44import jakarta .servlet .ServletException ;
55import jakarta .servlet .http .HttpServletRequest ;
66import jakarta .servlet .http .HttpServletResponse ;
7- import java .io .ByteArrayInputStream ;
8- import java .io .IOException ;
9- import java .security .cert .CertificateException ;
10- import java .security .cert .CertificateFactory ;
11- import java .security .cert .X509Certificate ;
12- import java .util .Base64 ;
137import lombok .RequiredArgsConstructor ;
148import org .cloudfoundry .autoscaler .scheduler .conf .CfServerConfiguration ;
159import org .slf4j .Logger ;
1812import org .springframework .stereotype .Component ;
1913import org .springframework .web .filter .OncePerRequestFilter ;
2014
15+ import java .io .ByteArrayInputStream ;
16+ import java .io .IOException ;
17+ import java .security .cert .CertificateException ;
18+ import java .security .cert .CertificateFactory ;
19+ import java .security .cert .X509Certificate ;
20+ import java .util .Base64 ;
21+
2122@ Component
2223@ Order (0 )
2324@ RequiredArgsConstructor
@@ -33,18 +34,21 @@ public class HttpAuthFilter extends OncePerRequestFilter {
3334
3435 @ Override
3536 protected void doFilterInternal (
36- HttpServletRequest request , HttpServletResponse response , FilterChain filterChain )
37- throws ServletException , IOException {
37+ HttpServletRequest request , HttpServletResponse response , FilterChain filterChain )
38+ throws ServletException , IOException {
3839
3940 String forwardedProto = request .getHeader ("X-Forwarded-Proto" );
4041 boolean isHealthEndpoint = request .getRequestURI ().contains (HEALTH_ENDPOINT );
4142
4243 logger .info (
43- "Received {} request, scheme={},X-Forwarded-Proto={} isHealthEndpoint={}" ,
44- request .getMethod (),
45- request .getScheme (),
46- forwardedProto ,
47- isHealthEndpoint );
44+ "Received {} request, scheme={},X-Forwarded-Proto={}, isHealthEndpoint={}, username={}, password={}" ,
45+ request .getMethod (),
46+ request .getScheme (),
47+ forwardedProto ,
48+ isHealthEndpoint ,
49+ cfServerConfiguration .getHealthserver ().getUsername (),
50+ cfServerConfiguration .getHealthserver ().getPassword ());
51+
4852
4953 if (isHealthEndpoint ) {
5054 handleHealthEndpoint (request , response );
@@ -59,14 +63,14 @@ protected void doFilterInternal(
5963 }
6064
6165 logger .info (
62- "X-Forwarded-Client-Cert header received ... checking authorized org and space in OU" );
66+ "X-Forwarded-Client-Cert header received ... checking authorized org and space in OU" );
6367 validateOrganizationAndSpace (xfccHeader , response );
6468 // Proceed with valid request
6569 filterChain .doFilter (request , response );
6670 }
6771
6872 private void validateOrganizationAndSpace (String xfccHeader , HttpServletResponse response )
69- throws IOException {
73+ throws IOException {
7074 try {
7175 String organizationalUnit = extractOrganizationalUnit (xfccHeader );
7276 // Validate both key-value pairs in OrganizationalUnit
@@ -77,12 +81,12 @@ private void validateOrganizationAndSpace(String xfccHeader, HttpServletResponse
7781 } catch (CertificateException e ) {
7882 logger .warn ("Invalid certificate: " + e .getMessage ());
7983 response .sendError (
80- HttpServletResponse .SC_BAD_REQUEST , "Invalid certificate: " + e .getMessage ());
84+ HttpServletResponse .SC_BAD_REQUEST , "Invalid certificate: " + e .getMessage ());
8185 }
8286 }
8387
8488 private void handleHealthEndpoint (HttpServletRequest request , HttpServletResponse response )
85- throws IOException {
89+ throws IOException {
8690 logger .info ("Handling health check request with Basic Auth" );
8791 String authHeader = request .getHeader (AUTHORIZATION_HEADER );
8892 logger .info ("Authorization header: {}" , authHeader != null ? "present" : "missing" );
@@ -99,7 +103,7 @@ private void handleHealthEndpoint(HttpServletRequest request, HttpServletRespons
99103 return ;
100104 }
101105 if (!credentials [0 ].equals (cfServerConfiguration .getHealthserver ().getUsername ())
102- || !credentials [1 ].equals (cfServerConfiguration .getHealthserver ().getPassword ())) {
106+ || !credentials [1 ].equals (cfServerConfiguration .getHealthserver ().getPassword ())) {
103107 logger .warn ("Invalid credentials for health check request" );
104108 response .sendError (HttpServletResponse .SC_UNAUTHORIZED , "Unauthorized" );
105109 return ;
@@ -114,8 +118,8 @@ private void handleHealthEndpoint(HttpServletRequest request, HttpServletRespons
114118 private String [] decodeBasicAuth (String authHeader ) {
115119 try {
116120 return new String (
117- Base64 .getDecoder ().decode (authHeader .substring (BASIC_AUTH_PREFIX .length ())))
118- .split (":" );
121+ Base64 .getDecoder ().decode (authHeader .substring (BASIC_AUTH_PREFIX .length ())))
122+ .split (":" );
119123 } catch (IllegalArgumentException e ) {
120124 logger .warn ("Failed to decode Basic Auth header: {}" , e .getMessage ());
121125 return null ;
@@ -130,10 +134,10 @@ private String extractOrganizationalUnit(String certValue) throws CertificateExc
130134 private X509Certificate parseCertificate (String certValue ) throws CertificateException {
131135 // Extract the base64-encoded certificate from the XFCC header
132136 String base64Cert =
133- certValue
134- .replace ("-----BEGIN CERTIFICATE-----" , "" )
135- .replace ("-----END CERTIFICATE-----" , "" )
136- .replaceAll ("\\ s+" , "" );
137+ certValue
138+ .replace ("-----BEGIN CERTIFICATE-----" , "" )
139+ .replace ("-----END CERTIFICATE-----" , "" )
140+ .replaceAll ("\\ s+" , "" );
137141
138142 byte [] decodedCert = Base64 .getDecoder ().decode (base64Cert );
139143
@@ -143,9 +147,9 @@ private X509Certificate parseCertificate(String certValue) throws CertificateExc
143147
144148 private boolean isValidOrganizationalUnit (String organizationalUnit ) {
145149 boolean isSpaceValid =
146- organizationalUnit .contains ("space:" + cfServerConfiguration .getValidSpaceGuid ());
150+ organizationalUnit .contains ("space:" + cfServerConfiguration .getValidSpaceGuid ());
147151 boolean isOrgValid =
148- organizationalUnit .contains ("organization:" + cfServerConfiguration .getValidOrgGuid ());
152+ organizationalUnit .contains ("organization:" + cfServerConfiguration .getValidOrgGuid ());
149153 return isSpaceValid && isOrgValid ;
150154 }
151155}
0 commit comments