feat: OpenTelemetry log signals for invalid authentication

apiml-common/src/testFixtures/java/org/zowe/apiml/util/config/SslContext.java

@@ -56,6 +56,10 @@ public synchronized static void reset() {
         isInitialized.set(false);
     }
 
+    public static boolean isInitialized() {
+        return isInitialized.get();
+    }
+
     public synchronized static void prepareSslAuthentication(SslContextConfigurer providedConfigurer) throws Exception {
 
         if (configurer.get() != null && !configurer.get().equals(providedConfigurer)) {
@@ -174,7 +178,7 @@ public synchronized static void prepareSslAuthentication(SslContextConfigurer pr
 
             isInitialized.set(true);
         }
-    }
-}
 
+    }
 
+}

apiml-security-common/src/testFixtures/java/org/zowe/apiml/security/common/util/JWTTestUtils.java

@@ -34,6 +34,10 @@ public static String createZoweJwtToken(String username, String domain, String l
         return createToken(username, domain, ltpaToken, config, "APIML");
     }
 
+    public static String createExpiredZoweJwtToken(String username, String domain, String ltpaToken, HttpsConfig config) {
+        return createExpiredToken(username, domain, ltpaToken, config, "APIML");
+    }
+
     public static String createZosmfJwtToken(String username, String domain, String ltpaToken, HttpsConfig config) {
         return createToken(username, domain, ltpaToken, config, "zOSMF");
     }
@@ -55,6 +59,23 @@ public static String createToken(String username, String domain, String ltpaToke
             .compact();
     }
 
+    public static String createExpiredToken(String username, String domain, String ltpaToken, HttpsConfig config, String issuer) {
+        long now = System.currentTimeMillis();
+        long expiration = now - 200_000L;
+        Key jwtSecret = SecurityUtils.loadKey(config);
+
+        return Jwts.builder()
+            .subject(username)
+            .claim("dom", domain)
+            .claim("ltpa", ltpaToken)
+            .issuedAt(new Date(now))
+            .expiration(new Date(expiration))
+            .issuer(issuer)
+            .id(UUID.randomUUID().toString())
+            .signWith(jwtSecret)
+            .compact();
+    }
+
     public static String createDummyJwtToken(String username, String issuer, long expiration) {
         long now = System.currentTimeMillis();
         return Jwts.builder()

apiml/src/main/java/org/zowe/apiml/filter/BasicLoginFilter.java

@@ -25,6 +25,7 @@
 import org.springframework.web.server.WebFilter;
 import org.springframework.web.server.WebFilterChain;
 import org.zowe.apiml.handler.FailedAuthenticationWebHandler;
+import org.zowe.apiml.product.opentelemetry.OtelRequestContext;
 import org.zowe.apiml.security.common.login.LoginFilter;
 import org.zowe.apiml.security.common.login.LoginRequest;
 import org.zowe.apiml.zaas.security.config.CompoundAuthProvider;
@@ -50,7 +51,7 @@
  * </ol>
  *
  * <p>This filter is intended to be used on /login endpoints.</p>
- *
+ * <p>
  * Caution: Filter will read the body and make it available as a request attribute
  *
  * @see LoginRequest
@@ -72,6 +73,8 @@ public BasicLoginFilter(CompoundAuthProvider compoundAuthProvider, FailedAuthent
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
         var hasBody = Optional.ofNullable(exchange.getAttribute(CachedBodyFilter.CACHED_BODY_ATTR)).isPresent();
+        var otelContext = OtelRequestContext.of(exchange);
+        otelContext.authMethod(OtelRequestContext.BASIC_AUTH_TYPE);
         exchange.getAttributes().put(X509AuthFilter.SKIP_X509_AUTH_ATTR, hasBody);
         return extractBasicAuth(exchange)
             .map(this::useCredentials)

apiml/src/main/java/org/zowe/apiml/handler/FailedAuthenticationWebHandler.java

@@ -26,6 +26,7 @@
 import org.zowe.apiml.message.api.ApiMessageView;
 import org.zowe.apiml.message.log.ApimlLogger;
 import org.zowe.apiml.product.logging.annotations.InjectApimlLogger;
+import org.zowe.apiml.product.opentelemetry.OtelRequestContext;
 import org.zowe.apiml.security.common.error.AuthExceptionHandler;
 import reactor.core.publisher.Mono;
 
