Programming | edwin's journey

Create JWT Token based on Public – Private Key Certificate On Spring Security

By edwin / 13 November 2019 13 November 2019 / Java, Programming / Java, Security, spring

Previously im always creating JWT token using a simple 20digit random character string, despite it works well but somehow it feels like there is something wrong. It feels like it is less secure.
Therefore, after spending some time researching, im changing below code where im using a 20 digits random String character


	String signingKey = "V5iwaQYUyqyi71ij3OtP";
	
    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey(signingKey);
        return converter;
    }

To signing and veryfing using a simple public and private key, first we need to create a simple public key file, public.txt

and private key, private.txt. And put both of them under resources folder so accessible by our app

And change our code to below,

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        Resource resource = new ClassPathResource("public.txt");
        Resource privateResource = new ClassPathResource("private.txt");
        String publicKey = null;
        String privateKey = null;
        try {
            publicKey = IOUtils.toString(resource.getInputStream());
            privateKey = IOUtils.toString(privateResource.getInputStream());
        } catch (final IOException e) {
            throw new RuntimeException(e);
        }
        converter.setVerifierKey(publicKey);
        converter.setSigningKey(privateKey);
        return converter;
    }

The downside of this new signing is it almost doubled the size of my JWT token, but hopefully makes it more secure.

[Java] Generate XML From XSD using xjc

By edwin / 11 November 2019 11 November 2019 / Java, Programming / Java, util, utility

For example i have an xsd, and i want to generate an XML based on it using java. This is my xsd example, and i save it as “my.xsd”

<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
           xmlns:tns="http://tempuri.org/PurchaseOrderSchema.xsd"
           targetNamespace="http://tempuri.org/PurchaseOrderSchema.xsd"
           elementFormDefault="qualified">
 <xsd:element name="PurchaseOrder" type="tns:PurchaseOrderType"/>
 <xsd:complexType name="PurchaseOrderType">
  <xsd:sequence>
   <xsd:element name="ShipTo" type="tns:USAddress" maxOccurs="2"/>
   <xsd:element name="BillTo" type="tns:USAddress"/>
  </xsd:sequence>
  <xsd:attribute name="OrderDate" type="xsd:date"/>
 </xsd:complexType>

 <xsd:complexType name="USAddress">
  <xsd:sequence>
   <xsd:element name="name"   type="xsd:string"/>
   <xsd:element name="street" type="xsd:string"/>
   <xsd:element name="city"   type="xsd:string"/>
   <xsd:element name="state"  type="xsd:string"/>
   <xsd:element name="zip"    type="xsd:integer"/>
  </xsd:sequence>
  <xsd:attribute name="country" type="xsd:NMTOKEN" fixed="US"/>
 </xsd:complexType>
</xsd:schema>

Next step is generate java bean using xjc using below command

xjc -p com.edw.bean my.xsd

And it will gives below output,

parsing a schema...
compiling a schema...
com\edw\bean\ObjectFactory.java
com\edw\bean\PurchaseOrderType.java
com\edw\bean\USAddress.java
com\edw\bean\package-info.java

Import those generated java files, and print a simple xml on console based on it.

package com.edw;

import com.edw.bean.ObjectFactory;
import com.edw.bean.PurchaseOrderType;
import com.edw.bean.USAddress;

import javax.xml.bind.JAXBContext;
import javax.xml.bind.JAXBElement;
import javax.xml.bind.Marshaller;
import javax.xml.datatype.DatatypeFactory;
import java.math.BigInteger;
import java.util.Date;

public class Main {
    public static void main(String[] args) throws Exception {
        new Main().doSomething();
    }

    private void doSomething() throws Exception {
        PurchaseOrderType purchaseOrderType = new PurchaseOrderType();
        USAddress address = new USAddress();
        address.setCity("aaa");
        address.setCountry("US");
        address.setName("cccc");
        address.setState("dddd");
        address.setStreet("eee");
        address.setZip(BigInteger.ONE);

        purchaseOrderType.setBillTo(address);
        purchaseOrderType.getShipTo().add(address);
        purchaseOrderType.setOrderDate(DatatypeFactory.newInstance().newXMLGregorianCalendar(new Date().toInstant().toString()));

