Separate system and application users

[PareekshithPalat]

Separate System Users and Application Users

Summary

Implemented system-user and application-user separation for API authentication.

System users are now configurable through c_configuration and are allowed to authenticate using Basic Authentication, while application users are prevented from using Basic Authentication.

Changes

System User Configuration

• Added a new system-users configuration in c_configuration.
• Initial configured system users:
  • system
  • mifos
  • template_system
• System users can be extended through configuration without modifying Java code.

Configuration Service

• Added getSystemUsernames() to ConfigurationDomainService.
• Implemented configuration lookup and comma-separated username parsing in ConfigurationDomainServiceJpa.
• Uses the existing configuration caching mechanism.

Basic Authentication

Updated TenantAwareBasicAuthenticationFilter to:

• Allow Basic Authentication only for configured system users.
• Reject application users attempting to authenticate using Basic Authentication.

Token Authentication

Updated CustomTokenAuthenticationFilter to:

• Reject configured system users attempting to authenticate using application tokens.
• Continue allowing application users through the normal token authentication flow.

Modified Files

• fineract-provider/src/main/resources/db/changelog/tenant/parts/0137_add_system_users_configuration.xml
• fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml
• fineract-provider/src/main/java/org/apache/fineract/infrastructure/configuration/domain/ConfigurationDomainService.java
• fineract-provider/src/main/java/org/apache/fineract/infrastructure/configuration/domain/ConfigurationDomainServiceJpa.java
• fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/filter/TenantAwareBasicAuthenticationFilter.java
• fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/filter/CustomTokenAuthenticationFilter.java

Verification

Verified the following authentication behavior:

• System user + Basic Auth → Allowed
• System user + Token Auth → Rejected
• Application user + Basic Auth → Rejected
• Application user + Token Auth → Allowed

Also verified that adding a user to the system-users configuration dynamically allows that user to authenticate as a system user.