@@ -48,7 +49,11 @@ public class FailedAuthenticationWebHandler implements ServerAuthenticationFailu
     public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange, AuthenticationException exception) {
         var exchange = webFilterExchange.getExchange();
         var requestUri = exchange.getRequest().getURI().getPath();
+        var otelContext = OtelRequestContext.of(exchange);
         log.debug("Unauthorized access to '{}' endpoint", requestUri);
+        otelContext.authenticationFailed();
+        otelContext.authErrorMessage(exception.getMessage());
+        otelContext.authErrorType(exception.getClass().getName());
         var bufferFactory = new DefaultDataBufferFactory();
         AtomicReference<DefaultDataBuffer> buffer = new AtomicReference<>();
         BiConsumer<ApiMessageView, HttpStatus> consumer = (message, status) -> {
@@ -64,7 +69,7 @@ public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange, A
                 buffer.set(bufferFactory.wrap(new byte[0]));
             }
         };
-        var addHeader = (BiConsumer<String, String>)(name, value) -> exchange.getResponse().getHeaders().add(name, value);
+        var addHeader = (BiConsumer<String, String>) (name, value) -> exchange.getResponse().getHeaders().add(name, value);
         try {
             handler.handleException(requestUri, consumer, addHeader, exception);
         } catch (ServletException e) {

apiml/src/test/java/org/zowe/apiml/ZaasSchemeTransformApiTest.java

@@ -14,6 +14,7 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ServerWebExchange;
 import org.zowe.apiml.gateway.filters.RequestCredentials;
 import org.zowe.apiml.message.core.MessageService;
 import org.zowe.apiml.message.yaml.YamlMessageServiceInstance;
@@ -97,7 +98,7 @@ void thenReturnsExpectedTicket() throws PassTicketException {
 
                 when(passTicketService.generate("USER1", "app1")).thenReturn("ticket123");
 
-                StepVerifier.create(transformApi.passticket(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.passticket(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertNotNull(result);
                     TicketResponse response = result.getBody();
                     assertNotNull(response);
@@ -112,7 +113,7 @@ void whenTicketGenerationFails_writeErrorHeader() throws PassTicketException {
 
                 when(passTicketService.generate("USER1", "app1")).thenThrow(new RuntimeException("boom"));
 
-                StepVerifier.create(transformApi.passticket(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.passticket(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals(INVALID_AUTH_MSG, result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                 }).verifyComplete();
             }
@@ -126,7 +127,7 @@ void whenAuthSourceMissing_returnsMissingAuthError() {
                 RequestCredentials credentials = mockCredentials();
                 when(authSourceService.getAuthSourceFromRequest(any())).thenReturn(Optional.empty());
 
-                StepVerifier.create(transformApi.passticket(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.passticket(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertNotNull(result);
                     assertNull(result.getBody());
                     assertTrue(result.getHeaders().header("x-zowe-error").isEmpty());
@@ -141,7 +142,7 @@ void whenAuthSourceInvalid_writeErrorHeader() throws PassTicketException {
                 when(authSourceService.getAuthSourceFromRequest(any())).thenReturn(Optional.of(authSource));
                 when(authSourceService.isValid(authSource)).thenReturn(false);
 
-                StepVerifier.create(transformApi.passticket(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.passticket(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals(MISSING_AUTH_MSG, result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                     assertNull(result.getBody());
                 }).verifyComplete();
@@ -150,7 +151,7 @@ void whenAuthSourceInvalid_writeErrorHeader() throws PassTicketException {
             @Test
             void whenApplicationNameIsMissing_inPassticket_thenReturnsError() {
                 when(credentials.getApplId()).thenReturn(null);
-                StepVerifier.create(transformApi.passticket(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.passticket(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals("ApplicationName not provided.", result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                     assertNull(result.getBody());
                 }).verifyComplete();
@@ -168,7 +169,7 @@ class GivenSafIdtScheme {
         void whenMissingAppId_returnsError() {
             when(credentials.getApplId()).thenReturn(null);
 
-            StepVerifier.create(transformApi.safIdt(credentials)).assertNext(result -> {
+            StepVerifier.create(transformApi.safIdt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                 assertEquals("ApplicationName not provided.", result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                 assertNull(result.getBody());
             }).verifyComplete();
@@ -191,7 +192,7 @@ void whenValidUser_returnsToken() throws PassTicketException {
                 when(tokenCreationService.createSafIdTokenWithoutCredentials("USER1", "app1"))
                     .thenReturn("saf-idt");
 
