feat(jans-lock): implement fetch policy stores #9423

olehbozhok · 2024-09-09T12:25:22Z

Prepare

Read PR guidelines
Read license information

Description

Target issue

Issue

closes #9365

Implementation Details

Was done small refactor. Extracted necessary elements to the init_engine crate.
Implementing the ways to get policy store:
- include as file
- HTTPS GET to public URI
Updated python bindings with new API and updated README to it.

The unit test will be implemented in the issue#9353

Test and Document the changes

Static code analysis has been run locally and issues have been fixed
Relevant unit and integration tests have been added/updated
Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

I confirm that there is no impact on the docs due to the code changes in this PR.

dryrunsecurity · 2024-09-09T12:25:37Z

DryRun Security Summary

The pull request covers various changes to the "cedarling" component of the Jans project, which is responsible for authorization and policy management, including updates to the authz module, the PolicyStore and BootstrapConfig structures, the init_engine module, and the Python bindings, with a focus on improving the structure, organization, and flexibility of the component while ensuring proper security practices are followed.

Expand for full summary

Summary:

The code changes in this pull request cover various aspects of the Jans project's "cedarling" component, which is responsible for authorization and policy management. The changes include updates to the authz module, the PolicyStore and BootstrapConfig structures, the init_engine module, and the Python bindings for the cedarling component.

From an application security perspective, the key points to highlight are:

Dependency Management: The changes introduce new dependencies, such as init_engine, cedar-policy, and ehttp. It's important to review these dependencies for any known security vulnerabilities and ensure they are properly managed and kept up-to-date.
JWT Handling: The code handles JSON Web Tokens (JWT) for authentication and authorization purposes. Proper validation and secure implementation of JWT handling is crucial to prevent security issues like token forgery and unauthorized access.
Policy Store and Configuration: The changes involve updating the policy store and configuration-related structures. Ensure that the policy data is properly validated, sanitized, and secured, and that the configuration options do not introduce any security risks.
Input Validation: When handling input from various sources, such as remote URIs or raw JSON data, it's essential to implement robust input validation and sanitization to prevent injection attacks and other security vulnerabilities.
Error Handling and Logging: The code includes extensive error handling and logging capabilities, which is a good security practice. Review the implementation to ensure that sensitive information is not accidentally logged and that errors are handled gracefully.

Overall, the changes appear to be focused on improving the structure, organization, and flexibility of the cedarling component, but it's crucial to review the implementation details to ensure that the application's security posture is maintained.

Files Changed:

jans-lock/cedarling/authz/Cargo.toml: Changes to the dependencies in the authz crate, including the removal of the derivative dependency and the addition of init_engine and jwt.
jans-lock/cedarling/README.md: Updates to the documentation, mentioning configuration files, a Python binding, and the need for Rust installation.
jans-lock/cedarling/authz/src/authz.rs: Refactoring of the Authz module, including the removal of the policy_store module and consolidation of configuration-related types.
jans-lock/cedarling/Cargo.toml: Addition of new workspace members and dependencies, including init_engine, cedar-policy, and ehttp.
jans-lock/cedarling/authz/src/lib.rs: Exposure of additional functionality from the init_engine module.
jans-lock/cedarling/authz/src/authz/jwt_data_handler.rs: Changes related to the handling and validation of JWT tokens.
jans-lock/cedarling/cedarling_python/Cargo.toml: Addition of the init_engine dependency in the Python binding.
jans-lock/cedarling/authz_run/src/main.rs: Changes to the policy store configuration, from LocalJson to JsonRaw.
jans-lock/cedarling/cedarling_python/example.py: Demonstration of using the PolicyStore, TokenMapper, BootstrapConfig, and Authz components in the Python binding.
jans-lock/cedarling/cedarling_python/README.md: Updates to the documentation, including instructions and explanations of the Python library's components.
jans-lock/cedarling/cedarling_python/src/config.rs: Changes to the TokenMapper and BootstrapConfig structs, including default implementations and trait implementations.
jans-lock/cedarling/cedarling_python/src/policy_store.rs: Updates to the PolicyStore struct and its creation methods.
jans-lock/cedarling/init_engine/src/lib.rs: Changes to the BootstrapConfig and TokenMapper structs, including the lack of JWT validation in the get_jwt_decoder() method.
jans-lock/cedarling/init_engine/src/policy_store.rs: Introduction of the `Policy

Code Analysis

We ran 9 analyzers against 16 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

…letion The cedarling_mvp branch was merged and subsequently deleted. This commit rebases the current changes from the main branch to keep the branch up to date. list of rebased commits: rust demo code without connect to python cargo improvements fix format rule add to gitignore files that is used in debug process add parsing roles from token and it mapping remove unused text in readme added guide how to build add python binding python example hotfix make Id in python example more illustrative update to make tokens field jti optional fix readme file feat: store the sample policy stores in demo folder #9373 Signed-off-by: Arnab Dutta <arnab.bdutta@gmail.com> rename role mapper to token mapper add loading policy store from file or json show in example that we can use setter use single quote for action in python example update python bindings to use object Request added crate init_engine refactor authz, move some parts to init_engine added skip check clippy::enum_variant_names Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

For some reason my git client start but out. Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

also updated the python binding. also renamed the enum PolicyStoreConfig::LocalJson to JsonRaw Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

…ibrary Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

moaz-mokhtar

Reviewed and thanks @olehbozhok

SafinWasi

Looks good to me.

… init PolicyStore using methods: - from_raw_json - from_filepath - from_remote_uri Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

…r windows we no need to install maturin[patchelf] Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

…he userinfo token Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

…ted among the available packages. Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

…uild-essential for cedarling_python Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

sonarqubecloud · 2024-09-10T08:11:22Z

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-09-10T08:12:07Z

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-09-10T08:12:12Z

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-09-10T08:12:33Z

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-09-10T08:12:39Z

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-09-10T08:12:53Z

Quality Gate passed for 'Fido2 API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarqubecloud · 2024-09-10T08:12:56Z

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

* chore(jans-cedarling): rebase from main after cedarling_mvp branch deletion The cedarling_mvp branch was merged and subsequently deleted. This commit rebases the current changes from the main branch to keep the branch up to date. list of rebased commits: rust demo code without connect to python cargo improvements fix format rule add to gitignore files that is used in debug process add parsing roles from token and it mapping remove unused text in readme added guide how to build add python binding python example hotfix make Id in python example more illustrative update to make tokens field jti optional fix readme file feat: store the sample policy stores in demo folder #9373 Signed-off-by: Arnab Dutta <arnab.bdutta@gmail.com> rename role mapper to token mapper add loading policy store from file or json show in example that we can use setter use single quote for action in python example update python bindings to use object Request added crate init_engine refactor authz, move some parts to init_engine added skip check clippy::enum_variant_names Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * chore: delete Readme.md For some reason my git client start but out. Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * chore(chedarling) rename PolicyStoreEntry to PolicyStore Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * feat(cedarling): added load PolicyStore from file and URI also updated the python binding. also renamed the enum PolicyStoreConfig::LocalJson to JsonRaw Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * docs(cedarling-python): added section Classes and Methods in python library Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * docs(cedarling): added to python binding documentation example how to init PolicyStore using methods: - from_raw_json - from_filepath - from_remote_uri Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * docs(cedarling): added to python binding documentation notice that for windows we no need to install maturin[patchelf] Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * docs(cedarling): added example how to extract the "role" claim from the userinfo token Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * docs(cedarling): added note that we should see `cedarling_python` listed among the available packages. Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> * doc(cedarling): added note that user on linux maybe need to install build-essential for cedarling_python Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> --------- Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com> Co-authored-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com> Former-commit-id: cea08b5

olehbozhok requested a review from yurem as a code owner September 9, 2024 12:25

mo-auto added the area-documentation Documentation needs to change as part of issue or PR label Sep 9, 2024

olehbozhok added 5 commits September 9, 2024 15:42

chore: delete Readme.md

4dd0283

For some reason my git client start but out. Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

chore(chedarling) rename PolicyStoreEntry to PolicyStore

74586ac

Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

feat(cedarling): added load PolicyStore from file and URI

0bd7a82

also updated the python binding. also renamed the enum PolicyStoreConfig::LocalJson to JsonRaw Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

docs(cedarling-python): added section Classes and Methods in python l…

1e39cd8

…ibrary Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

olehbozhok force-pushed the jans-cedaling-issue-9365 branch from 932bf56 to 1e39cd8 Compare September 9, 2024 12:44

moaz-mokhtar reviewed Sep 9, 2024

View reviewed changes

duttarnab requested review from SafinWasi, kdhttps and moabu September 9, 2024 17:12

