Update Security Samples #301

TimHess · 2023-07-14T21:56:27Z

Use minimal API, add actuators, only listen over HTTPS, improve usability

TODO: update integration test, help users understand how to enable UAA as a user store for the tile

Security/src/CloudFoundrySingleSignon/Controllers/HomeController.cs

Security/src/CloudFoundrySingleSignon/Program.cs

Security/src/CloudFoundrySingleSignon/README-UAA.md

bart-vmware · 2023-07-18T08:23:48Z

Security/src/CloudFoundrySingleSignon/README-UAA.md

+After authenticating, add a new `user` and `group` to the UAA Server database. Do NOT change the group name: `testgroup` as it is used for policy based authorization in the sample application. Feel free to change the username and password to anything you would like.
+
+1. uaac group add testgroup
+1. uaac user add dave --given_name Dave --family_name Tillman --emails dave@testcloud.com --password Password1!


Perhaps replace 'dave' with something else? (multiple places in this file and others)

bart-vmware · 2023-07-18T08:24:42Z

Security/src/CloudFoundrySingleSignon/README-UAA.md

+
+### Add User-Provided Service with OAuth Details
+
+Last, we will create a user-provide service that includes the appropriate UAA server configuration data. Use the sample below to pass the parameters directly to the `cf cups` command, replacing `<YOUR-CLOUDFOUNDRY-SYSTEM-DOMAIN>` with your domain.


Suggested change

Last, we will create a user-provide service that includes the appropriate UAA server configuration data. Use the sample below to pass the parameters directly to the `cf cups` command, replacing `<YOUR-CLOUDFOUNDRY-SYSTEM-DOMAIN>` with your domain.

Last, we will create a user-provided service that includes the appropriate UAA server configuration data. Use the sample below to pass the parameters directly to the `cf cups` command, replacing `<YOUR-CLOUDFOUNDRY-SYSTEM-DOMAIN>` with your domain.

Security/src/CloudFoundrySingleSignon/README-UAA.md

bart-vmware · 2023-07-18T08:30:13Z

Security/src/CloudFoundrySingleSignon/README-UAA.md

+    * `cf push -f manifest.yml -p bin/Debug/netcoreapp3.1/linux-x64/publish`
+    * `cf push -f manifest-windows.yml -p bin/Debug/netcoreapp3.1/win10-x64/publish`
+
+> Note: The provided manifest(s) will create an app named `single-signon` and attempt to bind it to the user-provided service `myOAuthService`.


It looks like this was renamed to mySSOService in other places. Should this be renamed accordingly?

Suggested change

> Note: The provided manifest(s) will create an app named `single-signon` and attempt to bind it to the user-provided service `myOAuthService`.

> Note: The provided manifest(s) will create an app named `single-signon` and attempt to bind it to the user-provided service `mySSOService`.

bart-vmware · 2023-07-18T08:38:06Z

Security/src/CloudFoundrySingleSignon/Startup.cs

+                var options = serviceProvider.GetService<IOptions<CertificateOptions>>();
+                if (options?.Value.Certificate != null)


I don't think GetService for an IOptions<> ever returns null. If there's no configuration, you'll get a default instance.

Suggested change

var options = serviceProvider.GetService<IOptions<CertificateOptions>>();

if (options?.Value.Certificate != null)

var options = serviceProvider.GetRequiredService<IOptions<CertificateOptions>>();

if (options.Value.Certificate != null)

The same suggestion applies to other places in this PR, which I haven't marked.

bart-vmware · 2023-07-18T08:42:02Z

Security/src/CloudFoundrySingleSignon/Program.cs

+    options.AddPolicy("testgroup1", policy => policy.RequireClaim("scope", "testgroup1"));
+});
+
+// Add Redis to allow scaling beyond a single instance


Suggested change

// Add Redis to allow scaling beyond a single instance

// Uncomment the code below to add Redis to allow scaling beyond a single instance

bart-vmware · 2023-07-18T08:49:53Z

Security/src/CloudFoundrySingleSignon/Controllers/HomeController.cs

                }
                else
                {
-                    serviceHostname = serviceName + hostName.Substring(indx);
+                    serviceHostname = string.Concat(serviceName, hostName.AsSpan(indexOfHost));


Just out of curiosity, did you get this suggestion from an analyzer? Resharper suggests using range indexer syntax.

Suggested change

serviceHostname = string.Concat(serviceName, hostName.AsSpan(indexOfHost));

serviceHostname = $"{serviceName}{hostName[indx..]}";

This was probably a Visual Studio suggestion, Resharper's preference is fine with me

Refs: #289

Bumps [MongoDB.Driver](https://github.com/mongodb/mongo-csharp-driver) from 2.18.0 to 2.19.0. - [Release notes](https://github.com/mongodb/mongo-csharp-driver/releases) - [Commits](mongodb/mongo-csharp-driver@v2.18.0...v2.19.0) --- updated-dependencies: - dependency-name: MongoDB.Driver dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [requests](https://github.com/psf/requests) from 2.28.2 to 2.31.0. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.28.2...v2.31.0) --- updated-dependencies: - dependency-name: requests dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

See https://hub.docker.com/_/consul: > Upcoming in Consul 1.16, we will stop publishing official Dockerhub images and publish only our Verified Publisher images. Users of Docker images should pull from hashicorp/consul instead of consul. Verified Publisher images can be found at https://hub.docker.com/r/hashicorp/consul.

