Update for more Logging Info

Issue-ID: AAF-853
Change-Id: I51e9160e2b53ebf74ba5f93c9a634a790f7ed848
Signed-off-by: Instrumental <jonathan.gathman@att.com>

17 files changed, 284 insertions, 92 deletions

diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsDAO.java
index f769e38c..10e7844c 100644
--- a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsDAO.java
+++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/NsDAO.java
@@ -64,6 +64,7 @@ public class NsDAO extends CassDAOImpl<AuthzTrans,NsDAO.Data> {
     public static final String TABLE = "ns";
     public static final String TABLE_ATTRIB = "ns_attrib";
     public static final int CACHE_SEG = 0x40; // yields segment 0x0-0x3F
+    public static final int USER = 0;
     public static final int ROOT = 1;
     public static final int COMPANY=2;
     public static final int APP = 3;
diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/PermDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/PermDAO.java
index 6e1057b8..3b77a577 100644
--- a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/PermDAO.java
+++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/PermDAO.java
@@ -93,11 +93,26 @@ public class PermDAO extends CassDAOImpl<AuthzTrans,PermDAO.Data> {
         }
 
         public String fullType() {
-            return ns + '.' + type;
+        	StringBuilder sb = new StringBuilder();
+        	if(ns==null) {
+        		sb.append('.');
+        	} else {
+	        	sb.append(ns);
+	        	sb.append(ns.indexOf('@')<0?'.':':');
+        	}
+        	sb.append(type);
+        	return sb.toString();
         }
         
         public String fullPerm() {
-            return ns + '.' + type + '|' + instance + '|' + action;
+        	StringBuilder sb = new StringBuilder(ns);
+        	sb.append(ns.indexOf('@')<0?'.':':'); 
+        	sb.append(type);
+        	sb.append('|');
+        	sb.append(instance);
+        	sb.append('|');
+        	sb.append(action);
+        	return sb.toString();
         }
 
         public String encode() {
@@ -193,17 +208,26 @@ public class PermDAO extends CassDAOImpl<AuthzTrans,PermDAO.Data> {
             Data rv = new PermDAO.Data();
             if (rdns.isOKhasData()) {
                 switch(s.length) {
+	                case 4:
+	                	rv.ns=s[0];
+	                    rv.type=s[1];
+	                    rv.instance=s[2];
+	                    rv.action=s[3];
+	                    break;
                     case 3:
+	                	rv.ns=s[0];
                         rv.type=s[1];
                         rv.instance=s[2];
                         rv.action=s[3];
                         break;
                     case 2:
+	                	rv.ns=s[0];
                         rv.type=s[1];
                         rv.instance=s[2];
                         rv.action=STAR;
                         break;
                     default:
+	                	rv.ns=s[0];
                         rv.type=s[1];
                         rv.instance = STAR;
                         rv.action = STAR;
diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/RoleDAO.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/RoleDAO.java
index 127dd4e2..e31e1e6a 100644
--- a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/RoleDAO.java
+++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/cass/RoleDAO.java
@@ -106,7 +106,14 @@ public class RoleDAO extends CassDAOImpl<AuthzTrans,RoleDAO.Data> {
         }
         
         public String fullName() {
-            return ns + '.' + name;
+        	StringBuilder sb = new StringBuilder();
+        	if(ns==null) {
+        		sb.append('.');
+        	} else {
+            	sb.append(ns.indexOf('@')<0?'.':':'); 
+        	}
+        	sb.append(name);
+        	return sb.toString();
         }
         
         public String encode() {
diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java
index 2c98a9bc..7160edec 100644
--- a/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java
+++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java
@@ -187,6 +187,7 @@ public class Question {
     
     private final CacheInfoDAO cacheInfoDAO;
 	private final int cldays;
+	private final boolean alwaysSpecial;
 
     public Question(AuthzTrans trans, Cluster cluster, String keyspace) throws APIException, IOException {
         PERMS = trans.slot("USER_PERMS");
@@ -220,6 +221,8 @@ public class Question {
         AbsCassDAO.primePSIs(trans);
         
         cldays = Integer.parseInt(trans.getProperty(Config.AAF_CRED_WARN_DAYS, Config.AAF_CRED_WARN_DAYS_DFT));
+        
+        alwaysSpecial = Boolean.parseBoolean(trans.getProperty("aaf_always_special", Boolean.FALSE.toString()));
     }
 
