cf-uaac 4.16.0 → 4.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 276b109b1fa40107102c91b342869bf30767a3ee9f7be7aaf480c801d923b2fc
-  data.tar.gz: 81c401c741ae0092cbb997df969a6b0435080fde6dc876235ca2b8b115e46a63
+  metadata.gz: b470c3d2590a9e00f4481b0d5ac9c611b38f6f14b3d506c3a2c3c4b6eeede7c3
+  data.tar.gz: f0838fe08f2a05f001a12d70c093b32f5c209986e271ab3fd0ed71ff12f58699
 SHA512:
-  metadata.gz: '0888529f04a01b043f6d552f366d32b873e9e715c6b78c14173cc6b96ae31da930c339209c5940023a150c165c1fcc7486311c23e1c2080a81226cd6f80e1dfa'
-  data.tar.gz: c9daacd917c2bdb037a2e0876368eaaabae0c41446c8b005e0a6728ad282f2c8141c184f4200b2982069f20030168dc064cca07c2a15a544b7822887b8ea2c8b
+  metadata.gz: 40db2b6725b381ad1b516ed64ccf567130e2a9760da0b9555973f7c4b6f0cd8a42fca39203048358117bd067e459492ff03d9978fc6fae994fc8b938730e4ba5
+  data.tar.gz: a7c3573b9409e08c22f9629de314c7b4b3f2e89c2359ebce22291bd21cdf7fe85fb471c2042c9ffe29d08fa89515a7affd652029da227bb30a96ed525d8e51cd

data/cf-uaac.gemspec

@@ -31,7 +31,7 @@ Gem::Specification.new do |s|
   s.require_paths = ['lib']
 
   # dependencies
-  s.add_runtime_dependency 'cf-uaa-lib', '~> 4.0.3'
+  s.add_runtime_dependency 'cf-uaa-lib', '~> 4.0.4'
   s.add_development_dependency 'rake', '~> 13.0'
   s.add_development_dependency 'rspec', '~> 3.12'
   s.add_development_dependency 'simplecov', '~> 0.22.0'

data/lib/uaa/cli/client_reg.rb

@@ -30,7 +30,8 @@ class ClientCli < CommonCli
       :autoapprove => 'list',
       :allowpublic => 'list',
       :allowedproviders => 'list',
-      :'signup_redirect_url' => 'url'
+      :'signup_redirect_url' => 'url',
+      :required_user_groups => 'list'
   }
   CLIENT_SCHEMA.each { |k, v| define_option(k, "--#{k} <#{v}>") }
 
@@ -65,8 +66,18 @@ class ClientCli < CommonCli
 
   desc "client get [id]", "Get specific client registration", :attrs do |id|
     pp(scim_request do |sr|
-      client = scim_get_object(sr, :client, clientid(id), opts[:attrs])
-      add_meta_fields_to_client(sr, client)
+      if opts[:attrs] == nil
+        # return whole object, not search by filter
+        begin
+          client = sr.get(:client, clientid(id))
+        rescue NotFound
+          # to raise same error as scim_get_object
+          raise NotFound
+        end
+      else
+        client = scim_get_object(sr, :client, clientid(id), opts[:attrs])
+      end
+      add_meta_fields_to_client(sr, client, id)
     end)
   end
 
@@ -121,6 +132,31 @@ class ClientCli < CommonCli
     }
   end
 
+  define_option :jwks_uri, '--jwks_uri <token_keys endpoint>', 'JWKS token key endpoint'
+  define_option :jwks, '--jwks <json token key set>', 'JWKS token key'
+  desc 'client jwt add [id]', 'Add client jwt trust', :jwks_uri, :jwks do |id|
+    pp scim_request { |cr|
+      ###change_clientjwt(client_id, jwks_uri = nil, jwks = nil, kid = nil, changeMode = nil)
+      cr.change_clientjwt(clientid(id), opts[:jwks_uri], opts[:jwks], nil, 'ADD')
+      'client jwt successfully added'
+    }
+  end
+
+  desc 'client jwt update [id]', 'Update client jwt trust', :jwks_uri, :jwks do |id|
+    pp scim_request { |cr|
+      cr.change_clientjwt(clientid(id), opts[:jwks_uri], opts[:jwks], nil, 'UPDATE')
+      'client jwt successfully set'
+    }
+  end
+
+  define_option :kid, '--kid <key id in json token keys>', 'JWKS token key'
+  desc 'client jwt delete [id]', 'Delete client jwt trust', :kid do |id|
+    pp scim_request { |cr|
+      cr.change_clientjwt(clientid(id), '*', nil, opts[:kid], 'DELETE')
+      'client jwt successfully deleted'
+    }
+  end
+
   private
 
   def update_client(cr, info)
@@ -128,8 +164,11 @@ class ClientCli < CommonCli
     add_meta_fields_to_client(cr, client)
   end
 
