splitResult = SPLITTER.split(headerString);
- checkArgument(splitResult.containsKey(JOB_ID_KEY), "Invalid ClientInfo header: %s",
+ checkArgument(splitResult.containsKey(JOB_ID_KEY), INVALID_CLIENTINFO_HEADER_MESSAGE,
headerString);
- checkArgument(splitResult.containsKey(FILE_ID_KEY), "Invalid ClientInfo header: %s",
+ checkArgument(splitResult.containsKey(FILE_ID_KEY), INVALID_CLIENTINFO_HEADER_MESSAGE,
headerString);
- checkArgument(splitResult.containsKey(RETRY_COUNT_KEY), "Invalid ClientInfo header: %s",
+ checkArgument(splitResult.containsKey(RETRY_COUNT_KEY), INVALID_CLIENTINFO_HEADER_MESSAGE,
headerString);
return new ClientInfo(splitResult.get(JOB_ID_KEY), splitResult.get(FILE_ID_KEY),
Integer.parseInt(splitResult.get(RETRY_COUNT_KEY)));
@@ -74,6 +76,6 @@ public static ClientInfo fromHeaderString(String headerString) {
public void addToMDC() {
final String ciStr = String.format("job-id:%s,file-id:%s,retry:%d", jobId, fileId, retryCount);
MDC.put(CLIENT_INFO_MDC_KEY, ciStr);
-
+
}
}
diff --git a/src/main/java/org/italiangrid/storm/webdav/tpc/utils/UrlHelper.java b/src/main/java/org/italiangrid/storm/webdav/tpc/utils/UrlHelper.java
index 5462e239..6dc72458 100644
--- a/src/main/java/org/italiangrid/storm/webdav/tpc/utils/UrlHelper.java
+++ b/src/main/java/org/italiangrid/storm/webdav/tpc/utils/UrlHelper.java
@@ -15,8 +15,6 @@
*/
package org.italiangrid.storm.webdav.tpc.utils;
-import static java.util.Objects.isNull;
-
import java.net.URI;
import java.net.URISyntaxException;
@@ -31,11 +29,7 @@ public static boolean isRemoteUrl(String url) {
URI uri = new URI(url);
- if (isNull(uri.getScheme())) {
- return false;
- }
-
- return true;
+ return uri.getScheme() != null;
} catch (URISyntaxException e) {
return false;
diff --git a/src/main/java/org/italiangrid/storm/webdav/utils/RangeCopyHelper.java b/src/main/java/org/italiangrid/storm/webdav/utils/RangeCopyHelper.java
index c442df09..cef6fa60 100644
--- a/src/main/java/org/italiangrid/storm/webdav/utils/RangeCopyHelper.java
+++ b/src/main/java/org/italiangrid/storm/webdav/utils/RangeCopyHelper.java
@@ -28,6 +28,8 @@
public class RangeCopyHelper {
+ private RangeCopyHelper() {}
+
public static long rangeCopy(InputStream is, File f, long rangeStart, long rangeCount) throws IOException {
checkNotNull(is);
diff --git a/src/main/java/org/italiangrid/storm/webdav/web/ViewUtilsInterceptor.java b/src/main/java/org/italiangrid/storm/webdav/web/ViewUtilsInterceptor.java
index f4df47dc..f1b54e2b 100644
--- a/src/main/java/org/italiangrid/storm/webdav/web/ViewUtilsInterceptor.java
+++ b/src/main/java/org/italiangrid/storm/webdav/web/ViewUtilsInterceptor.java
@@ -25,9 +25,9 @@
import org.italiangrid.storm.webdav.server.servlet.SAIndexServlet;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+import org.springframework.web.servlet.HandlerInterceptor;
-public class ViewUtilsInterceptor extends HandlerInterceptorAdapter {
+public class ViewUtilsInterceptor implements HandlerInterceptor {
final ServiceConfigurationProperties serviceConfig;
final StorageAreaConfiguration saConfig;
diff --git a/src/main/resources/application-dev.yml b/src/main/resources/application-dev.yml
index 6b1c7356..8d9d02e0 100644
--- a/src/main/resources/application-dev.yml
+++ b/src/main/resources/application-dev.yml
@@ -2,8 +2,19 @@ server:
jetty:
accesslog:
enabled: false
+
+management:
+ # endpoint:
+ # env:
+ # additional-keys-to-sanitize: client-secret
+ endpoints:
+ web:
+ exposure:
+ include: env
+
oauth:
