3keycompany / czertainly-auth

CZERTAINLY - authentication service for the platform

CZERTAINLY Auth Service

This repository is part of the commercial open source project CZERTAINLY. You can find more information about the project at CZERTAINLY repository, including the contribution guide.

Auth service is designed as a central service for managing access control to different resources and related actions and objects, and identify users based on identification token.

Auth service offers the following functionality:

• identification of user
• management of roles
• management of users and their roles membership
• management of resources and related actions
• management of role permissions for specific resources and related actions
• issuing authorization tokens

User can belong to multiple roles and permissions are merged in this case from all assigned roles.

Note The authorization is performed by the OPA. The Auth service manages users, roles, and associated permissions that can be assigned to users.

Authentication flow

Users can be identified based on identification token provided in this order:

1. X.509 certificate
2. JSON ID
3. Username of system user

After successful identification, user details with its merged role permissions is returned. If none of the above specified data is present, user is identified as anonymous user with limited permissions.

X.509 certificate

When identifying user with certificate, its content string is decoded and parsed. Afterwards it is verified if it is valid and trusted.

Then, based on its fingerprint, it is mapped to user from database and return authentication response. The certificate can be assigned to maximum of 1 user.

JSON ID

When identifying user with JSON ID, it is decoded and must conform to the required structure. Username specified in the JSON ID is used as unique information based on which user is identified.

Auth service can be further configured to create user or role, if it does not exist.

Username of system user

Username is used only for internal identification of system users to elevate permissions and perform actions that are otherwise subject to authorization. This is not exposed for the external systems.

Authorization

This service does not evaluate permissions. The authorization is controlled by the Open Policy Agent. For more information, refer to CZERTAINLY Documentation.

Docker container

Auth service is provided as a Docker container. Use the 3keycompany/czertainly-auth:tagname to pull the required image from the repository. It can be configured using the following environment variables:

Variable	Description	Required	Default value
AUTH_DB_CONNECTION_STRING	Connection string for database access		N/A
AUTH_CREATE_UNKNOWN_USERS	Unknown user with username specified in JSON authentication token will be created		false
AUTH_CREATE_UNKNOWN_ROLES	Unknown role with name specified in JSON authentication token will be created and assigned to user		false
SYNC_POLICY	create-only - create users and roles based on previous variables, changes in token not reflected in already existing user. sync-data - user's properties and roles are synced with the user data present in token		create-only

czertainly-auth's Issues

Security Policy violation SECURITY.md

This issue was automatically created by Allstar.

Security Policy Violation
Security policy not enabled.
A SECURITY.md file can give users information about what constitutes a vulnerability and how to report one securely so that information about a bug is not publicly visible. Examples of secure reporting methods include using an issue tracker with private issue support, or encrypted email with a published key.

To fix this, add a SECURITY.md file that explains how to handle vulnerabilities found in your repository. Go to https://github.com/CZERTAINLY/CZERTAINLY-Auth/security/policy to enable.

For more information, see https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository.

---

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

Security Policy violation Repository Administrators

This issue was automatically created by Allstar.

Security Policy Violation
Did not find any owners of this repository
This policy requires all repositories to have a user or team assigned as an administrator. A responsible party is required by organization policy to respond to security events and organization requests.

To add an administrator From the main page of the repository, go to Settings -> Manage Access.
(For more information, see https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories)

Alternately, if this repository does not have any maintainers, archive or delete it.

---

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

Add sync policy support for users

Currently we have the following options working with users that are authenticated using external identity provider:
AUTH_CREATE_UNKNOWN_USERS - Unknown user with username specified in JSON authentication token will be created
AUTH_CREATE_UNKNOWN_ROLES - Unknown role with name specified in JSON authentication token will be created and assigned to user

When user or role is created, they are not changed when there is some change in external identity provider which cause that the user data is not synchronized. A typical situation is when there is a change of roles for the user. Such change will not be currently reflected in CZERTAINLY.

We can implement new configuration property SYNC_POLICY that can be configured as follows:

• create-only - this will create users and roles as currently implement, and will be default option
• sync-data - this will assume that external identity provider has always current data and the data will be synchronized with the user data and roles in CZERTAINLY every login

When the desired behaviour is to keep the user data synchronized with the configuration of the external identity provider, it can be enabled by using the SYNC_POLICY=sync

Improve exceptions handling

Implement better general exceptions handling - improve ExceptionMiddleware

• unify exceptions handling, add base exception to have common response DTO
• different exception response based on environment (hide details in Production)
• add exception handling in existing code, raise corresponding exceptions

Create new microservice for Authorization service

Create Authorization microservice where will be further implemented access control logic. Application should contain basic skeleton with implementation of individual app layers and Auth service DB model

Requirements:

• GitHub repository
• .NET 6 Web API application
• DB model entities with migration

Add trusted certificates handling and validation of certificate

Add trusted certificate passed as secret to be added as trusted during build/deployment. That will allow successfully fully validate certificate used for authentication.

Related PRs:
CZERTAINLY/CZERTAINLY-Core#127
CZERTAINLY/CZERTAINLY-EJBCA-NG-Connector#24

Deployment pipeline for Auth service

Create pipeline with automatic build and deploy Auth service to Kubernetes of same standards as other Czertainly platform services.

Implement endpoints for saving and retrieving role permissions

Implement endpoints that are integrated with getting and editing permissions of roles.

