Add gRPC & REST basic auth support

Change-Id: Iaa187a8288a9c84aa80b596a14e66de10a9b7501
Issue-ID: CCSDK-1055
Signed-off-by: Alexis de Talhouët <adetalhouet89@gmail.com>

9 files changed, 326 insertions, 21 deletions

diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintGRPCServer.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintGRPCServer.java
index 86fdccd4..3ac1a6e6 100644
--- a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintGRPCServer.java
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintGRPCServer.java
@@ -18,6 +18,7 @@ package org.onap.ccsdk.apps.blueprintsprocessor;
 
 import io.grpc.Server;
 import io.grpc.ServerBuilder;
+import org.onap.ccsdk.apps.blueprintsprocessor.security.BasicAuthServerInterceptor;
 import org.onap.ccsdk.apps.blueprintsprocessor.selfservice.api.BluePrintManagementGRPCHandler;
 import org.onap.ccsdk.apps.blueprintsprocessor.selfservice.api.BluePrintProcessingGRPCHandler;
 import org.slf4j.Logger;
@@ -37,9 +38,10 @@ public class BlueprintGRPCServer implements ApplicationListener<ContextRefreshed
 
     @Autowired
     private BluePrintProcessingGRPCHandler bluePrintProcessingGRPCHandler;
-
     @Autowired
     private BluePrintManagementGRPCHandler bluePrintManagementGRPCHandler;
+    @Autowired
+    private BasicAuthServerInterceptor authInterceptor;
 
     @Value("${blueprintsprocessor.grpcPort}")
     private Integer grpcPort;
@@ -49,10 +51,11 @@ public class BlueprintGRPCServer implements ApplicationListener<ContextRefreshed
         try {
             log.info("Starting Blueprint Processor GRPC Starting..");
             Server server = ServerBuilder
-                    .forPort(grpcPort)
-                    .addService(bluePrintProcessingGRPCHandler)
-                    .addService(bluePrintManagementGRPCHandler)
-                    .build();
+                .forPort(grpcPort)
+                .intercept(authInterceptor)
+                .addService(bluePrintProcessingGRPCHandler)
+                .addService(bluePrintManagementGRPCHandler)
+                .build();
 
             server.start();
             log.info("Blueprint Processor GRPC server started and ready to serve on port({})...", server.getPort());
diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintHttpServer.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintHttpServer.java
index b00c4627..9561b78d 100644
--- a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintHttpServer.java
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintHttpServer.java
@@ -16,23 +16,21 @@
 
 package org.onap.ccsdk.apps.blueprintsprocessor;
 
+import javax.annotation.PostConstruct;
+import javax.annotation.PreDestroy;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.web.embedded.netty.NettyReactiveWebServerFactory;
 import org.springframework.boot.web.reactive.server.ReactiveWebServerFactory;
 import org.springframework.boot.web.server.WebServer;
 import org.springframework.http.server.reactive.HttpHandler;
 import org.springframework.stereotype.Component;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-
-@ConditionalOnProperty(name = "blueprintsprocessor.grpcEnable", havingValue = "true")
 @Component
 public class BlueprintHttpServer {
+
     private static Logger log = LoggerFactory.getLogger(BlueprintHttpServer.class);
 
     @Value("${blueprintsprocessor.httpPort}")
diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintProcessorApplication.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintProcessorApplication.java
index 241d920a..3f8dc375 100644
--- a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintProcessorApplication.java
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/BlueprintProcessorApplication.java
@@ -21,7 +21,6 @@ import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.autoconfigure.SpringBootApplication;

 import org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration;

 import org.springframework.context.annotation.ComponentScan;

-import org.springframework.web.reactive.config.EnableWebFlux;

 

 /**

  * BlueprintProcessorApplication

@@ -30,10 +29,10 @@ import org.springframework.web.reactive.config.EnableWebFlux;
  */

 @SpringBootApplication

 @EnableAutoConfiguration(exclude = {DataSourceAutoConfiguration.class})

-@EnableWebFlux

 @ComponentScan(basePackages = {"org.onap.ccsdk.apps.controllerblueprints",

-        "org.onap.ccsdk.apps.blueprintsprocessor"})

+    "org.onap.ccsdk.apps.blueprintsprocessor"})

 public class BlueprintProcessorApplication {

+

     public static void main(String[] args) {

         SpringApplication.run(BlueprintProcessorApplication.class, args);

     }

diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/WebConfig.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/WebConfig.java
index 796a2d79..47c7b722 100644
--- a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/WebConfig.java
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/WebConfig.java
@@ -17,8 +17,17 @@
 

 package org.onap.ccsdk.apps.blueprintsprocessor;

 

+import org.onap.ccsdk.apps.blueprintsprocessor.security.AuthenticationManager;

+import org.onap.ccsdk.apps.blueprintsprocessor.security.SecurityContextRepository;

+import org.springframework.beans.factory.annotation.Autowired;

+import org.springframework.context.annotation.Bean;

 import org.springframework.context.annotation.Configuration;

-import org.springframework.web.reactive.config.*;

