From 6b0778a113c27c9a0579248866b2324a5c5cf582 Mon Sep 17 00:00:00 2001 From: "M.Hosnidokht" Date: Tue, 12 Jan 2021 12:13:53 -0500 Subject: Using new OwnerCheck implementation - Bump up aai-common version Issue-ID: AAI-3226 Signed-off-by: Mohammad Hosnidokht Change-Id: I7c74bf65a8a8218d172d865b19fb672a1b87e988 --- aai-resources/pom.xml | 2 +- .../java/org/onap/aai/rest/LegacyMoxyConsumer.java | 31 +++++++++++++++++----- .../onap/aai/rest/security/WebSecurityConfig.java | 2 -- .../main/resources/application-keycloak.properties | 2 +- pom.xml | 6 ++--- version.properties | 2 +- 6 files changed, 30 insertions(+), 15 deletions(-) diff --git a/aai-resources/pom.xml b/aai-resources/pom.xml index de6eaa4..b710d5e 100644 --- a/aai-resources/pom.xml +++ b/aai-resources/pom.xml @@ -28,7 +28,7 @@ org.onap.aai.resources resources - 1.8.0-SNAPSHOT + 1.8.1-SNAPSHOT 1.8 diff --git a/aai-resources/src/main/java/org/onap/aai/rest/LegacyMoxyConsumer.java b/aai-resources/src/main/java/org/onap/aai/rest/LegacyMoxyConsumer.java index 4f7049d..d22252a 100644 --- a/aai-resources/src/main/java/org/onap/aai/rest/LegacyMoxyConsumer.java +++ b/aai-resources/src/main/java/org/onap/aai/rest/LegacyMoxyConsumer.java @@ -20,7 +20,7 @@ package org.onap.aai.rest; import io.swagger.jaxrs.PATCH; -import java.security.Principal; +import org.apache.commons.lang3.ObjectUtils; import org.javatuples.Pair; import org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount; import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken; @@ -29,6 +29,7 @@ import org.onap.aai.config.SpringContextAware; import org.onap.aai.exceptions.AAIException; import org.onap.aai.introspection.Introspector; import org.onap.aai.introspection.Loader; +import org.onap.aai.introspection.sideeffect.OwnerCheck; import org.onap.aai.parsers.query.QueryParser; import org.onap.aai.rest.db.DBRequest; import org.onap.aai.rest.db.HttpEntry; @@ -48,6 +49,7 @@ import javax.ws.rs.*; import javax.ws.rs.core.*; import java.io.UnsupportedEncodingException; import java.net.URI; +import java.security.Principal; import java.util.*; import java.util.stream.Collectors; @@ -75,7 +77,7 @@ public class LegacyMoxyConsumer extends RESTAPI { @Consumes({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML }) public Response update (String content, @PathParam("version")String versionParam, @PathParam("uri") @Encoded String uri, @Context HttpHeaders headers, @Context UriInfo info, @Context HttpServletRequest req) { - Set roles = getRoles(req.getUserPrincipal()); + Set roles = getRoles(req.getUserPrincipal(), req.getMethod()); MediaType mediaType = headers.getMediaType(); return this.handleWrites(mediaType, HttpMethod.PUT, content, versionParam, uri, headers, info, roles); } @@ -166,7 +168,7 @@ public class LegacyMoxyConsumer extends RESTAPI { @Consumes({ "application/merge-patch+json" }) @Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML }) public Response patch (String content, @PathParam("version")String versionParam, @PathParam("uri") @Encoded String uri, @Context HttpHeaders headers, @Context UriInfo info, @Context HttpServletRequest req) { - Set roles = getRoles(req.getUserPrincipal()); + Set roles = getRoles(req.getUserPrincipal(), req.getMethod()); MediaType mediaType = MediaType.APPLICATION_JSON_TYPE; return this.handleWrites(mediaType, HttpMethod.MERGE_PATCH, content, versionParam, uri, headers, info, roles); @@ -190,7 +192,7 @@ public class LegacyMoxyConsumer extends RESTAPI { @Consumes({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML }) public Response getLegacy (String