Common authorization logic on a resource

[colesturza]

Hi all,

I currently have a microservice leveraging a Keycloak instance for authentication. The microservice stores scenario data that a user or group of users owns. I was wondering if there is a best practice for implementing the common authorization logic on all endpoints of the following form: /scenarios/{id}/**. I would like to validate that the user is either the owner of the scenario data, or is a part of the group that owns the scenario data. If the user is not allowed to access the scenario data, I'd want to return a HTTP 403 status response. Otherwise, the request would proceed to the endpoint. Ideally, I'd also then store the scenario data retrieved from the database in a request scoped object. I thought about using filters, but I would not have access to the path parameter in a way that doesn't require parsing the URI. Has anyone attempted something similar and has found a way that works nicely? Thanks in advance.

[sberyozkin]

Hi,

I would like to validate that the user is either the owner of the scenario data, or is a part of the group that owns the scenario data.

Is asserting with @RolesAllowed that a user is in a given role enough ? Or are you interested in finer grained relationship based authorization ? https://github.com/quarkiverse/quarkus-zanzibar can be of help in the latter case

Ideally, I'd also then store the scenario data retrieved from the database in a request scoped object. I thought about using filters, but I would not have access to the path parameter in a way that doesn't require parsing the URI

You should be able to inject JAX-RS UriInfo which will let you access individual request URI path parameters, which may simplify it

[colesturza]

Hi,

Using @RolesAllowed is not enough, the access is finer grained than a user having a system wide role. It is similar to a user having access to a private GitHub repository. I did some looking into the Zanzibar link you provided, that seems to be a possible fit for my criteria. Another solution I came across was this Stack Overflow post. https://stackoverflow.com/questions/31866258/how-to-pass-object-from-containerrequestfilter-to-resource which demonstrates passing data between filters and resources.

To demonstrate, for any others that may come across this problem.

@Target({ ElementType.TYPE, ElementType.METHOD })
@Retention(value = RetentionPolicy.RUNTIME)
@NameBinding
public @interface ScenarioAuthorized { }

@Provider
@ScenarioAuthorized
@Priority(Priorities.AUTHORIZATION)
public class ScenarioAuthorizationFilter implements ContainerRequestFilter {

    @Inject
    ScenarioRepository scenarioRepository;

    @Override
    public void filter(ContainerRequestContext requestContext) throws IOException {
        String scenarioIdString = requestContext.getUriInfo().getPathParameters().getFirst("id");
        if (scenarioIdString == null) {
            requestContext.abortWith(Response.status(Response.Status.BAD_REQUEST).entity("Scenario ID is required").build());
            return;
        }

        long scenarioId;
        try {
            scenarioId = Long.parseLong(scenarioIdString);
        } catch (NumberFormatException e) {
            requestContext.abortWith(Response.status(Response.Status.BAD_REQUEST).entity("Invalid Scenario ID format").build());
            return;
        }

        Scenario scenario = scenarioRepository.findById(scenarioId);
        if (scenario == null) {
            requestContext.abortWith(Response.status(Response.Status.NOT_FOUND).build());
            return;
        }

        // authorize that the current request user has permission to view the scenario

        requestContext.setProperty("currentScenario", scenario);
    }
}

@Path("scenarios")
public class ScenarioResource {

    @GET
    @Path("{id}")
    @ScenarioAuthorized
    public Response find(@PathParam("id") long id, @Context ContainerRequestContext requestContext) {
        Scenario scenario = (Scenario) requestContext.getProperty("currentScenario");
        return Response.ok(scenario).build();
    }

    @PUT
    @Path("{id}")
    @ScenarioAuthorized
    public Response update(@PathParam("id") long id, Scenario scenario, @Context ContainerRequestContext requestContext) {
        // Logic to update an existing scenario
        return Response.ok(scenario).build();
    }
}

[sberyozkin]

Looks like binding filters provides a neat solution indeed