Bumps [mechanicalsoup](https://github.com/MechanicalSoup/MechanicalSoup) from 1.2.0 to 1.3.0. - [Release notes](https://github.com/MechanicalSoup/MechanicalSoup/releases) - [Changelog](https://github.com/MechanicalSoup/MechanicalSoup/blob/main/docs/ChangeLog.rst) - [Commits](MechanicalSoup/MechanicalSoup@v1.2.0...v1.3.0) --- updated-dependencies: - dependency-name: mechanicalsoup dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.0.2 to 2.0.6. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.0.2...2.0.6) --- updated-dependencies: - dependency-name: urllib3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.0.6 to 2.0.7. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.0.6...2.0.7) --- updated-dependencies: - dependency-name: urllib3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [Azure.Identity](https://github.com/Azure/azure-sdk-for-net) from 1.5.0 to 1.10.2. - [Release notes](https://github.com/Azure/azure-sdk-for-net/releases) - [Commits](Azure/azure-sdk-for-net@Azure.Identity_1.5.0...Azure.Identity_1.10.2) --- updated-dependencies: - dependency-name: Azure.Identity dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Use minimal API, add actuators, only listen over HTTPS, improve usability

TimHess · 2024-06-06T22:04:41Z

I will reopen a new PR, this history is probably not worth saving

bart-vmware reviewed Jul 18, 2023

View reviewed changes

TimHess force-pushed the security-refresh branch from 5d03e26 to f605ce4 Compare January 26, 2024 22:16

TimHess force-pushed the security-refresh branch from f605ce4 to 77ee2e2 Compare February 28, 2024 21:40

TimHess force-pushed the security-refresh branch from d1db821 to b1d7f3d Compare April 25, 2024 21:09

TimHess force-pushed the security-refresh branch from b1d7f3d to abcd359 Compare June 3, 2024 21:56

TimHess changed the base branch from main to latest June 3, 2024 21:57

ccheetham and others added 14 commits June 6, 2024 16:53

Upgrade Python to 3.11

1b141ea

Refs: #289

Initial RabbitMQ Tutorial commit (#288)

8aa0ee0

Update Security Samples

d191da6

Use minimal API, add actuators, only listen over HTTPS, improve usability

Refresh app security samples

941940e

TimHess force-pushed the security-refresh branch from abcd359 to 941940e Compare June 6, 2024 22:00

TimHess closed this Jun 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Security Samples #301

Update Security Samples #301

TimHess commented Jul 14, 2023

bart-vmware Jul 18, 2023

bart-vmware Jul 18, 2023

bart-vmware Jul 18, 2023

bart-vmware Jul 18, 2023

bart-vmware Jul 18, 2023

bart-vmware Jul 18, 2023

TimHess Jan 26, 2024

TimHess commented Jun 6, 2024


		### Add User-Provided Service with OAuth Details

		Last, we will create a user-provide service that includes the appropriate UAA server configuration data. Use the sample below to pass the parameters directly to the `cf cups` command, replacing `<YOUR-CLOUDFOUNDRY-SYSTEM-DOMAIN>` with your domain.

	Last, we will create a user-provide service that includes the appropriate UAA server configuration data. Use the sample below to pass the parameters directly to the `cf cups` command, replacing `<YOUR-CLOUDFOUNDRY-SYSTEM-DOMAIN>` with your domain.
	Last, we will create a user-provided service that includes the appropriate UAA server configuration data. Use the sample below to pass the parameters directly to the `cf cups` command, replacing `<YOUR-CLOUDFOUNDRY-SYSTEM-DOMAIN>` with your domain.

	> Note: The provided manifest(s) will create an app named `single-signon` and attempt to bind it to the user-provided service `myOAuthService`.
	> Note: The provided manifest(s) will create an app named `single-signon` and attempt to bind it to the user-provided service `mySSOService`.

		var options = serviceProvider.GetService<IOptions<CertificateOptions>>();
		if (options?.Value.Certificate != null)

	// Add Redis to allow scaling beyond a single instance
	// Uncomment the code below to add Redis to allow scaling beyond a single instance

	serviceHostname = string.Concat(serviceName, hostName.AsSpan(indexOfHost));
	serviceHostname = $"{serviceName}{hostName[indx..]}";

Update Security Samples #301

Update Security Samples #301

Conversation

TimHess commented Jul 14, 2023

bart-vmware Jul 18, 2023

Choose a reason for hiding this comment

bart-vmware Jul 18, 2023

Choose a reason for hiding this comment

bart-vmware Jul 18, 2023

Choose a reason for hiding this comment

bart-vmware Jul 18, 2023

Choose a reason for hiding this comment

bart-vmware Jul 18, 2023

Choose a reason for hiding this comment

bart-vmware Jul 18, 2023

Choose a reason for hiding this comment

TimHess Jan 26, 2024

Choose a reason for hiding this comment

TimHess commented Jun 6, 2024