chore!: casa installer adjustment for agama flow

[devrimyatar]

closes #8851

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request primarily focuses on the configuration and deployment of the Jans Casa application and its associated Agama project, including updates to the LDAP time formatting utility, the JVM configuration, the LDAP configuration, and the installation and configuration process, which should be carefully reviewed to ensure that the authentication mechanisms, sensitive data handling, and overall security posture of the application are not compromised.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on the configuration and deployment of the Jans Casa application and its associated Agama project. The changes include updates to the LDAP time formatting utility, the JVM configuration for the Jans Casa application, the LDAP configuration for the Agama project deployment, and the installation and configuration process for the Jans Casa application.

From an application security perspective, the changes do not appear to introduce any obvious security vulnerabilities. However, it is important to review the changes carefully to ensure that the authentication mechanisms, sensitive data handling, and overall security posture of the application are not compromised.

Specifically, the review should focus on the following areas:

1. Ensuring that the authentication mechanisms and providers used by the Jans Casa application are implemented securely.
2. Verifying that the handling of sensitive information, such as the base64-encoded Agama project assets, follows best practices and does not introduce any vulnerabilities.
3. Thoroughly reviewing the custom "BADA-BADA" script and the integration of the Agama project to ensure that they do not introduce any security risks.
4. Confirming that the removal of the "person_authentication_script.ldif" file does not impact the overall security of the authentication process.

By addressing these security considerations, the application security engineer can help ensure that the changes in this pull request do not introduce any security vulnerabilities and maintain the overall security posture of the Jans Casa application.

Files Changed:

1. jans-linux-setup/jans_setup/setup_app/utils/setup_utils.py:

   • The changes in this file are related to the get_ldap_time() function, which is responsible for generating a timestamp in the LDAP time format. The changes do not introduce any obvious security concerns.

2. jans-linux-setup/jans_setup/templates/jetty/jans-casa:

   • The changes in this file update the JAVA_OPTIONS parameter for the Jans Casa application, including the addition of a new setting -Dacr=agama_io.jans.casa.authn.main. This change should be reviewed to ensure that the authentication mechanism or provider is implemented securely.

3. jans-linux-setup/jans_setup/templates/jans-casa/configuration.ldif:

   • The changes in this file introduce a new entry for the Agama project deployment, including metadata and base64-encoded assets. The handling of this sensitive information should be reviewed to ensure that it does not introduce any security vulnerabilities.

4. jans-linux-setup/jans_setup/setup_app/installers/jans_casa.py:

   • The changes in this file include the addition of the "casa-agama-project.zip" file, the enabling of a custom "BADA-BADA" script, and the removal of the "person_authentication_script.ldif" file. These changes should be thoroughly reviewed to ensure that they do not introduce any security risks or compromise the overall security of the Jans Casa application.

Code Analysis

We ran 9 analyzers against 5 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud