2 files changed, 0 insertions, 302 deletions
diff --git a/src/main/java/eu/mulk/mulkcms2/authentication/JwtCookieLoginFilter.java b/src/main/java/eu/mulk/mulkcms2/authentication/JwtCookieLoginFilter.java
deleted file mode 100644
index 53903f7..0000000
--- a/src/main/java/eu/mulk/mulkcms2/authentication/JwtCookieLoginFilter.java
+++ /dev/null
@@ -1,184 +0,0 @@
-package eu.mulk.mulkcms2.authentication;
-
-import io.quarkus.security.credential.Credential;
-import io.quarkus.security.identity.AuthenticationRequestContext;
-import io.quarkus.security.identity.IdentityProvider;
-import io.quarkus.security.identity.SecurityIdentity;
-import io.quarkus.security.identity.request.TokenAuthenticationRequest;
-import io.quarkus.smallrye.jwt.runtime.auth.JWTAuthMechanism;
-import io.smallrye.jwt.auth.principal.DefaultJWTCallerPrincipal;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.security.KeyStore;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.Permission;
-import java.security.Principal;
-import java.security.PublicKey;
-import java.security.cert.CertificateException;
-import java.time.Duration;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionStage;
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-import org.jose4j.jwa.AlgorithmConstraints;
-import org.jose4j.jws.AlgorithmIdentifiers;
-import org.jose4j.jwt.MalformedClaimException;
-import org.jose4j.jwt.consumer.InvalidJwtException;
-import org.jose4j.jwt.consumer.JwtConsumerBuilder;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Interprets a possibly present JWT cookie and uses it to authenticate the user.
- *
- * <p>JWT cookies are used to authenticate further requests based on initial authentication. This
- * way, there is no need to route the user through an OpenID Connect IdP on each request, for
- * example.
- *
- * @see JWTAuthMechanism
- * @see JwtCookieSetterFilter
- */
-@ApplicationScoped
-public class JwtCookieLoginFilter implements IdentityProvider<TokenAuthenticationRequest> {
-
-  @ConfigProperty(name = "mulkcms.jwt.signing-key")
-  String signingKeyAlias;
-
-  @ConfigProperty(name = "mulkcms.jwt.keystore.file")
-  String signingKeyFile;
-
-  @ConfigProperty(name = "mulkcms.jwt.keystore.passphrase")
-  String signingKeyPassphrase;
-
-  @ConfigProperty(name = "mulkcms.jwt.issuer")
-  String issuer;
-
-  @ConfigProperty(name = "mulkcms.jwt.validity")
-  Duration validity;
-
-  private static final Logger log = LoggerFactory.getLogger(JwtCookieLoginFilter.class);
-
-  private PublicKey signingKey;
-
-  @PostConstruct
-  public void postCostruct()
-      throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException {
-    log.info("Hello!");
-    try (var is = new FileInputStream(signingKeyFile)) {
-      var keystore = KeyStore.getInstance(KeyStore.getDefaultType());
-      keystore.load(is, signingKeyPassphrase.toCharArray());
-      signingKey = keystore.getCertificate(signingKeyAlias).getPublicKey();
-      Objects.requireNonNull(signingKey);
-    }
-  }
-
-  @Override
-  public CompletionStage<SecurityIdentity> authenticate(
-      TokenAuthenticationRequest request, AuthenticationRequestContext context) {
-
-    log.info("Starting JWT verification.");
-
-    return context.runBlocking(
-        () -> {
-          try {
-            log.info("JWT verification started.");
-
-            /*
-            AbstractBearerTokenExtractor extractor =
-                new BearerTokenExtractor(requestContext, authContextInfo);
-            String bearerToken = extractor.getBearerToken();
-            */
-
-            // FIXME: But how does this know how the token is extracted?  What passes it here?
-            // Look up JWTAuthMechanism.
