diff options
Diffstat (limited to 'aai-auth')
| -rw-r--r-- | aai-auth/License.txt | 22 | ||||
| -rw-r--r-- | aai-auth/pom.xml | 167 | ||||
| -rw-r--r-- | aai-auth/src/main/java/org/openecomp/auth/Auth.java | 63 | ||||
| -rw-r--r-- | aai-auth/src/main/java/org/openecomp/auth/AuthCore.java | 219 | ||||
| -rw-r--r-- | aai-auth/src/main/java/org/openecomp/util/AuthConstants.java | 44 |
5 files changed, 515 insertions, 0 deletions
diff --git a/aai-auth/License.txt b/aai-auth/License.txt new file mode 100644 index 00000000..df5d92ad --- /dev/null +++ b/aai-auth/License.txt @@ -0,0 +1,22 @@ +============LICENSE_START======================================================= +EcompAuth +================================================================================ +Copyright © 2017 AT&T Intellectual Property. +Copyright © 2017 Amdocs +All rights reserved. +================================================================================ +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +============LICENSE_END========================================================= + +ECOMP and OpenECOMP are trademarks +and service marks of AT&T Intellectual Property. diff --git a/aai-auth/pom.xml b/aai-auth/pom.xml new file mode 100644 index 00000000..e4e2b22b --- /dev/null +++ b/aai-auth/pom.xml @@ -0,0 +1,167 @@ +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> + <modelVersion>4.0.0</modelVersion> + <parent> + <groupId>org.onap.aai.aai-common</groupId> + <artifactId>aai-common</artifactId> + <version>1.1.0-SNAPSHOT</version> + </parent> + <artifactId>aai-auth</artifactId> + <name>aai-auth</name> + <version>1.1.0-SNAPSHOT</version> + + <properties> + <checkstyle.config.location>google_checks.xml</checkstyle.config.location> + <nexusproxy>https://nexus.onap.org</nexusproxy> + <sitePath>/content/sites/site/${project.groupId}/${project.artifactId}/${project.version}</sitePath> + </properties> + + + <dependencies> + + <dependency> + <groupId>com.fasterxml.jackson.core</groupId> + <artifactId>jackson-databind</artifactId> + <version>2.8.7</version> + </dependency> + + <dependency> + <groupId>org.apache.httpcomponents</groupId> + <artifactId>httpclient</artifactId> + <version>4.5.3</version> + </dependency> + </dependencies> + + <build> + <pluginManagement> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-compiler-plugin</artifactId> + <configuration> + <source>1.8</source> + <target>1.8</target> + </configuration> + </plugin> + <plugin> + <artifactId>maven-release-plugin</artifactId> + <version>2.4.2</version> + <dependencies> + <dependency> + <groupId>org.apache.maven.scm</groupId> + <artifactId>maven-scm-provider-gitexe</artifactId> + <version>1.8.1</version> + </dependency> + </dependencies> + </plugin> + </plugins> + </pluginManagement> + <plugins> + <!-- license plugin --> + <plugin> + <groupId>com.mycila</groupId> + <artifactId>license-maven-plugin</artifactId> + <version>3.0</version> + <configuration> + <header>License.txt</header> + <includes> + <include>src/main/java/**</include> + </includes> + </configuration> + <executions> + <execution> + <goals> + <goal>format</goal> + </goals> + <phase>process-sources</phase> + </execution> + </executions> + </plugin> + + + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-site-plugin</artifactId> + <version>3.3</version> + <configuration> + <reportPlugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-checkstyle-plugin</artifactId> + <version>2.17</version> + <reportSets> + <reportSet> + <reports> + <report>checkstyle</report> + </reports> + </reportSet> + </reportSets> + </plugin> + </reportPlugins> + </configuration> + </plugin> + <plugin> + <groupId>org.sonatype.plugins</groupId> + <artifactId>nexus-staging-maven-plugin</artifactId> + <version>1.6.7</version> + <extensions>true</extensions> + <configuration> + <nexusUrl>${nexusproxy}</nexusUrl> + <stagingProfileId>176c31dfe190a</stagingProfileId> + <serverId>ecomp-staging</serverId> + </configuration> + </plugin> + </plugins> + </build> + + <distributionManagement> + <repository> + <id>ecomp-releases</id> + <name>ECOMP Release Repository</name> + <url>${nexusproxy}/content/repositories/releases/</url> + </repository> + <snapshotRepository> + <id>ecomp-snapshots</id> + <name>ECOMP Snapshot Repository</name> + <url>${nexusproxy}/content/repositories/snapshots/</url> + </snapshotRepository> + <site> + <id>ecomp-site</id> + <url>dav:${nexusproxy}${sitePath}</url> + </site> + </distributionManagement> + + <repositories> + <repository> + <id>AJSC</id> + <name>AJSC repository</name> + <url>https://mvnrepository.com/artifact/com.att.ajsc</url> + </repository> + <repository> + <id>restlet</id> + <name>maven