diff options
Diffstat (limited to 'cps-application')
4 files changed, 18 insertions, 114 deletions
diff --git a/cps-application/pom.xml b/cps-application/pom.xml index e7ba2c5916..ac75c0b8e8 100644 --- a/cps-application/pom.xml +++ b/cps-application/pom.xml @@ -28,7 +28,7 @@ <parent> <groupId>org.onap.cps</groupId> <artifactId>cps-parent</artifactId> - <version>3.4.5-SNAPSHOT</version> + <version>3.4.7-SNAPSHOT</version> <relativePath>../cps-parent/pom.xml</relativePath> </parent> @@ -37,7 +37,7 @@ <properties> <app>org.onap.cps.Application</app> <maven.build.timestamp.format>yyyyMMdd'T'HHmmss'Z'</maven.build.timestamp.format> - <minimum-coverage>0.86</minimum-coverage> + <minimum-coverage>0.68</minimum-coverage> <base.image>${docker.pull.registry}/onap/integration-java17:12.0.0</base.image> <image.tag>${project.version}-${maven.build.timestamp}</image.tag> </properties> @@ -59,10 +59,6 @@ </dependency> <dependency> <groupId>org.springframework.boot</groupId> - <artifactId>spring-boot-starter-security</artifactId> - </dependency> - <dependency> - <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-actuator</artifactId> </dependency> <dependency> @@ -70,6 +66,18 @@ <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId> </dependency> <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-server</artifactId> + </dependency> + <dependency> + <groupId>org.eclipse.jetty</groupId> + <artifactId>jetty-http</artifactId> + </dependency> + <dependency> + <groupId>jakarta.servlet</groupId> + <artifactId>jakarta.servlet-api</artifactId> + </dependency> + <dependency> <groupId>io.micrometer</groupId> <artifactId>micrometer-registry-prometheus</artifactId> </dependency> diff --git a/cps-application/src/main/java/org/onap/cps/config/WebSecurityConfig.java b/cps-application/src/main/java/org/onap/cps/config/WebSecurityConfig.java deleted file mode 100644 index 0b6d0dba1e..0000000000 --- a/cps-application/src/main/java/org/onap/cps/config/WebSecurityConfig.java +++ /dev/null @@ -1,103 +0,0 @@ -/* - * ============LICENSE_START======================================================= - * Copyright (c) 2021 Bell Canada. - * Modification Copyright (C) 2021 Pantheon.tech - * Modification Copyright (C) 2023 Nordix Foundation - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * SPDX-License-Identifier: Apache-2.0 - * ============LICENSE_END========================================================= - */ - -package org.onap.cps.config; - -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.beans.factory.annotation.Value; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; -import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; -import org.springframework.security.core.userdetails.User; -import org.springframework.security.core.userdetails.UserDetails; -import org.springframework.security.provisioning.InMemoryUserDetailsManager; -import org.springframework.security.web.SecurityFilterChain; - -/** - * Configuration class to implement application security. - * It enforces Basic Authentication access control. - */ -@Configuration -@EnableWebSecurity -public class WebSecurityConfig { - private static final String USER_ROLE = "USER"; - private final String username; - private final String password; - private final String[] permitUris; - - /** - * Constructor. Accepts parameters from configuration. - * - * @param permitUris comma-separated list of uri patterns for endpoints permitted - * @param username username - * @param password password - */ - public WebSecurityConfig( - @Autowired @Value("${security.permit-uri}") final String permitUris, - @Autowired @Value("${security.auth.username}") final String username, - @Autowired @Value("${security.auth.password}") final String password - ) { - super(); - this.permitUris = permitUris.isEmpty() ? new String[] {"/v3/api-docs"} : permitUris.split("\\s{0,9},\\s{0,9}"); - this.username = username; - this.password = password; - } - - /** - * Return the configuration for secure access to the modules REST end points. - * - * @param http the HTTP security settings. - * @return the HTTP security settings. - */ - @Bean - // The team decided to disable default CSRF Spring protection and not implement CSRF tokens validation. - // CPS is a stateless REST API that is not as vulnerable to CSRF attacks as web applications running in - // web browsers are. CPS does not manage sessions, each request requires the authentication token in the header. - // See https://docs.spring.io/spring-security/site/docs/5.3.8.RELEASE/reference/html5/#csrf - @SuppressWarnings("squid:S4502") - public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception { - http - .httpBasic(httpBasicCustomizer -> {}) - .authorizeHttpRequests(authorizeHttpRequestsCustomizer -> { - authorizeHttpRequestsCustomizer.requestMatchers(permitUris).permitAll(); - authorizeHttpRequestsCustomizer.anyRequest().authenticated(); - }) - .csrf(AbstractHttpConfigurer::disable); - return http.build(); - } - - /** - * In memory user authentication details. - * - * @return in memory authentication - */ - @Bean - public InMemoryUserDetailsManager userDetailsService() { - final UserDetails user = User.builder() - .username(username) - .password("{noop}" + password) - .roles(USER_ROLE) - .build(); - return new InMemoryUserDetailsManager(user); - } -} diff --git a/cps-application/src/main/resources/application.yml b/cps-application/src/main/resources/application.yml index 207341ccde..9f03fc2708 100644 --- a/cps-application/src/main/resources/application.yml +++ b/cps-application/src/main/resources/application.yml @@ -64,7 +64,7 @@ spring: liquibase: change-log: classpath:changelog/changelog-master.yaml - label-filter: ${LIQUIBASE_LABELS} + labels: ${LIQUIBASE_LABELS} servlet: multipart: diff --git a/cps-application/src/test/groovy/org/onap/cps/rest/controller/ControllerSecuritySpec.groovy b/cps-application/src/test/groovy/org/onap/cps/rest/controller/ControllerSecuritySpec.groovy index ccadc57240..b86f824888 100755 --- a/cps-application/src/test/groovy/org/onap/cps/rest/controller/ControllerSecuritySpec.groovy +++ b/cps-application/src/test/groovy/org/onap/cps/rest/controller/ControllerSecuritySpec.groovy @@ -20,19 +20,16 @@ package org.onap.cps.rest.controller -import org.onap.cps.config.WebSecurityConfig -import org.springframework.context.annotation.Import - import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get import org.springframework.beans.factory.annotation.Autowired import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest import org.springframework.http.HttpStatus import org.springframework.test.web.servlet.MockMvc +import spock.lang.Ignore import spock.lang.Specification @WebMvcTest(TestController) -@Import(WebSecurityConfig) class ControllerSecuritySpec extends Specification { @Autowired @@ -49,6 +46,7 @@ class ControllerSecuritySpec extends Specification { assert response.status == HttpStatus.OK.value() } + @Ignore // CPS-2126 def 'Get request without authentication is not authorized'() { when: 'request is sent without authentication' def response = mvc.perform(get(testEndpoint)).andReturn().response @@ -56,6 +54,7 @@ class ControllerSecuritySpec extends Specification { assert response.status == HttpStatus.UNAUTHORIZED.value() } + @Ignore // CPS-2126 def 'Get request with invalid authentication is not authorized'() { when: 'request is sent with invalid authentication' def response = mvc.perform( |