Skip to content

Commit 3294b3e

Browse files
pedro-hospedro-hos
committed
[WFLY-20384] - Restore the original behaviour of RoleMapping login module in the mapped role mapper
1 parent 28cc6d6 commit 3294b3e

File tree

1 file changed

+219
-0
lines changed

1 file changed

+219
-0
lines changed

‎elytron/WFLY-20384-properties-role-mapper.adoc‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
---
2+
categories:
3+
- Elytron
4+
stability-level: Community
5+
issue: https://github.com/wildfly/wildfly-proposals/issues/711[#711]
6+
feature-team:
7+
developer: mailto:pesilva@redhat.com[Pedro Hos]
8+
sme:
9+
-
10+
outside-perspective:
11+
-
12+
promotes:
13+
promoted-by:
14+
---
15+
16+
= Restore the original behaviour of RoleMapping login module in the mapped role mapper
17+
:author: Pedro Silva
18+
:email: pesilva@redhat.com
19+
:toc: left
20+
:icons: font
21+
:idprefix:
22+
:idseparator: -
23+
24+
== Overview
25+
26+
Some people migrating from previous versions of WildFly to the latest version are struggling with the migration of the RoleMapping login module. The equivalent of the RoleMapping login module is the mapped-role-mapper, which can achieve similar behavior.
27+
28+
The main challenge comes from the fact that a properties file was previously used to map REALM roles to APPLICATION roles, and with mapped-role-mapper, this no longer seems possible. The proposal is to create a new role mapper based on a properties file to match REALM roles to APPLICATION roles.
29+
30+
=== User Stories
31+
32+
Some users need to map **REALM** roles to **APPLICATION** roles. The example https://github.com/gabrielpadilh4/custom-properties-mapped-role-mapper[custom-properties-mapped-role-mapper] was created to avoid this gap.
33+
34+
== Issue Metadata
35+
36+
=== Issue
37+
38+
* https://issues.redhat.com/browse/WFLY-20384[WFLY-20384]
39+
40+
=== Related Issues
41+
42+
* https://issues.redhat.com/browse/ELY-2892[ELY-2892]
43+
* https://issues.redhat.com/browse/WFCORE-7203[WFCORE-7203]
44+
* https://issues.redhat.com/browse/WFLY-20522[WFLY-20522]
45+
46+
=== Affected Projects or Components
47+
48+
* https://github.com/wildfly-security/wildfly-elytron[Elytron]
49+
* https://github.com/wildfly/wildfly-core/[Wildfly Core - Elytron]
50+
* https://github.com/wildfly/wildfly[Wildfly Documentation]
51+
52+
=== Other Interested Projects
53+
N/A
54+
55+
=== Relevant Installation Types
56+
57+
* [x] Traditional standalone server (unzipped or provisioned by Galleon)
58+
* [x] Managed domain
59+
* [x] OpenShift Source-to-Image (S2I)
60+
* [ ] Bootable jar
61+
62+
== Requirements
63+
64+
This RFE will add an attribute to add a new elytron subsystem role mapper configuration to map roles based on a properties file. The CLI command should have two paramenters: `path` and `relative-to`. For example:
65+
66+
```
67+
/subsystem=elytron/properties-role-mapper=prm:add(path="my-role-properties.properties", relative-to="jboss.server.config.dir")
68+
```
69+
70+
* The `path` paramenter is mandary, and represents the properties file;
71+
* The `relative-to` is not mandadoty, represents the relative directory where the file is present. Acepts environment variables, like: `jboss.server.config.dir`
72+
73+
It's possible use the full path like `path="eap/stadanloe/configuration/my-role-properties.properties`, in this case the `relative-to` paramenter is not necessary, however, if `relative-to` is used, the `path` paramenter should be provided.
74+
75+
The properties file should contain the the Realm role, followed by the Application mapped role, for example:
76+
77+
```
78+
$ cat my-role-properties.properties
79+
80+
EnterpriseRole=role-admin,role-123
81+
```
82+
83+
Based on that file, the new `PropertiesMappedRoleMapper.java` will map the roles.
84+
85+
=== Changed requirements
86+
Update the schema n order to add the new `properties-role-mapper` configuration.
87+
88+
=== Non-Requirements
89+
N/A
90+
91+
=== Future Work
92+
N/A
93+
94+
== Backwards Compatibility
95+
96+
Need to change the schema in order to add the new configuration:
97+
98+
```
99+
[...]
100+
<xs:element name="properties-role-mapper" type="propertiesRoleMapperType" minOccurs="0" maxOccurs="unbounded" />