     public void startTimers(AuthzEnv env) {
@@ -612,6 +615,17 @@ public class Question {
     }
 
     public Result<NsDAO.Data> mayUser(AuthzTrans trans, String user,PermDAO.Data pdd, Access access) {
+    	if(pdd.ns.indexOf('@')>-1) {
+	    	if(user.equals(pdd.ns)) {
+	    		NsDAO.Data ndd = new NsDAO.Data();
+	    		ndd.name = user;
+	    		ndd.type = NsDAO.USER;
+	    		ndd.parent = "";
+	    		return Result.ok(ndd);
+	    	} else {
+	    		return Result.err(Result.ERR_Security,"Only a User may modify User");
+	    	}
+    	}
         Result<NsDAO.Data> rnsd = deriveNs(trans, pdd.ns);
         if (rnsd.isOK()) {
             return mayUser(trans, user, rnsd.value, pdd, access);
@@ -831,6 +845,7 @@ public class Question {
                                     byte[] md5=Hash.hashMD5(cred);
                                     if (Hash.compareTo(md5,dbcred)==0) {
                                         checkLessThanDays(trans,cldays,now,cdd);
+                                        trans.setTag(cdd.tag);
                                         return Result.ok(cdd.expires);
                                     } else if (debug!=null) {
                                         load(debug, cdd);
@@ -844,6 +859,7 @@ public class Question {
     
                                     if (Hash.compareTo(hash,dbcred)==0) {
                                         checkLessThanDays(trans,cldays,now,cdd);
+                                        trans.setTag(cdd.tag);
                                         return Result.ok(cdd.expires);
                                     } else if (debug!=null) {
                                         load(debug, cdd);
@@ -858,34 +874,41 @@ public class Question {
                     } else {
                         if (expired==null || expired.before(cdd.expires)) {
                             expired = cdd.expires;
+                            trans.setTag(cdd.tag);
                         }
                     }
                 } // end for each
-                if (debug==null) {
-                    trans.audit().printf("No cred matches ip=%s, user=%s\n",trans.ip(),user);
-                } else {
-                    trans.audit().printf("No cred matches ip=%s, user=%s %s\n",trans.ip(),user,debug.toString());
-                }
+                
                 if (expired!=null) {
                     // Note: this is only returned if there are no good Credentials
                     rv = Result.err(Status.ERR_Security,
-                            "Credentials %s from %s expired %s",trans.user(), trans.ip(), Chrono.dateTime(expired));
+                            "Credentials expired %s",Chrono.utcStamp(expired));
+                } else {
+	                if (debug==null && alwaysSpecial) {
+	                	debug = new StringBuilder();
+	                }
+	                if (debug!=null) {
+	                	debug.append(trans.env().encryptor().encrypt(new String(cred)));
+	                	rv = Result.err(Status.ERR_Security,String.format("invalid password - %s",debug.toString()));
+	                }
                 }
             }
         } else {
             return Result.err(result);
         }
-        return rv == null ? Result.create((Date) null, Status.ERR_Security, "Wrong credential") : rv;
+        return rv == null ? Result.err(Status.ERR_Security, "Wrong credential") : rv;
     }
 
 
     private void load(StringBuilder debug, Data cdd) {
-        debug.append("DB Entry: user=");
+        debug.append("\nDB Entry: user=");
         debug.append(cdd.id);
         debug.append(",type=");
         debug.append(cdd.type);
         debug.append(",expires=");
         debug.append(Chrono.dateTime(cdd.expires));
+        debug.append(",tag=");
+        debug.append(cdd.tag);
         debug.append('\n');
     }
 
diff --git a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFUserPass.java b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFUserPass.java
index 3ef532b4..62e1592f 100644
--- a/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFUserPass.java
+++ b/auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFUserPass.java
@@ -52,8 +52,13 @@ public class DirectAAFUserPass implements CredVal {
 
