osiam / resource-server

[DEPRECATED] OSIAM resource server

OSIAM - Open Source Identity and Access Management

Active development of this project has stopped.

OSIAM is a secure identity management solution providing REST based services for authentication and authorization. We achieve this by implementing two important open standards:

• OAuth 2.0
• SCIM 2.0

OSIAM is published under the MIT licence, giving you the greatest freedom possible to utilize OSIAM in you project or product. Watch our blog to stay informed about releases and upcoming changes.

Use cases

• Single app with OSIAM as free backing store for users and groups and local auth service.
• Distributed app with OSIAM as central identity store and auth service.
• Publish your app's API with OSIAM as auth service for 3rd-parties and allow safe access to your user's data.

Quick Start

Download the latest version of OSIAM:

curl -L https://dl.bintray.com/osiam/downloads/osiam/3.0/osiam-3.0.war -o osiam.war

Make the .war file executable:

chmod +x osiam.war

Start OSIAM:

./osiam.war

After some seconds, OSIAM should be fully running. You can now retrieve your first access token:

curl -H "Authorization: Basic ZXhhbXBsZS1jbGllbnQ6c2VjcmV0" -X POST -d "grant_type=client_credentials&scope=ADMIN" http://localhost:8080/oauth/token

You can now start to setup OSIAM, by changing the administrator's password and add your own OAuth client. Please see the Installation and Configuration Manual for details.

Documentation

Learn how to install and configure OSIAM for production in the documentation.

Components

• osiam handles the authentication and authorization based on OAuth 2.0 and holds the SCIM based user data
• addon-self-administration provides account management self-service as a web application
• addon-administration lets you administer users and groups via a web application

Easy customization

Every visual aspect of OSIAM's components can be easily customized by supplying your own templates, stylesheets and scripts to make OSIAM integrate seamlessly with your application. Read the customization guide to learn more.

Snapshots

To use the latest snapshot of OSIAM just download it from JFrog OSS: https://oss.jfrog.org/repo/org/osiam/osiam/latest-SNAPSHOT/

Scroll down to the bottom of the page and select the latest WAR file.

Issue Tracker

Please report issues, bugs and feature requests via [the issue tracker] (https://github.com/osiam/osiam/issues).

Get involved

Help is very appreciated. Please read the contributors guide to learn how to get started.

resource-server's Issues

Hibernate naming strategy

The default naming strategy of hibernate is the EJB3NamingStrategy. The strategy maps camel case attributes like userName to the column name username. When switching to Spring Boot, the default naming strategy is set by Boot to ImprovedNamingStrategy. This leads to problems with the column names of camel case entity attributes which are not annotated with @Column and a set name parameter (e.g. @column(name = "username") ). I think we should use the ImprovedNamingStrategy before migrate to Spring Boot and add flyway migrations for postgres and mysql to use underscores for mixed case names.

Improve handling of parallel requests

Like already did for the 2.x branch, we should improve the handling of parallel request.

Make Prototype for spring-restdocs

As discussed in osiam/osiam#29, we should write some REST-API docs using spring-restdocs to get a clear impression on it's capabilities. The resource-server should be a good place to start, I think.

Build Docker images in this repo

This repo should contain stuff so that a Docker image can be build. It should be possible to build it as a trusted image on the Hub and also for local testing during development. This can be achieved in the following way:

The install script that runs during the build process checks if there is a locally-built war file in the target folder and uses this. Otherwise it installs Maven, etc. and builds the war itself or downloads it from the central/Sonatype snapshots or something else.

Write unit tests for OsiamController

The OsiamController and the underlying SCIMExtensionProvisioning service layer isn't tested!

When the postalCode is not set, the json output includes the string 'null'

If a user will be created with an address and the postalCode is not set, the postalCode will be include as 'null' String in the json output of the user.

Set GroupRef Type

Moved from Jira:

It looks like, that the types of a User GroupRef is not set probably.
Also the indirect Group refs. of a User are not set at all.
At least this should be checked if it is working.

Build Debian packages in this repo

This repo should contain stuff so that a Debian package can be build. It's still open whether we should use vanilla Debian packaging scripts and stuff, or maybe use the excellent pkg-maven-plugin. I would recommend the pkg-maven-plugin.

Search filter cuts string query, when using not supported operator and fired no exception

Moved from Jira:

When using = instead of eq in the string filter with the OsiamConnector, the filter string will be cut and no exception fired.

Right filter string:
"userName eq "user1" and name.formatted eq "formatted1""
-> both constraints will be used

Wrong filter strings:
"userName eg "user1" and name.formatted = "formatted1""
-> just uses the first constraint, the second will be cut

"userName = "user1" and name.formatted = "formatted1""
-> exception fired: org.osiam.client.exception.ConflictException: no viable alternative at input 'userName"user1"'

Spring Boot fat war

As a pre step to a fully standalone application in form of a Spring Boot fat jar, we should migrate the resource-server after the configuration migration to a fat war which is deployable like before. This was already done in the self-administration and we made good experience with the split into small migration steps. Next stop: fat jar!

Problem with "not"-Filter

Moved from osiam/server#247

@sschum:

It seams that is a bug in the filter mechanism. Even if I use the "not" filter, the result is not that what I would expect!

For example:

1. I want to search all users that are NOT included in a given group. Than I want to use the following filter: not(groups eq "<groupId>")
2. I want to search all groups in which is the user NOT a member. Than I want to use the following filter: not(members eq "<userId>")

In the following I have create a little JUnit-Test-File. In there the use-cases demonstrated.
EDIT: here is the gist-link: https://gist.github.com/sschum/ad6a09a2e70ae95ad1ce

@dacrome:

I will check this bug. Thanks for sharing!

...and please post your example code next time in a gist and copy the link here :) or you open a PR to the integration-tests of OSIAM for easy verify :) thank you!

Switch to YAML configuration

Using properties files is not really an optimal way to configure this application. As discussed here, we decided to switch to YAML.

Switch to standalone application

After #21 has been solved, we can move on and finally switch to a standalone, runnable .jar deployment. This does not contain switching to YAML files, which will be done in a separate step.

Wrong schema for SCIMSearchResult

Moved from Jira:

the schema in the ScimSearchResult ist at the moment e.g.

[urn:scim:schemas:core:2.0:User]

But according to
http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.2.2
it should be like
["urn:scim:schemas:core:2.0:ListResponse"]

Switch to a Spring Boot standalone application with runnable fat JAR

This is the umbrella issue for the transition of this component to a Spring Boot standalone application with an executable fat JAR. See also osiam/osiam#5 for the initial reasons and discussion.

Tasks that have to be done:

• Change Hibernate naming strategy (#11)
• Switch from XML to Java configuration (Issue: #20 / PR: #50)
• Introduce Spring Boot, but keep WAR deployment (#21 / PR: #53)
• Switch to YAML configration (#44)
• Switch to standalone application (#45)

Please, maintain this list, if you add new issues or close existing ones.

Error responses not SCIM compliant

The current implementation of error returns is not adhering to the SCIM 2.0 spec. This has to be fixed, if we want to be truly SCIM 2.0 compliant.

Resources with only 'primary' sub-attribute set should be rejected

Currently it is possible to create a user with multi-valued attributes where only the sub-attribute 'primary' is set. This should not be possible, a multi-valued attribute should only be valid if at least one of the sub-attributes are set that needed for the identification of the resource.

Replace MeasureDurationTimeOfMethods with @Timed

At this time the resource server is using a custom AOP aspect to measure the time a method is running (org.osiam.resources.helper.MeasureDurationTimeOfMethods). This should be replaced with Metrics' @timed annotation.

Create meaningful log message if auth-server can't be reached.

As @mirabilos pointed out in auth-server#55 the resource server doesn't generate a meaningful log message if it refuses to validate an access token because of an unreachable auth server.

Run the resource-server as a standalone application

Like already discussed in the OSIAM umbrella repo, the time is right to support standalone application with Spring Boot fat jars. I already created pre steps in form of issues in this repo, to reach the goal of a standalone application without the currently ugly deployment!

Remove unnecessary AOP profiling feature

We have the home grown profiling solution that is implemented as an aspect in MeasureDurationTimeOfMethods. It never was the most elegant solution to begin with and since we have introduced the most excellent metrics framework it is now time for this implementation to go. I suggest that we remove it.

Handle all exceptions when using connector

In AccessTokenValidationService currently not all possible exceptions thrown by the connector are handled. I already descibed a possible solution how they could be handled.

Update User with PATCH: add and delete same email address depends on the order

When updating a user's email address in way that removes the email address and then adds it back again, the order of the respective statements matters. This is wrong regarding the SCIM 2.0 spec that states something like: first values that are marked for deletion have to be removed, and then new values should be added.

Steps to reproduce:

1. Create a new User with an email address

2. Create an UpdateUser and add and then delete the email address:

   Email email = user.getEmails().get(0);
   UpdateUser updateUser = new UpdateUser.Builder()
           .addEmail(email)
           .deleteEmail(email)
           .build();
   

3. Update the User

Expected result:

The User has not been changed.

Actual result:

The User's email address has been deleted

See also: osiam/connector4java-integration-tests#253

Add /RessourceTypes endpoint

The section about Service Provider Configuration Endpoints of the SCIM Specification describes a /RessourceTypes endpoint that enables clients to discover the list of supported ResourceTypes.

Switch to SLF4J for logging

Currently a combination of log4j and JUL is used.

Metrics broken

Since #20/#50 the /Metrics endpoint does not report any data. This obviously happened because no one configured it within the new Java config. See https://github.com/ryantenney/metrics-spring#basic-usage for details.

Databse connection pooling

It would be beneficiary to the overall performance if we had database connection pools.

Switch from xml to java configuration

The xml configuration should be removed and migrate to java configuration. The Spring Framework provides java configuration since version 3.1 and this can be done as a first step to Spring Boot. We already made good experience with the configuration migration in the self-administration. We should check if this step can be used to migrate Spring OAuth2 version 1.0.5.RELEASE to the latest version 2.0.7.RELEASE to take advantage of the new configuration annotations. Maybe also a bump of the Spring Security version to the latest 4.0.1.RELEASE is possible.

Remove SSLRequestLoggingFilter

As discussed in osiam/osiam#12, we want to get rid of the annoying SSLRequestLoggingFilter.

Extend sorting logic to handle extension fields

Moved from Jira.

Deploy to Bintray snapshots with CircleCI

Request server version

Severity: wishlist

Please add a request that returns the version of the OSIAM resource server that is actually running, including an indication that it’s the OSIAM resource server (to avoid problems like deploying resource server as osiam-auth-server.war caused by a copy/paste mistake). For this reason, please choose a harmonised request path, and make it accessible without auth.

Group member "type" value returns null

Moved from Jira

When using getValue() on a group member you get the UUID, but you can not get the type via getType(). It always return null.

Add /Schemas endpoint

The section about Service Provider Configuration Endpoints of the SCIM Specification describes a /Schemas endpoint that enables clients to discover the list of supported Schemas.

Properties for Connection-Pool

We need properties for the connection pool (how many connection and the connection timeout) of the internal connector4java. And we need also a property for the DB-Pool-Size (hikari).

Add configurable password constraints

one should be able to define password constraints at configuration/deployment time. we should start with minimal length constraints and add something like character classes later on. constraints should be configurable via the main configuration file (resource-server.properties at the time of writing). also, the connector(s) have to be extended to support the new behavior (like throwing an exception or something).