+import org.springframework.http.HttpMethod;

+import org.springframework.security.config.web.server.ServerHttpSecurity;

+import org.springframework.security.web.server.SecurityWebFilterChain;

+import org.springframework.web.reactive.config.CorsRegistry;

+import org.springframework.web.reactive.config.ResourceHandlerRegistry;

+import org.springframework.web.reactive.config.WebFluxConfigurationSupport;

 

 /**

  * WebConfig

@@ -27,21 +36,43 @@ import org.springframework.web.reactive.config.*;
  */

 @Configuration

 public class WebConfig extends WebFluxConfigurationSupport {

-	@Override

+

+    @Autowired

+    private AuthenticationManager authenticationManager;

+

+    @Autowired

+    private SecurityContextRepository securityContextRepository;

+

+    @Override

     public void addResourceHandlers(ResourceHandlerRegistry registry) {

         registry.addResourceHandler("swagger-ui.html")

-                .addResourceLocations("classpath:/META-INF/resources/");

+            .addResourceLocations("classpath:/META-INF/resources/");

 

         registry.addResourceHandler("/webjars/**")

-                .addResourceLocations("classpath:/META-INF/resources/webjars/");

+            .addResourceLocations("classpath:/META-INF/resources/webjars/");

     }

 

     @Override

     public void addCorsMappings(CorsRegistry corsRegistry) {

         corsRegistry.addMapping("/**")

-                .allowedOrigins("*")

-                .allowedMethods("*")

-                .allowedHeaders("DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range")

-                .maxAge(3600);

+            .allowedOrigins("*")

+            .allowedMethods("*")

+            .allowedHeaders("*")

+            .maxAge(3600);

+    }

+

+

+    @Bean

+    public SecurityWebFilterChain securitygWebFilterChain(ServerHttpSecurity http) {

+        return http.csrf().disable()

+            .formLogin().disable()

+            .httpBasic().disable()

+            .authenticationManager(authenticationManager)

+            .securityContextRepository(securityContextRepository)

+            .authorizeExchange()

+            .pathMatchers(HttpMethod.OPTIONS).permitAll()

+            .anyExchange().authenticated()

+            .and().build();

