feat(cloud-native)!: remove support for ldap persistence #9669

iromli · 2024-10-06T03:40:11Z

Prepare

Read PR guidelines
Read license information

Description

Target issue

closes #9659

This contains a breaking change removing OpenDJ support completely.

Implementation Details

Test and Document the changes

Static code analysis has been run locally and issues have been fixed
Relevant unit and integration tests have been added/updated
Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

I confirm that there is no impact on the docs due to the code changes in this PR.

Signed-off-by: iromli <[email protected]>

dryrunsecurity · 2024-10-06T03:40:52Z

DryRun Security Summary

The provided code changes cover a variety of updates across multiple components of the Janssen application, including the removal of LDAP support, adoption of modern persistence options, improved logging and monitoring, secure credential management, and potential security risks that require further review.

Expand for full summary

Summary:

The provided code changes cover a variety of updates across multiple components of the Janssen application. The key security-related observations are:

Removal of LDAP support: The changes indicate a shift away from LDAP-based persistence, with LDAP-related configurations being removed from various components. This simplification can potentially improve the overall security posture by reducing the attack surface and complexity associated with LDAP integration.
Adoption of modern persistence options: The application is now focusing on more lightweight and cloud-native persistence solutions, such as Couchbase, SQL, and Google Spanner. This transition requires careful review of the security configurations and practices for these new persistence backends.
Improved logging and monitoring: The changes include updates to the logging configurations, which can enhance the application's security monitoring and incident response capabilities.
Secure credential management: The application appears to be using Kubernetes Secrets, Vault, and other secure credential management solutions to store sensitive data, such as database passwords and API keys. This is a positive security practice that should be maintained.
Potential security risks: While the changes generally seem to be focused on improving the application's security, there are a few areas that require further review, such as the handling of custom scripts, resource allocation in test environments, and potential hardcoded or insecure configurations.

Files Changed:

automation/rancher-partner-charts/app-readme.md: Removal of LDAP support from the Janssen Server.
.github/workflows/microk8s.yml: Simplification of the persistence backend configuration, focusing on MySQL instead of LDAP.
automation/docs/generated-cn-docs.sh: Updates to the documentation generation process, with no direct security implications.
automation/rancher-partner-charts/questions.yaml: Removal of LDAP support as a persistence option.
automation/startjanssendemo.sh: Removal of LDAP persistence option and improvements to logging and monitoring.
charts/janssen-all-in-one/README.md: Removal of LDAP-related configurations.
charts/janssen-all-in-one/templates/configmap.yaml: Removal of LDAP-related configurations.
automation/startjanssenmonolithdemo.sh: Removal of LDAP persistence option and improvements to the deployment process.
charts/janssen/Chart.yaml: Removal of the OpenDJ (LDAP) component.
charts/janssen/charts/auth-server/templates/deployment.yml: Updates to the resource allocation, probes, and environment variable configurations.
charts/janssen/charts/auth-server-key-rotation/templates/cronjobs.yaml: Improvements to the key rotation process.
charts/janssen/charts/casa/templates/deployment.yaml: Updates to the resource allocation, custom scripts, and environment variable configurations.
charts/janssen/charts/config-api/templates/deployment.yaml: Updates to the resource allocation, custom scripts, and environment variable configurations.
charts/janssen/charts/config/README.md: Removal of LDAP-related configurations.
charts/janssen/charts/config/templates/_helpers.tpl: Removal of the LDAP scope from the optional scopes.
charts/janssen/charts/config/templates/secrets.yaml: Removal of LDAP-related secrets and updates to the credential management.
charts/janssen/charts/config/templates/configmaps.yaml: Removal of LDAP-related configurations and updates to the logging, Couchbase, Google, and AWS integrations.
charts/janssen/charts/config/values.yaml: Removal of LDAP-related configurations and updates to the persistence, Couchbase, SQL, Redis, and Vault configurations.
charts/janssen/charts/fido2/templates/deployment.yml: Updates to the resource allocation and custom script handling.
charts/janssen/charts/kc-scheduler/templates/cronjobs.yaml: Updates to the resource allocation and environment variable handling.
charts/janssen/charts/link/templates/deployment.yaml: Updates to the resource allocation, volume mounts, environment variables, and custom script handling.

Code Analysis

We ran 9 analyzers against 30 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

Signed-off-by: iromli <[email protected]>

sonarcloud · 2024-10-07T16:49:54Z

Quality Gate passed for 'Fido2 API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-10-07T16:50:23Z

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Signed-off-by: iromli <[email protected]>

sonarcloud · 2024-10-08T17:28:46Z

Quality Gate passed for 'jans-pycloudlib'

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Signed-off-by: iromli <[email protected]>

sonarcloud · 2024-10-10T05:48:57Z

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Signed-off-by: iromli <[email protected]>

sonarcloud · 2024-10-10T19:23:33Z

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-10-10T19:23:49Z

Quality Gate passed for 'keycloak-integration-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-10-10T19:24:03Z

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-10-10T19:24:33Z

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-10-10T19:25:25Z

Quality Gate passed for 'orm'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Signed-off-by: iromli <[email protected]>

