Sergey Matvienko
4 years ago
4 changed files with 128 additions and 95 deletions
@ -0,0 +1,117 @@ |
|||
/** |
|||
* Copyright © 2016-2022 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.config; |
|||
|
|||
import lombok.Getter; |
|||
import lombok.RequiredArgsConstructor; |
|||
import lombok.extern.slf4j.Slf4j; |
|||
import org.apache.commons.lang3.RandomStringUtils; |
|||
import org.springframework.stereotype.Service; |
|||
import org.thingsboard.common.util.JacksonUtil; |
|||
import org.thingsboard.server.common.data.AdminSettings; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.dao.settings.AdminSettingsService; |
|||
|
|||
import javax.annotation.PostConstruct; |
|||
import javax.validation.ValidationException; |
|||
import java.nio.charset.StandardCharsets; |
|||
import java.util.Base64; |
|||
import java.util.Objects; |
|||
|
|||
@Service |
|||
@RequiredArgsConstructor |
|||
@Slf4j |
|||
public class JwtSettingsService { |
|||
|
|||
static final String ADMIN_SETTINGS_JWT_KEY = "jwt"; |
|||
static final String TOKEN_SIGNING_KEY_DEFAULT = "thingsboardDefaultSigningKey"; |
|||
static final String TB_ALLOW_DEFAULT_JWT_SIGNING_KEY = "TB_ALLOW_DEFAULT_JWT_SIGNING_KEY"; |
|||
|
|||
private final AdminSettingsService adminSettingsService; |
|||
|
|||
@Getter |
|||
private final JwtSettings jwtSettings; |
|||
|
|||
@PostConstruct |
|||
public void init() { |
|||
AdminSettings adminJwtSettings = findJwtAdminSettings(); |
|||
if (adminJwtSettings != null) { |
|||
log.debug("Loading the JWT admin settings from database"); |
|||
JwtSettings jwtLoaded = JacksonUtil.treeToValue(adminJwtSettings.getJsonValue(), JwtSettings.class); |
|||
jwtSettings.setRefreshTokenExpTime(jwtLoaded.getRefreshTokenExpTime()); |
|||
jwtSettings.setTokenExpirationTime(jwtLoaded.getTokenExpirationTime()); |
|||
jwtSettings.setTokenIssuer(jwtLoaded.getTokenIssuer()); |
|||
jwtSettings.setTokenSigningKey(jwtLoaded.getTokenSigningKey()); |
|||
} |
|||
|
|||
if (hasDefaultTokenSigningKey()) { |
|||
log.warn("JWT token signing key is default. This is a security issue. Please, consider to set unique value"); |
|||
} |
|||
} |
|||
|
|||
public boolean hasDefaultTokenSigningKey() { |
|||
return TOKEN_SIGNING_KEY_DEFAULT.equals(jwtSettings.getTokenSigningKey()); |
|||
} |
|||
|
|||
public void createJwtAdminSettings() { |
|||
Objects.requireNonNull(jwtSettings, "JWT settings is null"); |
|||
if (!isJwtAdminSettingsExists()) { |
|||
if (hasDefaultTokenSigningKey()) { |
|||
if (!isAllowedDefaultJwtSigningKey()) { |
|||
log.warn("JWT token signing key is default. Generating a new random key"); |
|||
jwtSettings.setTokenSigningKey(Base64.getEncoder().encodeToString(RandomStringUtils.randomAlphanumeric(64).getBytes(StandardCharsets.UTF_8))); |
|||
} |
|||
} |
|||
AdminSettings adminJwtSettings = new AdminSettings(); |
|||
adminJwtSettings.setTenantId(TenantId.SYS_TENANT_ID); |
|||
adminJwtSettings.setKey(ADMIN_SETTINGS_JWT_KEY); |
|||
adminJwtSettings.setJsonValue(JacksonUtil.valueToTree(jwtSettings)); |
|||
log.info("Saving new JWT admin settings. From this moment, the JWT parameters from YAML and ENV will be ignored"); |
|||
adminSettingsService.saveAdminSettings(TenantId.SYS_TENANT_ID, adminJwtSettings); |
|||
} |
|||
} |
|||
|
|||
public boolean isJwtAdminSettingsExists() { |
|||
return findJwtAdminSettings() == null; |
|||
} |
|||
|
|||
AdminSettings findJwtAdminSettings() { |
|||
return adminSettingsService.findAdminSettingsByKey(TenantId.SYS_TENANT_ID, ADMIN_SETTINGS_JWT_KEY); |
|||
} |
|||
|
|||
/* |
|||
* Allowing default JWT signing key is not secure |
|||
* */ |
|||
public boolean isAllowedDefaultJwtSigningKey() { |
|||
String allowDefaultJwtSigningKey = System.getenv(TB_ALLOW_DEFAULT_JWT_SIGNING_KEY); |
|||
return "true".equalsIgnoreCase(allowDefaultJwtSigningKey); |
|||
} |
|||
|
|||
public void validateJwtTokenSigningKey() { |
|||
if (!isJwtAdminSettingsExists()) { |
|||
if (hasDefaultTokenSigningKey()) { |
|||
if (isAllowedDefaultJwtSigningKey()) { |
|||
log.warn("Default JWT signing key is allowed. This is a security issue. Please, consider to set a strong key in admin settings"); |
|||
} else { |
|||
String message = "Please, set a unique signing key with env variable JWT_TOKEN_SIGNING_KEY. Key is a Base64 encoded phrase. This will require to generate new tokens for all users and API that uses JWT tokens. To allow insecure JWS use TB_ALLOW_DEFAULT_JWT_SIGNING_KEY=true"; |
|||
log.error(message); |
|||
throw new ValidationException(message); |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
} |
|||
Loading…
Reference in new issue