Test action lint

.github/workflows/actionlint.yml

@@ -9,5 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # needed to annotate the files in a pull request with comments
+      pull-requests: write
     steps:
-      - uses: it-at-m/lhm_actions/action-templates/actions/action-actionlint@4ed8f906bab8111fbd9a7af8e3f4129f9b721757 # v1.2.3
+      - uses: it-at-m/lhm_actions/action-templates/actions/action-actionlint@e9a8422d740d4e9eaef25cfeeb3a5790da97a7aa # v1.2.4

.trivyignore

@@ -1,2 +1,2 @@
-# Deno-runtime related vulnerability, irrelevant as Node.js is used
-GHSA-gv7w-rqvm-qjhr
+# brace-expansion (npm) related DoS vulnerability, however irrelevant as we do not use it in production
+CVE-2026-14257

backend/Dockerfile

@@ -1,5 +1,5 @@
 # For documentation see https://jboss-container-images.github.io/openjdk/
-FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:1.24-9@sha256:434a4e1c5d6d57c4380ddc0f2c1707ec65df1cb294ea84b21d37ca54aa4b923c
+FROM registry.access.redhat.com/ubi10/openjdk-21-runtime:1.24-10@sha256:3f21794f7e1c568a194798dc36f8bb09da239471fa88d7fa8353efaa091549cc
 
 # Copy runnable jar to deployments
 COPY target/*.jar /deployments/application.jar

backend/pom.xml

@@ -83,6 +83,7 @@
 
         <!-- TEMPORARY TRANSITIVE DEPENDENCY OVERRIDES FOR SECURITY FIXES -->
         <!-- Preferably override properties defined in spring-boot-starter -> spring-boot-dependencies POM -->
+        <postgresql.version>42.7.12</postgresql.version> <!-- CVE-2026-54291 -->
     </properties>
 
     <dependencies>

backend/src/main/java/de/muenchen/oss/refarch/backend/configuration/filter/RequestResponseLoggingFilter.java

@@ -10,14 +10,15 @@
 import java.util.List;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.jspecify.annotations.NonNull;
 import org.springframework.boot.web.servlet.FilterRegistration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.stereotype.Component;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 /**
- * This filter logs the username for requests.
+ * This filter logs the username from requests using the {@link AuthUtils} bean.
  */
 @Component
 @FilterRegistration(urlPatterns = "/*", order = 1)
@@ -28,6 +29,7 @@ public class RequestResponseLoggingFilter extends OncePerRequestFilter {
     private static final List<String> CHANGING_METHODS = List.of(HttpMethod.POST.name(), HttpMethod.PUT.name(), HttpMethod.PATCH.name(),
             HttpMethod.DELETE.name());
 
+    private final AuthUtils authUtils;
     private final SecurityProperties securityProperties;
 
     /**
@@ -54,12 +56,12 @@ public enum LoggingMode {
      * {@inheritDoc}
      */
     @Override
-    protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response, final FilterChain filterChain)
+    protected void doFilterInternal(final @NonNull HttpServletRequest request, final @NonNull HttpServletResponse response, final FilterChain filterChain)
             throws ServletException, IOException {
         filterChain.doFilter(request, response);
         if (checkForLogging(request)) {
             log.info("User {} executed {} on URI {} with http status {}",
-                    AuthUtils.getUsername(),
+                    authUtils.getUsername(),
                     request.getMethod(),
                     request.getRequestURI(),
                     response.getStatus());

backend/src/main/java/de/muenchen/oss/refarch/backend/configuration/security/SecurityProperties.java

@@ -26,6 +26,12 @@ public class SecurityProperties {
      */
     @NotBlank private String clientId;
 
+    /**
+     * Name of the JWT claim that contains the username.
+     * Defaults to "preferred_username" if not configured.
+     */
+    @NotBlank private String usernameClaim = "preferred_username";
+
     /**
      * URI of the endpoint used for fetching permissions,
      * see also {@link KeycloakPermissionsAuthoritiesConverter}.

backend/src/main/java/de/muenchen/oss/refarch/backend/security/AuthUtils.java

@@ -1,35 +1,35 @@
 package de.muenchen.oss.refarch.backend.security;
 
