security: Users can only access their own resources

fix: Make sure JWTs from Keycloak are understood and CORS is respected

module-server/src/main/kotlin/de/twomartens/timetable/auth/UserController.kt

@@ -14,6 +14,9 @@ import io.swagger.v3.oas.annotations.tags.Tag
 import org.mapstruct.factory.Mappers
 import org.springframework.http.HttpStatus
 import org.springframework.http.ResponseEntity
+import org.springframework.security.authorization.AuthorizationDeniedException
+import org.springframework.security.core.context.SecurityContextHolder
+import org.springframework.security.oauth2.jwt.Jwt
 import org.springframework.web.bind.annotation.*
 
 @RestController
@@ -60,6 +63,9 @@ class UserController(
                         )
                     ]) body: User
     ): ResponseEntity<User> {
+        val authentication = SecurityContextHolder.getContext().authentication
+        val jwt = authentication as Jwt
+        val authorizedParty = jwt.getClaimAsString("azp")
         var created = false
 
         val userIdConverted = UserId.of(NonEmptyString(userId))
@@ -67,9 +73,11 @@ class UserController(
         if (user == null) {
             created = true
             user = mapper.mapToDB(body)
-        } else {
+        } else if (authorizedParty == userId) {
             user.name = NonEmptyString(body.name)
             user.email = Email.of(NonEmptyString(body.email))
+        } else {
+            throw AuthorizationDeniedException("The user is not authorized to update this user")
         }
 
         userRepository.save(user)

module-server/src/main/kotlin/de/twomartens/timetable/configuration/AuthorizationManagerConfiguration.kt

@@ -0,0 +1,24 @@
+package de.twomartens.timetable.configuration
+
+import de.twomartens.timetable.configuration.roles.CheckParty
+import de.twomartens.timetable.configuration.roles.PartyAuthorizationManager
+import org.springframework.aop.support.annotation.AnnotationMatchingPointcut
+import org.springframework.beans.factory.config.BeanDefinition.ROLE_INFRASTRUCTURE
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.context.annotation.Role
+import org.springframework.security.authorization.method.AuthorizationInterceptorsOrder
+import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor
+
+@Configuration
+class AuthorizationManagerConfiguration {
+
+    @Bean
+    @Role(ROLE_INFRASTRUCTURE)
+    fun checkPartyInterceptor(): AuthorizationManagerBeforeMethodInterceptor {
+        val pointcut = AnnotationMatchingPointcut(null, CheckParty::class.java, true)
+        val interceptor = AuthorizationManagerBeforeMethodInterceptor(pointcut, PartyAuthorizationManager())
+        interceptor.order = AuthorizationInterceptorsOrder.PRE_AUTHORIZE.order
+        return interceptor
+    }
+}

module-server/src/main/kotlin/de/twomartens/timetable/configuration/CorsConfig.kt

@@ -0,0 +1,26 @@
+package de.twomartens.timetable.configuration
+
+import org.springframework.beans.factory.annotation.Qualifier
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.web.cors.CorsConfiguration
+import org.springframework.web.cors.CorsConfigurationSource
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource
+
+@Configuration
+class CorsConfig {
+
+    @Bean
+    @Qualifier("corsApplication")
+    fun corsConfigurationSource(): CorsConfigurationSource {
+        val configuration = CorsConfiguration()
+        configuration.allowedOrigins = listOf("http://localhost:8100", "https://timetable.2martens.de") // frontend origin
+        configuration.allowedMethods = listOf("GET", "POST", "PUT", "HEAD", "DELETE", "OPTIONS")
+        configuration.allowedHeaders = listOf("*")
+        configuration.allowCredentials = true
+
+        val source = UrlBasedCorsConfigurationSource()
+        source.registerCorsConfiguration("/**", configuration)
+        return source
+    }
+}

module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt

@@ -1,73 +1,36 @@
 package de.twomartens.timetable.configuration
 
-import de.twomartens.support.security.SpringPolicyEnforcerFilter
-import org.keycloak.adapters.authorization.spi.ConfigurationResolver
-import org.keycloak.adapters.authorization.spi.HttpRequest
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.EnforcementMode
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig
-import org.keycloak.util.JsonSerialization
-import org.springframework.beans.factory.annotation.Value
+import org.springframework.beans.factory.annotation.Qualifier
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.http.HttpMethod
 import org.springframework.security.config.Customizer
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer
-import org.springframework.security.oauth2.jwt.JwtDecoder
-import org.springframework.security.oauth2.jwt.NimbusJwtDecoder
+import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.web.SecurityFilterChain
-import java.io.IOException
+import org.springframework.web.cors.CorsConfigurationSource
 
