Return torrii redirect on /authorization/callback

Set secure cookie option

.gitignore

@@ -22,3 +22,7 @@ DS_STORE
 
 /config/proxy-https/cert.pem
 /config/proxy-https/key.pem
+
+source.json
+out.json
+security.yml

config/authorization/config.ex

@@ -8,7 +8,7 @@ alias Acl.GroupSpec.GraphCleanup, as: GraphCleanup
 
 defmodule Acl.UserGroups.Config do
  @protected_resource_type [
-                           "http://www.w3.org/ns/org#Organization",
+                        "http://www.w3.org/ns/org#Organization",
                         "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
                         "http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst",
                         "http://data.vlaanderen.be/ns/besluit#Bestuursorgaan",
@@ -75,18 +75,15 @@ defmodule Acl.UserGroups.Config do
 
   def user_groups do
     [
-            %GroupSpec{
+       %GroupSpec{
         name: "acmidm",
         useage: [:read, :write, :read_for_write],
         access: %AccessByQuery{
           query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
                   PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
-                  PREFIX musession: <http://mu.semte.ch/vocabularies/session/>
+                  PREFIX session: <http://mu.semte.ch/vocabularies/session/>
-                  SELECT ?s WHERE {
+                  SELECT ?account WHERE {
-                    ?s ?p ?o.
+                    <SESSION_ID> session:account ?account.
-                    FILTER NOT EXISTS {
-                      <SESSION_ID> ext:hasAccount ?account.
-                    }
                   } LIMIT 1",
           vars: []
         },
@@ -112,22 +109,14 @@ defmodule Acl.UserGroups.Config do
         useage: [:read],
         access: %AlwaysAccessible{}, 
         graphs: [ %GraphSpec{
-                    graph: "http://mu.semte.ch/graphs/public",
+                    graph: "http://mu.semte.ch/graphs/public", # mock login only
                     constraint: %ResourceConstraint{
                       resource_types: [
                         "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
                         "http://xmlns.com/foaf/0.1/Person",
                         "http://xmlns.com/foaf/0.1/OnlineAccount"
                       ]
-                    } },
+                    } }]},
-                  %GraphSpec{
-                    graph: "http://mu.semte.ch/graphs/sessions",
-                    constraint: %ResourceFormatConstraint{
-                      resource_prefix: "http://mu.semte.ch/sessions/"
-                    } } ] },
-  
-     
-
   
       # // CLEANUP
       #

config/dispatcher/dispatcher.ex

@@ -10,9 +10,11 @@ defmodule Dispatcher do
 
   define_layers [ :api_services, :api, :frontend, :not_found ]
 
+
   ###############################################################
   # domain.json
   ###############################################################
+
   match "/people/*path", %{ accept: [:json], layer: :api} do
     Proxy.forward conn, path, "http://cache/people/"
   end
@@ -189,13 +191,17 @@ defmodule Dispatcher do
     Proxy.forward conn, path, "http://cache/site-types/"
   end
   
+
   ###############
   # LOGIN
   ###############
-  match "/accounts/*path", %{ accept: [:json], layer: :api} do
-    Proxy.forward conn, path, "http://resource/accounts/"
-  end
 
+  match "/accounts", %{ accept: [:json], layer: :api} do
+   Proxy.forward conn, [], "http://resource/accounts/"
+  end
+  match "/accounts/*path", %{ accept: [:json], layer: :api} do
+    Proxy.forward conn, path, "http://accountdetail/accounts/"
+  end
   match "/groups/*path", %{ accept: [:json], layer: :api} do
     Proxy.forward conn, path, "http://resource/groups/"
   end
@@ -208,21 +214,15 @@ defmodule Dispatcher do
     Proxy.forward conn, path, "http://login/sessions/"
   end
   
+
   ###############
   # API SERVICES
   ###############
+
   match "/v3/api-docs/*path", %{ layer: :api_services, accept: %{ json: true } } do
     forward conn, path, "http://kalliope-api/v3/api-docs/"
   end
 
-  match "/delta/*path", %{ layer: :api_services, accept: %{ json: true } } do
-    forward conn, path, "http://kalliope-api/delta/"
-  end
-
-  match "/bulk/*path", %{ layer: :api_services, accept: %{ json: true } } do
-    forward conn, path, "http://kalliope-api/bulk"
-  end
-
   match "/changes/*path", %{ layer: :api_services, accept: %{ json: true } } do
     forward conn, path, "http://kalliope-api/changes/"
   end
@@ -243,12 +243,17 @@ defmodule Dispatcher do
     forward conn, path, "http://privacy/person-information-requests"
   end
 
+  get "/uri-info/*path", %{ layer: :api_services, accept: %{ json: true } } do
+    forward conn, path, "http://uri-info/"
+  end
+
 
   ###############################################################
   # frontend layer
   ###############################################################
-  match "/torii/redirect.html", %{ accept: [:html], layer: :api } do
+
-    Proxy.forward conn, [], "http://frontend/torii/redirect.html"
+  match "/authorization/callback/*_path", %{ accept: [:html], layer: :api } do
+      Proxy.forward conn, [], "http://frontend/torii/redirect.html"
   end
 
   match "/assets/*path", %{ layer: :api } do
@@ -267,9 +272,11 @@ defmodule Dispatcher do
     Proxy.forward conn, [], "http://frontend/index.html"
   end
   
