All notable changes to this project will be documented in this file.
- Fix for Jetty HTTP TRACE - CVE-2010-0386 (disabled TRACE method for Jetty server)
- CORS configuration (for compatibility with UI)
- Updated firewall.properties
- Multipart message library upgraded to 1.0.18
- Websocket library upgraded to 1.0.18
- Fix WSS SSL support
- Upgrade GHA to use Node.js 20
- Audit logs stored in database
- Column encrypted using AES/GCM/NoPadding
- New endpoint for fetching audit events
- requires to set environment variable with AES256-SECRET-KEY used in encryption algorithm
- Using JFrog for IDS dependency management
- Audit events are not stored into file with this change but in DB (H2 as default)
- Simple user management
- cosign version upgrade with alpine image; must include --insecure-ignore-tlog flag
- CertificationCheck now uses Cosign to verify if running version is signed
- new property application.selfdescription.defaultEndpoint - used for custom URI where connector self-description is exposed
- Fix extended validation bug
- failed login is registered in logs (UserNotFoundException)
- bumped spring-boot-parent to 2.5.14
- hardcoded not to show stack trace in response
- if DAPS certificate is not loaded, or certificate expired, connector will not start
- changed how connectorId is used - now it is single property that needs to be set (application.connectorid)
- if connectorId is not valid (blank) connector will not start
- added Spring StrictHttpFirewall with firewall.property file; default - disabled
- new property application.connectorid
- Dockerfile improvements
- new processor at B-endpoint, for checking incoming info model version
- Hardcoded to use TLS communication only
- Property application.disableSslVerification deleted, so trust store must be set and valid
- Deleted next properties and set them to the hardcoded values: camel.springboot.main-run-controller = true, camel.component.http4.use-global-ssl-context-parameters = true, camel.component.jetty.use-global-ssl-context-parameters = true, server.ssl.enabled = true
- refactor classes for handling TLS (server certificate and truststore) and Daps certificate
- Security upgrade com.auth0:jwks-rsa from 0.21.1 to 0.22.1
- Security upgrade net.logstash.logback:logstash-logback-encoder from 7.0.1 to 7.3
- Security upgrade com.auth0:java-jwt from 3.19.1 to 3.19.3
- Security upgrade org.bitbucket.b_c:jose4j:0.7.8 to 0.9.3
- added certification check
- checksum for artifact/1 and artifact/big
- admin role now changed to apiUser, for ease of understanding
- default user name now application.user.api.username=apiUser
- upgraded org.json:json from 20210307 to 20230227 (Dependabot #4 - json stack overflow vulnerability)
- removed redundant and unused http endpoint that was running in parallel with https for Spring Boot; if http is needed please set server.ssl.enabled=false
- updated GitHub Actions, simplified input parameters; skipping develop build when performing mvn release commits
- upgraded Tomcat version to 9.0.76 due to small NIO exception bug when fetching Self Description
- removed internal sd route (DataApp v0.2.7 mandatory)
- auth for self description endpoint
- add requestedArtifact as mandatory field for communication with UC App (UC App v1.7.0 mandatory)
- new property application.internalSelfdescriptionPort=
- OCSP verification of receiver certificate
- version increase to align with docker images
- internal/sd now always available on it's own port
- all camel routes now only support POST method with the exception of internal/sd which is available only with GET
- dependency vulnerabilities know checked by dependabot
- removed authorization from IDS endpoint (B endpoint)
- Support for DataApp message handler (http-header flow)
- Requested for for this ECC version requires 0.2.0-SNAPSHOT+ version of DataApp
- Support for GitHub Workflow (release process, docker image signing)
- New UsageControl Platoon docker image (temurin based) rdlabengpa/ids_uc_data_app_platoon:v1.5 in GitHub Actions
- Add self-description for WSS flow
- Rename application.wss.server.port to application.wss-server-port
- Add messageType to WS-WS test case
- Add test1.csv as DataResource to selfdescription
- Multipart message library upgrade to 1.0.17
- infomodel dependency now managed via Multipart Library (excluded infomodel from idscp2 dependencies)
- Camel version from 3.18.0 to 3.19.0 (The default TLS protocol is changed from TLSv1.2 to TLSv1.3 in Camel JSSE support)
- Multipart message library upgrade from 1.0.14-SNAPSHOT to 1.0.15-SNAPSHOT (memory cleaner in MMP)
- Switch to base docker image eclipse-temurin:11-jre-alpine
- Fix in messageToHeaders method in HttpHeaderServiceImpl
- When requesting DAPS token, transportCertsSha256 from server public key will be sent
- Logic for checking TransportCertsSha256 hash value from jwToken
- readme file TRANSPORTCERTSSHA256.md with explanation
- new property for enabling/disabling new logic for extended token validation
application.extendedTokenValidation=false
- version remains the same since nothing is done to the code
- GitHub Actions now uses the develop Data App image from Docker Hub (rdlabengpa/ids_be_data_app:develop) instead of building it to speed up the process
- GitHub Actions tests now split to work in parallel
- added GHA tests.md document with brief explanation about the GitHub Actions tests
- added GitHub Actions tests for contract negotiation
- properties that will differentiate 2 users: Self Description API user, with ADMIN role; used to manipulate Self Description API Connector user, with CONNECTOR role; used to authenticate and authorize IDS message interaction with Connector (B-endpoint)
- Camel Policy, used to authenticate camel routes
#API management credentials
application.user.api.username=admin