SafinWasi changed the title ~~Jans cedaling issue 9365~~ feat(jans-lock): implement fetch policy stores Sep 9, 2024

mo-auto added the kind-feature Issue or PR is a new feature request label Sep 9, 2024

SafinWasi previously approved these changes Sep 9, 2024

View reviewed changes

docs(cedarling): added to python binding documentation example how to…

11d23b9

… init PolicyStore using methods: - from_raw_json - from_filepath - from_remote_uri Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

olehbozhok dismissed SafinWasi’s stale review via 4ac0aaa September 9, 2024 19:19

docs(cedarling): added to python binding documentation notice that fo…

9909ad0

…r windows we no need to install maturin[patchelf] Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

olehbozhok force-pushed the jans-cedaling-issue-9365 branch from 4ac0aaa to 9909ad0 Compare September 9, 2024 19:28

olehbozhok requested review from moaz-mokhtar and SafinWasi September 9, 2024 19:35

olehbozhok added 3 commits September 10, 2024 01:08

docs(cedarling): added example how to extract the "role" claim from t…

d01589c

…he userinfo token Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

docs(cedarling): added note that we should see cedarling_python lis…

dd1983c

…ted among the available packages. Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

doc(cedarling): added note that user on linux maybe need to install b…

9e9fa6b

…uild-essential for cedarling_python Signed-off-by: Oleh Bohzok <olehbozhok@gmail.com>

olehbozhok force-pushed the jans-cedaling-issue-9365 branch from 8c10d07 to 9e9fa6b Compare September 9, 2024 22:38

moabu approved these changes Sep 10, 2024

View reviewed changes

Merge branch 'main' into jans-cedaling-issue-9365

89d1700

moabu merged commit cea08b5 into main Sep 10, 2024
11 checks passed

moabu deleted the jans-cedaling-issue-9365 branch September 10, 2024 08:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(jans-lock): implement fetch policy stores #9423

feat(jans-lock): implement fetch policy stores #9423

olehbozhok commented Sep 9, 2024

dryrunsecurity bot commented Sep 9, 2024 •

edited

Loading

moaz-mokhtar left a comment

SafinWasi left a comment

sonarqubecloud bot commented Sep 10, 2024

sonarqubecloud bot commented Sep 10, 2024

sonarqubecloud bot commented Sep 10, 2024

sonarqubecloud bot commented Sep 10, 2024

sonarqubecloud bot commented Sep 10, 2024

sonarqubecloud bot commented Sep 10, 2024

sonarqubecloud bot commented Sep 10, 2024

feat(jans-lock): implement fetch policy stores #9423

feat(jans-lock): implement fetch policy stores #9423

Conversation

olehbozhok commented Sep 9, 2024

Prepare

Description

Target issue

Implementation Details

Test and Document the changes

dryrunsecurity bot commented Sep 9, 2024 • edited Loading

DryRun Security Summary

Code Analysis

Riskiness

moaz-mokhtar left a comment

Choose a reason for hiding this comment

SafinWasi left a comment

Choose a reason for hiding this comment

sonarqubecloud bot commented Sep 10, 2024

Quality Gate passed for 'jans-cli'

sonarqubecloud bot commented Sep 10, 2024

Quality Gate passed for 'Jans-Keycloak-Link'

sonarqubecloud bot commented Sep 10, 2024

Quality Gate passed for 'jans-linux-setup'

sonarqubecloud bot commented Sep 10, 2024

Quality Gate passed for 'jans-config-api-parent'

sonarqubecloud bot commented Sep 10, 2024

Quality Gate passed for 'jans-core'

sonarqubecloud bot commented Sep 10, 2024

Quality Gate passed for 'Fido2 API'

sonarqubecloud bot commented Sep 10, 2024

Quality Gate passed for 'SCIM API'

dryrunsecurity bot commented Sep 9, 2024 •

edited

Loading