[Jupiter] Security plan execution

mouligno commented 2 years ago

:rainbow: Feature

As an API Publisher, I want to make sure that applications are using the correct plans it subscribed to

:sunrise_over_mountains: Additional information

The idea is to execute the plan based on the subscription instead of just checking the security technical requirements.

A first implementation of the security chain has been made and one issue has been discovered - https://gravitee.slab.com/posts/token-based-plan-issue-hwz47lst

Improvements required :

making the gateway identify application & associated subscription before invoking SecurityPolicy
find a more generic way to retrieve id from the SecurityPolicy for the gateway to identify corresponding subscription without limiting it to clientId which is tightly coupled to JWT / OAuth2 policies

:link: Dependencies

https://github.com/gravitee-io/issues/issues/7995 https://github.com/gravitee-io/issues/issues/7824

:camera: Mockups

Insert screenshots, drawings...

:books: Documentation required

Provide link to the issue for documentation update

:superhero: Acceptance criteria

[ ] Given 2 JWT plans (jwt1 & jwt2) using the same Jwks resolver then I got through correct jwt1 flow When i call the API using an application subscribed to jwt1 plan.
[ ] Given '...' Then '...' When '...'

:warning: Potential impacts

Which other features may be impacted by this fix. This could be populated after fix

What are the impacted versions?

:rocket:

Sicofonia commented 2 years ago

@marcambier would be kind to link the original pull request for the original issue: https://github.com/gravitee-io/issues/issues/7824

https://github.com/gravitee-io/gravitee-api-management/pull/2186

marcambier commented 2 years ago

Note for QA team ; This is a refactoring of the security chain, so everything related to plans execution on the gateway side has to be tested. For example :

all plans type (API keys / JWT / Oauth2 / keyless)
combinations of mutliple plans within the same API
selection rules system
subscriptions system (including status, start dates, end dates...)

LiliaEn commented 2 years ago

Tested on the default env v3.19.0 The following scenarios (plan combinations) were covered:

Keyless
API Key
JWT
oAUth2
JWT+ JWT
JWT+ oAUth2
JWT +oAUth2 + APi Key
oAUth2 + oAUth2
oAuth2 + oAuth 2 + Keyless

gravitee-io / issues