Skip to content

Commit a2024ce

Browse files
jbonofrejbonofre
committed
feat(#1737): Move OAuth2 LoginModule to dedicated activemq-oauth2 module
Extract OAuth2 JWT authentication into its own activemq-oauth2 module (similar to activemq-shiro) with package org.apache.activemq.oauth2. Remove nimbus-jose-jwt dependency from activemq-jaas and assembly, add activemq-oauth2 to parent modules/dependencyManagement and assembly. Include commented-out OAuth2 configuration example in the distribution login.config.
1 parent 51992c2 commit a2024ce

File tree

9 files changed

+141
-22
lines changed

9 files changed

+141
-22
lines changed

‎activemq-jaas/pom.xml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,6 @@
106106
<artifactId>jasypt</artifactId>
107107
<optional>true</optional>
108108
</dependency>
109-
<dependency>
110-
<groupId>com.nimbusds</groupId>
111-
<artifactId>nimbus-jose-jwt</artifactId>
112-
<optional>true</optional>
113-
</dependency>
114109
</dependencies>
115110

116111
<profiles>

‎activemq-jaas/src/test/resources/login.config‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -179,16 +179,6 @@ GuestLoginWithDefaults {
179179
debug=true;
180180
};
181181

182-
OAuth2Login {
183-
org.apache.activemq.jaas.OAuth2LoginModule required
184-
debug=true
185-
oauth2.jwksUrl="https://idp.example.com/.well-known/jwks.json"
186-
oauth2.issuer="https://idp.example.com"
187-
oauth2.audience="activemq"
188-
oauth2.usernameClaim="sub"
189-
oauth2.groupsClaim="groups";
190-
};
191-
192182
OpenLdapConfiguration {
193183
org.apache.activemq.jaas.LDAPLoginModule required
194184
debug=true

‎activemq-oauth2/pom.xml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
19+
20+
<modelVersion>4.0.0</modelVersion>
21+
22+
<parent>
23+
<groupId>org.apache.activemq</groupId>
24+
<artifactId>activemq-parent</artifactId>
25+
<version>6.3.0-SNAPSHOT</version>
26+
</parent>
27+
28+
<artifactId>activemq-oauth2</artifactId>
29+
<packaging>bundle</packaging>
30+
<name>ActiveMQ :: OAuth2</name>
31+
<description>ActiveMQ OAuth2 JWT authentication via JAAS LoginModule</description>
32+
33+
<dependencies>
34+
35+
<!-- =============================== -->
36+
<!-- Required Dependencies -->
37+
<!-- =============================== -->
38+
<dependency>
39+
<groupId>${project.groupId}</groupId>
40+
<artifactId>activemq-jaas</artifactId>
41+
</dependency>
42+
43+
<dependency>
44+
<groupId>com.nimbusds</groupId>
45+
<artifactId>nimbus-jose-jwt</artifactId>
46+
</dependency>
47+
48+
<dependency>
49+
<groupId>org.slf4j</groupId>
50+
<artifactId>slf4j-api</artifactId>
51+
</dependency>
52+
53+
<!-- =============================== -->
54+
<!-- Testing Dependencies -->
55+
<!-- =============================== -->
56+
<dependency>
57+
<groupId>junit</groupId>
58+
<artifactId>junit</artifactId>
59+
<scope>test</scope>
60+
</dependency>
61+
<dependency>
62+
<groupId>org.apache.logging.log4j</groupId>
63+
<artifactId>log4j-slf4j2-impl</artifactId>
64+
<scope>test</scope>
65+
</dependency>
66+
<dependency>
67+
<groupId>org.apache.logging.log4j</groupId>
68+
<artifactId>log4j-core</artifactId>
69+
<scope>test</scope>
70+
</dependency>
71+
</dependencies>
72+
73+
<build>
74+
<plugins>
75+
<plugin>
76+
<groupId>org.apache.felix</groupId>
77+
<artifactId>maven-bundle-plugin</artifactId>
78+
<extensions>true</extensions>
79+
<configuration>
80+
<instructions>
81+
<Bundle-SymbolicName>org.apache.activemq.oauth2</Bundle-SymbolicName>
82+
<Export-Package>org.apache.activemq.oauth2*;version=${project.version};-noimport:=true;-split-package:=merge-first</Export-Package>
83+
<Import-Package>
84+
org.apache.activemq*;version=${project.version};resolution:=optional,
85+
com.nimbusds*,
86+
*
87+
</Import-Package>
88+
<_noee>true</_noee>
89+
</instructions>
90+
</configuration>
91+
</plugin>
92+
</plugins>
93+
</build>
94+
95+
</project>

activemq-jaas/src/main/java/org/apache/activemq/jaas/OAuth2LoginModule.java renamed to activemq-oauth2/src/main/java/org/apache/activemq/oauth2/OAuth2LoginModule.java

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package org.apache.activemq.jaas;
17+
package org.apache.activemq.oauth2;
1818

