From 44a0c948823d5a8bf6121499aa76b1f107ba73b9 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 11 Nov 2019 15:21:53 +0100 Subject: [PATCH 01/13] Allow to configure multiple users at a time --- .../helper/DefaultUserConfiguration.java | 7 +++ .../engine/helper/PropertyValueProvider.java | 10 ++++- .../helper/ScannerUserConfiguration.java | 45 +++++++++++++++++++ .../src/main/resources/application-dev.yaml | 13 +++--- 4 files changed, 68 insertions(+), 7 deletions(-) create mode 100644 scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java index 6a7c2c0e..e296e13c 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java @@ -46,6 +46,9 @@ public class DefaultUserConfiguration extends AbstractCamundaConfiguration { @Autowired private PropertyValueProvider properties; + @Autowired + private ScannerUserConfiguration scannerUserConfiguration; + private static final Logger LOG = LoggerFactory.getLogger(DefaultUserConfiguration.class); public static final String GROUP_SCANNER = "scanner"; @@ -64,6 +67,10 @@ public void postProcessEngineBuild(final ProcessEngine processEngine) { createGroups(processEngine); setupTechnicalUserForScanner(identityService); + + for(ScannerUserConfiguration.ScannerUser scannerUser : scannerUserConfiguration.getScannerUsers()){ + LOG.info("I'd create a User for with creds '{}:{}' now", scannerUser.getUsername(), scannerUser.getPassword()); + } } private void createGroups(final ProcessEngine processEngine){ diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java index 349d36e2..9be7bacf 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java @@ -1,6 +1,7 @@ package io.securecodebox.engine.helper; import org.springframework.beans.factory.annotation.Value; +import org.springframework.boot.context.properties.DeprecatedConfigurationProperty; import org.springframework.stereotype.Component; /** @@ -35,7 +36,6 @@ public class PropertyValueProvider { @Value("${securecodebox.rest.user.scanner-default.password}") private String defaultUserScannerPassword; - /** * Default target access URI */ @@ -58,10 +58,18 @@ public String getDefaultTargetUri() { return defaultTargetUri; } + @DeprecatedConfigurationProperty( + replacement = "securecodebox.rest.user.scanner", + reason = "Using the new property multiple users can be configured, which is more flexible than only being able to create one." + ) String getDefaultUserScannerId() { return defaultUserScannerId; } + @DeprecatedConfigurationProperty( + replacement = "securecodebox.rest.user.scanner", + reason = "Using the new property multiple users can be configured, which is more flexible than only being able to create one." + ) String getDefaultUserScannerPassword() { return defaultUserScannerPassword; } diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java new file mode 100644 index 00000000..390742ee --- /dev/null +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java @@ -0,0 +1,45 @@ +package io.securecodebox.engine.helper; + +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.context.annotation.Configuration; + +import java.util.ArrayList; + +@Configuration +@ConfigurationProperties( prefix = "securecodebox.rest.user" ) +public class ScannerUserConfiguration { + + private ArrayList scanner = new ArrayList<>(); + + public static class ScannerUser { + private String username; + private String password; + + public ScannerUser() {} + + public ScannerUser(String username, String password) { + this.username = username; + this.password = password; + } + + public String getUsername() { + return username; + } + + public String getPassword() { + return password; + } + + public void setUsername(String username) { + this.username = username; + } + + public void setPassword(String password) { + this.password = password; + } + } + + public ArrayList getScannerUsers() { + return scanner; + } +} diff --git a/scb-engine/src/main/resources/application-dev.yaml b/scb-engine/src/main/resources/application-dev.yaml index ee8d05b0..baaebbe8 100644 --- a/scb-engine/src/main/resources/application-dev.yaml +++ b/scb-engine/src/main/resources/application-dev.yaml @@ -6,9 +6,10 @@ camunda.bpm: logging.level: DEBUG logging.level.io.securecodebox: DEBUG -# Configure which persistence provider you would like to choose -# - none -# - elasticsearch -securecodebox.rest.user.scanner-default: - user-id: defaultScanner - password: scan +securecodebox.rest.user: + scanner: + - username: ' = new ArrayList<>();' + password: '123456' + scanner-default: + user-id: defaultScanner + password: scanner From 84ff0455fbce32d0ea8023acd8d33f9e82ef05c8 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 11 Nov 2019 15:26:29 +0100 Subject: [PATCH 02/13] Replace example user with a non accidentally posted in code snipped --- scb-engine/src/main/resources/application-dev.