Skip to content

Commit 8444ca8

Browse files
banterCZbanterCZ
authored
Merge pull request #1196 from wultra/develop
Merge develop to master
2 parents 30bfa16 + 1a0d0e0 commit 8444ca8

File tree

97 files changed

+2831
-883
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

97 files changed

+2831
-883
lines changed

‎.github/workflows/scp-deploy.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Run SCP deploy
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
scp-deploy:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/checkout@v3
11+
- name: Set up JDK 17
12+
uses: actions/setup-java@v3
13+
with:
14+
java-version: 17
15+
distribution: 'temurin'
16+
server-id: jfrog-central
17+
server-username: INTERNAL_USERNAME
18+
server-password: INTERNAL_PASSWORD
19+
cache: maven
20+
- name: Run Maven Package Step
21+
run: |
22+
mvn -B -U package -Dmaven.test.skip=true
23+
env:
24+
INTERNAL_USERNAME: ${{ secrets.JFROG_USERNAME }}
25+
INTERNAL_PASSWORD: ${{ secrets.JFROG_PASSWORD }}
26+
- name: Set up SSH key
27+
run: |
28+
mkdir -p ~/.ssh
29+
echo "${{ secrets.SCP_CERTIFICATE }}" > ~/.ssh/id_rsa
30+
chmod 600 ~/.ssh/id_rsa
31+
ssh-keyscan -t rsa ${{ secrets.SCP_HOST }} >> ~/.ssh/known_hosts
32+
- name: Deploy powerauth-java-server.war
33+
shell: bash
34+
run: |
35+
scp -i ~/.ssh/id_rsa **/target/powerauth-java-server-*.war ${{ secrets.SCP_USERNAME }}@${{ secrets.SCP_HOST }}:/opt/apache-tomcat/webapps/powerauth-java-server.war
36+
- name: Deploy powerauth-admin.war
37+
shell: bash
38+
run: |
39+
scp -i ~/.ssh/id_rsa **/target/powerauth-admin-*.war ${{ secrets.SCP_USERNAME }}@${{ secrets.SCP_HOST }}:/opt/apache-tomcat/webapps/powerauth-admin.war

‎docs-private/Developer-How-To-Start.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,13 @@ Others (like URL, username, password) depend on your environment.
2121