1919
import java.io.IOException;
2020
import java.net.MalformedURLException;
@@ -49,6 +49,9 @@
4949
import com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier;
5050
import com.nimbusds.jwt.proc.DefaultJWTProcessor;
5151

52+
import org.apache.activemq.jaas.GroupPrincipal;
53+
import org.apache.activemq.jaas.UserPrincipal;
54+
5255
import org.slf4j.Logger;
5356
import org.slf4j.LoggerFactory;
5457

@@ -72,7 +75,7 @@
7275
* Example login.config:
7376
* <pre>
7477
* activemq-oauth2 {
75-
* org.apache.activemq.jaas.OAuth2LoginModule required
78+
* org.apache.activemq.oauth2.OAuth2LoginModule required
7679
* oauth2.jwksUrl="https://idp.example.com/.well-known/jwks.json"
7780
* oauth2.issuer="https://idp.example.com"
7881
* oauth2.audience="activemq"

activemq-jaas/src/main/java/org/apache/activemq/jaas/OAuth2TokenCallback.java renamed to activemq-oauth2/src/main/java/org/apache/activemq/oauth2/OAuth2TokenCallback.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package org.apache.activemq.jaas;
17+
package org.apache.activemq.oauth2;
1818

1919
import javax.security.auth.callback.Callback;
2020

activemq-jaas/src/test/java/org/apache/activemq/jaas/OAuth2LoginModuleTest.java renamed to activemq-oauth2/src/test/java/org/apache/activemq/oauth2/OAuth2LoginModuleTest.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package org.apache.activemq.jaas;
17+
package org.apache.activemq.oauth2;
1818

1919
import java.io.IOException;
2020
import java.security.KeyPair;
@@ -54,6 +54,9 @@
5454
import com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier;
5555
import com.nimbusds.jwt.proc.DefaultJWTProcessor;
5656

57+
import org.apache.activemq.jaas.GroupPrincipal;
58+
import org.apache.activemq.jaas.UserPrincipal;
59+
5760
import junit.framework.TestCase;
5861

5962
public class OAuth2LoginModuleTest extends TestCase {

‎assembly/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -528,8 +528,8 @@
528528
<artifactId>jackson-databind</artifactId>
529529
</dependency>
530530
<dependency>
531-
<groupId>com.nimbusds</groupId>
532-
<artifactId>nimbus-jose-jwt</artifactId>
531+
<groupId>${project.groupId}</groupId>
532+
<artifactId>activemq-oauth2</artifactId>
533533
</dependency>
534534

535535
<!-- JAXB/Activation/iStack -->

‎assembly/src/release/conf/login.config‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,31 @@ activemq {
1818
org.apache.activemq.jaas.PropertiesLoginModule required
1919
org.apache.activemq.jaas.properties.user="users.properties"
2020
org.apache.activemq.jaas.properties.group="groups.properties";
21-
};
21+
};
22+
23+
/**
24+
* OAuth2 JWT authentication example.
25+
* Uncomment and configure the following to authenticate clients using
26+
* OAuth2/OIDC JWT access tokens. The token is passed as the password
27+
* in the connection credentials.
28+
*
29+
* Required options:
30+
* oauth2.jwksUrl - URL to the JWKS endpoint for token signature verification
31+
* oauth2.issuer - Expected token issuer (iss claim)
32+
*
33+
* Optional options:
34+
* oauth2.audience - Expected token audience (aud claim)
35+
* oauth2.usernameClaim - JWT claim to extract the username from (default: "sub")
36+
* oauth2.groupsClaim - JWT claim containing group memberships (default: "groups")
37+
*
38+
* To use this configuration, change the broker's jaasAuthenticationPlugin
39+
* to reference "activemq-oauth2" instead of "activemq".
40+
*/
41+
//activemq-oauth2 {
42+
// org.apache.activemq.oauth2.OAuth2LoginModule required
43+
// oauth2.jwksUrl="https://idp.example.com/.well-known/jwks.json"
44+
// oauth2.issuer="https://idp.example.com"
45+
// oauth2.audience="activemq"
46+
// oauth2.usernameClaim="preferred_username"
47+
// oauth2.groupsClaim="roles";
48+
//};

‎pom.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@
209209
<module>activemq-rar</module>
210210
<module>activemq-run</module>
211211
<module>activemq-shiro</module>
212+
<module>activemq-oauth2</module>
212213
<module>activemq-spring</module>
213214
<module>activemq-runtime-config</module>
214215
<module>activemq-tooling</module>
@@ -341,6 +342,11 @@
341342
<artifactId>activemq-shiro</artifactId>
342343
<version>${project.version}</version>
343344
</dependency>
345+
<dependency>
346+
<groupId>org.apache.activemq</groupId>
347+
<artifactId>activemq-oauth2</artifactId>
348+
<version>${project.version}</version>
349+
</dependency>
344350
<dependency>
345351
<groupId>org.apache.activemq</groupId>
346352
<artifactId>activemq-spring</artifactId>

0 commit comments

Comments
 (0)