1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
/*-
* ============LICENSE_START=======================================================
* org.onap.dmaap
* ================================================================================
* Copyright (C) 2019 Nokia Intellectual Property. All rights reserved.
* ================================================================================
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
* ============LICENSE_END=========================================================
*/
package org.onap.dmaap.dbcapi.service;
import org.onap.dmaap.dbcapi.aaf.AafService;
import org.onap.dmaap.dbcapi.aaf.AafServiceImpl;
import org.onap.dmaap.dbcapi.aaf.AafUserRole;
import org.onap.dmaap.dbcapi.aaf.DmaapGrant;
import org.onap.dmaap.dbcapi.aaf.DmaapPerm;
import org.onap.dmaap.dbcapi.logging.BaseLoggingClass;
import org.onap.dmaap.dbcapi.model.ApiError;
import org.onap.dmaap.dbcapi.model.DmaapObject.DmaapObject_Status;
import org.onap.dmaap.dbcapi.model.MR_Client;
import static java.lang.String.format;
public class AafPermissionService extends BaseLoggingClass {
private static final String INSTANCE_PREFIX = ":topic.";
private final AafService aafService;
private final DmaapService dmaapService;
public AafPermissionService() {
this(new AafServiceImpl(AafService.ServiceType.AAF_TopicMgr), new DmaapService());
}
AafPermissionService(AafService aafService, DmaapService dmaapService) {
this.aafService = aafService;
this.dmaapService = dmaapService;
}
ApiError assignClientToRole(MR_Client client, String role) {
AafUserRole ur = new AafUserRole(client.getClientIdentity(), role);
int rc = aafService.addUserRole(ur);
if (rc != 201 && rc != 409) {
return handleErrorStatus(rc, client,
format("Failed to add user %s to role %s", client.getClientIdentity(), role));
}
return handleOkStatus(client);
}
ApiError grantClientRolePerms(MR_Client client) {
return forEachClientAction(client, this::grantPermForClientRole);
}
ApiError revokeClientPerms(MR_Client client) {
return forEachClientAction(client, this::revokePermForClientRole);
}
private ApiError forEachClientAction(MR_Client client, PermissionUpdate permissionUpdate) {
try {
String instance = INSTANCE_PREFIX + client.getFqtn();
for (String action : client.getAction()) {
permissionUpdate.execute(client.getClientRole(), instance, action);
}
} catch (PermissionServiceException e) {
return handleErrorStatus(e.getCode(), client, e.getMessage());
}
return handleOkStatus(client);
}
private void grantPermForClientRole(String clientRole, String instance, String action) throws PermissionServiceException {
if (clientRole != null) {
DmaapPerm perm = new DmaapPerm(dmaapService.getTopicPerm(), instance, action);
DmaapGrant g = new DmaapGrant(perm, clientRole);
int code = aafService.addGrant(g);
if (code != 201 && code != 409) {
throw new PermissionServiceException(code, format("Grant of %s|%s|%s failed for %s",
dmaapService.getTopicPerm(), instance, action, clientRole));
}
} else {
logger.warn("No Grant of {}|{}|{} because role is null ", dmaapService.getTopicPerm(), instance, action);
}
}
private void revokePermForClientRole(String clientRole, String instance, String action) throws PermissionServiceException {
DmaapPerm perm = new DmaapPerm(dmaapService.getTopicPerm(), instance, action);
DmaapGrant g = new DmaapGrant(perm, clientRole);
int code = aafService.delGrant(g);
if (code != 200 && code != 404) {
throw new PermissionServiceException(code, format("Revoke of %s|%s|%s failed for %s",
dmaapService.getTopicPerm(), instance, action, clientRole));
}
}
private ApiError handleErrorStatus(int code, MR_Client client, String message) {
ApiError apiError = new ApiError(code, message);
client.setStatus(DmaapObject_Status.INVALID);
logger.warn(apiError.getMessage());
return apiError;
}
private ApiError handleOkStatus(MR_Client client) {
client.setStatus(DmaapObject_Status.VALID);
return new ApiError(200, "OK");
}
private class PermissionServiceException extends Exception {
private final int code;
private final String message;
PermissionServiceException(int code, String message) {
this.code = code;
this.message = message;
}
public int getCode() {
return code;
}
@Override
public String getMessage() {
return message;
}
}
@FunctionalInterface
interface PermissionUpdate {
void execute(String clientRole, String instance, String action) throws PermissionServiceException;
}
}
|