Requirements:

• retrieve all resources and their actions
• design DTOs to communicate with Core regarding permissions
• add endpoint to update permissions of role (incremental or replacement of all permissions with new ones)
• add endpoint to retrieve role and user permissions

CRUD operations for management of users/roles and their permissions

Implement authentication of user with OIDC token

Implement OIDC token authentication type of user as an alternative to client certificate.
Authentication with token should work as following:

• decode and parse token payload
• if user with username specified in token data does not exist, create new one
• if roles specified in token data does not exist, do not create new one
• assign existing roles from token data to user
• if no token or certificate is present or certificate does not have user assigned, throw 401

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Pending Approval

These branches will be created by Renovate only once you click their checkbox below.

• Update all non-major dependencies (Microsoft.EntityFrameworkCore, Microsoft.EntityFrameworkCore.SqlServer, Microsoft.EntityFrameworkCore.Tools, NLog.Extensions.Logging, NLog.Web.AspNetCore, Swashbuckle.AspNetCore, sigstore/cosign-installer)

Detected dependencies

dockerfile

Dockerfile

• mcr.microsoft.com/dotnet/aspnet 8.0
• mcr.microsoft.com/dotnet/sdk 8.0

github-actions

.github/workflows/build.yml

• actions/checkout v4
• actions/setup-java v4
• actions/checkout v4
• actions/cache v4
• actions/cache v4

.github/workflows/codeql.yml

• actions/checkout v4
• github/codeql-action v3
• github/codeql-action v3
• github/codeql-action v3

.github/workflows/publish_docker_3key.yaml

• actions/checkout v4
• sigstore/cosign-installer v3.5.0
• docker/setup-qemu-action v3
• docker/setup-buildx-action v3
• docker/login-action v3
• docker/metadata-action v5
• docker/build-push-action v6
• christian-korneck/update-container-description-action v1

.github/workflows/publish_docker_czertainly.yaml

• actions/checkout v4
• sigstore/cosign-installer v3.5.0
• docker/setup-qemu-action v3
• docker/setup-buildx-action v3
• docker/login-action v3
• docker/metadata-action v5
• docker/build-push-action v6
• christian-korneck/update-container-description-action v1

.github/workflows/publish_harbor_3key.yaml

• actions/checkout v4
• sigstore/cosign-installer v3.5.0
• docker/setup-qemu-action v3
• docker/setup-buildx-action v3
• docker/login-action v3
• docker/metadata-action v5
• docker/build-push-action v6
• christian-korneck/update-container-description-action v1

.github/workflows/test_docker_image.yaml

• actions/checkout v4
• docker/setup-qemu-action v3
• docker/setup-buildx-action v3
• docker/metadata-action v5
• docker/build-push-action v6

nuget

src/Czertainly.Auth/Czertainly.Auth.csproj

• System.Diagnostics.DiagnosticSource 8.0.1
• Swashbuckle.AspNetCore 6.6.2
• Npgsql.EntityFrameworkCore.PostgreSQL 8.0.4
• NLog.Web.AspNetCore 5.3.11
• NLog.Extensions.Logging 5.3.11
• Microsoft.VisualStudio.Azure.Containers.Tools.Targets 1.21.0
• Microsoft.EntityFrameworkCore.Tools 8.0.7
• Microsoft.EntityFrameworkCore.SqlServer 8.0.7
• Microsoft.EntityFrameworkCore 8.0.7
• Microsoft.AspNetCore.Mvc.Versioning 5.1.0
• AutoMapper.Extensions.Microsoft.DependencyInjection 12.0.1

---

• Check this box to trigger a request for Renovate to run again on this repository

Implement resource sync with Core service

Implement resource sync endpoint to sync all resources and their actions used in Core service.
These information is then used to assign permissions only for existing resources and actions.

Security Policy violation Branch Protection

This issue was automatically created by Allstar.

Security Policy Violation
Dismiss stale reviews not configured for branch develop

---

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

User roles are only added but not removed

Describe the bug
User roles are only added but not removed, when user loses role.

To Reproduce

1. login into CZERTAINLY and make note of roles of an user
2. logout from CZERTAINLY
3. login into Keycloak
4. locate user, add some other value to groups, for example test
5. login into CZERTAINLY and check roles of that user, you should see that test was adddes
6. logout from CZERTAINLY and in Keycloak remove test group
7. login into CZERTAINLY and check roles of test user, you should see that test is still there

Expected behavior
I expect that when I remove group from user in Keycloak it is also removed in CZERTAINLY.

Screenshots

Keycloak screen showing that admin doesn't have test role

CZERTAINLY showing that admin user have both roles superadmin, test

Additional context
I'm running CZERTAINLY 2.11 and Keycloak 21

Change initial seeding of Auth service DB

Change initial seeding of Auth service DB. Necessary system roles/users and migrated roles/users will be seeded from Core service.

Seeding of Auth service needs to be removed. To allow creation of system roles/users and set permissions of system roles, DTOs used for creation needs to be updated with corresponding properties.

Implement endpoint auth flow

Requirements:

• Implement authentication of user based on certificate sent with request
• Merge user permissions from permissions of roles he has assigned
• Response with complete user profile - user information, its roles and merged permissions

Add endpoints to retrieve users permissions

Add endpoints to Auth service that can retrieve permissions of user.

Requirements:

• get all resources and its actions
• get allowed resources for specified action/s
• get allowed actions for specific resource/s
• allow specifying object UUID for above mentioned get operations for allowed resources/actions