OIDC Login Module with JWT token support

artemis-features/src/main/resources/features.xml

@@ -79,6 +79,7 @@
 		<bundle dependency="true">mvn:org.apache.commons/commons-pool2/${commons.pool2.version}</bundle>
 		<!-- Micrometer can't be included until it supports OSGi. It is currently an "optional" Maven dependency. -->
 		<!--bundle dependency="true">mvn:io.micrometer/micrometer-core/${version.micrometer}</bundle-->
+		<bundle dependency="true">mvn:com.nimbusds/nimbus-jose-jwt/${nimbus.jwt.version}</bundle>
 
 		<bundle>mvn:org.apache.activemq/activemq-artemis-native/${activemq-artemis-native-version}</bundle>
 		<bundle>mvn:org.apache.artemis/artemis-lockmanager-api/${pom.version}</bundle>

artemis-pom/pom.xml

@@ -943,6 +943,14 @@
             <type>pom</type>
             <scope>import</scope>
          </dependency>
+
+         <dependency>
+            <groupId>com.nimbusds</groupId>
+            <artifactId>nimbus-jose-jwt</artifactId>
+            <version>${nimbus.jwt.version}</version>
+            <!-- License: Apache 2.0 -->
+         </dependency>
+
       </dependencies>
    </dependencyManagement>
 

artemis-protocols/artemis-amqp-protocol/src/main/java/org/apache/activemq/artemis/protocol/amqp/proton/AMQPConnectionContext.java

@@ -59,6 +59,7 @@
 import org.apache.activemq.artemis.protocol.amqp.sasl.ClientSASLFactory;
 import org.apache.activemq.artemis.protocol.amqp.sasl.PlainSASLResult;
 import org.apache.activemq.artemis.protocol.amqp.sasl.SASLResult;
+import org.apache.activemq.artemis.protocol.amqp.sasl.TokenSASLResult;
 import org.apache.activemq.artemis.spi.core.protocol.RemotingConnection;
 import org.apache.activemq.artemis.spi.core.remoting.ReadyListener;
 import org.apache.activemq.artemis.utils.ByteUtil;
@@ -729,6 +730,9 @@ private boolean validateUser(Connection connection) throws Exception {
          if (saslResult instanceof PlainSASLResult plainSASLResult) {
             password = plainSASLResult.getPassword();
          }
+         if (saslResult instanceof TokenSASLResult tokenSASLResult) {
+            password = tokenSASLResult.getToken();
+         }
       }
 
       if (isIncomingConnection() && saslClientFactory == null && !isBrokerConnection()) {
@@ -988,6 +992,9 @@ public String getPassword() {
             if (saslResult instanceof PlainSASLResult plainSASLResult) {
                password = plainSASLResult.getPassword();
             }
+            if (saslResult instanceof TokenSASLResult tokenSASLResult) {
+               password = tokenSASLResult.getToken();
+            }
          }
 
          return password;

artemis-protocols/artemis-amqp-protocol/src/main/java/org/apache/activemq/artemis/protocol/amqp/sasl/OAuthBearerSASL.java

@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.activemq.artemis.protocol.amqp.sasl;
+
+import org.apache.activemq.artemis.core.security.SecurityStore;
+import org.apache.activemq.artemis.spi.core.protocol.RemotingConnection;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+public class OAuthBearerSASL extends ServerSASLToken {
+
+   // https://datatracker.ietf.org/doc/html/rfc7628#section-3
+   static final String MECHANISM_NAME = "OAUTHBEARER";
+
+   public OAuthBearerSASL(SecurityStore securityStore, String securityDomain, RemotingConnection remotingConnection) {
+      super(securityStore, securityDomain, remotingConnection);
+   }
+
+   @Override
+   public String getName() {
+      return MECHANISM_NAME;
+   }
+
+   @Override
+   public byte[] processSASL(byte[] bytes) {
+      // expecting `n,a=<user>,\x01host=<host>\x01port=<port>\x01auth=Bearer <token>\x01\x01`
+      // according to https://datatracker.ietf.org/doc/html/rfc7628#section-3.1
+      // `n,a=<user>,` is from https://datatracker.ietf.org/doc/html/rfc5801
+      //  - gs2-cb-flag: "n" = client does not support channel binding,
+      //                 "p" = client supports and used channel binding
+      //                 "y" = client supports CB, thinks the server does not
+      //  - gs2-authzid: "a=<saslname>"
+      if (bytes == null || bytes.length == 0) {
+         result = new TokenSASLResult(false, null, null);
+      } else {
+         if (bytes.length < 2 || !(bytes[bytes.length - 2] == '\001' && bytes[bytes.length - 1] == '\001')) {
+            result = new TokenSASLResult(false, null, null);
+         } else {
+            String data = new String(bytes, StandardCharsets.UTF_8);
+            String[] segments = data.split("\001");
+            if (segments.length < 2) {
+               result = new TokenSASLResult(false, null, null);
+            } else {
+               String gs2Header = segments[0];
+               String[] headersSegments = gs2Header.split(",");
+               String user = null;
+               for (String s : headersSegments) {
+                  if (s.startsWith("a=")) {
+                     user = s.substring(2);
+                  }
+               }
+
+               String token = null;
+               for (int i = 1; i < segments.length; i++) {
+                  if (segments[i].startsWith("auth=Bearer ")) {
+                     token = segments[i].substring(12);
+                  }
+               }
+
+               if (token == null) {
+                  result = new TokenSASLResult(false, null, null);
+               } else {
+                  boolean success = authenticate(user, token);
+                  result = new TokenSASLResult(success, user, token);
+               }
+            }
+         }
+      }
+
+      // TODO: validate host and port from the SASL OAUTHBEARER initial response?
+
+      if (result.isSuccess()) {
+         return null;
+      }
+
+      // see https://datatracker.ietf.org/doc/html/rfc7628#section-3.2.2
+      return Base64.getEncoder().encode("{\"status\":\"invalid_token\"}".getBytes());
+   }
+
+}