2222
```shell
2323
liquibase --changelog-file=./docs/db/changelog/changesets/powerauth-java-server/db.changelog-module.xml --url=jdbc:postgresql://localhost:5432/powerauth --username=powerauth status
24-
```
24+
```
25+
26+
To generate SQL script run this command.
27+
28+
```shell
29+
liquibase --changeLogFile=./docs/db/changelog/changesets/powerauth-java-server/db.changelog-module.xml --output-file=./docs/sql/oracle/generated-oracle-script.sql updateSQL --url=offline:oracle
30+
```
2531

2632

2733
## PowerAuth Admin Server

‎docs/Configuration-Properties-Admin.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,9 @@ The PowerAuth Admin application uses the following public configuration properti
3838
| `powerauth.admin.security.ldap.ldif` | `_empty_` | Specifies an ldif to load at startup for an embedded LDAP server. |
3939
| `powerauth.admin.security.ldap.managerDN` | `_empty_` | Username (DN) of the "manager" user identity (i.e. "uid=admin,ou=system") which will be used to authenticate to a (non-embedded) LDAP server. If omitted, anonymous access will be used. |
4040
| `powerauth.admin.security.ldap.managerPassword` | `_empty_` | The password for the manager DN. This is required if the `managerDN` property is set. |
41+
42+
43+
## Monitoring and Observability
44+
45+
The WAR file includes the `micrometer-registry-prometheus` dependency.
46+
Discuss its configuration with the [Spring Boot documentation](https://docs.spring.io/spring-boot/docs/3.1.x/reference/html/actuator.html#actuator.metrics).

‎docs/Configuration-Properties.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ The PowerAuth Server uses the following public configuration properties:
1010
| `spring.datasource.username` | `powerauth` | Database JDBC username |
1111
| `spring.datasource.password` | `_empty_` | Database JDBC password |
1212
| `spring.datasource.driver-class-name` | `org.postgresql.Driver` | Datasource JDBC class name |
13-
| `spring.jpa.database-platform` | `org.hibernate.dialect.PostgreSQLDialect` | Database dialect |
1413
| `spring.jpa.hibernate.ddl-auto` | `none` | Configuration of automatic database schema creation |
1514
| `spring.jpa.properties.hibernate.connection.characterEncoding` | `utf8` | Character encoding |
1615
| `spring.jpa.properties.hibernate.connection.useUnicode` | `true` | Character encoding - Unicode support |
@@ -38,7 +37,7 @@ The PowerAuth Server uses the following public configuration properties:
3837
| `powerauth.service.secureVault.enableBiometricAuthentication` | `false` | Whether biometric authentication is enabled when accessing Secure Vault |
3938
| `powerauth.server.db.master.encryption.key` | `_empty_` | Master DB encryption key for decryption of server private key in database |
4039
| `powerauth.service.proximity-check.otp.length` | `8` | Length of OTP generated for proximity check |
41-
| `powerauth.service.pagination.default-page-size` | `100` | The default number of records per page when paginated results are requested |
40+
| `powerauth.service.pagination.default-page-size` | `500` | The default number of records per page when paginated results are requested |
4241
| `powerauth.service.pagination.default-page-number` | `0` | The default page number when paginated results are requested. Page numbers start from 0 |
4342

4443
## HTTP Configuration
@@ -69,3 +68,9 @@ The PowerAuth Server uses the following public configuration properties:
6968
| `powerauth.service.correlation-header.name` | `X-Correlation-ID` | Correlation header name |
7069
| `powerauth.service.correlation-header.value.validation-regexp` | `[a-zA-Z0-9\\-]{8,1024}` | Regular expression for correlation header value validation |
7170
| `logging.pattern.console` | [See value in application.properties](https://github.com/wultra/powerauth-server/blob/develop/powerauth-java-server/src/main/resources/application.properties#docucheck-keep-link) | Logging pattern for console which includes the correlation header value |
71+
72+
73+
## Monitoring and Observability
74+
75+
The WAR file includes the `micrometer-registry-prometheus` dependency.
76+
Discuss its configuration with the [Spring Boot documentation](https://docs.spring.io/spring-boot/docs/3.1.x/reference/html/actuator.html#actuator.metrics).

‎docs/Deploying-PowerAuth-Server.md

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ spring.datasource.url=jdbc:postgresql://localhost:5432/powerauth
4343
spring.datasource.username=powerauth
4444
spring.datasource.password=
4545
spring.datasource.driver-class-name=org.postgresql.Driver
46-
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
4746
spring.jpa.hibernate.ddl-auto=none
4847
spring.jpa.properties.hibernate.connection.characterEncoding=utf8
4948
spring.jpa.properties.hibernate.connection.useUnicode=true
@@ -59,7 +58,6 @@ spring.datasource.url=jdbc:oracle:thin:@//[HOST]:[PORT]/[SERVICENAME]
5958
spring.datasource.username=powerauth
6059
spring.datasource.password=*********
6160
spring.datasource.driver-class-name=oracle.jdbc.driver.OracleDriver
62-
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
6361
spring.jpa.hibernate.ddl-auto=none
6462
```
6563

@@ -71,7 +69,6 @@ spring.datasource.url=jdbc:postgresql://[HOST]:[PORT]/[DATABASE]
7169
spring.datasource.username=powerauth
7270
spring.datasource.password=*********
7371
spring.datasource.driver-class-name=org.postgresql.Driver
74-
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
7572
spring.jpa.hibernate.ddl-auto=none
7673
```
7774

@@ -140,7 +137,6 @@ You can specify the individual properties directly in the server configuration.
140137
<Parameter name="spring.datasource.username" value="powerauth"/>
141138
<Parameter name="spring.datasource.password" value=""/>
142139
<Parameter name="spring.datasource.driver-class-name" value="org.postgresql.Driver"/>
143-
<Parameter name="spring.jpa.database-platform" value="org.hibernate.dialect.PostgreSQLDialect"/>
144140
</Context>
145141
```
146142

