Add dynamic ports for HTTP/HTTPS

The ports can now be configured in the application.properties and
the both protocols can run at the same time (HTTP+HTTPS)

Change-Id: I57d1b5643df33da45af2f6798923d94bff1d560d
Issue-Id: CLAMP-43
Signed-off-by: Determe, Sebastien (sd378r) <sd378r@intl.att.com>

3 files changed, 272 insertions, 120 deletions

diff --git a/src/main/java/org/onap/clamp/clds/Application.java b/src/main/java/org/onap/clamp/clds/Application.java
index 037935175..bebb07844 100644
--- a/src/main/java/org/onap/clamp/clds/Application.java
+++ b/src/main/java/org/onap/clamp/clds/Application.java
@@ -30,7 +30,10 @@ import javax.ws.rs.client.Client;
 import javax.ws.rs.client.ClientBuilder;
 
 import org.apache.camel.component.servlet.CamelHttpTransportServlet;
+import org.apache.catalina.connector.Connector;
 import org.camunda.bpm.spring.boot.starter.webapp.CamundaBpmWebappAutoConfiguration;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration;
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
@@ -39,13 +42,18 @@ import org.springframework.boot.autoconfigure.data.jpa.JpaRepositoriesAutoConfig
 import org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration;
 import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration;
 import org.springframework.boot.builder.SpringApplicationBuilder;
+import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory;
+import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
 import org.springframework.boot.web.servlet.ServletRegistrationBean;
 import org.springframework.boot.web.support.SpringBootServletInitializer;
+import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.scheduling.annotation.EnableAsync;
 
 import com.att.ajsc.common.utility.SystemPropertiesLoader;
+import com.att.eelf.configuration.EELFLogger;
+import com.att.eelf.configuration.EELFManager;
 
 @SpringBootApplication
 @ComponentScan(basePackages = { "org.onap.clamp.clds", "com.att.ajsc" })
@@ -55,8 +63,29 @@ import com.att.ajsc.common.utility.SystemPropertiesLoader;
 @EnableAsync
 public class Application extends SpringBootServletInitializer {
 
-    private static final String CAMEL_SERVLET_NAME = "CamelServlet";
-    private static final String CAMEL_URL_MAPPING  = "/restservices/clds/v1/*";
+    protected static final EELFLogger logger             = EELFManager.getInstance().getLogger(Application.class);
+
+    @Autowired
+    protected ApplicationContext      appContext;
+
+    private static final String       CAMEL_SERVLET_NAME = "CamelServlet";
+    private static final String       CAMEL_URL_MAPPING  = "/restservices/clds/v1/*";
+
+    // This settings is an additional one to Spring config,
+    // only if we want to have an additional port automatically redirected to
+    // HTTPS
+    @Value("${server.http-to-https-redirection.port:none}")
+    private String                    httpRedirectedPort;
+
+    /**
+     * This 8080 is the default port used by spring if this parameter is not
+     * specified in application.properties.
+     */
+    @Value("${server.port:8080}")
+    private String                    springServerPort;
+
+    @Value("${server.ssl.key-store:none}")
+    private String                    sslKeystoreFile;
 
     @Override
     protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
@@ -84,4 +113,39 @@ public class Application extends SpringBootServletInitializer {
         return ClientBuilder.newClient();
     }
 