        JAXBElement<PurchaseOrderType> element = new ObjectFactory().createPurchaseOrder(purchaseOrderType);
        toXml(element);
    }

    private void toXml(JAXBElement<PurchaseOrderType> element) throws Exception {
        JAXBContext ctx = JAXBContext.newInstance(PurchaseOrderType.class);
        Marshaller marshaller = ctx.createMarshaller();
        marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, Boolean.TRUE);
        marshaller.marshal(element, System.out);
    }
}

It will print below output,

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<PurchaseOrder xmlns="http://tempuri.org/PurchaseOrderSchema.xsd" OrderDate="2019-11-11Z">
    <ShipTo country="US">
        <name>cccc</name>
        <street>eee</street>
        <city>aaa</city>
        <state>dddd</state>
        <zip>1</zip>
    </ShipTo>
    <BillTo country="US">
        <name>cccc</name>
        <street>eee</street>
        <city>aaa</city>
        <state>dddd</state>
        <zip>1</zip>
    </BillTo>
</PurchaseOrder>

Final step is we can validate our generated xml with provided xsd, and see whether generated xml is valid.

Fixing Error “null username” when Integrating RedHat Single Sign On to Active Directory

By edwin / 17 October 2019 17 October 2019 / Programming, Server Configuration / openshift, redhat, RHSSO

Previously never had any issue when integrating RedHat SSO (Keycloak) to LDAP, but now got a very weird issue because now im trying to connecting RHSSO to Microsoft Active Directory instead of standard LDAP.

One biggest difference is that ActiveDirectory is using “sAMAccountName” field for user primarykey mapping, and somehow RHSSO is always get null value when trying to synchronize with existing user. Below is the complete stacktrace.

11:59:45,031 ERROR [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (default task-122) Failed during import user from LDAP: 
org.keycloak.models.ModelException: User returned from LDAP has null username! 
Check configuration of your LDAP mappings. Mapped username LDAP attribute: sAMAccountName, 
user DN: CN=XXX,OU=User,OU=HO,DC=llll,DC=co,DC=id, attributes from LDAP: 
{whenChanged=[20191016020643.0Z], whenCreated=[20170105023800.0Z], mail=[xxx@lll.co.id], givenName=[cccc], sn=[dddd], cn=[ccccc dddd], userAccountControl=[512], pwdLastSet=[132156652033202194]}
	at org.keycloak.storage.ldap.LDAPUtils.getUsername(LDAPUtils.java:113)
	at org.keycloak.storage.ldap.LDAPStorageProviderFactory$3.run(LDAPStorageProviderFactory.java:542)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
	at org.keycloak.storage.ldap.LDAPStorageProviderFactory.importLdapUsers(LDAPStorageProviderFactory.java:535)
	at org.keycloak.storage.ldap.LDAPStorageProviderFactory.syncImpl(LDAPStorageProviderFactory.java:490)
	at org.keycloak.storage.ldap.LDAPStorageProviderFactory.sync(LDAPStorageProviderFactory.java:428)
	at org.keycloak.services.managers.UserStorageSyncManager$2$1.call(UserStorageSyncManager.java:107)
	at org.keycloak.services.managers.UserStorageSyncManager$2$1.call(UserStorageSyncManager.java:102)
	at org.keycloak.cluster.infinispan.InfinispanClusterProvider.executeIfNotExecuted(InfinispanClusterProvider.java:78)
	at org.keycloak.services.managers.UserStorageSyncManager$2.run(UserStorageSyncManager.java:102)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
	at org.keycloak.services.managers.UserStorageSyncManager.syncAllUsers(UserStorageSyncManager.java:92)
	at org.keycloak.services.resources.admin.UserStorageProviderResource.syncUsers(UserStorageProviderResource.java:142)
	at sun.reflect.GeneratedMethodAccessor891.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)

It turns out that i have to mapping “sAMAccountName” field to username. Can find the complete screenshot below,

Cheers (^)

Creating a Simple Openshift Pipeline for NodeJS 10 Apps with Jenkins Slave

By edwin / 3 October 2019 3 October 2019 / Openshift, Programming / openshift, pipeline

Jenkins pipeline build have a slave mechanism, where it will spawn a new pod based on a specific image and will build on top of it. Slave mechanism have several benefits compared to traditional build, and one of the benefit is it can build with a different environment compared to jenkins master’s environment.

