Bastion host integration

// A web call in JavaScript is redirected to ODC.
window.open('xxx.xxx.x.x:2883/#/gateway/' + param)  

// Evoke the Chrome browser.
chrome.exe --new-window xxx.xxx.x.x:2883/#/gateway/param

{
 action: string, // The call type.
  data: any, // The data parameter in a call. If parameter encryption is enabled, parameters are serialized to a string. Otherwise, parameters are directly passed.
  encrypt: boolean // Specifies whether to encrypt the parameters.
}

-- Enable the integrated bastion host.
update `config_system_configuration` set `value` = 'true' where `key` = 'odc.integration.bastion.enabled';

-- Specify not to enable parameter encryption.
update `config_system_configuration` set `value` = 'false' where `key` = 'odc.integration.bastion.encryption.enabled';
update `config_system_configuration` set `value` = 'RAW' where `key` = 'odc.integration.bastion.encryption.algorithm';
update `config_system_configuration` set `value` = '' where `key` = 'odc.integration.bastion.encryption.secret';

-- Enable automatic login.
update `config_system_configuration` set `value` = 'true' where `key` = 'odc.integration.bastion.account.auto-login-enabled';

-- Configure the account query API of the bastion host. The Moco service configured in Step 2 is used as an example. Note that the API configuration must match the Moco configuration.
update `config_system_configuration` set `value` = 'POST' where `key` = 'odc.integration.bastion.account.query.request-method';
update `config_system_configuration` set `value` = 'http://xx.xx.xx.xx:*****/api/queryUser' where `key` = 'odc.integration.bastion.account.query.request-url';
update `config_system_configuration` set `value` = 'Content-Type=application/json;charset=UTF-8,Accept=application/json' where `key` = 'odc.integration.bastion.account.query.request-headers';
update `config_system_configuration` set `value` = '{"accountVerifyToken":"${account_verify_token}"}' where `key` = 'odc.integration.bastion.account.query.request-body';
update `config_system_configuration` set `value` = 'false' where `key` = 'odc.integration.bastion.account.query.request-encrypted';
update `config_system_configuration` set `value` = '[''resultCode''] == 0' where `key` = 'odc.integration.bastion.account.query.response-body-valid-expression';
update `config_system_configuration` set `value` = '[''userCode'']' where `key` = 'odc.integration.bastion.account.query.response-body-username-extract-expression';
update `config_system_configuration` set `value` = '[''userName'']' where `key` = 'odc.integration.bastion.account.query.response-body-nickname-extract-expression';
update `config_system_configuration` set `value` = 'false' where `key` = 'odc.integration.bastion.account.query.response-encrypted';

-- Configure HTTP connection settings.
update `config_system_configuration` set `value` = '5' where `key` = 'odc.integration.bastion.account.http.connect-timeout-seconds';
update `config_system_configuration` set `value` = '20' where `key` = 'odc.integration.bastion.account.query.read-timeout-seconds';

-- Configure GET connection settings.
update `config_system_configuration` set `value` = 'http://xx.xx.xx.xx:*****/api/queryUser2?accountVerifyToken=${account_verify_token}' where `key` = 'odc.integration.bastion.account.query.request-url';
update `config_system_configuration` set `value` = '' where `key` = 'odc.integration.bastion.account.query.request-body';

// Construct the data parameter.
const data = {
 accountVerifyToken: 'token_value'
}

// Construct the ODC call parameter.
const ODCData = {
 action: 'start',
  data: encrypt(JSON.stringify(data)), // Encrypt data.
  encrypt: true
}

// Convert JSON type data into a Base64 string.
const param = base64(JSON.stringify(ODCData)); 

// Call Web ODC on a web page.
window.open('xxx.xxx.x.x:2883/#/gateway/' + param)  

// Evoke the Chrome browser.
chrome.exe --new-window xxx.xxx.x.x:2883/#/gateway/param

// Construct the data parameter.
// ODC cannot parse the values of parameters in the properties parameter, and must confirm the information with the integrated approval and auditing systems.
const data = {
  accountVerifyToken: 'token_value',
  type: 'OB_ORACLE',
  host: 'xxx.xxx.x.x',
  port: 2883, 

  username: 'username',
  password: '****',
  tenantName: 'oracle',
  defaultSchema: 'default',
  properties: {
    accountName: '****',
    dbInstance: '****',
    instanceType: 2,
    ipAddress: '****',
    operateSessionId: '****',
    serviceName: '****',
    userCode: '****',
  }  
}

// Construct the ODC call parameter.
const ODCData = {
 action: 'newTempSession',
  data: encrypt(JSON.stringify(data)), // Encrypt data.
  encrypt: true
}

// Convert JSON type data into a Base64 string.
const param = base64(JSON.stringify(ODCData)); 