-  def add_meta_fields_to_client(cr, client)
-    meta = cr.get_client_meta(client['client_id'])
+  def add_meta_fields_to_client(cr, client, id = nil)
+    if id == nil
+      id = client['client_id']
+    end
+    meta = cr.get_client_meta(id)
     client.merge({:created_by => meta['createdby']})
   end
 end

data/lib/uaa/stub/scim.rb

@@ -27,7 +27,7 @@ class StubScim
 
   private
 
-  CREATOR = 'Stalin'
+  CREATOR = 'Freedom'
 
   # attribute types. Anything not listed is case-ignore string
   HIDDEN_ATTRS = [:rtype, :password, :client_secret].to_set
@@ -66,7 +66,7 @@ class StubScim
       client: [*COMMON_ATTRS, :client_id, :name, :client_secret, :authorities,
         :authorized_grant_types, :scope, :autoapprove,
         :access_token_validity, :refresh_token_validity, :redirect_uri, :allowedproviders,
-        :'signup_redirect_url'].to_set,
+        :'signup_redirect_url', :required_user_groups].to_set,
       group: [*COMMON_ATTRS, :displayname, :members, :writers, :readers, :external_groups].to_set }
   VISIBLE_ATTRS = {user: Set.new(LEGAL_ATTRS[:user] - HIDDEN_ATTRS),
       client: Set.new(LEGAL_ATTRS[:client] - HIDDEN_ATTRS),

data/lib/uaa/stub/uaa.rb

@@ -414,6 +414,13 @@ class StubUAAConn < Stub::Base
     reply.json(status: 'ok', message: 'secret updated')
   end
 
+  route :put, %r{^/oauth/clients/([^/]+)/clientjwt$}, 'content-type' => %r{application/json} do
+    info = Util.json_parse(request.body, :down)
+    return not_found(match[1]) unless id = server.scim.id(match[1], :client)
+    return bad_request('no client_id given') unless info['client_id']
+    reply.json(status: 'ok', message: 'client jwt updated')
+  end
+
   #----------------------------------------------------------------------------
   # users and groups endpoints
   #

data/spec/client_reg_spec.rb

@@ -78,16 +78,35 @@ describe ClientCli do
       Cli.output.string.should include 'access_denied'
     end
 
+    it "changes it's client jwt" do
+      Cli.run("token client get #{@test_client} -s #{@test_secret}").should be
+      Cli.run('token decode').should be
+      Cli.run("client jwt add #{@test_client} --jwks_uri http://localhost:8080/uaa/token_keys").should be
+      Cli.run("client jwt update #{@test_client} --jwks_uri http://localhost:8080/uaa/token_keys").should be
+      Cli.run("client jwt delete #{@test_client} ").should be
+    end
+
+    it "fails to get client" do
+      Cli.run("token client get #{@test_client} -s #{@test_secret}").should be
+      Cli.run("context #{@admin_client}").should be
+      Cli.run("client get #{@test_client}").should be
+      Cli.run("client get #{@test_client} -a id").should be
+      Cli.output.string.should include 'id'
+      Cli.run("client get not-existing").should be_nil
+      Cli.output.string.should include 'NotFound'
+    end
+
     context 'as updated client' do
 
       before :all do
         # update the test client as the admin client
         Cli.run("token client get #{@test_client} -s #{@test_secret}").should be
         Cli.run("context #{@admin_client}").should be
-        Cli.run("client update #{@test_client} --authorities scim.write,scim.read").should be
+        Cli.run("client update #{@test_client} --authorities scim.write,scim.read --required_user_groups openid").should be
         Cli.output.string.should include 'created_by'
         Cli.run("client get #{@test_client}").should be
         Cli.output.string.should include 'scim.read', 'scim.write'
+        Cli.output.string.should include 'required_user_groups'
       end
 
       it 'fails to create a user account with old token' do

data/version.txt

@@ -1 +1 @@
-4.16.0
+4.18.0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-uaac
 version: !ruby/object:Gem::Version
-  version: 4.16.0
+  version: 4.18.0
 platform: ruby
 authors:
 - Dave Syer
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-09-15 00:00:00.000000000 Z
+date: 2023-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cf-uaa-lib
@@ -20,14 +20,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.3
+        version: 4.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.3
+        version: 4.0.4
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement