Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

concord-server: allow tokens without users, remove user from default agent token #1054

Merged
merged 5 commits into from
Jan 3, 2025
Merged

concord-server: allow tokens without users, remove user from default agent token #1054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
37f136d
server: agent tokens by default are not tied to any user
brig Dec 19, 2024
0c39136
simple rest api
brig Dec 22, 2024
88888db
Merge branch 'master' into brig/agen-token-without-user
brig Dec 31, 2024
25542e2
tidy up
ibodrov Jan 3, 2025
50d3eb9
tidy up
ibodrov Jan 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/liquibase.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,5 +115,6 @@
<include file="v2.10.0.xml" relativeToChangelogFile="true"/>
<include file="v2.12.0.xml" relativeToChangelogFile="true"/>
<include file="v2.14.0.xml" relativeToChangelogFile="true"/>
<include file="v2.21.0.xml" relativeToChangelogFile="true"/>

</databaseChangeLog>
34 changes: 21 additions & 13 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.69.0.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,24 +4,32 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">

<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!--
<property name="concordAgentUserId" value="d4f123c1-f8d4-40b2-8a12-b8947b9ce2d8"/>
-->

<!-- moved to v1.86.0.xml (no more hard-coded default token) -->
<!-- <changeSet id="69000" author="[email protected]">
<insert tableName="USERS">
<column name="USER_ID">${concordAgentUserId}</column>
<column name="USERNAME">concordAgent</column>
<column name="USER_TYPE">LOCAL</column>
</insert>
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!--
<changeSet id="69000" author="[email protected]">
<insert tableName="USERS">
<column name="USER_ID">${concordAgentUserId}</column>
<column name="USERNAME">concordAgent</column>
<column name="USER_TYPE">LOCAL</column>
</insert>

<insert tableName="API_KEYS">
&lt;!&ndash; "O+JMYwBsU797EKtlRQYu+Q" &ndash;&gt;
<column name="API_KEY">1sw9eLZ41EOK4w/iV3jFnn6cqeAMeFtxfazqVY04koY</column>
<column name="USER_ID">${concordAgentUserId}</column>
</insert>
</changeSet> -->
<insert tableName="API_KEYS">
&lt;!&ndash; "O+JMYwBsU797EKtlRQYu+Q" &ndash;&gt;
<column name="API_KEY">1sw9eLZ41EOK4w/iV3jFnn6cqeAMeFtxfazqVY04koY</column>
<column name="USER_ID">${concordAgentUserId}</column>
</insert>
</changeSet>
-->

<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!-- Create agent user when not exist -->
<!--
<changeSet id="69001" author="[email protected]">
<preConditions onFail="MARK_RAN">
<sqlCheck expectedResult="0">
Expand All @@ -37,5 +45,5 @@
<column name="USER_TYPE">LOCAL</column>
</insert>
</changeSet>

-->
</databaseChangeLog>
28 changes: 15 additions & 13 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.70.0.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,21 +4,23 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">

<!-- <property name="concordRunnerUserId" value="2599c604-1384-4660-a767-8bc03baa7a31"/>
<!--
<property name="concordRunnerUserId" value="2599c604-1384-4660-a767-8bc03baa7a31"/>

<changeSet id="70000" author="[email protected]">
<insert tableName="USERS">
<column name="USER_ID">${concordRunnerUserId}</column>
<column name="USERNAME">concordRunner</column>
<column name="USER_TYPE">LOCAL</column>
</insert>
<changeSet id="70000" author="[email protected]">
<insert tableName="USERS">
<column name="USER_ID">${concordRunnerUserId}</column>
<column name="USERNAME">concordRunner</column>
<column name="USER_TYPE">LOCAL</column>
</insert>

<insert tableName="API_KEYS">
&lt;!&ndash; "Gz0q/DeGlH8Zs7QJMj1v8g" &ndash;&gt;
<column name="API_KEY">DrRt3j6G7b6GHY/Prddu4voyKyZa17iFkEj99ac0q/A</column>
<column name="USER_ID">${concordRunnerUserId}</column>
</insert>
</changeSet> -->
<insert tableName="API_KEYS">
&lt;!&ndash; "Gz0q/DeGlH8Zs7QJMj1v8g" &ndash;&gt;
<column name="API_KEY">DrRt3j6G7b6GHY/Prddu4voyKyZa17iFkEj99ac0q/A</column>
<column name="USER_ID">${concordRunnerUserId}</column>
</insert>
</changeSet>
-->

<changeSet id="70100" author="[email protected]">
<addColumn tableName="PROCESS_QUEUE">
Expand Down
3 changes: 3 additions & 0 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.79.0.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,15 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">

<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!--
<changeSet id="79000" author="[email protected]">
<insert tableName="USER_ROLES">
<column name="ROLE_ID">${concordSystemReaderRoleId}</column>
<column name="USER_ID">${concordAgentUserId}</column>
</insert>
</changeSet>
-->

<changeSet id="79100" author="[email protected]">
<addColumn tableName="API_KEYS">
Expand Down
4 changes: 4 additions & 0 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.80.0.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,16 +7,20 @@
<property name="concordSystemWriterRoleId" value="c162d868-89ea-11e8-80be-97fd8a9f7419"/>

<changeSet id="80000" author="[email protected]">
<validCheckSum>ANY</validCheckSum>
<insert tableName="ROLES">
<column name="ROLE_ID">${concordSystemWriterRoleId}</column>
<column name="ROLE_NAME">concordSystemWriter</column>
<column name="GLOBAL_WRITER">true</column>
</insert>

<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!--
<insert tableName="USER_ROLES">
<column name="ROLE_ID">${concordSystemWriterRoleId}</column>
<column name="USER_ID">${concordAgentUserId}</column>
</insert>
-->
</changeSet>

