Securing microservices with JSON Web Tokens

 1// tag::copyright[]
 2/*******************************************************************************
 3 * Copyright (c) 2017, 2022 IBM Corporation and others.
 4 * All rights reserved. This program and the accompanying materials
 5 * are made available under the terms of the Eclipse Public License 2.0
 6 * which accompanies this distribution, and is available at
 7 * http://www.eclipse.org/legal/epl-2.0/
 8 *
 9 * SPDX-License-Identifier: EPL-2.0
10 *******************************************************************************/
11// end::copyright[]
12package io.openliberty.guides.system;
13
14import jakarta.json.JsonArray;
15import jakarta.enterprise.context.RequestScoped;
16import jakarta.inject.Inject;
17import jakarta.ws.rs.GET;
18import jakarta.ws.rs.Path;
19import jakarta.ws.rs.Produces;
20import jakarta.ws.rs.core.MediaType;
21import jakarta.annotation.security.RolesAllowed;
22
23import org.eclipse.microprofile.jwt.Claim;
24
25@RequestScoped
26@Path("/properties")
27public class SystemResource {
28
29    @Inject
30    // tag::claim[]
31    @Claim("groups")
32    // end::claim[]
33    // tag::rolesArray[]
34    private JsonArray roles;
35    // end::rolesArray[]
36
37    @GET
38    // tag::usernameEndpoint[]
39    @Path("/username")
40    // end::usernameEndpoint[]
41    @Produces(MediaType.APPLICATION_JSON)
42    // tag::rolesAllowedAdminUser1[]
43    @RolesAllowed({ "admin", "user" })
44    // end::rolesAllowedAdminUser1[]
45    public String getUsername() {
46        return System.getProperties().getProperty("user.name");
47    }
48
49    @GET
50    // tag::osEndpoint[]
51    @Path("/os")
52    // end::osEndpoint[]
53    @Produces(MediaType.APPLICATION_JSON)
54    // tag::rolesAllowedAdmin[]
55    @RolesAllowed({ "admin" })
56    // end::rolesAllowedAdmin[]
57    public String getOS() {
58        return System.getProperties().getProperty("os.name");
59    }
60
61    @GET
62    // tag::rolesEndpoint[]
63    @Path("/jwtroles")
64    // end::rolesEndpoint[]
65    @Produces(MediaType.APPLICATION_JSON)
66    // tag::rolesAllowedAdminUser2[]
67    @RolesAllowed({ "admin", "user" })
68    // end::rolesAllowedAdminUser2[]
69    public String getRoles() {
70        return roles.toString();
71    }
72}

 1// tag::copyright[]
 2/*******************************************************************************
 3 * Copyright (c) 2020, 2022 IBM Corporation and others.
 4 * All rights reserved. This program and the accompanying materials
 5 * are made available under the terms of the Eclipse Public License 2.0
 6 * which accompanies this distribution, and is available at
 7 * http://www.eclipse.org/legal/epl-2.0/
 8 *
 9 * SPDX-License-Identifier: EPL-2.0
10 *******************************************************************************/
11// end::copyright[]
12package io.openliberty.guides.frontend.client;
13
14import jakarta.enterprise.context.RequestScoped;
15import jakarta.ws.rs.GET;
16import jakarta.ws.rs.Path;
17import jakarta.ws.rs.Produces;
18import jakarta.ws.rs.core.MediaType;
19import jakarta.ws.rs.HeaderParam;
20
21import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
22
23// tag::systemClient[]
24@RegisterRestClient(baseUri = "https://localhost:8443/system")
25@Path("/properties")
26@RequestScoped
27public interface SystemClient extends AutoCloseable {
28
29    @GET
30    @Path("/os")
31    @Produces(MediaType.APPLICATION_JSON)
32    // tag::headerParam1[]
33    String getOS(@HeaderParam("Authorization") String authHeader);
34    // end::headerParam1[]
35
36    @GET
37    @Path("/username")
38    @Produces(MediaType.APPLICATION_JSON)
39    // tag::headerParam2[]
40    String getUsername(@HeaderParam("Authorization") String authHeader);
41    // end::headerParam2[]
42
43    @GET
44    @Path("/jwtroles")
45    @Produces(MediaType.APPLICATION_JSON)
46    // tag::headerParam3[]
47    String getJwtRoles(@HeaderParam("Authorization") String authHeader);
48    // end::headerParam3[]
49}
50// end::systemClient[]

 1// tag::copyright[]
 2/*******************************************************************************
 3 * Copyright (c) 2020, 2022 IBM Corporation and others.