// Call Web ODC on a web page.
window.open('xxx.xxx.x.x:2883/#/gateway/' + param)  

// Evoke the Chrome browser.
chrome.exe --new-window xxx.xxx.x.x:2883/#/gateway/param

package com.oceanbase.odc.example;

import java.nio.charset.StandardCharsets;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.KeySpec;
import java.util.Arrays;
import java.util.Base64;
import java.util.Objects;

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyGenerator;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;

/**
 * AES encryption and decryption by using Base64
 */
public class AesBase64TextEncryptor {
    private final AesBytesEncryptor encryptDecrypt;

    /**
     * @param key The encryption key string.
     * @param salt The salt value used for generating the key. This parameter is optional. If you do not specify it, salt is not used.
     */
    public AesBase64TextEncryptor(String key, String salt) {
        this.encryptDecrypt = new AesBytesEncryptor(key, salt);
    }

    /**
     * @param key The encryption key string.
     * @param salt The salt value used for generating the key. This parameter is optional.
     * @param keyLength The length of the key.
     */
    public AesBase64TextEncryptor(String key, String salt, int keyLength) {
        this.encryptDecrypt = new AesBytesEncryptor(key, salt, keyLength);
    }

    /**
     * Encryption
     */
    public synchronized String encrypt(String plainText) {
        if (plainText == null) {
            return null;
        }
        byte[] bytes = plainText.getBytes(StandardCharsets.UTF_8);
        byte[] encrypted = encryptDecrypt.encrypt(bytes);
        return base64Encode(encrypted);
    }

    /**
     * Decryption
     */
    public synchronized String decrypt(String encryptedText) {
        if (encryptedText == null) {
            return null;
        }
        byte[] encrypted = base64Decode(encryptedText);
        byte[] decrypt = encryptDecrypt.decrypt(encrypted);
        return new String(decrypt, StandardCharsets.UTF_8);
    }

    private byte[] base64Decode(String right) {
        byte[] bytes = right.getBytes(StandardCharsets.UTF_8);
        return Base64.getDecoder().decode(bytes);
    }

    private String base64Encode(byte[] left) {
        byte[] encoded = Base64.getEncoder().encode(left);
        if (Objects.isNull(encoded)) {
            return null;
        }
        return new String(encoded, StandardCharsets.UTF_8);
    }

    public static class AesBytesEncryptor {

        private static final String FACTORY_INSTANCE = "PBKDF2WithHmacSHA256";
        private static final String CIPHER_INSTANCE = "AES/CBC/PKCS5PADDING";
        private static final String SECRET_KEY_TYPE = "AES";
        private static final String NO_SALT_SECURE_RANDOM_INSTANCE = "SHA1PRNG";

        /**
         * The default length of the key.
         */
        private static final int DEFAULT_KEY_LENGTH = 256;

        /**
         * IV stands for initialization vector.<br>
         * The use of a random IV in Cipher Block Chaining (CBC) mode ensures that a different value is generated each time the same source is encrypted.
         */
        private static final int IV_LENGTH = 16;

        /**
         * More iterations indicate higher encryption and decryption costs, as well as longer time spent on brute force decryption. We recommend that you set a value not less than 1000.
         */
        private static final int ITERATION_COUNT = 1024;

        /**
         * The length of the key.
         */
        private final int keyLength;

        private final SecretKeySpec secretKey;
        private final Cipher encryptor;
        private final Cipher decryptor;

        public AesBytesEncryptor(String key, String salt, int keyLength) {
            Validate.notEmpty(key, "parameter 'key' must not be empty");
            Validate.validState(keyLength > 0, "parameter 'keyLength' must greater than 0");
            this.keyLength = keyLength;
            this.secretKey = newSecretKey(key, salt);
            this.encryptor = createCipher();
            this.decryptor = createCipher();
        }

        public AesBytesEncryptor(String key, String salt) {
            this(key, salt, DEFAULT_KEY_LENGTH);
        }

        public byte[] encrypt(byte[] origin) {
            Validate.notNull(origin, "parameter 'origin' may not be null");
            // Generating a random IV
            SecureRandom random = new SecureRandom();
            byte[] iv = new byte[IV_LENGTH];
            random.nextBytes(iv);
            initCipher(encryptor, Cipher.ENCRYPT_MODE, iv);
            byte[] encrypted = doFinal(encryptor, origin);
            return addIVToCipher(encrypted, iv);
        }