enable-oidc: false
+
storm:
connector:
port: 8086
diff --git a/src/main/resources/application-fga.yml b/src/main/resources/application-fga.yml
new file mode 100644
index 00000000..7a207fb3
--- /dev/null
+++ b/src/main/resources/application-fga.yml
@@ -0,0 +1,51 @@
+server:
+ jetty:
+ accesslog:
+ enabled: false
+
+management:
+ endpoints:
+ web:
+ exposure:
+ include: env
+
+oauth:
+ enable-oidc: false
+ issuers:
+ - name: iam-dev
+ issuer: https://iam-dev.cloud.cnaf.infn.it/
+
+storm:
+ connector:
+ port: 8086
+ securePort: 9443
+ sa:
+ config-dir: src/test/resources/conf/sa.d
+ tls:
+ trust-anchors-dir: src/test/resources/trust-anchors
+ certificate-path: src/test/resources/hostcert/hostcert.pem
+ private-key-path: src/test/resources/hostcert/hostkey.pem
+ authz-server:
+ enabled: true
+ voms:
+ trust-store:
+ dir: src/test/resources/vomsdir
+ tape:
+ well-known:
+ source: src/test/resources/well-known/wlcg-tape-rest-api.json
+
+ authz:
+ policies:
+ - sa: fga
+ actions:
+ - all
+ effect: permit
+ description: Grant read/write access to a specific client
+ paths:
+ - /**
+ principals:
+ - type: jwt-client
+ params:
+ iss: https://iam-dev.cloud.cnaf.infn.it/
+ id: 42999a63-7449-43fb-952e-42f2d75b865b
+
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 6eaaa236..e18c7e51 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -11,16 +11,19 @@ spring:
issuer-uri: https://iam-escape.cloud.cnaf.infn.it/
indigo:
issuer-uri: https://iam-test.indigo-datacloud.eu/
+
session:
store-type: none
server:
- # StoRM webdav will bind on this address
+ # StoRM WebDAV will bind on this address
address: ${STORM_WEBDAV_SERVER_ADDRESS:0.0.0.0}
+ # StoRM WebDAV server should support graceful shutdown, allowing active requests time to complete, or shut down immediately
+ # Values: graceful, immediate
+ shutdown: ${STORM_WEBDAV_SERVER_SHUTDOWN:graceful}
error:
whitelabel:
enabled: false
-
jetty:
threads:
max: ${storm.connector.max-connections}
@@ -28,7 +31,7 @@ server:
management:
health:
redis:
- enabled: false
+ enabled: false
tpc:
tls-protocol: ${STORM_WEBDAV_TPC_TLS_PROTOCOL:TLSv1.2}
@@ -50,7 +53,8 @@ tpc:
enable-expect-continue-threshold: ${STORM_WEBDAV_TPC_ENABLE_EXPECT_CONTINUE_THRESHOLD:1048576}
oauth:
- refresh-period-minutes: 60
+ refresh-period-minutes: ${STORM_WEBDAV_OAUTH_REFRESH_PERIOD_MINUTES:60}
+ refresh-timeout-seconds: ${STORM_WEBDAV_OAUTH_REFRESH_TIMEOUT_SECONDS:30}
issuers:
storm:
@@ -81,18 +85,31 @@ storm:
macaroon-filter:
enabled: ${STORM_WEBDAV_MACAROON_FILTER_ENABLED:true}
+ scitag:
+ enabled: ${STORM_WEBDAV_SCITAG_ENABLED:false}
+
+ server:
+ # Jetty Thread-Pool maximum idle time (in milliseconds)
+ max-idle-time-msec: ${STORM_WEBDAV_SERVER_MAX_IDLE_TIME:3600000}
+
connector:
# HTTP connector port
port: ${STORM_WEBDAV_HTTP_PORT:8085}
# HTTPS connector port
secure-port: ${STORM_WEBDAV_HTTPS_PORT:8443}
+ # Min concurrent connections
+ min-connections: ${STORM_WEBDAV_MIN_CONNECTIONS:50}
# Max concurrent connections
max-connections: ${STORM_WEBDAV_MAX_CONNECTIONS:300}
# Connection queue size
max-queue-size: ${STORM_WEBDAV_MAX_QUEUE_SIZE:900}
# Connector Maximum idle time (in milliseconds)
- max-idle-time-msec: ${STORM_WEBDAV_CONNECTOR_MAX_IDLE_TIME:30000}
+ max-idle-time-msec: ${STORM_WEBDAV_CONNECTOR_MAX_IDLE_TIME:30000}
output-buffer-size-bytes: ${storm.buffer.file-buffer-size-bytes}
+ # Number of acceptor threads to use. When the value is -1, the default, the number of acceptors is derived from the operating environment.
