Skip to content

Commit d6585f1

Browse files
msm1992msm1992
committed
Encrypt secret fields in gateway configs
1 parent 2fb9096 commit d6585f1

File tree

8 files changed

+187
-0
lines changed

8 files changed

+187
-0
lines changed

‎components/apimgt/org.wso2.carbon.apimgt.api/src/main/java/org/wso2/carbon/apimgt/api/model/Environment.java

+22
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,28 @@ public class Environment implements Serializable {
5959
private String[] visibilityRoles;
6060
private String visibility;
6161

62+
public Environment(Environment environment) {
63+
this.type = environment.type;
64+
this.serverURL = environment.serverURL;
65+
this.userName = environment.userName;
66+
this.password = environment.password;
67+
this.apiGatewayEndpoint = environment.apiGatewayEndpoint;
68+
this.websocketGatewayEndpoint = environment.websocketGatewayEndpoint;
69+
this.webSubGatewayEndpoint = environment.webSubGatewayEndpoint;
70+
this.isDefault = environment.isDefault;
71+
this.id = environment.id;
72+
this.uuid = environment.uuid;
73+
this.name = environment.name;
74+
this.displayName = environment.displayName;
75+
this.description = environment.description;
76+
this.isReadOnly = environment.isReadOnly;
77+
this.vhosts = new ArrayList<>(environment.vhosts);
78+
this.provider = environment.provider;
79+
this.gatewayType = environment.gatewayType;
80+
this.additionalProperties = new HashMap<>(environment.additionalProperties);
81+
this.visibilityRoles = environment.visibilityRoles;
82+
this.visibility = environment.visibility;
83+
}
6284
private GatewayVisibilityPermissionConfigurationDTO permissions = new GatewayVisibilityPermissionConfigurationDTO();
6385

6486
public boolean isDefault() {

‎components/apimgt/org.wso2.carbon.apimgt.impl/src/main/java/org/wso2/carbon/apimgt/impl/APIAdminImpl.java

+61
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@
6969
import org.wso2.carbon.apimgt.impl.dao.ApiMgtDAO;
7070
import org.wso2.carbon.apimgt.impl.dao.LabelsDAO;
7171
import org.wso2.carbon.apimgt.impl.dao.constants.SQLConstants;
72+
import org.wso2.carbon.apimgt.impl.deployer.ExternalGatewayDeployer;
7273
import org.wso2.carbon.apimgt.impl.dto.ThrottleProperties;
7374
import org.wso2.carbon.apimgt.impl.dto.WorkflowProperties;
7475
import org.wso2.carbon.apimgt.impl.factory.PersistenceFactory;
@@ -157,6 +158,10 @@ public List<Environment> getAllEnvironments(String tenantDomain) throws APIManag
157158
// add read only environments first and dynamic environments later
158159
APIUtil.getReadOnlyEnvironments().values().stream().filter(env -> !dynamicEnvNames.contains(env.getName())).forEach(allEnvs::add);
159160
allEnvs.addAll(dynamicEnvs);
161+
162+
for (Environment env : allEnvs) {
163+
decryptGatewayConfigurationValues(env);
164+
}
160165
return allEnvs;
161166
}
162167

@@ -175,6 +180,7 @@ public Environment getEnvironment(String tenantDomain, String uuid) throws APIMa
175180
);
176181
}
177182
}
183+
maskValues(env);
178184
return env;
179185
}
180186

@@ -189,6 +195,8 @@ public Environment addEnvironment(String tenantDomain, Environment environment)
189195
String.format("name '%s'", environment.getName())));
190196
}
191197
validateForUniqueVhostNames(environment);
198+
Environment environmentToStore = new Environment(environment);
199+
encryptGatewayConfigurationValues(null, environmentToStore);
192200
return apiMgtDAO.addEnvironment(tenantDomain, environment);
193201
}
194202

@@ -792,6 +800,31 @@ private void encryptKeyManagerConfigurationValues(KeyManagerConfigurationDTO ret
792800
}
793801
}
794802

