Refactor of `org.zowe.apiml.filter.QueryWebFilter`
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
This issue is based on the changes in the PR #4108.
There were originaly three endpoint written as servlets (or as success handler): /gateway/api/v1/auth/query, gateway/api/v1/auth/ticket, and gateway/api/v1/auth/refresh. All of these were refactored into controllers.
As sideeffect there is still a react filter org.zowe.apiml.filter.QueryWebFilter that handles a part of logic. The aim of this issue to minimalize the code or remove it at all.
Here are the parts to be modified:
if (!exchange.getRequest().getMethod().equals(this.httpMethod)) {
AuthMethodNotSupportedException ex = new AuthMethodNotSupportedException(
exchange.getRequest().getMethod().name());
return this.failureHandler.onAuthenticationFailure(
new WebFilterExchange(exchange, chain), ex);
}
Since they are writted in controller with annotations @GetMapping and @PostMapping it is not necessary to check the method. It is now a responsibility of Spring and exception handlers. It implies also to remove method type from the constructor and the configuration in org.zowe.apiml.WebSecurityConfig.
These endpoints requires to provide JWT token. The check should be done on site of endpoint, not as a filtering step.
Only one meaningfull code that should stay here is checking of the x509, berause the endpoint requires the Zowe one.
The goal should be write a filter to check Zowe certificate and it should be configured for these three endpoints.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading org.zowe.apiml.filter.QueryWebFilter and the related configuration in org.zowe.apiml.WebSecurityConfig, then compare the controller changes from PR #4108. Remove obsolete method and JWT filtering responsibilities, retain the Zowe certificate check, and configure that check for the three listed endpoints. Done means the endpoints still enforce the required certificate behavior without the redundant filter logic.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, authentication, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100