Add support to access organization resources in tenant perspective #295
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -45,6 +45,7 @@ | |
| import org.wso2.carbon.identity.organization.management.authz.service.OrganizationManagementAuthorizationContext; | ||
| import org.wso2.carbon.identity.organization.management.service.constant.OrganizationManagementConstants; | ||
| import org.wso2.carbon.identity.organization.management.service.exception.OrganizationManagementException; | ||
| import org.wso2.carbon.identity.organization.management.service.util.OrganizationManagementUtil; | ||
| import org.wso2.carbon.utils.multitenancy.MultitenantConstants; | ||
|
|
||
| import java.io.IOException; | ||
|
|
@@ -85,25 +86,37 @@ public void invoke(Request request, Response response) throws IOException, Servl | |
| } | ||
|
|
||
| String requestURI = request.getRequestURI(); | ||
| String spTenantDomain = null; | ||
| String isAppSharedStr = null; | ||
| if (authenticationContext.getParameter("serviceProviderTenantDomain") != null) { | ||
| spTenantDomain = authenticationContext.getParameter("serviceProviderTenantDomain").toString(); | ||
| } | ||
| if (authenticationContext.getParameter("isAppShared") != null) { | ||
| isAppSharedStr = authenticationContext.getParameter("isAppShared").toString(); | ||
| } | ||
| // If the application is not a shared application and the tenant is an organization, skip the | ||
| // request validation for the tenant. | ||
| if (!isSubOrganizationApp(spTenantDomain, isAppSharedStr)) { | ||
| if (!isRequestValidForTenant(authenticationContext, authorizationContext, request)) { | ||
| /* | ||
| Forbidden the /o/<org-id> path requests if the org level authz failed and | ||
| resource is not cross tenant allowed or authenticated user doesn't belong to the accessed resource's org. | ||
| */ | ||
| if (requestURI.startsWith(ORGANIZATION_PATH_PARAM)) { | ||
| APIErrorResponseHandler.handleErrorResponse(authenticationContext, response, | ||
| HttpServletResponse.SC_FORBIDDEN, null); | ||
| return; | ||
| } | ||
| if (log.isDebugEnabled()) { | ||
| log.debug("Authorization to " + request.getRequestURI() | ||
| + " is denied because the authenticated user belongs to different tenant domain: " | ||
| + authenticationContext.getUser().getTenantDomain() | ||
| + " and cross-domain access for the tenant is disabled."); | ||
| } | ||
| APIErrorResponseHandler.handleErrorResponse(authenticationContext, response, | ||
| HttpServletResponse.SC_UNAUTHORIZED, null); | ||
| return; | ||
| } | ||
| } | ||
|
|
||
| if (!isUserEmpty(authenticationContext)) { | ||
|
|
@@ -299,4 +312,20 @@ private void startOrganizationBoundTenantFlow(String authorizedOrganization) { | |
| throw new AuthRuntimeException("Error while resolving tenant domain by organization.", e); | ||
| } | ||
| } | ||
|
|
||
| private boolean isSubOrganizationApp (String spTenantDomain, String isAppShared) { | ||
|
|
||
| try { | ||
| if (StringUtils.isNotEmpty(spTenantDomain) && StringUtils.isNotEmpty(isAppShared)) { | ||
| if (OrganizationManagementUtil.isOrganization(spTenantDomain) && !Boolean.parseBoolean(isAppShared)) { | ||
| return true; | ||
| } | ||
| } else { | ||
| return false; | ||
| } | ||
| } catch (OrganizationManagementException e) { | ||
| throw new AuthRuntimeException("Error while checking the tenant is an organization.", e); | ||
| } | ||
| return false; | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,13 +23,15 @@ | |
| import org.apache.catalina.connector.Request; | ||
| import org.apache.catalina.connector.Response; | ||
| import org.apache.catalina.valves.ValveBase; | ||
| import org.apache.commons.collections.CollectionUtils; | ||
| import org.apache.commons.lang.StringUtils; | ||
| import org.apache.commons.logging.Log; | ||
| import org.apache.commons.logging.LogFactory; | ||
| import org.slf4j.MDC; | ||
| import org.wso2.carbon.base.ServerConfiguration; | ||
| import org.wso2.carbon.context.PrivilegedCarbonContext; | ||
