Skip to content

Commit 9a0a6e9

Browse files
MuchembiMuchembi
authored
Merge branch 'kafbat:main' into feature/google_managed_service_for_kafka_login_handler
2 parents 046f790 + dfab5e5 commit 9a0a6e9

File tree

16 files changed

+1244
-34
lines changed

16 files changed

+1244
-34
lines changed

‎api/src/main/java/io/kafbat/ui/config/auth/LdapProperties.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ public class LdapProperties {
2020

2121
@Value("${oauth2.ldap.activeDirectory:false}")
2222
private boolean isActiveDirectory;
23-
@Value("${oauth2.ldap.activeDirectory.domain:@null}")
23+
@Value("${oauth2.ldap.activeDirectory.domain:#{null}}")
2424
private String activeDirectoryDomain;
2525

2626
}

‎api/src/main/java/io/kafbat/ui/config/auth/LdapSecurityConfig.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import java.util.stream.Stream;
1313
import lombok.RequiredArgsConstructor;
1414
import lombok.extern.slf4j.Slf4j;
15+
import org.apache.commons.lang3.StringUtils;
1516
import org.springframework.beans.factory.annotation.Autowired;
1617
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
1718
import org.springframework.boot.context.properties.EnableConfigurationProperties;
@@ -163,6 +164,10 @@ public SecurityWebFilterChain configureLdap(ServerHttpSecurity http) {
163164
}
164165

165166
private ActiveDirectoryLdapAuthenticationProvider activeDirectoryProvider(LdapAuthoritiesPopulator populator) {
167+
if (StringUtils.isBlank(props.getActiveDirectoryDomain())) {
168+
throw new IllegalArgumentException("Active Directory domain is required but not specified");
169+
}
170+
166171
ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider(
167172
props.getActiveDirectoryDomain(),
168173
props.getUrls()

‎api/src/main/java/io/kafbat/ui/service/KafkaConfigSanitizer.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ class KafkaConfigSanitizer {
2929
.addAll(kafkaConfigKeysToSanitize())
3030
.add(
3131
"basic.auth.user.info", /* For Schema Registry credentials */
32-
"password", "secret", "token", "key", ".*credentials.*", /* General credential patterns */
32+
"password", "secret", "token", "key", ".*credentials.*", "passphrase", /* General credential patterns */
3333
"aws.access.*", "aws.secret.*", "aws.session.*", /* AWS-related credential patterns */
3434
"connection.uri" /* mongo credential patterns */
3535
)

‎api/src/test/java/io/kafbat/ui/service/KafkaConfigSanitizerTest.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ void obfuscateCredentials() {
2727
assertThat(sanitizer.sanitize("main.consumer.sasl.jaas.config", "secret")).isEqualTo("******");
2828
assertThat(sanitizer.sanitize("database.password", "secret")).isEqualTo("******");
2929
assertThat(sanitizer.sanitize("basic.auth.user.info", "secret")).isEqualTo("******");
30+
assertThat(sanitizer.sanitize("private.key.passphrase", "secret")).isEqualTo("******");
3031

3132
//AWS var sanitizing
3233
assertThat(sanitizer.sanitize("aws.access.key.id", "secret")).isEqualTo("******");

‎api/src/test/java/io/kafbat/ui/service/rbac/AccessControlServiceRbacDisabledTest.java