reslet</name> + <url>https://maven.restlet.com/</url> + </repository> + + <repository> + <id>central</id> + <name>Maven 2 repository 2</name> + <url>http://repo2.maven.org/maven2/</url> + </repository> + <repository> + <id>ecomp-releases</id> + <name>ECOMP Release Repository</name> + <url>${nexusproxy}/content/repositories/releases/</url> + </repository> + <repository> + <id>ecomp-staging</id> + <name>ECOMP Staging Repository</name> + <url>${nexusproxy}/content/repositories/staging/</url> + </repository> + <repository> + <id>ecomp-snapshots</id> + <name>ECOMP Snapshot Repository</name> + <url>${nexusproxy}/content/repositories/snapshots/</url> + </repository> + </repositories> +</project> diff --git a/aai-auth/src/main/java/org/openecomp/auth/Auth.java b/aai-auth/src/main/java/org/openecomp/auth/Auth.java new file mode 100644 index 00000000..4d112887 --- /dev/null +++ b/aai-auth/src/main/java/org/openecomp/auth/Auth.java @@ -0,0 +1,63 @@ +/** + * ============LICENSE_START======================================================= + * EcompAuth + * ================================================================================ + * Copyright © 2017 AT&T Intellectual Property. + * Copyright © 2017 Amdocs + * All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + * + * ECOMP and OpenECOMP are trademarks + * and service marks of AT&T Intellectual Property. + */ + +package org.openecomp.auth; + +import org.apache.http.cookie.Cookie; + +public class Auth { + private AuthCore authCore; + + public Auth(String filename) throws Exception { + this.authCore = new AuthCore(filename); + } + + public boolean auth_basic(String username, String authFunction) throws Exception { + return authCore.authorize(username, authFunction); + } + + public boolean auth_cookie(Cookie cookie, String authFunction, StringBuilder username) + throws Exception { + if (cookie == null) { + return false; + } + return authCore.authorize(username.toString(), authFunction); + } + + /** + * Returns true if the user is allowed to access a function. + * @param authUser + * - String value of the user. + * @param authAction + * - String value of the function. + */ + public boolean validateRequest(String authUser, String authAction) throws Exception { + + if (authUser == null || authAction == null) { + return false; + } + return authCore.authorize(authUser, authAction); + } +} diff --git a/aai-auth/src/main/java/org/openecomp/auth/AuthCore.java b/aai-auth/src/main/java/org/openecomp/auth/AuthCore.java new file mode 100644 index 00000000..27de5c04 --- /dev/null +++ b/aai-auth/src/main/java/org/openecomp/auth/AuthCore.java @@ -0,0 +1,219 @@ +/** + * ============LICENSE_START======================================================= + * EcompAuth + * ================================================================================ + * Copyright © 2017 AT&T Intellectual Property. + * Copyright © 2017 Amdocs + * All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + * + * ECOMP and OpenECOMP are trademarks + * and service marks of AT&T Intellectual Property. + */ +package org.openecomp.auth; + +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.ObjectMapper; +import org.openecomp.util.AuthConstants; + +import java.io.File; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + + +public class AuthCore { + + private String authFilename; + public ObjectMapper mapper; + + private static enum HTTP_METHODS { + POST, GET, PUT, DELETE, PATCH + } + + public AuthCore(String filename) throws Exception { + this.authFilename = filename; + loadUsers(filename); + } + + private static boolean usersInitialized = false; + private static HashMap<String, AuthUser> users; + + public String getConfigFile() { + return this.authFilename; + } + + /** + * Loads the auth file and caches a list of authorized users. + * @param authFilename + * - Absolute path of the file where authorized users are listed. + */ + public synchronized void loadUsers(String authFilename) throws Exception { + users = new HashMap<String, AuthUser>(); + + mapper = new ObjectMapper(); // can reuse, share globally + JsonNode rootNode = mapper.readTree(new File(authFilename)); + JsonNode rolesNode = rootNode.path(AuthConstants.rolesNodePath); + + for (JsonNode roleNode : rolesNode) { + String roleName = roleNode.path(AuthConstants.roleNamePath).asText(); + + AuthRole role = new AuthRole(); + JsonNode usersNode = roleNode.path(AuthConstants.usersNodePath); + JsonNode functionsNode = roleNode.path(AuthConstants.functionsNodePath); + for (JsonNode functionNode : functionsNode) { + String function = functionNode.path(AuthConstants.functionNamePath).asText(); + JsonNode