Skip to content

Commit a0b0c1d

Browse files
ibodrovibodrov
authored
Merge branch 'master' into ib/misc-security
2 parents 2b96031 + 334bd77 commit a0b0c1d

File tree

11 files changed

+200
-72
lines changed

11 files changed

+200
-72
lines changed

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/liquibase.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,5 +115,6 @@
115115
<include file="v2.10.0.xml" relativeToChangelogFile="true"/>
116116
<include file="v2.12.0.xml" relativeToChangelogFile="true"/>
117117
<include file="v2.14.0.xml" relativeToChangelogFile="true"/>
118+
<include file="v2.21.0.xml" relativeToChangelogFile="true"/>
118119

119120
</databaseChangeLog>

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.69.0.xml‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,24 +4,32 @@
44
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
55
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">
66

7+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
8+
<!--
79
<property name="concordAgentUserId" value="d4f123c1-f8d4-40b2-8a12-b8947b9ce2d8"/>
10+
-->
811

912
<!-- moved to v1.86.0.xml (no more hard-coded default token) -->
10-
<!-- <changeSet id="69000" author="[email protected]">
11-
<insert tableName="USERS">
12-
<column name="USER_ID">${concordAgentUserId}</column>
13-
<column name="USERNAME">concordAgent</column>
14-
<column name="USER_TYPE">LOCAL</column>
15-
</insert>
13+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
14+
<!--
15+
<changeSet id="69000" author="[email protected]">
16+
<insert tableName="USERS">
17+
<column name="USER_ID">${concordAgentUserId}</column>
18+
<column name="USERNAME">concordAgent</column>
19+
<column name="USER_TYPE">LOCAL</column>
20+
</insert>
1621
17-
<insert tableName="API_KEYS">
18-
&lt;!&ndash; "O+JMYwBsU797EKtlRQYu+Q" &ndash;&gt;
19-
<column name="API_KEY">1sw9eLZ41EOK4w/iV3jFnn6cqeAMeFtxfazqVY04koY</column>
20-
<column name="USER_ID">${concordAgentUserId}</column>
21-
</insert>
22-
</changeSet> -->
22+
<insert tableName="API_KEYS">
23+
&lt;!&ndash; "O+JMYwBsU797EKtlRQYu+Q" &ndash;&gt;
24+
<column name="API_KEY">1sw9eLZ41EOK4w/iV3jFnn6cqeAMeFtxfazqVY04koY</column>
25+
<column name="USER_ID">${concordAgentUserId}</column>
26+
</insert>
27+
</changeSet>
28+
-->
2329

30+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
2431
<!-- Create agent user when not exist -->
32+
<!--
2533
<changeSet id="69001" author="[email protected]">
2634
<preConditions onFail="MARK_RAN">
2735
<sqlCheck expectedResult="0">
@@ -37,5 +45,5 @@
3745
<column name="USER_TYPE">LOCAL</column>
3846
</insert>
3947
</changeSet>
40-
48+
-->
4149
</databaseChangeLog>

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.70.0.xml‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,23 @@
44
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
55
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">
66

7-
<!-- <property name="concordRunnerUserId" value="2599c604-1384-4660-a767-8bc03baa7a31"/>
7+
<!--
8+
<property name="concordRunnerUserId" value="2599c604-1384-4660-a767-8bc03baa7a31"/>
89
9-
<changeSet id="70000" author="[email protected]">
10-
<insert tableName="USERS">
11-
<column name="USER_ID">${concordRunnerUserId}</column>
12-
<column name="USERNAME">concordRunner</column>
13-
<column name="USER_TYPE">LOCAL</column>
14-
</insert>
10+
<changeSet id="70000" author="[email protected]">
11+
<insert tableName="USERS">
12+
<column name="USER_ID">${concordRunnerUserId}</column>
13+
<column name="USERNAME">concordRunner</column>
14+
<column name="USER_TYPE">LOCAL</column>
15+
</insert>
1516
16-
<insert tableName="API_KEYS">
17-
&lt;!&ndash; "Gz0q/DeGlH8Zs7QJMj1v8g" &ndash;&gt;
18-
<column name="API_KEY">DrRt3j6G7b6GHY/Prddu4voyKyZa17iFkEj99ac0q/A</column>
19-
<column name="USER_ID">${concordRunnerUserId}</column>
20-
</insert>
21-
</changeSet> -->
17+
<insert tableName="API_KEYS">
18+
&lt;!&ndash; "Gz0q/DeGlH8Zs7QJMj1v8g" &ndash;&gt;
19+
<column name="API_KEY">DrRt3j6G7b6GHY/Prddu4voyKyZa17iFkEj99ac0q/A</column>
20+
<column name="USER_ID">${concordRunnerUserId}</column>
21+
</insert>
22+
</changeSet>
23+
-->
2224