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
package io.kafbat.ui.service.rbac;
2+
3+
import static io.kafbat.ui.service.rbac.MockedRbacUtils.CONNECT_NAME;
4+
import static io.kafbat.ui.service.rbac.MockedRbacUtils.CONSUMER_GROUP_NAME;
5+
import static io.kafbat.ui.service.rbac.MockedRbacUtils.DEV_ROLE;
6+
import static io.kafbat.ui.service.rbac.MockedRbacUtils.PROD_CLUSTER;
7+
import static io.kafbat.ui.service.rbac.MockedRbacUtils.SCHEMA_NAME;
8+
import static io.kafbat.ui.service.rbac.MockedRbacUtils.TOPIC_NAME;
9+
import static io.kafbat.ui.service.rbac.MockedRbacUtils.getAccessContext;
10+
import static org.assertj.core.api.Assertions.assertThat;
11+
import static org.mockito.Mockito.when;
12+
13+
import io.kafbat.ui.AbstractIntegrationTest;
14+
import io.kafbat.ui.config.auth.RbacUser;
15+
import io.kafbat.ui.model.ClusterDTO;
16+
import io.kafbat.ui.model.ConnectDTO;
17+
import io.kafbat.ui.model.InternalTopic;
18+
import io.kafbat.ui.model.rbac.AccessContext;
19+
import io.kafbat.ui.model.rbac.Role;
20+
import java.util.List;
21+
import org.junit.jupiter.api.BeforeEach;
22+
import org.junit.jupiter.api.Test;
23+
import org.mockito.Mock;
24+
import org.mockito.MockedStatic;
25+
import org.mockito.Mockito;
26+
import org.springframework.beans.factory.annotation.Autowired;
27+
import org.springframework.security.core.Authentication;
28+
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
29+
import org.springframework.security.core.context.SecurityContext;
30+
import org.springframework.test.annotation.DirtiesContext;
31+
import reactor.core.publisher.Mono;
32+
import reactor.test.StepVerifier;
33+
34+
/**
35+
* Test cases for AccessControlService when RBAC is disabled.
36+
* Using PROD cluster and user DEV role for all tests.
37+
*/
38+
@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_CLASS)
39+
class AccessControlServiceRbacDisabledTest extends AbstractIntegrationTest {
40+
41+
@Autowired
42+
AccessControlService accessControlService;
43+
44+
@Mock
45+
SecurityContext securityContext;
46+
47+
@Mock
48+
Authentication authentication;
49+
50+
@Mock
51+
RbacUser user;
52+
53+
@BeforeEach
54+
void setUp() {
55+
// Mock security context
56+
when(securityContext.getAuthentication()).thenReturn(authentication);
57+
when(authentication.getPrincipal()).thenReturn(user);
58+
}
59+
60+
public void withSecurityContext(Runnable runnable) {
61+
try (MockedStatic<ReactiveSecurityContextHolder> ctxHolder = Mockito.mockStatic(
62+
ReactiveSecurityContextHolder.class)) {
63+
// Mock static method to get security context
64+
ctxHolder.when(ReactiveSecurityContextHolder::getContext).thenReturn(Mono.just(securityContext));
65+
runnable.run();
66+
}
67+
}
68+
69+
@Test
70+
void validateAccess() {
71+
withSecurityContext(() -> {
72+
when(user.groups()).thenReturn(List.of(DEV_ROLE));
73+
AccessContext context = getAccessContext(PROD_CLUSTER, true);
74+
Mono<Void> validateAccessMono = accessControlService.validateAccess(context);
75+
StepVerifier.create(validateAccessMono)
76+
.expectComplete()
77+
.verify();
78+
});
79+
}
80+
81+
@Test
82+
void isClusterAccessible() {
83+
withSecurityContext(() -> {
84+
when(user.groups()).thenReturn(List.of(DEV_ROLE));
85+
ClusterDTO clusterDto = new ClusterDTO();
86+
clusterDto.setName(PROD_CLUSTER);
87+
Mono<Boolean> clusterAccessibleMono = accessControlService.isClusterAccessible(clusterDto);
88+
StepVerifier.create(clusterAccessibleMono)
89+
.expectNext(true)
90+
.expectComplete()
91+
.verify();
92+
});
93+
}
94+
95+
@Test
96+
void filterViewableTopics() {
97+
withSecurityContext(() -> {
98+
when(user.groups()).thenReturn(List.of(DEV_ROLE));
99+
List<InternalTopic> topics = List.of(
100+
InternalTopic.builder()
101+
.name(TOPIC_NAME)
102+
.build()
103+
);
104+
Mono<List<InternalTopic>> filterTopicsMono = accessControlService.filterViewableTopics(topics, PROD_CLUSTER);
105+
StepVerifier.create(filterTopicsMono)
106+
.expectNextMatches(responseTopics -> responseTopics.stream().anyMatch(t -> t.getName().equals(TOPIC_NAME)))
107+
.expectComplete()
108+
.verify();
109+
});
110+
}
111+
112+
@Test
113+
void isConsumerGroupAccessible() {
114+
withSecurityContext(() -> {
115+
when(user.groups()).thenReturn(List.of(DEV_ROLE));
116+
Mono<Boolean> consumerGroupAccessibleMono =
117+
accessControlService.isConsumerGroupAccessible(CONSUMER_GROUP_NAME, PROD_CLUSTER);
118+
StepVerifier.create(consumerGroupAccessibleMono)
119+
.expectNext(true)
120+
.expectComplete()
121+
.verify();
122+
});
123+
}
124+
125+
@Test
126+
void isSchemaAccessible() {
127+
withSecurityContext(() -> {
128+
when(user.groups()).thenReturn(List.of(DEV_ROLE));
129+
Mono<Boolean> consumerGroupAccessibleMono =
130+
accessControlService.isSchemaAccessible(SCHEMA_NAME, PROD_CLUSTER);
131+
StepVerifier.create(consumerGroupAccessibleMono)
132+
.expectNext(true)
133+
.expectComplete()
134+
.verify();
135+
});
136+
}
137+
138+
@Test
139+
void isConnectAccessible() {
140+
withSecurityContext(() -> {
141+
when(user.groups()).thenReturn(List.of(DEV_ROLE));
142+
Mono<Boolean> consumerGroupAccessibleMono =
143+
accessControlService.isConnectAccessible(CONNECT_NAME, PROD_CLUSTER);
144+
StepVerifier.create(consumerGroupAccessibleMono)
145+
.expectNext(true)
146+
.expectComplete()
147+
.verify();
148+
});
149+
}
150+
151+
@Test
152+
void isConnectAccessibleDto() {
153+
withSecurityContext(() -> {
154+
when(user.groups()).thenReturn(List.of(DEV_ROLE));
155+
ConnectDTO connectDto = ConnectDTO.builder()
156+
.name(CONNECT_NAME)
157+
.build();
158+
Mono<Boolean> consumerGroupAccessibleMono =
159+
accessControlService.isConnectAccessible(connectDto, PROD_CLUSTER);
160+
StepVerifier.create(consumerGroupAccessibleMono)
161+
.expectNext(true)
162+
.expectComplete()
163+
.verify();
164+
});
165+
}
166+
167+
@Test
168+
void getRoles() {
169+
List<Role> roles = accessControlService.getRoles();
170+
assertThat(roles).isEmpty();
171+
}
172+
173+
}

0 commit comments

Comments
 (0)