Local CA to use Keystores

Issue-ID: AAF-204
Change-Id: I59491ffa26d5ea117a98470f38f090900b9e1b4e
Signed-off-by: Instrumental <jcgmisc@stl.gathman.org>

41 files changed, 293 insertions, 55 deletions

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..988e9128
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+/.settings/
+/.project
+/target/
diff --git a/auth/.gitignore b/auth/.gitignore
new file mode 100644
index 00000000..988e9128
--- /dev/null
+++ b/auth/.gitignore
@@ -0,0 +1,3 @@
+/.settings/
+/.project
+/target/
diff --git a/auth/auth-batch/.gitignore b/auth/auth-batch/.gitignore
new file mode 100644
index 00000000..9f0fc218
--- /dev/null
+++ b/auth/auth-batch/.gitignore
@@ -0,0 +1,4 @@
+/.settings/
+/target/
+/.classpath
+/.project
diff --git a/auth/auth-batch/src/main/config/.gitignore b/auth/auth-batch/src/main/config/.gitignore
index 28a74e22..1941d7a5 100644
--- a/auth/auth-batch/src/main/config/.gitignore
+++ b/auth/auth-batch/src/main/config/.gitignore
@@ -1,2 +1,5 @@
 /authBatch.props
 /log4j.properties
+/.settings/
+/.project
+/target/
diff --git a/auth/auth-cass/.gitignore b/auth/auth-cass/.gitignore
new file mode 100644
index 00000000..5fd2ede3
--- /dev/null
+++ b/auth/auth-cass/.gitignore
@@ -0,0 +1,4 @@
+/.settings/
+/.project
+/target/
+/.classpath
diff --git a/auth/auth-cass/src/main/cql/.gitignore b/auth/auth-cass/src/main/cql/.gitignore
index f17048e9..d091d305 100644
--- a/auth/auth-cass/src/main/cql/.gitignore
+++ b/auth/auth-cass/src/main/cql/.gitignore
@@ -1 +1,5 @@
 /init.cql
+/.settings/
+/.project
+/target/
+/.classpath
diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/.gitignore b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/.gitignore
index e69de29b..5fd2ede3 100644
--- a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/.gitignore
+++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/.gitignore
@@ -0,0 +1,4 @@
+/.settings/
+/.project
+/target/
+/.classpath
diff --git a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/.gitignore b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/.gitignore
index 488b914c..1871693c 100644
--- a/auth/auth-cass/src/test/java/com/att/dao/aaf/test/.gitignore
+++ b/auth/auth-cass/src/test/java/com/att/dao/aaf/test/.gitignore
@@ -1 +1,5 @@
 /JU_OAuthAppDAO.java
+/.settings/
+/.project
+/target/
+/.classpath
diff --git a/auth/auth-cass/target/classes/.gitignore b/auth/auth-cass/target/classes/.gitignore
new file mode 100644
index 00000000..6302aa99
--- /dev/null
+++ b/auth/auth-cass/target/classes/.gitignore
@@ -0,0 +1,5 @@
+/org/
+/.settings/
+/.project
+/target/
+/.classpath
diff --git a/auth/auth-cass/target/test-classes/com/att/dao/aaf/test/.gitignore b/auth/auth-cass/target/test-classes/com/att/dao/aaf/test/.gitignore
new file mode 100644
index 00000000..1871693c
--- /dev/null
+++ b/auth/auth-cass/target/test-classes/com/att/dao/aaf/test/.gitignore
@@ -0,0 +1,5 @@
+/JU_OAuthAppDAO.java
+/.settings/
+/.project
+/target/
+/.classpath
diff --git a/auth/auth-certman/.gitignore b/auth/auth-certman/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-certman/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java
index b6a2a0a9..70f67940 100644
--- a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java
+++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java
@@ -21,13 +21,22 @@
 package org.onap.aaf.auth.cm.ca;
 
 import java.io.File;
+import java.io.FileInputStream;
 import java.io.FileReader;
 import java.io.IOException;
 import java.math.BigInteger;
 import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.KeyStore.Entry;
+import java.security.KeyStore.PrivateKeyEntry;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.Provider;
 import java.security.SecureRandom;
+import java.security.UnrecoverableEntryException;
+import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
-import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.ArrayList;
 import java.util.Date;
@@ -68,7 +77,7 @@ public class LocalCA extends CA {
 				KeyPurposeId.id_kp_serverAuth, // WebServer
 				KeyPurposeId.id_kp_clientAuth};// WebClient
 				
