shanika04/cloudfoundry_uaaCVE-2016-4468
The UAA is a multi tenant identity management service, used in Cloud Foundry, but also available as a stand alone OAuth2 server. It's primary role is as an OAuth2 provider, issuing tokens for client applications to use when they act on behalf of Cloud Foundry users. It can also authenticate users with their Cloud Foundry credentials, and can act as an SSO service using those credentials (or others). It has endpoints for managing user accounts and for registering OAuth2 clients, as well as various other management functions.
Requirements:
If this works you are in business:
$ git clone git://github.com/cloudfoundry/uaa.git
$ cd uaa
$ ./gradlew run
The apps all work together with the apps running on the same port
(8080) as /uaa, /app and /api.
UAA will log to a file called uaa.log which can be found using the following command:-
$ sudo find / -name uaa.log
which you should find under something like:-
/private/var/folders/7v/518b18d97_3f4c8fzxphy6f8zcm51c/T/cargo/conf/logs/
You can also build the app and push it to Cloud Foundry, e.g. Our recommended way is to use a manifest file, but you can do everything on the command line.
$ ./gradlew :cloudfoundry-identity-uaa:war
$ cf push myuaa --no-start -m 512M -p uaa/build/libs/cloudfoundry-identity-uaa-2.3.2-SNAPSHOT.war
$ cf set-env myuaa SPRING_PROFILES_ACTIVE default,hsqldb
$ cf set-env myuaa UAA_URL http://myuaa.<domain>
$ cf set-env myuaa LOGIN_URL http://myuaa.<domain>
$ cf set-env myuaa JBP_CONFIG_SPRING_AUTO_RECONFIGURATION '[enabled: false]'
$ cf set-env myuaa JBP_CONFIG_TOMCAT '{tomcat: { version: 7.0.+ }}'
$ cf start myuaa
In the steps above, replace:
myuaa with a unique application name2.3.2-SNAPSHOT with the appropriate version label from your build<domain> this is your app domain. We will be parsing this from the system environment in the futureFirst run the UAA server as described above:
$ ./gradlew run
Then start another terminal and from the project base directory, ask the login endpoint to tell you about the system:
$ curl -H "Accept: application/json" localhost:8080/uaa/login
{
"timestamp":"2012-03-28T18:25:49+0100",
"commit_id":"111274e",
"prompts":{"username":["text","Username"],
"password":["password","Password"]
}
}
Then you can try logging in with the UAA ruby gem. Make sure you have ruby 1.9, then
$ gem install cf-uaac
$ uaac target http://localhost:8080/uaa
$ uaac token get marissa koala
(or leave out the username / password to be prompted).
This authenticates and obtains an access token from the server using
the OAuth2 implicit grant, similar to the approach intended for a
client like CF. The token is stored in ~/.uaac.yml, so dig into
that file and pull out the access token for your cf target (or use
--verbose on the login command line above to see it logged to your
console).
Then you can login as a resource server and retrieve the token details:
$ uaac target http://localhost:8080/uaa
$ uaac token decode
You should see your username and the client id of the original token grant on stdout, e.g.
exp: 1355348409
user_name: marissa
scope: cloud_controller.read openid password.write scim.userids tokens.read tokens.write
email: [email protected]
aud: scim tokens openid cloud_controller password
jti: ea2fac72-3f51-4c8f-a7a6-5ffc117af542
user_id: ba14fea0-9d87-4f0c-b59e-32aaa8eb1434
client_id: cf
$ ./gradlew -Dspring.profiles.active=default,mysql run
This command will assume that there is a MySQL database available with the default settings for access and will respond to the following JDBC settings.
driver = 'org.mariadb.jdbc.Driver'
url = 'jdbc:mysql://localhost:3306/uaa'
user = 'root'
password = 'changeme'
schemas = ['uaa']
In a similar fashion, should you execute the command
$ ./gradlew -Dspring.profiles.active=default,postgresql run
It uses the settings defined as
driver = 'org.postgresql.Driver'
url = 'jdbc:postgresql:uaa'
user = 'root'
password = 'changeme'
These settings are duplicated in two places for the Gradle integration. They are defined as defaults in the Spring XML configuration files and they are defined in the main build.gradle file. The reason they are in the Gradle build file, is so that during Gradle always executes the flywayClean task prior to launching the UAA application. If you wish to not clean the DB, you can define the variable
-Dflyway.clean=false
as part of your command line. This disables the flywayClean task in the gradle script. Another way to disable to the flywayClean is to not specify the spring profiles on the command line, but set the profiles in the uaa.yml and login.yml files.
The same command line example should work against a UAA running on run.pivotal.io (except for the token decoding bit because you won't have the client secret). In this case, there is no need to run a local uaa server, so simply ask the external login endpoint to tell you about the system:
$ curl -H "Accept: application/json" login.run.pivotal.io
{
"prompts":{"username":["text","Username"],
"password":["password","Password"]
}
}
You can then try logging in with the UAA ruby gem. Make sure you have ruby 1.9, then
$ gem install cf-uaac
$ uaac target uaa.run.pivotal.io
$ uaac token get [yourusername] [yourpassword]
(or leave out the username / password to be prompted).
This authenticates and obtains an access token from the server using the OAuth2 implicit grant, the same as used by a client like CF.
You can run the integration tests with
$ ./gradlew integrationTest
will run the integration tests against a uaa server running in a local
Apache Tomcat instance, so for example the service URL is set to http://localhost:8080/uaa (by
default).
You can point the CLOUD_FOUNDRY_CONFIG_PATH to pick up a
uaa.yml where URLs can be changed
and (if appropriate) set the context root for running the
server (see below for more detail on that).
To modify the runtime parameters you can provide a uaa.yml, e.g.