From 6d469611d86642bc0b74ce51af72cc36d2af962d Mon Sep 17 00:00:00 2001 From: Instrumental Date: Mon, 26 Mar 2018 12:04:27 -0700 Subject: Remove Code from cadi, it is now in authz Issue-ID: AAF-193 Change-Id: Ib7abdb15ba8a7445a3875cf8c6bb48b7d563f424 Signed-off-by: Instrumental --- .../onap/aaf/cadi/aaf/cass/AAFAuthenticator.java | 174 --------------------- 1 file changed, 174 deletions(-) delete mode 100644 cass/src/main/java/org/onap/aaf/cadi/aaf/cass/AAFAuthenticator.java (limited to 'cass/src/main/java/org/onap/aaf/cadi/aaf/cass/AAFAuthenticator.java') diff --git a/cass/src/main/java/org/onap/aaf/cadi/aaf/cass/AAFAuthenticator.java b/cass/src/main/java/org/onap/aaf/cadi/aaf/cass/AAFAuthenticator.java deleted file mode 100644 index 6b8b29d..0000000 --- a/cass/src/main/java/org/onap/aaf/cadi/aaf/cass/AAFAuthenticator.java +++ /dev/null @@ -1,174 +0,0 @@ -/******************************************************************************* - * ============LICENSE_START==================================================== - * * org.onap.aaf - * * =========================================================================== - * * Copyright © 2017 AT&T Intellectual Property. All rights reserved. - * * =========================================================================== - * * Licensed under the Apache License, Version 2.0 (the "License"); - * * you may not use this file except in compliance with the License. - * * You may obtain a copy of the License at - * * - * * http://www.apache.org/licenses/LICENSE-2.0 - * * - * * Unless required by applicable law or agreed to in writing, software - * * distributed under the License is distributed on an "AS IS" BASIS, - * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * * See the License for the specific language governing permissions and - * * limitations under the License. - * * ============LICENSE_END==================================================== - * * - * * ECOMP is a trademark and service mark of AT&T Intellectual Property. - * * - ******************************************************************************/ -package org.onap.aaf.cadi.aaf.cass; - -import java.io.IOException; -import java.io.UnsupportedEncodingException; -import java.util.Arrays; -import java.util.HashMap; -import java.util.Map; - -import org.apache.cassandra.auth.AuthenticatedUser; -import org.apache.cassandra.auth.IAuthenticator; -import org.apache.cassandra.auth.ISaslAwareAuthenticator; -import org.apache.cassandra.exceptions.AuthenticationException; -import org.apache.cassandra.exceptions.InvalidRequestException; -import org.apache.cassandra.exceptions.RequestExecutionException; -import org.onap.aaf.cadi.Symm; -import org.onap.aaf.cadi.Access.Level; -import org.onap.aaf.cadi.CredVal.Type; -import org.onap.aaf.cadi.config.Config; - -public class AAFAuthenticator extends AAFBase implements ISaslAwareAuthenticator { - - public boolean requireAuthentication() { - return true; - } - - /** - * Invoked to authenticate an user - */ - public AuthenticatedUser authenticate(Map credentials) throws AuthenticationException { - String username = (String)credentials.get("username"); - if (username == null) { - throw new AuthenticationException("'username' is missing"); - } - - AAFAuthenticatedUser aau = new AAFAuthenticatedUser(access,username); - String fullName=aau.getFullName(); - access.log(Level.DEBUG, "Authenticating", aau.getName(),"(", fullName,")"); - - String password = (String)credentials.get("password"); - if (password == null) { - throw new AuthenticationException("'password' is missing"); - } else if(password.startsWith("bsf:")) { - try { - password = Symm.base64noSplit.depass(password); - } catch (IOException e) { - throw new AuthenticationException("AAF bnf: Password cannot be decoded"); - } - } else if(password.startsWith("enc:???")) { - try { - password = access.decrypt(password, true); - } catch (IOException e) { - throw new AuthenticationException("AAF Encrypted Password cannot be decrypted"); - } - } - - if(localLur!=null) { - access.log(Level.DEBUG, "Validating",fullName, "with LocalTaf", password); - if(localLur.validate(fullName, Type.PASSWORD, password.getBytes())) { - aau.setAnonymous(true); - aau.setLocal(true); - access.log(Level.DEBUG, fullName, "is authenticated locally"); - return aau; - } - } - - String aafResponse; - try { - access.log(Level.DEBUG, "Validating",fullName, "with AAF");//, password); - aafResponse = aafAuthn.validate(fullName, password); - if(aafResponse != null) { // Reason for failing. - access.log(Level.AUDIT, "AAF reports ",fullName,":",aafResponse); - throw new AuthenticationException(aafResponse); - } - access.log(Level.AUDIT, fullName, "is authenticated"); //,password); - // This tells Cassandra to skip checking it's own tables for User Entries. - aau.setAnonymous(true); - } catch (AuthenticationException ex) { - throw ex; - } catch(Exception ex) { - access.log(ex,"Exception validating user"); - throw new AuthenticationException("Exception validating user"); - } - - return aau; - } - - public void create(String username, Map options) throws InvalidRequestException, RequestExecutionException { - access.log(Level.INFO,"Use AAF CLI to create user"); - } - - public void alter(String username, Map options) throws RequestExecutionException { - access.log(Level.INFO,"Use AAF CLI to alter user"); - } - - public void drop(String username) throws RequestExecutionException { - access.log(Level.INFO,"Use AAF CLI to delete user"); - } - - public SaslAuthenticator newAuthenticator() { - return new ISaslAwareAuthenticator.SaslAuthenticator() { - private boolean complete = false; - private Map credentials; - - public byte[] evaluateResponse(byte[] clientResponse) throws AuthenticationException { - this.credentials = decodeCredentials(clientResponse); - this.complete = true; - return null; - } - - public boolean isComplete() { - return this.complete; - } - - public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException { - return AAFAuthenticator.this.authenticate(this.credentials); - } - - private Map decodeCredentials(byte[] bytes) throws AuthenticationException { - access.log(Level.DEBUG,"Decoding credentials from client token"); - byte[] user = null; - byte[] pass = null; - int end = bytes.length; - for (int i = bytes.length - 1; i >= 0; i--) - { - if (bytes[i] != 0) - continue; - if (pass == null) - pass = Arrays.copyOfRange(bytes, i + 1, end); - else if (user == null) - user = Arrays.copyOfRange(bytes, i + 1, end); - end = i; - } - - if (user == null) - throw new AuthenticationException("Authentication ID must not be null"); - if (pass == null) { - throw new AuthenticationException("Password must not be null"); - } - Map credentials = new HashMap(); - try { - credentials.put(IAuthenticator.USERNAME_KEY, new String(user, Config.UTF_8)); - credentials.put(IAuthenticator.PASSWORD_KEY, new String(pass, Config.UTF_8)); - } catch (UnsupportedEncodingException e) { - throw new AuthenticationException(e.getMessage()); - } - return credentials; - } - }; - } - -} - -- cgit 1.2.3-korg