You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airavata.apache.org by is...@apache.org on 2020/08/13 13:51:25 UTC
[airavata-php-gateway] branch custos-integration updated: fixing
custos access issuess
This is an automated email from the ASF dual-hosted git repository.
isjarana pushed a commit to branch custos-integration
in repository https://gitbox.apache.org/repos/asf/airavata-php-gateway.git
The following commit(s) were added to refs/heads/custos-integration by this push:
new 67ab36d fixing custos access issuess
67ab36d is described below
commit 67ab36d1b253d450baed35020f6c7ce03ed27a45
Author: Isuru Ranawaka <ir...@gmail.com>
AuthorDate: Thu Aug 13 09:49:44 2020 -0400
fixing custos access issuess
---
.../Keycloak/API/BaseKeycloakAPIEndpoint.php | 6 ++-
app/libraries/Keycloak/API/RoleMapper.php | 15 +++---
app/libraries/Keycloak/Keycloak.php | 55 +++++++++++++---------
app/libraries/Keycloak/KeycloakUtil.php | 4 +-
4 files changed, 48 insertions(+), 32 deletions(-)
diff --git a/app/libraries/Keycloak/API/BaseKeycloakAPIEndpoint.php b/app/libraries/Keycloak/API/BaseKeycloakAPIEndpoint.php
index 48f0f20..de9a34b 100644
--- a/app/libraries/Keycloak/API/BaseKeycloakAPIEndpoint.php
+++ b/app/libraries/Keycloak/API/BaseKeycloakAPIEndpoint.php
@@ -15,8 +15,9 @@ class BaseKeycloakAPIEndpoint {
protected $cafile_path;
protected $client_id;
protected $client_secret;
+ protected $openid_discovery_endpoint_url;
- function __construct($base_endpoint_url, $admin_username, $admin_password, $verify_peer, $cafile_path, $client_id, $client_secret) {
+ function __construct($openid_discovery_endpoint_url, $base_endpoint_url, $admin_username, $admin_password, $verify_peer, $cafile_path, $client_id, $client_secret) {
$this->base_endpoint_url = $base_endpoint_url;
$this->admin_username = $admin_username;
$this->admin_password = $admin_password;
@@ -24,10 +25,11 @@ class BaseKeycloakAPIEndpoint {
$this->cafile_path = $cafile_path;
$this->client_id = $client_id;
$this->client_secret = $client_secret;
+ $this->openid_discovery_endpoint_url = $openid_discovery_endpoint_url;
}
protected function getAPIAccessToken($realm) {
- return KeycloakUtil::getAPIAccessToken($this->base_endpoint_url, $realm, $this->admin_username, $this->admin_password, $this->verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
+ return KeycloakUtil::getAPIAccessToken($this->openid_discovery_endpoint_url, $realm, $this->admin_username, $this->admin_password, $this->verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
}
}
diff --git a/app/libraries/Keycloak/API/RoleMapper.php b/app/libraries/Keycloak/API/RoleMapper.php
index 216cc77..3c796b1 100644
--- a/app/libraries/Keycloak/API/RoleMapper.php
+++ b/app/libraries/Keycloak/API/RoleMapper.php
@@ -18,14 +18,16 @@ class RoleMapper extends BaseKeycloakAPIEndpoint {
*
* Returns Array of RoleRepresentations
*/
- public function getRealmRoleMappingsForUser($realm, $user_id){
+ public function getRealmRoleMappingsForUser($user_id){
// curl -H "Authorization: bearer $access_token" https://149.165.156.62:8443/auth/admin/realms/airavata/users/2c9ad2c6-0212-4aef-a5fb-9df862578934/role-mappings/realm
// get access token for admin API
- $access_token = $this->getAPIAccessToken($realm);
- Log::info("Access token from getAPIAccessToken ", array($access_token));
- $url = $this->base_endpoint_url . '/admin/realms/' . rawurlencode($realm) . '/users/' . rawurlencode($user_id) . '/role-mappings/realm';
+
+ $url = $this->base_endpoint_url . 'user-management/v1.0.0/user';
+ $params = "?client_id=" . urlencode($this->client_id). "&user.username=".urlencode($user_id);
+ $url = $url.$params;
+
// Log::debug("getRealmRoleMappingsForUser url", array($url));
$r = curl_init($url);
curl_setopt($r, CURLOPT_RETURNTRANSFER, 1);
@@ -35,9 +37,8 @@ class RoleMapper extends BaseKeycloakAPIEndpoint {
curl_setopt($r, CURLOPT_CAINFO, $this->cafile_path);
}
curl_setopt($r, CURLOPT_HTTPHEADER, array(
- "Authorization: Bearer " . $access_token
+ "Authorization: Basic " . base64_encode($this->client_id . ":" . $this->client_secret),
));
-
$response = curl_exec($r);
if ($response == false) {
Log::error("Failed to retrieve realm role mappings for user");
@@ -45,7 +46,7 @@ class RoleMapper extends BaseKeycloakAPIEndpoint {
}
$result = json_decode($response);
// Log::debug("getRealmRoleMappingsForUser result", array($result));
- return $result;
+ return $result->realm_roles;
}
/**
diff --git a/app/libraries/Keycloak/Keycloak.php b/app/libraries/Keycloak/Keycloak.php
index 2ea056f..67d5f66 100644
--- a/app/libraries/Keycloak/Keycloak.php
