8000 fix(cloud-native): remove oxauth variable naming inside templates by iromli · Pull Request #9027 · JanssenProject/jans · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix(cloud-native): remove oxauth variable naming inside templates #9027

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jul 25, 2024
Merged

fix(cloud-native): remove oxauth variable naming inside templates #9027

merged 2 commits into from
Jul 25, 2024

Conversation

iromli
Copy link
Contributor
@iromli iromli commented Jul 24, 2024

Prepare

Description

Target issue

closes #9026

Implementation Details

Test and Document the changes

  • Static code analysis has been run locally and issues have been fixed
  • Relevant unit and integration tests have been added/updated
  • Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

  • I confirm that there is no impact on the docs due to the code changes in this PR.

@iromli
fix(cloud-native): remove oxauth variable naming inside templates
11de949 
Signed-off-by: iromli <isman.firmansyah@gmail.com>
@iromli iromli requested a review from moabu as a code owner July 24, 2024 14:43
@dryrunsecurity DryRunSecurity
Copy link
dryrunsecurity bot commented Jul 24, 2024 •
edited
Loading

DryRun Security Summary

The provided code changes are related to the Janssen project, focusing on updating the configuration and secrets management for the Janssen Authentication (jans-auth) component and the docker-jans-persistence-loader application, as well as making updates to the Docker images used for deployment, with a focus on security-conscious practices.

Expand for full summary

Summary:

The provided code changes are related to the Janssen project, which includes the Janssen Authentication (jans-auth) component and the docker-jans-persistence-loader application. The changes primarily focus on updating the configuration and secrets management for these components, as well as making some updates to the Docker images used for deployment.

From an application security perspective, the key points to highlight are:

  1. Naming Convention Updates: The code changes reflect an update in the naming conventions used for the Janssen Authentication component, with references to "oxauth" being replaced by "jans-auth".
  2. Configuration and Secrets Management: The changes update the keys used for retrieving configuration and secrets, such as OpenID Connect keys, error messages, and static configurations. It's important to ensure that these configurations and secrets are properly managed and secured.
  3. Docker Image Updates: The changes update the base image versions for various Janssen components, which is a positive security practice to ensure that the latest bug fixes and security patches are included. The Dockerfiles also include several security-conscious measures, such as creating a non-root user and setting appropriate permissions.
  4. Persistence Layer Configuration: The code configures the persistence layer, which is set to use Couchbase by default. The Couchbase-related environment variables, such as the URL, user, and password, should be carefully managed to prevent unauthorized access or data leaks.
  5. Logging and Monitoring: It's important to ensure that the application has proper logging and monitoring mechanisms in place to detect and respond to any security-related events or anomalies.

Overall, the code changes appear to be focused on maintaining compatibility and consistency with the Janssen project, as well as implementing security-conscious practices in the deployment and configuration of the application. However, it's crucial to thoroughly review the entire codebase and deployment setup to ensure that there are no other security concerns or vulnerabilities that may have been introduced.

Files Changed:

  1. docker-jans-persistence-loader/scripts/utils.py: The changes update the keys used for retrieving configuration and secrets related to the Janssen Authentication component.
  2. docker-jans-persistence-loader/scripts/hooks.py: The changes update the configuration of the Janssen Authentication component, including updates to the keystore, dynamic configuration, and LDIF mapping handling.
  3. docker-jans-all-in-one/Dockerfile: The changes update the base image versions for various Janssen components and set various environment variables related to configuration and secrets management.
  4. docker-jans-persistence-loader/Dockerfile: The changes update the Docker image for the Janssen Authorization Server Persistence Loader, including version updates, asset synchronization, Python dependency management, and configuration of the persistence layer and other services.

Code Analysis

We ran 9 analyzers against 4 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 2 findings
Authn/Authz Analyzer 4 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

@mo-auto mo-auto added comp-docker-jans-all-in-one Touching folder /docker-jans-all-in-one comp-docker-jans-persistence-loader kind-bug Issue or PR is a bug in existing functionality labels Jul 24, 2024
@moabu moabu merged commit 9357128 into main Jul 25, 2024
9 of 10 checks passed
@moabu moabu deleted the cn-vars-rename branch July 25, 2024 10:02
yuriyz pushed a commit that referenced this pull request Nov 7, 2024
@iromli @moabu
fix(cloud-native): remove oxauth variable naming inside templates (#9027
8be2efa 
)

Signed-off-by: iromli <isman.firmansyah@gmail.com>
Co-authored-by: Mohammad Abudayyeh <47318409+moabu@users.noreply.github.com>
Former-commit-id: 9357128
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@moabu moabu moabu approved these changes

Assignees
No one assigned
Labels
comp-docker-jans-all-in-one Touching folder /docker-jans-all-in-one comp-docker-jans-persistence-loader kind-bug Issue or PR is a bug in existing functionality
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

fix(cloud-native): remove oxauth variable naming inside templates
3 participants
@iromli @moabu @mo-auto
0