Spring Webflux : Help in converting code to non-blocking - jwt

Question

In a Spring Webflux application, I have the below "AuthenticationManager" implementation. On a high level, below is what it is trying to do -
Certain url paths are configured in prop file as requiring basic auth while others require bearer token.
For basic auth, BcryptPasswordEncoder.matches method is used to compare incoming password with encoded one stored in prop file.
For bearer token auth, io.jsonwebtoken library is being used to validate token.
#Component
public class AuthenticationManager implements ReactiveAuthenticationManager {
/** The jwt util. */
#Autowired
private JWTUtil jwtUtil;
#Override
public Mono<Authentication> authenticate(Authentication authobj) {
return Mono.just(authobj).flatMap(authentication -> {
String credentials = authentication.getCredentials().toString();
String path = authentication.getPrincipal().toString();
BasicAuthPath basicAuthPath = jwtUtil.isBasicAuthUrl(path);
if (jwtUtil.isBasicScheme(credentials) || jwtUtil.isBearerScheme(credentials)) {
if (jwtUtil.isBasicScheme(credentials) && basicAuthPath.isState()) {
credentials = credentials.substring(5);
if (jwtUtil.isBasicAuthSuccess(credentials.trim(), basicAuthPath.getPath())) {
UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(credentials, null, null);
return Mono.just(auth);
} else {
return Mono.empty();
}
} else if (jwtUtil.isBearerTokenAuthUrl(path) && jwtUtil.isBearerScheme(credentials)) {
credentials = credentials.substring(7);
String username;
try {
username = jwtUtil.getUsernameFromToken(credentials);
} catch (Exception e) {
username = null;
}
if (jwtUtil.validateToken(credentials)) {
Claims claims = jwtUtil.getAllClaimsFromToken(credentials);
List<String> rolesMap = claims.get("role", List.class);
List<Role> roles = new ArrayList<>();
for (String rolemap : rolesMap) {
roles.add(Role.valueOf(rolemap));
}
UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(username, null,
roles.stream().map(authority -> new SimpleGrantedAuthority(authority.name())).collect(Collectors.toList()));
return Mono.just(auth);
} else {
return Mono.empty();
}
} else {
return Mono.empty();
}
}
return Mono.empty();
});
}
}
JwtUtil Code below
#Component
#Slf4j
public class JWTUtil implements Serializable {
/** The Constant serialVersionUID. */
private static final long serialVersionUID = 1L;
/** The env. */
#Autowired
private Environment env;
#Autowired
private PasswordEncoder passwordEncoder;
#Autowired
private JwtParser jwtParser;
#Autowired
private Key signingKey;
private static final PathPatternParser DEFAULT_PATTERN_PARSER = new PathPatternParser();
/**
* Checks if is basic auth success.
*
* #param inputCredentials the input credentials
* #param path the path
* #return true, if is basic auth success
*/
public boolean isBasicAuthSuccess(String inputCredentials, String path) {
String pathtoprop = pathtoprop(path);
String configpwd = env.getProperty(pathtoprop);
if (StringUtils.isBlank(configpwd)) {
configpwd = env.getProperty(pathtoprop.substring(0, pathtoprop.lastIndexOf(".")));
}
return passwordEncoder.matches(new String(Base64.getDecoder().decode(inputCredentials)), configpwd);
//return true;
}
/**
* Checks if is basic auth url.
*
* #param path the path
* #return true, if is basic auth url
*/
public BasicAuthPath isBasicAuthUrl(String path) {
BasicAuthPath basicAuthPath = new BasicAuthPath();
if (StringUtils.isNotBlank(env.getProperty("gateway.basicauth.urls"))) {
return pathMatcherBasic(StringUtils.split(env.getProperty("gateway.basicauth.urls"), ","), path);
}
basicAuthPath.setState(false);
return basicAuthPath;
}
/**
* pathMatcher
*
* #param pathPatterns
* #param path
* #return
*/
private BasicAuthPath pathMatcherBasic(String[] pathPatterns, String path) {
BasicAuthPath basicAuthPath = new BasicAuthPath();
for (String pathPattern : pathPatterns) {
PathPattern pattern = DEFAULT_PATTERN_PARSER.parse(pathPattern);
if (pattern.matches(PathContainer.parsePath(path))) {
basicAuthPath.setState(true);
basicAuthPath.setPath(pathPattern);
return basicAuthPath;
}
}
basicAuthPath.setState(false);
return basicAuthPath;
}
/**
* Checks if is bearer token auth url.
*