+++ b/app/libraries/Keycloak/Keycloak.php
@@ -10,7 +10,6 @@ use Keycloak\API\RoleMapper;
use Keycloak\API\Roles;
use Keycloak\API\Users;
use Log;
-use Keycloak\KeycloakUtil;
class Keycloak
{
@@ -47,15 +46,15 @@ class Keycloak
$this->callback_url = $callback_url;
$this->cafile_path = $cafile_path;
$this->verify_peer = $verify_peer;
- $this->base_endpoint_url = $custos_credentials_uri;
+ $this->base_endpoint_url = $base_endpoint_url;
$this->admin_username = $admin_username;
$this->admin_password = $admin_password;
$this->gateway_id = $gateway_id;
$this->custos_credentials_uri = $custos_credentials_uri;
- $this->role_mapper = new RoleMapper($base_endpoint_url, $admin_username, $admin_password, $verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
- $this->roles = new Roles($base_endpoint_url, $admin_username, $admin_password, $verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
- $this->users = new Users($base_endpoint_url, $admin_username, $admin_password, $verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
+ $this->role_mapper = new RoleMapper($openid_connect_discovery_url, $base_endpoint_url, $admin_username, $admin_password, $verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
+ $this->roles = new Roles($openid_connect_discovery_url, $base_endpoint_url, $admin_username, $admin_password, $verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
+ $this->users = new Users($openid_connect_discovery_url, $base_endpoint_url, $admin_username, $admin_password, $verify_peer, $this->cafile_path, $this->client_id, $this->client_secret);
}
/**
@@ -69,8 +68,8 @@ class Keycloak
public function authenticate($username, $password)
{
-
- $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url,$this->client_id,$this->client_secret);
+ Log::info("Calling authenticate ", array($username));
+ $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url, $this->client_id, $this->client_secret);
$token_endpoint = $config->token_endpoint;
@@ -117,7 +116,8 @@ class Keycloak
public function getOAuthRequestCodeUrl($extra_params = null)
{
- $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url,$this->client_id,$this->client_secret);
+ Log::info("Calling getOAuthRequestCodeUrl ", array($extra_params));
+ $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url, $this->client_id, $this->client_secret);
$authorization_endpoint = $config->authorization_endpoint;
// TODO: add state variable to request and put into session
@@ -133,7 +133,8 @@ class Keycloak
public function getOAuthToken($code)
{
- $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url,$this->client_id,$this->client_secret);
+ Log::info("Calling getOAuthToken ", array($code));
+ $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url, $this->client_id, $this->client_secret);
$token_endpoint = $config->token_endpoint;
// Init cUrl.
@@ -177,9 +178,9 @@ class Keycloak
public function getUserProfileFromOAuthToken($token)
{
- Log::info("Calling user info endpoint");
+ Log::info("Calling getUserProfileFromOAuthToken");
- $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url,$this->client_id,$this->client_secret);
+ $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url, $this->client_id, $this->client_secret);
$userinfo_endpoint = $config->userinfo_endpoint;
$r = curl_init($userinfo_endpoint);
@@ -208,7 +209,7 @@ class Keycloak
$email = $userinfo->email;
// get roles from Keycloak API
- $role_mappings = $this->role_mapper->getRealmRoleMappingsForUser($this->realm, $userinfo->sub);
+ $role_mappings = $this->role_mapper->getRealmRoleMappingsForUser($userinfo->sub);
$roles = [];
foreach ($role_mappings as $role_mapping) {
$roles[] = $role_mapping->name;
@@ -224,8 +225,8 @@ class Keycloak
*/
public function getRefreshedOAuthToken($refresh_token)
{
-
- $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url,$this->client_id,$this->client_secret);
+ Log::info("Calling getRefreshedOAuthToken");
+ $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url, $this->client_id, $this->client_secret);
$token_endpoint = $config->token_endpoint;
// Init cUrl.
@@ -238,9 +239,13 @@ class Keycloak
curl_setopt($r, CURLOPT_CAINFO, $this->cafile_path);
}
+ $auth_credentials = $this->getAuthCredentials();
+
+ $iam_secret = $auth_credentials->iam_client_secret;
+
// Add client ID and client secret to the headers.
curl_setopt($r, CURLOPT_HTTPHEADER, array(
- "Authorization: Basic " . base64_encode($this->client_id . ":" . $this->client_secret),
+ "Authorization: Basic " . base64_encode($this->client_id . ":" . $iam_secret),
));
// Assemble POST parameters for the request.