-                StepVerifier.create(transformApi.safIdt(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.safIdt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertNotNull(result);
                     assertEquals("saf-idt", result.getBody().getToken());
                 }).verifyComplete();
@@ -209,7 +210,7 @@ void whenOidc_returnsDistributedId() throws PassTicketException {
                 when(tokenCreationService.createSafIdTokenWithoutCredentials("USER1", "app1"))
                     .thenReturn("saf-idt");
 
-                StepVerifier.create(transformApi.safIdt(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.safIdt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertNotNull(result);
                     assertEquals("saf-idt", result.getBody().getToken());
                     assertNotNull(result.getBody().getDistributedIds());
@@ -224,7 +225,7 @@ void whenSafIdTokenCreationFails_returnsError() {
                 when(tokenCreationService.createSafIdTokenWithoutCredentials("USER1", "app1"))
                     .thenThrow(new RuntimeException("Simulated SAF IDT failure"));
 
-                StepVerifier.create(transformApi.safIdt(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.safIdt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals("Simulated SAF IDT failure", result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                     assertNull(result.getBody());
                 }).verifyComplete();
@@ -241,7 +242,7 @@ void whenAuthSourceInvalid_returnsError() {
                 when(authSourceService.getAuthSourceFromRequest(any())).thenReturn(Optional.of(authSource));
                 when(authSourceService.isValid(authSource)).thenReturn(false);
 
-                StepVerifier.create(transformApi.safIdt(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.safIdt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals(MISSING_AUTH_MSG, result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                     assertNull(result.getBody());
                 }).verifyComplete();
@@ -251,7 +252,7 @@ void whenAuthSourceInvalid_returnsError() {
             void whenApplicationNameIsMissing_inSafIdt_thenReturnsError() {
                 RequestCredentials credentials = mockCredentialsWithAppId(" "); // blank
 
-                StepVerifier.create(transformApi.safIdt(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.safIdt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals("ApplicationName not provided.", result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                     assertNull(result.getBody());
                 }).verifyComplete();
@@ -283,7 +284,7 @@ void thenReturnsJwt() {
 
                 when(authSourceService.getJWT(authSource)).thenReturn("jwt-token");
 
-                StepVerifier.create(transformApi.zoweJwt(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.zoweJwt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertNotNull(result);
                     ZaasTokenResponse response = result.getBody();
                     assertNotNull(response);
@@ -295,7 +296,7 @@ void thenReturnsJwt() {
             void whenJwtRetrievalFails_returnsErrorResponse() {
                 when(authSourceService.getJWT(authSource)).thenThrow(new RuntimeException("boom"));
 
-                StepVerifier.create(transformApi.zoweJwt(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.zoweJwt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals(INVALID_AUTH_MSG, result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                     assertNull(result.getBody());
                 }).verifyComplete();
@@ -307,7 +308,7 @@ void whenMissingAuthSource_returnsError() {
 
             when(authSourceService.getAuthSourceFromRequest(any())).thenReturn(Optional.empty());
 
-            StepVerifier.create(transformApi.zoweJwt(credentials)).assertNext(result -> {
+            StepVerifier.create(transformApi.zoweJwt(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                 assertEquals(MISSING_AUTH_MSG, result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                 assertNull(result.getBody());
             }).verifyComplete();
@@ -353,7 +354,7 @@ void whenValidAuthSource_returnsTokenResponse() throws ServiceNotFoundException
                 when(zosmfService.exchangeAuthenticationForZosmfToken(anyString(), eq(parsed)))
                     .thenReturn(mockResponse);
 
-                StepVerifier.create(transformApi.zosmf(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.zosmf(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
 
                     assertNotNull(result);
                     assertEquals("zosmf-token", result.getBody().getToken());
@@ -365,7 +366,7 @@ void testZosmf_serviceThrowsException_returnsError() throws ServiceNotFoundExcep
 
                 when(zosmfService.exchangeAuthenticationForZosmfToken(any(), any()))
                     .thenThrow(new RuntimeException("Error returned from zosmf"));
-                StepVerifier.create(transformApi.zosmf(credentials)).assertNext(result -> {
+                StepVerifier.create(transformApi.zosmf(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                     assertEquals("Error returned from zosmf", result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                     assertNull(result.getBody());
                 }).verifyComplete();
@@ -376,7 +377,7 @@ void testZosmf_serviceThrowsException_returnsError() throws ServiceNotFoundExcep
         void whenAuthSourceMissing_returnsMissingAuthError() {
 
