CB-4154 rp add te role header and auth log (#2117) (#2123)

Co-authored-by: Daria Marutkina <125263541+dariamarutkina@users.noreply.github.com>

server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/RPSessionHandler.java

@@ -38,6 +38,7 @@ import org.jkiss.dbeaver.model.security.exception.SMException;
 import org.jkiss.utils.CommonUtils;
 
 import java.io.IOException;
+import java.text.MessageFormat;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -69,7 +70,12 @@ public class RPSessionHandler implements DBWSessionHandler {
         }
         SMAuthProviderExternal<?> authProviderExternal = (SMAuthProviderExternal<?>) authProvider.getInstance();
         String userName = request.getHeader(RPAuthProvider.X_USER);
-        String teams = request.getHeader(RPAuthProvider.X_ROLE);
+        String teams = request.getHeader(RPAuthProvider.X_TEAM);
+        if (CommonUtils.isEmpty(teams)) {
+            // backward compatibility
+            teams = request.getHeader(RPAuthProvider.X_ROLE);
+        }
+        String role = request.getHeader(RPAuthProvider.X_ROLE_TE);
         String firstName = request.getHeader(RPAuthProvider.X_FIRST_NAME);
         String lastName = request.getHeader(RPAuthProvider.X_LAST_NAME);
         List<String> userTeams = teams == null ? Collections.emptyList() : List.of(teams.split("\\|"));
@@ -85,16 +91,21 @@ public class RPSessionHandler implements DBWSessionHandler {
                 }
                 Map<String, Object> sessionParameters = webSession.getSessionParameters();
                 sessionParameters.put(SMConstants.SESSION_PARAM_TRUSTED_USER_TEAMS, userTeams);
+                sessionParameters.put(SMConstants.SESSION_PARAM_TRUSTED_USER_ROLE, role);
                 Map<String, Object> userCredentials = authProviderExternal.authExternalUser(
                     webSession.getProgressMonitor(), null, credentials);
                 String currentSmSessionId = webSession.getUser() == null ? null : webSession.getUserContext().getSmSessionId();
                 try {
+                    log.debug(MessageFormat.format(
+                        "Attempting to authenticate user ''{0}'' with teams {1} through reverse proxy", userName, userTeams));
                     SMAuthInfo smAuthInfo = securityController.authenticate(
                         webSession.getSessionId(),
                         currentSmSessionId,
                         sessionParameters,
                         WebSession.CB_SESSION_TYPE, authProvider.getId(), null, userCredentials);
                     new WebSessionAuthProcessor(webSession, smAuthInfo, false).authenticateSession();
+                    log.debug(MessageFormat.format(
+                        "Successful reverse proxy authentication: user ''{0}'' with teams {1}", userName, userTeams));
                 } catch (SMException e) {
                     log.debug("Error during user authentication", e);
                     throw e;

server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/rp/RPAuthProvider.java

@@ -42,7 +42,10 @@ public class RPAuthProvider implements SMAuthProviderExternal<SMSession> {
     private static final Log log = Log.getLog(RPAuthProvider.class);
 
     public static final String X_USER = "X-User";
+    @Deprecated // use X-Team
     public static final String X_ROLE = "X-Role";
+    public static final String X_TEAM = "X-Team";
+    public static final String X_ROLE_TE = "X-Role-TE";
     public static final String X_FIRST_NAME = "X-First-name";
     public static final String X_LAST_NAME = "X-Last-name";
     public static final String AUTH_PROVIDER = "reverseProxy";

server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java

@@ -2102,6 +2102,10 @@ public class CBEmbeddedSecurityController<T extends WebAuthApplication>
             userId = userIdFromCredentials;
         }
         if (authProvider.isTrusted()) {
+            Object reverseProxyUserRole = sessionParameters.get(SMConstants.SESSION_PARAM_TRUSTED_USER_ROLE);
+            if (reverseProxyUserRole instanceof String rpAuthRole) {
+                setUserAuthRole(userId, rpAuthRole);
+            }
             Object reverseProxyUserTeams = sessionParameters.get(SMConstants.SESSION_PARAM_TRUSTED_USER_TEAMS);
             if (reverseProxyUserTeams instanceof List) {
                 setUserTeams(userId, ((List<?>) reverseProxyUserTeams).stream().map(Object::toString).toArray(String[]::new), userId);

server/test/io.cloudbeaver.test.platform/src/io/cloudbeaver/test/platform/AuthenticationTest.java

@@ -55,7 +55,7 @@ public class AuthenticationTest {
 
     private Map<String, Object> doPostQuery(HttpClient client, String gqlScript) throws Exception {
         String input = WebTestUtils.readScriptTemplate(gqlScript, CEServerTestSuite.getScriptsPath());
-        List<String> headers = List.of(RPAuthProvider.X_USER, REVERSE_PROXY_TEST_USER, RPAuthProvider.X_ROLE, "user");
+        List<String> headers = List.of(RPAuthProvider.X_USER, REVERSE_PROXY_TEST_USER, RPAuthProvider.X_TEAM, "user");
         Map<String, Object> map = WebTestUtils.doPostWithHeaders(CEServerTestSuite.GQL_API_URL, input, client, headers);
         return JSONUtils.getObjectOrNull(map, "data");
     }

webapp/packages/product-default/package.json

@@ -5,7 +5,7 @@
     "src/**/*.scss",
     "public/**/*"
   ],
-  "version": "23.2.3",
+  "version": "23.2.4",
   "description": "CloudBeaver Community",
   "license": "Apache-2.0",
   "main": "dist/index.js",