+
   ###############################################################
   # errors
   ###############################################################
+
   match "/*_path", %{ accept: [:any], layer: :not_found} do
     send_resp( conn, 404, "{\"error\": {\"code\": 404}")
   end

config/frontend/add-x-frame-options-header.conf

@@ -0,0 +1,3 @@
+location / {
+  add_header X-Frame-Options "DENY" always;
+}

config/kalliope/security-dev.yml

@@ -0,0 +1,9 @@
+# disabled on dev
+application:
+  security:
+    enabled: false
+spring:
+  autoconfigure:
+    exclude:
+       - org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration
+       - org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration

config/migrations/202109241151111112111233323-remove-acmidm-account-from-public.sparql

@@ -0,0 +1,32 @@
+PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
+PREFIX dcterms: <http://purl.org/dc/terms/>
+PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>
+PREFIX foaf: <http://xmlns.com/foaf/0.1/>
+PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>
+  DELETE {
+    GRAPH  <http://mu.semte.ch/graphs/public> {
+      ?s ?p ?o
+    }
+  } INSERT {
+    GRAPH  <http://mu.semte.ch/graphs/public> {
+       <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> a besluit:Bestuurseenheid ;
+          mu:uuid "141d9d6b-54af-4d17-b313-8d1c30bc3f5b" ;
+          skos:prefLabel "Agentschap Binnenlands Bestuur" ;
+          dcterms:identifier "OVO001835" .
+      <http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3470> a foaf:Person ;
+          mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ;
+          foaf:firstName "Josephine" ;
+          foaf:familyName "Putseys" ;
+          foaf:member <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> ;
+          foaf:account <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956> .
+      <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956> a foaf:OnlineAccount ;
+          mu:uuid "3a91ff60-07c1-4136-ac5e-55cf401e0956" ;
+          foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
+          ext:sessionRole "ChAdmin".
+    }
+  } WHERE {
+    GRAPH  <http://mu.semte.ch/graphs/public> {
+      ?s ?p ?o
+    }
+  }

config/proxy-https/proxy_ssl.conf

@@ -1,22 +0,0 @@
-
-server {
-  listen *:443;
-  server_name organisaties.abb.lblod.info;
-  ssl on;
-  ssl_certificate /etc/nginx/conf.d/cert.pem;
-  ssl_certificate_key /etc/nginx/conf.d/key.pem;
-
-  location / {
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header    X-Forwarded-For $remote_addr;
-        proxy_pass http://identifier;
-        client_max_body_size 3072m;
-  }
-
-  location ~ /authorization/callback(.*) {
-    rewrite ^ /torii/redirect.html permanent;
-  }
-}

config/proxy/web.conf

@@ -1,88 +0,0 @@
-events {
-
-}
-
-http {
-  server {
-    listen 80 default_server;
-    listen [::]:80 default_server;
-    server_name dev.contacthub.lblod.info;
-
-    location /v3/api-docs {
-        auth_basic "Contact Hub realm";
-        auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header    X-Forwarded-For $remote_addr;
-        proxy_pass http://identifier;
-        client_max_body_size 3072m;
-    }
-
-    location /delta {
-        auth_basic "Contact Hub realm";
-        auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header    X-Forwarded-For $remote_addr;
-        proxy_pass http://identifier;
-        client_max_body_size 3072m;
-    }
-    
-    location /bulk {
-        auth_basic "Contact Hub realm";
-        auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header    X-Forwarded-For $remote_addr;
-        proxy_pass http://identifier;
-        client_max_body_size 3072m;
-    }
-    
-    location /changes {
-        auth_basic "Contact Hub realm";
-        auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header    X-Forwarded-For $remote_addr;
-        proxy_pass http://identifier;
-        client_max_body_size 3072m;
-    }
-    
-    location /consolidated {
-        auth_basic "Contact Hub realm";
-        auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header    X-Forwarded-For $remote_addr;
-        proxy_pass http://identifier;
-        client_max_body_size 3072m;
-    }
-
-
-    location / {
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header    X-Forwarded-For $remote_addr;
-        proxy_pass http://identifier;
-        client_max_body_size 3072m;
-    }
-
-    location ~ /authorization/callback(.*) {
-        rewrite ^ /torii/redirect.html permanent;
-    }
-
-  }
-  
-}

docker-compose.dev.yml

@@ -3,6 +3,8 @@ version: '3.4'
 services:
   identifier:
     restart: "no"
+    ports:
+      - "80:80"
   dispatcher:
     restart: "no"
   triplestore:
@@ -18,7 +20,9 @@ services:
   cache:
     restart: "no"
   kalliope-api:
-    restart: "no"
+    environment:
+      SPRING_SECURITY_CONFIG: "/config/security-dev.yml"
+      restart: "no"
   deltanotifier:
     restart: "no"
   mocklogin:
@@ -29,9 +33,7 @@ services:
     restart: "no"
   login:
     restart: "no"
-  web:
-    ports:
-      - "80:80"
-    restart: "no"
   frontend:
     restart: "no"
+  uri-info:
+    restart: "no"

