Merge "Fix Sonar Crypto issues"

17 files changed, 105 insertions, 383 deletions

diff --git a/README.md b/README.md
index ba194ec33..583f4cc6f 100644
--- a/README.md
+++ b/README.md
@@ -67,7 +67,7 @@ This file is a JSON that must be specified to Spring config, here is an example:
         "consumerId": "consumerId1",
         "environmentName": "AUTO",
         "sdcAddress": "localhost:8443",
-        "password": "b7acccda32b98c5bb7acccda32b98c5b05D511BD6D93626E90D18E9D24D9B78CD34C7EE8012F0A189A28763E82271E50A5D4EC10C7D93E06E0A2D27CAE66B981",
+        "password": "QpF2TcrdRSFADqDxH1HwDYdYUIbMxOj-TrGd6Vqvwzd",
         "pollingInterval":30,
         "pollingTimeout":30,
         "activateServerTLSAuth":"false",
@@ -81,7 +81,7 @@ This file is a JSON that must be specified to Spring config, here is an example:
         "consumerId": "consumerId1",
         "environmentName": "AUTO",
         "sdcAddress": "localhost:8443",
-        "password": "b7acccda32b98c5bb7acccda32b98c5b05D511BD6D93626E90D18E9D24D9B78CD34C7EE8012F0A189A28763E82271E50A5D4EC10C7D93E06E0A2D27CAE66B981",
+        "password": "QpF2TcrdRSFADqDxH1HwDYdYUIbMxOj-TrGd6Vqvwzd",
         "pollingInterval":30,
         "pollingTimeout":30,
         "activateServerTLSAuth":"false",
@@ -101,7 +101,7 @@ If the sdcAddress is not specified or not available (connection failure) the mes
 
 A [docker-compose example file](extra/docker/clamp/docker-compose.yml) can be found under the [extra/docker/clamp/ folder](extra/docker/).
 
-Once the image has been built and is available locally, you can use the `docker-compose up` command to deploy a prepopullated database and a clamp instance available on [https://localhost:3000](https://localhost:3000).
+Once the image has been built and is available locally, you can use the `docker-compose up` command to deploy a pre-populated database, and a clamp instance available on [https://localhost:3000](https://localhost:3000).
 
 
 ### Logs
@@ -146,9 +146,9 @@ resource clds/aaf/org.onap.clamp.p12.
     cadi_latitude[0.000]=10.0
     cadi_longitude[0.000]=10.0
 - Certs should created, you can get them in /var/lib/docker/volumes/clamp_config/_data/local
-    If you want to recreate the certs, you have to delete the docker volume (otherwise it will be re used) : docker volume rm clamp_config
+    If you want to recreate the certs, you have to delete the docker volume (otherwise it will be re-used) : docker volume rm clamp_config
 - wget https://nexus.onap.org/content/repositories/releases/org/onap/aaf/authz/aaf-cadi-aaf/2.1.13/aaf-cadi-aaf-2.1.13-full.jar
-- to encrypt or decrypt the store passwords:  java -jar aaf-cadi-aaf-2.1.13-full.jar cadi digest changeit testos.key
+- to encrypt or decrypt the store passwords:  java -jar aaf-cadi-aaf-2.1.13-full.jar cadi <digest|undigest> changeit testos.key
 - you can also use the agent.sh script to decrypt the passwords, by running the showpass commands (see wiki below) 
 - Extract private key from P12: 'openssl pkcs12 -in org.onap.clamp.p12 -nocerts -nodes > clamp.key'
 - Extract public certificate from P12: 'openssl pkcs12 -in org.onap.clamp.p12 -clcerts -nokeys > clamp.pem'
diff --git a/pom.xml b/pom.xml
index d7a624164..36661b86c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -514,18 +514,6 @@
             <scope>test</scope>
         </dependency>
         <dependency>
-            <groupId>org.powermock</groupId>
-            <artifactId>powermock-api-mockito2</artifactId>
-            <version>2.0.4</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.powermock</groupId>
-            <artifactId>powermock-module-junit4</artifactId>
-            <version>2.0.4</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
             <groupId>com.github.docker-java</groupId>
             <artifactId>docker-java-core</artifactId>
             <version>3.2.7</version>
diff --git a/src/main/java/org/onap/policy/clamp/clds/Application.java b/src/main/java/org/onap/policy/clamp/clds/Application.java
index a242086da..ba300ac09 100644
--- a/src/main/java/org/onap/policy/clamp/clds/Application.java
+++ b/src/main/java/org/onap/policy/clamp/clds/Application.java
@@ -96,7 +96,7 @@ public class Application extends SpringBootServletInitializer {
     private String keyStoreType;
 