Signed-off-by: moabu <[email protected]>

Signed-off-by: iromli <[email protected]>

feat(cloud-native): remove support for ldap persistence

b79a4d4

Signed-off-by: iromli <[email protected]>

mo-auto added area-documentation Documentation needs to change as part of issue or PR comp-docs Touching folder /docs comp-jans-pycloudlib kind-feature Issue or PR is a new feature request labels Oct 6, 2024

iromli added 3 commits October 6, 2024 15:39

chore(cloud-native): partially remove ldap support from OCI images

e09c45a

Signed-off-by: iromli <[email protected]>

fix(docker-jans-scim): remove invalid conditional block

73b4cec

Signed-off-by: iromli <[email protected]>

chore(cloud-native): partially remove ldap-related code

cf46514

Signed-off-by: iromli <[email protected]>

iromli self-assigned this Oct 7, 2024

iromli added 2 commits October 9, 2024 00:20

feat(cloud-native): add support to migrate from ldap to sql

8b3e988

Signed-off-by: iromli <[email protected]>

chore: add notes for ldap3 library

f3dde71

Signed-off-by: iromli <[email protected]>

iromli added 2 commits October 9, 2024 22:37

chore: remove ldap-related configuration

d709437

Signed-off-by: iromli <[email protected]>

chore: remove ldap-related configuration

2d8161f

Signed-off-by: iromli <[email protected]>

iromli and others added 6 commits October 10, 2024 13:02

chore(charts): remove ldap support from janssen chart

45bd851

Signed-off-by: iromli <[email protected]>

chore(charts): remove ldap support from janssen-all-in-one chart

07ec923

Signed-off-by: iromli <[email protected]>

chore(charts): remove unsupported storageClass

68c2ca8

Signed-off-by: iromli <[email protected]>

docs(cloud-native): update reference docs for k8s env

0fc1a20

Signed-off-by: iromli <[email protected]>

fix(charts): resolve incorrect conditional block

37bc75f

Signed-off-by: iromli <[email protected]>

Merge branch 'main' into cn-remove-ldap-support

54329c3

chore(monolith): remove ldap support

88db459

Signed-off-by: iromli <[email protected]>

iromli and others added 2 commits October 11, 2024 21:42

Merge branch 'main' into cn-remove-ldap-support

908b451

chore: update JANS_SOURCE_VERSION

ae7be35

Signed-off-by: iromli <[email protected]>

iromli marked this pull request as ready for review October 11, 2024 17:38

iromli requested a review from moabu as a code owner October 11, 2024 17:38

moabu changed the title ~~feat(cloud-native): remove support for ldap persistence~~ feat(cloud-native)!: remove support for ldap persistence Oct 11, 2024

iromli and others added 3 commits October 12, 2024 00:58

chore: add missing logger for com.couchbase.client

10fccc3

Signed-off-by: iromli <[email protected]>

docs: initial removal of opendj from CN docs

3ac9314

Signed-off-by: moabu <[email protected]>

docs: removal of opendj from docs

c9e40b5

Signed-off-by: moabu <[email protected]>

iromli removed comp-jans-pycloudlib comp-jans-config-api Component affected by issue or PR comp-jans-fido2 Component affected by issue or PR comp-jans-keycloak-link Touching folder /jans-keycloak-link comp-jans-link Touching folder /jans-link labels Oct 11, 2024

fix: add missing storageClass

33f092f

Signed-off-by: iromli <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cloud-native)!: remove support for ldap persistence #9669

feat(cloud-native)!: remove support for ldap persistence #9669

iromli commented Oct 6, 2024 •

edited by moabu

Loading

dryrunsecurity bot commented Oct 6, 2024 •

edited

Loading

sonarcloud bot commented Oct 7, 2024

sonarcloud bot commented Oct 7, 2024

sonarcloud bot commented Oct 8, 2024

sonarcloud bot commented Oct 10, 2024

sonarcloud bot commented Oct 10, 2024

sonarcloud bot commented Oct 10, 2024

sonarcloud bot commented Oct 10, 2024

sonarcloud bot commented Oct 10, 2024

sonarcloud bot commented Oct 10, 2024

feat(cloud-native)!: remove support for ldap persistence #9669

Are you sure you want to change the base?

feat(cloud-native)!: remove support for ldap persistence #9669

Conversation

iromli commented Oct 6, 2024 • edited by moabu Loading

Prepare

Description

Target issue

Implementation Details

Test and Document the changes

dryrunsecurity bot commented Oct 6, 2024 • edited Loading

DryRun Security Summary

Code Analysis

Riskiness

sonarcloud bot commented Oct 7, 2024

Quality Gate passed for 'Fido2 API'

sonarcloud bot commented Oct 7, 2024

Quality Gate passed for 'SCIM API'

sonarcloud bot commented Oct 8, 2024

Quality Gate passed for 'jans-pycloudlib'

sonarcloud bot commented Oct 10, 2024

Quality Gate passed for 'Jans-Keycloak-Link'

sonarcloud bot commented Oct 10, 2024

Quality Gate passed for 'jans-cli'

sonarcloud bot commented Oct 10, 2024

Quality Gate passed for 'keycloak-integration-parent'

sonarcloud bot commented Oct 10, 2024

Quality Gate passed for 'jans-linux-setup'

sonarcloud bot commented Oct 10, 2024

Quality Gate passed for 'jans-config-api-parent'

sonarcloud bot commented Oct 10, 2024

Quality Gate passed for 'orm'

iromli commented Oct 6, 2024 •

edited by moabu

Loading

dryrunsecurity bot commented Oct 6, 2024 •

edited

Loading