2325
<changeSet id="70100" author="[email protected]">
2426
<addColumn tableName="PROCESS_QUEUE">

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.79.0.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,15 @@
44
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
55
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">
66

7+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
8+
<!--
79
<changeSet id="79000" author="[email protected]">
810
<insert tableName="USER_ROLES">
911
<column name="ROLE_ID">${concordSystemReaderRoleId}</column>
1012
<column name="USER_ID">${concordAgentUserId}</column>
1113
</insert>
1214
</changeSet>
15+
-->
1316

1417
<changeSet id="79100" author="[email protected]">
1518
<addColumn tableName="API_KEYS">

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/v0.80.0.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,20 @@
77
<property name="concordSystemWriterRoleId" value="c162d868-89ea-11e8-80be-97fd8a9f7419"/>
88

99
<changeSet id="80000" author="[email protected]">
10+
<validCheckSum>ANY</validCheckSum>
1011
<insert tableName="ROLES">
1112
<column name="ROLE_ID">${concordSystemWriterRoleId}</column>
1213
<column name="ROLE_NAME">concordSystemWriter</column>
1314
<column name="GLOBAL_WRITER">true</column>
1415
</insert>
1516

17+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
18+
<!--
1619
<insert tableName="USER_ROLES">
1720
<column name="ROLE_ID">${concordSystemWriterRoleId}</column>
1821
<column name="USER_ID">${concordAgentUserId}</column>
1922
</insert>
23+
-->
2024
</changeSet>
2125

2226
<!-- removed in 1.9.0+

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/v1.45.0.xml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@
44
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
55
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">
66

7-
<!-- moved to v1.86.0.xml -->
8-
<!-- <changeSet id="1450000" author="[email protected]" runInTransaction="false" context="!codegen">
7+
<!-- moved to v1.86.0.xml -->
8+
<!--
9+
<changeSet id="1450000" author="[email protected]" runInTransaction="false" context="!codegen">
910
<sql>
1011
delete from API_KEYS where KEY_ID = 'd5165ca8-e8de-11e6-9bf5-136b5db23c32'
1112
</sql>
@@ -17,5 +18,6 @@
1718
&lt;!&ndash; value from concord-server.conf &ndash;&gt;
1819
<param name="token" value="${defaultAdminToken}"/>
1920
</customChange>
20-
</changeSet> -->
21+
</changeSet>
22+
-->
2123
</databaseChangeLog>

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/v1.86.0.xml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,10 @@
55
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">
66

77
<property name="concordAdminUserId" value="230c5c9c-d9a7-11e6-bcfd-bb681c07b26c"/>
8+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
9+
<!--
810
<property name="concordAgentUserId" value="d4f123c1-f8d4-40b2-8a12-b8947b9ce2d8"/>
11+
-->
912
<property name="concordRunnerUserId" value="2599c604-1384-4660-a767-8bc03baa7a31"/>
1013

1114
<!-- delete old hard-coded default admin API token -->
@@ -38,15 +41,20 @@
3841
</changeSet>
3942

4043
<!-- delete old hard-coded default agent API token -->
44+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
45+
<!--
4146
<changeSet id="1860200" author="[email protected]" runInTransaction="false" context="!codegen">
4247
<sql>
4348
delete from API_KEYS
4449
where USER_ID = '${concordAgentUserId}'
4550
and API_KEY = '1sw9eLZ41EOK4w/iV3jFnn6cqeAMeFtxfazqVY04koY'
4651
</sql>
4752
</changeSet>
53+
-->
4854

