From ea50c8f5ac2e2cfa30512acd4ab1e72c2a36b278 Mon Sep 17 00:00:00 2001
From: Ravi Pendurty <ravi.pendurty@highstreet-technologies.com>
Date: Tue, 3 Aug 2021 15:13:28 +0530
Subject: Support for external identity providers

oauth-provider now supports keycloak and gitlab as identity providers

Issue-ID: CCSDK-3411
Signed-off-by: Ravi Pendurty <ravi.pendurty@highstreet-technologies.com>
Change-Id: I78d678136e26f402b25723f4e10d76b646d76589
Signed-off-by: Ravi Pendurty <ravi.pendurty@highstreet-technologies.com>
---
 .../src/test/resources/aaa-app-config.test.xml     | 258 ++++++++++++++++++++-
 .../src/test/resources/test.config.json            |   3 +-
 2 files changed, 257 insertions(+), 4 deletions(-)

(limited to 'sdnr/wt/oauth-provider/provider-jar/src/test/resources')

diff --git a/sdnr/wt/oauth-provider/provider-jar/src/test/resources/aaa-app-config.test.xml b/sdnr/wt/oauth-provider/provider-jar/src/test/resources/aaa-app-config.test.xml
index 682fa3728..1929fde8e 100644
--- a/sdnr/wt/oauth-provider/provider-jar/src/test/resources/aaa-app-config.test.xml
+++ b/sdnr/wt/oauth-provider/provider-jar/src/test/resources/aaa-app-config.test.xml
@@ -6,7 +6,6 @@
      terms of the Eclipse Public License v1.0 which accompanies this distribution,
      and is available at http://www.eclipse.org/legal/epl-v10.html , or the Apache License,
      Version 2.0 which is available at https://www.apache.org/licenses/LICENSE-2.0
-
      SPDX-License-Identifier: EPL-1.0 OR Apache-2.0
 -->
 
@@ -17,15 +16,243 @@
   ///////////////////////////////////////////////////////////////////////////////////////
 -->
 