@@ -162,7 +158,6 @@ spring.datasource.url=jdbc:postgresql://localhost:5432/powerauth
162158
spring.datasource.username=powerauth
163159
spring.datasource.password=
164160
spring.datasource.driver-class-name=org.postgresql.Driver
165-
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
166161
```
167162

168163
## Generating Your First Application

‎docs/Deploying-Wildfly.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,6 @@ spring.datasource.url=jdbc:oracle:thin:@//[host]:[port]/[servicename]
9797
spring.datasource.username=powerauth
9898
spring.datasource.password=powerauth
9999
spring.datasource.driver-class-name=oracle.jdbc.driver.OracleDriver
100-
spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
101100
102101
# Application Service Configuration
103102
powerauth.service.applicationEnvironment=TEST

‎docs/Installing-Bouncy-Castle.md

Lines changed: 0 additions & 166 deletions
Original file line numberDiff line numberDiff line change
@@ -1,169 +1,3 @@
11
# Installing Bouncy Castle
22

33
Since PowerAuth Server in version 1.1.x, installing the Bouncy Castle in OS or Java container is no longer required. The latest version is bundled with the app and cryptographic primitives should work out of the box.
4-
5-
## Legacy: Installing Before 1.1.x
6-
7-
In order to function correctly, PowerAuth software requires Bouncy Castle to be available.
8-
9-
Bouncy Castle library installation depends on Java version and used web container.
10-
11-
PowerAuth server uses dynamic initialization of Bouncy Castle provider, so it is not required to configure security provider statically in the Java Runtime configuration.
12-
13-
You can get the Bouncy Castle provider here:
14-
https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on
15-
16-
### Installing on Java 11
17-
18-
Java 11 no longer provides a library extension mechanism and thus Bouncy Castle library must be installed in the web container.
19-
20-
#### Bouncy Castle on Tomcat
21-
22-
Copy [`bcprov-jdk18on-176.jar`](https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on) to your `${CATALINA_HOME}/lib` folder.
23-
24-
<!-- begin box warning -->
25-
Bouncy Castle library will not work properly in case any war file deployed to Tomcat contains another copy of the Bouncy Castle library, even if the war file is not related to PowerAuth.
26-
Bouncy Castle library must be only present in the `${CATALINA_HOME}/lib` folder. The `key spec not recognized` error message will appear in Tomcat log in this case.
27-
<!-- end -->
28-
29-
#### Bouncy Castle on JBoss / Wildfly
30-
31-
PowerAuth server requires a specific version of Bouncy Castle library: `bcprov-jdk18on-176.jar`
32-
33-
In order to make PowerAuth Server work on JBoss / Wildfly, you need to add and enable the external Bouncy Castle module on the server
34-
by adding the `<global-modules>` element in the `standalone.xml` file:
35-
36-
```xml
37-
<subsystem xmlns="urn:jboss:domain:ee:4.0">
38-
<global-modules>
39-
<module name="org.bouncycastle.external" slot="main"/>
40-
</global-modules>
41-
</subsystem>
42-
```
43-
44-
The module should be defined using a new module XML file in JBoss folder `modules/system/layers/base/org/bouncycastle/external/main`:
45-
```xml
46-
<?xml version="1.0" encoding="UTF-8"?>
47-
<module name="org.bouncycastle.external" xmlns="urn:jboss:module:1.8">
48-
<resources>
49-
<resource-root path="bcprov-jdk18on-176.jar"/>
50-
</resources>
51-
</module>
52-
```
53-
54-
Finally, copy the Bouncy Castle library `bcprov-jdk18on-176.jar` into folder `modules/system/layers/base/org/bouncycastle/external/main` so that it is available for the module.
55-
56-
<!-- begin box warning -->
57-
Do not reuse Bouncy Castle module `org.bouncycastle` from JBoss, because version of library provided by JBoss may differ from version required by PowerAuth.
58-
<!-- end -->
59-
60-
#### Testing the Installation
61-
62-
You can test the installation in web container using our simple [bc-check.war application](https://github.com/wultra/powerauth-crypto/releases/download/0.23.0/check-bc.war).
63-
64-
The application performs following checks after startup:
65-
- Check whether BC provider is correctly installed.
66-
- Generate an ECSDA keypair.
67-
- Compute and validate an ECSDA signature.
68-
69-
Once you deploy the application to the web container, you should see following messages in container log:
70-
```
71-
BC provider is installed.
72-
ECSDA signature validation succeeded.
73-
```
74-
75-
In case of any error or different output, please check the troubleshooting guide below.
