diff options
Diffstat (limited to 'shiro/src/main/java/org/onap/aaf')
| -rw-r--r-- | shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFAuthorizationInfo.java | 55 | ||||
| -rw-r--r-- | shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFRealm.java | 81 |
2 files changed, 120 insertions, 16 deletions
diff --git a/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFAuthorizationInfo.java b/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFAuthorizationInfo.java index 0035626..247683a 100644 --- a/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFAuthorizationInfo.java +++ b/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFAuthorizationInfo.java @@ -29,6 +29,7 @@ import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.Permission; import org.onap.aaf.cadi.Access; import org.onap.aaf.cadi.Access.Level; +import org.onap.aaf.cadi.aaf.AAFPermission; /** * We treat "roles" and "permissions" in a similar way for first pass. @@ -42,15 +43,27 @@ public class AAFAuthorizationInfo implements AuthorizationInfo { private Access access; private Principal bait; private List<org.onap.aaf.cadi.Permission> pond; - private ArrayList<String> sPerms; - private ArrayList<Permission> oPerms; + // Use these to save conversions + private List<org.onap.aaf.cadi.Permission> cPerms; + private List<Permission> oPerms; + private List<String> sPerms; + + public AAFAuthorizationInfo(Access access, Principal bait) { + this.access = access; + this.bait = bait; + cPerms=null; + oPerms=null; + sPerms=null; + pond=null; + } public AAFAuthorizationInfo(Access access, Principal bait, List<org.onap.aaf.cadi.Permission> pond) { this.access = access; this.bait = bait; this.pond = pond; - sPerms=null; oPerms=null; + sPerms=null; + cPerms=null; } public Principal principal() { @@ -62,9 +75,20 @@ public class AAFAuthorizationInfo implements AuthorizationInfo { access.log(Level.DEBUG, "AAFAuthorizationInfo.getObjectPermissions"); synchronized(bait) { if(oPerms == null) { - oPerms = new ArrayList<Permission>(); - for(final org.onap.aaf.cadi.Permission p : pond) { - oPerms.add(new AAFShiroPermission(p)); + if (pond != null) { + oPerms = new ArrayList<Permission>(); + for(final org.onap.aaf.cadi.Permission p : pond) { + oPerms.add(new AAFShiroPermission(p)); + } + } else { + oPerms = new ArrayList<>(); + if (cPerms == null) { + cPerms = new ArrayList<>(); + AAFRealm.singleton.authz.fishAll(bait, cPerms); + } + for (final org.onap.aaf.cadi.Permission p : cPerms) { + oPerms.add(new AAFShiroPermission(p)); + } } } } @@ -83,10 +107,21 @@ public class AAFAuthorizationInfo implements AuthorizationInfo { access.log(Level.DEBUG,"AAFAuthorizationInfo.getStringPermissions"); synchronized(bait) { if(sPerms == null) { - sPerms = new ArrayList<String>(); - for(org.onap.aaf.cadi.Permission p : pond) { - sPerms.add(p.getKey().replace("|",":")); - access.printf(Level.INFO,"%s has %s",bait.getName(),p.getKey()); + if (pond != null) { + sPerms = new ArrayList<String>(); + for(org.onap.aaf.cadi.Permission p : pond) { + sPerms.add(p.getKey().replace("|", ":")); + access.printf(Level.INFO, "%s has %s", bait.getName(), p.getKey()); + } + } else { + sPerms = new ArrayList<>(); + if (cPerms == null) { + cPerms = new ArrayList<>(); + AAFRealm.singleton.authz.fishAll(bait, cPerms); + } + for (final org.onap.aaf.cadi.Permission p : cPerms) { + sPerms.add(p.getKey()); + } } } } diff --git a/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFRealm.java b/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFRealm.java index eb8bc60..818ec9e 100644 --- a/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFRealm.java +++ b/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFRealm.java @@ -33,6 +33,7 @@ import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.UsernamePasswordToken; +import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import org.onap.aaf.cadi.Access.Level; @@ -41,29 +42,40 @@ import org.onap.aaf.cadi.LocatorException; import org.onap.aaf.cadi.Permission; import org.onap.aaf.cadi.PropAccess; import org.onap.aaf.cadi.Symm; +import org.onap.aaf.cadi.aaf.AAFPermission; import org.onap.aaf.cadi.aaf.v2_0.AAFAuthn; import