[VAS] Story #11619: Multiple organizations on same domain mail #1695

bbenaissa · 2024-03-19T11:49:19Z

Description

L'objectif de cette PR est de faire évoluer Vitamui pour q'un même domaine mail puisse pouvoir être intégré dans deux organisations différentes afin de pouvoir accéder aux archives des organisations.

Cette évolution concerne les parties suivantes :

l'authentification dans les modes suivants:
- Interne
- SSO en Open Id Connect
- SSO en Saml2
- Par Certificat
Subrogation avec compte interne et avec compte en délagation.
Mise à jour des écrans
l'ensemble des Workdlow de gestion des mot de passe

Type de changement:

Nouveau Code
Correction

Tests:

manuel

environnement

TU

Contributeur

VAS (Vitam Accessible en Service)

vitam-devops · 2024-03-19T12:23:25Z

Checkmarx One – Scan Summary & Details – feefc6dc-edd3-4921-9e8c-e59f574c70fe

New Issues

Issue	Source File / Package	Checkmarx Insight
Passwords And Secrets - Generic Password	/docker-compose.yml: 20	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/docker-compose.yml: 53	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/docker-compose.yml: 50	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/docker-compose.yml: 18	Query to find passwords and secrets in infrastructure code.
Passwords And Secrets - Generic Password	/docker-compose.yml: 26	Query to find passwords and secrets in infrastructure code.
Cleartext_Submission_of_Sensitive_Information	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/user/service/UserEmailInternalService.java: 98	Attack Vector
Cleartext_Submission_of_Sensitive_Information	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 84	Attack Vector
Container Traffic Not Bound To Host Interface	/docker-compose.yml: 14	Incoming container traffic should be bound to a specific host interface
Container Traffic Not Bound To Host Interface	/docker-compose.yml: 47	Incoming container traffic should be bound to a specific host interface
Healthcheck Not Set	/docker-compose.yml: 41	Check containers periodically to see if they are running properly.
Healthcheck Not Set	/docker-compose.yml: 4	Check containers periodically to see if they are running properly.
Memory Not Limited	/docker-compose.yml: 4	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
Memory Not Limited	/docker-compose.yml: 41	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 211	Attack Vector
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 131	Attack Vector
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 131	Attack Vector
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 158	Attack Vector
Privacy_Violation	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 180	Attack Vector
Privacy_Violation	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 100	Attack Vector
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 211	Attack Vector
Privacy_Violation	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 180	Attack Vector
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 131	Attack Vector
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 131	Attack Vector
Privacy_Violation	/api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 158	Attack Vector
Privacy_Violation	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 180	Attack Vector
Privacy_Violation	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 184	Attack Vector
SSRF	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 163	Attack Vector
SSRF	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 163	Attack Vector
SSRF	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 164	Attack Vector
SSRF	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 143	Attack Vector
SSRF	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 142	Attack Vector
SSRF	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 100	Attack Vector
SSRF	/api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 101	Attack Vector
SSRF	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/authentication/UserAuthenticationHandler.java: 107	Attack Vector
Security Opt Not Set	/docker-compose.yml: 4	Attribute 'security_opt' should be defined.
Security Opt Not Set	/docker-compose.yml: 41	Attribute 'security_opt' should be defined.
Client_JQuery_Deprecated_Symbols	/cas/cas-server/src/main/resources/static/js/cas.js: 74	Attack Vector
Client_JQuery_Deprecated_Symbols	/cas/cas-server/src/main/resources/static/js/cas.js: 40	Attack Vector
Client_JQuery_Deprecated_Symbols	/cas/cas-server/src/main/resources/static/js/cas.js: 39	Attack Vector
Container Capabilities Unrestricted	/docker-compose.yml: 4	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
Container Capabilities Unrestricted	/docker-compose.yml: 41	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
Cpus Not Limited	/docker-compose.yml: 4	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
Cpus Not Limited	/docker-compose.yml: 41	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
Healthcheck Instruction Missing	/Dockerfile: 6	Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
Heap_Inspection	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/user/service/UserInternalService.java: 539	Attack Vector
Heap_Inspection	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/cas/service/CasInternalService.java: 243	Attack Vector
Heap_Inspection	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/cas/service/CasInternalService.java: 225	Attack Vector
Heap_Inspection	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/cas/service/CasInternalService.java: 234	Attack Vector
Heap_Inspection	/api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/cas/service/CasInternalService.java: 240	Attack Vector
Use_Of_Hardcoded_Password	/deployment/scripts/mongod/1.0.0/101_iam_system_demo.js: 315	Attack Vector
Use_Of_Hardcoded_Password	/deployment/scripts/mongod/1.0.0/101_iam_system_demo.js: 269	Attack Vector
Use_Of_Hardcoded_Password	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/configurer/CustomLoginWebflowConfigurer.java: 76	Attack Vector
Use_Of_Hardcoded_Password	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/configurer/CustomLoginWebflowConfigurer.java: 66	Attack Vector
Use_Of_Hardcoded_Password	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/configurer/CustomLoginWebflowConfigurer.java: 82	Attack Vector
Use_Of_Hardcoded_Password	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/configurer/CustomLoginWebflowConfigurer.java: 68	Attack Vector

