Webapi 3.0 - #2536
Draft
chrisknoll wants to merge 98 commits into
Draft
Conversation
Removed ActivityTracker. Cleaned up permission annotations to use isAnyPermitted(anyOf) to avoid naming conflicts. Improved Etag impl to use Spring Boot ShallowEtagHeaderFilter. Adjusted CORS config to expose Etag header.
Added permission checks for protected tags. Added new permission 'admin:run-as'. Adjusted migration to associate run-as permission with roles. Made the anonymous user role a system role.
Enables OpenID Connect (OIDC) authentication in the project. Update environment variables, configuration properties, and test collections to use OIDC, and enable automated OIDC authentication tests that were previously disabled.
This pull request introduces a new direct OIDC login endpoint and refactors OIDC role synchronization to improve maintainability and security. The main changes include adding a /user/login/openidDirect endpoint for direct OIDC authentication using Bearer tokens, centralizing and improving the logic for synchronizing OIDC roles, and ensuring only known roles are assigned to users.
* Added permission de-cache to assets. * Specify batch table prefix in job explorer. * Addressed NegativeControlTasklet handling split-sql and JPA/Batch transactions. * Remove deleted sources from generation lists: Requesting generation results from deleted source results in 404. * Add versioning support for pathway. * Fix allowCustom check in tags. * Fix job notification functionality and improve performance. * Allow job parameters to be returned for pathway and ir jobs. * Notification system updates: - Adding notification system update documentation. - Move to stream-based notifications fetch to reduce memory consumption. * Allow /user/me to use etags. * Removed obsolete tables related to 'feasibility study' and 'heracles analysis'. * Re-introduced cohort generation with demographics reports. - split /report into /inclusion and /demographics endpoints.
This pull request removes the TrexSQL extension as a Maven build-time dependency and instead enables TrexSQL as a dynamically loaded plugin at runtime.
* Cascade deletes to sec_{entity} tables; done migration and baseline scripts.
* Add User to WebApiPrincipal so we don't need to reload user details from db when we get current user.
* Implemented RunAs
Return HTTP 500 when you fail to get JDBC connection.
This pull request reorganizes where the foreign key (FK) constraints for the sec_{entity} tables are declared in the B3.0.0__webapi_baseline.sql migration script. The FK constraints, which enforce referential integrity and use ON DELETE CASCADE, have been moved to a later section of the script to ensure that all referenced tables and primary keys exist before the constraints are added. No logic has changed, but the order of operations has been adjusted.
…Authorize coverage) (#2521) Hardens WebAPI authorization so no endpoint is reachable without an explicit check. Before this PR, the API filter chain was effectively permit-all and several handlers were without per-operation authorization. - The API filter chain no longer permits all requests. `security.anonymousAccess.enabled` (default `true`) decides how token-less requests are handled: admitted as the anonymous user, then denied by per-endpoint `@PreAuthorize` on protected endpoints - **Per-operation `@PreAuthorize` across the API**, using existing 3.0 permissions: - admin operations: `admin:cache`, `admin:tags`, `admin:tools`, `admin:security` (user/role/permission + user-import), `admin:source`, admin for statistics - source-scoped reads/writes: `read:source`/`hasSourceAccess` on cdmresults, cohort-sample, vocabulary, evidence, ddl, sqlrender - per-domain `read:<x>`, entity owner/access expressions for cohort, concept-set, characterization, pathway, feature-analysis, reusable - generic `read` for tag/tool/job reads; `isAuthenticated()` for self-scoped endpoints (`/user/me`, notifications)
Adds automated guardrails so authorization regressions are caught, wires the security integration tests into CI (they previously never ran there), and fixes a coverage gap the new guard surfaced.
…2523) WebAPI authorizes every request through a security principal (authenticated user or the built-in anonymous principal), deciding access from permission grants + per-entity filtering. #2521 hardened authorization and kept that model. It gated list endpoints behind read/write permissions, when listing should stay open and have its contents filtered per principal (which several lists already did). This change removes those list gates and relies on filtering, and removes a handful of isAuthenticated() checks that cut against the model. #2521's genuine endpoint protections are kept.
* Implement API Keys. * Added APIKey howto article. Fixes #1884.
…flow can use to get the login, name and groups. Could not implement a group/claims mapper to WebAPI Roles due to the tight coupling with UserImportJobs and LDAP. Phase2 can incorporate a method of group mapping.
…r function and does not require permissons. The previous check required read or write access to all sources.