content, @DefaultValue("-1") @QueryParam("resultIndex") String resultIndex, @DefaultValue("-1") @QueryParam("resultSize") String resultSize, @PathParam("version")String versionParam, @PathParam("uri") @Encoded String uri, @DefaultValue("all") @QueryParam("depth") String depthParam, @DefaultValue("false") @QueryParam("cleanup") String cleanUp, @Context HttpHeaders headers, @Context UriInfo info, @Context HttpServletRequest req) { - Set roles = getRoles(req.getUserPrincipal()); + Set roles = getRoles(req.getUserPrincipal(), req.getMethod()); return runner(AAIConstants.AAI_CRUD_TIMEOUT_ENABLED, AAIConstants.AAI_CRUD_TIMEOUT_APP, @@ -667,16 +669,31 @@ public class LegacyMoxyConsumer extends RESTAPI { return "{}".equals(obj.marshal(false)); } - private Set getRoles(Principal userPrincipal) { + private Set getRoles(Principal userPrincipal, String method) { KeycloakAuthenticationToken token = (KeycloakAuthenticationToken) userPrincipal; - if (token == null) { + if (ObjectUtils.isEmpty(token)) { return Collections.EMPTY_SET; } SimpleKeycloakAccount account = (SimpleKeycloakAccount) token.getDetails(); - if (account == null) { + if (ObjectUtils.isEmpty(account)) { return Collections.EMPTY_SET; } + // When the request is not a GET, we need to exclude ReadOnly access roles + if (isNotGetRequest(method)) { + return getExcludedReadOnlyAccessRoles(account); + } return account.getRoles(); } + + private Set getExcludedReadOnlyAccessRoles(SimpleKeycloakAccount account) { + return account.getRoles() + .stream() + .filter(role -> !role.endsWith(OwnerCheck.READ_ONLY_SUFFIX)) + .collect(Collectors.toSet()); + } + + private boolean isNotGetRequest(String method) { + return !Action.GET.name().equalsIgnoreCase(method); + } } diff --git a/aai-resources/src/main/java/org/onap/aai/rest/security/WebSecurityConfig.java b/aai-resources/src/main/java/org/onap/aai/rest/security/WebSecurityConfig.java index 2b67c40..127a490 100644 --- a/aai-resources/src/main/java/org/onap/aai/rest/security/WebSecurityConfig.java +++ b/aai-resources/src/main/java/org/onap/aai/rest/security/WebSecurityConfig.java @@ -72,8 +72,6 @@ public class WebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter { super.configure(http); http.authorizeRequests() .antMatchers("/**") - .hasAnyRole("admin") - .anyRequest() .permitAll().and().csrf().disable(); } diff --git a/aai-resources/src/main/resources/application-keycloak.properties b/aai-resources/src/main/resources/application-keycloak.properties index c787d0b..d398256 100644 --- a/aai-resources/src/main/resources/application-keycloak.properties +++ b/aai-resources/src/main/resources/application-keycloak.properties @@ -3,7 +3,7 @@ spring.autoconfigure.exclude=\ org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration,\ org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration - +multi.tenancy.enabled=true keycloak.auth-server-url=http://localhost:8180/auth keycloak.realm=aai-resources keycloak.resource=aai-resources-app diff --git a/pom.xml b/pom.xml index 20ab910..2c49f8b 100644 --- a/pom.xml +++ b/pom.xml @@ -26,11 +26,11 @@ org.onap.aai.aai-common aai-parent - 1.7.2 + 1.8.1 org.onap.aai.resources resources - 1.8.0-SNAPSHOT + 1.8.1-SNAPSHOT aai-resources pom @@ -48,7 +48,7 @@ /content/repositories/staging/ ${project.version} - 1.7.2 + 1.8.1 1.7.9 diff --git a/version.properties b/version.properties index 5403b8c..b40cc93 100644 --- a/version.properties +++ b/version.properties @@ -5,7 +5,7 @@ major_version=1 minor_version=8 -patch_version=0 +patch_version=1 base_version=${major_version}.${minor_version}.${patch_version} -- cgit 1.2.3-korg