diff options
Diffstat (limited to 'datarouter-prov/src/main')
26 files changed, 215 insertions, 745 deletions
diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/authz/impl/AuthRespSupplementImpl.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/authz/impl/AuthRespSupplementImpl.java deleted file mode 100644 index b61c00e5..00000000 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/authz/impl/AuthRespSupplementImpl.java +++ /dev/null @@ -1,71 +0,0 @@ -/*******************************************************************************
- * ============LICENSE_START==================================================
- * * org.onap.dmaap
- * * ===========================================================================
- * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
- * * ===========================================================================
- * * Licensed under the Apache License, Version 2.0 (the "License");
- * * you may not use this file except in compliance with the License.
- * * You may obtain a copy of the License at
- * *
- * * http://www.apache.org/licenses/LICENSE-2.0
- * *
- * * Unless required by applicable law or agreed to in writing, software
- * * distributed under the License is distributed on an "AS IS" BASIS,
- * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * * See the License for the specific language governing permissions and
- * * limitations under the License.
- * * ============LICENSE_END====================================================
- * *
- * * ECOMP is a trademark and service mark of AT&T Intellectual Property.
- * *
- ******************************************************************************/
-
-
-package org.onap.dmaap.datarouter.authz.impl;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import org.onap.dmaap.datarouter.authz.AuthorizationResponseSupplement;
-
-/** Carries supplementary information--an advice or an obligation--from the authorization response returned
- * by a XACML Policy Decision Point. Not used in Data Router R1.
- * @author J. F. Lucas
- *
- */
-public class AuthRespSupplementImpl implements AuthorizationResponseSupplement {
-
- private String id;
- private Map<String, String> attributes;
-
- /** Constructor, available within the package.
- *
- * @param id The identifier for the advice or obligation element
- * @param attributes The attributes (name-value pairs) for the advice or obligation element.
- */
- AuthRespSupplementImpl(String id, Map<String, String> attributes) {
- this.id = id;
- this.attributes = new HashMap<>(attributes);
- }
-
- /** Return the identifier for the supplementary information element.
- *
- * @return a <code>String</code> containing the identifier.
- */
- @Override
- public String getId() {
- return id;
- }
-
- /** Return the attributes for the supplementary information element, as a <code>Map</code> in which
- * keys represent attribute identifiers and values represent attribute values.
- *
- * @return attributes for the supplementary information element.
- */
- @Override
- public Map<String, String> getAttributes() {
- return attributes;
- }
-
-}
diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/authz/impl/ProvAuthorizer.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/authz/impl/ProvAuthorizer.java index 48e31bfe..97cdc120 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/authz/impl/ProvAuthorizer.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/authz/impl/ProvAuthorizer.java @@ -106,7 +106,6 @@ public class ProvAuthorizer implements Authorizer { decision = allowSubAccess(resource, method, subject, subjectgroup); break; default: - decision = false; break; } } diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/BaseServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/BaseServlet.java index 1942b148..c37c0a7d 100755 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/BaseServlet.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/BaseServlet.java @@ -85,23 +85,6 @@ public class BaseServlet extends HttpServlet implements ProvDataProvider { public static final String BEHALF_HEADER = "X-DMAAP-DR-ON-BEHALF-OF"; - public static final String EXCLUDE_AAF_HEADER = "X-EXCLUDE-AAF"; - - private static final String AAF_CADI_FEED_TYPE = "org.onap.dmaap.datarouter.provserver.aaf.feed.type"; - private static final String AAF_CADI_SUB_TYPE = "org.onap.dmaap.datarouter.provserver.aaf.sub.type"; - private static final String AAF_INSTANCE = "org.onap.dmaap.datarouter.provserver.aaf.instance"; - private static final String AAF_CADI_FEED = "org.onap.dmaap-dr.feed"; - private static final String AAF_CADI_SUB = "org.onap.dmaap-dr.sub"; - - static final String CREATE_PERMISSION = "create"; - static final String EDIT_PERMISSION = "edit"; - static final String DELETE_PERMISSION = "delete"; - private static final String PUBLISH_PERMISSION = "publish"; - private static final String SUSPEND_PERMISSION = "suspend"; - private static final String RESTORE_PERMISSION = "restore"; - private static final String SUBSCRIBE_PERMISSION = "subscribe"; - static final String APPROVE_SUB_PERMISSION = "approveSub"; - static final String FEED_BASECONTENT_TYPE = "application/vnd.dmaap-dr.feed"; public static final String FEED_CONTENT_TYPE = "application/vnd.dmaap-dr.feed; version=2.0"; public static final String FEEDFULL_CONTENT_TYPE = "application/vnd.dmaap-dr.feed-full; version=2.0"; @@ -261,9 +244,6 @@ public class BaseServlet extends HttpServlet implements ProvDataProvider { private static String isAddressAuthEnabled = ProvRunner.getProvProperties() .getProperty("org.onap.dmaap.datarouter.provserver.isaddressauthenabled", "false"); - static String isCadiEnabled = ProvRunner.getProvProperties() - .getProperty("org.onap.dmaap.datarouter.provserver.cadi.enabled", "false"); - /** * Initialize data common to all the provisioning server servlets. */ @@ -959,96 +939,4 @@ public class BaseServlet extends HttpServlet implements ProvDataProvider { } } - - /* - * AAF changes: TDP EPIC US# 307413 - * @Method - getFeedPermission - Forming permission string for feed part to check AAF access in CADI Framework - * @Params - aafInstance Passing aafInstance as it's used in permission string - * @Params - userAction Passing CONST values to set different actions in permission string - */ - String getFeedPermission(String aafInstance, String userAction) { - try { - Properties props = ProvRunner.getProvProperties(); - String type = props.getProperty(AAF_CADI_FEED_TYPE, AAF_CADI_FEED); - String action; - switch (userAction) { - case CREATE_PERMISSION: - action = CREATE_PERMISSION; - break; - case EDIT_PERMISSION: - action = EDIT_PERMISSION; - break; - case DELETE_PERMISSION: - action = DELETE_PERMISSION; - break; - case PUBLISH_PERMISSION: - action = PUBLISH_PERMISSION; - break; - case SUSPEND_PERMISSION: - action = SUSPEND_PERMISSION; - break; - case RESTORE_PERMISSION: - action = RESTORE_PERMISSION; - break; - default: - action = "*"; - } - if (aafInstance == null || "".equals(aafInstance)) { - aafInstance = props.getProperty(AAF_INSTANCE, "org.onap.dmaap-dr.NoInstanceDefined"); - } - return type + "|" + aafInstance + "|" + action; - } catch (Exception e) { - intlogger.error("PROV7005 BaseServlet.getFeedPermission: " + e.getMessage(), e); - } - return null; - } - - /* - * AAF changes: TDP EPIC US# 307413 - * @Method - getSubscriberPermission - Forming