-
 <shiro-configuration xmlns="urn:opendaylight:aaa:app:config">
 
+    <!--
+      ///////////////////////////////////////////////////////////////////////////////////
+      // shiro-configuration is the model based container that contains all shiro      //
+      // related information used in ODL AAA configuration.  It is the sole pain of    //
+      // glass for shiro related configuration, and is how to configure shiro concepts //
+      // such as:                                                                      //
+      // * realms                                                                      //
+      // * urls                                                                        //
+      // * security manager settings                                                   //
+      //                                                                               //
+      // In general, you really shouldn't muck with the settings in this file.  The    //
+      // way an operator should configure AAA shiro settings is through one of ODL's   //
+      // northbound interfaces (i.e., RESTCONF or NETCONF).  These are just the        //
+      // defaults if no values are specified in MD-SAL.  The reason this file is so    //
+      // verbose is for two reasons:                                                   //
+      // 1) to demonstrate payload examples for plausible configuration scenarios      //
+      // 2) to allow bootstrap of the controller (first time start) since otherwise    //
+      //    configuration becomes a chicken and the egg problem.                       //
+      //                                                                               //
+      ///////////////////////////////////////////////////////////////////////////////////
+    -->
+
+    <!--
+      ===================================================================================
+      =                                                                                 =
+      =                                                                                 =
+      =                                      MAIN                                       =
+      =                                                                                 =
+      =                                                                                 =
+      ===================================================================================
+    -->
+
+    <!--
+      ===================================================================================
+      ============================ ODLJndiLdapRealmAuthNOnly ============================
+      ===================================================================================
+      =                                                                                 =
+      = Description:  A Realm implementation aimed at federating with an external LDAP  =
+      =               server for authentication only.  For authorization support, refer =
+      =               to ODLJndiLdapRealm.                                              =
+      ===================================================================================
+    -->
+    <!-- Start ldapRealm commented out
+    <main>
+        <pair-key>ldapRealm</pair-key>
+        <pair-value>org.opendaylight.aaa.shiro.realm.ODLJndiLdapRealmAuthNOnly</pair-value>
+    </main>
+    <main>
+        <pair-key>ldapRealm.userDnTemplate</pair-key>
+        <pair-value>uid={0},ou=People,dc=DOMAIN,dc=TLD</pair-value>
+    </main>
+    <main>
+        <pair-key>ldapRealm.contextFactory.url</pair-key>
+        <pair-value>ldap://&lt;URL&gt;:389</pair-value>
+    </main>
+    <main>
+        <pair-key>ldapRealm.searchBase</pair-key>
+        <pair-value>dc=DOMAIN,dc=TLD</pair-value>
+    </main>
+    <main>
+        <pair-key>ldapRealm.groupRolesMap</pair-key>
+        <pair-value>&quot;person&quot;:&quot;admin&quot;, &quot;organizationalPerson&quot;:&quot;user&quot;</pair-value>
+    </main>
+    <main>
+        <pair-key>ldapRealm.ldapAttributeForComparison</pair-key>
+        <pair-value>objectClass</pair-value>
+    </main>
+    End ldapRealm commented out-->
+
+    <!--
+      ===================================================================================
+      ============================= ODLActiveDirectoryRealm =============================
+      ===================================================================================
+      =                                                                                 =
+      = Description:  A Realm implementation aimed at federating with an external AD    =
+      =               IDP server.                                                       =
+      ===================================================================================
+    -->
+    <!-- Start adRealm commented out
+    <main>
+        <pair-key>adRealm</pair-key>
+        <pair-value>org.opendaylight.aaa.shiro.realm.ODLActiveDirectoryRealm</pair-value>
+    </main>
+    <main>
+        <pair-key>adRealm.searchBase</pair-key>
+        <pair-value>&quot;CN=Users,DC=example,DC=com&quot;</pair-value>
+    </main>
+    <main>
+        <pair-key>adRealm.systemUsername</pair-key>
+        <pair-value>aduser@example.com</pair-value>
+    </main>
+    <main>
+        <pair-key>adRealm.systemPassword</pair-key>
+        <pair-value>adpassword</pair-value>
+    </main>
+    <main>
+        <pair-key>adRealm.url</pair-key>
+        <pair-value>ldaps://adserver:636</pair-value>
+    </main>
+    <main>
+        <pair-key>adRealm.groupRolesMap</pair-key>
+        <pair-value>&quot;CN=sysadmin,CN=Users,DC=example,DC=com&quot;:&quot;admin&quot;, &quot;CN=unprivileged,CN=Users,DC=example,DC=com&quot;:&quot;user&quot;</pair-value>
+    </main>
+    End adRealm commented out-->
+
+    <!--
+      ===================================================================================
+      ================================== ODLJdbcRealm ===================================
+      ===================================================================================
+      =                                                                                 =
+      = Description:  A Realm implementation aimed at federating with an external JDBC  =
+      =               DBMS.                                                             =
+      ===================================================================================
+    -->
+    <!-- Start jdbcRealm commented out
+    <main>
+        <pair-key>ds</pair-key>
+        <pair-value>com.mysql.jdbc.Driver</pair-value>
+    </main>
+    <main>
+        <pair-key>ds.serverName</pair-key>
+        <pair-value>localhost</pair-value>
+    </main>
+    <main>
+        <pair-key>ds.user</pair-key>
+        <pair-value>user</pair-value>
+    </main>
+    <main>
+        <pair-key>ds.password</pair-key>
+        <pair-value>password</pair-value>
+    </main>
+    <main>
+        <pair-key>ds.databaseName</pair-key>
+        <pair-value>db_name</pair-value>
+    </main>
+    <main>
+        <pair-key>jdbcRealm</pair-key>
+        <pair-value>ODLJdbcRealm</pair-value>
+    </main>
+    <main>
+        <pair-key>jdbcRealm.dataSource</pair-key>
+        <pair-value>$ds</pair-value>
+    </main>
+    <main>
+        <pair-key>jdbcRealm.authenticationQuery</pair-key>
+        <pair-value>&quot;SELECT password FROM users WHERE user_name = ?&quot;</pair-value>
+    </main>
+    <main>
+        <pair-key>jdbcRealm.userRolesQuery</pair-key>
+        <pair-value>&quot;SELECT role_name FROM user_rolesWHERE user_name = ?&quot;</pair-value>
+    </main>
+    End jdbcRealm commented out-->
 
+    <!--
+      ===================================================================================
+      ================================= TokenAuthRealm ==================================
+      ===================================================================================
+      =                                                                                 =
+      = Description:  A Realm implementation utilizing a per node H2 database store.    =
+      ===================================================================================
+    -->
+<!--     <main> -->
+<!--         <pair-key>tokenAuthRealm</pair-key> -->
+<!--         <pair-value>org.opendaylight.aaa.shiro.realm.TokenAuthRealm</pair-value> -->
+<!--     </main> -->
     <main>
         <pair-key>tokenAuthRealm</pair-key>
         <pair-value>org.onap.ccsdk.features.sdnr.wt.oauthprovider.OAuth2Realm</pair-value>
     </main>
 
+    <!--
+      ===================================================================================
+      =================================== MdsalRealm ====================================
+      ===================================================================================
+      =                                                                                 =
+      = Description:  A Realm implementation utilizing the aaa.yang model.              =
+      ===================================================================================
+    -->
+    <!-- Start mdsalRealm commented out
+    <main>
+        <pair-key>mdsalRealm</pair-key>
+        <pair-value>org.opendaylight.aaa.shiro.realm.MdsalRealm</pair-value>
+    </main>
+    End mdsalRealm commented out-->
+
+    <!--
+      ===================================================================================
+      ================================= MoonAuthRealm ===================================
+      ===================================================================================
+      =                                                                                 =
+      = Description:  A Realm implementation aimed at federating with OPNFV Moon.       =
+      ===================================================================================
+    -->
+    <!-- Start moonAuthRealm commented out
+    <main>
+        <pair-key>moonAuthRealm</pair-key>
+        <pair-value>org.opendaylight.aaa.shiro.realm.MoonRealm</pair-value>
+    </main>
+    <main>
+        <pair-key>moonAuthRealm.moonServerURL</pair-key>
+        <pair-value>http://&lt;host&gt;:&lt;port&gt;</pair-value>
+    </main>
+    End moonAuthRealm commented out-->
+
+    <!--
+      ===================================================================================
+      ================================= KeystoneAuthRealm == ============================
+      ===================================================================================
+      =                                                                                 =
+      = Description:  A Realm implementation aimed at federating with an OpenStack      =
+      =               Keystone.                                                         =
+      ===================================================================================
+    -->
+    <!-- Start keystoneAuthRealm commented out
+    <main>
+        <pair-key>keystoneAuthRealm</pair-key>
+        <pair-value>org.opendaylight.aaa.shiro.realm.KeystoneAuthRealm</pair-value>
+    </main>
+    <main>
+        <pair-key>keystoneAuthRealm.url</pair-key>
+        <pair-value>https://&lt;host&gt;:&lt;port&gt;</pair-value>
+    </main>
+    <main>
+        <pair-key>keystoneAuthRealm.sslVerification</pair-key>
+        <pair-value>true</pair-value>
+    </main>
+    <main>
+        <pair-key>keystoneAuthRealm.defaultDomain</pair-key>
+        <pair-value>Default</pair-value>
+    </main>
+    -->
+
+    <!--
+    Add tokenAuthRealm as the only realm.  To enable mdsalRealm, add it to the list to he right of tokenAuthRealm.
+    -->
     <main>
         <pair-key>securityManager.realms</pair-key>
         <pair-value>$tokenAuthRealm</pair-value>
@@ -43,6 +270,13 @@
         <pair-key>authcBearer</pair-key>
         <pair-value>org.opendaylight.aaa.shiro.filters.ODLHttpAuthenticationFilter2</pair-value>
     </main>
+   
+    <!-- Start moonAuthRealm commented out
+    <main>
+        <pair-key>rest</pair-key>
+        <pair-value>org.opendaylight.aaa.shiro.filters.MoonOAuthFilter</pair-value>
+    </main>
+    End moonAuthRealm commented out-->
 
     <!-- in order to track AAA challenge attempts -->
     <main>
@@ -59,8 +293,26 @@
         <pair-key>dynamicAuthorization</pair-key>
         <pair-value>org.opendaylight.aaa.shiro.realm.MDSALDynamicAuthorizationFilter</pair-value>
     </main>
+<!--     <main> -->
+<!--         <pair-key>securityManager.sessionManager.sessionIdCookieEnabled</pair-key> -->
+<!--         <pair-value>false</pair-value> -->
+<!--     </main> -->
 
-
+    <!--
+      ===================================================================================
+      =                                                                                 =
+      =                                                                                 =
+      =                                      URLS                                       =
+      =                                                                                 =
+      =                                                                                 =
+      ===================================================================================
+    -->
+    <!-- Start moonAuthRealm commented out
+    <urls>
+        <pair-key>/token</pair-key>
+        <pair-value>rest</pair-value>
+    </urls>
+    End moonAuthRealm commented out-->
     <urls>
         <pair-key>/**/operations/cluster-admin**</pair-key>
         <pair-value>dynamicAuthorization</pair-value>
diff --git a/sdnr/wt/oauth-provider/provider-jar/src/test/resources/test.config.json b/sdnr/wt/oauth-provider/provider-jar/src/test/resources/test.config.json
index 157ddb71a..260b77da7 100644
--- a/sdnr/wt/oauth-provider/provider-jar/src/test/resources/test.config.json
+++ b/sdnr/wt/oauth-provider/provider-jar/src/test/resources/test.config.json
@@ -12,7 +12,8 @@
             "clientId": "odlux.app",
             "secret": "5da4ea3d-8cc9-4669-bd7e-3ecb91d120cd",
             "scope": "openid",
-            "title": "OSNL Keycloak Provider"
+            "title": "OSNL Keycloak Provider",
+            "realmName":"onap"
         }
     ]
 }
\ No newline at end of file
-- 
cgit 1.2.3-korg