diff --git a/README.md b/README.md index e033d69..2f1fc25 100644 --- a/README.md +++ b/README.md @@ -114,6 +114,23 @@ Weitere Informationen zur Konfiguration des OIDC-Providers sind [hier](https://docs.spring.io/spring-security/reference/servlet/oauth2/index.html#oauth2-client) zu finden. +#### Rollenbasierte Berechtigungen + +Wird OpenID Connect verwendet, gibt es eine rollenbasierte Berechtigungszuweisung. + +Die Standardrolle für neue OIDC-Benutzer kann mit der Option `APP_SECURITY_DEFAULT_USER_ROLE` festgelegt werden. +Mögliche Werte sind `user` oder `guest`. Standardwert ist `user`. + +Benutzer mit der Rolle "Gast" sehen nur die Inhalte, die auch nicht angemeldete Benutzer sehen. + +Hierdurch ist es möglich, einzelne Benutzer einzuschränken oder durch Änderung der Standardrolle auf `guest` nur +einzelne Benutzer als vollwertige Nutzer zuzulassen. + +![Rollenverwaltung](docs/userroles.png) + +Benutzer werden nach dem Entfernen oder der Änderung der vergebenen Rolle automatisch abgemeldet und müssen sich neu anmelden. +Sie bekommen dabei wieder die Standardrolle zugewiesen. + #### Auswirkungen auf den dargestellten Inhalt Nur Administratoren haben Zugriff auf den Konfigurationsbereich, nur angemeldete Benutzer können die anonymisierte oder diff --git a/docs/userroles.png b/docs/userroles.png new file mode 100644 index 0000000..cefb175 Binary files /dev/null and b/docs/userroles.png differ diff --git a/src/main/kotlin/dev/dnpm/etl/processor/config/AppConfigProperties.kt b/src/main/kotlin/dev/dnpm/etl/processor/config/AppConfigProperties.kt index e8d6bfc..d951c60 100644 --- a/src/main/kotlin/dev/dnpm/etl/processor/config/AppConfigProperties.kt +++ b/src/main/kotlin/dev/dnpm/etl/processor/config/AppConfigProperties.kt @@ -19,6 +19,7 @@ package dev.dnpm.etl.processor.config +import dev.dnpm.etl.processor.security.Role import org.springframework.boot.context.properties.ConfigurationProperties import org.springframework.boot.context.properties.DeprecatedConfigurationProperty @@ -102,7 +103,8 @@ data class SecurityConfigProperties( val adminUser: String?, val adminPassword: String?, val enableTokens: Boolean = false, - val enableOidc: Boolean = false + val enableOidc: Boolean = false, + val defaultNewUserRole: Role = Role.USER ) { companion object { const val NAME = "app.security" diff --git a/src/main/kotlin/dev/dnpm/etl/processor/config/AppSecurityConfiguration.kt b/src/main/kotlin/dev/dnpm/etl/processor/config/AppSecurityConfiguration.kt index 6017aab..ca511a7 100644 --- a/src/main/kotlin/dev/dnpm/etl/processor/config/AppSecurityConfiguration.kt +++ b/src/main/kotlin/dev/dnpm/etl/processor/config/AppSecurityConfiguration.kt @@ -19,6 +19,9 @@ package dev.dnpm.etl.processor.config +import dev.dnpm.etl.processor.security.UserRole +import dev.dnpm.etl.processor.security.UserRoleRepository +import dev.dnpm.etl.processor.services.UserRoleService import org.slf4j.LoggerFactory import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty import org.springframework.boot.context.properties.EnableConfigurationProperties @@ -27,10 +30,15 @@ import org.springframework.context.annotation.Configuration import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity import org.springframework.security.config.annotation.web.invoke +import org.springframework.security.core.authority.SimpleGrantedAuthority +import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper +import org.springframework.security.core.session.SessionRegistry +import org.springframework.security.core.session.SessionRegistryImpl import org.springframework.security.core.userdetails.User import org.springframework.security.core.userdetails.UserDetails import org.springframework.security.crypto.factory.PasswordEncoderFactories import org.springframework.security.crypto.password.PasswordEncoder +import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority import org.springframework.security.provisioning.InMemoryUserDetailsManager import org.springframework.security.web.SecurityFilterChain import java.util.