…ed read/write access to ANY source.
* Adding google auth and one time code support. * Combined otc login controller behaviro to LoginController. Add migration for OTC tales. Change session cleanup to fixedDelay. Added scheduled to OTCService cleanup. * Simplified ODIC Configuration to infer callback endpoints from client registration. Communicate authenticated session/jwt with one-time-code. Added article describing the One-Time-Codes. Removed obsolete config settings from application.yaml.
* New feature: External Role Mapping: - maintains a association between a claim and webAPI role. - Can be maintained via CSV load or indiviual REST endpionts - Login flow updated to synchronize mapped roles on login. - Added tests for add/delete/overwrite and validation rules. * Refactor user-role-import functionality tables. * Updated docker/auth-tests.postman_collection.json to handle the new OIDC auth flow. * Temporary disable endpoint guard tests until we determine a better way to identify guarded.
In future, i18n handling will be a UI concern. We may introduce some level of i18n on the WebAPI side in the future, but only for WebAPI concerns (like error messages or other needs).
A user with global read:source or write:source permission, but no per-source access-control entry, was denied the patient profile endpoint while every other source-scoped read endpoint let them through. That is what makes the cohort sample list viewable but the profile behind it return access denied. hasSourceAccess resolves only per-entity ACL entries: it calls hasEntityAccess for the source and never consults the global read:source/write:source entitlement. Every other source-scoped read in the codebase therefore pairs it with an isAnyPermitted check, 55 endpoints in all. getPersonProfile was the single exception, carrying only the ACL half since it was first added in the person service migration. Use the same paired expression as its siblings. Reported in OHDSI/Atlas3#206.
Creating a tag returned a 500 with no usable message in two situations, both of which are ordinary user error and should be reported as such. The constraint-violation handler assumed the cause chain was exactly two levels deep, that the inner cause carried a message, and that the message contained a PostgreSQL "Detail: " section. Any of those assumptions failing threw a NullPointerException out of the handler itself, so Spring reported a 500 rather than the 409 the handler was written to return. When the section was simply absent, indexOf returned -1 and substring silently dropped the first seven characters of the message instead. This matters for tags because there is a unique index on lower(name) across the whole tags table, which holds tag groups as well, so a name that collides with any existing tag or group lands in this handler. Walk the cause chain defensively, only strip the "Detail: " prefix when it is actually present, and fall back to the most specific cause. Separately, rejecting a tag whose group does not allow custom tags threw IllegalArgumentException, which fell through to the generic handler and became a 500 reading "An exception occurred: java.lang.IllegalArgumentException". Throw BadRequestAtlasException instead and register it on the existing bad-request handler, which already treated it as a 400 when it arrived wrapped in an UndeclaredThrowableException. The message now names the groups that refused the tag, since the client cannot otherwise tell which of the selected groups was the problem. Creating a tag with no groups at all NPEd on the same path and is now a 400 too. Reported in OHDSI/Atlas3#211.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WebAPI 3.0 is a major upgrade to the legacy JDK8, Spring Boot 1.5 application. The following are the summary of changes:
WebAPI 3.0 Changes Summary
Overview
This document summarizes the major changes and features introduced in the
webapi-3.0branch compared toorigin/master.Major Changes
1. Internationalization (i18n) Removal
2. OAuth/OIDC & Authentication
3. Authorization & Security
Complete SHIRO to Spring Security Migration
Entity-Level Permission Model with Access Tables
sec_*entity tables for fine-grained, role-based access control per resource:sec_cohort_definition- Cohort definition access controlsec_concept_set- Concept set access controlsec_ir_analysis- Incidence rate analysis access controlsec_fe_analysis- Feature analysis access controlsec_cohort_characterization- Characterization access controlsec_pathway_analysis- Pathway analysis access controlsec_reusable- Reusable component access controlLegacy Permission Migration
cohort:%s:get→ entity-level READ permissions)Anonymous System User
anonymous(user_id: -1) with personal roleMethod-level Authorization Model
@PreAuthorizecoverage across all endpoints that require authroizationAPI Keys
RunAs and Cascade Deletes
ETag Support
4. Data & Features
5. Infrastructure & Framework
Spring Framework & Ecosystem
Application Server
Database
6. Database Changes
Commit Statistics
webapi-3.0branchorigin/masterDocumentation
Additional documentation has been added for:
DatabaseAuth_HOWTO.md)EntityAccess_HOWTO.md)Ssl_HOWTO.md)SpringMicrometer_HOWTO.md)