 4 * All rights reserved. This program and the accompanying materials
 5 * are made available under the terms of the Eclipse Public License 2.0
 6 * which accompanies this distribution, and is available at
 7 * http://www.eclipse.org/legal/epl-2.0/
 8 *
 9 * SPDX-License-Identifier: EPL-2.0
10 *******************************************************************************/
11// end::copyright[]
12package io.openliberty.guides.frontend;
13
14import jakarta.enterprise.context.ApplicationScoped;
15import jakarta.inject.Inject;
16import jakarta.inject.Named;
17
18import org.eclipse.microprofile.rest.client.inject.RestClient;
19
20import io.openliberty.guides.frontend.client.SystemClient;
21import io.openliberty.guides.frontend.util.SessionUtils;
22
23
24@ApplicationScoped
25@Named
26public class ApplicationBean {
27
28    // tag::restClient[]
29    @Inject
30    @RestClient
31    private SystemClient defaultRestClient;
32    // end::restClient[]
33
34    // tag::getJwt[]
35    public String getJwt() {
36        String jwtTokenString = SessionUtils.getJwtToken();
37        String authHeader = "Bearer " + jwtTokenString;
38        return authHeader;
39    }
40    // end::getJwt[]
41
42    // tag::getOs[]
43    public String getOs() {
44        String authHeader = getJwt();
45        String os;
46        try {
47            // tag::authHeader1[]
48            os = defaultRestClient.getOS(authHeader);
49            // end::authHeader1[]
50        } catch (Exception e) {
51            return "You are not authorized to access this system property";
52        }
53        return os;
54    }
55    // end::getOs[]
56
57    // tag::getUsername[]
58    public String getUsername() {
59        String authHeader = getJwt();
60        // tag::authHeader2[]
61        return defaultRestClient.getUsername(authHeader);
62        // end::authHeader2[]
63    }
64    // end::getUsername[]
65
66    // tag::getJwtRoles[]
67    public String getJwtRoles() {
68        String authHeader = getJwt();
69        // tag::authHeader3[]
70        return defaultRestClient.getJwtRoles(authHeader);
71        // end::authHeader3[]
72    }
73    // end::getJwtRoles[]
74
75}

  1// tag::copyright[]
  2/*******************************************************************************
  3 * Copyright (c) 2018, 2022 IBM Corporation and others.
  4 * All rights reserved. This program and the accompanying materials
  5 * are made available under the terms of the Eclipse Public License 2.0
  6 * which accompanies this distribution, and is available at
  7 * http://www.eclipse.org/legal/epl-2.0/
  8 *
  9 * SPDX-License-Identifier: EPL-2.0
 10 *******************************************************************************/
 11// end::copyright[]
 12package io.openliberty.guides.frontend;
 13
 14import java.util.Set;
 15import java.util.HashSet;
 16import jakarta.servlet.ServletException;
 17import jakarta.servlet.http.HttpServletRequest;
 18import jakarta.servlet.http.HttpSession;
 19import jakarta.enterprise.context.ApplicationScoped;
 20import jakarta.inject.Named;
 21
 22import com.ibm.websphere.security.jwt.JwtBuilder;
 23import com.ibm.websphere.security.jwt.Claims;
 24
 25import io.openliberty.guides.frontend.util.SessionUtils;
 26
 27// tag::loginBean[]
 28@ApplicationScoped
 29@Named
 30public class LoginBean {
 31
 32    private String username;
 33    private String password;
 34
 35    public void setUsername(String username) {
 36        this.username = username;
 37    }
 38
 39    public void setPassword(String password) {
