Adding proxy to GraphProxy OkHttpClient (#162)

Co-authored-by: Tim Jacomb <[email protected]>

Author: meiswjn

pom.xml

@@ -161,7 +161,7 @@
         <dependency>
             <groupId>org.bitbucket.b_c</groupId>
             <artifactId>jose4j</artifactId>
-            <version>0.6.3</version>
+            <version>0.7.9</version>
             <exclusions>
                 <exclusion>
                     <groupId>org.slf4j</groupId>

src/main/java/com/microsoft/jenkins/azuread/AzureSecurityRealm.java

@@ -184,11 +184,11 @@ private ClientSecretCredential getClientSecretCredential() {
                 .build();
     }
 
-    private static OkHttpClient.Builder addProxyToHttpClientIfRequired(OkHttpClient.Builder builder) {
+    public static OkHttpClient.Builder addProxyToHttpClientIfRequired(OkHttpClient.Builder builder) {
         if (JenkinsJVM.isJenkinsJVM()) {
             ProxyConfiguration proxyConfiguration = Jenkins.get().getProxy();
             if (proxyConfiguration != null && StringUtils.isNotBlank(proxyConfiguration.getName())) {
-                Proxy proxy = proxyConfiguration.createProxy("https://graph.microsoft.com");
+                Proxy proxy = proxyConfiguration.createProxy("graph.microsoft.com");
 
                 builder = builder.proxy(proxy);
                 if (StringUtils.isNotBlank(proxyConfiguration.getUserName())) {

src/main/java/com/microsoft/jenkins/azuread/GraphProxy.java

@@ -5,6 +5,7 @@
 import com.github.benmanes.caffeine.cache.Caffeine;
 import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.Extension;
+import hudson.ProxyConfiguration;
 import hudson.model.AbstractItem;
 import hudson.model.Action;
 import hudson.model.Computer;
@@ -35,20 +36,21 @@
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
 
+import static com.microsoft.jenkins.azuread.AzureSecurityRealm.addProxyToHttpClientIfRequired;
+
 /**
  * Proxies calls to the Microsoft Graph API.
  */
 @Extension
 @Restricted(NoExternalUse.class)
 public class GraphProxy implements RootAction, StaplerProxy {
-
-    private static final OkHttpClient CLIENT = new OkHttpClient();
     private static final int TEN = 10;
     private final Cache<String, AccessToken> tokenCache = Caffeine.newBuilder()
             .expireAfterWrite(TEN, TimeUnit.MINUTES)
             .build();
 
     private AccessControlled accessControlled;
+    private static final OkHttpClient DEFAULT_CLIENT = new OkHttpClient();
 
     @Override
     public String getIconFileName() {
@@ -122,19 +124,19 @@ public Collection<? extends Action> createFor(@NonNull Computer target) {
             return Collections.singletonList(new GraphProxy(target));
         }
     }
-
     public void doDynamic(StaplerRequest request, StaplerResponse response) throws IOException {
         proxy(request, response);
     }
 
     private void proxy(StaplerRequest request, StaplerResponse response) throws IOException {
+        OkHttpClient client = getClient();
         String baseUrl = getBaseUrl();
         String token = getToken();
 
         String url = buildUrl(request, baseUrl);
         Request okRequest = buildRequest(request, token, url);
 
-        try (Response okResp = CLIENT.newCall(okRequest).execute()) {
+        try (Response okResp = client.newCall(okRequest).execute()) {
             String contentType = okResp.header("Content-Type", "application/json");
 
             response.setContentType(contentType);
@@ -157,6 +159,17 @@ private void proxy(StaplerRequest request, StaplerResponse response) throws IOEx
         }
     }
 
+    /**
+     * Prefers the default client for performance, proxy users will get a new instance each time.
+     */
+    private OkHttpClient getClient() {
+        ProxyConfiguration proxyConfiguration = Jenkins.get().getProxy();
+        if (proxyConfiguration != null && StringUtils.isNotBlank(proxyConfiguration.getName())) {
+            return addProxyToHttpClientIfRequired(new OkHttpClient().newBuilder()).build();
+        }
+        return DEFAULT_CLIENT;
+    }
+
     private String getToken() {
         SecurityRealm securityRealm = Jenkins.get().getSecurityRealm();
         if (securityRealm instanceof AzureSecurityRealm) {

src/main/java/com/microsoft/jenkins/azuread/Utils.java

@@ -10,7 +10,10 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.PropertyNamingStrategies;
 import hudson.Functions;
+import hudson.ProxyConfiguration;
 import hudson.util.FormValidation;
+import jenkins.model.Jenkins;
+import org.jose4j.http.Get;
 import org.jose4j.jwk.HttpsJwks;
 import org.jose4j.jwt.consumer.JwtConsumer;
 import org.jose4j.jwt.consumer.JwtConsumerBuilder;
@@ -72,9 +75,16 @@ public static class JwtUtil {
 
         public static JwtConsumer jwt(final String clientId, final String tenantId) {
             final String expectedIssuer = String.format("https://login.microsoftonline.com/%s/v2.0", tenantId);
-            HttpsJwks httpsJkws = new HttpsJwks(KEYSTORE_URL);
-            httpsJkws.setDefaultCacheDuration(DEFAULT_CACHE_DURATION);
-            HttpsJwksVerificationKeyResolver httpsJwksKeyResolver = new HttpsJwksVerificationKeyResolver(httpsJkws);
+            HttpsJwks httpsJwks = new HttpsJwks(KEYSTORE_URL);
+            httpsJwks.setDefaultCacheDuration(DEFAULT_CACHE_DURATION);
+            ProxyConfiguration proxy = Jenkins.get().getProxy();
+            if (proxy != null) {
+                Get get = new Get();
+                get.setHttpProxy(proxy.createProxy("login.microsoftonline.com"));
+                httpsJwks.setSimpleHttpGet(get);
+            }
+
+            HttpsJwksVerificationKeyResolver httpsJwksKeyResolver = new HttpsJwksVerificationKeyResolver(httpsJwks);
             return new JwtConsumerBuilder()
                     .setVerificationKeyResolver(httpsJwksKeyResolver)
                     .setExpectedIssuer(expectedIssuer)