     @Override
     public boolean validate(String user, Type type, byte[] pass, Object state) {
+    		if(user==null || type==null || pass==null) {
+    			return false;
+    		}
+    	
             try {
                 AuthzTrans trans;
+                boolean transfer = false;
                 if (state !=null) {
                     if (state instanceof AuthzTrans) {
                         trans = (AuthzTrans)state;
@@ -61,19 +66,23 @@ public class DirectAAFUserPass implements CredVal {
                         trans = env.newTransNoAvg();
                         if (state instanceof HttpServletRequest) {
                             trans.set((HttpServletRequest)state);
+                            transfer=true;
                         }
                     }
                 } else {
                     trans = env.newTransNoAvg();
                 }
                 Result<Date> result = question.doesUserCredMatch(trans, user, pass);
-                trans.logAuditTrail(env.info());
+                if(transfer) {
+                	((HttpServletRequest)state).setAttribute("CRED_TAG", trans.getTag());
+                }
+                trans.logAuditTrail(env.debug());
                 switch(result.status) {
                     case OK:
                         return true;
                     default:
-                        String ip = trans.ip()==null?"":(", ip="+trans.ip());
-                        env.warn().log(user, "failed password validation" + ip + ':',result.errorString());
+                        String ip = trans.ip()==null?"":trans.ip();
+                        env.audit().printf("user=%s,tag=%s,ip=%s,msg=\"failed password validation: %s\"",user,trans.getTag(),ip,result.errorString());
                 }
             } catch (DAOException e) {
                 env.error().log(e,"Cannot validate user/pass from cassandra");
diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/cass/JU_RoleDAO.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/cass/JU_RoleDAO.java
index 16f05aa3..fa023af3 100644
--- a/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/cass/JU_RoleDAO.java
+++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/dao/cass/JU_RoleDAO.java
@@ -430,7 +430,7 @@ public class JU_RoleDAO {
 	}
 	
 	@Test
-	public void testWasMOdified() {
+	public void testWasModified() {
 		TimeTaken tt = Mockito.mock(TimeTaken.class);
 		Mockito.doReturn(tt).when(trans).start("RoleDAO CREATE", Env.REMOTE);
 		Mockito.doReturn(tt).when(trans).start("Clear Reset Deque", Env.SUB);
diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFLur.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFLur.java
index 05077438..f0f3c5d0 100644
--- a/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFLur.java
+++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFLur.java
@@ -237,7 +237,7 @@ public class JU_DirectAAFLur {
 		
 		assertFalse(pp.match(null));
 		
-		pond = new AAFPermission("null.test", "name", "instance", "action");
-		pp.match(pond);
+		pond = new AAFPermission("test.test", "test", "test", "test");
+		assertTrue(pp.match(pond));
 	}
 }
diff --git a/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFUserPass.java b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFUserPass.java
index ca0a8917..c767aeb5 100644
--- a/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFUserPass.java
+++ b/auth/auth-cass/src/test/java/org/onap/aaf/auth/direct/test/JU_DirectAAFUserPass.java
@@ -125,7 +125,7 @@ public class JU_DirectAAFUserPass {
 		}
 		boolean retVal = aafLocatorObj.validate(null, null, null, null);
 		
-		assertTrue(retVal);
+		assertFalse(retVal);
 	}	
 	
 	@Test
diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTrans.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTrans.java
index 0256c1bf..920f330f 100644
--- a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTrans.java
+++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTrans.java
@@ -39,8 +39,8 @@ public interface AuthzTrans extends TransStore {
         REQD_TYPE(int bit) {
             this.bit = bit;
         }
-    };
-    
+    }
+
     public abstract AuthzTrans set(HttpServletRequest req);
 
 	public abstract HttpServletRequest hreq();
@@ -76,5 +76,9 @@ public interface AuthzTrans extends TransStore {
     public abstract void logAuditTrail(LogTarget lt);
     
     public abstract Date now();
+    
+    public abstract void setTag(String tag);
+    
+    public abstract String getTag();
 
 }
\ No newline at end of file
diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java
index b08e0240..ec5e70de 100644
--- a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java
+++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java
@@ -85,9 +85,9 @@ public class AuthzTransFilter extends TransFilter<AuthzTrans> {
     }
 
