Introduce Spring Boot Security Starter & Oauth2 Camunda Run modules

[danielkelemen]

Acceptance Criteria (Required on creation)

• There is an oauth2 Camunda Run module
  • This module can be activated via --oauth2 flag
• There is a spring security Camunda Spring Boot module
• These reference the required dependencies for Spring Security with oauth2
• If activated, Spring Security is disabled for Camunda endpoints and regular Camunda auth is used.

Hints

• License check!

Links

Breakdown

PRs

Preview Give feedback

1. feat(run): add spring security module #4478
   bot:java-dependency-check bot:java-dependency-tree ci:run ci:spring-boot +4
   
2. fix(ci): skip starter-security module for jdk11 stages #4568
   ci:jdk +1
   
3. https://github.com/camunda/camunda-bpm-platform-ee/pull/975
4. fix(modules): oauth2 module should be available for ce and ee #4572
   ci:skipTests ci:spring-boot +2
   

[punitdarira]

Hi Daniel,
I would very much like to work on these security issues if no one else has already started working on it

[danielkelemen]

Hi @punitdarira,
Thanks for the heads up!
There was a POC where many implementation details were already done. I think most work on these sub-tasks will be about testing. This issue is also mostly done already.
We still might be able to find you something, I will think about it and ping you!
-Daniel

[punitdarira]

Thank you for the response @danielkelemen. Yes please do let me know I would love to work on spring-security

[danielkelemen]

For the reviewer:

This change only adds a new module containing Spring Security. We decided that in Run it will be deactivated by default, in Boot it won't be deactivated.

You can test this in Spring Boot or Run:

Boot:

• Run a Spring Boot application with the new camunda-bpm-spring-boot-starter-security dependency added

  <dependency>
    <groupId>org.camunda.bpm.springboot</groupId>
    <artifactId>camunda-bpm-spring-boot-starter-security</artifactId>
    <version>${camunda.version}</version> <!-- Not necessary, bom contains dependency -->
  </dependency>

• Start application. Default Spring login form should appear.
• You can disable this with some security filter chain configuration. This for instance turns it off:

@Bean
public SecurityFilterChain filterChainPermitAll(HttpSecurity http) throws Exception {
  http.authorizeHttpRequests(customizer -> customizer.anyRequest().permitAll())
      .cors(AbstractHttpConfigurer::disable)
      .csrf(AbstractHttpConfigurer::disable);
  return http.build();
}

Run:

• Build Run, I usually do it with-pl distro/run/distro -am
• Start Run with ./start.sh --webapps --rest --example --oauth2
• Application works normally because Spring Security is configured to permit all by default.
• This can be deactivated if someone deploys a Spring plugin jar with @EnableAutoConfig(exclude= CamundaBpmSpringSecurityDisableAutoConfiguration.class)

Some additional notes: #4478 (comment)

[yanavasileva]

Started an example with camunda-bpm-spring-boot-starter-security. Spring login page is there.
I think Camunda Run with the new flag doesn't work as expected at the moment. Clarified that's expected