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scb-engine/src/main/resources/application-dev.yaml b/scb-engine/src/main/resources/application-dev.yaml index baaebbe8..0534e92e 100644 --- a/scb-engine/src/main/resources/application-dev.yaml +++ b/scb-engine/src/main/resources/application-dev.yaml @@ -8,7 +8,7 @@ logging.level.io.securecodebox: DEBUG securecodebox.rest.user: scanner: - - username: ' = new ArrayList<>();' + - username: 'foobar' password: '123456' scanner-default: user-id: defaultScanner From a11433c28f179bd5bd5feb2f85963532b19f0d94 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 11 Nov 2019 16:11:43 +0100 Subject: [PATCH 03/13] Fix spring boot config injection issues A setter was missing for the scanner property of the `ScannerUserConfiguration` class --- .../helper/DefaultUserConfiguration.java | 1 + .../helper/ScannerUserConfiguration.java | 25 +++++++++---------- .../src/main/resources/application-dev.yaml | 2 ++ 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java index e296e13c..146b8065 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java @@ -68,6 +68,7 @@ public void postProcessEngineBuild(final ProcessEngine processEngine) { createGroups(processEngine); setupTechnicalUserForScanner(identityService); + LOG.info("ScannerUsers to create {}", scannerUserConfiguration.getScannerUsers()); for(ScannerUserConfiguration.ScannerUser scannerUser : scannerUserConfiguration.getScannerUsers()){ LOG.info("I'd create a User for with creds '{}:{}' now", scannerUser.getUsername(), scannerUser.getPassword()); } diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java index 390742ee..2181f719 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java @@ -2,44 +2,43 @@ import org.springframework.boot.context.properties.ConfigurationProperties; import org.springframework.context.annotation.Configuration; +import org.springframework.stereotype.Component; import java.util.ArrayList; +import java.util.List; @Configuration @ConfigurationProperties( prefix = "securecodebox.rest.user" ) public class ScannerUserConfiguration { - private ArrayList scanner = new ArrayList<>(); + private List scanner = new ArrayList<>(); public static class ScannerUser { private String username; private String password; - public ScannerUser() {} - - public ScannerUser(String username, String password) { - this.username = username; - this.password = password; - } - public String getUsername() { return username; } - public String getPassword() { - return password; - } - public void setUsername(String username) { this.username = username; } + public String getPassword() { + return password; + } + public void setPassword(String password) { this.password = password; } } - public ArrayList getScannerUsers() { + public List getScannerUsers() { return scanner; } + + public void setScanner(List scanner) { + this.scanner = scanner; + } } diff --git a/scb-engine/src/main/resources/application-dev.yaml b/scb-engine/src/main/resources/application-dev.yaml index 0534e92e..b8f6a7da 100644 --- a/scb-engine/src/main/resources/application-dev.yaml +++ b/scb-engine/src/main/resources/application-dev.yaml @@ -10,6 +10,8 @@ securecodebox.rest.user: scanner: - username: 'foobar' password: '123456' + - username: 'baarfoo' + password: '123456' scanner-default: user-id: defaultScanner password: scanner From 9d54c8f11d2dcf400c314fc7fc6a822a09c44a8a Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 12 Nov 2019 15:52:12 +0100 Subject: [PATCH 04/13] Added support to create groups and group memberships via config --- .../engine/helper/AuthConfiguration.java | 166 ++++++++++++++++++ .../helper/DefaultUserConfiguration.java | 134 +++++++------- .../helper/ScannerUserConfiguration.java | 44 ----- .../src/main/resources/application-dev.yaml | 98 ++++++++++- 4 files changed, 320 insertions(+), 122 deletions(-) create mode 100644 scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java delete mode 100644 scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java new file mode 100644 index 00000000..ac5a045d --- /dev/null +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java @@ -0,0 +1,166 @@ +package io.securecodebox.engine.helper; + +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.context.annotation.Configuration; +import org.springframework.validation.annotation.Validated; + +import javax.validation.constraints.Email; +import javax.validation.constraints.NotEmpty; +import javax.validation.constraints.Pattern; +import java.util.ArrayList; +import java.util.List; + +@Validated +@Configuration +@ConfigurationProperties(prefix = "securecodebox") +public class AuthConfiguration { + + private List users = new ArrayList<>(); + + private List groups = new ArrayList<>(); + + public static class UserConfiguration { + @NotEmpty + // See: https://docs.camunda.org/manual/7.11/update/minor/79-to-710/#whitelist-pattern-for-user-group-and-tenant-ids + // Minus the camunda admin part. As scanner users are never the camunda admin + @Pattern(regexp = "[a-zA-Z0-9]+") + private String id; + @NotEmpty + private String password; + @Email + private String email; + @NotEmpty + private String firstname = "Technical-User"; + @NotEmpty + private String lastname = "Scanner-User"; + private List groups = new ArrayList<>(); + + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public String getPassword() { + return password; + } + + public void setPassword(String password) { + this.password = password; + } + + public String getEmail() { + return email; + } + + public void setEmail(String email) { + this.email = email; + } + + public String getFirstname() { + return firstname; + } + + public void setFirstname(String firstname) { + this.firstname = firstname; + } + + public String getLastname() { + return lastname; + } + + public void setLastname(String lastname) { + this.lastname = lastname; + } + + public List getGroups() { + return groups; + } + + public void setGroups(List groups) { + this.groups = groups; + } + } + + public static class GroupConfiguration { + @NotEmpty + // See: https://docs.camunda.org/manual/7.11/update/minor/79-to-710/#whitelist-pattern-for-user-group-and-tenant-ids + // Minus the camunda admin part. As scanner users are never the camunda admin + @Pattern(regexp = "[a-zA-Z0-9]+") + private String id; + + @NotEmpty + private String name; + + private List authorizations = new ArrayList<>(); + + public static class GroupAuthorizations { + @NotEmpty + private String resource; + + private List permissions = new ArrayList<>(); + + public String getResource() { + return resource; + } + + public void setResource(String resource) { + this.resource = resource; + } + + public List getPermissions() { + return permissions; + } + + public void setPermissions(List permissions) { + this.permissions = permissions; + } + } + + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public String getName() { + return name; + } + + public void setName(String name) { + this.name = name; + } + + public List getAuthorizations() { + return authorizations; + } + + public void setAuthorizations(List authorizations) { + this.authorizations = authorizations; + } + } + + public List getUsers() { + return users; + } + + public void setScanner(List users) { + this.users = users; + } + + public void setUsers(List users) { + this.users = users; + } + + public List getGroups() { + return groups; + } + + public void setGroups(List groups) { + this.groups = groups; + } +} diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java index 146b8065..3ded9b8f 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java @@ -24,7 +24,6 @@ import org.camunda.bpm.engine.ProcessEngine; import org.camunda.bpm.engine.authorization.Authorization; import org.camunda.bpm.engine.authorization.AuthorizationQuery; -import org.camunda.bpm.engine.authorization.Groups; import org.camunda.bpm.engine.authorization.Permission; import org.camunda.bpm.engine.authorization.Permissions; import org.camunda.bpm.engine.authorization.Resource; @@ -37,6 +36,9 @@ import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; +import java.util.List; +import java.util.stream.Collectors; + /** * This configuration file adds a default user for scanner services */ @@ -47,107 +49,101 @@ public class DefaultUserConfiguration extends AbstractCamundaConfiguration { private PropertyValueProvider properties; @Autowired - private ScannerUserConfiguration scannerUserConfiguration; + private AuthConfiguration userConfiguration; private static final Logger LOG = LoggerFactory.getLogger(DefaultUserConfiguration.class); public static final String GROUP_SCANNER = "scanner"; - public static final String GROUP_APPROVER = "approver"; - public static final String GROUP_CI = "continuousIntegration"; - @Override public void postProcessEngineBuild(final ProcessEngine processEngine) { final IdentityService identityService = processEngine.getIdentityService(); - if(identityService.isReadOnly()) { + if (identityService.isReadOnly()) { LOG.warn("Identity service provider is Read Only, not creating any users."); return; } createGroups(processEngine); - setupTechnicalUserForScanner(identityService); - - LOG.info("ScannerUsers to create {}", scannerUserConfiguration.getScannerUsers()); - for(ScannerUserConfiguration.ScannerUser scannerUser : scannerUserConfiguration.getScannerUsers()){ - LOG.info("I'd create a User for with creds '{}:{}' now", scannerUser.getUsername(), scannerUser.getPassword()); - } + createUsers(identityService); } - private void createGroups(final ProcessEngine processEngine){ - createGroup(processEngine.getIdentityService(), GROUP_APPROVER); - - createGroup(processEngine.getIdentityService(), GROUP_SCANNER); - createAuthorizationForGroup( - processEngine.getAuthorizationService(), - GROUP_SCANNER, - Resources.PROCESS_INSTANCE, - Permissions.READ, Permissions.UPDATE - ); - createAuthorizationForGroup( - processEngine.getAuthorizationService(), - GROUP_SCANNER, - Resources.PROCESS_DEFINITION, - Permissions.READ, Permissions.READ_INSTANCE, Permissions.UPDATE_INSTANCE - ); - - createGroup(processEngine.getIdentityService(), GROUP_CI); - createAuthorizationForGroup( - processEngine.getAuthorizationService(), - GROUP_CI, - Resources.PROCESS_DEFINITION, - Permissions.CREATE_INSTANCE, Permissions.READ, Permissions.READ_HISTORY - ); - createAuthorizationForGroup( - processEngine.getAuthorizationService(), - GROUP_CI, - Resources.PROCESS_INSTANCE, - Permissions.READ, Permissions.CREATE - ); + private void createGroups(final ProcessEngine processEngine) { + + for(AuthConfiguration.GroupConfiguration group : userConfiguration.getGroups()){ + createGroup(processEngine.getIdentityService(), group.getId(), group.getName()); + + for (AuthConfiguration.GroupConfiguration.GroupAuthorizations authorization : group.getAuthorizations()){ + createAuthorizationForGroup( + processEngine.getAuthorizationService(), + group.getId(), + Resources.valueOf(authorization.getResource()), + authorization.getPermissions().stream().map(Permissions::forName).collect(Collectors.toList()) + ); + } + } } - private void setupTechnicalUserForScanner(final IdentityService identityService) { + private void createUsers(final IdentityService identityService) { + // Deprecated single User Config final String scannerUserId = properties.getDefaultUserScannerId(); final String scannerUserPw = properties.getDefaultUserScannerPassword(); - if(scannerUserId == null || scannerUserId.isEmpty() || scannerUserPw == null || scannerUserPw.isEmpty()) { + if (scannerUserId == null || scannerUserId.isEmpty() || scannerUserPw == null || scannerUserPw.isEmpty()) { LOG.info("No environment variables provided to create technical user for scanners"); - return; - } - - boolean userForScannersAlreadyExists = identityService.createUserQuery().userId(scannerUserId).count() > 0; - if(userForScannersAlreadyExists){ - LOG.info("Technical user for scanners already exists"); } else { - LOG.info("Creating technical user for scanners"); - LOG.info("User: {}, Password: {}", scannerUserId, scannerUserPw); - createTechnicalUserForScanner(identityService, scannerUserId, scannerUserPw); + AuthConfiguration.UserConfiguration user = new AuthConfiguration.UserConfiguration(); + user.setId(scannerUserId); + user.setPassword(scannerUserPw); + user.setFirstname("Technical-User"); + user.setLastname("Scanner-User"); + createUser(identityService, user); identityService.createMembership(scannerUserId, GROUP_SCANNER); } + + // Newer Multi User Config + for (AuthConfiguration.UserConfiguration user : userConfiguration.getUsers()) { + createUser(identityService, user); + + for (String groupId : user.getGroups()){ + if(identityService.createGroupQuery().groupId(groupId).count() == 0){ + throw new RuntimeException("Tried to add user '" + user.getId() + "' to group '" + groupId + "' but the group doesn't exist. You'll need to change group of the user to a existing group or configure the group in your config."); + } + + identityService.createMembership(user.getId(), groupId); + LOG.info("Added user '{}' to group '{}'", user.getId(), groupId); + } + } } - private void createTechnicalUserForScanner(final IdentityService identityService, final String scannerUserId, final String scannerUserPw) { - User technicalUserForScanner = identityService.newUser(scannerUserId); - technicalUserForScanner.setPassword(scannerUserPw); - technicalUserForScanner.setFirstName("Technical-User"); - technicalUserForScanner.setLastName("Default-Scanner"); + private void createUser(final IdentityService identityService, AuthConfiguration.UserConfiguration user) { + boolean userForScannersAlreadyExists = identityService.createUserQuery().userId(user.getId()).count() > 0; + if (userForScannersAlreadyExists) { + LOG.info("User '{}' already exists", user.getId()); + return; + } + + User newUser = identityService.newUser(user.getId()); + newUser.setEmail(user.getEmail()); + newUser.setPassword(user.getPassword()); + newUser.setFirstName(user.getFirstname()); + newUser.setLastName(user.getLastname()); - identityService.saveUser(technicalUserForScanner); + identityService.saveUser(newUser); } - private void createGroup(IdentityService identityService, String groupId) { - // create group + private void createGroup(IdentityService identityService, String groupId, String groupName) { if (identityService.createGroupQuery().groupId(groupId).count() == 0) { Group group = identityService.newGroup(groupId); - group.setName("SecureCodeBox " + groupId); - group.setType(Groups.GROUP_TYPE_SYSTEM); + group.setName(groupName); + group.setType("secureCodeBox"); identityService.saveGroup(group); - LOG.info("Created default secureCodeBox group: {}", group.getName()); + LOG.info("Created group: {}", group.getName()); } } - private void createAuthorizationForGroup(AuthorizationService authorizationService, String groupId, Resource resource, Permission... permissions){ - if(permissions.length == 0){ + private void createAuthorizationForGroup(AuthorizationService authorizationService, String groupId, Resource resource, List permissions) { + if (permissions.isEmpty()) { throw new IllegalArgumentException("createAuthorizationForGroup needs at least one permission"); } @@ -156,17 +152,17 @@ private void createAuthorizationForGroup(AuthorizationService authorizationServi .groupIdIn(groupId) .resourceType(resource) .resourceId("*"); - for (Permission permission: permissions) { + for (Permission permission : permissions) { authorizationQuery.hasPermission(permission); } long authCounts = authorizationQuery.count(); - if(authCounts == 0){ + if (authCounts == 0) { Authorization auth = authorizationService.createNewAuthorization(Authorization.AUTH_TYPE_GRANT); auth.setGroupId(groupId); auth.setResource(resource); auth.setResourceId("*"); - for (Permission permission: permissions) { + for (Permission permission : permissions) { auth.addPermission(permission); } authorizationService.saveAuthorization(auth); diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java deleted file mode 100644 index 2181f719..00000000 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/ScannerUserConfiguration.java +++ /dev/null @@ -1,44 +0,0 @@ -package io.securecodebox.engine.helper; - -import org.springframework.boot.context.properties.ConfigurationProperties; -import org.springframework.context.annotation.Configuration; -import org.springframework.stereotype.Component; - -import java.util.ArrayList; -import java.util.List; - -@Configuration -@ConfigurationProperties( prefix = "securecodebox.rest.user" ) -public class ScannerUserConfiguration { - - private List scanner = new ArrayList<>(); - - public static class ScannerUser { - private String username; - private String password; - - public String getUsername() { - return username; - } - - public void setUsername(String username) { - this.username = username; - } - - public String getPassword() { - return password; - } - - public void setPassword(String password) { - this.password = password; - } - } - - public List getScannerUsers() { - return scanner; - } - - public void setScanner(List scanner) { - this.scanner = scanner; - } -} diff --git a/scb-engine/src/main/resources/application-dev.yaml b/scb-engine/src/main/resources/application-dev.yaml index b8f6a7da..40b49839 100644 --- a/scb-engine/src/main/resources/application-dev.yaml +++ b/scb-engine/src/main/resources/application-dev.yaml @@ -6,12 +6,92 @@ camunda.bpm: logging.level: DEBUG logging.level.io.securecodebox: DEBUG -securecodebox.rest.user: - scanner: - - username: 'foobar' - password: '123456' - - username: 'baarfoo' - password: '123456' - scanner-default: - user-id: defaultScanner - password: scanner +securecodebox: + tenants: + - id: iteratecInternal + name: 'iteratec Internal' + users: + - id: nmapScanner + password: 'password1' + firstname: 'nmap' + lastname: 'scanner' + groups: ['scanner'] + - id: foobar + email: foo.bar@example.com + password: 'password1' + firstname: 'foo' + lastname: 'bar' + groups: ['user'] + groups: + - id: scanner + name: "secureCodeBox Scanner" + authorizations: + - resource: PROCESS_INSTANCE + permissions: [READ, UPDATE] + - resource: PROCESS_DEFINITION + permissions: [READ, READ_INSTANCE, UPDATE_INSTANCE] + - id: ci + name: "secureCodeBox Continuous Integration" + authorizations: + - resource: PROCESS_DEFINITION + permissions: [CREATE_INSTANCE, READ, READ_HISTORY] + - resource: PROCESS_INSTANCE + permissions: [READ, CREATE] + - id: user + name: "secureCodeBox User" + authorizations: + - resource: APPLICATION + permissions: [ACCESS] + - resource: DASHBOARD + permissions: [ALL] + - resource: DEPLOYMENT + permissions: [READ] + - resource: FILTER + permissions: [ALL] + - resource: PROCESS_DEFINITION + permissions: [CREATE_INSTANCE, READ, READ_HISTORY] + - resource: PROCESS_INSTANCE + permissions: [ALL] + - resource: TASK + permissions: [ALL] + - id: admin + name: "secureCodeBox Admin" + authorizations: + - resource: APPLICATION + permissions: [ALL] + - resource: AUTHORIZATION + permissions: [ALL] + - resource: BATCH + permissions: [ALL] + - resource: DASHBOARD + permissions: [ALL] + - resource: DECISION_DEFINITION + permissions: [ALL] + - resource: DECISION_REQUIREMENTS_DEFINITION + permissions: [ALL] + - resource: FILTER + permissions: [ALL] + - resource: GROUP + permissions: [ALL] + - resource: GROUP_MEMBERSHIP + permissions: [ALL] + - resource: PROCESS_DEFINITION + permissions: [ALL] + - resource: PROCESS_INSTANCE + permissions: [ALL] + - resource: REPORT + permissions: [ALL] + - resource: TASK + permissions: [ALL] + - resource: TENANT + permissions: [ALL] + - resource: TENANT + permissions: [ALL] + - resource: TENANT_MEMBERSHIP + permissions: [ALL] + - resource: USER + permissions: [ALL] + rest.user: + scanner-default: + user-id: defaultScanner + password: scanner From c6e9790bbf01013f6ef88305ad4a694035eb0655 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 12 Nov 2019 15:56:34 +0100 Subject: [PATCH 05/13] Move group creation part into user creation method --- .../helper/DefaultUserConfiguration.java | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java index 3ded9b8f..e5957476 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java @@ -53,8 +53,6 @@ public class DefaultUserConfiguration extends AbstractCamundaConfiguration { private static final Logger LOG = LoggerFactory.getLogger(DefaultUserConfiguration.class); - public static final String GROUP_SCANNER = "scanner"; - @Override public void postProcessEngineBuild(final ProcessEngine processEngine) { final IdentityService identityService = processEngine.getIdentityService(); @@ -97,22 +95,13 @@ private void createUsers(final IdentityService identityService) { user.setPassword(scannerUserPw); user.setFirstname("Technical-User"); user.setLastname("Scanner-User"); + user.getGroups().add("scanner"); createUser(identityService, user); - identityService.createMembership(scannerUserId, GROUP_SCANNER); } // Newer Multi User Config for (AuthConfiguration.UserConfiguration user : userConfiguration.getUsers()) { createUser(identityService, user); - - for (String groupId : user.getGroups()){ - if(identityService.createGroupQuery().groupId(groupId).count() == 0){ - throw new RuntimeException("Tried to add user '" + user.getId() + "' to group '" + groupId + "' but the group doesn't exist. You'll need to change group of the user to a existing group or configure the group in your config."); - } - - identityService.createMembership(user.getId(), groupId); - LOG.info("Added user '{}' to group '{}'", user.getId(), groupId); - } } } @@ -130,6 +119,15 @@ private void createUser(final IdentityService identityService, AuthConfiguration newUser.setLastName(user.getLastname()); identityService.saveUser(newUser); + + for (String groupId : user.getGroups()){ + if(identityService.createGroupQuery().groupId(groupId).count() == 0){ + throw new RuntimeException("Tried to add user '" + user.getId() + "' to group '" + groupId + "' but the group doesn't exist. You'll need to change group of the user to a existing group or configure the group in your config."); + } + + identityService.createMembership(user.getId(), groupId); + LOG.info("Added user '{}' to group '{}'", user.getId(), groupId); + } } private void createGroup(IdentityService identityService, String groupId, String groupName) { From 4fb402c8a5d57910afc3795444299d3cee62e4ba Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 12 Nov 2019 16:20:53 +0100 Subject: [PATCH 06/13] Add tenant config --- .../engine/helper/AuthConfiguration.java | 45 +++++++++++++++++++ .../helper/DefaultUserConfiguration.java | 32 ++++++++++--- .../src/main/resources/application-dev.yaml | 6 ++- 3 files changed, 74 insertions(+), 9 deletions(-) diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java index ac5a045d..d279b679 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/AuthConfiguration.java @@ -19,6 +19,8 @@ public class AuthConfiguration { private List groups = new ArrayList<>(); + private List tenants = new ArrayList<>(); + public static class UserConfiguration { @NotEmpty // See: https://docs.camunda.org/manual/7.11/update/minor/79-to-710/#whitelist-pattern-for-user-group-and-tenant-ids @@ -34,6 +36,7 @@ public static class UserConfiguration { @NotEmpty private String lastname = "Scanner-User"; private