zowe / zowe/api-layer

Refactor of `org.zowe.apiml.filter.QueryWebFilter`

Open
#4,182 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Priority: Medium size/M technical excellence V3
Dominant language
Java
Stars
92
Forks
81
Avg merge
1d 9h
Merged PRs (30d)
46

Description

This issue is based on the changes in the PR #4108.

There were originaly three endpoint written as servlets (or as success handler): /gateway/api/v1/auth/query, gateway/api/v1/auth/ticket, and gateway/api/v1/auth/refresh. All of these were refactored into controllers.

As sideeffect there is still a react filter org.zowe.apiml.filter.QueryWebFilter that handles a part of logic. The aim of this issue to minimalize the code or remove it at all.

Here are the parts to be modified:

        if (!exchange.getRequest().getMethod().equals(this.httpMethod)) {
            AuthMethodNotSupportedException ex = new AuthMethodNotSupportedException(
                exchange.getRequest().getMethod().name());
            return this.failureHandler.onAuthenticationFailure(
                new WebFilterExchange(exchange, chain), ex);
        }

Since they are writted in controller with annotations @GetMapping and @PostMapping it is not necessary to check the method. It is now a responsibility of Spring and exception handlers. It implies also to remove method type from the constructor and the configuration in org.zowe.apiml.WebSecurityConfig.

These endpoints requires to provide JWT token. The check should be done on site of endpoint, not as a filtering step.

Only one meaningfull code that should stay here is checking of the x509, berause the endpoint requires the Zowe one.

The goal should be write a filter to check Zowe certificate and it should be configured for these three endpoints.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading org.zowe.apiml.filter.QueryWebFilter and the related configuration in org.zowe.apiml.WebSecurityConfig, then compare the controller changes from PR #4108. Remove obsolete method and JWT filtering responsibilities, retain the Zowe certificate check, and configure that check for the three listed endpoints. Done means the endpoints still enforce the required certificate behavior without the redundant filter logic.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, authentication, security
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.