             when(authSourceService.getAuthSourceFromRequest(any())).thenReturn(Optional.empty());
-            StepVerifier.create(transformApi.zosmf(credentials)).assertNext(result -> {
+            StepVerifier.create(transformApi.zosmf(credentials, mock(ServerWebExchange.class))).assertNext(result -> {
                 assertEquals(MISSING_AUTH_MSG, result.getHeaders().header(AUTH_FAIL_HEADER).get(0));
                 assertNull(result.getBody());
             }).verifyComplete();
@@ -415,7 +416,7 @@ void setup() {
         void giveOidcToken_whenPassticket_thenReturnUserIds() {
             var requestCredentials = RequestCredentials.builder().applId("APPLID").build();
 
-            StepVerifier.create(transformApi.passticket(requestCredentials))
+            StepVerifier.create(transformApi.passticket(requestCredentials, mock(ServerWebExchange.class)))
                 .assertNext(response -> {
                     assertSame(DISTRIBUTED_IDS, response.getBody().getDistributedIds());
                     assertSame(USER_ID, response.getBody().getUserId());
@@ -426,7 +427,7 @@ void giveOidcToken_whenPassticket_thenReturnUserIds() {
         void giveOidcToken_whenSafIdt_thenReturnUserIds() {
             var requestCredentials = RequestCredentials.builder().applId("APPLID").build();
 
-            StepVerifier.create(transformApi.safIdt(requestCredentials))
+            StepVerifier.create(transformApi.safIdt(requestCredentials, mock(ServerWebExchange.class)))
                 .assertNext(response -> {
                     assertSame(DISTRIBUTED_IDS, response.getBody().getDistributedIds());
                     assertSame(USER_ID, response.getBody().getUserId());
@@ -438,7 +439,7 @@ void giveOidcToken_whenZosmf_thenReturnUserIds() throws ServiceNotFoundException
             var requestCredentials = RequestCredentials.builder().build();
             doReturn(ZaasTokenResponse.builder().distributedIds(DISTRIBUTED_IDS).userId(USER_ID).build()).when(zosmfService).exchangeAuthenticationForZosmfToken(any(), any());
 
-            StepVerifier.create(transformApi.zosmf(requestCredentials))
+            StepVerifier.create(transformApi.zosmf(requestCredentials, mock(ServerWebExchange.class)))
                 .assertNext(response -> {
                     assertSame(DISTRIBUTED_IDS, response.getBody().getDistributedIds());
                     assertSame(USER_ID, response.getBody().getUserId());
@@ -449,7 +450,7 @@ void giveOidcToken_whenZosmf_thenReturnUserIds() throws ServiceNotFoundException
         void giveOidcToken_whenZoweJwt_thenReturnUserIds() {
             var requestCredentials = RequestCredentials.builder().build();
 
-            StepVerifier.create(transformApi.zoweJwt(requestCredentials))
+            StepVerifier.create(transformApi.zoweJwt(requestCredentials, mock(ServerWebExchange.class)))
                 .assertNext(response -> {
                     assertSame(DISTRIBUTED_IDS, response.getBody().getDistributedIds());
                     assertSame(USER_ID, response.getBody().getUserId());

apiml/src/test/java/org/zowe/apiml/acceptance/AcceptanceTestWithMockServices.java

@@ -22,6 +22,7 @@
 import org.springframework.context.ApplicationEventPublisher;
 import org.zowe.apiml.gateway.ApplicationRegistry;
 import org.zowe.apiml.gateway.MockService;
+import org.zowe.apiml.gateway.MockWebSocketService;
 
 @AcceptanceTest
 @TestInstance(TestInstance.Lifecycle.PER_CLASS)
@@ -78,6 +79,15 @@ protected MockService.MockServiceBuilder mockService(String serviceId) {
             .serviceId(serviceId);
     }
 
+    protected MockWebSocketService.MockWsServiceBuilder mockServiceWs(String serviceId) {
+        return MockWebSocketService.wsBuilder()
+            .statusChangedListener(mockService -> {
+                applicationRegistry.update(mockService);
+                updateRoutingRules();
+            })
+            .serviceId(serviceId);
+    }
+
     @AfterEach
     void stopMocksWithTestScope() {
         applicationRegistry.afterTest();