 @Configuration
 @EnableWebSecurity
+@EnableMethodSecurity
 open class WebSecurityConfiguration {
-    @Value("\${spring.security.oauth2.resourceserver.jwt.jwk-set-uri}")
-    private lateinit var jwkSetUri: String
-
-    @Value("#{environment.CLIENT_SECRET}")
-    private lateinit var clientSecret: String
-
     @Bean
     @Throws(Exception::class)
-    open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
+    open fun securityFilterChain(http: HttpSecurity,
+                                 @Qualifier("corsApplication") corsConfiguration: CorsConfigurationSource): SecurityFilterChain {
         http
+                .cors { it.configurationSource(corsConfiguration) }
                 .csrf { it.disable() }
+                .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
                 .authorizeHttpRequests { it.requestMatchers(*PERMITTED_PATHS.toTypedArray<String>()).permitAll() }
                 .authorizeHttpRequests { it.requestMatchers(HttpMethod.OPTIONS).permitAll() }
                 .authorizeHttpRequests { it.anyRequest().authenticated() }
-                .oauth2ResourceServer { obj: OAuth2ResourceServerConfigurer<HttpSecurity?> -> obj.jwt(Customizer.withDefaults()) }
+                .oauth2ResourceServer { it.jwt(Customizer.withDefaults()) }
         return http.build()
     }
 
-    @Bean
-    open fun jwtDecoder(): JwtDecoder {
-        return NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build()
-    }
-
-    private fun createPolicyEnforcerFilter(): SpringPolicyEnforcerFilter {
-        return SpringPolicyEnforcerFilter(object : ConfigurationResolver {
-            override fun resolve(request: HttpRequest): PolicyEnforcerConfig {
-                return try {
-                    val policyEnforcerConfig = JsonSerialization.readValue(
-                            javaClass.getResourceAsStream("/policy-enforcer.json"), PolicyEnforcerConfig::class.java
-                    )
-                    policyEnforcerConfig.credentials = mapOf(Pair("secret", clientSecret))
-                    if (request.method == HttpMethod.OPTIONS.name()) {
-                        // always allow options request
-                        policyEnforcerConfig.enforcementMode = EnforcementMode.DISABLED
-                    } else {
-                        policyEnforcerConfig.paths = PATHS
-                    }
-                    policyEnforcerConfig
-                } catch (e: IOException) {
-                    throw RuntimeException(e)
-                }
-            }
-        })
-    }
-
     companion object {
         private val PERMITTED_PATHS: Collection<String> = listOf(
                 "/timetable/healthCheck",
@@ -77,17 +40,5 @@ open class WebSecurityConfiguration {
                 "/error",
                 "/timetable/version",
         )
-        private val PATHS = buildPathConfigs()
-
-        private fun buildPathConfigs(): List<PathConfig> {
-            val paths: MutableList<PathConfig> = mutableListOf()
-            for (path in PERMITTED_PATHS) {
-                val pathConfig = PathConfig()
-                pathConfig.path = path.replace("**", "*")
-                pathConfig.enforcementMode = EnforcementMode.DISABLED
-                paths.add(pathConfig)
-            }
-            return paths
-        }
     }
 }

module-server/src/main/kotlin/de/twomartens/timetable/configuration/roles/CheckParty.kt

@@ -0,0 +1,11 @@
+package de.twomartens.timetable.configuration.roles
+
+import java.lang.annotation.Inherited
+
+@Target(AnnotationTarget.FUNCTION, AnnotationTarget.TYPE)
+@Retention(AnnotationRetention.RUNTIME)
+@Inherited
+@MustBeDocumented
+annotation class CheckParty(
+        val partyParamName: String    // Name of method argument holding the party ID
+)

module-server/src/main/kotlin/de/twomartens/timetable/configuration/roles/PartyAuthorizationManager.kt

@@ -0,0 +1,43 @@
+package de.twomartens.timetable.configuration.roles
+
+import org.aopalliance.intercept.MethodInvocation
+import org.springframework.security.authorization.AuthorizationDecision
+import org.springframework.security.authorization.AuthorizationDeniedException
+import org.springframework.security.authorization.AuthorizationManager
+import org.springframework.security.authorization.AuthorizationResult
+import org.springframework.security.authorization.method.MethodAuthorizationDeniedHandler
+import org.springframework.security.core.Authentication
+import java.util.function.Supplier
+
+class PartyAuthorizationManager : AuthorizationManager<MethodInvocation>, MethodAuthorizationDeniedHandler {
+    @Deprecated("Deprecated in Spring Security")
+    override fun check(authentication: Supplier<Authentication?>?, invocation: MethodInvocation?): AuthorizationDecision {
+        if (authentication == null || authentication.get() == null || !authentication.get()!!.isAuthenticated) {
+            return AuthorizationDecision(false)
+        }
+
+        val annotation = invocation!!.method.getAnnotation(CheckParty::class.java)
+                ?: invocation.method.declaringClass.getAnnotation(CheckParty::class.java)
+                ?: return AuthorizationDecision(true) // No annotation, allow
+
+        val authentication = authentication.get()!!
+        val partyParamName = annotation.partyParamName
+
+        // 1. Authorized party check
+        val methodParams = invocation.method.parameters
+        val argIndex = methodParams.indexOfFirst { it.name == partyParamName }
+        if (argIndex == -1) {
+            return AuthorizationDecision(false)
+        }
+
+        val requestedPartyId = invocation.arguments[argIndex]?.toString()
+        val tokenPartyId = (authentication.details as? Map<*, *>)?.get("azp")?.toString()
+                ?: authentication.name // fallback
+
+        return AuthorizationDecision(requestedPartyId == tokenPartyId)
+    }
+
+    override fun handleDeniedInvocation(methodInvocation: MethodInvocation?, authorizationResult: AuthorizationResult?): Any? {
+        throw AuthorizationDeniedException("The requested resources are not accessible to the authorized party")
+    }
+}