+import de.muenchen.oss.refarch.backend.configuration.security.SecurityProperties;
+import lombok.RequiredArgsConstructor;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
+import org.springframework.stereotype.Component;
 
 /**
- * Utilities for authentication data.
+ * Utility bean for authentication related data.
  */
-public final class AuthUtils {
+@Component
+@RequiredArgsConstructor
+public class AuthUtils {
 
     public static final String NAME_UNAUTHENTICATED_USER = "unauthenticated";
 
-    private static final String TOKEN_USER_NAME = "preferred_username";
-
-    private AuthUtils() {
-    }
+    private final SecurityProperties securityProperties;
 
     /**
      * Extracts the user name from the existing Spring Security Context via
      * {@link SecurityContextHolder}.
      *
      * @return the username or an "unauthenticated" if no {@link Authentication} exists
      */
-    public static String getUsername() {
+    public String getUsername() {
         final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-        if (authentication instanceof JwtAuthenticationToken) {
-            final JwtAuthenticationToken jwtAuth = (JwtAuthenticationToken) authentication;
-            return (String) jwtAuth.getTokenAttributes().getOrDefault(TOKEN_USER_NAME, null);
-        } else if (authentication instanceof UsernamePasswordAuthenticationToken) {
-            final UsernamePasswordAuthenticationToken usernameAuth = (UsernamePasswordAuthenticationToken) authentication;
+        if (authentication instanceof JwtAuthenticationToken jwtAuth) {
+            return (String) jwtAuth.getTokenAttributes().get(securityProperties.getUsernameClaim());
+        } else if (authentication instanceof UsernamePasswordAuthenticationToken usernameAuth) {
             return usernameAuth.getName();
         } else {
             return NAME_UNAUTHENTICATED_USER;

backend/src/test/java/de/muenchen/oss/refarch/backend/security/AuthUtilsTest.java

@@ -0,0 +1,95 @@
+package de.muenchen.oss.refarch.backend.security;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.when;
+
+import de.muenchen.oss.refarch.backend.configuration.security.SecurityProperties;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
+
+@ExtendWith(MockitoExtension.class)
+class AuthUtilsTest {
+
+    private static final String USERNAME_CLAIM = "preferred_username";
+
+    @Mock
+    private SecurityProperties securityProperties;
+
+    @InjectMocks
+    private AuthUtils authUtils;
+
+    @AfterEach
+    void tearDown() {
+        SecurityContextHolder.clearContext();
+    }
+
+    @Test
+    void givenJwtWithUsernameClaim_thenReturnUsername() {
+        // given
+        when(securityProperties.getUsernameClaim()).thenReturn(USERNAME_CLAIM);
+        final Jwt jwt = Jwt.withTokenValue("token")
+                .header("alg", "none")
+                .claim(USERNAME_CLAIM, "john.doe")
+                .build();
+        final JwtAuthenticationToken authentication = new JwtAuthenticationToken(jwt);
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+
+        // when
+        final String username = authUtils.getUsername();
+
+        // then
+        assertThat(username).isEqualTo("john.doe");
+    }
+
+    @Test
+    void givenJwtWithoutUsernameClaim_thenReturnUnauthenticatedUser() {
+        // given
+        when(securityProperties.getUsernameClaim()).thenReturn(USERNAME_CLAIM);
+        final Jwt jwt = Jwt.withTokenValue("token")
+                .header("alg", "none")
+                .claims(claims -> claims.put("other", "value"))
+                .build();
+        final JwtAuthenticationToken authentication = new JwtAuthenticationToken(jwt);
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+
+        // when
+        final String username = authUtils.getUsername();
+
+        // then
+        assertThat(username).isNull();
+    }
+
+    @Test
+    void givenUsernamePasswordAuthentication_thenReturnUsername() {
+        // given
+        final UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken("jane.doe", "password");
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+
+        // when
+        final String username = authUtils.getUsername();
+
+        // then
+        assertThat(username).isEqualTo("jane.doe");
+    }
+
+    @Test
+    void givenNoAuthentication_thenReturnUnauthenticatedUser() {
+        // given
+        SecurityContextHolder.clearContext();
+
+        // when
+        final String username = authUtils.getUsername();
+
+        // then
+        assertThat(username).isEqualTo(AuthUtils.NAME_UNAUTHENTICATED_USER);
+    }
+
+}