-	private final RSAPrivateKey caKey;
+	private final PrivateKey caKey;
 	private final X500Name issuer;
 	private final SecureRandom random = new SecureRandom();
 	private byte[] serialish;
@@ -82,38 +91,93 @@ public class LocalCA extends CA {
 		}
 		
 		// Read in the Private Key
-		File f = new File(params[0][0]); // key
-		if(f.exists()) {
-			caKey = (RSAPrivateKey)Factory.toPrivateKey(NullTrans.singleton(),f);
-		} else {
-			throw new CertException("Private Key, " + f.getPath() + ", does not exist");
-		}
+		String configured;
+		File f = new File(params[0][0]);
+		if(f.exists() && f.isFile()) {
+			String fileName = f.getName();
+			if(fileName.endsWith(".key")) {
+				caKey = Factory.toPrivateKey(NullTrans.singleton(),f);
+				List<FileReader> frs = new ArrayList<FileReader>(params.length-1);
+				try {
+					String dir = access.getProperty(CM_PUBLIC_DIR, "");
+					if(!"".equals(dir) && !dir.endsWith("/")) {
+						dir = dir + '/';
+					}
 
-		String dir = access.getProperty(CM_PUBLIC_DIR, "");
-		if(!"".equals(dir) && !dir.endsWith("/")) {
-			dir = dir + '/';
-		}
-		List<FileReader> frs = new ArrayList<FileReader>(params.length-1);
-		try {
-			String path;
-			for(int i=1; i<params[0].length; ++i) { // first param is Private Key, remainder are TrustChain
-				path = !params[0][i].contains("/")?dir+params[0][i]:params[0][i];
-				access.printf(Level.INIT, "Loading a TrustChain Member for %s from %s\n",name, path);
-				frs.add(new FileReader(path));
-			}
-			x509cwi = new X509ChainWithIssuer(frs);
-			X500NameBuilder xnb = new X500NameBuilder();
-			for(RDN rnd : RDN.parse(',', x509cwi.getIssuerDN())) {
-				xnb.addRDN(rnd.aoi,rnd.value);
-			}
-			issuer = xnb.build();
-		} finally {
-			for(FileReader fr : frs) {
-				if(fr!=null) {
-					fr.close();
+					String path;
+					for(int i=1; i<params[0].length; ++i) { // first param is Private Key, remainder are TrustChain
+						path = !params[0][i].contains("/")?dir+params[0][i]:params[0][i];
+						access.printf(Level.INIT, "Loading a TrustChain Member for %s from %s\n",name, path);
+						frs.add(new FileReader(path));
+					}
+					x509cwi = new X509ChainWithIssuer(frs);
+				} finally {
+					for(FileReader fr : frs) {
+						if(fr!=null) {
+							fr.close();
+						}
+					}
+				}
+				configured = "Configured with " + fileName;
+			} else {
+				if(params.length<1 || params[0].length<3) {
+					throw new CertException("LocalCA parameters must be <keystore [.p12|.pkcs12|.jks|.pkcs11(sun only)]; <alias>; enc:<encrypted Keystore Password>>");
+				}
+				try {
+					Provider p;
+					KeyStore keyStore;
+					if(fileName.endsWith(".pkcs11")) {
+						String ksType;
+						p = Factory.getSecurityProvider(ksType="PKCS11",params);
+						keyStore = KeyStore.getInstance(ksType,p);
+					} else if(fileName.endsWith(".jks")) {
+						keyStore = KeyStore.getInstance("JKS");
+					} else if(fileName.endsWith(".p12") || fileName.endsWith(".pkcs12")) {
+						keyStore = KeyStore.getInstance("PKCS12");
+					} else {
+						throw new CertException("Unknown Keystore type from filename " + fileName);
+					}
+					
+					FileInputStream fis = new FileInputStream(f);
+					KeyStore.ProtectionParameter keyPass;
+
+					try {
+						String pass = access.decrypt(params[0][2]/*encrypted passcode*/, true);
+						if(pass==null) {
+							throw new CertException("Passcode for " + fileName + " cannot be decrypted.");
+						}
+						char[] ksPass = pass.toCharArray();
+						//Assuming Key Pass is same as Keystore Pass
+						keyPass = new KeyStore.PasswordProtection(ksPass);
+
+						keyStore.load(fis,ksPass);
+					} finally {
+						fis.close();
+					}
+					Entry entry = keyStore.getEntry(params[0][1]/*alias*/, keyPass);
+					if(entry==null) {
+						throw new CertException("There is no Keystore entry with name '" + params[0][1] +'\'');
+					}
+					PrivateKeyEntry privateKeyEntry = (PrivateKeyEntry)entry;
+					caKey = privateKeyEntry.getPrivateKey();
+					
+					x509cwi = new X509ChainWithIssuer(privateKeyEntry.getCertificateChain());
+					configured =  "keystore \"" + fileName + "\", alias " + params[0][1];
+				} catch (KeyStoreException | NoSuchAlgorithmException | CertificateException | UnrecoverableEntryException e) {
+					throw new CertException("Exception opening Keystore " + fileName, e);
 				}
 			}
+		} else {
+			throw new CertException("Private Key, " + f.getPath() + ", does not exist");
+		}
+		
+		X500NameBuilder xnb = new X500NameBuilder();
+		for(RDN rnd : RDN.parse(',', x509cwi.getIssuerDN())) {
+			xnb.addRDN(rnd.aoi,rnd.value);
 		}
+		issuer = xnb.build();
+		access.printf(Level.INIT, "LocalCA is configured with %s.  The Issuer DN is %s.",
+				configured, issuer.toString());
 	}
 