docker-compose.yml

@@ -9,9 +9,10 @@ x-logging:
 
 services:
   identifier:
-    image: semtech/mu-identifier:1.8.1
+    image: semtech/mu-identifier:1.9.1
     environment:
       DEFAULT_MU_AUTH_ALLOWED_GROUPS_HEADER: "[{\"variables\":[],\"name\":\"public\"}]"
+      SESSION_COOKIE_SECURE: "on"
     labels:
       - "logging=true"
     restart: always
@@ -32,8 +33,6 @@ services:
     volumes:
       - ./data/db:/data
       - ./config/db/virtuoso.ini:/data/virtuoso.ini
-    labels:
-      - "logging=true"
     restart: always
     logging: *default-logging
   db:
@@ -47,6 +46,10 @@ services:
       ERROR_ON_UNWRITTEN_DATA: "true"
     volumes:
       - ./config/authorization:/config
+    labels:
+      - "logging=true"
+    restart: always
+    logging: *default-logging
   migrations:
     image: semtech/mu-migrations-service:0.7.0
     links:
@@ -58,7 +61,7 @@ services:
     restart: always
     logging: *default-logging
   resource:
-    image: semtech/mu-cl-resources:latest
+    image: semtech/mu-cl-resources:feature-all-errors-as-json-api-errors
     links:
       - db:database
     volumes:
@@ -76,7 +79,7 @@ services:
     restart: always
     logging: *default-logging
   kalliope-api:
-    image: lblod/jsonld-delta-service:0.2.0
+    image: lblod/jsonld-delta-service:0.3.2
     volumes:
       - ./config/kalliope:/config
       - ./data/files:/share
@@ -84,11 +87,18 @@ services:
       SERVER_PORT: "80"
       LOGGING_LEVEL: "INFO"
       SPARQL_ENDPOINT: "http://db:8890/sparql"
+    labels:
+      - "logging=true"
     restart: always
+    logging: *default-logging
   deltanotifier:
     image: semtech/mu-delta-notifier:0.1.0
     volumes:
       - ./config/delta:/config
+    labels:
+      - "logging=true"
+    restart: always
+    logging: *default-logging
   sink:
     image: nginx:1.15.2
     volumes:
@@ -98,49 +108,72 @@ services:
     restart: always
     logging: *default-logging
   login:
-    image: lblod/acmidm-login-service:0.9.2-organisatie_portaal
+    image: lblod/acmidm-login-service:0.9.3-organisatie_portaal
     links:
       - db:database
     environment:
+      MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts"
       MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op"
       MU_APPLICATION_AUTH_CLIENT_ID: "677af572-2e2f-4e61-ad38-036723bb314c"
       MU_APPLICATION_AUTH_REDIRECT_URI: "https://organisaties.abb.lblod.info/authorization/callback"
       MU_APPLICATION_AUTH_CLIENT_SECRET: ""
+    links:
+      - db:database
     labels:
       - "logging=true"
     restart: always
     logging: *default-logging
     links:
       - db:database
+  accountdetail:
+    image: lblod/account-detail-service:latest
+    labels:
+      - "logging=true"
+    environment:
+      MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts"
+    links:
+      - db:database
+    restart: always
+    logging: *default-logging
   privacy:
     image: lblod/privacy-centric-service:0.0.1
+    labels:
+      - "logging=true"
     environment:
       SERVER_PORT: "80"
       SPARQL_ENDPOINT: "http://db:8890/sparql"
       LOGGING_LEVEL: "INFO"
       DEFAULT_GRAPH: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin"
       SESSION_GRAPH: "http://mu.semte.ch/graphs/sessions"
+    labels:
+      - "logging=true"
+    restart: always
+    logging: *default-logging
   adressenregister:
     image: lblod/adressenregister-fuzzy-search-service:0.5.0
-  web:
-    image: nginx
-    volumes:
-       - ./config/proxy:/etc/nginx/conf.d
-       - ./config/proxy/web.conf:/etc/nginx/nginx.conf:ro
-    links:
-      - identifier:identifier
     labels:
       - "logging=true"
     restart: always
     logging: *default-logging
   frontend:
     image: lblod/frontend-contact-hub:1.1.0
-    labels:
+    volumes:
-      - "logging=true"
+      - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf
     environment:
       EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback"
       EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c"
       EMBER_OAUTH_API_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth"
       EMBER_OAUTH_API_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout"
       EMBER_OAUTH_API_SCOPE: "openid vo profile abb_organisatieportaal"
+    labels:
+      - "logging=true"
     restart: always
+    logging: *default-logging
+  uri-info:
+    image: redpencil/mu-uri-info-service:0.2.1
+    links:
+      - db:database
+    labels:
+      - "logging=true"
+    restart: always
+    logging: *default-logging