| import org.wso2.carbon.identity.base.IdentityRuntimeException; | ||
| import org.wso2.carbon.identity.context.rewrite.bean.OrganizationRewriteContext; | ||
| import org.wso2.carbon.identity.context.rewrite.bean.RewriteContext; | ||
| import org.wso2.carbon.identity.context.rewrite.internal.ContextRewriteValveServiceComponentHolder; | ||
| import org.wso2.carbon.identity.core.util.IdentityConfigParser; | ||
|
|
@@ -41,8 +43,10 @@ | |
| import java.io.IOException; | ||
| import java.util.ArrayList; | ||
| import java.util.Collections; | ||
| import java.util.Comparator; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.Optional; | ||
| import java.util.regex.Pattern; | ||
|
|
||
| import javax.servlet.ServletException; | ||
|
|
@@ -59,6 +63,7 @@ | |
| public class TenantContextRewriteValve extends ValveBase { | ||
|
|
||
| private static List<RewriteContext> contextsToRewrite; | ||
| private static List<OrganizationRewriteContext> contextsToRewriteInTenantPerspective; | ||
| private static List<String> contextListToOverwriteDispatch; | ||
| private static List<String> ignorePathListForOverwriteDispatch; | ||
| private static List<String> organizationRoutingOnlySupportedAPIPaths; | ||
|
|
@@ -73,6 +78,7 @@ protected synchronized void startInternal() throws LifecycleException { | |
| super.startInternal(); | ||
| // Initialize the tenant context rewrite valve. | ||
| contextsToRewrite = getContextsToRewrite(); | ||
| contextsToRewriteInTenantPerspective = getContextsToRewriteInTenantPerspective(); | ||
| contextListToOverwriteDispatch = getContextListToOverwriteDispatchLocation(); | ||
| ignorePathListForOverwriteDispatch = getIgnorePathListForOverwriteDispatch(); | ||
| isTenantQualifiedUrlsEnabled = isTenantQualifiedUrlsEnabled(); | ||
|
|
@@ -110,6 +116,26 @@ public void invoke(Request request, Response response) throws IOException, Servl | |
| } | ||
| } | ||
|
|
||
| outerLoop: | ||
| for (OrganizationRewriteContext context : contextsToRewriteInTenantPerspective) { | ||
| Pattern patternTenantPerspective = Pattern.compile("^/t/[^/]+/o/[a-f0-9\\-]+?" + context.getContext()); | ||
| if (patternTenantPerspective.matcher(requestURI).find() && CollectionUtils.isNotEmpty(context.getSubPaths())) { | ||
| for (Pattern subPath : context.getSubPaths()) { | ||
| if (subPath.matcher(requestURI).find()) { | ||
| isContextRewrite = true; | ||
| isWebApp = context.isWebApp(); | ||
| contextToForward = context.getContext(); | ||
| int startIndex = requestURI.indexOf("/o/") + 3; | ||
| int endIndex = requestURI.indexOf("/", startIndex); | ||
| String appOrgId = requestURI.substring(startIndex, endIndex); | ||
| PrivilegedCarbonContext.getThreadLocalCarbonContext(). | ||
| setApplicationResidentOrganizationId(appOrgId); | ||
| break outerLoop; | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| String tenantDomain = PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantDomain(); | ||
| try { | ||
| MDC.put(TENANT_DOMAIN, tenantDomain); | ||
|
|
@@ -135,7 +161,8 @@ public void invoke(Request request, Response response) throws IOException, Servl | |
| Ex-: Request: /t/<tenant-domain>/o/api/server/v1/applications --> /o/server/v1/applications | ||
| */ | ||
| if (!requestURI.startsWith(ORGANIZATION_PATH_PARAM) && | ||
| requestURI.contains(ORGANIZATION_PATH_PARAM) && | ||
| !isOrganizationIdAvailableInTenantPerspective(requestURI)) { | ||
| dispatchLocation = "/o" + dispatchLocation; | ||
| } | ||
| if (contextListToOverwriteDispatch.contains(contextToForward) && !isIgnorePath(dispatchLocation)) { | ||
|
|
@@ -151,7 +178,10 @@ public void invoke(Request request, Response response) throws IOException, Servl | |
| requestURI = requestURI.replace(carbonWebContext + "/", ""); | ||
| } | ||
| //Servlet | ||
| if (StringUtils.isEmpty(PrivilegedCarbonContext.getThreadLocalCarbonContext() | ||
| .getApplicationResidentOrganizationId())) { | ||
| requestURI = requestURI.replace("/t/" + tenantDomain, ""); | ||
| } | ||
