Security filter chain changed for the invalidate endpoint in mofulith and what caching storage modes are supported?
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
Describe the bug
Security filter chain for the modulith /auth/invalidate endpoint was unintentionally changed in #4818.
- The security configuration defines path
gateway/api/v1/auth/invalidate/**
https://github.com/zowe/api-layer/blob/a656f6d035d6788b09a623cec4d7df6877b59d56/apiml/src/main/java/org/zowe/apiml/WebSecurityConfig.java#L546-L550 - In the PR the
invalidateendpoint was changed to/gateway/api/v1/auth/invalidatehere:
https://github.com/zowe/api-layer/blob/a656f6d035d6788b09a623cec4d7df6877b59d56/zaas-service/src/main/java/org/zowe/apiml/zaas/security/service/ModulithAuthenticationService.java#L45-L46
and here:
https://github.com/zowe/api-layer/blob/a656f6d035d6788b09a623cec4d7df6877b59d56/zaas-service/src/main/java/org/zowe/apiml/zaas/security/service/ModulithAuthenticationService.java#L45-L46
The invalidate endpoint is used in modulith only when caching storage mode other than infinispan is used. This is possible only in development environment because the modulith start.sh script validates the configuration (https://github.com/zowe/api-layer/blob/a656f6d035d6788b09a623cec4d7df6877b59d56/apiml-package/src/main/resources/bin/validate.sh#L13-L21)
Such configuration is not covered in tests.
Do we want to support other caching storage modes than infinispan in modulith (even for tests or development environment)? If yes, we should fix it and add an integration test configuration. Otherwise this is a dead code to be removed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the security path in apiml/src/main/java/org/zowe/apiml/WebSecurityConfig.java and the invalidate endpoint in zaas-service/src/main/java/org/zowe/apiml/zaas/security/service/ModulithAuthenticationService.java. Review the storage-mode validation in apiml-package/src/main/resources/bin/validate.sh and existing test coverage to determine whether non-Infinispan modes are supported. Done means either an integration test configuration covers the supported modes and the security path is consistent, or the unused path and related code are removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100