List groups = new ArrayList<>(); + private List tenants = new ArrayList<>(); public String getId() { return id; @@ -82,6 +85,14 @@ public List getGroups() { public void setGroups(List groups) { this.groups = groups; } + + public List getTenants() { + return tenants; + } + + public void setTenants(List tenants) { + this.tenants = tenants; + } } public static class GroupConfiguration { @@ -144,6 +155,32 @@ public void setAuthorizations(List authorizations) { } } + public static class TenantConfiguration { + @NotEmpty + // See: https://docs.camunda.org/manual/7.11/update/minor/79-to-710/#whitelist-pattern-for-user-group-and-tenant-ids + // Minus the camunda admin part. As scanner users are never the camunda admin + @Pattern(regexp = "[a-zA-Z0-9]+") + private String id; + @NotEmpty + private String name; + + public String getId() { + return id; + } + + public void setId(String id) { + this.id = id; + } + + public String getName() { + return name; + } + + public void setName(String name) { + this.name = name; + } + } + public List getUsers() { return users; } @@ -163,4 +200,12 @@ public List getGroups() { public void setGroups(List groups) { this.groups = groups; } + + public List getTenants() { + return tenants; + } + + public void setTenants(List tenants) { + this.tenants = tenants; + } } diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java index e5957476..b6918ea2 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java @@ -29,6 +29,7 @@ import org.camunda.bpm.engine.authorization.Resource; import org.camunda.bpm.engine.authorization.Resources; import org.camunda.bpm.engine.identity.Group; +import org.camunda.bpm.engine.identity.Tenant; import org.camunda.bpm.engine.identity.User; import org.camunda.bpm.spring.boot.starter.configuration.impl.AbstractCamundaConfiguration; import org.slf4j.Logger; @@ -58,14 +59,26 @@ public void postProcessEngineBuild(final ProcessEngine processEngine) { final IdentityService identityService = processEngine.getIdentityService(); if (identityService.isReadOnly()) { - LOG.warn("Identity service provider is Read Only, not creating any users."); + LOG.warn("Identity service provider is ReadOnly, not creating any users."); return; } createGroups(processEngine); + createTenants(identityService); createUsers(identityService); } + private void createTenants(IdentityService identityService) { + for(AuthConfiguration.TenantConfiguration tenant : userConfiguration.getTenants()){ + if(identityService.createTenantQuery().tenantId(tenant.getId()).count() == 0){ + Tenant newTenant = identityService.newTenant(tenant.getId()); + newTenant.setName(tenant.getName()); + identityService.saveTenant(newTenant); + LOG.info("Created tenant {}", tenant.getId()); + } + } + } + private void createGroups(final ProcessEngine processEngine) { for(AuthConfiguration.GroupConfiguration group : userConfiguration.getGroups()){ @@ -122,12 +135,21 @@ private void createUser(final IdentityService identityService, AuthConfiguration for (String groupId : user.getGroups()){ if(identityService.createGroupQuery().groupId(groupId).count() == 0){ - throw new RuntimeException("Tried to add user '" + user.getId() + "' to group '" + groupId + "' but the group doesn't exist. You'll need to change group of the user to a existing group or configure the group in your config."); + throw new RuntimeException("Tried to add user '" + user.getId() + "' to group '" + groupId + "' but the group doesn't exist. You'll need to change group of the user to a existing group or configure the group in your config so it'll get created."); } identityService.createMembership(user.getId(), groupId); LOG.info("Added user '{}' to group '{}'", user.getId(), groupId); } + + for(String tenantId : user.getTenants()){ + if(identityService.createTenantQuery().tenantId(tenantId).count() == 0){ + throw new RuntimeException("Tried to add user '" + user.getId() + "' to tenant '" + tenantId + "' but the tenant doesn't exist. You'll need to change tenant of the user to a existing tenant or configure the tenant in your config so it'll get created."); + } + + identityService.createTenantUserMembership(tenantId, user.getId()); + LOG.info("Added user '{}' to tenant '{}'", user.getId(), tenantId); + } } private void createGroup(IdentityService identityService, String groupId, String groupName) { @@ -141,10 +163,6 @@ private void createGroup(IdentityService identityService, String groupId, String } private void createAuthorizationForGroup(AuthorizationService authorizationService, String groupId, Resource resource, List permissions) { - if (permissions.isEmpty()) { - throw new IllegalArgumentException("createAuthorizationForGroup needs at least one permission"); - } - AuthorizationQuery authorizationQuery = authorizationService .createAuthorizationQuery() .groupIdIn(groupId) @@ -165,7 +183,7 @@ private void createAuthorizationForGroup(AuthorizationService authorizationServi } authorizationService.saveAuthorization(auth); - LOG.info("Created Authorization for Group {}", groupId); + LOG.info("Created authorization for group {}", groupId); } } } diff --git a/scb-engine/src/main/resources/application-dev.yaml b/scb-engine/src/main/resources/application-dev.yaml index 40b49839..6f1c1aa4 100644 --- a/scb-engine/src/main/resources/application-dev.yaml +++ b/scb-engine/src/main/resources/application-dev.yaml @@ -8,20 +8,22 @@ logging.level.io.securecodebox: DEBUG securecodebox: tenants: - - id: iteratecInternal - name: 'iteratec Internal' + - id: companyInternal + name: 'company Internal' users: - id: nmapScanner password: 'password1' firstname: 'nmap' lastname: 'scanner' groups: ['scanner'] + tenants: [] - id: foobar email: foo.bar@example.com password: 'password1' firstname: 'foo' lastname: 'bar' groups: ['user'] + tenants: ['companyInternal'] groups: - id: scanner name: "secureCodeBox Scanner" From b5ed2218b044d178a530b3772a4cf44562de8f26 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 12 Nov 2019 16:24:19 +0100 Subject: [PATCH 07/13] Refactore variable name --- .../engine/helper/DefaultUserConfiguration.