So, lets start with a simple docker file. We’ll create an imagestream using it, and will be used as a slave image. Basically it will use jenkins-slave-base-rhel7 as base image, and will install nodejs 10 on top of it.

oc new-build -D $'
FROM registry.access.redhat.com/openshift3/jenkins-slave-base-rhel7:v3.11
\n
RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.34.0/install.sh | bash
\n
ENV NVM_DIR=/home/jenkins/.nvm \ NODE_VERSION=10.16.0
\n
RUN . "$NVM_DIR/nvm.sh" && nvm install ${NODE_VERSION} && nvm use v${NODE_VERSION} && nvm alias default v${NODE_VERSION}
\n
ENV PATH="/home/jenkins/.nvm/versions/node/v${NODE_VERSION}/bin/:${PATH}"
\n
RUN node --version && npm --version
\n
USER 1001' --name=new-jenkins-slave-node10-rhel7

And you can see the imagestream on Openshift,

Next step is, creating a Jenkins ephemeral on Openshift and creating new Jenkins slave with our newly created image.

oc new-app jenkins-persistent --param ENABLE_OAUTH=true --param MEMORY_LIMIT=2Gi --param VOLUME_CAPACITY=4Gi --param DISABLE_ADMINISTRATIVE_MONITORS=true -e OPENSHIFT_JENKINS_JVM_ARCH=i386

For creating new slave, we can login to Jenkins page, open manage Jenkins menu, and go to Configure System menu, press Add Pod Template button.

Once successfully add new pod, we can start build our pipeline. Select New Item menu, add select Pipeline after that.Add put below code on Pipeline script,

def gitRepo="https://github.com/ariemay/node-test-app.git"
def branch="master"

node('new-jenkins-slave-node10-rhel7') {
    stage('test npm') {
        sh("node --version")
        sh("npm --version")
        sh("oc whoami")
    }
    stage ('pull code') {
        git branch: branch, url: gitRepo
    }
    stage ('build') {
        sh("npm install")
        sh("npm run build")
    }
    stage('check and prepare') {
        sh("cd /tmp")
        sh("pwd")
        sh("ls -alrth")
    }
    stage ('deploy') {
        try {
            sh("oc delete bc hello-react")
        } catch (Exception e) {
            sh("echo \"fail deleting bc \"")
        }
        try {
            sh("oc delete is hello-react")
        } catch (Exception e) {
            sh("echo \"fail deleting is \"")
        }
        try {
            sh("oc delete svc hello-react")
        } catch (Exception e) {
            sh("echo \"fail deleting svc \"")
        }
        try {
            sh("oc delete route hello-react")
        } catch (Exception e) {
            sh("echo \"fail deleting route \"")
        }
        sh("oc new-build --binary=true --name=hello-react --image-stream=nginx-112-rhel7")
        sh("oc start-build hello-react --from-dir=build --follow --wait" )

        try {
            sh("oc new-app  hello-react --name=hello-react" )
        } catch (Exception e) {
            sh("echo \"fail creating new-app, dc exists \"")
        }

        sh("oc expose svc/hello-react --name=hello-react")
    }
}

Press Build Now in order to see the build result,

We can see the url for result pod, and click it to see the built webpage.

So simple right?

Create A Simple Canary Deployment on Openshift

By edwin / 2 October 2019 2 October 2019 / Openshift, Programming / kubernetes, openshift

Openshift support multiple ways of deployements, such as traditional, canary and blue/green deployment. On this blog, im trying to create a simple canary deployment in order to see how can we leverage Openshift routing in deploy partially within a timeframe to reduce unwanted risks.

First we create two simple hello world app, one on top of PHP, and another one is on top of Java. We call my-blue and my-green. The goal of this scenario is to partially moving traffic from my-blue to my-green seamlessly.

oc new-app registry.access.redhat.com/redhat-openjdk-18/openjdk18-openshift~https://github.com/edwin/hello-world --name=my-blue

oc new-app php:7.0~https://github.com/edwin/php-helloworld --name=my-green

First is giving a 100percent traffic to my-blue microservice.

oc expose svc/my-blue --name=my-bluegreen

Then gradually reduce it to 75 percent,

oc set route-backends my-bluegreen my-blue=75 my-green=25

And 15 percent,

oc set route-backends my-bluegreen my-blue=15 my-green=85

Until the end is 100 percent of traffic goes to my-green.

oc set route-backends my-bluegreen my-green=100

We can test the url output with below curl command

curl http://your-openshift-url