Java Library

*Note: This is an early access feature.

Introduction

This library enables the use of the PlainID SQL-PDP service with Java SpringBoot and applies SQL filtering
rules to SQL queries generated by SpringBoot Hibernate.
A minimum Java version of 1.8 and Spring Boot version 2.0.0 or higher is required.

Usage

To include this library using Maven, add the following dependency to your pom.xml:

<dependency>
    <groupId>com.plainid.libs</groupId>
    <artifactId>plainid-sql-pdp-auth-lib</artifactId>
    <version>1.2.17</version>
</dependency>

Initializing the Library Configuration

Configure the library by adding the following settings to your application.yamlor application.properties. Alternatively, you can choose not to define properties in your application.properties file and instead, set everything through Environment variables:

plainid.sqlpdp.pdpUrl=http://localhost:8080/sql
plainid.sqlpdp.clientID=XXXXXX
plainid.sqlpdp.clientSecret=XXXXXXXXXX
plainid.sqlpdp.entityTypeId=Main
plainid.sqlpdp.emptyCLSTreatAsPermitted=true
plainid.sqlpdp.emptyRLSTreatAsDenied=false
plainid.sqlpdp.ignoreRuntimeCLSResponse=true
plainid.sqlpdp.ignoreSqlPdpServiceErrors=true 
plainid.sqlpdp.oppositeColumnFilteringBehavior=true
plainid.sqlpdp.expandStarColumn=true
plainid.sqlpdp.policiesJoinOperation=OR
plainid.sqlpdp.runtimeCLSAsMasked=true
plainid.sqlpdp.requestMapping='[JSON_ARRAY_OF_REQUEST_MAPPING_CONFIGS]'
plainid.sqlpdp.jwtPassthrough=true
plainid.sqlpdp.entityIdJwtMapping=user_id

To configure the way a request is sent to the PDP service, create a bean of type
QueryModificationFlags and set the desired flags according to the following parameters or set everything via the Environment variables:

@Bean
public QueryModificationFlags queryModificationFlags() {
    return new QueryModificationFlags(true, true, false, true, true, "OR", true);
}

Request Mapping

The parameter accepts configuration properties that define mappings between various sources and their mapping targets in the PDP/Runtime calls. A source refers where data is retrieved from and a target specifies where the data should be mapped.

Sources

The following sources are supported:

• headers: Data is retrieved from the request headers.
• url: Data is extracted from the request URL based on a regex pattern.
• qs (query-string parameter): Data is retrieved from the query string parameters of the request.
• env (environment variable): Data is retrieved from the environment variables of the application.

Targets

The following targets are supported:

• entityAttributes: The data is mapped to the entityAttributes section in the Policy resolution call.
• environment: The data is mapped to the Environment section in the Policy resolution call.
• contextData: The data is mapped to the contextData section in the Policy resolution call.

Configuration Structure

The configuration parameter is passed as a key / value mapping entries. Each object should have the following structure:

{ "source.sourceKey": "target.targetKey" }

Fields:

• source: Specifies the source type. It can be headers, url, env or qs.
• sourceKey: For headers it is the header to look for, following an optional possible JSON path extraction rule, for qs, this is the exact key to look for. For url, this is a regex pattern to match and extract data.
• target: Specifies the target type. It can be entityAttributes, environment, or contextData.
• targetKey: This is the key under which the data from the source is stored in the target.

Example of a configuration:

{
{
  "env.MY_ENV_VAR": "entityAttributes.myEnvVar",
  "headers.x-user-info.$.user.department": "contextData.userInfo",
  "headers.Accept-Encoding": "entityAttributes.Accept-Encoding-Target",
  "qs.difficulty": "environment.difficulty",
  "url./api/([^/]+)(/|$)": "environment.urlPartExample"
}

• Data from the MY_ENV_VAR environment variable is mapped to entityAttributes section under the key myEnvVar.
• Data from the x-user-info header is extracted and mapped through json path $.user.department to contextData section under the key userInfo.
• Data from the Accept-Encoding header is mapped to contextData section under the key Accept-Encoding-Target.
• Data from the difficulty querystring parameter is mapped to the environment section.
• Data matching the regex pattern /api/([^/]+)(/|$) from the URL is mapped to entityAttributes under the key urlPartExample, for example this extracts users from the URL http://localhost:8080/api/users.

The configuration should be passed as a JSON string to the plainid.sqlpdp.requestMapping property or environment variable: PLAINID_RUNTIME_REQUEST_MAPPING.

Using Context and Authorization

To fetch the current user and security context sent to the SQL Database Authorizer Service, the library retrieves the information through a call to Spring Security Core Context by default:

 Authentication authentication=SecurityContextHolder.getContext().getAuthentication();
String u=authentication==null null:authentication.getName();

To override this behavior and inject your user ID and context, use the following code before performing database actions:

 com.plainid.sqlpdplib.Context.setUsername("YOUR_USERNAME");

To inject entity attributes within the Runtime for further Policy resolution based on Dynamic Groups, insert the following code before performing any database actions:

EntityAttributes entityAttributes = new EntityAttributes();
entityAttributes.addAttribute("ATTRIBUTE_NAME", "ATTRIBUTE_VALUE");
com.plainid.sqlpdplib.Context.setEntityAttributes(entityAttributes);

API Documentation

The ReSQL API is a powerful tool that enables you to modify SQL queries over HTTP.
It provides several customization options, which are encapsulated within a request, allowing users to fine-tune their SQL query behavior based on PlainID policies as needed.
The API also returns a structured JSON response, containing potential error messages and indicating whether the query was modified.

For more information API Documentation, check out the Authorizer Service article.