@@ -267,7 +272,8 @@ class Keycloak
*/
public function getOAuthLogoutUrl($redirect_uri)
{
- $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url,$this->client_id,$this->client_secret);
+ Log::info("Calling getOAuthLogoutUrl");
+ $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($this->openid_connect_discovery_url, $this->client_id, $this->client_secret);
$logout_endpoint = $config->end_session_endpoint;
return $logout_endpoint . '?redirect_uri=' . rawurlencode($redirect_uri);
}
@@ -279,6 +285,7 @@ class Keycloak
*/
public function listUsers()
{
+ Log::info("Calling listUsers");
$users = $this->users->getUsers($this->realm);
$usernames = [];
foreach ($users as $user) {
@@ -297,6 +304,7 @@ class Keycloak
*/
public function searchUsers($phrase)
{
+ Log::info("Calling searchUsers");
$users = $this->users->searchUsers($this->realm, $phrase);
$usernames = [];
foreach ($users as $user) {
@@ -314,6 +322,7 @@ class Keycloak
public function getAllRoles()
{
try {
+ Log::info("Calling getAllRoles");
$roles = $this->roles->getRoles($this->realm);
$role_names = [];
foreach ($roles as $role) {
@@ -334,10 +343,11 @@ class Keycloak
public function getUserRoles($username)
{
try {
+ Log::info("Calling getUserRoles");
// get userid from username
$user_id = $this->getUserId($username);
// Get the user's realm roles, then convert to an array of just names
- $roles = $this->role_mapper->getRealmRoleMappingsForUser($this->realm, $user_id);
+ $roles = $this->role_mapper->getRealmRoleMappingsForUser($user_id);
$role_names = [];
foreach ($roles as $role) {
$role_names[] = $role->name;
@@ -360,6 +370,7 @@ class Keycloak
{
// Log::debug("updateUserRoles", array($user_id, $roles));
try {
+ Log::info("Calling updateUserRoles");
// get userid from username
$user_id = $this->getUserId($username);
// Get all of the roles into an array keyed by role name
@@ -397,6 +408,7 @@ class Keycloak
*/
public function getUserProfile($username)
{
+ Log::info("Calling getUserProfile");
$user = $this->users->getUserByUsername($this->realm, $username);
if ($user != null) {
$result = [];
@@ -419,6 +431,7 @@ class Keycloak
public function usernameExists($username)
{
try {
+ Log::info("Calling usernameExists");
$user = $this->users->getUserByUsername($this->realm, $username);
return $user != null;
} catch (Exception $ex) {
@@ -432,6 +445,7 @@ class Keycloak
{
try {
+ Log::info("Calling isUpdatePasswordRequired");
$user = $this->users->getUserByUsername($this->realm, $username);
if ($user != null) {
return in_array("UPDATE_PASSWORD", $user->requiredActions);
@@ -446,12 +460,13 @@ class Keycloak
public function getAdminAuthzToken()
{
-
- $access_token = KeycloakUtil::getAPIAccessToken($this->base_endpoint_url, $this->realm, $this->admin_username, $this->admin_password, $this->verify_peer, $this->cafile_path);
+ Log::info("Calling getAdminAuthzToken");
+ $access_token = KeycloakUtil::getAPIAccessToken($this->openid_connect_discovery_url, $this->realm, $this->admin_username, $this->admin_password, $this->verify_peer, $this->cafile_path);
$authzToken = new \Airavata\Model\Security\AuthzToken();
$authzToken->accessToken = $access_token;
$authzToken->claimsMap['gatewayID'] = $this->gateway_id;
$authzToken->claimsMap['userName'] = $this->admin_username;
+ $authzToken->claimsMap['custosId'] = $this->client_id;
return $authzToken;
}
@@ -469,8 +484,6 @@ class Keycloak
}
-
-
private function getAuthCredentials()
{
diff --git a/app/libraries/Keycloak/KeycloakUtil.php b/app/libraries/Keycloak/KeycloakUtil.php
index 7fc7d8c..185e7eb 100644
--- a/app/libraries/Keycloak/KeycloakUtil.php
+++ b/app/libraries/Keycloak/KeycloakUtil.php
@@ -7,10 +7,10 @@ use Log;
class KeycloakUtil
{
- public static function getAPIAccessToken($base_endpoint_url, $realm, $admin_username, $admin_password, $verify_peer, $cafile_path, $client_id, $client_sec)
+ public static function getAPIAccessToken($openid_connect_discovery_url, $realm, $admin_username, $admin_password, $verify_peer, $cafile_path, $client_id, $client_sec)
{
- $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($base_endpoint_url,$client_id,$client_sec);
+ $config = KeycloakUtil::getOpenIDConnectDiscoveryConfiguration($openid_connect_discovery_url,$client_id,$client_sec);
$token_endpoint = $config->token_endpoint;