     @Override
-    protected void tallyHo(AuthzTrans trans) {
+    protected void tallyHo(AuthzTrans trans, String target) {
         Boolean b = trans.get(specialLogSlot, false);
-        LogTarget lt = b?trans.warn():trans.info();
+        LogTarget lt = b?trans.warn():trans.debug();
         
         if (lt.isLoggable()) {
             // Transaction is done, now post full Audit Trail
@@ -131,8 +131,11 @@ public class AuthzTransFilter extends TransFilter<AuthzTrans> {
             sb.append("user=");
             Principal p = trans.getUserPrincipal();
             if (p==null) {
-                sb.append("n/a");
+            	lt=trans.warn();
+                sb.append(target);
+                sb.append("[None]");
             } else {
+            	lt=trans.info();
                 sb.append(p.getName());
                 if (p instanceof TrustPrincipal) {
                     sb.append('(');
@@ -148,6 +151,11 @@ public class AuthzTransFilter extends TransFilter<AuthzTrans> {
                     sb.append(']');
                 }
             }
+            String tag = trans.getTag();
+            if(tag!=null) {
+                sb.append(",tag=");
+                sb.append(tag);
+            }
             sb.append(",ip=");
             sb.append(trans.ip());
             sb.append(",port=");
@@ -176,7 +184,7 @@ public class AuthzTransFilter extends TransFilter<AuthzTrans> {
                 sb.append('"');
             }
             
-            trans.warn().log(sb);
+            lt.log(sb);
         }
     }
 
diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransImpl.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransImpl.java
index ce947be9..a7bb24a5 100644
--- a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransImpl.java
+++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransImpl.java
@@ -42,10 +42,12 @@ public class AuthzTransImpl extends BasicTrans implements AuthzTrans {
     private Organization org;
     private int mask;
     private Date now;
+    private String tag;
     public AuthzTransImpl(AuthzEnv env) {
         super(env);
         org=null;
         mask=0;
+        tag=null;
     }
 
     /**
@@ -213,4 +215,18 @@ public class AuthzTransImpl extends BasicTrans implements AuthzTrans {
         }
         return now;
     }
+    
+    /*
+     * (non-Javadoc)
+     * @see org.onap.aaf.auth.env.AuthzTrans#setTag(java.lang.String)
+     */
+    @Override
+    public void setTag(String tag) {
+    	this.tag = tag;
+    }
+
+    @Override
+    public String getTag() {
+    	return tag;
+    }
 }
diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/NullTrans.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/NullTrans.java
index 94a6aad5..54a8f484 100644
--- a/auth/auth-core/src/main/java/org/onap/aaf/auth/env/NullTrans.java
+++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/env/NullTrans.java
@@ -236,5 +236,12 @@ public class NullTrans implements AuthzTrans {
         }
         return now;
     }
+	@Override
+	public void setTag(String tag) {
+	}
+	@Override
+	public String getTag() {
+		return null;
+	}
 }
 
diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransFilter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransFilter.java
index d0fc1a3f..92c0fc24 100644
--- a/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransFilter.java
+++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/rserv/TransFilter.java
@@ -33,6 +33,7 @@ import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.onap.aaf.auth.env.AuthzTrans;
 import org.onap.aaf.cadi.Access;
 import org.onap.aaf.cadi.CadiException;
 import org.onap.aaf.cadi.CadiWrap;
@@ -88,7 +89,7 @@ public abstract class TransFilter<TRANS extends TransStore> implements Filter {
     protected abstract TRANS newTrans(HttpServletRequest request);
     protected abstract TimeTaken start(TRANS trans, ServletRequest request);
     protected abstract void authenticated(TRANS trans, Principal p);
-    protected abstract void tallyHo(TRANS trans);
+    protected abstract void tallyHo(TRANS trans, String target);
     
     @Override
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
@@ -98,6 +99,7 @@ public abstract class TransFilter<TRANS extends TransStore> implements Filter {
         TRANS trans = newTrans(req);
         
         TimeTaken overall = start(trans,request);
+        String target = "n/a";
         try {
             request.setAttribute(TRANS_TAG, trans);
             
@@ -116,6 +118,10 @@ public abstract class TransFilter<TRANS extends TransStore> implements Filter {
             CadiWrap cw = null;
             try {
                 resp = cadi.validate(req,res,trans);
+                Object tag = req.getAttribute("CRED_TAG");
+                if(tag!=null) {
+                	((AuthzTrans)trans).setTag(tag.toString());
+                }
                 switch(r=resp.isAuthenticated()) {
                     case IS_AUTHENTICATED:
                         cw = new CadiWrap(req,resp,cadi.getLur());
@@ -139,7 +145,7 @@ public abstract class TransFilter<TRANS extends TransStore> implements Filter {
                 // use
                 trans.checkpoint(resp.desc(),Env.ALWAYS);
                 if (resp.isFailedAttempt()) {
-                        trans.audit().log(resp.desc());
+                	target = resp.getTarget();
                 }
             }
         } catch (Exception e) {
@@ -148,7 +154,7 @@ public abstract class TransFilter<TRANS extends TransStore> implements Filter {
             throw new ServletException(e);
         } finally {
             overall.done();
-            tallyHo(trans);
+            tallyHo(trans,target);
         }
     }
 