 	/* (non-Javadoc)
diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509ChainWithIssuer.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509ChainWithIssuer.java
index e0a85676..6f3062bb 100644
--- a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509ChainWithIssuer.java
+++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/X509ChainWithIssuer.java
@@ -67,6 +67,21 @@ public class X509ChainWithIssuer extends X509andChain {
 		}
 	}
 	
+	public X509ChainWithIssuer(Certificate[] certs) throws IOException, CertException {
+		X509Certificate x509;
+		for(Certificate c : certs) {
+			x509=(X509Certificate)c;
+			Principal subject = x509.getSubjectDN();
+			if(subject!=null) {
+				if(cert==null) { // first in Trust Chain
+					issuerDN= subject.toString();
+				}
+				addTrustChainEntry(x509);
+				cert=x509; // adding each time makes sure last one is signer.
+			}
+		}
+	}
+
 	public String getIssuerDN() {
 		return issuerDN;
 	}
diff --git a/auth/auth-client/.gitignore b/auth/auth-client/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-client/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-cmd/.gitignore b/auth/auth-cmd/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-cmd/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-core/.gitignore b/auth/auth-core/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-core/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-deforg/.gitignore b/auth/auth-deforg/.gitignore
new file mode 100644
index 00000000..1999002f
--- /dev/null
+++ b/auth/auth-deforg/.gitignore
@@ -0,0 +1,5 @@
+/.classpath
+/.settings/
+/target/
+/.project
+
diff --git a/auth/auth-fs/.gitignore b/auth/auth-fs/.gitignore
new file mode 100644
index 00000000..1999002f
--- /dev/null
+++ b/auth/auth-fs/.gitignore
@@ -0,0 +1,5 @@
+/.classpath
+/.settings/
+/target/
+/.project
+
diff --git a/auth/auth-gui/.gitignore b/auth/auth-gui/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-gui/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-hello/.gitignore b/auth/auth-hello/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-hello/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-locate/.gitignore b/auth/auth-locate/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-locate/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-oauth/.gitignore b/auth/auth-oauth/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-oauth/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/auth/auth-service/.gitignore b/auth/auth-service/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/auth/auth-service/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/cadi/.gitignore b/cadi/.gitignore
new file mode 100644
index 00000000..58c32c89
--- /dev/null
+++ b/cadi/.gitignore
@@ -0,0 +1,2 @@
+/.project
+/.settings/
diff --git a/cadi/aaf/.gitignore b/cadi/aaf/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/cadi/aaf/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/cadi/aaf/pom.xml b/cadi/aaf/pom.xml
index 77b09641..7a8185c7 100644
--- a/cadi/aaf/pom.xml
+++ b/cadi/aaf/pom.xml
@@ -122,7 +122,6 @@
 				<plugin>
 				<groupId>org.sonatype.plugins</groupId>
 				<artifactId>nexus-staging-maven-plugin</artifactId>
-				<version>1.6.7</version>
 				<extensions>true</extensions>
 				<configuration>
 					<nexusUrl>${nexusproxy}</nexusUrl>