 40        this.password = password;
 41    }
 42
 43    public String getUsername() {
 44        return username;
 45    }
 46
 47    public String getPassword() {
 48        return password;
 49    }
 50
 51    // tag::doLogin[]
 52    public String doLogin() throws Exception {
 53        HttpServletRequest request = SessionUtils.getRequest();
 54
 55        try {
 56            request.logout();
 57            request.login(this.username, this.password);
 58        } catch (ServletException e) {
 59            System.out.println("Login failed.");
 60            return "error.jsf";
 61        }
 62
 63        String remoteUser = request.getRemoteUser();
 64        Set<String> roles = getRoles(request);
 65        if (remoteUser != null && remoteUser.equals(username)) {
 66            String jwt = buildJwt(username, roles);
 67            HttpSession ses = request.getSession();
 68            if (ses == null) {
 69                System.out.println("Session timed out.");
 70            } else {
 71                // tag::setAttribute[]
 72                ses.setAttribute("jwt", jwt);
 73                // end::setAttribute[]
 74            }
 75        } else {
 76            System.out.println("Failed to update JWT in session.");
 77        }
 78        return "application.jsf?faces-redirect=true";
 79    }
 80    // end::doLogin[]
 81    // tag::buildJwt[]
 82
 83  private String buildJwt(String userName, Set<String> roles) throws Exception {
 84        // tag::jwtBuilder[]
 85        return JwtBuilder.create("jwtFrontEndBuilder")
 86        // end::jwtBuilder[]
 87                         .claim(Claims.SUBJECT, userName)
 88                         .claim("upn", userName)
 89                         // tag::claim[]
 90                         .claim("groups", roles.toArray(new String[roles.size()]))
 91                         .claim("aud", "systemService")
 92                         // end::claim[]
 93                         .buildJwt()
 94                         .compact();
 95
 96    }
 97    // end::buildJwt[]
 98
 99    private Set<String> getRoles(HttpServletRequest request) {
100        Set<String> roles = new HashSet<String>();
101        boolean isAdmin = request.isUserInRole("admin");
102        boolean isUser = request.isUserInRole("user");
103        if (isAdmin) {
104            roles.add("admin");
105        }
106        if (isUser) {
107            roles.add("user");
108        }
109        return roles;
110    }
111}
112// end::loginBean[]

 1<server description="Sample Liberty server">
 2
 3  <featureManager>
 4    <feature>restfulWS-3.1</feature>
 5    <feature>jsonb-3.0</feature>
 6    <feature>jsonp-2.1</feature>
 7    <feature>cdi-4.0</feature>
 8    <feature>mpConfig-3.1</feature>
 9    <feature>mpRestClient-3.0</feature>
10    <feature>appSecurity-5.0</feature>
11    <feature>servlet-6.0</feature>
12    <!-- tag::mpJwt[] -->
13    <feature>mpJwt-2.1</feature>
14    <!-- end::mpJwt[] -->
15  </featureManager>
16
17  <variable name="http.port" defaultValue="8080"/>
18  <variable name="https.port" defaultValue="8443"/>
19
20  <keyStore id="defaultKeyStore" password="secret"/>
21  
22  <httpEndpoint host="*" httpPort="${http.port}" httpsPort="${https.port}"
23                id="defaultHttpEndpoint"/>
24                 
25  <webApplication location="system.war" contextRoot="/"/>
26
27</server>

  1// tag::copyright[]
  2/*******************************************************************************
  3 * Copyright (c) 2020, 2023 IBM Corporation and others.