76-
77-
### Installing on Java 8
78-
79-
Java 8 provides a library extension mechanism which can be used to installed Bouncy Castle with exception of JBoss / Wildfly which has it's own mechanism for installing Bouncy Castle.
80-
81-
#### Bouncy Castle on Tomcat
82-
83-
##### Standalone Tomcat
84-
85-
When running a standalone Tomcat instance, all you need to do is to copy [`bcprov-jdk18on-176.jar`](https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on) to your `${JDK_HOME}/jre/lib/ext` folder.
86-
87-
##### Embedded Tomcat
88-
89-
In case you are running Spring Boot application with the embedded Tomcat server, you also might need to register the provider in the Java security configuration file. To do this, add a new line to `$JAVA_HOME/jre/lib/security/java.security` and enable Bouncy Castle security provider on a system level:
90-
91-
```
92-
security.provider.N=org.bouncycastle.jce.provider.BouncyCastleProvider
93-
```
94-
95-
Make sure to add the provider to the top of the list (ideally, N=2).
96-
97-
#### Bouncy Castle on JBoss / Wildfly
98-
99-
PowerAuth server requires a specific version of Bouncy Castle library: `bcprov-jdk18on-176.jar`
100-
101-
In order to make PowerAuth Server work on JBoss / Wildfly, you need to add and enable the external Bouncy Castle module on the server
102-
by adding the `<global-modules>` element in the `standalone.xml` file:
103-
104-
```xml
105-
<subsystem xmlns="urn:jboss:domain:ee:4.0">
106-
<global-modules>
107-
<module name="org.bouncycastle.external" slot="main"/>
108-
</global-modules>
109-
</subsystem>
110-
```
111-
112-
The module should be defined using a new module XML file in JBoss folder `modules/system/layers/base/org/bouncycastle/external/main`:
113-
```xml
114-
<?xml version="1.0" encoding="UTF-8"?>
115-
<module name="org.bouncycastle.external" xmlns="urn:jboss:module:1.8">
116-
<resources>
117-
<resource-root path="bcprov-jdk18on-176.jar"/>
118-
</resources>
119-
</module>
120-
```
121-
122-
Finally, copy the Bouncy Castle library `bcprov-jdk18on-176.jar` into folder `modules/system/layers/base/org/bouncycastle/external/main` so that it is available for the module.
123-
124-
<!-- begin box warning -->
125-
Do not reuse Bouncy Castle module `org.bouncycastle` from JBoss, because version of library provided by JBoss may differ from version required by PowerAuth.
126-
<!-- end -->
127-
128-
Note that when Bouncy Castle module for JBoss / Wildfly is used, Bouncy Castle should not be present in the `lib/ext` folder of the Java runtime, otherwise the following error can occur: `key spec not recognized` due to clash of Bouncy Castle libraries.
129-
130-
#### Testing the Installation
131-
132-
You can test the installation using our [simple Java utility](./util/check-bc.jar):
133-
134-
```sh
135-
$ java -jar check-bc.jar
136-
```
137-
138-
The utility uses following source code to check the provider installation:
139-
140-
```java
141-
import java.security.Security;
142-
143-
public class SimpleTest
144-
{
145-
public static void main(String[] args)
146-
{
147-
String name = "BC";
148-
if (Security.getProvider(name) == null)
149-
{
150-
System.out.println("not installed");
151-
}
152-
else
153-
{
154-
System.out.println("installed");
155-
}
156-
}
157-
}
158-
```
159-
160-
## Troubleshooting Bouncy Castle Installation Issues
161-
162-
In case you get the following error: `key spec not recognized`, there are possible issues:
163-
164-
- Tomcat on Java 11: Check that Bouncy Castle library is installed in `${CATALINA_HOME}/lib`.
165-
- Tomcat on Java 8: Check that Bouncy Castle library is installed in `${JDK_HOME}/jre/lib/ext` and it is not present in `${CATALINA_HOME}/lib`.
166-
- JBoss / Wildfly on Java 11: Check that Bouncy Castle library is installed as a module in JBoss / Wildfly.
167-
- JBoss / Wildfly on Java 8: Check that Bouncy Castle library is not installed in `${JDK_HOME}/jre/lib/ext` and it is installed as an external module in JBoss / Wildfly.
168-
- All containers on Java 8/11: Check that none of the deployed war files contains Bouncy Castle library, even if the war file is not related to PowerAuth.
169-
Another copy of Bouncy Castle library would clash with the globally installed version of the library. This rule applies only for PowerAuth `2019.05` or later.

‎docs/Migration-Instructions.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ This page contains PowerAuth Server migration instructions.
66
When updating across multiple versions, you need to perform all migration steps additively.