@@ -133,7 +132,6 @@
 			<plugin>
 				<groupId>org.jacoco</groupId>
 				<artifactId>jacoco-maven-plugin</artifactId>
-				<version>0.7.7.201606060606</version>
 				<configuration>
 					<dumpOnExit>true</dumpOnExit>
 					<includes>
diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/Factory.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/Factory.java
index 70111882..8933963d 100644
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/Factory.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/Factory.java
@@ -34,6 +34,8 @@ import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.Reader;
 import java.io.StringReader;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
 import java.security.InvalidKeyException;
 import java.security.Key;
 import java.security.KeyFactory;
@@ -41,8 +43,10 @@ import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
+import java.security.Provider;
 import java.security.PublicKey;
 import java.security.SecureRandom;
+import java.security.Security;
 import java.security.Signature;
 import java.security.SignatureException;
 import java.security.cert.Certificate;
@@ -444,4 +448,39 @@ public class Factory {
 			tt.done();
 		}	
 	}
+
+	/**
+	 * Get the Security Provider, or, if not exists yet, attempt to load
+	 * 
+	 * @param providerType
+	 * @param params
+	 * @return
+	 * @throws CertException
+	 */
+	public static synchronized Provider getSecurityProvider(String providerType, String[][] params) throws CertException {
+		Provider p = Security.getProvider(providerType);
+		if(p!=null) {
+			switch(providerType) {
+				case "PKCS12":
+					
+					break;
+				case "PKCS11": // PKCS11 only known to be supported by Sun
+					try {
+						Class<?> clsSunPKCS11 = Class.forName("sun.security.pkcs11.SunPKCS11");
+						Constructor<?> cnst = clsSunPKCS11.getConstructor(String.class);
+						Object sunPKCS11 = cnst.newInstance(params[0][0]);
+						if (sunPKCS11==null) {
+							throw new CertException("SunPKCS11 Provider cannot be constructed for " + params[0][0]);
+						}
+						Security.addProvider((Provider)sunPKCS11);
+					} catch (ClassNotFoundException | NoSuchMethodException | SecurityException | InstantiationException | IllegalAccessException | IllegalArgumentException | InvocationTargetException e) {
+						throw new CertException(e);
+					}
+					break;
+				default:
+					throw new CertException(providerType + " is not a known Security Provider for your JDK.");
+			}
+		}
+		return p;
+	}
 }
diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/PlaceArtifactInKeystore.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/PlaceArtifactInKeystore.java
index a4d095ea..9360e02f 100644
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/PlaceArtifactInKeystore.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/cm/PlaceArtifactInKeystore.java
@@ -41,12 +41,6 @@ import certman.v1_0.CertInfo;
 
 public class PlaceArtifactInKeystore extends ArtifactDir {
 	private String kst;
-	//TODO get ROOT DNs or Trusted DNs from Certificate Manager.
-//	private static String[] rootDNs = new String[]{			
-//			"CN=ATT CADI Root CA - Test, O=ATT, OU=CSO, C=US", // Lab.  delete eventually
-//			"CN=ATT AAF CADI TEST CA, OU=CSO, O=ATT, C=US",
-//			"CN=ATT AAF CADI CA, OU=CSO, O=ATT, C=US"
-//	};
 