application.user.api.password=$2a$10$MQ5grDaIqDpBjMlG78PFduv.AMRe9cs0CNm/V4cgUubrqdGTFCH3m
application.user.connector.username=connector
application.user.connector.password=$2a$10$MQ5grDaIqDpBjMlG78PFduv.AMRe9cs0CNm/V4cgUubrqdGTFCH3m
#number of consecutive failed attempts
application.user.lock.maxattempts=5
# duration for how long user will be locked
application.user.lock.duration=30
# time unit used for locking user, possible values are: SECONDS,MINUTES,HOURS,DAYS
application.user.lock.unit=MINUTES
- Refactor GitHub Actions tests
- using ids-comm dependency from Frauenhofer repository
- removed GitHub Actions tests for payload only
- local maven dependencies
- New properties for Password Validator:
## Password Validator
application.password.validator.minLength=8
application.password.validator.maxLength=16
application.password.validator.minUpperCase=1
application.password.validator.minLowerCase=1
application.password.validator.minDigit=1
application.password.validator.minSpecial=1
- added a Password Validator to verify that the password meets the desired criteria
### Clearng-House
application.clearinghouse.isEnabledClearingHouse=false
application.clearinghouse.username=
application.clearinghouse.password=
application.clearinghouse.baseUrl=
application.clearinghouse.logEndpoint=/messages/log/
application.clearinghouse.processEndpoint=/process/
- updated Clearing House logic now compliant with Frauenhofer CH
- header propagation was not properly done when sending Broker messages, thats fixed now
- ENG Clearing House dependency removed
- New endpoint (password protected) for getting hash value for SelfDescription API password
- banner is now packed with jar, to avoid need to manually change it in dockerized version
- added audit logging
- updated documentation with new functionality
- added log lines to track of connector setup: REST, WSS, IDSCPv2
- logic for locking API user after consecutive failed attempts
- new properties to configure user locking functionality
- updated documentation with new functionality
- added log lines to track of connector setup: REST, WSS, IDSCPv2
- added new GHA tests for payload extraction logic
- added new junit tests
- small code refactoring
- added new GHA tests for big payload
- mixed and form responses are now passed through OutputStream to avoid org.apache.http.ContentTooLongException
- updated existing GHA tests with new .env files
- Upgraded versions for following dependencies: camel version update async-http-client com.auth0 bcprov-jdk15on com.squareup.okhttp3 com.squareup.okio
- Dockerfile base image version upgrade
- Rejection message is now always created from the request message
- removed DAT from rejection message
- added new service for interacting with Platoon Usage Control dataApp
- new property, application.usageControlVersion, which is used to configure which UC dataApp to use, platoon or mydata
- refined logic for modify/de-modify payload, now only for ArtifactResponseMessage
- updated logic for Receiver, send response, HttpEntity instead String representation of multipart/form-data
- reverted change for DAPS jwks URL, compatibility with Omejdn (not using default jwks URL)
- added public key in Self Description document
- policy upload is now done when we get the correct response instead of doing it before sending request
- parseReceivedResponseMessage processor is removed, parsing of the response is done on handleResponse, not as separate step
- Self Description typo fix
- added property and functionality to skip protocol validation
- New version of Multipart Message Library
- Modified self-description document to use dateTimeStamp instead dateTime, compatibility with standard
- Replaced swagger with springdoc and updated documentation
- UC properties not required when disabled (can remain blank)
- encode-decode payload on ECC boundaries - default is set to false - will not enforce encoding-decoding
- added new property application.encodeDecodePayload=false to manage newly added logic
- default contract offer,artifact and resource for self description
- removed support for DAPS v1 token
- now supporting file sending over multipart/form
- modification for improved docker image creation
- minor exception and exception handling changes
- updated camel framework to 3.11.2
- removed stand-alone com.google.protobuf dependencies
- removed org.checkerframework dependency
- removed unnecessary exceptions
- removed info-model property from property file; it will be read from multipart processor message library
- RejectionMessageService dependency injection now done through constructor
- TestUtilMessageService now everywhere replaced with UtilMessageService
- infomodel version has been changed to 4.1.1
- mandatory fields/properties to RejectionMessages
- updated the Daps interaction: in case of disabled Daps interaction is no more needed to define keystore, truststore and the related properties
- disabled fetch token on start up in case of Daps interaction disabled
- updated logic for using objectMapper to convert from IDS Message to Map and creating Map from incoming headers to convert back to IDS Message
- added API endpoints and logic for dynamic modification of Self Description document
- new properties
application.selfdescription.filelocation
spring.security.user.name
spring.security.user.password
- updated developer information with missing dependency
- added CI build GitHub Actions PAT, repository for MMP
- Make use of TestUtilMessage service from Multipart Message library
- updated versions for Multipart Message library
- updated version for WebSocket Message Streamer library
- moved model , service, config, autoconfig and exception packages from Camel Interceptor Ucapp directly to Execution Core Container
- removed Camel Interceptor Ucapp dependency from pom.xml