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java index b6918ea2..69edd86d 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java @@ -50,7 +50,7 @@ public class DefaultUserConfiguration extends AbstractCamundaConfiguration { private PropertyValueProvider properties; @Autowired - private AuthConfiguration userConfiguration; + private AuthConfiguration authConfiguration; private static final Logger LOG = LoggerFactory.getLogger(DefaultUserConfiguration.class); @@ -69,7 +69,7 @@ public void postProcessEngineBuild(final ProcessEngine processEngine) { } private void createTenants(IdentityService identityService) { - for(AuthConfiguration.TenantConfiguration tenant : userConfiguration.getTenants()){ + for(AuthConfiguration.TenantConfiguration tenant : authConfiguration.getTenants()){ if(identityService.createTenantQuery().tenantId(tenant.getId()).count() == 0){ Tenant newTenant = identityService.newTenant(tenant.getId()); newTenant.setName(tenant.getName()); @@ -81,7 +81,7 @@ private void createTenants(IdentityService identityService) { private void createGroups(final ProcessEngine processEngine) { - for(AuthConfiguration.GroupConfiguration group : userConfiguration.getGroups()){ + for(AuthConfiguration.GroupConfiguration group : authConfiguration.getGroups()){ createGroup(processEngine.getIdentityService(), group.getId(), group.getName()); for (AuthConfiguration.GroupConfiguration.GroupAuthorizations authorization : group.getAuthorizations()){ @@ -113,7 +113,7 @@ private void createUsers(final IdentityService identityService) { } // Newer Multi User Config - for (AuthConfiguration.UserConfiguration user : userConfiguration.getUsers()) { + for (AuthConfiguration.UserConfiguration user : authConfiguration.getUsers()) { createUser(identityService, user); } } From 83555c50140d53d9ae66f4e718db1b4b12d4298a Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 13 Nov 2019 13:45:02 +0100 Subject: [PATCH 08/13] Create basic groups by default --- .../src/main/resources/application.yaml | 81 +++++++++++++++++-- 1 file changed, 76 insertions(+), 5 deletions(-) diff --git a/scb-engine/src/main/resources/application.yaml b/scb-engine/src/main/resources/application.yaml index cc7cd809..f09ae36e 100644 --- a/scb-engine/src/main/resources/application.yaml +++ b/scb-engine/src/main/resources/application.yaml @@ -60,8 +60,79 @@ securecodebox.default.context: BodgeIT # - none securecodebox.rest.auth: basic auth -# Configure a technical user for the scanner services. This user allows the scanner services to authenticate on the engines rest api. -# (If not set as environment variable, a user has to be added manually in the camunda ui.) -securecodebox.rest.user.scanner-default: - user-id: ${SECURECODEBOX_USER_SCANNER:} - password: ${SECURECODEBOX_USER_SCANNER_PW:} +securecodebox: + tenants: [] + users: [] + groups: + - id: scanner + name: "secureCodeBox Scanner" + authorizations: + - resource: PROCESS_INSTANCE + permissions: [READ, UPDATE] + - resource: PROCESS_DEFINITION + permissions: [READ, READ_INSTANCE, UPDATE_INSTANCE] + - id: ci + name: "secureCodeBox Continuous Integration" + authorizations: + - resource: PROCESS_DEFINITION + permissions: [CREATE_INSTANCE, READ, READ_HISTORY] + - resource: PROCESS_INSTANCE + permissions: [READ, CREATE] + - id: user + name: "secureCodeBox User" + authorizations: + - resource: APPLICATION + permissions: [ACCESS] + - resource: DASHBOARD + permissions: [ALL] + - resource: DEPLOYMENT + permissions: [READ] + - resource: FILTER + permissions: [ALL] + - resource: PROCESS_DEFINITION + permissions: [CREATE_INSTANCE, READ, READ_HISTORY] + - resource: PROCESS_INSTANCE + permissions: [ALL] + - resource: TASK + permissions: [ALL] + - id: admin + name: "secureCodeBox Admin" + authorizations: + - resource: APPLICATION + permissions: [ALL] + - resource: AUTHORIZATION + permissions: [ALL] + - resource: BATCH + permissions: [ALL] + - resource: DASHBOARD + permissions: [ALL] + - resource: DECISION_DEFINITION + permissions: [ALL] + - resource: DECISION_REQUIREMENTS_DEFINITION + permissions: [ALL] + - resource: FILTER + permissions: [ALL] + - resource: GROUP + permissions: [ALL] + - resource: GROUP_MEMBERSHIP + permissions: [ALL] + - resource: PROCESS_DEFINITION + permissions: [ALL] + - resource: PROCESS_INSTANCE + permissions: [ALL] + - resource: REPORT + permissions: [ALL] + - resource: TASK + permissions: [ALL] + - resource: TENANT + permissions: [ALL] + - resource: TENANT + permissions: [ALL] + - resource: TENANT_MEMBERSHIP + permissions: [ALL] + - resource: USER + permissions: [ALL] + rest.user: + scanner-default: + user-id: ${SECURECODEBOX_USER_SCANNER:} + password: ${SECURECODEBOX_USER_SCANNER_PW:} From 2d724665ce8d6c84e0f0579755c8e505becf0ab7 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Thu, 14 Nov 2019 12:02:55 +0100 Subject: [PATCH 09/13] Mark the config folder as an explicit volume in the docker file --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index 52e2df74..795e2164 100644 --- a/Dockerfile +++ b/Dockerfile @@ -52,4 +52,6 @@ LABEL org.opencontainers.image.title="secureCodeBox Engine" \ org.opencontainers.image.revision=$COMMIT_ID \ org.opencontainers.image.created=$BUILD_DATE +VOLUME ["/scb-engine/config"] + ENTRYPOINT ["./init.sh"] From ee4c96e412ca3af18172c527abf43ba4e2e97e22 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Thu, 14 Nov 2019 12:04:45 +0100 Subject: [PATCH 10/13] Correct depracation replacement --- .../io/securecodebox/engine/helper/PropertyValueProvider.