        public byte[] decrypt(byte[] encrypted) {
            Validate.notNull(encrypted, "parameter 'encrypted' may not be null");
            Validate.isTrue(encrypted.length >= IV_LENGTH,
                    "length of parameter 'encrypted' may not less than IV length " + IV_LENGTH);
            byte[] iv = new byte[IV_LENGTH];
            System.arraycopy(encrypted, 0, iv, 0, IV_LENGTH);
            initCipher(decryptor, Cipher.DECRYPT_MODE, iv);
            byte[] original = doFinal(decryptor, encrypted);
            return Arrays.copyOfRange(original, IV_LENGTH, original.length);
        }

        private byte[] doFinal(Cipher cipher, byte[] input) {
            try {
                return cipher.doFinal(input);
            } catch (IllegalBlockSizeException e) {
                throw new IllegalStateException(
                        "Unable to invoke Cipher due to illegal block size", e);
            } catch (BadPaddingException e) {
                throw new IllegalStateException("Unable to invoke Cipher due to bad padding",
                        e);
            }
        }

        private SecretKeySpec newSecretKey(String key, String salt) {
            try {
                if (Objects.isNull(salt) || salt.isEmpty()) {
                    SecureRandom random = SecureRandom.getInstance(NO_SALT_SECURE_RANDOM_INSTANCE);
                    random.setSeed(key.getBytes());

                    KeyGenerator keyGenerator = KeyGenerator.getInstance(SECRET_KEY_TYPE);
                    keyGenerator.init(keyLength, random);

                    SecretKey secretKey = keyGenerator.generateKey();
                    return new SecretKeySpec(secretKey.getEncoded(), SECRET_KEY_TYPE);
                } else {
                    SecretKeyFactory factory = SecretKeyFactory.getInstance(FACTORY_INSTANCE);
                    KeySpec keySpec = new PBEKeySpec(key.toCharArray(), salt.getBytes(), ITERATION_COUNT, keyLength);
                    SecretKey secretKey = factory.generateSecret(keySpec);
                    return new SecretKeySpec(secretKey.getEncoded(), SECRET_KEY_TYPE);
                }
            } catch (

            NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Not a valid encryption algorithm", e);
            } catch (InvalidKeySpecException e) {
                throw new IllegalArgumentException("Not a valid secret key", e);
            }
        }

        private void initCipher(Cipher cipher, int mode, byte[] iv) {
            try {
                cipher.init(mode, secretKey, new IvParameterSpec(iv));
            } catch (InvalidKeyException e) {
                throw new IllegalArgumentException("Not a valid secret key", e);
            } catch (InvalidAlgorithmParameterException e) {
                throw new IllegalArgumentException("Not a valid encryption algorithm", e);
            }
        }

        private Cipher createCipher() {
            try {
                return Cipher.getInstance(CIPHER_INSTANCE);
            } catch (NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Not a valid encryption algorithm", e);
            } catch (NoSuchPaddingException e) {
                throw new IllegalStateException("Should not happen", e);
            }
        }

        private byte[] addIVToCipher(byte[] encrypted, byte[] iv) {
            byte[] cipherWithIv = new byte[iv.length + encrypted.length];
            System.arraycopy(iv, 0, cipherWithIv, 0, iv.length);
            System.arraycopy(encrypted, 0, cipherWithIv, iv.length, encrypted.length);
            return cipherWithIv;
        }
    }

    public static class Validate {
        public static <T extends CharSequence> T notEmpty(final T chars, final String message, final Object... values) {
            Objects.requireNonNull(chars, () -> String.format(message, values));
            if (chars.length() == 0) {
                throw new IllegalArgumentException(String.format(message, values));
            }
            return chars;
        }

        public static void validState(final boolean expression, final String message, final Object... values) {
            if (!expression) {
                throw new IllegalStateException(String.format(message, values));
            }
        }

        public static <T> T notNull(final T object, final String message, final Object... values) {
            return Objects.requireNonNull(object, () -> String.format(message, values));
        }

        public static void isTrue(final boolean expression, final String message, final Object... values) {
            if (!expression) {
                throw new IllegalArgumentException(String.format(message, values));
            }
        }
    }
}

package com.oceanbase.odc.example;

import org.junit.Assert;
import org.junit.Test;

public class AesBase64TextEncryptorTest {

    @Test
    public void encryptDecrypt_NoSalt() {
        AesBase64TextEncryptor encryptor = new AesBase64TextEncryptor("1234567890123456_1", null);

        String origin = "abcd1234";
        String encrypt = encryptor.encrypt(origin);
        String decrypt = encryptor.decrypt(encrypt);
        Assert.assertEquals(origin, decrypt);
    }

    @Test
    public void sameKeyTwice_Different() {
        AesBase64TextEncryptor encryptor = new AesBase64TextEncryptor("1234567890123456_1", null);

        String encrypted1 = encryptor.encrypt("123654");
        String encrypted2 = encryptor.encrypt("123654");
        Assert.assertNotEquals(encrypted1, encrypted2);
    }

}