GiooDev · 2024-03-31T18:07:28Z

api/api-iam/README.md

@@ -9,17 +9,17 @@ These components are a set of REST/JSON web services to perform CRUD operations
 - profiles
 - users.

-There are composed of the web services themselves (api-iam-server module), the REST clients of these web services (api-iam-client module) and the DTOs shared between the two modules (api-iam-common module).
-
+There are composed of the web services themselves (api-iam-server module), the REST clients of these web services (


Pourquoi ces sauts de lignes ici ?

Simple formatage. Markdown ignore les simples hauts

ebernard · 2024-04-02T08:55:50Z

api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/dto/IdentityProviderDto.java

@@ -135,5 +135,6 @@ public class IdentityProviderDto extends CustomerIdDto {

    private Boolean usePkce;

+    // FIXME : Convert to enum


À faire maintenant ou créer une story pour pas l'oublier.

à faire plus tard en clean code

Attention à la divergence de code avec la future CAS v7.

ebernard · 2024-04-02T09:12:54Z

...external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java

        checkResponse(response);
    }

-    public UserDto getUserByEmail(final ExternalHttpContext context, final String email, final Optional<String> embedded) {
+    // FIXME :  getUserByEmail vs getUser


À faire maintenant ou créer une story pour pas l'oublier.

ebernard · 2024-04-02T09:17:55Z

...external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java

        checkResponse(response);
    }

-    public UserDto getUserByEmail(final ExternalHttpContext context, final String email, final Optional<String> embedded) {
+    // FIXME :  getUserByEmail vs getUser
+    @VisibleForTesting


La documentation de l'annotation VisibleForTesting indique :

Do not use this interface for public or protected declarations: it is a fig leaf for bad design, and it does not prevent anyone from using the declaration

(voir https://guava.dev/releases/snapshot-jre/api/docs/com/google/common/annotations/VisibleForTesting.html)

OK, en plus c'était pas si test only. Je supprime

...external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java

ebernard · 2024-04-02T13:39:07Z

...server/src/main/resources/templates/password-reset/casResetPasswordSendInstructionsView.html

+          th:href="@{/css/cas.css}"/>
+    <link rel="stylesheet" type="text/css" href="../../static/icons/vitamui-icons.css"
+          th:href="@{/icons/vitamui-icons.css}"/>
+    <script type="text/javascript" src="../../../../../../deployment/roles/reverse/files/apache/page/js/jquery.min.js"


ebernard · 2024-04-02T13:41:06Z

cas/cas-server/src/main/resources/templates/passwordForm.html

+        th:href="@{/css/cas.css}"/>
+  <link rel="stylesheet" type="text/css" href="../static/icons/vitamui-icons.css"
+        th:href="@{/icons/vitamui-icons.css}"/>
+  <script type="text/javascript" src="../../../../../../deployment/roles/reverse/files/apache/page/js/jquery.min.js"


deployment/roles/vitamui/templates/iam-internal/application.yml.j2

ebernard · 2024-04-02T14:43:26Z

deployment/scripts/mongod/1.0.0/101_iam_system_demo.js

Ces changements ne devraient-ils pas être faits dans v7.1 plutôt ?

integration-tests/src/test/java/fr/gouv/vitamui/utils/TestConstants.java

…anup

…tion

…with internal provider

…t and password update

…anisations with multi domain

… (experimental)

ebernard · 2024-04-02T15:25:15Z

Mes retours sont non bloquants, vous pouvez merger, mais il faudra peut-être les traiter par la suite.

leleuj · 2024-04-04T07:04:13Z

...m/iam-commons/src/test/java/fr/gouv/vitamui/iam/common/utils/IdentityProviderHelperTest.java


 /**
 * Tests {@link IdentityProviderHelper}.
- *
- *
 */
 public final class IdentityProviderHelperTest {


Je ne vois pas de tests sur les nouvelles méthodes : findAllByUserIdentifier, findByUserIdentifierAndCustomerId et identifierMatchProviderPattern.