diff --git a/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java
index 56eea435..23240cf1 100644
--- a/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java
+++ b/auth/auth-core/src/main/java/org/onap/aaf/auth/server/AbsServiceStarter.java
@@ -97,7 +97,7 @@ public abstract class AbsServiceStarter<ENV extends RosettaEnv, TRANS extends Tr
 		if(System.getProperty("ECLIPSE", null)!=null) {
 			Thread.sleep(2000);
 	        System.out.println("Service Started in Eclipse: ");
-	        System.out.print("  Hit <enter> to end:");
+	        System.out.print("  Hit <enter> to end\n:");
 	        try {
 				System.in.read();
 				System.exit(0);
diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java
index e311513e..41c433f4 100644
--- a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java
+++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/AuthzCassServiceImpl.java
@@ -47,6 +47,9 @@ import javax.servlet.http.HttpServletRequest;
 
 import org.onap.aaf.auth.common.Define;
 import org.onap.aaf.auth.dao.DAOException;
+import org.onap.aaf.auth.dao.cached.CachedPermDAO;
+import org.onap.aaf.auth.dao.cached.CachedRoleDAO;
+import org.onap.aaf.auth.dao.cached.CachedUserRoleDAO;
 import org.onap.aaf.auth.dao.cass.ApprovalDAO;
 import org.onap.aaf.auth.dao.cass.CertDAO;
 import org.onap.aaf.auth.dao.cass.CredDAO;
@@ -799,62 +802,129 @@ public class AuthzCassServiceImpl    <NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DE
     @Override
     public Result<Void> createPerm(final AuthzTrans trans,REQUEST rreq) {        
         final Result<PermDAO.Data> newPd = mapper.perm(trans, rreq);
-        // Does Perm Type exist as a Namespace?
-        if(newPd.value.type.isEmpty() || ques.nsDAO().read(trans, newPd.value.fullType()).isOKhasData()) {
-            return Result.err(Status.ERR_ConflictAlreadyExists,
-                    "Permission Type exists as a Namespace");
-        }
-        
+
         final ServiceValidator v = new ServiceValidator();
         if (v.perm(newPd).err()) {
             return Result.err(Status.ERR_BadData,v.errs());
         }
-        
-        Result<FutureDAO.Data> fd = mapper.future(trans, PermDAO.TABLE, rreq, newPd.value,false,
-            new Mapper.Memo() {
-                @Override
-                public String get() {
-                    return "Create Permission [" + 
-                        newPd.value.fullType() + '|' + 
-                        newPd.value.instance + '|' + 
-                        newPd.value.action + ']';
-                }
-            },
-            new MayChange() {
-                private Result<NsDAO.Data> nsd;
-                @Override
-                public Result<?> mayChange() {
-                    if (nsd==null) {
-                        nsd = ques.mayUser(trans, trans.user(), newPd.value, Access.write);
-                    }
-                    return nsd;
-                }
-            });
-        Result<List<NsDAO.Data>> nsr = ques.nsDAO().read(trans, newPd.value.ns);
-        if (nsr.notOKorIsEmpty()) {
-            return Result.err(nsr);
+
+        // User Permission mechanism
+        if(newPd.value.ns.indexOf('@')>0) {
+        	PermDAO.Data pdd = newPd.value;
+        	if(trans.user().equals(newPd.value.ns)) {
+        		CachedPermDAO permDAO = ques.permDAO();
+        		Result<List<PermDAO.Data>> rlpdd = permDAO.read(trans, pdd);
+        		if(rlpdd.notOK()) {
+        			return Result.err(rlpdd);
+        		}
+        		if(!rlpdd.isEmpty()) {
+        			return Result.err(Result.ERR_ConflictAlreadyExists,"Permission already exists"); 
+        		}
+
+				RoleDAO.Data rdd = new RoleDAO.Data();
+				rdd.ns = pdd.ns;
+				rdd.name = "user";
+
+				pdd.roles(true).add(rdd.encode());
+				Result<PermDAO.Data> rpdd = permDAO.create(trans, pdd);
+				if(rpdd.notOK()) {
+					return Result.err(rpdd);
+				}
+				
+        		CachedRoleDAO roleDAO = ques.roleDAO();
+        		Result<List<RoleDAO.Data>> rlrdd = roleDAO.read(trans, rdd);
+        		if(rlrdd.notOK()) {
+        			return Result.err(rlrdd);
+        		} else {
+        			if(!rlrdd.isEmpty()) {
+        				rdd = rlrdd.value.get(0);
+        			}
+        		}
+        		
+        		String eperm = pdd.encode();
+        		rdd.perms(true).add(eperm);
+        		Result<Void> rv = roleDAO.update(trans, rdd);