  4 * All rights reserved. This program and the accompanying materials
  5 * are made available under the terms of the Eclipse Public License 2.0
  6 * which accompanies this distribution, and is available at
  7 * http://www.eclipse.org/legal/epl-2.0/
  8 *
  9 * SPDX-License-Identifier: EPL-2.0
 10 *******************************************************************************/
 11// end::copyright[]
 12package it.io.openliberty.guides.system;
 13
 14import jakarta.ws.rs.client.Client;
 15import jakarta.ws.rs.client.ClientBuilder;
 16import jakarta.ws.rs.client.Invocation.Builder;
 17import jakarta.ws.rs.core.Response;
 18import jakarta.ws.rs.core.HttpHeaders;
 19import jakarta.ws.rs.core.MediaType;
 20
 21import org.junit.jupiter.api.Test;
 22import org.junit.jupiter.api.BeforeAll;
 23import static org.junit.jupiter.api.Assertions.assertEquals;
 24
 25import it.io.openliberty.guides.system.util.JwtBuilder;
 26
 27public class SystemEndpointIT {
 28
 29    static String authHeaderAdmin;
 30    static String authHeaderUser;
 31    static String urlOS;
 32    static String urlUsername;
 33    static String urlRoles;
 34
 35    @BeforeAll
 36    public static void setup() throws Exception {
 37        String urlBase = "http://" + System.getProperty("hostname")
 38                 + ":" + System.getProperty("http.port")
 39                 + "/system/properties";
 40        urlOS = urlBase + "/os";
 41        urlUsername = urlBase + "/username";
 42        urlRoles = urlBase + "/jwtroles";
 43
 44        authHeaderAdmin = "Bearer " + new JwtBuilder().createAdminJwt("testUser");
 45        authHeaderUser = "Bearer " + new JwtBuilder().createUserJwt("testUser");
 46    }
 47
 48    @Test
 49    // tag::os[]
 50    public void testOSEndpoint() {
 51        // tag::adminRequest1[]
 52        Response response = makeRequest(urlOS, authHeaderAdmin);
 53        // end::adminRequest1[]
 54        assertEquals(200, response.getStatus(),
 55                    "Incorrect response code from " + urlOS);
 56        assertEquals(System.getProperty("os.name"), response.readEntity(String.class),
 57                "The system property for the local and remote JVM should match");
 58
 59        // tag::userRequest1[]
 60        response = makeRequest(urlOS, authHeaderUser);
 61        // end::userRequest1[]
 62        assertEquals(403, response.getStatus(),
 63                    "Incorrect response code from " + urlOS);
 64
 65        // tag::nojwtRequest1[]
 66        response = makeRequest(urlOS, null);
 67        // end::nojwtRequest1[]
 68        assertEquals(401, response.getStatus(),
 69                    "Incorrect response code from " + urlOS);
 70
 71        response.close();
 72    }
 73    // end::os[]
 74
 75    @Test
 76    // tag::username[]
 77    public void testUsernameEndpoint() {
 78        // tag::adminRequest2[]
 79        Response response = makeRequest(urlUsername, authHeaderAdmin);
 80        // end::adminRequest2[]
 81        assertEquals(200, response.getStatus(),
 82                "Incorrect response code from " + urlUsername);
 83
 84        // tag::userRequest2[]
 85        response = makeRequest(urlUsername, authHeaderUser);
 86        // end::userRequest2[]
 87        assertEquals(200, response.getStatus(),
 88                "Incorrect response code from " + urlUsername);
 89
 90        // tag::nojwtRequest2[]
 91        response = makeRequest(urlUsername, null);
 92        // end::nojwtRequest2[]
 93        assertEquals(401, response.getStatus(),
 94                "Incorrect response code from " + urlUsername);
 95
 96        response.close();
 97    }
 98    // end::username[]
 99
100    @Test
101    // tag::roles[]
102    public void testRolesEndpoint() {
103        // tag::adminRequest3[]
104        Response response = makeRequest(urlRoles, authHeaderAdmin);
105        // end::adminRequest3[]
106        assertEquals(200, response.getStatus(),
107                "Incorrect response code from " + urlRoles);
108        assertEquals("[\"admin\",\"user\"]", response.readEntity(String.class),
109                "Incorrect groups claim in token " + urlRoles);
110
111        // tag::userRequest3[]
112        response = makeRequest(urlRoles, authHeaderUser);
113        // end::userRequest3[]
114        assertEquals(200, response.getStatus(),
115                "Incorrect response code from " + urlRoles);
116        assertEquals("[\"user\"]", response.readEntity(String.class),
117                "Incorrect groups claim in token " + urlRoles);
118
119        // tag::nojwtRequest3[]
120        response = makeRequest(urlRoles, null);
121        // end::nojwtRequest3[]
122        assertEquals(401, response.getStatus(),
123                "Incorrect response code from " + urlRoles);
124
125        response.close();
126    }
127    // end::roles[]
128
129    private Response makeRequest(String url, String authHeader) {
130        try (Client client = ClientBuilder.newClient()) {
131            Builder builder = client.target(url).request();
132            builder.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON);
133            if (authHeader != null) {
134            builder.header(HttpHeaders.AUTHORIZATION, authHeader);
135            }
136            Response response = builder.get();
137            return response;
138        }
139    }
140
141}