101+
102+
[...]
103+
<xs:complexType name="propertiesRoleMapperType">
104+
<xs:annotation>
105+
<xs:documentation>
106+
A RoleMapper definition for a RoleMapper that performs a mapping based on a property file.
107+
</xs:documentation>
108+
</xs:annotation>
109+
<xs:complexContent>
110+
<xs:extension base="roleMapperType">
111+
<xs:attribute name="path" type="xs:string" use="required">
112+
<xs:annotation>
113+
<xs:documentation>
114+
Property file used to perform the role mapping
115+
</xs:documentation>
116+
</xs:annotation>
117+
</xs:attribute>
118+
<xs:attribute name="relative-to" type="xs:string" use="optional">
119+
<xs:annotation>
120+
<xs:documentation>
121+
Path from the file used to perform the role mapping
122+
</xs:documentation>
123+
</xs:annotation>
124+
</xs:attribute>
125+
</xs:extension>
126+
</xs:complexContent>
127+
</xs:complexType>
128+
[...]
129+
```
130+
131+
=== Default Configuration
132+
133+
This change will add a new role mapper paramenter, named `properties-role-mapper`
134+
135+
=== Importing Existing Configuration
136+
137+
N/A
138+
139+
=== Deployments
140+
141+
N/A
142+
143+
=== Interoperability
144+
145+
== Implementation Plan
146+
147+
N/A
148+
149+
== Admin Clients
150+
151+
New Role Mapper added named `properties-role-mapper`, for example:
152+
153+
```
154+
/subsystem=elytron/properties-role-mapper=prm:add(path="my-role-properties.properties", relative-to="jboss.server.config.dir")
155+
```
156+
157+
where `relative-to` isn't mandatory, but if used, requires the `path` paramenter.
158+
159+
== Security Considerations
160+
161+
[[test_plan]]
162+
== Test Plan
163+
164+
*** Manual tests: First, start Wildfly using standalone mode. Create a new file named "my-role-properties.properties" under Wildfly standalone configuration directory: "jboss.server.config.dir" with the following content:
165+
166+
```
167+
EnterpriseRole=role-admin,role-123
168+
```
169+
170+
Connect to the Wildfly CLI, configure a new Filesystem Realm, Roles and Properties Roles:
171+
172+
```
173+
/subsystem=elytron/filesystem-realm=myFsRealm:add(path=my-fs-realm-users,relative-to=jboss.server.config.dir)
174+
175+
/subsystem=elytron/filesystem-realm=myFsRealm:add-identity(identity=joe)
176+
177+
/subsystem=elytron/filesystem-realm=myFsRealm:add-identity-attribute(identity=joe, name=Roles, value=["123-user","123-admin", "EnterpriseRole"])
178+
179+
/subsystem=elytron/simple-role-decoder=from-roles-attribute:add(attribute=Roles)
180+
181+
/subsystem=elytron/properties-role-mapper=prm:add(path="my-role-properties.properties", relative-to="jboss.server.config.dir")
182+
183+
/subsystem=elytron/security-domain=mySD:add(realms=[{realm=myFsRealm,role-decoder=from-roles-attribute}],role-mapper=prm,default-realm=myFsRealm,permission-mapper=default-permission-mapper)
184+
```
185+
186+
Check that when asked for roles of the identity from given security domain the properties will be used and resulted roles will be correctly mapped:
187+
188+
```
189+
/subsystem=elytron/security-domain=mySD:read-identity(name=joe)
190+
{
191+
"outcome" => "success",
192+
"result" => {
193+
"name" => "joe",
194+
"attributes" => {"Roles" => [
195+
"123-user",
196+
"123-admin",
197+
"EnterpriseRole"
198+
]},
199+
"roles" => [
200+
"123-admin",
201+
"EnterpriseRole",
202+
"123-user",
203+
"role-123",
204+
"role-admin"
205+
]
206+
}
207+
}
208+
```
209+
210+
*** Integration tests - New `PropertiesRoleMapperTest.java` test added on test suit and `RoleMappersTestCase.java` test case updated on Wildfly Core project. New `PropertiesMappedRoleMapperTest.java` class added on Elytron project
211+
212+
== Community Documentation
213+
214+
* Update Wildfly Elytron Subsystem documentation to include new `properties-role-mapper` configuration.
215+
* New Elytron Blog Post
216+
217+
== Release Note Content
218+
219+
The Elytron Role Mapper now supports role mapping using a properties file. This enhancement provides a flexible and configurable way to map user roles to application-specific roles without modifying the code or requiring complex configuration changes.

0 commit comments

Comments
 (0)