+        		if(rv.notOK()) {
+        			return rv;
+        		}
+        		 
+        		CachedUserRoleDAO urDAO = ques.userRoleDAO();
+    			UserRoleDAO.Data urdd = new UserRoleDAO.Data();
+    			urdd.user = trans.user();
+    			urdd.ns = rdd.ns;
+    			urdd.rname = rdd.name;
+    			urdd.role = rdd.fullName();
+        		Result<List<UserRoleDAO.Data>> rlurdd = urDAO.read(trans, urdd);
+        		if(rlurdd.notOK()) {
+        			return Result.err(rlrdd);
+        		} else if(rlurdd.isEmpty()) {
+        			GregorianCalendar gc = trans.org().expiration(null, Expiration.UserInRole);
+        			if(gc==null) {
+        				return Result.err(Result.ERR_Policy,"Organzation does not grant Expiration for UserRole");
+        			} else {
+        				urdd.expires = gc.getTime();
+        			}
+        			Result<UserRoleDAO.Data> rurdd = urDAO.create(trans, urdd);
+        			return Result.err(rurdd);
+        		}
+        		return rv;
+        	} else {
+        		return Result.err(Result.ERR_Security,"Only the User can create User Permissions");
+        	}
+        } else {
+	        // Does Perm Type exist as a Namespace?
+	        if(newPd.value.type.isEmpty() || ques.nsDAO().read(trans, newPd.value.fullType()).isOKhasData()) {
+	            return Result.err(Status.ERR_ConflictAlreadyExists,
+	                    "Permission Type exists as a Namespace");
+	        }
+	        
+	        Result<FutureDAO.Data> fd = mapper.future(trans, PermDAO.TABLE, rreq, newPd.value,false,
+	            new Mapper.Memo() {
+	                @Override
+	                public String get() {
+	                    return "Create Permission [" + 
+	                        newPd.value.fullType() + '|' + 
+	                        newPd.value.instance + '|' + 
+	                        newPd.value.action + ']';
+	                }
+	            },
+	            new MayChange() {
+	                private Result<NsDAO.Data> nsd;
+	                @Override
+	                public Result<?> mayChange() {
+	                    if (nsd==null) {
+	                        nsd = ques.mayUser(trans, trans.user(), newPd.value, Access.write);
+	                    }
+	                    return nsd;
+	                }
+	            });
+	        
+	        Result<List<NsDAO.Data>> nsr = ques.nsDAO().read(trans, newPd.value.ns);
+	        if (nsr.notOKorIsEmpty()) {
+	            return Result.err(nsr);
+	        }
+	        switch(fd.status) {
+	            case OK:
+	                Result<String> rfc = func.createFuture(trans,fd.value, 
+	                        newPd.value.fullType() + '|' + newPd.value.instance + '|' + newPd.value.action,
+	                        trans.user(),
+	                        nsr.value.get(0),
+	                        FUTURE_OP.C);
+	                if (rfc.isOK()) {
+	                    return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing",
+	                            newPd.value.ns,
+	                            newPd.value.type,
+	                            newPd.value.instance,
+	                            newPd.value.action);
+	                } else {
+	                    return Result.err(rfc);
+	                }
+	            case Status.ACC_Now:
+	                return func.createPerm(trans, newPd.value, true);
+	            default:
+	                return Result.err(fd);
+	        }
         }
-        switch(fd.status) {
-            case OK:
-                Result<String> rfc = func.createFuture(trans,fd.value, 
-                        newPd.value.fullType() + '|' + newPd.value.instance + '|' + newPd.value.action,
-                        trans.user(),
-                        nsr.value.get(0),
-                        FUTURE_OP.C);
-                if (rfc.isOK()) {
-                    return Result.err(Status.ACC_Future, "Perm [%s.%s|%s|%s] is saved for future processing",
-                            newPd.value.ns,
-                            newPd.value.type,
-                            newPd.value.instance,
-                            newPd.value.action);
-                } else {
-                    return Result.err(rfc);
-                }
-            case Status.ACC_Now:
-                return func.createPerm(trans, newPd.value, true);
-            default:
-                return Result.err(fd);
-        }    
     }
 
