Remove unnecessary configs passed from Adapter to Enforcer through xDS messages

[renuka-fernando]

Purpose

$subject

Logs

adapter-1 | 2024-02-16 15:10:13 INFO [marshaller.go:346] - [xds.MarshalKeyManager] [-] [Renuka] Key Manager Configuration Before Filter: map[AuthorizeURL:https://choreo-am-service:9443/oauth2/authorize LogoutURL:https://choreo-am-service:9443/oidc/logout OAuthConfigurations.EncryptPersistedTokens:true RevokeURL:https://choreo-am-service:9443/oauth2/revoke ServerURL:https://choreo-am-service:9443/services/ TokenURL:https://choreo-am-service:9443/oauth2/token VALIDITY_PERIOD:3600 authorize_endpoint:https://choreo-am-service:9443/oauth2/authorize certificate_type:JWKS certificate_value:https://sts.preview-dv.choreo.dev/oauth2/jwks enable_map_oauth_consumer_apps:false enable_oauth_app_creation:true enable_token_encryption:false enable_token_generation:true enable_token_hash:false grant_types:[refresh_token urn:ietf:params:oauth:grant-type:saml2-bearer password client_credentials iwa:ntlm authorization_code urn:ietf:params:oauth:grant-type:token-exchange urn:ietf:params:oauth:grant-type:jwt-bearer] issuer:https://sts.preview-dv.choreo.dev:443/oauth2/token logout_endpoint:https://choreo-am-service:9443/oidc/logout revoke_endpoint:https://choreo-am-service:9443/oauth2/revoke self_validate_jwt:true token_endpoint:https://choreo-am-service:9443/oauth2/token token_format_string:[{"enable":true,"type":"REFERENCE","value":"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}"}] validation_enable:true]
adapter-1 | 2024-02-16 15:10:13 INFO [marshaller.go:350] - [xds.MarshalKeyManager] [-] [Renuka] Key Manager Configuration After Filter: {"certificate_type":"JWKS","certificate_value":"https://sts.preview-dv.choreo.dev/oauth2/jwks","issuer":"https://sts.preview-dv.choreo.dev:443/oauth2/token","self_validate_jwt":true}
adapter-1 | 2024-02-16 15:10:13 INFO [marshaller.go:346] - [xds.MarshalKeyManager] [-] [Renuka] Key Manager Configuration Before Filter: map[authorize_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/authorize certificate_type:JWKS certificate_value:https://dev.api.asgardeo.io/t/renukafernando/oauth2/jwks claim_mappings:[] client_registration_endpoint:https://dev.api.asgardeo.io/t/renukafernando/api/server/v1 consumer_key_claim:azp enable_map_oauth_consumer_apps:false enable_oauth_app_creation:true enable_token_encryption:false enable_token_generation:true enable_token_hash:false grant_types:[refresh_token password client_credentials authorization_code implicit] issuer:https://dev.api.asgardeo.io/t/renukafernando/oauth2/token revoke_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/revoke scopes_claim:scope self_validate_jwt:true token_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/token]
adapter-1 | 2024-02-16 15:10:13 INFO [marshaller.go:350] - [xds.MarshalKeyManager] [-] [Renuka] Key Manager Configuration After Filter: {"certificate_type":"JWKS","certificate_value":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/jwks","claim_mappings":[],"consumer_key_claim":"azp","issuer":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/token","scopes_claim":"scope","self_validate_jwt":true}

Formatted Config

{
  "certificate_type": "JWKS",
  "certificate_value": "https://sts.preview-dv.choreo.dev/oauth2/jwks",
  "issuer": "https://sts.preview-dv.choreo.dev:443/oauth2/token",
  "self_validate_jwt": true
}

{
  "certificate_type": "JWKS",
  "certificate_value": "https://dev.api.asgardeo.io/t/renukafernando/oauth2/jwks",
  "claim_mappings": [],
  "consumer_key_claim": "azp",
  "issuer": "https://dev.api.asgardeo.io/t/renukafernando/oauth2/token",
  "scopes_claim": "scope",
  "self_validate_jwt": true
}