 	public PlaceArtifactInKeystore(String kst) {
 		this.kst = kst;
diff --git a/cadi/aaf/src/test/java/org/onap/aaf/cadi/aaf/v2_0/JU_AAFAuthnTest.java b/cadi/aaf/src/test/java/org/onap/aaf/cadi/aaf/v2_0/JU_AAFAuthnTest.java
index 5bea1981..d2971848 100644
--- a/cadi/aaf/src/test/java/org/onap/aaf/cadi/aaf/v2_0/JU_AAFAuthnTest.java
+++ b/cadi/aaf/src/test/java/org/onap/aaf/cadi/aaf/v2_0/JU_AAFAuthnTest.java
@@ -75,6 +75,7 @@ public class JU_AAFAuthnTest {
 	@Test
 	public void testAAFAuthnAAFConOfCLIENTAbsUserCacheOfAAFPermission() throws Exception {
 		AAFAuthn<HttpsURLConnection> auth = con.newAuthn(cache);
+		assertNotNull(auth);
 	}
 	//TODO broken JUNIT with MOCKITO
 	@Test
@@ -90,6 +91,7 @@ public class JU_AAFAuthnTest {
 	@Test
 	public void testAAFAuthnAAFConOfCLIENTAbsUserCacheOfAAFPermission1() throws Exception {
 		AAFAuthn<HttpsURLConnection> auth = con.newAuthn(cache);
+		assertNotNull(auth);
 	}
 	//TODO broken JUNIT with MOCKITO
 	@Test
@@ -105,6 +107,8 @@ public class JU_AAFAuthnTest {
 	@Test
 	public void testAAFAuthnAAFConOfCLIENTAbsUserCacheOfAAFPermission2() throws Exception {
 		AAFAuthn<HttpsURLConnection> auth = con.newAuthn(cache);
+		assertNotNull(auth);
+
 	}
 	//TODO broken JUNIT with MOCKITO
 	@Test
@@ -120,6 +124,8 @@ public class JU_AAFAuthnTest {
 	@Test
 	public void testAAFAuthnAAFConOfCLIENTAbsUserCacheOfAAFPermission3() throws Exception {
 		AAFAuthn<HttpsURLConnection> auth = con.newAuthn(cache);
+		assertNotNull(auth);
+
 	}
 	//TODO broken JUNIT with MOCKITO
 	@Test
@@ -135,6 +141,8 @@ public class JU_AAFAuthnTest {
 	@Test
 	public void testAAFAuthnAAFConOfCLIENTAbsUserCacheOfAAFPermission4() throws Exception {
 		AAFAuthn<HttpsURLConnection> auth = con.newAuthn(cache);
+		assertNotNull(auth);
+
 	}
 	//TODO broken JUNIT with MOCKITO
 	@Test
@@ -150,5 +158,7 @@ public class JU_AAFAuthnTest {
 	@Test
 	public void testAAFAuthnAAFConOfCLIENTAbsUserCacheOfAAFPermission5() throws Exception {
 		AAFAuthn<HttpsURLConnection> auth = con.newAuthn(cache);
+		assertNotNull(auth);
+
 	}
 }
diff --git a/cadi/cass/.gitignore b/cadi/cass/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/cadi/cass/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/cadi/client/.gitignore b/cadi/client/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/cadi/client/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/cadi/core/.gitignore b/cadi/core/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/cadi/core/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/cadi/core/src/main/java/org/onap/aaf/cadi/config/Config.java b/cadi/core/src/main/java/org/onap/aaf/cadi/config/Config.java
index dda4b6cd..122996a6 100644
--- a/cadi/core/src/main/java/org/onap/aaf/cadi/config/Config.java
+++ b/cadi/core/src/main/java/org/onap/aaf/cadi/config/Config.java
@@ -347,23 +347,26 @@ public class Config {
 					if(AAF_TAF_CLASS_DEF.equals(aafTafClassName)) { 
 						try {
 							Class<?> aafTafClass = loadClass(access,aafTafClassName);
-		
-							Constructor<?> cstr = aafTafClass.getConstructor(Connector.class,boolean.class,AbsUserCache.class);
-							if(cstr!=null) {
-								if(lur instanceof AbsUserCache) {
-									aaftaf = (HttpTaf)cstr.newInstance(aafcon,basic_warn,lur);
-								} else {
-									cstr = aafTafClass.getConstructor(Connector.class,boolean.class);
-									if(cstr!=null) {
-										aaftaf = (HttpTaf)cstr.newInstance(aafcon,basic_warn);
+							if(aafTafClass!=null) {
+								Constructor<?> cstr = aafTafClass.getConstructor(Connector.class,boolean.class,AbsUserCache.class);
+								if(cstr!=null) {
+									if(lur instanceof AbsUserCache) {
+										aaftaf = (HttpTaf)cstr.newInstance(aafcon,basic_warn,lur);
+									} else {
+										cstr = aafTafClass.getConstructor(Connector.class,boolean.class);
+										if(cstr!=null) {
+											aaftaf = (HttpTaf)cstr.newInstance(aafcon,basic_warn);
+										}
+									}
+									if(aaftaf==null) {
+										access.log(Level.INIT,"ERROR! AAF TAF Failed construction.  NOT Configured");
+									} else {
+										access.log(Level.INIT,"AAF TAF Configured to ",aafURL);
+										// Note: will add later, after all others configured
 									}
 								}
-								if(aaftaf==null) {
-									access.log(Level.INIT,"ERROR! AAF TAF Failed construction.  NOT Configured");
-								} else {
-									access.log(Level.INIT,"AAF TAF Configured to ",aafURL);
-									// Note: will add later, after all others configured
-								}
+							} else {
+								access.log(Level.INIT, "There is no AAF TAF class available: %s. AAF TAF not configured.",aafTafClassName);
 							}
 						} catch(Exception e) {
 							access.log(Level.INIT,"ERROR! AAF TAF Failed construction.  NOT Configured",e);
diff --git a/cadi/core/target/classes/.gitignore b/cadi/core/target/classes/.gitignore
new file mode 100644
index 00000000..cf1db2ee
--- /dev/null
+++ b/cadi/core/target/classes/.gitignore
@@ -0,0 +1 @@
+/org/
diff --git a/cadi/core/target/test-classes/.gitignore b/cadi/core/target/test-classes/.gitignore
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/cadi/core/target/test-classes/.gitignore
diff --git a/cadi/oauth-enduser/.gitignore b/cadi/oauth-enduser/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/cadi/oauth-enduser/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/cadi/shiro/.gitignore b/cadi/shiro/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/cadi/shiro/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/cadi/target/.gitignore b/cadi/target/.gitignore
new file mode 100644
index 00000000..6028f0a5
--- /dev/null
+++ b/cadi/target/.gitignore
@@ -0,0 +1,4 @@
+/.classpath
+/.settings/
+/target/
+/.project
diff --git a/misc/.gitignore b/misc/.gitignore
index 0c2b833e..988e9128 100644
--- a/misc/.gitignore
+++ b/misc/.gitignore
@@ -1,2 +1,3 @@
 /.settings/
 /.project
+/target/
diff --git a/misc/env/.gitignore b/misc/env/.gitignore
index 51037e60..6028f0a5 100644
--- a/misc/env/.gitignore
+++ b/misc/env/.gitignore
@@ -1,4 +1,3 @@
-/target/
 /.classpath
 /.settings/
 /target/
diff --git a/misc/rosetta/.gitignore b/misc/rosetta/.gitignore
index 3b314b88..b373f319 100644
--- a/misc/rosetta/.gitignore
+++ b/misc/rosetta/.gitignore
@@ -2,5 +2,4 @@
 /.classpath
 /.settings/
 /logs/
-/target/
 /.project