| request.getRequestDispatcher(requestURI).forward(request, response); | ||
| } | ||
| } | ||
|
|
@@ -176,6 +206,11 @@ public void invoke(Request request, Response response) throws IOException, Servl | |
| } | ||
| } | ||
|
|
||
| private boolean isOrganizationIdAvailableInTenantPerspective(String requestURI) { | ||
|
|
||
| return Pattern.compile("^/t/[^/]+/o/[a-f0-9\\-]+?").matcher(requestURI).find(); | ||
| } | ||
|
|
||
| private void unsetMDCThreadLocals() { | ||
|
|
||
| MDC.remove(TENANT_DOMAIN); | ||
|
|
@@ -217,6 +252,51 @@ private List<RewriteContext> getContextsToRewrite() { | |
| return rewriteContexts; | ||
| } | ||
|
|
||
| private List<OrganizationRewriteContext> getContextsToRewriteInTenantPerspective() { | ||
ShanChathusanda93 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| List<OrganizationRewriteContext> organizationRewriteContexts = new ArrayList<>(); | ||
| Map<String, Object> configuration = IdentityConfigParser.getInstance().getConfiguration(); | ||
| Object webAppBasePathContexts = configuration.get("OrgContextsToRewriteInTenantPerspective.WebApp.Context." + | ||
| "BasePath"); | ||
| setOrganizationRewriteContexts(organizationRewriteContexts, webAppBasePathContexts, true); | ||
|
|
||
| Object webAppSubPathContexts = configuration.get("OrgContextsToRewriteInTenantPerspective.WebApp.Context." + | ||
| "SubPaths.Path"); | ||
| setSubPathContexts(organizationRewriteContexts, webAppSubPathContexts); | ||
|
|
||
| return organizationRewriteContexts; | ||
| } | ||
|
|
||
| private void setOrganizationRewriteContexts(List<OrganizationRewriteContext> organizationRewriteContexts, | ||
| Object basePathContexts, boolean isWebApp) { | ||
|
|
||
| if (basePathContexts != null) { | ||
| if (basePathContexts instanceof ArrayList) { | ||
| for (String context : (ArrayList<String>) basePathContexts) { | ||
| organizationRewriteContexts.add(new OrganizationRewriteContext(isWebApp, context)); | ||
| } | ||
| } else { | ||
| organizationRewriteContexts.add(new OrganizationRewriteContext(isWebApp, | ||
| basePathContexts.toString())); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private void setSubPathContexts(List<OrganizationRewriteContext> organizationRewriteContexts, | ||
| Object subPathContexts) { | ||
|
|
||
| if (subPathContexts instanceof ArrayList) { | ||
| for (String subPath : (ArrayList<String>) subPathContexts) { | ||
| Optional<OrganizationRewriteContext> maybeOrgRewriteContext = organizationRewriteContexts.stream() | ||
| .filter(rewriteContext -> subPath.startsWith(rewriteContext.getContext())) | ||
| .max(Comparator.comparingInt(rewriteContext -> rewriteContext.getContext().length())); | ||
| maybeOrgRewriteContext.ifPresent( | ||
| organizationRewriteContext -> organizationRewriteContext.addSubPath( | ||
| Pattern.compile("^/t/[^/]+/o/[a-f0-9\\-]+" + subPath))); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Get context list to overwrite dispatch location. | ||
| * | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -430,7 +430,7 @@ | |
| <identity.framework.version>7.3.13</identity.framework.version> | ||
| <carbon.identity.package.import.version.range>[5.17.8, 8.0.0)</carbon.identity.package.import.version.range> | ||
|
|
||
| <org.wso2.carbon.identity.oauth.version>7.0.192</org.wso2.carbon.identity.oauth.version> | ||
| <org.wso2.carbon.identity.oauth.import.version.range>[6.2.18, 8.0.0) | ||
| </org.wso2.carbon.identity.oauth.import.version.range> | ||
|
|
||
|
|
@@ -452,8 +452,8 @@ | |
| <osgi.util.tracker.imp.pkg.version.range>[1.5.1, 2.0.0)</osgi.util.tracker.imp.pkg.version.range> | ||
|
|
||
| <!-- Carbon Kernel version --> | ||
| <carbon.kernel.version>4.10.26</carbon.kernel.version> | ||
| <carbon.kernel.feature.version>4.10.0</carbon.kernel.feature.version> | ||
| <carbon.kernel.imp.pkg.version.range>[4.5.0, 5.0.0)</carbon.kernel.imp.pkg.version.range> | ||
|
|
||
| <!--Carbon Component version--> | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
applicationResidentTenantDomain