|
16 | 16 |
|
17 | 17 | package io.apicurio.registry.auth; |
18 | 18 |
|
19 | | -import io.apicurio.common.apps.config.Info; |
20 | | -import io.apicurio.common.apps.multitenancy.ApicurioTenantContext; |
21 | | -import io.apicurio.common.apps.multitenancy.MultitenancyProperties; |
22 | | -import io.apicurio.common.apps.multitenancy.TenantContext; |
23 | | -import io.apicurio.common.apps.multitenancy.exceptions.TenantNotAuthorizedException; |
24 | 19 | import io.quarkus.security.ForbiddenException; |
25 | 20 | import io.quarkus.security.UnauthorizedException; |
26 | 21 | import io.quarkus.security.identity.SecurityIdentity; |
|
30 | 25 | import jakarta.interceptor.AroundInvoke; |
31 | 26 | import jakarta.interceptor.Interceptor; |
32 | 27 | import jakarta.interceptor.InvocationContext; |
33 | | -import org.eclipse.microprofile.config.inject.ConfigProperty; |
34 | 28 | import org.eclipse.microprofile.jwt.JsonWebToken; |
35 | 29 | import org.slf4j.Logger; |
36 | 30 |
|
37 | | -import java.util.List; |
38 | | -import java.util.Optional; |
39 | | - |
40 | 31 | /** |
41 | 32 | * This class implements authorization logic for the registry. It is driven by a combination of the |
42 | 33 | * security identity (authenticated user) and configured security level of the operation the user is |
43 | | - * attempting to perform. In a multitenant deployment, this authorization interceptor also checks if |
44 | | - * the user accessing the tenant has the proper permission level. This interceptor will be triggered |
| 34 | + * attempting to perform. This interceptor will be triggered |
45 | 35 | * for any method that is annotated with the {@link Authorized} annotation. Please ensure that all |
46 | 36 | * JAX-RS operations are propertly annotated. |
47 | 37 | * |
@@ -73,35 +63,9 @@ public class AuthorizedInterceptor { |
73 | 63 | @Inject |
74 | 64 | OwnerBasedAccessController obac; |
75 | 65 |
|
76 | | - @Inject |
77 | | - MultitenancyProperties mtProperties; |
78 | | - |
79 | | - @Inject |
80 | | - TenantContext tenantContext; |
81 | | - |
82 | | - @ConfigProperty(name = "registry.organization-id.claim-name") |
83 | | - @Info(category = "mt", description = "Organization ID claim name", availableSince = "2.1.0.Final") |
84 | | - List<String> organizationIdClaims; |
85 | | - |
86 | 66 | @AroundInvoke |
87 | 67 | public Object authorizeMethod(InvocationContext context) throws Exception { |
88 | 68 |
|
89 | | - //execute multitenancy related authorization checks |
90 | | - if (mtProperties.isMultitenancyEnabled()) { |
91 | | - |
92 | | - //if multitenancy is enabled but no tenant context is loaded, because no tenant was resolved from request, reject it |
93 | | - //this is to avoid access to default tenant "_" when multitenancy is enabled |
94 | | - if (!tenantContext.isLoaded()) { |
95 | | - log.warn("Request is rejected because the tenant could not be found, and access to default tenant is disabled in a multitenant deployment"); |
96 | | - throw new ForbiddenException("Default tenant access is not allowed in multitenancy mode."); |
97 | | - } |
98 | | - |
99 | | - //If multitenancy authorization is enabled, check tenant access. |
100 | | - if (mtProperties.isMultitenancyAuthorizationEnabled()) { |
101 | | - checkTenantAuthorization(tenantContext.currentContext()); |
102 | | - } |
103 | | - } |
104 | | - |
105 | 69 | // If the user is trying to invoke a role-mapping operation, deny it if |
106 | 70 | // database based RBAC is not enabled. |
107 | 71 | RoleBasedAccessApiOperation rbacOpAnnotation = context.getMethod().getAnnotation(RoleBasedAccessApiOperation.class); |
@@ -174,36 +138,4 @@ public Object authorizeMethod(InvocationContext context) throws Exception { |
174 | 138 |
|
175 | 139 | return context.proceed(); |
176 | 140 | } |
177 | | - |
178 | | - private void checkTenantAuthorization(ApicurioTenantContext tenant) { |
179 | | - if (authConfig.isAuthEnabled()) { |
180 | | - if (!isTokenResolvable()) { |
181 | | - log.debug("Tenant access attempted without JWT token for tenant {} [allowing because some endpoints allow anonymous access]", tenant.getTenantId()); |
182 | | - return; |
183 | | - } |
184 | | - String accessedOrganizationId = null; |
185 | | - |
186 | | - for (String organizationIdClaim : organizationIdClaims) { |
187 | | - final Optional<Object> claimValue = jsonWebToken.get().claim(organizationIdClaim); |
188 | | - if (claimValue.isPresent()) { |
189 | | - accessedOrganizationId = (String) claimValue.get(); |
190 | | - break; |
191 | | - } |
192 | | - } |
193 | | - |
194 | | - if (null == accessedOrganizationId || !tenantCanAccessOrganization(tenant, accessedOrganizationId)) { |
195 | | - log.warn("User not authorized to access tenant."); |
196 | | - throw new TenantNotAuthorizedException("Tenant not authorized"); |
197 | | - } |
198 | | - } |
199 | | - } |
200 | | - |
201 | | - private boolean isTokenResolvable() { |
202 | | - return jsonWebToken.isResolvable() && jsonWebToken.get().getRawToken() != null; |
203 | | - } |
204 | | - |
205 | | - private boolean tenantCanAccessOrganization(ApicurioTenantContext tenant, String accessedOrganizationId) { |
206 | | - return tenant == null || accessedOrganizationId.equals(tenant.getOrganizationId()); |
207 | | - } |
208 | | - |
209 | 141 | } |
0 commit comments