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java index 9be7bacf..a930f19c 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java @@ -59,7 +59,7 @@ public String getDefaultTargetUri() { } @DeprecatedConfigurationProperty( - replacement = "securecodebox.rest.user.scanner", + replacement = "securecodebox.users", reason = "Using the new property multiple users can be configured, which is more flexible than only being able to create one." ) String getDefaultUserScannerId() { @@ -67,7 +67,7 @@ String getDefaultUserScannerId() { } @DeprecatedConfigurationProperty( - replacement = "securecodebox.rest.user.scanner", + replacement = "securecodebox.users", reason = "Using the new property multiple users can be configured, which is more flexible than only being able to create one." ) String getDefaultUserScannerPassword() { From 718a1a27af8357dcfc931e0653c604af7ff8ab47 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 19 Nov 2019 14:27:15 +0100 Subject: [PATCH 11/13] Add custom error type --- .../engine/helper/DefaultUserConfiguration.java | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java index 69edd86d..45801872 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/DefaultUserConfiguration.java @@ -135,7 +135,7 @@ private void createUser(final IdentityService identityService, AuthConfiguration for (String groupId : user.getGroups()){ if(identityService.createGroupQuery().groupId(groupId).count() == 0){ - throw new RuntimeException("Tried to add user '" + user.getId() + "' to group '" + groupId + "' but the group doesn't exist. You'll need to change group of the user to a existing group or configure the group in your config so it'll get created."); + throw new UserConfigurationError("Tried to add user '" + user.getId() + "' to group '" + groupId + "' but the group doesn't exist. You'll need to change group of the user to a existing group or configure the group in your config so it'll get created."); } identityService.createMembership(user.getId(), groupId); @@ -144,7 +144,7 @@ private void createUser(final IdentityService identityService, AuthConfiguration for(String tenantId : user.getTenants()){ if(identityService.createTenantQuery().tenantId(tenantId).count() == 0){ - throw new RuntimeException("Tried to add user '" + user.getId() + "' to tenant '" + tenantId + "' but the tenant doesn't exist. You'll need to change tenant of the user to a existing tenant or configure the tenant in your config so it'll get created."); + throw new UserConfigurationError("Tried to add user '" + user.getId() + "' to tenant '" + tenantId + "' but the tenant doesn't exist. You'll need to change tenant of the user to a existing tenant or configure the tenant in your config so it'll get created."); } identityService.createTenantUserMembership(tenantId, user.getId()); @@ -186,4 +186,10 @@ private void createAuthorizationForGroup(AuthorizationService authorizationServi LOG.info("Created authorization for group {}", groupId); } } + + private static class UserConfigurationError extends RuntimeException { + public UserConfigurationError(String msg){ + super(msg); + } + } } From 956fbd2712e138d14f64e99e5a562436e12e3afe Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 19 Nov 2019 14:27:55 +0100 Subject: [PATCH 12/13] Stop codacy from yelling --- .../io/securecodebox/engine/helper/PropertyValueProvider.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java b/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java index a930f19c..17a5d464 100644 --- a/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java +++ b/scb-engine/src/main/java/io/securecodebox/engine/helper/PropertyValueProvider.java @@ -62,7 +62,7 @@ public String getDefaultTargetUri() { replacement = "securecodebox.users", reason = "Using the new property multiple users can be configured, which is more flexible than only being able to create one." ) - String getDefaultUserScannerId() { + public String getDefaultUserScannerId() { return defaultUserScannerId; } @@ -70,7 +70,7 @@ String getDefaultUserScannerId() { replacement = "securecodebox.users", reason = "Using the new property multiple users can be configured, which is more flexible than only being able to create one." ) - String getDefaultUserScannerPassword() { + public String getDefaultUserScannerPassword() { return defaultUserScannerPassword; } } From 07ed891ca3897fb115ae2fab6ba8112ec9d7d971 Mon Sep 17 00:00:00 2001 From: J12934 <13718901+J12934@users.noreply.github.com> Date: Mon, 13 Jan 2020 14:13:38 +0100 Subject: [PATCH 13/13] Add link to camunda authentication resources and permission types --- scb-engine/src/main/resources/application.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scb-engine/src/main/resources/application.yaml b/scb-engine/src/main/resources/application.yaml index f09ae36e..332d6776 100644 --- a/scb-engine/src/main/resources/application.yaml +++ b/scb-engine/src/main/resources/application.yaml @@ -63,6 +63,8 @@ securecodebox.rest.auth: basic auth securecodebox: tenants: [] users: [] + # Documentation on Authorization resources and permission of Camunda types are documented here: + # https://docs.camunda.org/manual/7.12/user-guide/process-engine/authorization-service/#basic-principles groups: - id: scanner name: "secureCodeBox Scanner"