opensource/graylog2-server
1
0
Fork 0
mirror of https://github.com/Graylog2/graylog2-server.git synced 2026-03-13 09:32:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

DataNode: using JWT for authentication/authorisation (#16334)

Browse Source 
* jwt implementation, adding preflight + versionprobe

* adding JWT auth to anomaly detection client, some minor refactorings

* added missing license

* added provider, refactorings

* fixing small bugs

* set smaller default expiration

* using the correct OpenSearch distro for the erchitecture

* added config options

* small refactorings, fixing tests, adding dependencies for running tests from inside IntelliJ

* fixing import to correct Duration class

* removing unnecessary debug output

* fixing tests

* fixing tests

* adding JWT to Cluster test

* fixing path

* fixing path problems

* fix architecture logic for DatanodeContainerizedBackend

* fixing path problems

* fixing JWT settings in tests

* fixing JWT settings in tests

* fixing cluster test

* fixing cluster test

* fixing cluster test

* adding missing jwt token

* small refactoring to force thread-safety on creation

* the datanode uses mongodb - so the closing sequence needs to be adjusted

* moving config changes into config file, keep only change that has to be done by code

* adding breaking change info for JWT and clock synchronization.

* renaming config settings

* renaming config settings

* removed debug settings that are no longer in use

* renamed provider/annotation to be more precise

* lowering log level

* smaller refactorings/renamings

* keep config change in code until PR is merged, remove code in a follow-up PR

* moved changelog file to correct folder

* clock synchronsation

Co-authored-by: Dennis Oelkers <dennis@graylog.com>

* added jwt auth into changes after merge

* upped the timeout

* log curl connection information in DatanodeOpensearchWait

* replacing with jwt auth

* changing wait strategy

* fixing imports

* remove uname/pwd from opensearch rest base url

* propagate jwt token provider to http rest client callback, obtain fresh token every time

* inject IndexerJwtAuthTokenProvider in DatanodeConfigurationProvider

* remove rest uname/pwd from datanode configuration

---------

Co-authored-by: Tomas Dvorak <tomas.dvorak@graylog.com>
Co-authored-by: Dennis Oelkers <dennis@graylog.com>
This commit is contained in:
Jan Heise
2023-09-12 11:48:44 +02:00
committed by GitHub
parent 862520d455
commit cc52dcb5b0
35 changed files with 558 additions and 259 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
data-node/src/main/java/org/graylog/datanode/Configuration.java
View File

@@ -23,6 +23,7 @@ import com.github.joschi.jadconfig.Validator;
import com.github.joschi.jadconfig.ValidatorMethod;
import com.github.joschi.jadconfig.converters.IntegerConverter;
import com.github.joschi.jadconfig.converters.StringListConverter;
import com.github.joschi.jadconfig.util.Duration;
import com.github.joschi.jadconfig.validators.PositiveIntegerValidator;
import com.github.joschi.jadconfig.validators.StringNotBlankValidator;
import com.github.joschi.jadconfig.validators.URIAbsoluteValidator;
@@ -190,12 +191,27 @@ public class Configuration extends BaseConfiguration {
return opensearchProcessLogsBufferSize;
}
@Parameter(value = "rest_api_username")
private String restApiUsername;
@Parameter(value = "password_secret", required = true, validators = StringNotBlankValidator.class)
private String passwordSecret;
public String getPasswordSecret() {
return passwordSecret;
}
@Parameter(value = "indexer_jwt_auth_token_caching_duration")
Duration indexerJwtAuthTokenCachingDuration = Duration.seconds(60);
public Duration getIndexerJwtAuthTokenCachingDuration() {
return indexerJwtAuthTokenCachingDuration;
}
@Parameter(value = "indexer_jwt_auth_token_expiration_duration")
Duration indexerJwtAuthTokenExpirationDuration = Duration.seconds(180);
public Duration getIndexerJwtAuthTokenExpirationDuration() {
return indexerJwtAuthTokenExpirationDuration;
}
@ValidatorMethod
@SuppressWarnings("unused")
public void validatePasswordSecret() throws ValidationException {
@@ -204,9 +220,6 @@ public class Configuration extends BaseConfiguration {
}
}
@Parameter(value = "rest_api_password")
private String restApiPassword;
@Parameter(value = "node_id_file", validators = NodeIdFileValidator.class)
private String nodeIdFile = "data/node-id";
@@ -274,16 +287,6 @@ public class Configuration extends BaseConfiguration {
return datanodeHttpCertificatePassword;
}
public String getRestApiUsername() {
return restApiUsername;
}
public String getRestApiPassword() {
return restApiPassword;
}
public Optional<String> getOpensearchNetworkHostHost() {
return Optional.ofNullable(opensearchNetworkHostHost);
}