+ jetty-acceptors: ${STORM_WEBDAV_CONNECTOR_ACCEPTORS:-1}
+ # Number of selector threads to use. When the value is -1, the default, the number of selectors is derived from the operating environment.
+ jetty-selectors: ${STORM_WEBDAV_CONNECTOR_SELECTORS:-1}
tls:
# Path to the service certificate.
@@ -158,4 +175,5 @@ storm:
tape:
well-known:
- source: ${STORM_WEBDAV_TAPE_WELLKNOWN_SOURCE:/etc/storm/webdav/wlcg-tape-rest-api.json}
\ No newline at end of file
+ source: ${STORM_WEBDAV_TAPE_WELLKNOWN_SOURCE:/etc/storm/webdav/wlcg-tape-rest-api.json}
+
diff --git a/src/main/resources/templates/400.html b/src/main/resources/templates/400.html
index 14d78a16..9bf8a90e 100644
--- a/src/main/resources/templates/400.html
+++ b/src/main/resources/templates/400.html
@@ -1,5 +1,5 @@
-
Bad request!
@@ -10,4 +10,4 @@ Bad request!
The request you submitted is malformed!
Go back to the storage area index page
-
\ No newline at end of file
+
diff --git a/src/main/resources/templates/401.html b/src/main/resources/templates/401.html
index dee6c977..b6cf5c92 100644
--- a/src/main/resources/templates/401.html
+++ b/src/main/resources/templates/401.html
@@ -1,5 +1,5 @@
-
Access denied!
@@ -10,4 +10,4 @@ Unauthorized!
You are not authenticated and are trying to access content that requires authenticated access!
Go back to the storage area index page
-
\ No newline at end of file
+
diff --git a/src/main/resources/templates/403.html b/src/main/resources/templates/403.html
index bdf4065d..3b7c6306 100644
--- a/src/main/resources/templates/403.html
+++ b/src/main/resources/templates/403.html
@@ -1,5 +1,5 @@
-
Access denied!
@@ -10,4 +10,4 @@ Forbidden!
You do not have the rights to access the requested resources!
Go back to the storage area index page
-
\ No newline at end of file
+
diff --git a/src/main/resources/templates/404.html b/src/main/resources/templates/404.html
index a895f025..18bc284a 100644
--- a/src/main/resources/templates/404.html
+++ b/src/main/resources/templates/404.html
@@ -1,5 +1,5 @@
-
Not found!
@@ -10,4 +10,4 @@ Not found!
We could not find the resource you're looking for...
Go back to the storage area index page
-
\ No newline at end of file
+
diff --git a/src/main/resources/templates/405.html b/src/main/resources/templates/405.html
index 4a228df8..6200622f 100644
--- a/src/main/resources/templates/405.html
+++ b/src/main/resources/templates/405.html
@@ -1,5 +1,5 @@
-
Access denied!
@@ -10,4 +10,4 @@ Request method not allowed!
The http method in your request is not allowed for the target resource!
Go back to the storage area index page
-
\ No newline at end of file
+
diff --git a/src/main/resources/templates/authn-info.html b/src/main/resources/templates/authn-info.html
index 8c9570cc..3980a10a 100644
--- a/src/main/resources/templates/authn-info.html
+++ b/src/main/resources/templates/authn-info.html
@@ -1,5 +1,5 @@
-
Authentication info
@@ -26,4 +26,4 @@
Go back to the storage area index page
-
\ No newline at end of file
+