 
-    @Value("${clamp.config.keyFile:#{null}}")
+    @Value("${clamp.config.keyFile:classpath:/clds/aaf/org.onap.clamp.keyfile}")
     private String keyFile;
 
     @Autowired
diff --git a/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcControllersConfiguration.java b/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcControllersConfiguration.java
index 4748edf6d..d0b116f71 100644
--- a/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcControllersConfiguration.java
+++ b/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcControllersConfiguration.java
@@ -1,8 +1,8 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP CLAMP
+ * ONAP POLICY-CLAMP
  * ================================================================================
- * Copyright (C) 2018 AT&T Intellectual Property. All rights
+ * Copyright (C) 2018, 2021 AT&T Intellectual Property. All rights
  *                             reserved.
  * ================================================================================
  * Modifications Copyright (c) 2019 Samsung
@@ -20,13 +20,14 @@
  * limitations under the License.
  * ============LICENSE_END============================================
  * ===================================================================
- * 
+ *
  */
 
 package org.onap.policy.clamp.clds.config.sdc;
 
 import com.google.gson.JsonObject;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
@@ -49,10 +50,14 @@ public class SdcControllersConfiguration {
     private static final String CONTROLLER_SUBTREE_KEY = "sdc-connections";
     @Autowired
     protected ApplicationContext appContext;
+
+    @Value("${clamp.config.keyFile:classpath:/clds/aaf/org.onap.clamp.keyfile}")
+    private String keyFile;
+
     /**
      * The file name that will be loaded by Spring.
      */
-    @Value("${clamp.config.files.sdcController:'classpath:/clds/sdc-controllers-config.json'}")
+    @Value("${clamp.config.files.sdcController:classpath:/clds/sdc-controllers-config.json}")
     protected String sdcControllerFile;
     /**
      * The root of the JSON.
@@ -66,11 +71,10 @@ public class SdcControllersConfiguration {
      */
     @PostConstruct
     public void loadConfiguration() throws IOException {
-        Resource resource = appContext.getResource(sdcControllerFile);
-        // Try to load json tree
-        jsonRootNode = JsonUtils.GSON.fromJson(new InputStreamReader(
-                resource.getInputStream(), StandardCharsets.UTF_8),
-                                               JsonObject.class);
+        try (InputStreamReader controllerFile = new InputStreamReader(
+                appContext.getResource(sdcControllerFile).getInputStream(), StandardCharsets.UTF_8)) {
+            jsonRootNode = JsonUtils.GSON.fromJson(controllerFile, JsonObject.class);
+        }
     }
 
     public SdcSingleControllerConfiguration getSdcSingleControllerConfiguration(String controllerName) {
@@ -86,8 +90,9 @@ public class SdcControllersConfiguration {
         Map<String, SdcSingleControllerConfiguration> result = new HashMap<>();
         if (jsonRootNode.get(CONTROLLER_SUBTREE_KEY) != null) {
             jsonRootNode.get(CONTROLLER_SUBTREE_KEY).getAsJsonObject().entrySet().forEach(
-                entry -> result.put(entry.getKey(),
-                    new SdcSingleControllerConfiguration(entry.getValue().getAsJsonObject(), entry.getKey())));
+                    entry -> result.put(entry.getKey(),
+                            new SdcSingleControllerConfiguration(entry.getValue().getAsJsonObject(), entry.getKey(),
+                                    keyFile)));
         } else {
             throw new SdcParametersException(
                     CONTROLLER_SUBTREE_KEY + " key not found in the file: " + sdcControllerFile);
diff --git a/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfiguration.java b/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfiguration.java
index 0bbbf19dc..67060d776 100644
--- a/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfiguration.java
+++ b/src/main/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfiguration.java
@@ -1,8 +1,8 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP CLAMP
+ * ONAP POLICY-CLAMP
  * ================================================================================
- * Copyright (C) 2018 AT&T Intellectual Property. All rights
+ * Copyright (C) 2018, 2021 AT&T Intellectual Property. All rights
  *                             reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,22 +18,17 @@
  * limitations under the License.
  * ============LICENSE_END============================================
  * ===================================================================
- * 
+ *
  */
 
 package org.onap.policy.clamp.clds.config.sdc;
 
-import com.att.eelf.configuration.EELFLogger;
-import com.att.eelf.configuration.EELFManager;
 import com.google.gson.JsonObject;
-import java.security.GeneralSecurityException;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.List;
-import org.apache.commons.codec.DecoderException;
 import org.onap.policy.clamp.clds.exception.sdc.controller.SdcParametersException;
-import org.onap.policy.clamp.clds.util.CryptoUtils;
+import org.onap.policy.clamp.util.PassDecoder;
 import org.onap.sdc.api.consumer.IConfiguration;
 
 /**
@@ -41,8 +36,8 @@ import org.onap.sdc.api.consumer.IConfiguration;
  */
 public class SdcSingleControllerConfiguration implements IConfiguration {
 