<!-- removed in 1.9.0+
Expand Down
8 changes: 5 additions & 3 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/v1.45.0.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,9 @@
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">

<!-- moved to v1.86.0.xml -->
<!-- <changeSet id="1450000" author="[email protected]" runInTransaction="false" context="!codegen">
<!-- moved to v1.86.0.xml -->
<!--
<changeSet id="1450000" author="[email protected]" runInTransaction="false" context="!codegen">
<sql>
delete from API_KEYS where KEY_ID = 'd5165ca8-e8de-11e6-9bf5-136b5db23c32'
</sql>
Expand All @@ -17,5 +18,6 @@
&lt;!&ndash; value from concord-server.conf &ndash;&gt;
<param name="token" value="${defaultAdminToken}"/>
</customChange>
</changeSet> -->
</changeSet>
-->
</databaseChangeLog>
11 changes: 9 additions & 2 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/v1.86.0.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,10 @@
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">

<property name="concordAdminUserId" value="230c5c9c-d9a7-11e6-bcfd-bb681c07b26c"/>
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!--
<property name="concordAgentUserId" value="d4f123c1-f8d4-40b2-8a12-b8947b9ce2d8"/>
-->
<property name="concordRunnerUserId" value="2599c604-1384-4660-a767-8bc03baa7a31"/>

<!-- delete old hard-coded default admin API token -->
Expand Down Expand Up @@ -38,15 +41,20 @@
</changeSet>

<!-- delete old hard-coded default agent API token -->
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!--
<changeSet id="1860200" author="[email protected]" runInTransaction="false" context="!codegen">
<sql>
delete from API_KEYS
where USER_ID = '${concordAgentUserId}'
and API_KEY = '1sw9eLZ41EOK4w/iV3jFnn6cqeAMeFtxfazqVY04koY'
</sql>
</changeSet>
-->

<!-- Set initial agent API token when not exist -->
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
<!--
<changeSet id="1860300" author="[email protected]" runInTransaction="false" context="!codegen">
<validCheckSum>ANY</validCheckSum>

Expand All @@ -60,14 +68,13 @@
</preConditions>

<customChange class="com.walmartlabs.concord.server.liquibase.ext.ApiTokenCreator">
<!-- default agent user id from v0.69.0.xml -->
<param name="userId" value="${concordAgentUserId}"/>
<param name="username" value="concordAgent"/>
<!-- values from concord-server.conf -->
<param name="token" value="${defaultAgentToken}"/>
<param name="skip" value="${skipAgentTokenGeneration}"/>
</customChange>
</changeSet>
-->

<!-- Delete runner API tokens and user when exist -->
<changeSet id="1860400" author="[email protected]" runInTransaction="false" context="!codegen">
Expand Down
47 changes: 47 additions & 0 deletions server/db/src/main/resources/com/walmartlabs/concord/server/db/v2.21.0.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">

<changeSet id="2210000" author="[email protected]">
<dropNotNullConstraint tableName="API_KEYS" columnName="USER_ID"/>
</changeSet>

<changeSet id="2210010" author="[email protected]">
<dropIndex tableName="API_KEYS " indexName="IDX_API_KEYS_NAME_USER"/>

<sql>
create unique index IDX_API_KEYS_NAME_USER_NULL on API_KEYS (KEY_NAME) where USER_ID is null
</sql>
<sql>
create unique index IDX_API_KEYS_NAME_USER_NOT_NULL on API_KEYS (KEY_NAME, USER_ID) where USER_ID is not null
</sql>
</changeSet>

<changeSet id="2210020" author="[email protected]" runInTransaction="false" context="!codegen">
<validCheckSum>ANY</validCheckSum>

<preConditions onFail="MARK_RAN">
<sqlCheck expectedResult="0">
select count(key_id)
from API_KEYS
where KEY_NAME = 'concordAgentKey_autogenerated';
</sqlCheck>
<!-- concordAgentUserId='d4f123c1-f8d4-40b2-8a12-b8947b9ce2d8' -->
<sqlCheck expectedResult="0">
select count(key_id)
from API_KEYS
where USER_ID = 'd4f123c1-f8d4-40b2-8a12-b8947b9ce2d8';
</sqlCheck>
</preConditions>

<customChange class="com.walmartlabs.concord.server.liquibase.ext.ApiTokenCreator">
<param name="keyName" value="concordAgentKey_autogenerated"/>
<!-- values from concord-server.conf -->
<param name="token" value="${defaultAgentToken}"/>
<param name="skip" value="${skipAgentTokenGeneration}"/>
</customChange>
</changeSet>

</databaseChangeLog>
17 changes: 10 additions & 7 deletions server/impl/src/main/java/com/walmartlabs/concord/server/security/apikey/ApiKeyRealm.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,17 +62,20 @@ public boolean supports(AuthenticationToken token) {
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
ApiKey t = (ApiKey) token;

UserEntry u = userManager.get(t.getUserId()).orElse(null);
if (u == null) {
return null;
}
UserEntry u = null;
if (t.getUserId() != null) {
u = userManager.get(t.getUserId()).orElse(null);
if (u == null) {
return null;
}

if (u.isDisabled()) {
throw new AuthenticationException("User account '" + u.getName() + "' is disabled");
if (u.isDisabled()) {
throw new AuthenticationException("User account '" + u.getName() + "' is disabled");
}
}

auditLog.add(AuditObject.SYSTEM, AuditAction.ACCESS)
.userId(u.getId())
.userId(u != null ? u.getId() : null)
.field("realm", REALM_NAME)
.field("apiKeyId", t.getKeyId())
.log();
Expand Down
Loading
Loading