Rest API Security

Resources

• https://darutk.medium.com/diagrams-and-movies-of-all-the-oauth-2-0-flows-194f3c3ade85

• All tulisa videos: https://www.youtube.com/@tulasibeesabathuni772/videos

• https://auth0.com/intro-to-iam/what-is-oauth-2

• Digest Authentication

• https://oauth.net/2/jwt-access-tokens/

Supported HTTP Authorization Types

• Bearer Token

• Digest

• Basic

Customer How-tos

• Bearer Token

  • Login Into sunwave.

  • Create or get your client_id In our case “vQl91X514m11dTHHGYQPQkxJqNPxgbdJ” Master Data → Client Integration this populates sw_external_application

    (SunwaveEMR/web/integrations/integrations.dart) Requirements for Client ID and Secret Key:

    Open

    

  • In the same browser surf to http://localhost:8080/SunwaveEMR/authorizeRealm?client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ

  • Choose the Realm you what to issue rest commands against.

  • This will redirect you to something like this: http://localhost:8080/SunwaveEMR/generateCode?code=F26YCVM8F5&state=null This will populate sw_external_application_code

  • Note what the code parameter is set to. In our case “F26YCVM8F5”

  • Get your client secret. In our case “C0iGincSREijXqeuB3P9sDdj1ZU6UwqVaUc6VLwhpcx2sBQmB85k8zWuIKSc6gkCAcnXm4JTk2YBFpH5fFDEPH0JyKg4SgchallGmNDc9fNkO1ojZxyKaZ5murQZFDvSW7iJl1CM5JESube8P0cdlqtiLoHb7BP4293S6FqG557TbIPS61ACp0lfAOu9fNXD6L2LD24j7QMRZpM8GE6GQOnY5nTaHGn42eBMjB8iMS9gx4P7iStJirC0vjq2miSC”

  • Now get the Bearer Token by issuing the following http://localhost:8080/SunwaveEMR/token?code=F26YCVM8F5&client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ&client_secret=C0iGincSREijXqeuB3P9sDdj1ZU6UwqVaUc6VLwhpcx2sBQmB85k8zWuIKSc6gkCAcnXm4JTk2YBFpH5fFDEPH0JyKg4SgchallGmNDc9fNkO1ojZxyKaZ5murQZFDvSW7iJl1CM5JESube8P0cdlqtiLoHb7BP4293S6FqG557TbIPS61ACp0lfAOu9fNXD6L2LD24j7QMRZpM8GE6GQOnY5nTaHGn42eBMjB8iMS9gx4P7iStJirC0vjq2miSC

  • This will return something like this: { "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJzdW53YXZlLWFkbWluMSIsImF1ZCI6IjEzMSIsImNsaSI6InZRbDkxWDUxNG0xMWRUSEhHWVFQUWt4SnFOUHhnYmRKIiwiaXNzIjoiU3Vud2F2ZSIsImV4cCI6MTY3NDY2OTI0NzAxMX0.VpdznRyCkM6F_YnHaUCzIA6uScttcbssCs1SdRESymXOHT7Sk2z7UpUkJo-Px5ifgajPJlygt1CrByqUMS1T4Q", "expires_in": "24h" }

  • Now set bearer token on your request.

• Digest

• Basic

Software Design

• O-AUTH 2

  • Web.xml -https://github.com/sunwavehealth/SunwaveEMR/blob/3d9bf69492a0f60e786023adbaa63b1889feb859/src/main/webapp/WEB-INF/web.xml#L25

  • AuthorizeRealmServlet - (sets client_id and state as attributes in the session using client_id and state parameters) https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/AuthorizeRealmServlet.java#L14

  • api_select_realm https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/webapp/api_select_realm.jsp#L1

• Generate JWT Token for bearer:

  • Web.xml - https://github.com/sunwavehealth/SunwaveEMR/blob/3d9bf69492a0f60e786023adbaa63b1889feb859/src/main/webapp/WEB-INF/web.xml#L39

  • GenerateJWTServlet - (GET: http://localhost:8080/SunwaveEMR/generateCode) https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/GenerateJWTServlet.java#L16

  • JWT.genrateJWT (POST: http://localhost:8080/SunwaveEMR/token ex SunwaveEMR/token?code=VKYU5F5W1S&client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ&client_secret=C0iGincSREijXqeuB3P9sDdj1ZU6UwqVaUc6VLwhpcx2sBQmB85k8zWuIKSc6gkCAcnXm4JTk2YBFpH5fFDEPH0JyKg4SgchallGmNDc9fNkO1ojZxyKaZ5murQZFDvSW7iJl1CM5JESube8P0cdlqtiLoHb7BP4293S6FqG557TbIPS61ACp0lfAOu9fNXD6L2LD24j7QMRZpM8GE6GQOnY5nTaHGn42eBMjB8iMS9gx4P7iStJirC0vjq2miSC) -https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/util/JWT.java#L45

• Manage sw_external_application_codetable. Master Data → Client Integration

  • https://github.com/sunwavehealth/SunwaveEMR/blob/3d9bf69492a0f60e786023adbaa63b1889feb859/src/main/webapp/WEB-INF/web.xml#L31

  • Create (http://localhost:8080/SunwaveEMR/generateCode?clinic_id=131&client_id=vQl91X514m11dTHHGYQPQkxJqNPxgbdJ)

    • https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/GenerateCodeServlet.java#L33 ()

  • Delete https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/GenerateCodeServlet.java#L59

• Manage sw_external_application table Practice Setup → External Application

  • Dart external_app_registry - https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/web/admin/external_app_registry.dart#L200

  • Processor Entry - https://github.com/sunwavehealth/SunwaveEMR/blob/5daa4fd9d6563e688ff9ce479c13426040de490f/src/main/java/com/sunwave/emr/server/Processor.java#L528

  • ExternalApplicaitonProcessor -https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/ExternalApplicationProcessor.java#L18

    • POST https://github.com/sunwavehealth/SunwaveEMR/blob/d46b653451ce24623a0c6c72d0aa4e2313c5c0f9/src/main/java/com/sunwave/emr/server/security/ExternalApplicationProcessor.java#L48
      
      

• Validate Rest request

  • Tomcat Filters - https://www.codejava.net/java-ee/servlet/webfilter-annotation-examples

  • APISecurityFilter - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L28

  • APISecurityFilter - Path https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L26

  • Digest - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L44

  • Bearer - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L59

    • JSONArray clients = ReportProcessor.toJSONArrayOfJSONObjects( "select sw_external_application_code.created_by, sw_external_application_code.clinic_id " + "from " + " sw_external_application_code, " + " sw_external_application " + "where " + " sw_external_application_code.client_id = sw_external_application.client_id " + "and sw_external_application_code.code = ? " + "and sw_external_application_code.client_id = ? " + "and sw_external_application.client_secret = ?", new String[]{code, clientId, clientSecret});

       

  • Basic - https://github.com/sunwavehealth/SunwaveEMR/blob/51252a9bb7a7d193a9cb929a7c22b04c2ad7fcf5/src/main/java/com/sunwave/emr/server/security/APISecurityFilter.java#L85