77
<!-- end -->
88

9+
- [PowerAuth Server 1.6.0](./PowerAuth-Server-1.6.0.md)
910
- [PowerAuth Server 1.5.0](./PowerAuth-Server-1.5.0.md)
1011
- [PowerAuth Server 1.4.0](./PowerAuth-Server-1.4.0.md)
1112
- [PowerAuth Server 1.3.0](./PowerAuth-Server-1.3.0.md)

‎docs/PowerAuth-Server-0.22.0.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ Java 11 no longer supports installing Bouncy Castle using library extension mech
3636
longer contains the Bouncy Castle library in war files to avoid classloader issues in some web containers (e.g. Tomcat).
3737

3838
The Bouncy Castle provider needs to be installed using mechanism supported by the web container.
39-
See the [Installing Bouncy Castle](./Installing-Bouncy-Castle.md#installing-on-java-11) chapter in documentation.
39+
See the [Installing Bouncy Castle](./Installing-Bouncy-Castle.md) chapter in documentation.
4040

4141
### Tomcat on Java 11
4242

‎docs/PowerAuth-Server-1.5.0.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ This release adds support for PowerAuth protocol version 3.2, which adds several
2727

2828
### Simplified Configuration of PowerAuth Mobile SDK.
2929

30-
You can use the `mobileSdkConfig` value from `POST /rest/v3/application/detail`, see [REST API documentation](https://github.com/wultra/powerauth-server/blob/develop/docs/WebServices-Methods.md#method-getapplicationdetail). This value contains encoded master public key, application key and application secret.
30+
You can use the `mobileSdkConfig` value from `POST /rest/v3/application/detail`, see [REST API documentation](WebServices-Methods.md#method-getapplicationdetail). This value contains encoded master public key, application key and application secret.
3131

3232
Starting with version 1.5.x you can use this single configuration Base-64 encoded string for configuring the PowerAuth mobile SDK instead of using three separated configuration parameters.
3333

‎docs/PowerAuth-Server-1.6.0.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Migration from 1.5.x to 1.6.0
2+
3+
This guide contains instructions for migration from PowerAuth Server version `1.5.x` to version `1.6.0`.
4+
5+
## Database Changes
6+
7+
For convenience you can use liquibase for your database migration.
8+
9+
For manual changes use SQL scripts:
10+
11+
- [PostgreSQL script](./sql/postgresql/migration_1.5.3_1.6.0.sql)
12+
- [Oracle script](./sql/oracle/migration_1.5.3_1.6.0.sql)
13+
- [MSSQL script](./sql/mssql/migration_1.5.3_1.6.0.sql)
14+
15+
### Allow Non-personalized Operations
16+
17+
The column `user_id` in table `pa_operation` is nullable now.
18+
19+
### Forbid name duplication for operation templates.
20+
21+
Add unique constraint to `templateName` column in `pa_operation_template` table.
22+
23+
Applying this change may fail if there are duplicates in the `pa_operation_template` table. Please make sure there are
24+
no two records with the same name `templateName`. If necessary, remove any duplicities from the table manually. Consider
25+
creating a backup before this operation.
26+
27+
### Add foreign key constraints to operations and applications relation.
28+
29+
Add foreign key constraints to relating table `pa_operation_application`.
30+
31+
Applying this change may fail if there is an inconsistency between tables `pa_operation_application`
32+
and `pa_application` or `pa_operation`. Make sure that `pa_operation_application.application_id` contains references to
33+
existing `pa_application.id` and `pa_operation_application.operation_id` contains references to
34+
existing `pa_operation.id`. If necessary, manually remove orphaned records in `pa_operation_application`. Consider
35+
creating a backup before this operation.
36+
37+
### Add activation_id Column
38+
39+
Add a new column `activation_id` to the `pa_operation` table. This column is a foreign key that references
40+
the `activation_id` column in the `pa_activation` table. Storing the `activation_id` in the `pa_operation` table
41+
provides several enhancements:
42+
43+
* It allows the creation of a new operation tied to a specific mobile device, identified by its activation ID.
44+
* It ensures that the operation can only be approved on that specific mobile device, again identified by its activation ID.
45+
46+
### Add activation_name Column to pa_activation_history
47+
48+
Add a new column `activation_name` to the `pa_activation_history` table.
49+
Since it is possible to change the activation name, it is recorded in the history.

0 commit comments

Comments
 (0)