-            var bearerToken = request.getToken().getToken();
-
-            var jwtConsumer =
-                new JwtConsumerBuilder()
-                    .setJwsAlgorithmConstraints(
-                        new AlgorithmConstraints(
-                            AlgorithmConstraints.ConstraintType.WHITELIST,
-                            AlgorithmIdentifiers.RSA_USING_SHA256,
-                            AlgorithmIdentifiers.RSA_USING_SHA384,
-                            AlgorithmIdentifiers.RSA_USING_SHA512,
-                            AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256,
-                            AlgorithmIdentifiers.ECDSA_USING_P384_CURVE_AND_SHA384,
-                            AlgorithmIdentifiers.ECDSA_USING_P521_CURVE_AND_SHA512))
-                    .setVerificationKey(signingKey)
-                    .setRequireExpirationTime()
-                    .setAllowedClockSkewInSeconds(60)
-                    .build();
-
-            var claims = jwtConsumer.process(bearerToken).getJwtClaims();
-            claims.getSubject();
-
-            var jwtPrincipal = new DefaultJWTCallerPrincipal(claims);
-            log.info("JWT verified: {}", jwtPrincipal);
-
-            return new CookieIdentity(jwtPrincipal);
-          } catch (InvalidJwtException | MalformedClaimException e) {
-            log.info("JWT verification failed", e);
-            return null;
-          }
-        });
-  }
-
-  @Override
-  public Class<TokenAuthenticationRequest> getRequestType() {
-    return TokenAuthenticationRequest.class;
-  }
-
-  private static class CookieIdentity implements SecurityIdentity {
-
-    private Principal jwtPrincipal;
-
-    private CookieIdentity(Principal jwtPrincipal) {
-      this.jwtPrincipal = jwtPrincipal;
-    }
-
-    @Override
-    public Principal getPrincipal() {
-      return jwtPrincipal;
-    }
-
-    @Override
-    public boolean isAnonymous() {
-      return false;
-    }
-
-    @Override
-    public Set<String> getRoles() {
-      return Set.of();
-    }
-
-    @Override
-    public <T extends Credential> T getCredential(Class<T> credentialType) {
-      return null;
-    }
-
-    @Override
-    public Set<Credential> getCredentials() {
-      return Set.of();
-    }
-
-    @Override
-    public <T> T getAttribute(String name) {
-      return null;
-    }
-
-    @Override
-    public Map<String, Object> getAttributes() {
-      return Map.of();
-    }
-
-    @Override
-    public CompletionStage<Boolean> checkPermission(Permission permission) {
-      return CompletableFuture.completedFuture(false);
-    }
-  }
-}
diff --git a/src/main/java/eu/mulk/mulkcms2/authentication/JwtCookieSetterFilter.java b/src/main/java/eu/mulk/mulkcms2/authentication/JwtCookieSetterFilter.java
deleted file mode 100644
index baa51d4..0000000
--- a/src/main/java/eu/mulk/mulkcms2/authentication/JwtCookieSetterFilter.java
+++ /dev/null
@@ -1,118 +0,0 @@
-package eu.mulk.mulkcms2.authentication;
-
-import io.quarkus.security.identity.SecurityIdentity;
-import io.smallrye.jwt.build.Jwt;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.security.KeyStore;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.PrivateKey;
-import java.security.UnrecoverableKeyException;
-import java.security.cert.CertificateException;
-import java.time.Duration;
-import javax.annotation.PostConstruct;
-import javax.annotation.Priority;
-import javax.inject.Inject;
-import javax.ws.rs.container.ContainerRequestContext;
-import javax.ws.rs.container.ContainerResponseContext;
-import javax.ws.rs.container.ContainerResponseFilter;
-import javax.ws.rs.core.NewCookie;
-import javax.ws.rs.ext.Provider;
-import org.eclipse.microprofile.config.inject.ConfigProperty;
-import org.eclipse.microprofile.jwt.Claims;
-import org.eclipse.microprofile.jwt.JsonWebToken;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Adds a JWT cookie to every authenticated request.
- *
- * <p>JWT cookies are used to authenticate further requests based on initial authentication. This
- * way, there is no need to route the user through an OpenID Connect IdP on each request, for
- * example.
- *
- * @see JwtCookieLoginFilter
- */
-@Provider
-@Priority(1100)
-public class JwtCookieSetterFilter implements ContainerResponseFilter {
-
-  @ConfigProperty(name = "mulkcms.jwt.signing-key")
-  String signingKeyAlias;
-
-  @ConfigProperty(name = "mulkcms.jwt.keystore.file")
-  String signingKeyFile;
-
-  @ConfigProperty(name = "mulkcms.jwt.keystore.passphrase")
-  String signingKeyPassphrase;
-
-  @ConfigProperty(name = "mulkcms.jwt.issuer")
-  String issuer;
-
-  @ConfigProperty(name = "mulkcms.jwt.validity")
-  Duration validity;
-
-  @Inject SecurityIdentity identity;
-
-  private static final Logger log = LoggerFactory.getLogger(JwtCookieSetterFilter.class);
-
-  private PrivateKey signingKey;
-
-  @PostConstruct
-  public void postCostruct()
-      throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException,
-          UnrecoverableKeyException {
-    try (var is = new FileInputStream(signingKeyFile)) {
-      var keystore = KeyStore.getInstance(KeyStore.getDefaultType());
-      keystore.load(is, signingKeyPassphrase.toCharArray());
-      signingKey =
-          (PrivateKey) keystore.getKey(signingKeyAlias, signingKeyPassphrase.toCharArray());
-    }
-  }
-
-  @Override
-  public void filter(
-      ContainerRequestContext requestContext, ContainerResponseContext responseContext)
-      throws IOException {
-
-    if (identity.isAnonymous()) {
-      return;
-    }
-
-    var currentTimeSeconds = System.currentTimeMillis() / 1000;
-
-    if (identity instanceof JsonWebToken
-        && ((JsonWebToken) identity).getExpirationTime() < currentTimeSeconds) {
-      return;
-    }
-
-    var claims = Jwt.claims();
-
-    claims.issuedAt(currentTimeSeconds);
-    claims.claim(Claims.auth_time.name(), currentTimeSeconds);
-    claims.expiresAt(currentTimeSeconds + validity.toSeconds());
-    claims.issuer(issuer);
-    claims.preferredUserName(identity.getPrincipal().getName());
-    claims.subject(identity.getPrincipal().getName());
-
-    var token = claims.jws().signatureKeyId(signingKeyAlias).sign(signingKey);
-    responseContext
-        .getHeaders()
-        .add(
-            "Set-Cookie",
-            new NewCookie(
-                        "Bearer",
-                        token,
-                        null,
-                        null,
-                        1,
-                        null,
-                        (int) validity.toSeconds(),
-                        null,
-                        false,
-                        true)
-                    .toString()
-                + ";SameSite=Strict");
-  }
-}