* #param path the path
* #return true, if is bearer token auth url
*/
public boolean isBearerTokenAuthUrl(String path) {
if (StringUtils.isNotBlank(env.getProperty("gateway.bearertoken.urls"))
&& pathMatcher(StringUtils.split(env.getProperty("gateway.bearertoken.urls"), ","), path)) {
return true;
}
return false;
}
/**
* pathMatcher
*
* #param pathPatterns
* #param path
* #return
*/
private boolean pathMatcher(String[] pathPatterns, String path) {
for (String pathPattern : pathPatterns) {
PathPattern pattern = DEFAULT_PATTERN_PARSER.parse(pathPattern);
if (pattern.matches(PathContainer.parsePath(path))) {
return true;
}
}
return false;
}
/**
* isBasicScheme
*
* #param credentials
* #return
*/
public boolean isBasicScheme(String credentials) {
if (StringUtils.isNotBlank(credentials) && credentials.startsWith(RestUriConstants.BASIC_TOKE_PREFIX)) {
return true;
}
return false;
}
/**
* isBearerScheme
*
* #param credentials
* #return
*/
public boolean isBearerScheme(String credentials) {
if (StringUtils.isNotBlank(credentials) && credentials.startsWith(RestUriConstants.BEARER_TOKE_PREFIX)) {
return true;
}
return false;
}
/**
* Gets the all claims from token.
*
* #param token the token
* #return the all claims from token
*/
public Claims getAllClaimsFromToken(String token) {
return jwtParser.parseClaimsJws(token).getBody();
}
/**
* Gets the username from token.
*
* #param token the token
* #return the username from token
*/
public String getUsernameFromToken(String token) {
return getAllClaimsFromToken(token).getSubject();
}
/**
* Gets the expiration date from token.
*
* #param token the token
* #return the expiration date from token
*/
public Date getExpirationDateFromToken(String token) {
return getAllClaimsFromToken(token).getExpiration();
}
/**
* Checks if is token expired.
*
* #param token the token
* #return the boolean
*/
private Boolean isTokenExpired(String token) {
final Date expiration = getExpirationDateFromToken(token);
return expiration.before(new Date());
}
/**
* Generate token.
*
* #param user the user
* #return the string
*/
public String generateToken(User user) {
Map<String, Object> claims = new HashMap<>();
claims.put("role", user.getRoles());
return doGenerateToken(claims, user.getUsername());
}
/**
* Do generate token.
*
* #param claims the claims
* #param username the username
* #return the string
*/
private String doGenerateToken(Map<String, Object> claims, String username) {
Long expirationTimeLong = Long.parseLong(env.getProperty("gateway.apollo.token.encryption.exp")); // in second
final Date createdDate = new Date();
final Date expirationDate = new Date(createdDate.getTime() + expirationTimeLong * 1000);
return Jwts.builder().setClaims(claims).setSubject(username).setIssuedAt(createdDate).setExpiration(expirationDate).signWith(signingKey)
.compact();
}
/**
* Validate token.
*
* #param token the token
* #return the boolean
*/
public Boolean validateToken(String token) {
Boolean result = false;
try {
result = !isTokenExpired(token);
} catch (Exception e) {
log.error("Exception in validateToken - {}",token);
}
return result;
}
private String pathtoprop(String path) {
return "gateway.basicauth.credentials" + path.replace('/', '.');
}
}
During PST done with high number of parallel threads, high cpu utilization is being observed. I think it may be because a lot of the above code is blocking. If that is true, could anyone help with providing pointers on how to refactor this code in a reactive way? Should I be using a thread pool like below for better performance -
Mono.just(authobj).publishOn(Schedulers.newParallel("password-encoder", Schedulers.DEFAULT_POOL_SIZE, true);).......

Answer 1

I have something similar, except I am using Jose4J. What you have isn't technically blocking code but the nature of JWT signatures is CPU intensive.
What I do though is publishOn another scheduler so the rest of the gateway can still do the processing of other calls that do not involve signing.
I would also recommend adding a .timeout on the method that is being called by the user so that it will free up the thread soon in case it gets overloaded. You can add Resilience4J TimeLimitter as well, but that may be overkill.