permission string for subscription part to check - * AAF access in CADI Framework - * @Params - aafInstance Passing aafInstance as it's used in permission string - * @Params - userAction Passing CONST values to set different actions in permission string - */ - String getSubscriberPermission(String aafInstance, String userAction) { - try { - Properties props = ProvRunner.getProvProperties(); - String type = props.getProperty(AAF_CADI_SUB_TYPE, AAF_CADI_SUB); - String action; - switch (userAction) { - case SUBSCRIBE_PERMISSION: - action = SUBSCRIBE_PERMISSION; - type = props.getProperty(AAF_CADI_FEED_TYPE, AAF_CADI_FEED); - break; - case EDIT_PERMISSION: - action = EDIT_PERMISSION; - break; - case DELETE_PERMISSION: - action = DELETE_PERMISSION; - break; - case RESTORE_PERMISSION: - action = RESTORE_PERMISSION; - break; - case SUSPEND_PERMISSION: - action = SUSPEND_PERMISSION; - break; - case PUBLISH_PERMISSION: - action = PUBLISH_PERMISSION; - break; - case APPROVE_SUB_PERMISSION: - action = APPROVE_SUB_PERMISSION; - type = props.getProperty(AAF_CADI_FEED_TYPE, AAF_CADI_FEED); - break; - default: - action = "*"; - } - if (aafInstance == null || "".equals(aafInstance)) { - aafInstance = props.getProperty(AAF_INSTANCE, "org.onap.dmaap-dr.NoInstanceDefined"); - } - return type + "|" + aafInstance + "|" + action; - } catch (Exception e) { - intlogger.error("PROV7005 BaseServlet.getSubscriberPermission: " + e.getMessage(), e); - } - return null; - } } diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/DRFeedsServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/DRFeedsServlet.java index a0df71ce..7266ee69 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/DRFeedsServlet.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/DRFeedsServlet.java @@ -28,11 +28,11 @@ import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.send import com.att.eelf.configuration.EELFLogger; import com.att.eelf.configuration.EELFManager; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; import java.io.IOException; import java.io.InvalidObjectException; import java.util.List; -import jakarta.servlet.http.HttpServletRequest; -import jakarta.servlet.http.HttpServletResponse; import org.json.JSONObject; import org.onap.dmaap.datarouter.authz.AuthorizationResponse; import org.onap.dmaap.datarouter.provisioning.beans.EventLogRecord; @@ -289,61 +289,6 @@ public class DRFeedsServlet extends ProxyServlet { return; } - /* - * START - AAF changes - * TDP EPIC US# 307413 - * CADI code - No legacy user check as all new users will be AAF users - */ - String aafInstance = feed.getAafInstance(); - if (Boolean.parseBoolean(isCadiEnabled)) { - if ((aafInstance == null || "".equals(aafInstance) || ("legacy".equalsIgnoreCase(aafInstance)) - && "true".equalsIgnoreCase(req.getHeader(EXCLUDE_AAF_HEADER)))) { - // Check with the Authorizer - AuthorizationResponse aresp = authz.decide(req); - if (!aresp.isAuthorized()) { - message = POLICY_ENGINE; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } else { - if ("true".equalsIgnoreCase(req.getHeader(EXCLUDE_AAF_HEADER))) { - message = "DRFeedsServlet.doPost() -Invalid request exclude_AAF should not be true if passing " - + "AAF_Instance value= " + aafInstance; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - String permission = getFeedPermission(aafInstance, BaseServlet.CREATE_PERMISSION); - eventlogger.info("DRFeedsServlet.doPost().. Permission String - " + permission); - if (!req.isUserInRole(permission)) { - message = "AAF disallows access to permission - " + permission; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } - } else { - AuthorizationResponse aresp = authz.decide(req); - if (!aresp.isAuthorized()) { - message = POLICY_ENGINE; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } - /* - * END - AAF changes - */ - feed.setPublisher(bhdr); // set from X-DMAAP-DR-ON-BEHALF-OF header // Check if this feed already exists diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/FeedServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/FeedServlet.java index 5182cc23..475054d1 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/FeedServlet.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/FeedServlet.java @@ -28,7 +28,6 @@ import static org.onap.dmaap.datarouter.provisioning.utils.HttpServletUtils.send import com.att.eelf.configuration.EELFLogger; import com.att.eelf.configuration.EELFManager; -import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import java.io.IOException; @@ -108,37 +107,6 @@ public class FeedServlet extends ProxyServlet { sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger); return; } - /* - * START - AAF changes - * TDP EPIC US# 307413 - * CADI code - check on permissions based on Legacy/AAF users to allow to delete/remove feed - */ - String aafInstance = feed.getAafInstance(); - if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) { - AuthorizationResponse aresp = authz.decide(req); - if (! aresp.isAuthorized()) { - message = POLICY_ENGINE; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } else { - String permission = getFeedPermission(aafInstance, BaseServlet.DELETE_PERMISSION); - eventlogger.info("FeedServlet.doDelete().. Permission String - " + permission); - if (!req.isUserInRole(permission)) { - message = "AAF disallows access to permission - " + permission; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } - /* - * END - AAF changes - */ // Delete FEED table entry (set DELETED flag) feed.setDeleted(true); if (doUpdate(feed)) { @@ -352,39 +320,6 @@ public class FeedServlet extends ProxyServlet { return; } - /* - * START - AAF changes - * TDP EPIC US# 307413 - * CADI code - check on permissions based on Legacy/AAF users to allow feed edit/update/modify - */ - String aafInstance = feed.getAafInstance(); - if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) { - // Check with the Authorizer - AuthorizationResponse aresp = authz.decide(req); - if (!aresp.isAuthorized()) { - message = POLICY_ENGINE; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } else { - String permission = getFeedPermission(aafInstance, BaseServlet.EDIT_PERMISSION); - eventlogger.info("FeedServlet.doPut().. Permission String - " + permission); - if (!req.isUserInRole(permission)) { - message = "AAF disallows access to permission - " + permission; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } - /* - * END - AAF changes - */ - // Update FEEDS table entries if (doUpdate(feed)) { // send response diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/InternalServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/InternalServlet.java index 06959eef..0fb879e9 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/InternalServlet.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/InternalServlet.java @@ -162,7 +162,7 @@ public class InternalServlet extends ProxyServlet { private static final Object lock = new Object(); private static Integer logseq = 0; // another piece of info to make log spool file names unique //Adding EELF Logger Rally:US664892 - private static EELFLogger eelfLogger = EELFManager.getInstance() + private static final EELFLogger eelfLogger = EELFManager.getInstance() .getLogger(InternalServlet.class); /** diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvRunner.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvRunner.java index 747530ab..4777be8c 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvRunner.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvRunner.java @@ -29,16 +29,15 @@ import static java.lang.System.getProperty; import com.att.eelf.configuration.EELFLogger; import com.att.eelf.configuration.EELFManager; -import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.util.Properties; import java.util.Timer; import org.eclipse.jetty.server.Server; -import org.onap.dmaap.datarouter.provisioning.utils.AafPropsUtils; import org.onap.dmaap.datarouter.provisioning.utils.LogfileLoader; import org.onap.dmaap.datarouter.provisioning.utils.Poker; import org.onap.dmaap.datarouter.provisioning.utils.ProvDbUtils; +import org.onap.dmaap.datarouter.provisioning.utils.ProvTlsManager; import org.onap.dmaap.datarouter.provisioning.utils.PurgeLogDirTask; import org.onap.dmaap.datarouter.provisioning.utils.SynchronizerTask; @@ -76,7 +75,7 @@ public class ProvRunner { public static final EELFLogger intlogger = EELFManager.getInstance().getLogger("org.onap.dmaap.datarouter.provisioning.internal"); private static Server provServer; - private static AafPropsUtils aafPropsUtils; + private static ProvTlsManager provTlsManager; private static Properties provProperties; private static Boolean tlsEnabled; @@ -92,13 +91,11 @@ public class ProvRunner { exit(1); } if (Boolean.TRUE.equals(getTlsEnabled())) { - // Set up AAF properties + // Set up TLS Manager try { - aafPropsUtils = new AafPropsUtils(new File(getProvProperties().getProperty( - "org.onap.dmaap.datarouter.provserver.aafprops.path", - "/opt/app/osaaf/local/org.onap.dmaap-dr.props"))); - } catch (IOException e) { - intlogger.error("NODE0314 Failed to load AAF props. Exiting", e); + provTlsManager = new ProvTlsManager(ProvRunner.getProvProperties(), true); + } catch (Exception e) { + intlogger.error("NODE0314 Failed to load TLS config. Exiting", e); exit(1); } } @@ -153,10 +150,6 @@ public class ProvRunner { return provProperties; } - public static AafPropsUtils getAafPropsUtils() { - return aafPropsUtils; - } - public static Boolean getTlsEnabled() { if (tlsEnabled == null) { tlsEnabled = Boolean.parseBoolean(getProvProperties() @@ -164,4 +157,8 @@ public class ProvRunner { } return tlsEnabled; } + + public static ProvTlsManager getProvTlsManager() { + return provTlsManager; + } } diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvServer.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvServer.java index 9eb91178..102d4a24 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvServer.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProvServer.java @@ -42,7 +42,6 @@ import org.eclipse.jetty.servlet.ServletHolder; import org.eclipse.jetty.util.ssl.SslContextFactory; import org.eclipse.jetty.util.thread.QueuedThreadPool; import org.jetbrains.annotations.NotNull; -import org.onap.dmaap.datarouter.provisioning.utils.AafPropsUtils; public class ProvServer { @@ -106,14 +105,16 @@ public class ProvServer { httpsConfiguration.setRequestHeaderSize(8192); // HTTPS connector try (ServerConnector httpsServerConnector = new ServerConnector(server, - new SslConnectionFactory(getSslContextFactory(provProps), HttpVersion.HTTP_1_1.asString()), + new SslConnectionFactory(getSslContextFactory(), HttpVersion.HTTP_1_1.asString()), new HttpConnectionFactory(httpsConfiguration))) { httpsServerConnector.setPort(httpsPort); httpsServerConnector.setIdleTimeout(30000); httpsServerConnector.setAcceptQueueSize(2); + intlogger.info("ProvServer: TLS enabled. Setting up both HTTP/S connectors."); server.setConnectors(new Connector[]{httpServerConnector, httpsServerConnector}); } } else { + intlogger.info("ProvServer: TLS disabled. Setting up HTTP connector only."); server.setConnectors(new Connector[]{httpServerConnector}); } server.setHandler(handlerCollection); @@ -132,18 +133,9 @@ public class ProvServer { } @NotNull - private static SslContextFactory.Server getSslContextFactory(Properties provProps) { - SslContextFactory sslContextFactory = new SslContextFactory.Server(); - sslContextFactory.setKeyStoreType(AafPropsUtils.KEYSTORE_TYPE_PROPERTY); - sslContextFactory.setKeyStorePath(ProvRunner.getAafPropsUtils().getKeystorePathProperty()); - sslContextFactory.setKeyStorePassword(ProvRunner.getAafPropsUtils().getKeystorePassProperty()); - sslContextFactory.setKeyManagerPassword(ProvRunner.getAafPropsUtils().getKeystorePassProperty()); - - sslContextFactory.setTrustStoreType(AafPropsUtils.TRUESTSTORE_TYPE_PROPERTY); - sslContextFactory.setTrustStorePath(ProvRunner.getAafPropsUtils().getTruststorePathProperty()); - sslContextFactory.setTrustStorePassword(ProvRunner.getAafPropsUtils().getTruststorePassProperty()); - - sslContextFactory.setExcludeCipherSuites( + private static SslContextFactory.Server getSslContextFactory() { + SslContextFactory.Server sslContextFactoryServer = ProvRunner.getProvTlsManager().getSslContextFactoryServer(); + sslContextFactoryServer.setExcludeCipherSuites( "SSL_RSA_WITH_DES_CBC_SHA", "SSL_DHE_RSA_WITH_DES_CBC_SHA", "SSL_DHE_DSS_WITH_DES_CBC_SHA", @@ -152,17 +144,12 @@ public class ProvServer { "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA", "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA" ); - sslContextFactory.addExcludeProtocols("SSLv3"); - sslContextFactory.setIncludeProtocols(provProps.getProperty( - "org.onap.dmaap.datarouter.provserver.https.include.protocols", - "TLSv1.1|TLSv1.2").trim().split("\\|")); - - intlogger.info("Unsupported protocols: " + String.join(",", sslContextFactory.getExcludeProtocols())); - intlogger.info("Supported protocols: " + String.join(",", sslContextFactory.getIncludeProtocols())); - intlogger.info("Unsupported ciphers: " + String.join(",", sslContextFactory.getExcludeCipherSuites())); - intlogger.info("Supported ciphers: " + String.join(",", sslContextFactory.getIncludeCipherSuites())); - - return (SslContextFactory.Server) sslContextFactory; + sslContextFactoryServer.addExcludeProtocols("SSLv3"); + intlogger.info("Unsupported protocols: " + String.join(",", sslContextFactoryServer.getExcludeProtocols())); + intlogger.info("Supported protocols: " + String.join(",", sslContextFactoryServer.getIncludeProtocols())); + intlogger.info("Unsupported ciphers: " + String.join(",", sslContextFactoryServer.getExcludeCipherSuites())); + intlogger.info("Supported ciphers: " + String.join(",", sslContextFactoryServer.getIncludeCipherSuites())); + return sslContextFactoryServer; } @NotNull diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProxyServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProxyServlet.java index 49be5aa0..86b583a5 100755 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProxyServlet.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/ProxyServlet.java @@ -30,14 +30,9 @@ import jakarta.servlet.ServletConfig; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; -import java.io.File; -import java.io.FileInputStream; -import java.io.FileNotFoundException; import java.io.IOException; import java.io.InputStream; import java.net.URI; -import java.security.KeyStore; -import java.security.KeyStoreException; import java.util.Collections; import java.util.List; import org.apache.commons.io.IOUtils; @@ -53,7 +48,6 @@ import org.apache.http.conn.ssl.SSLSocketFactory; import org.apache.http.entity.BasicHttpEntity; import org.apache.http.impl.client.AbstractHttpClient; import org.apache.http.impl.client.DefaultHttpClient; -import org.onap.dmaap.datarouter.provisioning.utils.AafPropsUtils; import org.onap.dmaap.datarouter.provisioning.utils.SynchronizerTask; import org.onap.dmaap.datarouter.provisioning.utils.URLUtilities; @@ -81,20 +75,7 @@ public class ProxyServlet extends BaseServlet { super.init(config); try { if (Boolean.TRUE.equals(ProvRunner.getTlsEnabled())) { - // Set up keystore - String type = AafPropsUtils.KEYSTORE_TYPE_PROPERTY; - String store = ProvRunner.getAafPropsUtils().getKeystorePathProperty(); - String pass = ProvRunner.getAafPropsUtils().getKeystorePassProperty(); - KeyStore keyStore = readStore(store, pass, type); - // Set up truststore - store = ProvRunner.getAafPropsUtils().getTruststorePathProperty(); - pass = ProvRunner.getAafPropsUtils().getTruststorePassProperty(); - KeyStore trustStore = readStore(store, pass, AafPropsUtils.TRUESTSTORE_TYPE_PROPERTY); - - // We are connecting with the node name, but the certificate will have the CNAME - // So we need to accept a non-matching certificate name - SSLSocketFactory socketFactory = new SSLSocketFactory(keyStore, - ProvRunner.getAafPropsUtils().getKeystorePassProperty(), trustStore); + SSLSocketFactory socketFactory = ProvRunner.getProvTlsManager().getSslSocketFactory(); socketFactory.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); sch = new Scheme("https", 443, socketFactory); } else { @@ -108,18 +89,6 @@ public class ProxyServlet extends BaseServlet { intlogger.info("ProxyServlet: inited = " + inited); } - private KeyStore readStore(String store, String pass, String type) throws KeyStoreException { - KeyStore ks = KeyStore.getInstance(type); - try (FileInputStream instream = new FileInputStream(new File(store))) { - ks.load(instream, pass.toCharArray()); - } catch (FileNotFoundException fileNotFoundException) { - intlogger.error("ProxyServlet.readStore: " + fileNotFoundException.getMessage(), fileNotFoundException); - } catch (Exception x) { - intlogger.error("READING TRUSTSTORE: " + x); - } - return ks; - } - /** * Return <i>true</i> if the requester has NOT set the <i>noproxy</i> CGI variable. If they have, this indicates * they want to forcibly turn the proxy off. diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java index 2ee58d6e..6faecff5 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscribeServlet.java @@ -263,66 +263,6 @@ public class SubscribeServlet extends ProxyServlet { } sub.setFeedid(feedid); sub.setSubscriber(bhdr); // set from X-DMAAP-DR-ON-BEHALF-OF header - /* - * START - AAF changes - * TDP EPIC US# 307413 - * CADI code - check on permissions based on Legacy/AAF users to allow to create/add subscription - */ - String feedAafInstance = feed.getAafInstance(); - String subAafInstance = sub.getAafInstance(); - boolean subAafLegacyEmptyOrNull = (subAafInstance == null - || "".equals(subAafInstance) || "legacy".equalsIgnoreCase(subAafInstance)); - - // This extra check added to verify AAF feed with AAF subscriber having empty aaf instance check - if (feedAafInstance == null || "".equals(feedAafInstance) || "legacy".equalsIgnoreCase(feedAafInstance)) { - if (subAafLegacyEmptyOrNull) { - AuthorizationResponse aresp = authz.decide(req); - if (!aresp.isAuthorized()) { - message = POLICY_ENGINE; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } else { - //If Legacy Feed and AAF instance provided in Subscriber JSON - message = "AAF Subscriber can not be added to legacy Feed- " + feedid; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } else { - //New AAF Requirement to add legacy subscriber to AAF Feed - if (subAafLegacyEmptyOrNull) { - AuthorizationResponse aresp = authz.decide(req); - if (!aresp.isAuthorized()) { - message = POLICY_ENGINE; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } else { - //New AAF Requirement to add subscriber by publisher on publisher approval only - String permission = getSubscriberPermission(subAafInstance, BaseServlet.APPROVE_SUB_PERMISSION); - eventlogger.info("SubscribeServlet.doPost().. Permission String - " + permission); - if (!req.isUserInRole(permission)) { - message = "AAF disallows access to permission - " + permission; - elr.setMessage(message); - elr.setResult(HttpServletResponse.SC_FORBIDDEN); - eventlogger.error(elr.toString()); - sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger); - return; - } - } - } - /* - * END - AAF changes - */ // Check if this subscription already exists; not an error (yet), just warn Subscription sub2 = Subscription.getSubscriptionMatching(sub); if (sub2 != null) { diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscriptionServlet.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscriptionServlet.java index 1851d03a..f4f3c9b0 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscriptionServlet.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/SubscriptionServlet.java @@ -111,37 +111,6 @@ public class SubscriptionServlet extends ProxyServlet { sendResponseError(resp, HttpServletResponse.SC_NOT_FOUND, message, eventlogger);
return;
}
- /*
- * START - AAF changes
- * TDP EPIC US# 307413
- * CADI code - check on permissions based on Legacy/AAF users to allow to delete/remove subscription
- */
- String aafInstance = sub.getAafInstance();
- if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
- AuthorizationResponse aresp = authz.decide(req);
- if (!aresp.isAuthorized()) {
- message = POLICY_ENGINE;
- elr.setMessage(message);
- elr.setResult(HttpServletResponse.SC_FORBIDDEN);
- eventlogger.error(elr.toString());
- sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
- return;
- }
- } else {
- String permission = getSubscriberPermission(aafInstance, BaseServlet.DELETE_PERMISSION);
- eventlogger.info("SubscriptionServlet.doDelete().. Permission String - " + permission);
- if (!req.isUserInRole(permission)) {
- message = "AAF disallows access to permission - " + permission;
- elr.setMessage(message);
- elr.setResult(HttpServletResponse.SC_FORBIDDEN);
- eventlogger.error(elr.toString());
- sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
- return;
- }
- }
- /*
- * END - AAF changes
- */
// Delete Subscription
if (doDelete(sub)) {
activeSubs--;
@@ -321,38 +290,6 @@ public class SubscriptionServlet extends ProxyServlet { sendResponseError(resp, HttpServletResponse.SC_BAD_REQUEST, message, eventlogger);
return;
}
-
- /*
- * START - AAF changes
- * TDP EPIC US# 307413
- * CADI code - check on permissions based on Legacy/AAF users to allow to delete/remove subscription
- */
- String aafInstance = sub.getAafInstance();
- if (aafInstance == null || "".equals(aafInstance) || "legacy".equalsIgnoreCase(aafInstance)) {
- AuthorizationResponse aresp = authz.decide(req);
- if (!aresp.isAuthorized()) {
- message = POLICY_ENGINE;
- elr.setMessage(message);
- elr.setResult(HttpServletResponse.SC_FORBIDDEN);
- eventlogger.error(elr.toString());
- sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
- return;
- }
- } else {
- String permission = getSubscriberPermission(aafInstance, BaseServlet.EDIT_PERMISSION);
- eventlogger.info("SubscriptionServlet.doDelete().. Permission String - " + permission);
- if (!req.isUserInRole(permission)) {
- message = "AAF disallows access to permission - " + permission;
- elr.setMessage(message);
- elr.setResult(HttpServletResponse.SC_FORBIDDEN);
- eventlogger.error(elr.toString());
- sendResponseError(resp, HttpServletResponse.SC_FORBIDDEN, message, eventlogger);
- return;
- }
- }
- /*
- * END - AAF changes
- */
sub.setSubid(oldsub.getSubid());
sub.setFeedid(oldsub.getFeedid());
sub.setSubscriber(bhdr); // set from X-DMAAP-DR-ON-BEHALF-OF header
diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Feed.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Feed.java index c6344301..af6b3575 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Feed.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Feed.java @@ -77,7 +77,6 @@ public class Feed extends Syncable { private boolean suspended;
private Date lastMod;
private Date createdDate;
- private String aafInstance;
public Feed() {
this("", "", "", "");
@@ -104,7 +103,6 @@ public class Feed extends Syncable { this.suspended = false;
this.lastMod = new Date();
this.createdDate = new Date();
- this.aafInstance = "";
}
/**
@@ -133,7 +131,6 @@ public class Feed extends Syncable { this.suspended = rs.getBoolean("SUSPENDED");
this.lastMod = rs.getDate("LAST_MOD");
this.createdDate = rs.getTimestamp("CREATED_DATE");
- this.aafInstance = rs.getString("AAF_INSTANCE");
}
/**
@@ -148,10 +145,6 @@ public class Feed extends Syncable { this.feedid = jo.optInt(FEED_ID, -1);
this.groupid = jo.optInt("groupid");
this.name = jo.getString("name");
- this.aafInstance = jo.optString("aaf_instance", "legacy");
- if (!("legacy".equalsIgnoreCase(aafInstance)) && aafInstance.length() > 255) {
- throw new InvalidObjectException("aaf_instance field is too long");
- }
if (name.length() > 255) {
throw new InvalidObjectException("name field is too long");
}
@@ -440,10 +433,6 @@ public class Feed extends Syncable { fl.setLog(URLUtilities.generateFeedLogURL(feedid));
}
- public String getAafInstance() {
- return aafInstance;
- }
-
//new getter setters for groups- Rally:US708115 - 1610
public int getGroupid() {
return groupid;
@@ -553,7 +542,6 @@ public class Feed extends Syncable { jo.put("suspend", suspended);
jo.put(LAST_MOD, lastMod.getTime());
jo.put(CREATED_DATE, createdDate.getTime());
- jo.put("aaf_instance", aafInstance);
return jo;
}
@@ -634,8 +622,8 @@ public class Feed extends Syncable { try (PreparedStatement ps = conn.prepareStatement(
"insert into FEEDS (FEEDID, NAME, VERSION, DESCRIPTION, AUTH_CLASS, PUBLISHER, SELF_LINK, "
+ "PUBLISH_LINK, SUBSCRIBE_LINK, LOG_LINK, DELETED, SUSPENDED,"
- + "BUSINESS_DESCRIPTION, GROUPID, AAF_INSTANCE) "
- + "values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
+ + "BUSINESS_DESCRIPTION, GROUPID) "
+ + "values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
ps.setInt(1, feedid);
ps.setString(2, getName());
ps.setString(3, getVersion());
@@ -650,7 +638,6 @@ public class Feed extends Syncable { ps.setBoolean(12, isSuspended());
ps.setString(13, getBusinessDescription());
ps.setInt(14, groupid);
- ps.setString(15, getAafInstance());
ps.executeUpdate();
}
} catch (SQLException e) {
@@ -799,9 +786,6 @@ public class Feed extends Syncable { if (suspended != of.suspended) {
return false;
}
- if (!aafInstance.equals(of.aafInstance)) {
- return false;
- }
return true;
}
diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Subscription.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Subscription.java index 5741881c..6928addf 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Subscription.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/beans/Subscription.java @@ -72,7 +72,6 @@ public class Subscription extends Syncable { private Date lastMod;
private Date createdDate;
private boolean privilegedSubscriber;
- private String aafInstance;
private boolean decompress;
public Subscription() {
@@ -98,7 +97,6 @@ public class Subscription extends Syncable { this.lastMod = new Date();
this.createdDate = new Date();
this.privilegedSubscriber = false;
- this.aafInstance = "";
this.decompress = false;
}
@@ -121,7 +119,6 @@ public class Subscription extends Syncable { this.lastMod = rs.getDate("LAST_MOD");
this.createdDate = rs.getDate("CREATED_DATE");
this.privilegedSubscriber = rs.getBoolean("PRIVILEGED_SUBSCRIBER");
- this.aafInstance = rs.getString("AAF_INSTANCE");
this.decompress = rs.getBoolean("DECOMPRESS");
}
@@ -137,10 +134,6 @@ public class Subscription extends Syncable { this.subid = jo.optInt(SUBID_KEY, -1);
this.feedid = jo.optInt(FEEDID_KEY, -1);
this.groupid = jo.optInt(GROUPID_KEY, -1); //New field is added - Groups feature Rally:US708115 - 1610
- this.aafInstance = jo.optString("aaf_instance", "legacy");
- if (!(aafInstance.equalsIgnoreCase("legacy")) && aafInstance.length() > 255) {
- throw new InvalidObjectException("aaf_instance field is too long");
- }
JSONObject jdeli = jo.getJSONObject("delivery");
String url = jdeli.getString("url");
String user = jdeli.getString("user");
@@ -334,14 +327,6 @@ public class Subscription extends Syncable { sl.setFeed(URLUtilities.generateFeedURL(feedid));
}
- public String getAafInstance() {
- return aafInstance;
- }
-
- public void setAafInstance(String aafInstance) {
- this.aafInstance = aafInstance;
- }
-
//New getter setters for Groups feature Rally:US708115 - 1610
public int getGroupid() {
return groupid;
@@ -439,7 +424,6 @@ public class Subscription extends Syncable { jo.put(LAST_MOD_KEY, lastMod.getTime());
jo.put(CREATED_DATE, createdDate.getTime());
jo.put("privilegedSubscriber", privilegedSubscriber);
- jo.put("aaf_instance", aafInstance);
jo.put("decompress", decompress);
return jo;
}
@@ -490,8 +474,8 @@ public class Subscription extends Syncable { // Create the SUBSCRIPTIONS row
String sql = "insert into SUBSCRIPTIONS (SUBID, FEEDID, DELIVERY_URL, DELIVERY_USER, DELIVERY_PASSWORD, "
+ "DELIVERY_USE100, METADATA_ONLY, SUBSCRIBER, SUSPENDED, GROUPID, "
- + "PRIVILEGED_SUBSCRIBER, FOLLOW_REDIRECTS, DECOMPRESS, AAF_INSTANCE) "
- + "values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
+ + "PRIVILEGED_SUBSCRIBER, FOLLOW_REDIRECTS, DECOMPRESS) "
+ + "values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
ps = conn.prepareStatement(sql, new String[]{SUBID_COL});
ps.setInt(1, subid);
ps.setInt(2, feedid);
@@ -506,7 +490,6 @@ public class Subscription extends Syncable { ps.setBoolean(11, isPrivilegedSubscriber());
ps.setInt(12, isFollowRedirect() ? 1 : 0);
ps.setBoolean(13, isDecompress());
- ps.setString(14, getAafInstance());
ps.execute();
ps.close();
// Update the row to set the URLs
@@ -630,9 +613,6 @@ public class Subscription extends Syncable { if (suspended != os.suspended) {
return false;
}
- if (!aafInstance.equals(os.aafInstance)) {
- return false;
- }
return true;
}
diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/AafPropsUtils.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/AafPropsUtils.java deleted file mode 100644 index 57bc84bd..00000000 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/AafPropsUtils.java +++ /dev/null @@ -1,83 +0,0 @@ -/* - * ============LICENSE_START======================================================= - * Copyright (C) 2019 Nordix Foundation. - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * SPDX-License-Identifier: Apache-2.0 - * ============LICENSE_END========================================================= - */ - -package org.onap.dmaap.datarouter.provisioning.utils; - -import com.att.eelf.configuration.EELFLogger; -import com.att.eelf.configuration.EELFManager; -import java.io.File; -import java.io.FileInputStream; -import java.io.IOException; -import org.onap.aaf.cadi.PropAccess; - -public class AafPropsUtils { - - private static final EELFLogger eelfLogger = EELFManager.getInstance().getLogger(AafPropsUtils.class); - - public static final String KEYSTORE_TYPE_PROPERTY = "PKCS12"; - public static final String TRUESTSTORE_TYPE_PROPERTY = "jks"; - private static final String KEYSTORE_PATH_PROPERTY = "cadi_keystore"; - private static final String KEYSTORE_PASS_PROPERTY = "cadi_keystore_password_p12"; - private static final String TRUSTSTORE_PATH_PROPERTY = "cadi_truststore"; - private static final String TRUSTSTORE_PASS_PROPERTY = "cadi_truststore_password"; - - private final PropAccess propAccess; - - public AafPropsUtils(File propsFile) throws IOException { - propAccess = new PropAccess(); - try { - propAccess.load(new FileInputStream(propsFile)); - } catch (IOException e) { - eelfLogger.error("Failed to load props file: " + propsFile + "\n" + e.getMessage(), e); - throw e; - } - } - - private String decryptedPass(String password) { - String decryptedPass = null; - try { - decryptedPass = propAccess.decrypt(password, false); - } catch (IOException e) { - eelfLogger.error("Failed to decrypt " + password + " : " + e.getMessage(), e); - } - return decryptedPass; - } - - public PropAccess getPropAccess() { - return propAccess; - } - - public String getKeystorePathProperty() { - return propAccess.getProperty(KEYSTORE_PATH_PROPERTY); - } - - public String getKeystorePassProperty() { - return decryptedPass(propAccess.getProperty(KEYSTORE_PASS_PROPERTY)); - } - - public String getTruststorePathProperty() { - return propAccess.getProperty(TRUSTSTORE_PATH_PROPERTY); - } - - public String getTruststorePassProperty() { - return decryptedPass(propAccess.getProperty(TRUSTSTORE_PASS_PROPERTY)); - } - -} diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/DRRouteCLI.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/DRRouteCLI.java index c614c0ba..a0ece41a 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/DRRouteCLI.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/DRRouteCLI.java @@ -108,6 +108,7 @@ public class DRRouteCLI { private int width = 120; // screen width (for list) private AbstractHttpClient httpclient; + @SuppressWarnings("deprecation") /** * Create a DRRouteCLI object connecting to the specified server. * @@ -117,20 +118,18 @@ public class DRRouteCLI { public DRRouteCLI(String server) throws Exception { this.server = server; this.httpclient = new DefaultHttpClient(); - AafPropsUtils aafPropsUtils = null; + ProvTlsManager provTlsManager = null; Properties provProperties = ProvRunner.getProvProperties(); try { - aafPropsUtils = new AafPropsUtils(new File(provProperties.getProperty( - "org.onap.dmaap.datarouter.provserver.aafprops.path", - "/opt/app/osaaf/local/org.onap.dmaap-dr.props"))); - } catch (IOException e) { - intlogger.error("NODE0314 Failed to load AAF props. Exiting", e); + provTlsManager = new ProvTlsManager(provProperties, false); + } catch (Exception e) { + intlogger.error("NODE0314 Failed to load TLS config. Exiting", e); exit(1); } - String truststoreFile = aafPropsUtils.getTruststorePathProperty(); - String truststorePw = aafPropsUtils.getTruststorePassProperty(); + String truststoreFile = provTlsManager.getTrustStoreFile(); + String truststorePw = provTlsManager.getTrustStorePassword(); KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType()); if (truststoreFile == null || truststoreFile.equals("")) { diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/ProvTlsManager.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/ProvTlsManager.java new file mode 100644 index 00000000..4cf59066 --- /dev/null +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/ProvTlsManager.java @@ -0,0 +1,162 @@ +/* + * ============LICENSE_START======================================================= + * Copyright (C) 2022 Nordix Foundation. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + * ============LICENSE_END========================================================= + */ + +package org.onap.dmaap.datarouter.provisioning.utils; + +import com.att.eelf.configuration.EELFLogger; +import com.att.eelf.configuration.EELFManager; +import java.io.FileInputStream; +import java.io.IOException; +import java.security.KeyManagementException; +import java.security.KeyStore; +import java.security.KeyStoreException; +import java.security.NoSuchAlgorithmException; +import java.security.UnrecoverableKeyException; +import java.security.cert.CertificateException; +import java.util.Properties; +import org.apache.http.conn.ssl.SSLSocketFactory; +import org.eclipse.jetty.util.ssl.SslContextFactory; + +public class ProvTlsManager { + + private static final EELFLogger eelfLogger = EELFManager.getInstance().getLogger(ProvTlsManager.class); + + private final String keyStoreType; + private final String keyStorefile; + private final String keyStorePassword; + private final String keyManagerPassword; + private KeyStore keyStore; + + private final String trustStoreType; + private final String trustStoreFile; + private final String trustStorePassword; + private KeyStore trustStore; + + private final String[] enabledProtocols; + + /** + * Utility class to handle Provisioning server SSL configuration + * + * @param properties DR provisioning server properties + * @throws Exception for any unrecoverable problem + */ + public ProvTlsManager(Properties properties, boolean preLoadCerts) throws Exception { + + keyStoreType = properties.getProperty("org.onap.dmaap.datarouter.provserver.keystoretype", "PKCS12"); + keyStorefile = properties.getProperty("org.onap.dmaap.datarouter.provserver.keystorepath"); + keyStorePassword = properties.getProperty("org.onap.dmaap.datarouter.provserver.keystorepassword"); + keyManagerPassword = properties.getProperty("org.onap.dmaap.datarouter.provserver.keymanagerpassword"); + + trustStoreType = properties.getProperty("org.onap.dmaap.datarouter.provserver.truststoretype", "jks"); + trustStoreFile = properties.getProperty("org.onap.dmaap.datarouter.provserver.truststorepath"); + trustStorePassword = properties.getProperty("org.onap.dmaap.datarouter.provserver.truststorepassword"); + + if (preLoadCerts) { + eelfLogger.debug("ProvTlsManager: Attempting to pre load certificate data from config."); + setUpKeyStore(); + setUpTrustStore(); + } + + enabledProtocols = properties.getProperty( + "org.onap.dmaap.datarouter.provserver.https.include.protocols", + "TLSv1.1|TLSv1.2").trim().split("\\|"); + } + + /** + * Gets an SSLSocketFactory instance constructed using the relevant SSL properties + * + * @return SSLSocketFactory + * @throws KeyStoreException if SSL config is invalid + */ + public SSLSocketFactory getSslSocketFactory() + throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException, KeyManagementException { + eelfLogger.debug("ProvTlsManager.getSslSocketFactory: Setting up SSLSocketFactory"); + if (this.trustStoreFile == null) { + eelfLogger.warn("Warning: No trust store available."); + return new SSLSocketFactory(this.keyStore, this.keyStorePassword); + } + return new SSLSocketFactory(this.keyStore, this.keyStorePassword, this.trustStore); + } + + /** + * Gets an SslContextFactory.Server instance constructed using the relevant SSL properties + * + * @return SslContextFactory.Server + */ + public SslContextFactory.Server getSslContextFactoryServer() { + eelfLogger.debug("ProvTlsManager.getSslContextFactoryServer: Setting up getSslContextFactoryServer"); + SslContextFactory.Server sslContextFactoryServer = new SslContextFactory.Server(); + sslContextFactoryServer.setKeyStoreType(this.keyStoreType); + sslContextFactoryServer.setKeyStorePath(this.keyStorefile); + sslContextFactoryServer.setKeyStorePassword(this.keyStorePassword); + sslContextFactoryServer.setKeyManagerPassword(this.keyManagerPassword); + if (this.trustStoreFile != null) { + sslContextFactoryServer.setTrustStoreType(this.trustStoreType); + sslContextFactoryServer.setTrustStorePath(this.trustStoreFile); + sslContextFactoryServer.setTrustStorePassword(this.trustStorePassword); + } + sslContextFactoryServer.setIncludeProtocols(this.enabledProtocols); + return sslContextFactoryServer; + } + + /** + * Get the trust store file path from dr config + * + * @return String + */ + public String getTrustStoreFile() { + return trustStoreFile; + } + + /** + * Get the trust store password from dr config + * + * @return String + */ + public String getTrustStorePassword() { + return trustStorePassword; + } + + private void setUpKeyStore() + throws CertificateException, KeyStoreException, IOException, NoSuchAlgorithmException { + eelfLogger.debug("ProvTlsManager.setUpKeyStore: Attempting to load keyStore {}", keyStorefile); + keyStore = readKeyStore(keyStorefile, keyStorePassword, keyStoreType); + } + + private void setUpTrustStore() + throws CertificateException, KeyStoreException, IOException, NoSuchAlgorithmException { + if (trustStoreFile != null && trustStorePassword != null) { + eelfLogger.debug("ProvTlsManager.setUpTrustStore: Attempting to load trustStore {}", trustStoreFile); + trustStore = readKeyStore(trustStoreFile, trustStorePassword, trustStoreType); + } else { + eelfLogger.warn("No truststore provided from properties. Skipping."); + } + } + + private KeyStore readKeyStore(String keyStore, String pass, String type) + throws KeyStoreException, CertificateException, IOException, NoSuchAlgorithmException { + eelfLogger.debug("ProvTlsManager.readKeyStore: Verifying load of keystore {}", keyStore); + KeyStore ks = KeyStore.getInstance(type); + try (FileInputStream stream = new FileInputStream(keyStore)) { + ks.load(stream, pass.toCharArray()); + } + return ks; + } +}
\ No newline at end of file diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/SynchronizerTask.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/SynchronizerTask.java index ef282618..86c178a3 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/SynchronizerTask.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/SynchronizerTask.java @@ -140,33 +140,7 @@ public class SynchronizerTask extends TimerTask { try (AbstractHttpClient hc = new DefaultHttpClient()) { Scheme sch; if (Boolean.TRUE.equals(ProvRunner.getTlsEnabled())) { - // Set up keystore - String type = AafPropsUtils.KEYSTORE_TYPE_PROPERTY; - String store = ProvRunner.getAafPropsUtils().getKeystorePathProperty(); - String pass = ProvRunner.getAafPropsUtils().getKeystorePassProperty(); - KeyStore keyStore = KeyStore.getInstance(type); - try (FileInputStream instream = new FileInputStream(store)) { - keyStore.load(instream, pass.toCharArray()); - - } - // Set up truststore - store = ProvRunner.getAafPropsUtils().getTruststorePathProperty(); - pass = ProvRunner.getAafPropsUtils().getTruststorePassProperty(); - KeyStore trustStore = null; - if (store != null && store.length() > 0) { - trustStore = KeyStore.getInstance(AafPropsUtils.TRUESTSTORE_TYPE_PROPERTY); - try (FileInputStream instream = new FileInputStream(store)) { - trustStore.load(instream, pass.toCharArray()); - - } - } - // We are connecting with the node name, but the certificate will have the CNAME - // So we need to accept a non-matching certificate name - String keystorepass = ProvRunner.getAafPropsUtils().getKeystorePassProperty(); - SSLSocketFactory socketFactory = - (trustStore == null) - ? new SSLSocketFactory(keyStore, keystorepass) - : new SSLSocketFactory(keyStore, keystorepass, trustStore); + SSLSocketFactory socketFactory = ProvRunner.getProvTlsManager().getSslSocketFactory(); socketFactory.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); sch = new Scheme("https", 443, socketFactory); } else { @@ -180,6 +154,7 @@ public class SynchronizerTask extends TimerTask { } catch (Exception e) { logger.warn("PROV5005: Problem starting the synchronizer: " + e); } + logger.info("PROV5000: SynchronizerTask started"); } private void setSynchTimer(String strInterval) { diff --git a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/URLUtilities.java b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/URLUtilities.java index 89403488..a5eb4590 100644 --- a/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/URLUtilities.java +++ b/datarouter-prov/src/main/java/org/onap/dmaap/datarouter/provisioning/utils/URLUtilities.java @@ -161,7 +161,8 @@ public class URLUtilities { private static String getAppropriateUrlPort() {
if (Boolean.TRUE.equals(ProvRunner.getTlsEnabled())) {
- return "";
+ return ":" + ProvRunner.getProvProperties()
+ .getProperty("org.onap.dmaap.datarouter.provserver.https.port", "8443");
}
return ":" + ProvRunner.getProvProperties()
.getProperty("org.onap.dmaap.datarouter.provserver.http.port", "8080");
diff --git a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.cred.props b/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.cred.props deleted file mode 100644 index bb86e9d0..00000000 --- a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.cred.props +++ /dev/null @@ -1,17 +0,0 @@ -############################################################ -# Properties Generated by AT&T Certificate Manager -# by root -# on 2022-03-22T12:34:23.012+0000 -# @copyright 2019, AT&T -############################################################ -Challenge=enc:v6yuDc_Lu1OgeFEthckOsa7R0XW6h0iZqUQXnw4CpstwzjmN0x9VOsf27um5fC5z -cadi_alias=dmaap-dr-prov@dmaap-dr.onap.org -cadi_key_password=enc:CBXkw5IMQ8IeOhERa_oK4XcS1BsKy3T9BiZgAOIBqI46Nvy0USwgXCyOkTgVlJn7 -cadi_keyfile=/opt/app/osaaf/local/org.onap.dmaap-dr.keyfile -cadi_keystore=/opt/app/osaaf/local/org.onap.dmaap-dr.p12 -cadi_keystore_password=enc:Qd78mq7KSyK4G-gmnA0YVrB4jpMLgMX_4jDmwkdkKpD-MmonHNXlDA0TzRd3oxWe -cadi_keystore_password_jks=enc:GuyybAMtPX21LbCx_AXGnO7nz3NlPenZESuLVgrw-_cK55re75K4YOLYVzQswUYU -cadi_keystore_password_p12=enc:Qd78mq7KSyK4G-gmnA0YVrB4jpMLgMX_4jDmwkdkKpD-MmonHNXlDA0TzRd3oxWe -cadi_truststore=/opt/app/osaaf/local/org.onap.dmaap-dr.trust.jks -cadi_truststore_password=enc:y10bIyzTHei-rxWnWgHUUFUD_9TfOBdxmIn6vEf0zsyZtWmeP8ZjFE1LoPn7Ri4g -cadi_x509_issuers=CN=intermediateCA_1, OU=OSAAF, O=ONAP, C=US:CN=intermediateCA_7, OU=OSAAF, O=ONAP, C=US:CN=intermediateCA_9, OU=OSAAF, O=ONAP, C=US diff --git a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.keyfile b/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.keyfile deleted file mode 100644 index 86092892..00000000 --- a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.keyfile +++ /dev/null @@ -1,27 +0,0 @@ -gf-I4kLSg98uxwCXpklt-W2Qfa0mFgvXDoQk_qsLs4uuLI9FmWkrdlgdqzEgISL1sf6SAhoXFXO4 -BSm8fSPPrjaFEQ-uZcho1bY63lG710ZLh7vf0Bc7WPieRXesloH07CRXXjUdTkXXU8qTP6Ufru16 -mbGODzcZ-Ygm2GLVbkLk7953CJYIvuYT0M3ggrDr51eOalpgwXA1uO2DCTmY_fyqFNpZbLEtcYAx -EEBkbaT0KhKwSfXfPINjpfCVMNBr3eK2m75RFJzTmA4Nq_WFgQQBUJkYu6EaWR8xwKEnX3brIFN- -uY8Xk-Wxh8hhqNQWSxaSa_w6BfbP5CwUpIk9Ex1v_gCa63NIy4WzoRxOHKuCQAS26vLJFxTTNOlP -d_DVC0gmvL-q8VnedNVSsRw1zuDOtOzKg3iUbTjopba3YryelxwL2xUJzkxv8RiOVvTCdZ34lPP0 -vQCaGJYg52OKOCMaIs4e6bqfCFMT4nlbad--mPeZGS3X5pJ0xSAMRa8L2_ksHbTOvcjOlCvmWNDK -puP22sdegP-mV6Ygm30Gyn7TnUodDA3bzIiA70zrkrlt8pBMhKmCbmWvGfjItoRnfGwtlsm1OU73 -Jst8pQ_mvCK486UoH4Lui1kNBTqAJIrzYT_m-MrL6w9lx7Lu-ZG0HqdDVO4zB06WTyCXT-I2r-XS -F9ddoQ3GOUMA4kIckEeEVYfZiVaoPeizNwynSLHZDA3Xztc-kz7HEqdUCypM5pM32qGN-z4Gzbh0 -K4GO7_cGyctMGNY5za3iANK3BBBx9d3G3XKuCH2EDF9aj_kFarMaJjTHwn9-OAeD2GXtdYQqarod -4Yw11CD8JjyF6PdYstTh9t5_iK3pZjFaLMBPlLFN_tDu_5zsVagJjM7nMjfn8iWH5o3rj7WAIqBC -NoxZhIRUVpEmDKkhsnq9i9gdjoiKjrNwEsswX2vGsXEAf1vTXH2YsgraTjEhlW0cIb4PBLd4YoSE -AW3MXhwu5rYFgGooHyB99OKZOX6-5Y44fA0TE0ypn8HZ5oVrERCHVHNXsiXg1pRjTHjoIYUFoSQQ -lT8eVUo5MUxQ0SVKUi03wA7EduWrwvuD_KyLeNnvECj6IDuK7qiqH86UV7AyQhwjSZPj4N3KIlvD -VJNLmt6s8b6SLZpO23P-ZceFEIIYG7E1IGmo2s5VkWTNTkvqD7blxoOsfBIxb-SjttnMtbKCcXPj -aKMC1oqr5xLsvtg9XDKKXt4kELElRBiKtrud8t7qqYMfC-q6lIddmG8x_196qsYiErKd9mLyDT2H -DG9wmz3dDds_bUnXA7_-LsriDI4t_fAqAKnvR8tLi9DjhU1g9yjlGuKn4yd3y8aK-UFFfBi1AKxA -WoxSt2Omw_sl9Jc6bzoZ2_NHPZz7IaDhSu1imAAcAms4SIr3g-MnBffVpxarrXYsoaxurMRMoqLx -r0DyV1Y9IZSwo-xsWk42CxrvEF31AmFWewI0ykA8bZ-zpWux3z7BfbKDqxglg3Lp5uIfVFHamds3 -ya-KMBCtaSgiJ9fB7Q183Lt0tMxrOLe3hln55I4SRgHT5blh1LEznIigIfhFEOo514JEdctkVrDS -bDSbCO-yZE_0BcznTsjoyImwObeVRbDDu0feM9uGs4fL7zwVCbzEurGU2js-0o0rcyDiv30tsL5S -LaxA-xz7x5HO4JAd7BeaeF4-v0-IeLKPH4HzYk0g1PKskZaZHMWBWSPaJWin68ahh9Eh44xSjsCW -TUcoddf4-5HZS_RWlrLvbnfbEBAm7Ikbno1zLJz7_H3tmLKv2axkGEu-YWIAffb7xMzG0T9m6S3B -Iz1jWxtJ41gTE5kGFmaezDeUGPrioaqOq0bCq6DStQMc_5kcKAIg6GffOX75ZvagC2E6E_B58AGU -iVDzz_yi4Xcssf2jN-MIiHes0HsMQILrLAu1PLZh9qOIGOnVgLdwr0o5CGsg0h7Bxxl6jFQubwAZ -rc2foRg7arAcRHYasoC34f9pH0hfBzHfTGg5S7bWU6mDaldpWS8Na0EoCoFoZATkdzG77w6c
\ No newline at end of file diff --git a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.location.props b/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.location.props deleted file mode 100644 index eef8aac6..00000000 --- a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.location.props +++ /dev/null @@ -1,8 +0,0 @@ -############################################################ -# Properties Generated by AT&T Certificate Manager -# by root -# on 2022-03-22T12:34:21.359+0000 -# @copyright 2019, AT&T -############################################################ -cadi_latitude=38.0 -cadi_longitude=-72.0 diff --git a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.p12 b/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.p12 Binary files differdeleted file mode 100644 index 69948c25..00000000 --- a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.p12 +++ /dev/null diff --git a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.props b/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.props deleted file mode 100644 index a392a489..00000000 --- a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.props +++ /dev/null @@ -1,24 +0,0 @@ -############################################################ -# Properties Generated by AT&T Certificate Manager -# by root -# on 2022-03-22T12:34:21.357+0000 -# @copyright 2019, AT&T -############################################################ -aaf_env=DEV -aaf_id=dmaap-dr-prov@dmaap-dr.onap.org -aaf_locate_url=https://aaf-locate.onap:8095 -aaf_locator_app_ns=org.osaaf.aaf -aaf_locator_container=oom -aaf_locator_container_ns=onap -aaf_locator_fqdn=dmaap-dr-prov -aaf_locator_public_fqdn=aaf.osaaf.org -aaf_oauth2_introspect_url=https://AAF_LOCATE_URL/%CNS.%AAF_NS.introspect:2.1/introspect -aaf_oauth2_token_url=https://AAF_LOCATE_URL/%CNS.%AAF_NS.token:2.1/token -aaf_url=https://AAF_LOCATE_URL/%CNS.%AAF_NS.service:2.1 -aaf_url_cm=https://AAF_LOCATE_URL/%CNS.%AAF_NS.cm:2.1 -aaf_url_fs=https://AAF_LOCATE_URL/%CNS.%AAF_NS.fs:2.1 -aaf_url_gui=https://AAF_LOCATE_URL/%CNS.%AAF_NS.gui:2.1 -aaf_url_hello=https://aaf-locate.onap:8095/locate/onap.org.osaaf.aaf.hello:2.1 -aaf_url_oauth=https://AAF_LOCATE_URL/%CNS.%AAF_NS.oauth:2.1 -cadi_prop_files=/opt/app/osaaf/local/org.onap.dmaap-dr.location.props:/opt/app/osaaf/local/org.onap.dmaap-dr.cred.props -cadi_protocols=TLSv1.1,TLSv1.2 diff --git a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.trust.jks b/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.trust.jks Binary files differdeleted file mode 100644 index 3666b965..00000000 --- a/datarouter-prov/src/main/resources/aaf/org.onap.dmaap-dr.trust.jks +++ /dev/null diff --git a/datarouter-prov/src/main/resources/misc/sql_init_01.sql b/datarouter-prov/src/main/resources/misc/sql_init_01.sql index a1980d29..17884f66 100755 --- a/datarouter-prov/src/main/resources/misc/sql_init_01.sql +++ b/datarouter-prov/src/main/resources/misc/sql_init_01.sql @@ -14,8 +14,7 @@ CREATE TABLE FEEDS ( DELETED BOOLEAN DEFAULT FALSE, LAST_MOD TIMESTAMP DEFAULT CURRENT_TIMESTAMP, SUSPENDED BOOLEAN DEFAULT FALSE, - CREATED_DATE TIMESTAMP DEFAULT CURRENT_TIMESTAMP, - AAF_INSTANCE VARCHAR(256) + CREATED_DATE TIMESTAMP DEFAULT CURRENT_TIMESTAMP ); CREATE TABLE FEED_ENDPOINT_IDS ( @@ -46,9 +45,7 @@ CREATE TABLE SUBSCRIPTIONS ( SUSPENDED BOOLEAN DEFAULT FALSE, PRIVILEGED_SUBSCRIBER BOOLEAN DEFAULT FALSE, CREATED_DATE TIMESTAMP DEFAULT CURRENT_TIMESTAMP, - DECOMPRESS BOOLEAN DEFAULT FALSE, - AAF_INSTANCE VARCHAR(256) - + DECOMPRESS BOOLEAN DEFAULT FALSE ); CREATE TABLE PARAMETERS ( @@ -145,6 +142,6 @@ INSERT INTO PARAMETERS VALUES ('PROV_MAXFEED_COUNT', '10000'), ('PROV_MAXSUB_COUNT', '100000'), ('PROV_REQUIRE_CERT', 'false'), - ('PROV_REQUIRE_SECURE', 'true'), + ('PROV_REQUIRE_SECURE', 'false'), ('_INT_VALUES', 'LOGROLL_INTERVAL|PROV_MAXFEED_COUNT|PROV_MAXSUB_COUNT|DELIVERY_INIT_RETRY_INTERVAL|DELIVERY_MAX_RETRY_INTERVAL|DELIVERY_RETRY_RATIO|DELIVERY_MAX_AGE|DELIVERY_FILE_PROCESS_INTERVAL') ;
\ No newline at end of file diff --git a/datarouter-prov/src/main/resources/provserver.properties b/datarouter-prov/src/main/resources/provserver.properties index 66d4e6c4..25824988 100755 --- a/datarouter-prov/src/main/resources/provserver.properties +++ b/datarouter-prov/src/main/resources/provserver.properties @@ -31,12 +31,17 @@ org.onap.dmaap.datarouter.provserver.spooldir = /opt/app/datartr/spoo org.onap.dmaap.datarouter.provserver.dbscripts = /opt/app/datartr/etc/misc org.onap.dmaap.datarouter.provserver.logretention = 30 -org.onap.dmaap.datarouter.provserver.aafprops.path = /opt/app/osaaf/local/org.onap.dmaap-dr.props org.onap.dmaap.datarouter.provserver.isaddressauthenabled = false - -org.onap.dmaap.datarouter.provserver.cadi.enabled = false - org.onap.dmaap.datarouter.provserver.tlsenabled = false +# If tlsenabled is true, the following keystore info must be set +org.onap.dmaap.datarouter.provserver.keystoretype = PKCS12 +org.onap.dmaap.datarouter.provserver.keystorepath = /opt/app/datartr/certs/org.onap.dmaap-dr-prov.p12 +org.onap.dmaap.datarouter.provserver.keystorepassword = secret +org.onap.dmaap.datarouter.provserver.keymanagerpassword = secret +org.onap.dmaap.datarouter.provserver.truststoretype = jks +org.onap.dmaap.datarouter.provserver.truststorepath = /opt/app/datartr/certs/truststore.jks +org.onap.dmaap.datarouter.provserver.truststorepassword = secret + org.onap.dmaap.datarouter.nodeserver.https.port = 8443 org.onap.dmaap.datarouter.nodeserver.http.port = 8080 |