Add azure authz support

build/application/pom.xml

@@ -171,7 +171,11 @@
 			<artifactId>dirigible-components-security-oauth2</artifactId>
 			<version>9.0.0-SNAPSHOT</version>
 		</dependency>
-
+		<dependency>
+			<groupId>org.eclipse.dirigible</groupId>
+			<artifactId>dirigible-components-security-azure</artifactId>
+			<version>9.0.0-SNAPSHOT</version>
+		</dependency>
 		<!-- Data -->
 		<dependency>
 			<groupId>org.eclipse.dirigible</groupId>

build/application/src/main/resources/application.properties

@@ -26,6 +26,13 @@ oauth2.enabled=${DIRIGIBLE_OAUTH2_ENABLED:false}
 spring.security.oauth2.client.registration.github.clientId=${GITHUB_CLIENT_ID}
 spring.security.oauth2.client.registration.github.clientSecret=${GITHUB_CLIENT_SECRET}
 
+azure.authz.enabled=${DIRIGIBLE_AZURE_AUTHZ_ENABLED:false}
+#spring.security.oauth2.client.provider.azure.token-uri =  
+#spring.security.oauth2.client.registration.azure.client-id =  
+#spring.security.oauth2.client.registration.azure.client-secret =
+#spring.security.oauth2.client.registration.azure.authorization-grant-type=client_credentials
+#spring.security.oauth2.client.registration.azure.scope=
+
 terminal.enabled=${DIRIGIBLE_TERMINAL_ENABLED:false}
 
 management.metrics.mongo.command.enabled=false

components/pom.xml

@@ -31,6 +31,7 @@
         <module>security/security-basic</module>
         <module>security/security-keycloak</module>
         <module>security/security-oauth2</module>
+		<module>security/security-azure</module>
 
         <!-- Data -->
         <module>data/data-structures</module>

components/security/security-azure/src/main/java/org/eclipse/dirigible/components/security/azure/AzureOidcUserFactory.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible contributors
+ *
+ * All rights reserved. This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v2.0 which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v20.html
+ *
+ * SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible
+ * contributors SPDX-License-Identifier: EPL-2.0
+ */
+package org.eclipse.dirigible.components.security.azure;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import org.eclipse.dirigible.components.security.azure.config.JwtAuthorizationProperties;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
+import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
+import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
+import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
+import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+import org.springframework.stereotype.Service;
+
+@Service
+public class AzureOidcUserFactory {
+
+    public OAuth2UserService<OidcUserRequest, OidcUser> createUserService(JwtAuthorizationProperties props) {
+        final OidcUserService delegate = new OidcUserService();
+        final GroupsClaimMapper mapper = new GroupsClaimMapper(props.groupsClaim(), props.groupToAuthorities());
+
+        return (userRequest) -> {
+            OidcUser oidcUser = delegate.loadUser(userRequest);
+            // Enrich standard authorities with groups
+            Set<GrantedAuthority> mappedAuthorities = new HashSet<>();
+            mappedAuthorities.addAll(oidcUser.getAuthorities());
+            mappedAuthorities.addAll(mapper.mapAuthorities(oidcUser));
+
+            oidcUser = new DefaultOidcUser(mappedAuthorities, oidcUser.getIdToken(), oidcUser.getUserInfo(), oidcUser.getName());
+
+            return oidcUser;
+        };
+    }
+
+}

components/security/security-azure/src/main/java/org/eclipse/dirigible/components/security/azure/GroupsClaimMapper.java

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible contributors
+ *
+ * All rights reserved. This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v2.0 which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v20.html
+ *
+ * SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible
+ * contributors SPDX-License-Identifier: EPL-2.0
+ */
+package org.eclipse.dirigible.components.security.azure;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.oauth2.core.ClaimAccessor;
+
+public class GroupsClaimMapper {
+
+    private final String groupsClaim;
+    private final Map<String, List<String>> groupToAuthorities;
+
+    public GroupsClaimMapper(String groupsClaim, Map<String, List<String>> groupToAuthorities) {
+        this.groupsClaim = groupsClaim;
+        this.groupToAuthorities = Collections.unmodifiableMap(groupToAuthorities);
+    }
+
+    public Collection<? extends GrantedAuthority> mapAuthorities(ClaimAccessor source) {
+        List<String> groups = source.getClaimAsStringList(groupsClaim);
+        if (groups == null || groups.isEmpty()) {
+            return Collections.emptyList();
+        }
+
+        List<GrantedAuthority> result = new ArrayList<>();
+        for (String g : groups) {
+            List<String> authNames = groupToAuthorities.get(g);
+            if (authNames == null) {
+                continue;
+            }
+
+            List<SimpleGrantedAuthority> mapped = authNames.stream()
+                                                           .map(SimpleGrantedAuthority::new)
+                                                           .collect(Collectors.toList());
+
+            result.addAll(mapped);
+        }
+
+        return result;
+    }
+
+}

components/security/security-azure/src/main/java/org/eclipse/dirigible/components/security/azure/config/JwtAuthorizationConfiguration.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible contributors
+ *
+ * All rights reserved. This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v2.0 which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v20.html
+ *
+ * SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible
+ * contributors SPDX-License-Identifier: EPL-2.0
+ */
+package org.eclipse.dirigible.components.security.azure.config;
+
+import org.eclipse.dirigible.components.security.azure.AzureOidcUserFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+@ConditionalOnProperty(name = "azure.authz.enabled", havingValue = "true")
+@EnableConfigurationProperties(JwtAuthorizationProperties.class)
+public class JwtAuthorizationConfiguration {
+
+    @Autowired
+    AzureOidcUserFactory userServiceFactory;
+
+    @Bean
+    SecurityFilterChain customJwtSecurityChain(HttpSecurity http, JwtAuthorizationProperties props) throws Exception {
+        // @formatter:off
+        return http
+          .authorizeRequests( r -> r.anyRequest().authenticated())
+          .oauth2Login(oauth2 -> {
+              oauth2.userInfoEndpoint(ep ->
+                ep.oidcUserService(userServiceFactory.createUserService(props)));
+          })
+        .build();
+        // @formatter:on
+    }
+
+}

components/security/security-azure/src/main/java/org/eclipse/dirigible/components/security/azure/config/JwtAuthorizationProperties.java

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible contributors
+ *
+ * All rights reserved. This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v2.0 which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v20.html
+ *
+ * SPDX-FileCopyrightText: 2023 SAP SE or an SAP affiliate company and Eclipse Dirigible
+ * contributors SPDX-License-Identifier: EPL-2.0
+ */
+package org.eclipse.dirigible.components.security.azure.config;
+
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.ConstructorBinding;
+
+@ConfigurationProperties(prefix = "azure.authz")
+@ConstructorBinding
+public record JwtAuthorizationProperties(Map<String, List<String>> groupToAuthorities, String groupsClaim) {
+}