Rest API Security

Resources

• Tulisa Video: https://youtu.be/t0vIXC2iJm0

• All tulisa videos: https://www.youtube.com/@tulasibeesabathuni772/videos

• https://auth0.com/intro-to-iam/what-is-oauth-2

• https://www.techopedia.com/definition/13609/digest-authentication

• https://oauth.net/2/jwt-access-tokens/

Supported HTTP Authorization Types

• Bearer Token

• Digest

• Basic

Customer How-tos

• Bearer Token

  • Login Into sunwave.

  • Create or get your client_id In our case “vQl91X514m11dTHHGYQPQkxJqNPxgbdJ” Master Data → Client Integration this populates sw_external_application

    Requirements for Client ID and Secret Key:

    

  • In the same browser surf to http://localhost:8080/SunwaveEMR/authorizeRealm?client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ

  • Choose the Realm you what to issue rest commands against.

  • This will redirect you to something like this: http://localhost:8080/SunwaveEMR/generateCode?code=F26YCVM8F5&state=null This will populate sw_external_application_code

  • Note what the code parameter is set to. In our case “F26YCVM8F5”

  • Get your client secret. In out case “C0iGincSREijXqeuB3P9sDdj1ZU6UwqVaUc6VLwhpcx2sBQmB85k8zWuIKSc6gkCAcnXm4JTk2YBFpH5fFDEPH0JyKg4SgchallGmNDc9fNkO1ojZxyKaZ5murQZFDvSW7iJl1CM5JESube8P0cdlqtiLoHb7BP4293S6FqG557TbIPS61ACp0lfAOu9fNXD6L2LD24j7QMRZpM8GE6GQOnY5nTaHGn42eBMjB8iMS9gx4P7iStJirC0vjq2miSC”

  • Now get the Bearer Token by issuing the following http://localhost:8080/SunwaveEMR/token?code=F26YCVM8F5&client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ&client_secret=C0iGincSREijXqeuB3P9sDdj1ZU6UwqVaUc6VLwhpcx2sBQmB85k8zWuIKSc6gkCAcnXm4JTk2YBFpH5fFDEPH0JyKg4SgchallGmNDc9fNkO1ojZxyKaZ5murQZFDvSW7iJl1CM5JESube8P0cdlqtiLoHb7BP4293S6FqG557TbIPS61ACp0lfAOu9fNXD6L2LD24j7QMRZpM8GE6GQOnY5nTaHGn42eBMjB8iMS9gx4P7iStJirC0vjq2miSC

  • This will return something like this: { "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJzdW53YXZlLWFkbWluMSIsImF1ZCI6IjEzMSIsImNsaSI6InZRbDkxWDUxNG0xMWRUSEhHWVFQUWt4SnFOUHhnYmRKIiwiaXNzIjoiU3Vud2F2ZSIsImV4cCI6MTY3NDY2OTI0NzAxMX0.VpdznRyCkM6F_YnHaUCzIA6uScttcbssCs1SdRESymXOHT7Sk2z7UpUkJo-Px5ifgajPJlygt1CrByqUMS1T4Q", "expires_in": "24h" }

  • Now set bearer token on your request.

• Digest

• Basic

Software Design

• O-AUTH 2

  • Web.xml -https://github.com/sunwavehealth/SunwaveEMR/blob/3d9bf69492a0f60e786023adbaa63b1889feb859/src/main/webapp/WEB-INF/web.xml#L25

  • AuthorizeRealmServlet - (sets client_id and state as attributes in the session using client_id and state parameters) https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/AuthorizeRealmServlet.java#L14

  • api_select_realm https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/webapp/api_select_realm.jsp#L1

• Generate JWT Token for bearer:

  • Web.xml - https://github.com/sunwavehealth/SunwaveEMR/blob/3d9bf69492a0f60e786023adbaa63b1889feb859/src/main/webapp/WEB-INF/web.xml#L39

  • GenerateJWTServlet - (GET: http://localhost:8080/SunwaveEMR/generateCode) https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/GenerateJWTServlet.java#L16

  • JWT.genrateJWT (POST: http://localhost:8080/SunwaveEMR/token ex SunwaveEMR/token?code=VKYU5F5W1S&client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ&client_secret=C0iGincSREijXqeuB3P9sDdj1ZU6UwqVaUc6VLwhpcx2sBQmB85k8zWuIKSc6gkCAcnXm4JTk2YBFpH5fFDEPH0JyKg4SgchallGmNDc9fNkO1ojZxyKaZ5murQZFDvSW7iJl1CM5JESube8P0cdlqtiLoHb7BP4293S6FqG557TbIPS61ACp0lfAOu9fNXD6L2LD24j7QMRZpM8GE6GQOnY5nTaHGn42eBMjB8iMS9gx4P7iStJirC0vjq2miSC) -https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/util/JWT.java#L45

• Manage sw_external_application_codetable “Clinic Integrations”

  • https://github.com/sunwavehealth/SunwaveEMR/blob/3d9bf69492a0f60e786023adbaa63b1889feb859/src/main/webapp/WEB-INF/web.xml#L31

  • Create (http://localhost:8080/SunwaveEMR/generateCode?clinic_id=131&client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ)

    • https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/GenerateCodeServlet.java#L33 ()

  • Delete https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/GenerateCodeServlet.java#L59

• Validate Rest request

  • Tomcat Filters - https://www.codejava.net/java-ee/servlet/webfilter-annotation-examples

  • APISecurityFilter - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L28

  • APISecurityFilter - Path https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L26

  • Digest - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L44

  • Bearer - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L59

    • JSONArray clients = ReportProcessor.toJSONArrayOfJSONObjects(
              "select sw_external_application_code.created_by, sw_external_application_code.clinic_id " +
                      "from " +
                      "   sw_external_application_code, " +
                      "   sw_external_application " +
                      "where " +
                      "   sw_external_application_code.client_id = sw_external_application.client_id " +
                      "and sw_external_application_code.code = ? " +
                      "and sw_external_application_code.client_id = ? " +
                      "and sw_external_application.client_secret = ?",        new String[]{code, clientId, clientSecret});

  • Basic - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L85