803+
private void encryptGatewayConfigurationValues(Environment retrievedGatewayConfigurationDTO,
804+
Environment updatedGatewayConfigurationDto)
805+
throws APIManagementException {
806+
807+
ExternalGatewayDeployer gatewayDeployer = ServiceReferenceHolder.getInstance()
808+
.getExternalGatewayDeployer(updatedGatewayConfigurationDto.getGatewayType());
809+
if (gatewayDeployer != null) {
810+
Map<String, String> additionalProperties = updatedGatewayConfigurationDto.getAdditionalProperties();
811+
for (ConfigurationDto configurationDto : gatewayDeployer.getConnectionConfigurations()) {
812+
if (configurationDto.isMask()) {
813+
String value = additionalProperties.get(configurationDto.getName());
814+
if (APIConstants.DEFAULT_MODIFIED_ENDPOINT_PASSWORD.equals(value)) {
815+
if (retrievedGatewayConfigurationDTO != null) {
816+
String unModifiedValue = retrievedGatewayConfigurationDTO.getAdditionalProperties()
817+
.get(configurationDto.getName());
818+
additionalProperties.replace(configurationDto.getName(), unModifiedValue);
819+
}
820+
} else if (StringUtils.isNotEmpty(value)) {
821+
additionalProperties.replace(configurationDto.getName(), String.valueOf(encryptValues(value)));
822+
}
823+
}
824+
}
825+
}
826+
}
827+
795828
private KeyManagerConfigurationDTO decryptKeyManagerConfigurationValues(
796829
KeyManagerConfigurationDTO keyManagerConfigurationDTO)
797830
throws APIManagementException {
@@ -807,6 +840,20 @@ private KeyManagerConfigurationDTO decryptKeyManagerConfigurationValues(
807840
return keyManagerConfigurationDTO;
808841
}
809842

843+
private Environment decryptGatewayConfigurationValues(Environment environment)
844+
throws APIManagementException {
845+
846+
Map<String, String> additionalProperties = environment.getAdditionalProperties();
847+
for (Map.Entry<String, String> entry : additionalProperties.entrySet()) {
848+
String key = entry.getKey();
849+
Object value = entry.getValue();
850+
if (value != null) {
851+
additionalProperties.replace(key, String.valueOf(decryptValue(value)));
852+
}
853+
}
854+
return environment;
855+
}
856+
810857
private Object decryptValue(Object value) throws APIManagementException {
811858

812859
if (value instanceof String) {
@@ -1464,6 +1511,20 @@ private void maskValues(KeyManagerConfigurationDTO keyManagerConfigurationDTO) {
14641511
}
14651512
}
14661513

1514+
private void maskValues(Environment environment) {
1515+
ExternalGatewayDeployer gatewayDeployer = ServiceReferenceHolder.getInstance()
1516+
.getExternalGatewayDeployer(environment.getGatewayType());
1517+
1518+
Map<String, String> additionalProperties = environment.getAdditionalProperties();
1519+
List<ConfigurationDto> connectionConfigurations = gatewayDeployer.getConnectionConfigurations();
1520+
for (ConfigurationDto connectionConfiguration : connectionConfigurations) {
1521+
if (connectionConfiguration.isMask()) {
1522+
additionalProperties.replace(connectionConfiguration.getName(),
1523+
APIConstants.DEFAULT_MODIFIED_ENDPOINT_PASSWORD);
1524+
}
1525+
}
1526+
}
1527+
14671528
/**
14681529
* The method converts the date into timestamp
14691530
*

‎components/apimgt/org.wso2.carbon.apimgt.impl/src/main/java/org/wso2/carbon/apimgt/impl/dao/ApiMgtDAO.java