methodsNode = functionNode.path(AuthConstants.methodsNodePath); + boolean hasMethods = false; + for (JsonNode methodNode : methodsNode) { + String methodName = methodNode.path(AuthConstants.methodNamePath).asText(); + hasMethods = true; + String thisFunction = methodName + ":" + function; + + role.addAllowedFunction(thisFunction); + } + + if (hasMethods == false) { + // iterate the list from HTTP_METHODS + for (HTTP_METHODS meth : HTTP_METHODS.values()) { + String thisFunction = meth.toString() + ":" + function; + + role.addAllowedFunction(thisFunction); + } + } + } + + for (JsonNode userNode : usersNode) { + // make the user lower case + String node = userNode.path(AuthConstants.userNodePath).asText().toLowerCase(); + AuthUser user = null; + if (users.containsKey(node)) { + user = users.get(node); + } else { + user = new AuthUser(); + } + + user.setUser(node); + user.addRole(roleName, role); + users.put(node, user); + } + } + + usersInitialized = true; + + } + + public class AuthUser { + public AuthUser() { + this.roles = new HashMap<String, AuthRole>(); + } + + private String username; + private HashMap<String, AuthRole> roles; + + public String getUser() { + return this.username; + } + + public HashMap<String, AuthRole> getRoles() { + return this.roles; + } + + public void addRole(String roleName, AuthRole role) { + this.roles.put(roleName, role); + } + + /** + * Returns true if the user has permissions for the function, otherwise returns false. + * @param checkFunc + * - String value of the function. + */ + public boolean checkAllowed(String checkFunc) { + for (Map.Entry<String, AuthRole> roleEntry : this.roles.entrySet()) { + AuthRole role = roleEntry.getValue(); + if (role.hasAllowedFunction(checkFunc)) { + // break out as soon as we find it + return true; + } + } + // we would have got positive confirmation had it been there + return false; + } + + public void setUser(String myuser) { + this.username = myuser; + } + + } + + public static class AuthRole { + public AuthRole() { + this.allowedFunctions = new ArrayList<String>(); + } + + private List<String> allowedFunctions; + + public void addAllowedFunction(String func) { + this.allowedFunctions.add(func); + } + + /** + * Remove the function from the user's list of allowed functions. + * @param delFunc + * - String value of the function. + */ + public void delAllowedFunction(String delFunc) { + if (this.allowedFunctions.contains(delFunc)) { + this.allowedFunctions.remove(delFunc); + } + } + + /** + * Returns true if the user has permissions to use the function, otherwise returns false. + * @param afunc + * - String value of the function. + */ + public boolean hasAllowedFunction(String afunc) { + if (this.allowedFunctions.contains(afunc)) { + return true; + } else { + return false; + } + } + } + + /** + * Returns a hash-map of all users which have been loaded and initialized. + */ + public HashMap<String, AuthUser> getUsers(String key) throws Exception { + if (!usersInitialized || (users == null)) { + loadUsers(this.authFilename); + } + return users; + } + + /** + * Returns true if the user is allowed to access a function. + * @param username + * - String value of user + * @param authFunction + * - String value of the function. + */ + public boolean authorize(String username, String authFunction) throws Exception { + AuthUser user = users.get(username); + return user != null && user.checkAllowed(authFunction); + } +} diff --git a/aai-auth/src/main/java/org/openecomp/util/AuthConstants.java b/aai-auth/src/main/java/org/openecomp/util/AuthConstants.java new file mode 100644 index 00000000..8f4f60b9 --- /dev/null +++ b/aai-auth/src/main/java/org/openecomp/util/AuthConstants.java @@ -0,0 +1,44 @@ +/** + * ============LICENSE_START======================================================= + * EcompAuth + * ================================================================================ + * Copyright © 2017 AT&T Intellectual Property. + * Copyright © 2017 Amdocs + * All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + * + * ECOMP and OpenECOMP are trademarks + * and service marks of AT&T Intellectual Property. + */ +package org.openecomp.util; + +public class AuthConstants { + + public static final String rolesNodePath = "roles"; + + public static final String roleNamePath = "name"; + + public static final String usersNodePath = "users"; + + public static final String functionsNodePath = "functions"; + + public static final String functionNamePath = "name"; + + public static final String methodsNodePath = "methods"; + + public static final String methodNamePath = "name"; + + public static final String userNodePath = "username"; +} |