org.onap.aaf.cadi.aaf.v2_0.AAFCon; import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm; import org.onap.aaf.cadi.config.Config; import org.onap.aaf.cadi.filter.MapBathConverter; import org.onap.aaf.cadi.util.CSV; +import org.onap.aaf.cadi.util.Split; import org.onap.aaf.misc.env.APIException; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +/* + * Note: Shiro Realm document + * https://shiro.apache.org/realm.html + */ + public class AAFRealm extends AuthorizingRealm { public static final String AAF_REALM = "AAFRealm"; private static final Logger logger = LoggerFactory.getLogger(AAFRealm.class); - private static Singleton singleton = Singleton.singleton(); - private static class Singleton { - private AAFCon<?> acon; - private AAFAuthn<?> authn; + // Package on purpose + static Singleton singleton = Singleton.singleton(); + + public static class Singleton { + public AAFCon<?> acon; + public AAFAuthn<?> authn; + public AAFLurPerm authz; // private Set<Class<? extends AuthenticationToken>> supports; - private AAFLurPerm authz; + private MapBathConverter mbc; private Map<String,String> idMap; private Singleton() { + logger.info("Creating AAFRealm.Singleton"); mbc = null; idMap = null; String cadi_prop_files = access.getProperty(Config.CADI_PROP_FILES); @@ -222,6 +234,7 @@ public class AAFRealm extends AuthorizingRealm { @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { + logger.debug("AAFRealm.doGetAuthenticationInfo"); final UsernamePasswordToken upt = (UsernamePasswordToken)token; final String user = upt.getUsername(); String authUser = user; @@ -241,7 +254,7 @@ public class AAFRealm extends AuthorizingRealm { } } catch (IOException e) { singleton.access.log(e); - } + } } String err; try { @@ -264,6 +277,7 @@ public class AAFRealm extends AuthorizingRealm { @Override protected void assertCredentialsMatch(AuthenticationToken atoken, AuthenticationInfo ai)throws AuthenticationException { + logger.debug("AAFRealm.assertCredentialsMatch"); if(ai instanceof AAFAuthenticationInfo) { if(!((AAFAuthenticationInfo)ai).matches(atoken)) { throw new AuthenticationException("Credentials do not match"); @@ -275,6 +289,7 @@ public class AAFRealm extends AuthorizingRealm { @Override protected AAFAuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { + logger.debug("AAFRealm.doGetAuthorizationInfo"); Principal bait = (Principal)principals.getPrimaryPrincipal(); Principal newBait = bait; if(singleton.idMap!=null) { @@ -306,4 +321,58 @@ public class AAFRealm extends AuthorizingRealm { return AAF_REALM; } + private AAFPermission aafPerm(String permission) { + String[] pa = Split.splitTrim('|', permission); + switch(pa.length) { + case 3: + return new AAFPermission(null,pa[0],pa[1],pa[2]); + case 4: + return new AAFPermission(pa[0],pa[1],pa[2],pa[3]); + default: + return null; + } + } +/* + @Override + public boolean isPermitted(PrincipalCollection principals, String permission) { + logger.debug("AAFRealm.isPermitted(principals,permission<String>)"); + AAFPermission ap = aafPerm(permission); + if(ap!=null) { + return singleton.authz.fish((Principal)principals.getPrimaryPrincipal(), ap); + } + return false; + } + + @Override + protected boolean isPermitted(org.apache.shiro.authz.Permission permission, AuthorizationInfo info) { + logger.debug("AAFRealm.isPermitted(shiro.Permission,AuthorizationInfo)"); + if(info instanceof AAFAuthorizationInfo) { + AAFPermission ap = aafPerm(permission.toString()); + if(ap!=null) { + return singleton.authz.fish(((AAFAuthorizationInfo)info).principal(), ap); + } + return false; + } + return super.isPermitted(permission, info); + } + + @Override + protected boolean[] isPermitted(List<org.apache.shiro.authz.Permission> permissions, AuthorizationInfo info) { + logger.debug("AAFRealm.isPermitted(List<shiro.Permission>,AuthorizationInfo)"); + if(info instanceof AAFAuthorizationInfo) { + boolean rv[] = new boolean[permissions.size()]; + int i=0; + for(org.apache.shiro.authz.Permission sp : permissions) { + AAFPermission ap = aafPerm(sp.toString()); + if(ap!=null) { + rv[i++]=singleton.authz.fish(((AAFAuthorizationInfo)info).principal(), ap); + } else { + rv[i++]=false; + } + } + return rv; + } + return super.isPermitted(permissions, info); + } +*/ } |