+2
Original file line numberDiff line numberDiff line change
@@ -15340,6 +15340,7 @@ public Environment getEnvironment(String tenantDomain, String uuid) throws APIMa
1534015340
String displayName = rs.getString("DISPLAY_NAME");
1534115341
String description = rs.getString("DESCRIPTION");
1534215342
String provider = rs.getString("PROVIDER");
15343+
String gatewayType = rs.getString("GATEWAY_TYPE");
1534315344
Map<String, String> additionalProperties = new HashMap();
1534415345
try (InputStream configuration = rs.getBinaryStream("CONFIGURATION")) {
1534515346
if (configuration != null) {
@@ -15357,6 +15358,7 @@ public Environment getEnvironment(String tenantDomain, String uuid) throws APIMa
1535715358
env.setDisplayName(displayName);
1535815359
env.setDescription(description);
1535915360
env.setProvider(provider);
15361+
env.setGatewayType(gatewayType);
1536015362
env.setVhosts(getVhostGatewayEnvironments(connection, id));
1536115363
env.setPermissions(getGatewayVisibilityPermissions(uuid));
1536215364
env.setAdditionalProperties(additionalProperties);

‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/gen/java/org/wso2/carbon/apimgt/rest/api/admin/v1/EnvironmentsApi.java

+18
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,24 @@ public Response environmentsEnvironmentIdDelete(@ApiParam(value = "Environment U
5454
return delegate.environmentsEnvironmentIdDelete(environmentId, securityContext);
5555
}
5656

57+
@GET
58+
@Path("/{environmentId}")
59+
60+
@Produces({ "application/json" })
61+
@ApiOperation(value = "Get a Gateway Environment Configuration", notes = "Retrieve a single Gateway Environment Configuration. We should provide the Id of the Environment as a path parameter. ", response = EnvironmentDTO.class, authorizations = {
62+
@Authorization(value = "OAuth2Security", scopes = {
63+
@AuthorizationScope(scope = "apim:admin", description = "Manage all admin operations"),
64+
@AuthorizationScope(scope = "apim:environment_manage", description = "Manage gateway environments")
65+
})
66+
}, tags={ "Environments", })
67+
@ApiResponses(value = {
68+
@ApiResponse(code = 200, message = "OK. Gateway Environment Configuration returned ", response = EnvironmentDTO.class),
69+
@ApiResponse(code = 404, message = "Not Found. The specified resource does not exist.", response = ErrorDTO.class),
70+
@ApiResponse(code = 406, message = "Not Acceptable. The requested media type is not supported.", response = ErrorDTO.class) })
71+
public Response environmentsEnvironmentIdGet(@ApiParam(value = "Environment UUID (or Environment name defined in config) ",required=true) @PathParam("environmentId") String environmentId) throws APIManagementException{
72+
return delegate.environmentsEnvironmentIdGet(environmentId, securityContext);
73+
}
74+
5775
@PUT
5876
@Path("/{environmentId}")
5977
@Consumes({ "application/json" })

‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/gen/java/org/wso2/carbon/apimgt/rest/api/admin/v1/EnvironmentsApiService.java

+1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
public interface EnvironmentsApiService {
2525
public Response environmentsEnvironmentIdDelete(String environmentId, MessageContext messageContext) throws APIManagementException;
26+
public Response environmentsEnvironmentIdGet(String environmentId, MessageContext messageContext) throws APIManagementException;
2627
public Response environmentsEnvironmentIdPut(String environmentId, EnvironmentDTO environmentDTO, MessageContext messageContext) throws APIManagementException;
2728
public Response environmentsGet(MessageContext messageContext) throws APIManagementException;
2829
public Response environmentsPost(EnvironmentDTO environmentDTO, MessageContext messageContext) throws APIManagementException;

‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/main/java/org/wso2/carbon/apimgt/rest/api/admin/v1/impl/EnvironmentsApiServiceImpl.java

+13
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,19 @@ public Response environmentsEnvironmentIdDelete(String environmentId, MessageCon
5959
return Response.ok().build();
6060
}
6161

62+
@Override
63+
public Response environmentsEnvironmentIdGet(String environmentId, MessageContext messageContext) throws APIManagementException {
64+
APIAdmin apiAdmin = new APIAdminImpl();
65+
String organization = RestApiUtil.getValidatedOrganization(messageContext);
66+
Environment environment = apiAdmin.getEnvironment(organization, environmentId);
67+
if (environment != null) {
68+
EnvironmentDTO environmentDTO = EnvironmentMappingUtil.fromEnvToEnvDTO(environment);
69+
return Response.ok().entity(environmentDTO).build();
70+
}
71+
throw new APIManagementException("Requested Gateway Environment not found",
72+
ExceptionCodes.GATEWAY_ENVIRONMENT_NOT_FOUND);
73+
}
74+
6275
/**
6376
* Update gateway environment
6477
*

‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/main/resources/admin-api.yaml

+35
Original file line numberDiff line numberDiff line change
@@ -1943,6 +1943,41 @@ paths:
19431943
# The "Individual Environment" resource APIs
19441944
######################################################
19451945
/environments/{environmentId}:
1946+
get:
1947+
tags:
1948+
- Environments
1949+
summary: Get a Gateway Environment Configuration
1950+
description: |
1951+
Retrieve a single Gateway Environment Configuration. We should provide the Id of the Environment as a path parameter.
1952+
parameters:
1953+
- $ref: '#/components/parameters/environmentId'
1954+
responses:
1955+
200:
1956+
description: |
1957+
OK.
1958+
Gateway Environment Configuration returned
1959+
headers:
1960+
Content-Type:
1961+
description: |
1962+
The content type of the body.
1963+
schema:
1964+
type: string
1965+
content:
1966+
application/json:
1967+
schema:
1968+
$ref: '#/components/schemas/Environment'
1969+
404:
1970+
$ref: '#/components/responses/NotFound'
1971+
406:
1972+
$ref: '#/components/responses/NotAcceptable'
1973+
security:
1974+
- OAuth2Security:
1975+
- apim:admin
1976+
- apim:environment_manage
1977+
x-code-samples:
1978+
- lang: Curl
1979+
source: 'curl -k -H "Authorization: Bearer ae4eae22-3f65-387b-a171-d37eaa366fa8"
1980+
"https://127.0.0.1:9443/api/am/admin/v4/environments/8d263942-a6df-4cc2-a804-7a2525501450"'
19461981
put:
19471982
tags:
19481983
- Environments

‎components/apimgt/org.wso2.carbon.apimgt.rest.api.common/src/main/resources/admin-api.yaml

+35
Original file line numberDiff line numberDiff line change
@@ -1943,6 +1943,41 @@ paths:
19431943
# The "Individual Environment" resource APIs
19441944
######################################################
19451945
/environments/{environmentId}:
1946+
get:
1947+
tags:
1948+
- Environments
1949+
summary: Get a Gateway Environment Configuration
1950+
description: |
1951+
Retrieve a single Gateway Environment Configuration. We should provide the Id of the Environment as a path parameter.
1952+
parameters:
1953+
- $ref: '#/components/parameters/environmentId'
1954+
responses:
1955+
200:
1956+
description: |
1957+
OK.
1958+
Gateway Environment Configuration returned
1959+
headers:
1960+
Content-Type:
1961+
description: |
1962+
The content type of the body.
1963+
schema:
1964+
type: string
1965+
content:
1966+
application/json:
1967+
schema:
1968+
$ref: '#/components/schemas/Environment'
1969+
404:
1970+
$ref: '#/components/responses/NotFound'
1971+
406:
1972+
$ref: '#/components/responses/NotAcceptable'
1973+
security:
1974+
- OAuth2Security:
1975+
- apim:admin
1976+
- apim:environment_manage
1977+
x-code-samples:
1978+
- lang: Curl
1979+
source: 'curl -k -H "Authorization: Bearer ae4eae22-3f65-387b-a171-d37eaa366fa8"
1980+
"https://127.0.0.1:9443/api/am/admin/v4/environments/8d263942-a6df-4cc2-a804-7a2525501450"'
19461981
put:
19471982
tags:
19481983
- Environments

0 commit comments

Comments
 (0)