XNAT ActiveMQ client authentication using Kubernetes ServiceAccount JWT token

[dean-taylor]

Description

To allow additional functionality, both internal to XNAT and infrastructure in general, the ActiveMQ component is being deployed as an independent infrastructure component in the umbrella AIS Helm chart.

For tighter security using short lived auth tokens and better integration using Kubernetes best practices.

Benefit Hypothesis

Tighter security using short lived auth tokens and better integration using Kubernetes best practices.
Pre-req. for more federated cluster approach.
Reduced complexity as Kubernetes internal services manage and maintain Auth process.

Acceptance Criteria

Incorporate authnz using OAuth principles via the Kubernetes sub-system.

[dean-taylor]

AciveMQ is preconfigured with the JAAS KubernetesLoginModule.
Client access is configured in XNAT via xnat-config.properties spring.activemq.broker-url= spring.activemq.user= spring.activemq.password=. For OAuth the Bearer token is added to the password setting and the user becomes a reference for logs etc.
The environment variable SPRING_ACTIVEMQ_PASSWORD should also be available.
Kubernetes manages the JWT token at the path /run/secrets/kubernetes.io/serviceaccount/token with a TTL of 1 hour by default.
ISSUE: The spring framework will need to update the JWT Bearer token in the password variable on token renew.

[dean-taylor]

Investigation.
web/src/main/java/org/nrg/xnat/configuration/MqConfig.java
One potential solution would be to user the ActiveMQ re-connect process and add the new token into the authentication configuration using the Spring connection ErrorHandler process.

[dean-taylor]

References.

• https://activemq.apache.org/components/artemis/documentation/1.0.0/client-reconnection.html
• https://activemq.apache.org/components/artemis/documentation/latest/broker-plugins.html#using-the-connectionperiodicexpiryplugin
• https://activemq.apache.org/components/classic/documentation/maven/apidocs/org/apache/activemq/ActiveMQConnectionFactory.html
• https://activemq.apache.org/components/artemis/documentation/latest/security.html#kubernetesloginmodule