@nsshunt/stsconfig 1.14.0 → 1.15.0

package/.github/dependabot.yml

@@ -8,4 +8,4 @@ updates:
   - package-ecosystem: "npm" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
-      interval: "weekly"
+      interval: "monthly"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nsshunt/stsconfig",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "",
   "main": "stsconfig.js",
   "dependencies": {

package/stsconfig.js

@@ -72,6 +72,12 @@ const defconfig =
 	,rest01port: (process.env.REST01_PORT === undefined ? "3003" : process.env.REST01_PORT)
 	// STSREST01 Server endpoint
 	,rest01apiroot: (process.env.REST01_APIROOT === undefined ? "/stsrest01/v1" : process.env.REST01_APIROOT)
+	// STSREST01 API Identifier. This value will be used as the audience parameter on authorization calls (OAuth2 client credentials flow).
+	,rest01apiidentifier: process.env.REST01_API_IDENTIFIER
+	// STSREST01 API Identifier file. This value will be used as the audience parameter on authorization calls (OAuth2 client credentials flow).
+	,rest01apiidentifierfile: process.env.REST01_API_IDENTIFIER_FILE
+	// STSREST01 API Permissions file. These are all the permissions (scopes) that this API uses. Format is JSON.
+	,rest01apipermissionsfile: process.env.REST01_API_PERMISSIONS_FILE
 	// STSREST01 Prometheus metric support
 	,rest01prometheussupport: (process.env.REST01_PROM_SUPPORT === undefined ? true : (process.env.REST01_PROM_SUPPORT === "true" ? true : false))
 	// STSREST01 Cluster Server port (port used for cluster prometheus scrapes). Service will listen on this port at mount point /metrics
@@ -88,6 +94,14 @@ const defconfig =
 	,rest01password: (process.env.REST01_PASSWORD === undefined ? "STSREST01ServiceUserPassword" : process.env.REST01_PASSWORD)
 	// STSREST01 Server username password file
 	,rest01passwordfile: process.env.REST01_PASSWORD_FILE
+	// STSREST01 Server client ID. Used for oauth2 client credentials flow.
+	// Ref: https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow
+	// Ref: https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-the-client-credentials-flow
+	,rest01clientid: process.env.REST01_CLIENT_ID
+	// STSREST01 Server client ID file. Used for oauth2 client credentials flow.
+	,rest01clientidfile: process.env.REST01_CLIENT_ID_FILE
+	// STSREST01 Server client secret file. Used for oauth2 client credentials flow.
+	,rest01clientsecretfile: process.env.REST01_CLIENT_SECRET_PASSWORD_FILE
 	
 	// STS Instrument Manager Service endpoint
 	,imendpoint: (process.env.IM_ENDPOINT === undefined ? "http://localhost" : process.env.IM_ENDPOINT)
@@ -139,6 +153,10 @@ const defconfig =
 	// STS Test Orchestrator Service username password file
 	,topasswordfile: process.env.TO_PASSWORD_FILE
 	