-    private static final EELFLogger logger = EELFManager.getInstance()
-            .getLogger(SdcSingleControllerConfiguration.class);
+    private final String keyFile;
+
     /**
      * The sdc Controller name corresponding.
      */
@@ -78,23 +73,20 @@ public class SdcSingleControllerConfiguration implements IConfiguration {
     public static final String OTHER = "OTHER";
     public static final String TOSCA_CSAR = "TOSCA_CSAR";
     public static final String VF_MODULES_METADATA = "VF_MODULES_METADATA";
-    private static final String[] SUPPORTED_ARTIFACT_TYPES = {
-        TOSCA_CSAR, VF_MODULES_METADATA
-    };
-    public static final List<String> SUPPORTED_ARTIFACT_TYPES_LIST = Collections
-            .unmodifiableList(Arrays.asList(SUPPORTED_ARTIFACT_TYPES));
+    private static final String[] SUPPORTED_ARTIFACT_TYPES = {TOSCA_CSAR, VF_MODULES_METADATA};
+    public static final List<String> SUPPORTED_ARTIFACT_TYPES_LIST = List.of(SUPPORTED_ARTIFACT_TYPES);
 
     /**
      * This constructor builds a SdcSingleControllerConfiguration from the
      * corresponding json.
-     * 
-     * @param jsonNode
-     *            The JSON node
-     * @param controllerName
-     *            The controller name that must appear in the JSON
+     *
+     * @param jsonNode       The JSON node
+     * @param controllerName The controller name that must appear in the JSON
+     * @param keyFileLocation        The location of the file to decode the password using CADI
      */
-    public SdcSingleControllerConfiguration(JsonObject jsonNode, String controllerName) {
+    public SdcSingleControllerConfiguration(JsonObject jsonNode, String controllerName, String keyFileLocation) {
         jsonRootNode = jsonNode;
+        keyFile = keyFileLocation;
         setSdcControllerName(controllerName);
         testAllRequiredParameters();
     }
@@ -130,10 +122,10 @@ public class SdcSingleControllerConfiguration implements IConfiguration {
         }
     }
 
-    private String getEncryptedStringConfig(String key) throws GeneralSecurityException, DecoderException {
+    private String getEncryptedStringConfig(String key) {
         if (jsonRootNode != null && jsonRootNode.get(key) != null) {
             return jsonRootNode.get(key).getAsString().isEmpty() ? null
-                    : CryptoUtils.decrypt(jsonRootNode.get(key).getAsString());
+                    : PassDecoder.decode(jsonRootNode.get(key).getAsString(), keyFile);
         }
         return null;
     }
@@ -164,12 +156,7 @@ public class SdcSingleControllerConfiguration implements IConfiguration {
 
     @Override
     public String getPassword() {
-        try {
-            return getEncryptedStringConfig(SDC_KEY_ATTRIBUTE_NAME);
-        } catch (GeneralSecurityException | DecoderException e) {
-            logger.error("Unable to decrypt the SDC password", e);
-            return null;
-        }
+        return getEncryptedStringConfig(SDC_KEY_ATTRIBUTE_NAME);
     }
 
     @Override
@@ -211,12 +198,7 @@ public class SdcSingleControllerConfiguration implements IConfiguration {
 
     @Override
     public String getKeyStorePassword() {
-        try {
-            return getEncryptedStringConfig(KEY_STORE_KEY);
-        } catch (GeneralSecurityException | DecoderException e) {
-            logger.error("Unable to decrypt the SDC password", e);
-            return null;
-        }
+        return getEncryptedStringConfig(KEY_STORE_KEY);
     }
 