     @ApiDoc( 
@@ -1392,7 +1462,7 @@ public class AuthzCassServiceImpl    <NSS,PERMS,PERMKEY,ROLES,USERS,USERROLES,DE
             return Result.err(Status.ERR_PermissionNotFound, "Permission [%s.%s|%s|%s] does not exist",
                     perm.ns,perm.type,perm.instance,perm.action    );
         }
-
+        
         Result<FutureDAO.Data> fd = mapper.future(trans,PermDAO.TABLE,from,perm,false,
                 new Mapper.Memo() {
                     @Override
diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper_2_0.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper_2_0.java
index 187f4e39..7a5d0c18 100644
--- a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper_2_0.java
+++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/mapper/Mapper_2_0.java
@@ -58,6 +58,7 @@ import org.onap.aaf.auth.org.Organization.Expiration;
 import org.onap.aaf.auth.rserv.Pair;
 import org.onap.aaf.auth.service.MayChange;
 import org.onap.aaf.cadi.aaf.marshal.CertsMarshal;
+import org.onap.aaf.cadi.util.Split;
 import org.onap.aaf.cadi.util.Vars;
 import org.onap.aaf.misc.env.Env;
 import org.onap.aaf.misc.env.TimeTaken;
@@ -364,18 +365,32 @@ public class Mapper_2_0 implements Mapper<Nss, Perms, Pkey, Roles, Users, UserRo
     @Override
     public Result<PermDAO.Data> perm(AuthzTrans trans, Request req) {
         PermRequest from = (PermRequest)req;
-        Result<NsSplit> nss = q.deriveNsSplit(trans, from.getType());
+        String type = from.getType();
+        if(type==null) {
+        	return Result.err(Result.ERR_BadData, "Invalid Perm Type");
+        }
         PermDAO.Data pd = new PermDAO.Data();
-        if (nss.isOK()) { 
-            pd.ns=nss.value.ns;
-            pd.type = nss.value.name;
-            pd.instance = from.getInstance();
-            pd.action = from.getAction();
-            pd.description = from.getDescription();
-            trans.checkpoint(pd.fullPerm(), Env.ALWAYS);
-            return Result.ok(pd);
-        } else {
-            return Result.err(nss);
+        if(type.contains("@")) {
+        	String[] split = Split.splitTrim(':', type);
+        	pd.ns = split[0];
+        	pd.type=split.length>1?split[1]:"";
+        	pd.instance = from.getInstance();
+        	pd.action = from.getAction();
+        	pd.description = from.getDescription();
+        	return Result.ok(pd);
+        }  else {
+	        Result<NsSplit> nss = q.deriveNsSplit(trans, from.getType());
+	        if (nss.isOK()) { 
+	            pd.ns=nss.value.ns;
+	            pd.type = nss.value.name;
+	            pd.instance = from.getInstance();
+	            pd.action = from.getAction();
+	            pd.description = from.getDescription();
+	            trans.checkpoint(pd.fullPerm(), Env.ALWAYS);
+	            return Result.ok(pd);
+	        } else {
+	            return Result.err(nss);
+	        }
         }
     }
     
diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/validation/ServiceValidator.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/validation/ServiceValidator.java
index adff4612..fb7556ed 100644
--- a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/validation/ServiceValidator.java
+++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/validation/ServiceValidator.java
@@ -57,7 +57,9 @@ public class ServiceValidator extends Validator {
         if (pd==null) {
             msg("Perm Data is null.");
         } else {
-            ns(pd.ns);
+        	if(!pd.ns.contains("@")) { 
+        		ns(pd.ns);
+        	}
             permType(pd.type,pd.ns);
             permInstance(pd.instance);
             permAction(pd.action);