+

     }

 }

diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/AuthenticationManager.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/AuthenticationManager.java
new file mode 100644
index 00000000..726be2ce
--- /dev/null
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/AuthenticationManager.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2019 Bell Canada.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+* limitations under the License.
+ */
+package org.onap.ccsdk.apps.blueprintsprocessor.security;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.ReactiveAuthenticationManager;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import reactor.core.publisher.Mono;
+
+@Configuration
+public class AuthenticationManager implements ReactiveAuthenticationManager {
+
+    @Autowired
+    private AuthenticationProvider authenticationProvider;
+
+    @Override
+    public Mono<Authentication> authenticate(Authentication authentication) {
+        try {
+            return Mono.just(authenticationProvider.authenticate(authentication));
+        } catch (AuthenticationException e) {
+            return Mono.error(e);
+        }
+    }
+}
\ No newline at end of file
diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/BasicAuthServerInterceptor.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/BasicAuthServerInterceptor.java
new file mode 100644
index 00000000..db0bfce4
--- /dev/null
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/BasicAuthServerInterceptor.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2019 Bell Canada.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.onap.ccsdk.apps.blueprintsprocessor.security;
+
+import com.google.common.base.Strings;
+import io.grpc.Metadata;
+import io.grpc.ServerCall;
+import io.grpc.ServerCallHandler;
+import io.grpc.ServerInterceptor;
+import io.grpc.Status;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+
+@Component
+public class BasicAuthServerInterceptor implements ServerInterceptor {
+
+    private static Logger log = LoggerFactory.getLogger(BasicAuthServerInterceptor.class);
+
+    @Autowired
+    private AuthenticationManager authenticationManager;
+
+
+    @Override
+    public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(
+        ServerCall<ReqT, RespT> call,
+        Metadata headers,
+        ServerCallHandler<ReqT, RespT> next) {
+        String authHeader = headers.get(Metadata.Key.of("Authorization", Metadata.ASCII_STRING_MARSHALLER));
+
+        if (Strings.isNullOrEmpty(authHeader)) {
+            throw Status.UNAUTHENTICATED.withDescription("Missing required authentication").asRuntimeException();
+
+        }
+
+        try {
+            String[] tokens = decodeBasicAuth(authHeader);
+            String username = tokens[0];
+
+            log.info("Basic Authentication Authorization header found for user: {}", username);
+
+            Authentication authRequest = new UsernamePasswordAuthenticationToken(username, tokens[1]);
+            Authentication authResult = authenticationManager.authenticate(authRequest).block();
+
+            log.info("Authentication success: {}", authResult);
+
+            SecurityContextHolder.getContext().setAuthentication(authResult);
+
+        } catch (AuthenticationException e) {
+            SecurityContextHolder.clearContext();
+
+            log.info("Authentication request failed: {}", e.getMessage());
+
+            throw Status.UNAUTHENTICATED.withDescription(e.getMessage()).withCause(e).asRuntimeException();
+        }
+
+        return next.startCall(call, headers);
+    }
+
+    private String[] decodeBasicAuth(String authHeader) {
+        String basicAuth;
+        try {
+            basicAuth = new String(Base64.getDecoder().decode(authHeader.substring(6).getBytes(StandardCharsets.UTF_8)),
+                StandardCharsets.UTF_8);
+        } catch (IllegalArgumentException | IndexOutOfBoundsException e) {
+            throw new BadCredentialsException("Failed to decode basic authentication token");
+        }
+
+        int delim = basicAuth.indexOf(':');
+        if (delim == -1) {
+            throw new BadCredentialsException("Failed to decode basic authentication token");
+        }
+
+        return new String[]{basicAuth.substring(0, delim), basicAuth.substring(delim + 1)};
+    }
+}
\ No newline at end of file
diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/SecurityConfiguration.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/SecurityConfiguration.java
new file mode 100644
index 00000000..7ddc42cc
--- /dev/null
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/SecurityConfiguration.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2019 Bell Canada.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.onap.ccsdk.apps.blueprintsprocessor.security;
+
+import java.util.Collections;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+
+@Configuration
+public class SecurityConfiguration {
+
+    @Value("${security.user.name}")
+    private String username;
+
+    @Value("${security.user.password}")
+    private String password;
+
+    @Bean
+    public UserDetailsService inMemoryUserService() {
+        UserDetails user = new User(username, password,
+            Collections.singletonList(new SimpleGrantedAuthority("USER")));
+        return new InMemoryUserDetailsManager(user);
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    @Bean
+    public AuthenticationProvider inMemoryAuthenticationProvider() {
+        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
+        provider.setUserDetailsService(inMemoryUserService());
+        return provider;
+    }
+}
\ No newline at end of file
diff --git a/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/SecurityContextRepository.java b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/SecurityContextRepository.java
new file mode 100644
index 00000000..f9e184a1
--- /dev/null
+++ b/ms/blueprintsprocessor/application/src/main/java/org/onap/ccsdk/apps/blueprintsprocessor/security/SecurityContextRepository.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2019 Bell Canada.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.onap.ccsdk.apps.blueprintsprocessor.security;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextImpl;
+import org.springframework.security.web.server.context.ServerSecurityContextRepository;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+@Component
+public class SecurityContextRepository implements ServerSecurityContextRepository {
+
+    @Autowired
+    private AuthenticationManager authenticationManager;
+
+    @Override
+    public Mono<Void> save(ServerWebExchange swe, SecurityContext sc) {
+        throw new UnsupportedOperationException("Not supported.");
+    }
+
+    @Override
+    public Mono<SecurityContext> load(ServerWebExchange swe) {
+        ServerHttpRequest request = swe.getRequest();
+        String authHeader = request.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
+        if (authHeader != null && authHeader.startsWith("Basic")) {
+            String[] tokens = decodeBasicAuth(authHeader);
+            String username = tokens[0];
+            String password = tokens[1];
+            Authentication auth = new UsernamePasswordAuthenticationToken(username, password);
+            return this.authenticationManager.authenticate(auth).map(SecurityContextImpl::new);
+        } else {
+            return Mono.empty();
+        }
+    }
+
+    private String[] decodeBasicAuth(String authHeader) {
+        String basicAuth;
+        try {
+            basicAuth = new String(Base64.getDecoder().decode(authHeader.substring(6).getBytes(StandardCharsets.UTF_8)),
+                StandardCharsets.UTF_8);
+        } catch (IllegalArgumentException | IndexOutOfBoundsException e) {
+            throw new BadCredentialsException("Failed to decode basic authentication token");
+        }
+
+        int delim = basicAuth.indexOf(':');
+        if (delim == -1) {
+            throw new BadCredentialsException("Failed to decode basic authentication token");
+        }
+
+        return new String[]{basicAuth.substring(0, delim), basicAuth.substring(delim + 1)};
+    }
+}
\ No newline at end of file
diff --git a/ms/blueprintsprocessor/application/src/main/resources/application.properties b/ms/blueprintsprocessor/application/src/main/resources/application.properties
index cfef4f82..e955c97c 100755
--- a/ms/blueprintsprocessor/application/src/main/resources/application.properties
+++ b/ms/blueprintsprocessor/application/src/main/resources/application.properties
@@ -36,3 +36,6 @@ blueprintsprocessor.db.primary.hibernateDialect=org.hibernate.dialect.MySQL5Inno
 # Python executor
 blueprints.processor.functions.python.executor.executionPath=/opt/app/onap/scripts/jython/ccsdk_blueprints
 blueprints.processor.functions.python.executor.modulePaths=/opt/app/onap/scripts/jython/ccsdk_blueprints,/opt/app/onap/scripts/jython/ccsdk_netconf
+
+security.user.password: {bcrypt}$2a$10$duaUzVUVW0YPQCSIbGEkQOXwafZGwQ/b32/Ys4R1iwSSawFgz7QNu
+security.user.name: ccsdkapps