...external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java

...m-external/src/main/java/fr/gouv/vitamui/iam/external/server/service/CasExternalService.java

...c/main/java/fr/gouv/vitamui/iam/external/server/service/IdentityProviderExternalService.java

leleuj · 2024-04-04T07:24:00Z

...ternal/src/main/java/fr/gouv/vitamui/iam/internal/server/cas/service/CasInternalService.java

+            throw new ApplicationServerException("Unable to update password : customer not found");
+        }
+        User user = findUserByEmailAndCustomerId(email, customerId);
+        if (UserTypeEnum.NOMINATIVE != user.getType()) {


Exemple de test manquant : je ne crois pas que ce cas soit testé quelque part...

...n/java/fr/gouv/vitamui/cas/authentication/DelegatedSurrogateAuthenticationPostProcessor.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/authentication/UserPrincipalResolver.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/config/WebflowConfig.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/CustomerSelectedAction.java

...ver/src/main/java/fr/gouv/vitamui/cas/config/CustomSurrogateInitialAuthenticationAction.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/model/CustomerModel.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/pm/IamPasswordManagementService.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/pm/ResetPasswordController.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/CustomerSelectedAction.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/DispatcherAction.java

...-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/GeneralTerminateSessionAction.java

...c/main/java/fr/gouv/vitamui/cas/webflow/actions/I18NSendPasswordResetInstructionsAction.java

cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/ListCustomersAction.java

lgheribi · 2024-04-04T14:50:45Z

cas/cas-server/src/main/resources/templates/fragments/pwdupdateform.html

+                            numériques (0-9)
+                        </li>
+                        <li>
+                            caractères spéciaux (!"#$%&£'()*+,-./:;<=>?@[]^_`{|}~)


J'ai l'impression que ce bloc est statique + des soucis de substitution :

bbenaissa requested a review from leleuj March 19, 2024 11:49

lgheribi force-pushed the vas-11619-multiple-organizations-on-same-domain-internal-auth branch 2 times, most recently from 5c69337 to 7d4ad70 Compare March 22, 2024 08:28

bbenaissa force-pushed the vas-11619-multiple-organizations-on-same-domain-internal-auth branch from 625012c to daa0598 Compare March 26, 2024 14:50

lgheribi force-pushed the vas-11619-multiple-organizations-on-same-domain-internal-auth branch 4 times, most recently from 73fd224 to 50a992f Compare March 27, 2024 13:10

bbenaissa force-pushed the vas-11619-multiple-organizations-on-same-domain-internal-auth branch 4 times, most recently from 67a8565 to 45d5ada Compare March 29, 2024 10:57

bbenaissa changed the title ~~Vas 11619 multiple organizations on same domain internal auth~~ Vas 11619 multiple organizations on same domain mail Mar 29, 2024

bbenaissa force-pushed the vas-11619-multiple-organizations-on-same-domain-internal-auth branch 2 times, most recently from 8637616 to 7dc6645 Compare March 29, 2024 11:12

GiooDev changed the title ~~Vas 11619 multiple organizations on same domain mail~~ [VAS] Story #11619: Multiple organizations on same domain mail Mar 29, 2024

GiooDev added this to the IT 133 milestone Mar 29, 2024

bbenaissa force-pushed the vas-11619-multiple-organizations-on-same-domain-internal-auth branch 2 times, most recently from 88fd5cc to a272c6b Compare March 30, 2024 09:52

GiooDev reviewed Mar 31, 2024

View reviewed changes

ebernard reviewed Apr 2, 2024

View reviewed changes

ebernard marked this pull request as ready for review April 2, 2024 15:09

laedanrex and others added 7 commits April 2, 2024 17:22

Feature/Vas-11619: Multi-domain authentication - CSS, Templates & cle…

270781d

…anup

Feature/Vas-11619: Multi-domain authentication - Fix logos for produc…

2f6b5bb

…tion

Feature/Vas-11619: Multi-domain authentication - Authn & subrogation …

aef98a7

…with internal provider

Feature/Vas-11619: Multi-domain authentication - Handle password rese…

3f3405c

…t and password update

Feature/Vas-12559: Multi-domain authentication - Create users and org…

d8a679b

…anisations with multi domain

Feature/Vas-12560: Multi-domain authentication - External Idp support…

9eb31f9

… (experimental)

Feature/Vas-12560 - Add customer id for provisionning

8648bea

Feature/Vas-11619:Fix rebase conflict and adapt services with develop

8c837c0

bbenaissa force-pushed the vas-11619-multiple-organizations-on-same-domain-internal-auth branch from a272c6b to 8c837c0 Compare April 2, 2024 15:22

GiooDev merged commit 5efc2ac into develop Apr 2, 2024
1 check passed

GiooDev deleted the vas-11619-multiple-organizations-on-same-domain-internal-auth branch April 2, 2024 15:44