* @@ -77,12 +85,19 @@ class AppSecurityConfiguration( @Bean @ConditionalOnProperty(value = ["app.security.enable-oidc"], havingValue = "true") - fun filterChainOidc(http: HttpSecurity, passwordEncoder: PasswordEncoder): SecurityFilterChain { + fun filterChainOidc(http: HttpSecurity, passwordEncoder: PasswordEncoder, userRoleRepository: UserRoleRepository, sessionRegistry: SessionRegistry): SecurityFilterChain { http { authorizeRequests { authorize("/configs/**", hasRole("ADMIN")) authorize("/mtbfile/**", hasAnyRole("MTBFILE")) - authorize("/report/**", fullyAuthenticated) + authorize("/report/**", hasAnyRole("ADMIN", "USER")) + authorize("*.css", permitAll) + authorize("*.ico", permitAll) + authorize("*.jpeg", permitAll) + authorize("*.js", permitAll) + authorize("*.svg", permitAll) + authorize("*.css", permitAll) + authorize("/login/**", permitAll) authorize(anyRequest, permitAll) } httpBasic { @@ -94,11 +109,39 @@ class AppSecurityConfiguration( oauth2Login { loginPage = "/login" } + sessionManagement { + sessionConcurrency { + maximumSessions = 1 + maxSessionsPreventsLogin = true + expiredUrl = "/login?expired" + } + sessionFixation { + newSession() + } + } csrf { disable() } } return http.build() } + @Bean + @ConditionalOnProperty(value = ["app.security.enable-oidc"], havingValue = "true") + fun grantedAuthoritiesMapper(userRoleRepository: UserRoleRepository, appSecurityConfigProperties: SecurityConfigProperties): GrantedAuthoritiesMapper { + return GrantedAuthoritiesMapper { grantedAuthority -> + grantedAuthority.filterIsInstance() + .onEach { + val userRole = userRoleRepository.findByUsername(it.userInfo.preferredUsername) + if (userRole.isEmpty) { + userRoleRepository.save(UserRole(null, it.userInfo.preferredUsername, appSecurityConfigProperties.defaultNewUserRole)) + } + } + .map { + val userRole = userRoleRepository.findByUsername(it.userInfo.preferredUsername) + SimpleGrantedAuthority("ROLE_${userRole.get().role.toString().uppercase()}") + } + } + } + @Bean @ConditionalOnProperty(value = ["app.security.enable-oidc"], havingValue = "false", matchIfMissing = true) fun filterChain(http: HttpSecurity, passwordEncoder: PasswordEncoder): SecurityFilterChain { @@ -120,10 +163,19 @@ class AppSecurityConfiguration( return http.build() } + @Bean + fun sessionRegistry(): SessionRegistry { + return SessionRegistryImpl() + } + @Bean fun passwordEncoder(): PasswordEncoder { return PasswordEncoderFactories.createDelegatingPasswordEncoder() } + @Bean + @ConditionalOnProperty(value = ["app.security.enable-oidc"], havingValue = "true") + fun userRoleService(userRoleRepository: UserRoleRepository, sessionRegistry: SessionRegistry): UserRoleService { + return UserRoleService(userRoleRepository, sessionRegistry) + } } - diff --git a/src/main/kotlin/dev/dnpm/etl/processor/security/UserRole.kt b/src/main/kotlin/dev/dnpm/etl/processor/security/UserRole.kt new file mode 100644 index 0000000..4de31f5 --- /dev/null +++ b/src/main/kotlin/dev/dnpm/etl/processor/security/UserRole.kt @@ -0,0 +1,44 @@ +/* + * This file is part of ETL-Processor + * + * Copyright (C) 2024 Comprehensive Cancer Center Mainfranken, Datenintegrationszentrum Philipps-Universität Marburg and Contributors + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published + * by the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +package dev.dnpm.etl.processor.security + +import org.springframework.data.annotation.Id +import org.springframework.data.relational.core.mapping.Table +import org.springframework.data.repository.CrudRepository +import java.util.* + +@Table("user_role") +data class UserRole( + @Id val id: Long? = null, + val username: String, + var role: Role = Role.GUEST +) + +enum class Role(val value: String) { + GUEST("guest"), + USER("user") +} + +interface UserRoleRepository : CrudRepository { + + fun findByUsername(username: String): Optional + +} \ No newline at end of file diff --git a/src/main/kotlin/dev/dnpm/etl/processor/services/UserRoleService.kt b/src/main/kotlin/dev/dnpm/etl/processor/services/UserRoleService.kt new file mode 100644 index 0000000..6649f7d --- /dev/null +++ b/src/main/kotlin/dev/dnpm/etl/processor/services/UserRoleService.kt @@ -0,0 +1,61 @@ +/* + * This file is part of ETL-Processor + * + * Copyright (c) 2024 Comprehensive Cancer Center Mainfranken, Datenintegrationszentrum Philipps-Universität Marburg and Contributors + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published + * by the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + */ + +package dev.dnpm.etl.processor.services + +import dev.dnpm.etl.processor.security.Role +import dev.dnpm.etl.processor.security.UserRole +import dev.dnpm.etl.processor.security.UserRoleRepository +import org.springframework.data.repository.findByIdOrNull +import org.springframework.security.core.session.SessionRegistry +import org.springframework.security.oauth2.core.oidc.user.OidcUser + +class UserRoleService( + private val userRoleRepository: UserRoleRepository, + private val sessionRegistry: SessionRegistry +) { + fun updateUserRole(id: Long, role: Role) { + val userRole = userRoleRepository.findByIdOrNull(id) ?: return + userRole.role = role + userRoleRepository.save(userRole) + expireSessionFor(userRole.username) + } + + fun deleteUserRole(id: Long) { + val userRole = userRoleRepository.findByIdOrNull(id) ?: return + userRoleRepository.delete(userRole) + expireSessionFor(userRole.username) + } + + fun findAll(): List { + return userRoleRepository.findAll().toList() + } + + private fun expireSessionFor(username: String) { + sessionRegistry.allPrincipals + .filterIsInstance() + .filter { it.preferredUsername == username } + .flatMap { + sessionRegistry.getAllSessions(it, true) + } + .onEach { + it.expireNow() + } + } +} \ No newline at end of file diff --git a/src/main/kotlin/dev/dnpm/etl/processor/web/ConfigController.kt b/src/main/kotlin/dev/dnpm/etl/processor/web/ConfigController.kt index dbedee5..44ea400 100644 --- a/src/main/kotlin/dev/dnpm/etl/processor/web/ConfigController.kt +++ b/src/main/kotlin/dev/dnpm/etl/processor/web/ConfigController.kt @@ -22,9 +22,12 @@ package dev.dnpm.etl.processor.web import dev.dnpm.etl.processor.monitoring.ConnectionCheckService import dev.dnpm.etl.processor.output.MtbFileSender import dev.dnpm.etl.processor.pseudonym.Generator +import dev.dnpm.etl.processor.security.Role +import dev.dnpm.etl.processor.security.UserRole import dev.dnpm.etl.processor.services.Token import dev.dnpm.etl.processor.services.TokenService import dev.dnpm.etl.processor.services.TransformationService +import dev.dnpm.etl.processor.services.UserRoleService import org.springframework.beans.factory.annotation.Qualifier import org.springframework.http.MediaType import org.springframework.http.codec.ServerSentEvent @@ -43,7 +46,8 @@ class ConfigController( private val pseudonymGenerator: Generator, private val mtbFileSender: MtbFileSender, private val connectionCheckService: ConnectionCheckService, - private val tokenService: TokenService? + private val tokenService: TokenService?, + private val userRoleService: UserRoleService? ) { @GetMapping @@ -56,10 +60,16 @@ class ConfigController( if (tokenService != null) { model.addAttribute("tokens", tokenService.findAll()) } else { - model.addAttribute("tokens", listOf()) + model.addAttribute("tokens", emptyList()) } model.addAttribute("transformations", transformationService.getTransformations()) - + if (userRoleService != null) { + model.addAttribute("userRolesEnabled", true) + model.addAttribute("userRoles", userRoleService.findAll()) + } else { + model.addAttribute("userRolesEnabled", false) + model.addAttribute("userRoles", emptyList()) + } return "configs" } @@ -112,6 +122,34 @@ class ConfigController( return "configs/tokens" } + @DeleteMapping(path = ["userroles/{id}"]) + fun deleteUserRole(@PathVariable id: Long, model: Model): String { + if (userRoleService != null) { + userRoleService.deleteUserRole(id) + + model.addAttribute("userRolesEnabled", true) + model.addAttribute("userRoles", userRoleService.findAll()) + } else { + model.addAttribute("userRolesEnabled", false) + model.addAttribute("userRoles", emptyList()) + } + return "configs/userroles" + } + + @PutMapping(path = ["userroles/{id}"]) + fun updateUserRole(@PathVariable id: Long, @ModelAttribute("role") role: Role, model: Model): String { + if (userRoleService != null) { + userRoleService.updateUserRole(id, role) + + model.addAttribute("userRolesEnabled", true) + model.addAttribute("userRoles", userRoleService.findAll()) + } else { + model.addAttribute("userRolesEnabled", false) + model.addAttribute("userRoles", emptyList()) + } + return "configs/userroles" + } + @GetMapping(path = ["events"], produces = [MediaType.TEXT_EVENT_STREAM_VALUE]) fun events(): Flux> { return configsUpdateProducer.asFlux().map { diff --git a/src/main/resources/db/migration/mariadb/V0_3_0__UserRoles.sql b/src/main/resources/db/migration/mariadb/V0_3_0__UserRoles.sql new file mode 100644 index 0000000..99399fd --- /dev/null +++ b/src/main/resources/db/migration/mariadb/V0_3_0__UserRoles.sql @@ -0,0 +1,7 @@ +CREATE TABLE IF NOT EXISTS user_role +( + id int auto_increment primary key, + username varchar(255) not null unique, + role varchar(255) not null, + created_at datetime default utc_timestamp() not null +); \ No newline at end of file diff --git a/src/main/resources/db/migration/postgresql/V0_3_0__UserRoles.sql b/src/main/resources/db/migration/postgresql/V0_3_0__UserRoles.sql new file mode 100644 index 0000000..7dbfc08 --- /dev/null +++ b/src/main/resources/db/migration/postgresql/V0_3_0__UserRoles.sql @@ -0,0 +1,8 @@ +CREATE TABLE IF NOT EXISTS user_role +( + id serial, + username varchar(255) not null unique, + role varchar(255) not null, + created_at timestamp with time zone default now() not null, + PRIMARY KEY (id) +); \ No newline at end of file diff --git a/src/main/resources/static/style.css b/src/main/resources/static/style.css index c7a0b38..0dd5820 100644 --- a/src/main/resources/static/style.css +++ b/src/main/resources/static/style.css @@ -202,6 +202,17 @@ form.samplecode-input input:focus-visible { background: none; } +.userrole-form form { + margin: 0; + padding: 0; + + border: none; + border-radius: 0; + background: none; + + text-align: inherit; +} + .login-form form *, .token-form form * { padding: 0.5em; @@ -210,7 +221,8 @@ form.samplecode-input input:focus-visible { } .login-form form hr, -.token-form form hr { +.token-form form hr, +.userrole-form form hr { padding: 0; width: 100%; } @@ -224,6 +236,14 @@ form.samplecode-input input:focus-visible { border: none; } +.userrole-form form select { + padding: 0.5em; + border: none; + border-radius: 3px; + line-height: 1.2rem; + font-size: 0.8rem; +} + .border { padding: 1.5em; border: 1px solid var(--table-border); @@ -527,6 +547,10 @@ input.inline:focus-visible { color: var(--bg-green); } +.notification.notice { + color: var(--bg-yellow); +} + .notification.error { color: var(--bg-red); } diff --git a/src/main/resources/templates/configs.html b/src/main/resources/templates/configs.html index ebef7ca..2103b0b 100644 --- a/src/main/resources/templates/configs.html +++ b/src/main/resources/templates/configs.html @@ -40,6 +40,9 @@
+
+
+
diff --git a/src/main/resources/templates/configs/userroles.html b/src/main/resources/templates/configs/userroles.html new file mode 100644 index 0000000..23cc5f2 --- /dev/null +++ b/src/main/resources/templates/configs/userroles.html @@ -0,0 +1,39 @@ +
+

⛔ Benutzerberechtigungen

+

Die Verwendung von rollenbasierten Benutzerberechtigungen ist nicht aktiviert.

+
+ +
+

✅ Benutzerberechtigungen

+
+
Noch keine Benutzerberechtigungen vorhanden.
+ + + + + + + + + + + + + + + +
BenutzernameRolle
[[ ${userRole.username} ]] +
+
+ + +
+
+ 		+ +
+
+
\ No newline at end of file diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html index 3951f66..be3123b 100644 --- a/src/main/resources/templates/index.html +++ b/src/main/resources/templates/index.html @@ -53,17 +53,17 @@ [[ ${request.type} ]] [[ ${request.uuid} ]] - [[ ${request.uuid} ]] - [[ ${request.uuid} ]] + [[ ${request.uuid} ]] + [[ ${request.uuid} ]] - + [[ ${request.patientId} ]] - + [[ ${request.patientId} ]] - *** + *** diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html index 4ef8ec9..75a3681 100644 --- a/src/main/resources/templates/login.html +++ b/src/main/resources/templates/login.html @@ -11,6 +11,7 @@