zowe / zowe/api-layer

Security filter chain changed for the invalidate endpoint in mofulith and what caching storage modes are supported?

Open
#4,854 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Modulith Priority: Low size/S
Dominant language
Java
Stars
92
Forks
81
Avg merge
1d 9h
Merged PRs (30d)
46

Description

Describe the bug
Security filter chain for the modulith /auth/invalidate endpoint was unintentionally changed in #4818.

The invalidate endpoint is used in modulith only when caching storage mode other than infinispan is used. This is possible only in development environment because the modulith start.sh script validates the configuration (https://github.com/zowe/api-layer/blob/a656f6d035d6788b09a623cec4d7df6877b59d56/apiml-package/src/main/resources/bin/validate.sh#L13-L21)

Such configuration is not covered in tests.

Do we want to support other caching storage modes than infinispan in modulith (even for tests or development environment)? If yes, we should fix it and add an integration test configuration. Otherwise this is a dead code to be removed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the security path in apiml/src/main/java/org/zowe/apiml/WebSecurityConfig.java and the invalidate endpoint in zaas-service/src/main/java/org/zowe/apiml/zaas/security/service/ModulithAuthenticationService.java. Review the storage-mode validation in apiml-package/src/main/resources/bin/validate.sh and existing test coverage to determine whether non-Infinispan modes are supported. Done means either an integration test configuration covers the supported modes and the security path is consistent, or the unused path and related code are removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.