artemis-protocols/artemis-amqp-protocol/src/main/java/org/apache/activemq/artemis/protocol/amqp/sasl/OAuthBearerServerSASLFactory.java

@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.activemq.artemis.protocol.amqp.sasl;
+
+import org.apache.activemq.artemis.core.server.ActiveMQServer;
+import org.apache.activemq.artemis.protocol.amqp.broker.AmqpInterceptor;
+import org.apache.activemq.artemis.protocol.amqp.proton.AMQPRoutingHandler;
+import org.apache.activemq.artemis.spi.core.protocol.ProtocolManager;
+import org.apache.activemq.artemis.spi.core.protocol.RemotingConnection;
+import org.apache.activemq.artemis.spi.core.remoting.Connection;
+
+public class OAuthBearerServerSASLFactory implements ServerSASLFactory {
+
+   @Override
+   public String getMechanism() {
+      return OAuthBearerSASL.MECHANISM_NAME;
+   }
+
+   @Override
+   public ServerSASL create(ActiveMQServer server, ProtocolManager<AmqpInterceptor, AMQPRoutingHandler> manager, Connection connection, RemotingConnection remotingConnection) {
+      return new OAuthBearerSASL(server.getSecurityStore(), manager.getSecurityDomain(), connection.getProtocolConnection());
+   }
+
+   @Override
+   public int getPrecedence() {
+      return 32;
+   }
+
+   @Override
+   public boolean isDefaultPermitted() {
+      return false;
+   }
+
+}

artemis-protocols/artemis-amqp-protocol/src/main/java/org/apache/activemq/artemis/protocol/amqp/sasl/ServerSASLToken.java

@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.activemq.artemis.protocol.amqp.sasl;
+
+import org.apache.activemq.artemis.core.security.SecurityStore;
+import org.apache.activemq.artemis.spi.core.protocol.RemotingConnection;
+
+public abstract class ServerSASLToken implements ServerSASL {
+
+   protected final SecurityStore securityStore;
+   protected final String securityDomain;
+   protected RemotingConnection remotingConnection;
+
+   protected SASLResult result = null;
+
+   public ServerSASLToken(SecurityStore securityStore, String securityDomain, RemotingConnection remotingConnection) {
+      this.securityStore = securityStore;
+      this.securityDomain = securityDomain;
+      this.remotingConnection = remotingConnection;
+   }
+
+   @Override
+   public SASLResult result() {
+      return result;
+   }
+
+   @Override
+   public void done() {
+   }
+
+   protected boolean authenticate(String user, String token) {
+      if (securityStore != null && securityStore.isSecurityEnabled()) {
+         try {
+            securityStore.authenticate(user, token, remotingConnection, securityDomain);
+            return true;
+         } catch (Exception e) {
+            return false;
+         }
+      }
+      return true;
+   }
+
+}

artemis-protocols/artemis-amqp-protocol/src/main/java/org/apache/activemq/artemis/protocol/amqp/sasl/TokenSASLResult.java

@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.activemq.artemis.protocol.amqp.sasl;
+
+import javax.security.auth.Subject;
+
+/**
+ * A {@link SASLResult} containing a String representation of a token (like JWT) and optional username (usually
+ * not relevant).
+ */
+public class TokenSASLResult implements SASLResult {
+
+   private final boolean success;
+   private final String user;
+   private final String token;
+
+   public TokenSASLResult(boolean success, String user, String token) {
+      this.success = success;
+      this.user = user;
+      this.token = token;
+   }
+
+   @Override
+   public boolean isSuccess() {
+      return success;
+   }
+
+   @Override
+   public String getUser() {
+      return user;
+   }
+
+   public String getToken() {
+      return token;
+   }
+
+   @Override
+   public Subject getSubject() {
+      return null;
+   }
+
+}