     @Override
diff --git a/src/main/java/org/onap/policy/clamp/clds/util/CryptoUtils.java b/src/main/java/org/onap/policy/clamp/clds/util/CryptoUtils.java
deleted file mode 100644
index 01dd48763..000000000
--- a/src/main/java/org/onap/policy/clamp/clds/util/CryptoUtils.java
+++ /dev/null
@@ -1,168 +0,0 @@
-/*-
- * ============LICENSE_START=======================================================
- * ONAP CLAMP
- * ================================================================================
- * Copyright (C) 2017-2018 AT&T Intellectual Property. All rights
- *                             reserved.
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============LICENSE_END============================================
- * ===================================================================
- * 
- */
-
-package org.onap.policy.clamp.clds.util;
-
-import com.att.eelf.configuration.EELFLogger;
-import com.att.eelf.configuration.EELFManager;
-import com.google.common.base.Charsets;
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.security.GeneralSecurityException;
-import java.security.SecureRandom;
-import java.util.Properties;
-import javax.crypto.Cipher;
-import javax.crypto.spec.IvParameterSpec;
-import javax.crypto.spec.SecretKeySpec;
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
-import org.apache.commons.lang3.ArrayUtils;
-
-/**
- * CryptoUtils for encrypting/decrypting string based on a Key defined in
- * application.properties (Spring config file).
- */
-public final class CryptoUtils {
-
-    /**
-     * Used to log CryptoUtils class.
-     */
-    private static final EELFLogger logger = EELFManager.getInstance().getLogger(CryptoUtils.class);
-    // Openssl commands:
-    // Encrypt: echo -n "123456" | openssl aes-128-cbc -e -K <Private Hex key>
-    // -iv <16 Bytes iv (HEX), be careful it's 32 Hex Chars> | xxd -u -g100
-    // Final result is to put in properties file is: IV + Outcome of openssl
-    // command
-    // ************************************************************
-    // Decrypt: echo -n 'Encrypted string' | xxd -r -ps | openssl aes-128-cbc -d
-    // -K
-    // <Private Hex Key> -iv <16 Bytes IV extracted from Encrypted String, be
-    // careful it's 32 Hex Chars>
-    /**
-     * Definition of encryption algorithm.
-     */
-    private static final String ALGORITHM = "AES";
-
-    /**
-     * AES Encryption Key environment variable for external configuration.
-     */
-    private static final String AES_ENCRYPTION_KEY = "AES_ENCRYPTION_KEY";
-
-    /**
-     * Detailed definition of encryption algorithm.
-     */
-    private static final String ALGORITHM_DETAILS = ALGORITHM + "/CBC/PKCS5PADDING";
-    private static final int IV_BLOCK_SIZE_IN_BITS = 128;
-    /**
-     * An Initial Vector of 16 Bytes, so 32 Hexadecimal Chars.
-     */
-    private static final int IV_BLOCK_SIZE_IN_BYTES = IV_BLOCK_SIZE_IN_BITS / 8;
-    /**
-     * Key to read in the key.properties file.
-     */
-    private static final String KEY_PARAM = "org.onap.policy.clamp.encryption.aes.key";
-    private static final String PROPERTIES_FILE_NAME = "clds/key.properties";
-    /**
-     * The SecretKeySpec created from the Base 64 String key.
-     */
-    private static final SecretKeySpec SECRET_KEY_SPEC = readSecretKeySpec(PROPERTIES_FILE_NAME);
-
-    /**
-     * Private constructor to avoid creating instances of util class.
-     */
-    private CryptoUtils() {
-    }
-
-    /**
-     * Encrypt a value based on the Clamp Encryption Key.
-     * 
-     * @param value The value to encrypt
-     * @return The encrypted string
-     * @throws GeneralSecurityException     In case of issue with the encryption
-     * @throws UnsupportedEncodingException In case of issue with the charset
-     *                                      conversion
-     */
-    public static String encrypt(String value) throws GeneralSecurityException {
-        Cipher cipher = Cipher.getInstance(ALGORITHM_DETAILS, "SunJCE");
-        byte[] iv = new byte[IV_BLOCK_SIZE_IN_BYTES];
-        SecureRandom.getInstance("SHA1PRNG").nextBytes(iv);
-        IvParameterSpec ivspec = new IvParameterSpec(iv);
-        cipher.init(Cipher.ENCRYPT_MODE, SECRET_KEY_SPEC, ivspec);
-        return Hex.encodeHexString(ArrayUtils.addAll(iv, cipher.doFinal(value.getBytes(Charsets.UTF_8))));
-    }
-
-    /**
-     * Decrypt a value based on the Clamp Encryption Key.
-     * 
-     * @param message The encrypted string that must be decrypted using the Clamp
-     *                Encryption Key
-     * @return The String decrypted
-     * @throws GeneralSecurityException In case of issue with the encryption
-     * @throws DecoderException         In case of issue to decode the HexString
-     */
-    public static String decrypt(String message) throws GeneralSecurityException, DecoderException {
-        byte[] encryptedMessage = Hex.decodeHex(message.toCharArray());
-        Cipher cipher = Cipher.getInstance(ALGORITHM_DETAILS, "SunJCE");
-        IvParameterSpec ivspec = new IvParameterSpec(ArrayUtils.subarray(encryptedMessage, 0, IV_BLOCK_SIZE_IN_BYTES));
-        byte[] realData = ArrayUtils.subarray(encryptedMessage, IV_BLOCK_SIZE_IN_BYTES, encryptedMessage.length);
-        cipher.init(Cipher.DECRYPT_MODE, SECRET_KEY_SPEC, ivspec);
-        byte[] decrypted = cipher.doFinal(realData);
-        return new String(decrypted);
-    }
-
-    /**
-     * Method used to generate the SecretKeySpec from a Base64 String.
-     * 
-     * @param keyString The key as a string in Base 64
-     * @return The SecretKeySpec created
-     * @throws DecoderException In case of issues with the decoding of Base64
-     */
-    private static SecretKeySpec getSecretKeySpec(String keyString) throws DecoderException {
-        byte[] key = Hex.decodeHex(keyString.toCharArray());
-        return new SecretKeySpec(key, ALGORITHM);
-    }
-
-    /**
-     * Reads SecretKeySpec from file specified by propertiesFileName.
-     *
-     * @param propertiesFileName File name with properties
-     * @return SecretKeySpec secret key spec read from propertiesFileName
-     */
-    private static SecretKeySpec readSecretKeySpec(String propertiesFileName) {
-        Properties props = new Properties();
-        try {
-            // Workaround fix to make encryption key configurable
-            // System environment variable takes precedence for over clds/key.properties
-            String encryptionKey = System.getenv(AES_ENCRYPTION_KEY);
-            if (encryptionKey != null && encryptionKey.trim().length() > 0) {
-                return getSecretKeySpec(encryptionKey);
-            } else {
-                props.load(ResourceFileUtils.getResourceAsStream(propertiesFileName));
-                return getSecretKeySpec(props.getProperty(KEY_PARAM));
-            }
-        } catch (IOException | DecoderException e) {
-            logger.error("Exception occurred during the key reading", e);
-            return null;
-        }
-    }
-}
diff --git a/src/main/java/org/onap/policy/clamp/clds/util/ResourceFileUtils.java b/src/main/java/org/onap/policy/clamp/clds/util/ResourceFileUtils.java
index cd4700277..d6184c656 100644
--- a/src/main/java/org/onap/policy/clamp/clds/util/ResourceFileUtils.java
+++ b/src/main/java/org/onap/policy/clamp/clds/util/ResourceFileUtils.java
@@ -1,8 +1,8 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP CLAMP
+ * ONAP POLICY-CLAMP
  * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights
+ * Copyright (C) 2017, 2021 AT&T Intellectual Property. All rights
  *                             reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -56,8 +56,8 @@ public final class ResourceFileUtils {
      * @return The file as inputStream
      */
     public static InputStream getResourceAsStream(String fileName) {
-        InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream(
-                fileName.startsWith(CLASSPATH_PREFIX) ? fileName.replaceFirst(CLASSPATH_PREFIX, "") : fileName);
+        InputStream is = Thread.currentThread().getContextClassLoader()
+                .getResourceAsStream(fileName.replaceFirst("^" + CLASSPATH_PREFIX, ""));
         if (is == null) {
             throw new IllegalArgumentException("Unable to find resource: " + fileName);
         }
diff --git a/src/main/java/org/onap/policy/clamp/util/PassDecoder.java b/src/main/java/org/onap/policy/clamp/util/PassDecoder.java
index f4b8ed4dc..b8e90e3d0 100644
--- a/src/main/java/org/onap/policy/clamp/util/PassDecoder.java
+++ b/src/main/java/org/onap/policy/clamp/util/PassDecoder.java
@@ -1,8 +1,8 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP CLAMP
+ * ONAP POLICY-CLAMP
  * ================================================================================
- * Copyright (C) 2019 AT&T Intellectual Property. All rights
+ * Copyright (C) 2019, 2021 AT&T Intellectual Property. All rights
  *                             reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -32,6 +32,10 @@ import org.onap.policy.clamp.clds.util.ResourceFileUtils;
  * PassDecoder for decrypting the truststore and keystore password.
  */
 public class PassDecoder {
+
+    private PassDecoder() {
+    }
+
     /**
      * Used to log PassDecoder class.
      */
@@ -41,7 +45,7 @@ public class PassDecoder {
      * Decode the password.
      *
      * @param encryptedPass The encrypted password
-     * @param keyFileName       The key file name in String
+     * @param keyFileName   The key file name in String
      */
     public static String decode(String encryptedPass, String keyFileName) {
         if (null == keyFileName) {
diff --git a/src/main/resources/clds/key.properties b/src/main/resources/clds/key.properties
deleted file mode 100644
index dda2b87d0..000000000
--- a/src/main/resources/clds/key.properties
+++ /dev/null
@@ -1 +0,0 @@
-org.onap.policy.clamp.encryption.aes.key=aa3871669d893c7fb8abbcda31b88b4f
\ No newline at end of file
diff --git a/src/test/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfigurationTest.java b/src/test/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfigurationTest.java
index 89178b778..7390b65ba 100644
--- a/src/test/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfigurationTest.java
+++ b/src/test/java/org/onap/policy/clamp/clds/config/sdc/SdcSingleControllerConfigurationTest.java
@@ -1,8 +1,8 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP CLAMP
+ * ONAP POLICY-CLAMP
  * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
+ * Copyright (C) 2017, 2021 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -57,7 +57,8 @@ public class SdcSingleControllerConfigurationTest {
                 StandardCharsets.UTF_8);
         JsonObject jsonNode = JsonUtils.GSON.fromJson(streamReader, JsonObject.class);
 
-        return new SdcSingleControllerConfiguration(jsonNode, sdcControllerName);
+        return new SdcSingleControllerConfiguration(jsonNode, sdcControllerName,
+                "classpath:clds/aaf/org.onap.clamp.keyfile");
     }
 
     @Test
diff --git a/src/test/java/org/onap/policy/clamp/clds/it/config/SdcControllersConfigurationItCase.java b/src/test/java/org/onap/policy/clamp/clds/it/config/SdcControllersConfigurationItCase.java
index 516fc7a09..70aeccf59 100644
--- a/src/test/java/org/onap/policy/clamp/clds/it/config/SdcControllersConfigurationItCase.java
+++ b/src/test/java/org/onap/policy/clamp/clds/it/config/SdcControllersConfigurationItCase.java
@@ -1,8 +1,8 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP CLAMP
+ * ONAP POLICY-CLAMP
  * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
+ * Copyright (C) 2017, 2021 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -56,7 +56,7 @@ public class SdcControllersConfigurationItCase {
 
     @Test
     public void testGetAllDefinedControllers() throws IOException {
-        loadFile("classpath:/clds/sdc-controllers-config.json");
+        loadFile("classpath:clds/sdc-controllers-config.json");
         Map<String, SdcSingleControllerConfiguration> mapResult = sdcControllersConfiguration
                 .getAllDefinedControllers();
         assertTrue(mapResult.size() == 2);
@@ -66,7 +66,7 @@ public class SdcControllersConfigurationItCase {
 
     @Test
     public void testGetSdcSingleControllerConfiguration() throws IOException {
-        loadFile("classpath:/clds/sdc-controllers-config.json");
+        loadFile("classpath:clds/sdc-controllers-config.json");
         assertEquals("sdc-controller1", sdcControllersConfiguration
                 .getSdcSingleControllerConfiguration("sdc-controller1").getSdcControllerName());
         assertEquals("sdc-controller2", sdcControllersConfiguration
@@ -75,13 +75,13 @@ public class SdcControllersConfigurationItCase {
 
     @Test(expected = JsonSyntaxException.class)
     public void testBadJsonLoading() throws IOException {
-        loadFile("classpath:/clds/sdc-controllers-config-bad.json");
+        loadFile("classpath:clds/sdc-controllers-config-bad.json");
         fail("Should have raised an exception");
     }
 
     @Test(expected = SdcParametersException.class)
     public void testMissingParamInJsonLoading() throws IOException {
-        loadFile("classpath:/clds/sdc-controllers-config-missing-param.json");
+        loadFile("classpath:clds/sdc-controllers-config-missing-param.json");
         sdcControllersConfiguration.getAllDefinedControllers();
         fail("Should have raised an exception");
     }
diff --git a/src/test/java/org/onap/policy/clamp/clds/util/CryptoUtilsTest.java b/src/test/java/org/onap/policy/clamp/clds/util/CryptoUtilsTest.java
deleted file mode 100644
index 6239fef80..000000000
--- a/src/test/java/org/onap/policy/clamp/clds/util/CryptoUtilsTest.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*-
- * ============LICENSE_START=======================================================
- * ONAP CLAMP
- * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights
- *                             reserved.
- * ================================================================================
- * Modifications Copyright (c) 2019 Samsung
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License. 
- * You may obtain a copy of the License at
- * 
- * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software 
- * distributed under the License is distributed on an "AS IS" BASIS, 
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
- * See the License for the specific language governing permissions and 
- * limitations under the License.
- * ============LICENSE_END============================================
- * ===================================================================
- * 
- */
-
-package org.onap.policy.clamp.clds.util;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.mockito.ArgumentMatchers.eq;
-
-import java.security.InvalidKeyException;
-import javax.crypto.KeyGenerator;
-import javax.crypto.SecretKey;
-import org.apache.commons.codec.binary.Hex;
-import org.apache.commons.lang3.ArrayUtils;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.powermock.api.mockito.PowerMockito;
-import org.powermock.core.classloader.annotations.PowerMockIgnore;
-import org.powermock.core.classloader.annotations.PrepareForTest;
-import org.powermock.modules.junit4.PowerMockRunner;
-
-@RunWith(PowerMockRunner.class)
-@PowerMockIgnore({ "javax.crypto.*", "com.sun.org.apache.xerces.*", "javax.xml.*", "org.xml.*", "javax.management.*" })
-public class CryptoUtilsTest {
-
-    private final String data = "This is a test string";
-
-    @Test
-    @PrepareForTest({ CryptoUtils.class })
-    public final void testEncryption() throws Exception {
-        String encodedString = CryptoUtils.encrypt(data);
-        assertNotNull(encodedString);
-        assertEquals(data, CryptoUtils.decrypt(encodedString));
-    }
-
-    @Test
-    @PrepareForTest({ CryptoUtils.class })
-    public final void testEncryptedStringIsDifferent() throws Exception {
-        String encodedString1 = CryptoUtils.encrypt(data);
-        String encodedString2 = CryptoUtils.encrypt(data);
-        byte[] encryptedMessage1 = Hex.decodeHex(encodedString1.toCharArray());
-        byte[] encryptedMessage2 = Hex.decodeHex(encodedString2.toCharArray());
-        assertNotNull(encryptedMessage1);
-        assertNotNull(encryptedMessage2);
-        assertNotEquals(encryptedMessage1, encryptedMessage2);
-        byte[] subData1 = ArrayUtils.subarray(encryptedMessage1, 16, encryptedMessage1.length);
-        byte[] subData2 = ArrayUtils.subarray(encryptedMessage2, 16, encryptedMessage2.length);
-        assertNotEquals(subData1, subData2);
-    }
-
-    @Test
-    @PrepareForTest({ CryptoUtils.class })
-    public final void testEncryptionBaseOnRandomKey() throws Exception {
-        SecretKey secretKey = KeyGenerator.getInstance("AES").generateKey();
-        final String encryptionKey = String.valueOf(Hex.encodeHex(secretKey.getEncoded()));
-        setAesEncryptionKeyEnv(encryptionKey);
-
-        String encodedString = CryptoUtils.encrypt(data);
-        String decodedString = CryptoUtils.decrypt(encodedString);
-        assertEquals(data, decodedString);
-    }
-
-    @Test(expected = InvalidKeyException.class)
-    @PrepareForTest({ CryptoUtils.class })
-    public final void testEncryptionBadKey() throws Exception {
-        final String badEncryptionKey = "93210sd";
-        setAesEncryptionKeyEnv(badEncryptionKey);
-
-        CryptoUtils.encrypt(data);
-    }
-
-    private static void setAesEncryptionKeyEnv(String value) {
-        PowerMockito.mockStatic(System.class);
-        PowerMockito.when(System.getenv(eq("AES_ENCRYPTION_KEY"))).thenReturn(value);
-    }
-}
diff --git a/src/test/java/org/onap/policy/clamp/util/PassDecoderTest.java b/src/test/java/org/onap/policy/clamp/util/PassDecoderTest.java
index 83e894130..7fd0cb91d 100644
--- a/src/test/java/org/onap/policy/clamp/util/PassDecoderTest.java
+++ b/src/test/java/org/onap/policy/clamp/util/PassDecoderTest.java
@@ -1,24 +1,24 @@
 /*-
  * ============LICENSE_START=======================================================
- * ONAP CLAMP
+ * ONAP POLICY-CLAMP
  * ================================================================================
- * Copyright (C) 2019 AT&T Intellectual Property. All rights
+ * Copyright (C) 2019, 2021 AT&T Intellectual Property. All rights
  *                             reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License. 
+ * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  * http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software 
- * distributed under the License is distributed on an "AS IS" BASIS, 
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
- * See the License for the specific language governing permissions and 
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
  * limitations under the License.
  * ============LICENSE_END============================================
  * ===================================================================
- * 
+ *
  */
 
 package org.onap.policy.clamp.util;
@@ -48,5 +48,8 @@ public class PassDecoderTest {
     public final void testDecryption() throws Exception {
         String decodedPass = PassDecoder.decode(encrypted, "classpath:clds/aaf/org.onap.clamp.keyfile");
         assertEquals(decodedPass, "China in the Spring");
+        assertEquals("Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U", PassDecoder
+                .decode("enc:JPV4p067JlSXt2Fet9bfuI8JpkS4ZGYVcgypcPs98gXjgjCjTze_d3JxqmlKaaakdiOjIcEC_MJh6-5pJTLgdc",
+                        "classpath:clds/aaf/org.onap.clamp.keyfile"));
     }
 }
diff --git a/src/test/resources/application.properties b/src/test/resources/application.properties
index d67fe74a3..bc513e9e4 100644
--- a/src/test/resources/application.properties
+++ b/src/test/resources/application.properties
@@ -31,6 +31,8 @@ server.port=${clamp.it.tests.http}
 #server.ssl.key-store-password=pass
 #server.ssl.key-password=pass
 
+clamp.config.keyFile=classpath:clds/aaf/org.onap.clamp.keyfile
+
 ### In order to be user friendly when HTTPS is enabled,
 ### you can add another HTTP port that will be automatically redirected to HTTPS
 ### by enabling this parameter (server.http.port) and set it to another port (80 or 8080, 8090, etc ...)
diff --git a/src/test/resources/clds/sdc-controller-config-TLS.json b/src/test/resources/clds/sdc-controller-config-TLS.json
index 99366b765..4d5f02945 100644
--- a/src/test/resources/clds/sdc-controller-config-TLS.json
+++ b/src/test/resources/clds/sdc-controller-config-TLS.json
@@ -4,11 +4,11 @@
         "consumerId": "consumerId",
         "environmentName": "environmentName",
         "sdcAddress": "hostname:8080",
-        "password": "bb3871669d893c7fb8aaacda31b77b4f537E67A081C2726889548ED7BC4C2DE6",
+        "password": "QpF2TcrdRSFADqDxH1HwDYdYUIbMxOj-TrGd6Vqvwzd",
         "pollingInterval":10,
         "pollingTimeout":30,
         "activateServerTLSAuth": true,
-        "keyStorePassword":"bb3871669d893c7fb8aaacda31b77b4f537E67A081C2726889548ED7BC4C2DE6",
+        "keyStorePassword":"QpF2TcrdRSFADqDxH1HwDYdYUIbMxOj-TrGd6Vqvwzd",
         "keyStorePath": "/test",
         "messageBusAddresses":["localhost"]
 }
diff --git a/src/test/resources/clds/sdc-controllers-config.json b/src/test/resources/clds/sdc-controllers-config.json
index ce56fef27..75e5be1b9 100644
--- a/src/test/resources/clds/sdc-controllers-config.json
+++ b/src/test/resources/clds/sdc-controllers-config.json
@@ -1,27 +1,30 @@
 {
-  "sdc-connections":{
-    "sdc-controller1":{
-        "user": "User1",
-        "consumerGroup": "consumerGroup1",
-        "consumerId": "consumerId1",
-        "environmentName": "environmentName1",
-        "sdcAddress": "localhost:${docker.http-cache.port.host}",
-        "password": "bb3871669d893c7fb8aaacda31b77b4f537E67A081C2726889548ED7BC4C2DE6",
-        "pollingInterval":10,
-        "pollingTimeout":30,
-        "messageBusAddresses":["localhost"]
+  "sdc-connections": {
+    "sdc-controller1": {
+      "user": "User1",
+      "consumerGroup": "consumerGroup1",
+      "consumerId": "consumerId1",
+      "environmentName": "environmentName1",
+      "sdcAddress": "localhost:${docker.http-cache.port.host}",
+      "password": "QpF2TcrdRSFADqDxH1HwDYdYUIbMxOj-TrGd6Vqvwzd",
+      "pollingInterval": 10,
+      "pollingTimeout": 30,
+      "messageBusAddresses": [
+        "localhost"
+      ]
     },
-     "sdc-controller2":{
-        "user": "User2",
-        "consumerGroup": "consumerGroup2",
-        "consumerId": "consumerId2",
-        "environmentName": "environmentName2",
-        "sdcAddress": "localhost:${docker.http-cache.port.host}",
-        "password": "bb3871669d893c7fb8aaacda31b77b4f537E67A081C2726889548ED7BC4C2DE6",
-        "pollingInterval":10,
-        "pollingTimeout":30,
-        "messageBusAddresses":["localhost"]
-        
+    "sdc-controller2": {
+      "user": "User2",
+      "consumerGroup": "consumerGroup2",
+      "consumerId": "consumerId2",
+      "environmentName": "environmentName2",
+      "sdcAddress": "localhost:${docker.http-cache.port.host}",
+      "password": "QpF2TcrdRSFADqDxH1HwDYdYUIbMxOj-TrGd6Vqvwzd",
+      "pollingInterval": 10,
+      "pollingTimeout": 30,
+      "messageBusAddresses": [
+        "localhost"
+      ]
     }
   }
 }
diff --git a/src/test/resources/robotframework/robotframework-test.properties b/src/test/resources/robotframework/robotframework-test.properties
index a12f052ad..fed074198 100644
--- a/src/test/resources/robotframework/robotframework-test.properties
+++ b/src/test/resources/robotframework/robotframework-test.properties
@@ -31,6 +31,8 @@ server.port=${clamp.it.tests.robotframework.http}
 #server.ssl.key-store-password=pass
 #server.ssl.key-password=pass
 
+clamp.config.keyFile=classpath:clds/aaf/org.onap.clamp.keyfile
+
 ### In order to be user friendly when HTTPS is enabled,
 ### you can add another HTTP port that will be automatically redirected to HTTPS
 ### by enabling this parameter (server.http.port) and set it to another port (80 or 8080, 8090, etc ...)