gian/cloudstack-mirror
1
0
Fork 0
mirror of https://github.com/apache/cloudstack synced 2026-09-04 16:34:34 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

oauth2: improve list providers api for access

Browse Source 
Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
This commit is contained in:
Abhishek Kumar 2026-06-22 18:17:49 +05:30
parent 5b325dd49e
commit f320f552c3
1 changed files with 46 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java
View File

@ -21,12 +21,16 @@ import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import com.cloud.api.response.ApiResponseSerializer;
import com.cloud.user.Account;
import javax.inject.Inject;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.cloudstack.acl.RoleType;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiConstants;
import org.apache.cloudstack.api.ApiErrorCode;
import org.apache.cloudstack.api.ApiServerService;
import org.apache.cloudstack.api.BaseListCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.ServerApiException;
@ -39,16 +43,22 @@ import org.apache.cloudstack.oauth2.OAuth2AuthManager;
import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.lang3.EnumUtils;
import org.apache.commons.lang3.ObjectUtils;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import com.cloud.api.ApiServer;
import com.cloud.api.response.ApiResponseSerializer;
import com.cloud.user.Account;
import com.cloud.utils.HttpUtils;
@APICommand(name = "listOauthProvider", description = "List OAuth providers registered", responseObject = OauthProviderResponse.class, entityType = {},
requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}, since = "4.19.0")
public class ListOAuthProvidersCmd extends BaseListCmd implements APIAuthenticator {
@Inject
ApiServerService apiServer;
/////////////////////////////////////////////////////
//////////////// API parameters /////////////////////
/////////////////////////////////////////////////////
@ -87,6 +97,34 @@ public class ListOAuthProvidersCmd extends BaseListCmd implements APIAuthenticat
throw new ServerApiException(ApiErrorCode.METHOD_NOT_ALLOWED, "This is an authentication api, cannot be used directly");
}
protected boolean isSecretKeyAllowedForAuthenticatedCaller(Map<String, Object[]> params, HttpSession session,
InetAddress remoteAddress, HttpServletRequest req) {
if (session == null) {
return false;
}
final Long userId = (Long)session.getAttribute("userid");
final String account = (String) session.getAttribute("account");
final Object accountObj = session.getAttribute("accountobj");
if (account != null) {
HttpUtils.ApiSessionKeyCheckOption sessionKeyCheckOption =
EnumUtils.getEnumIgnoreCase(
HttpUtils.ApiSessionKeyCheckOption.class,
ApiServer.ApiSessionKeyCheckLocations.value(),
HttpUtils.ApiSessionKeyCheckOption.CookieAndParameter);
if (!HttpUtils.validateSessionKey(session, params, req.getCookies(),ApiConstants.SESSIONKEY,
sessionKeyCheckOption)) {
return false;
}
}
if (ObjectUtils.anyNull(userId, account, accountObj) || !apiServer.verifyUser(userId)) {
return false;
}
if (!apiServer.verifyRequest(params, userId, remoteAddress)) {
return false;
}
return _accountService.isRootAdmin(((Account)accountObj).getId());
}
@Override
public String authenticate(String command, Map<String, Object[]> params, HttpSession session, InetAddress remoteAddress, String responseType, StringBuilder auditTrailSb, HttpServletRequest req, HttpServletResponse resp) throws ServerApiException {
final String[] idArray = (String[])params.get(ApiConstants.ID);
@ -97,6 +135,7 @@ public class ListOAuthProvidersCmd extends BaseListCmd implements APIAuthenticat
if (ArrayUtils.isNotEmpty(providerArray)) {
provider = providerArray[0];
}
boolean secretKeyAllowed = isSecretKeyAllowedForAuthenticatedCaller(params, session, remoteAddress, req);
List<OauthProviderVO> resultList = _oauth2mgr.listOauthProviders(provider, id);
List<UserOAuth2Authenticator> userOAuth2AuthenticatorPlugins = _oauth2mgr.listUserOAuth2AuthenticationProviders();
@ -108,7 +147,8 @@ public class ListOAuthProvidersCmd extends BaseListCmd implements APIAuthenticat
List<OauthProviderResponse> responses = new ArrayList<>();
for (OauthProviderVO result : resultList) {
OauthProviderResponse r = new OauthProviderResponse(result.getUuid(), result.getProvider(),
result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri());
result.getDescription(), result.getClientId(), secretKeyAllowed ? result.getSecretKey() : null,
result.getRedirectUri());
if (OAuth2AuthManager.OAuth2IsPluginEnabled.value() && authenticatorPluginNames.contains(result.getProvider()) && result.isEnabled()) {
r.setEnabled(true);
} else {