Event based key manager configs

adapter-1 | 2024-02-16 15:22:42 INFO [notification_listener.go:164] - [messaging.handleKeyManagerEvents] [-] decoded Key Manager stream {"claim_mappings":[],"authorize_endpoint":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/authorize","grant_types":["refresh_token","password","client_credentials","authorization_code","implicit"],"enable_oauth_app_creation":true,"certificate_value":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/jwks","enable_token_generation":true,"issuer":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/token","enable_map_oauth_consumer_apps":false,"enable_token_hash":false,"self_validate_jwt":true,"revoke_endpoint":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/revoke","scopes_claim":"scope","enable_token_encryption":false,"client_registration_endpoint":"https://dev.api.asgardeo.io/t/renukafernando/api/server/v1","consumer_key_claim":"azp","certificate_type":"JWKS","token_endpoint":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/token"}
adapter-1 | 2024-02-16 15:22:42 INFO [notification_listener.go:177] - [messaging.handleKeyManagerEvents] [-] Key Manager data map[authorize_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/authorize certificate_type:JWKS certificate_value:https://dev.api.asgardeo.io/t/renukafernando/oauth2/jwks claim_mappings:[] client_registration_endpoint:https://dev.api.asgardeo.io/t/renukafernando/api/server/v1 consumer_key_claim:azp enable_map_oauth_consumer_apps:false enable_oauth_app_creation:true enable_token_encryption:false enable_token_generation:true enable_token_hash:false grant_types:[refresh_token password client_credentials authorization_code implicit] issuer:https://dev.api.asgardeo.io/t/renukafernando/oauth2/token revoke_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/revoke scopes_claim:scope self_validate_jwt:true token_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/token]
adapter-1 | 2024-02-16 15:22:42 INFO [marshaller.go:346] - [xds.MarshalKeyManager] [-] [Renuka] Key Manager Configuration Before Filter: map[authorize_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/authorize certificate_type:JWKS certificate_value:https://dev.api.asgardeo.io/t/renukafernando/oauth2/jwks claim_mappings:[] client_registration_endpoint:https://dev.api.asgardeo.io/t/renukafernando/api/server/v1 consumer_key_claim:azp enable_map_oauth_consumer_apps:false enable_oauth_app_creation:true enable_token_encryption:false enable_token_generation:true enable_token_hash:false grant_types:[refresh_token password client_credentials authorization_code implicit] issuer:https://dev.api.asgardeo.io/t/renukafernando/oauth2/token revoke_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/revoke scopes_claim:scope self_validate_jwt:true token_endpoint:https://dev.api.asgardeo.io/t/renukafernando/oauth2/token]
adapter-1 | 2024-02-16 15:22:42 INFO [marshaller.go:350] - [xds.MarshalKeyManager] [-] [Renuka] Key Manager Configuration After Filter: {"certificate_type":"JWKS","certificate_value":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/jwks","claim_mappings":[],"consumer_key_claim":"azp","issuer":"https://dev.api.asgardeo.io/t/renukafernando/oauth2/token","scopes_claim":"scope","self_validate_jwt":true}

Issues

Fixes #

Automation tests

• Unit tests added: Yes
• Integration tests added: No

Tested environments

Not Tested

---

Maintainers: Check before merge

• Assigned 'Type' label
• Assigned the project
• Validated respective github issues
• Assigned milestone to the github issue(s)

[slahirucd7]

Do we need a new struct ?

type xdsPayloadFormatter struct {
	RetainKeysForKeyManagerConfigs []string
}

[renuka-fernando]

Yeah, looks good. But in case we need to add another config for key managers, for example, filter out some keys we can add just another field in TOML for key managers.

[adapter.xdsPayloadFormatter.keyManagerConfigs]
# Retain only the following keys in the Key Manager configurations from Control Plane events and send to Enforcer
retainKeys = ["self_validate_jwt", "issuer", "claim_mappings", "consumer_key_claim", "scopes_claim", "jwks_endpoint", "certificate_type", "certificate_value", "environments"]

[choreo-cicd]

[succeeded] Dataplane(NorthEU) cluster : dev-deployment-v2 : 20240222.15

[choreo-cicd]

[succeeded] : dev-deployment-v2 : 20240222.15

[choreo-cicd]

[succeeded] Controlplane cluster : dev-deployment-v2 : 20240222.15

[choreo-cicd]

[succeeded] Dataplane(EastUS) cluster : dev-deployment-v2 : 20240222.15

[choreo-cicd]

[succeeded] : stage-deployment-v2 : 20240223.1

[choreo-cicd]

[failed] Dataplane(EastUS) cluster : stage-deployment-v2 : 20240223.1

[choreo-cicd]

[failed] Controlplane cluster : stage-deployment-v2 : 20240223.1

[choreo-cicd]

[succeeded] Dataplane(NorthEU) cluster : stage-deployment-v2 : 20240223.1

[choreo-cicd]

[] Dataplane(NorthEU) cluster : stage-deployment-v2 : 20240224.1

[choreo-cicd]

[] : stage-deployment-v2 : 20240224.1

[choreo-cicd]

[] Dataplane(EastUS) cluster : stage-deployment-v2 : 20240224.1

[choreo-cicd]

[] Controlplane cluster : stage-deployment-v2 : 20240224.1

[choreo-cicd]

[succeeded] : prod-deployment-v2 : 20240227.2

[choreo-cicd]

[failed] Controlplane cluster : prod-deployment-v2 : 20240227.2

[choreo-cicd]

[succeeded] Controlplane cluster : prod-deployment-v2 : 20240227.2

[choreo-cicd]

[succeeded] : prod-deployment-v2 : 20240227.2

[choreo-cicd]

[] Dataplane(NorthEU) cluster : prod-deployment-v2 : 20240227.5

[choreo-cicd]

[] Dataplane(EastUS) cluster : prod-deployment-v2 : 20240227.5

[choreo-cicd]

[] : prod-deployment-v2 : 20240227.5

[choreo-cicd]

[] Controlplane cluster : prod-deployment-v2 : 20240227.5