4955
<!-- Set initial agent API token when not exist -->
56+
<!-- starting from 2.21.x, the default agent token is no longer associated with any user -->
57+
<!--
5058
<changeSet id="1860300" author="[email protected]" runInTransaction="false" context="!codegen">
5159
<validCheckSum>ANY</validCheckSum>
5260
@@ -60,14 +68,13 @@
6068
</preConditions>
6169
6270
<customChange class="com.walmartlabs.concord.server.liquibase.ext.ApiTokenCreator">
63-
<!-- default agent user id from v0.69.0.xml -->
6471
<param name="userId" value="${concordAgentUserId}"/>
6572
<param name="username" value="concordAgent"/>
66-
<!-- values from concord-server.conf -->
6773
<param name="token" value="${defaultAgentToken}"/>
6874
<param name="skip" value="${skipAgentTokenGeneration}"/>
6975
</customChange>
7076
</changeSet>
77+
-->
7178

7279
<!-- Delete runner API tokens and user when exist -->
7380
<changeSet id="1860400" author="[email protected]" runInTransaction="false" context="!codegen">

‎server/db/src/main/resources/com/walmartlabs/concord/server/db/v2.21.0.xml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.3.xsd">
6+
7+
<changeSet id="2210000" author="[email protected]">
8+
<dropNotNullConstraint tableName="API_KEYS" columnName="USER_ID"/>
9+
</changeSet>
10+
11+
<changeSet id="2210010" author="[email protected]">
12+
<dropIndex tableName="API_KEYS " indexName="IDX_API_KEYS_NAME_USER"/>
13+
14+
<sql>
15+
create unique index IDX_API_KEYS_NAME_USER_NULL on API_KEYS (KEY_NAME) where USER_ID is null
16+
</sql>
17+
<sql>
18+
create unique index IDX_API_KEYS_NAME_USER_NOT_NULL on API_KEYS (KEY_NAME, USER_ID) where USER_ID is not null
19+
</sql>
20+
</changeSet>
21+
22+
<changeSet id="2210020" author="[email protected]" runInTransaction="false" context="!codegen">
23+
<validCheckSum>ANY</validCheckSum>
24+
25+
<preConditions onFail="MARK_RAN">
26+
<sqlCheck expectedResult="0">
27+
select count(key_id)
28+
from API_KEYS
29+
where KEY_NAME = 'concordAgentKey_autogenerated';
30+
</sqlCheck>
31+
<!-- concordAgentUserId='d4f123c1-f8d4-40b2-8a12-b8947b9ce2d8' -->
32+
<sqlCheck expectedResult="0">
33+
select count(key_id)
34+
from API_KEYS
35+
where USER_ID = 'd4f123c1-f8d4-40b2-8a12-b8947b9ce2d8';
36+
</sqlCheck>
37+
</preConditions>
38+
39+
<customChange class="com.walmartlabs.concord.server.liquibase.ext.ApiTokenCreator">
40+
<param name="keyName" value="concordAgentKey_autogenerated"/>
41+
<!-- values from concord-server.conf -->
42+
<param name="token" value="${defaultAgentToken}"/>
43+
<param name="skip" value="${skipAgentTokenGeneration}"/>
44+
</customChange>
45+
</changeSet>
46+
47+
</databaseChangeLog>

‎server/impl/src/main/java/com/walmartlabs/concord/server/security/apikey/ApiKeyRealm.java‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -62,17 +62,20 @@ public boolean supports(AuthenticationToken token) {
6262
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
6363
ApiKey t = (ApiKey) token;
6464

65-
UserEntry u = userManager.get(t.getUserId()).orElse(null);
66-
if (u == null) {
67-
return null;
68-
}
65+
UserEntry u = null;
66+
if (t.getUserId() != null) {
67+
u = userManager.get(t.getUserId()).orElse(null);
68+
if (u == null) {
69+
return null;
70+
}
6971

70-
if (u.isDisabled()) {
71-
throw new AuthenticationException("User account '" + u.getName() + "' is disabled");
72+
if (u.isDisabled()) {
73+
throw new AuthenticationException("User account '" + u.getName() + "' is disabled");
74+
}
7275
}
7376

7477
auditLog.add(AuditObject.SYSTEM, AuditAction.ACCESS)
75-
.userId(u.getId())
78+
.userId(u != null ? u.getId() : null)
7679
.field("realm", REALM_NAME)
7780
.field("apiKeyId", t.getKeyId())
7881
.log();

0 commit comments

Comments
 (0)