+	// STS Auth Server
+	// ---------------
+	// The auth server assumes the roles as an Identify Provider ([TODO]) and Token Server (OAuth2.0).
+	//
 	// Auth Server endpoint
 	,asendpoint: (process.env.AS_ENDPOINT === undefined ? "http://localhost" : process.env.AS_ENDPOINT)
 	// Auth Server host port (listen port for the service)
@@ -163,11 +181,37 @@ const defconfig =
 	,aspassword: (process.env.AS_PASSWORD === undefined ? "STSAuthServiceUserPassword" : process.env.AS_PASSWORD)
 	// Auth Server username password file
 	,aspasswordfile: process.env.AS_PASSWORD_FILE
-	// Auth Server - Private Key (when using JWT)
+
+	// Auth Server client ID. Used for oauth2 client credentials flow.
+	// Ref: https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow
+	// Ref: https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-the-client-credentials-flow
+	,asclientid: process.env.AS_CLIENT_ID
+	// Auth Server client ID file. Used for oauth2 client credentials flow.
+	,asclientidfile: process.env.AS_CLIENT_ID_FILE
+	// Auth Server client secret file. Used for oauth2 client credentials flow.
+	,asclientsecretfile: process.env.AS_CLIENT_SECRET_PASSWORD_FILE
+
+	// Auth Server - JWKS Public End Point.
+	,asjwksjsonpath: (process.env.AS_JWKS_JSON_PATH === undefined ? "/.well-known/jwks.json" : process.env.AS_JWKS_JSON_PATH)
+	// Auth Server - JWKS File Store. Auth server side private JWKS storage file.
+	,asjwksfilestore: (process.env.AS_JWKS_FILE_STORE === undefined ? "/run/secrets/jwks_store" : process.env.AS_JWKS_FILE_STORE)
+	// Auth Server - JWKS key rotation time (seconds).
+	,asjwkskeyrotationtime: (process.env.AS_JWKS_KEY_ROTATION_TIME === undefined ? 86400 : process.env.AS_JWKS_KEY_ROTATION_TIME) // 24 Hour default
+	// Auth Server - JWKS key purge time offset (seconds). Old keys (current keys are considered 'old' immediately after a key rotation) will be kept
+	// for asaccesstokenexpire + asjwkskeypurgetimeoffset seconds before purging from the JWKS.
+	,asjwkskeypurgetimeoffset: (process.env.AS_JWKS_KEY_PURGE_TIME_OFFSET === undefined ? 300 : process.env.AS_JWKS_KEY_PURGE_TIME_OFFSET) // 5 Minutes
+	// Auth Server - JWKS key count. Defines the number of active keys within the JWKS. Note that the actual key count may be double this value as current
+	// keys are rotated to old keys prior to old key purge. Old keys will be kept for asaccesstokenexpire + asjwkskeypurgetimeoffset seconds before removal from the JWKS.
+	// This is to ensure that any tokens signed by a current key that is then expired can still be validated within the life of the issued token.
+	,asjwkskeycount: (process.env.AS_JWKS_KEY_COUNT === undefined ? 4 : process.env.AS_JWKS_KEY_COUNT)
+	// Auth Server - JWKS Access token timeout.
+	,asaccesstokenexpire: (process.env.AS_ACCESS_TOKEN_EXPIRE === undefined ? 43200 : process.env.AS_ACCESS_TOKEN_EXPIRE) // 12 Hour default
+
+	// Auth Server - [DEPRECATED] Private Key (when using JWT)
 	,asprivatekeypath: (process.env.AS_PRIVATE_KEY_PATH === undefined ? "/var/lib/sts/stsglobalresources/keys/private.key" : process.env.AS_PRIVATE_KEY_PATH)
-	// Auth Server - Public Key (when using JWT)
+	// Auth Server - [DEPRECATED] Public Key (when using JWT)
 	,aspublickeypath: (process.env.AS_PUBLIC_KEY_PATH === undefined ? "/var/lib/sts/stsglobalresources/keys/public.key" : process.env.AS_PUBLIC_KEY_PATH)
-
+	
 	// STS Test Runner Prometheus metric support
 	,trprometheussupport: (process.env.TR_PROM_SUPPORT === undefined ? true : (process.env.TR_PROM_SUPPORT === "true" ? true : false ))
 	// STS Test Runner Cluster Server port (port used for cluster prometheus scrapes)
@@ -302,6 +346,8 @@ const ReadPasswordFile = (passwordFile) => {
 	}
 }
 
+// File based configuration settings. If a file is specified for a setting, this will be used. The non file version (if specified) will be ignored.
+
 // Database password file
 if (defconfig.dbpasswordfile !== undefined) {
 	defconfig.dbpassword = ReadPasswordFile(defconfig.dbpasswordfile);