module-server/src/main/kotlin/de/twomartens/timetable/formation/FormationController.kt

@@ -1,6 +1,7 @@
 package de.twomartens.timetable.formation
 
 import de.twomartens.timetable.auth.UserRepository
+import de.twomartens.timetable.configuration.roles.CheckParty
 import de.twomartens.timetable.model.common.FormationId
 import de.twomartens.timetable.model.common.UserId
 import de.twomartens.timetable.model.dto.Formation
@@ -44,6 +45,7 @@ class FormationController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @GetMapping("/{userId}/")
     fun getFormations(
             @PathVariable @Parameter(description = "The id of the user",
@@ -96,6 +98,7 @@ class FormationController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @GetMapping("/{userId}/{id}")
     fun getFormation(
             @PathVariable @Parameter(description = "The id of the user",
@@ -144,6 +147,7 @@ class FormationController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @PutMapping("/{userId}/{id}")
     fun putFormation(
             @PathVariable @Parameter(description = "The id of the user",
@@ -236,6 +240,7 @@ class FormationController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @DeleteMapping("/{userId}/{id}")
     fun deleteFormation(
             @PathVariable @Parameter(description = "The id of the user",

module-server/src/main/kotlin/de/twomartens/timetable/route/RouteController.kt

@@ -1,6 +1,7 @@
 package de.twomartens.timetable.route
 
 import de.twomartens.timetable.auth.UserRepository
+import de.twomartens.timetable.configuration.roles.CheckParty
 import de.twomartens.timetable.model.common.RouteId
 import de.twomartens.timetable.model.common.UserId
 import de.twomartens.timetable.model.dto.TswRoute
@@ -43,6 +44,7 @@ class RouteController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @GetMapping("/{userId}/")
     fun getRoutes(
             @PathVariable @Parameter(description = "The id of the user",
@@ -87,6 +89,7 @@ class RouteController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @GetMapping("/{userId}/{id}")
     fun getRoute(
             @PathVariable @Parameter(description = "The id of the user",
@@ -130,6 +133,7 @@ class RouteController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @PutMapping("/{userId}/{id}")
     fun putRoute(
             @PathVariable @Parameter(description = "The id of the user",
@@ -195,6 +199,7 @@ class RouteController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @CheckParty(partyParamName = "userId")
     @DeleteMapping("/{userId}/{id}")
     fun deleteRoute(
             @PathVariable @Parameter(description = "The id of the user",

module-server/src/main/kotlin/de/twomartens/timetable/station/StationController.kt

@@ -15,6 +15,7 @@ import io.swagger.v3.oas.annotations.security.SecurityRequirement
 import io.swagger.v3.oas.annotations.tags.Tag
 import org.mapstruct.factory.Mappers
 import org.springframework.http.ResponseEntity
+import org.springframework.security.access.prepost.PreAuthorize
 import org.springframework.web.bind.annotation.*
 
 @RestController
@@ -87,6 +88,7 @@ class StationController(
     )
     @SecurityRequirement(name = "bearer")
     @SecurityRequirement(name = "oauth2")
+    @PreAuthorize("hasRole('ROLE_ADMIN')")
     @PostMapping("/update")
     fun updateStations(): ResponseEntity<Void> {
         val stations = bahnApiService.fetchStations("*")

module-server/src/main/resources/application.yaml

@@ -38,7 +38,9 @@ spring:
     oauth2:
       resourceserver:
         jwt:
+          jws-algorithms: ES256
           jwk-set-uri: ${KEYCLOAK_URL:https://id.2martens.de}/realms/${KEYCLOAK_REALM:twomartens}/protocol/openid-connect/certs
+          issuer-uri: ${KEYCLOAK_URL:https://id.2martens.de}/realms/${KEYCLOAK_REALM:twomartens}
   application:
     name: timetable
 
@@ -79,10 +81,8 @@ de.twomartens.timetable:
   bahn-api:
     client-id: ${DB_CLIENT_ID}
     client-secret: ${DB_CLIENT_SECRET}
-  greeting: "Hello %s, on millenium"
   statusprobe:
     scheduleDuration: 60
-    maxKafkaFailureDuration: 5
     maxBlobFailureCount: 5
     maxFailurePercent: 50
 de.twomartens.support.health.greeting: "Good morning"