+    /**
+     * This method is used by Spring to create the servlet container factory.
+     * 
+     * @return The TomcatEmbeddedServletContainerFactory just created
+     */
+    @Bean
+    public EmbeddedServletContainerFactory getEmbeddedServletContainerFactory() {
+        TomcatEmbeddedServletContainerFactory tomcat = new TomcatEmbeddedServletContainerFactory();
+        if (!"none".equals(httpRedirectedPort) && !"none".equals(sslKeystoreFile)) {
+            // Automatically redirect to HTTPS
+            tomcat = new TomcatEmbeddedServletContainerFactoryRedirection();
+            Connector newConnector = createRedirectConnector(Integer.parseInt(springServerPort));
+            if (newConnector != null) {
+                tomcat.addAdditionalTomcatConnectors(newConnector);
+            }
+
+        }
+        return tomcat;
+
+    }
+
+    private Connector createRedirectConnector(int redirectSecuredPort) {
+        if (redirectSecuredPort <= 0) {
+            logger.warn(
+                    "HTTP port redirection to HTTPS is disabled because the HTTPS port is 0 (random port) or -1 (Connector disabled)");
+            return null;
+        }
+        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
+        connector.setScheme("http");
+        connector.setSecure(false);
+        connector.setPort(Integer.parseInt(httpRedirectedPort));
+        connector.setRedirectPort(redirectSecuredPort);
+        return connector;
+    }
+
 }
diff --git a/src/main/java/org/onap/clamp/clds/TomcatEmbeddedServletContainerFactoryRedirection.java b/src/main/java/org/onap/clamp/clds/TomcatEmbeddedServletContainerFactoryRedirection.java
new file mode 100644
index 000000000..2878140f9
--- /dev/null
+++ b/src/main/java/org/onap/clamp/clds/TomcatEmbeddedServletContainerFactoryRedirection.java
@@ -0,0 +1,55 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP CLAMP
+ * ================================================================================
+ * Copyright (C) 2017 AT&T Intellectual Property. All rights
+ *                             reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License"); 
+ * you may not use this file except in compliance with the License. 
+ * You may obtain a copy of the License at
+ * 
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software 
+ * distributed under the License is distributed on an "AS IS" BASIS, 
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
+ * See the License for the specific language governing permissions and 
+ * limitations under the License.
+ * ============LICENSE_END============================================
+ * ===================================================================
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.clamp.clds;
+
+import org.apache.catalina.Context;
+import org.apache.tomcat.util.descriptor.web.SecurityCollection;
+import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
+import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
+
+/**
+ * This class is a factory that redirects by default all HTTP to HTTPS
+ * connector. It is used by the Application.java class and defined in a Spring
+ * Bean.
+ * 
+ * In order to do this, the method postProcessContext has been overridden to
+ * provide another behavior.
+ * 
+ */
+public class TomcatEmbeddedServletContainerFactoryRedirection extends TomcatEmbeddedServletContainerFactory {
+
+    /**
+     * This method is there to force the automatic redirection of all calls done
+     * on the tomcat server to a Secure connection.
+     */
+    @Override
+    protected void postProcessContext(Context context) {
+        SecurityConstraint securityConstraint = new SecurityConstraint();
+        securityConstraint.setUserConstraint("CONFIDENTIAL");
+        SecurityCollection collection = new SecurityCollection();
+        collection.addPattern("/*");
+        securityConstraint.addCollection(collection);
+        context.addConstraint(securityConstraint);
+    }
+}
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index ce4158bbd..9ed7c6ede 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -1,119 +1,152 @@
-###
-# ============LICENSE_START=======================================================
-# ONAP CLAMP
-# ================================================================================
-# Copyright (C) 2017 AT&T Intellectual Property. All rights
-#                             reserved.
-# ================================================================================
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# ============LICENSE_END============================================
-# ===================================================================
-# ECOMP is a trademark and service mark of AT&T Intellectual Property.
-###
-
-info.build.artifact=@project.artifactId@
-info.build.name=@project.name@
-info.build.description=@project.description@
-info.build.version=@project.version@
-
-
-server.contextPath=/
-#Modified engine-rest applicationpath
-spring.jersey.application-path=/engine-rest
-spring.profiles.active=clamp-default,clamp-spring-authentication
-spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration,org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration
-
-#The max number of active threads in this pool
-server.tomcat.max-threads=200
-#The minimum number of threads always kept alive
-server.tomcat.min-Spare-Threads=25
-#The number of milliseconds before an idle thread shutsdown, unless the number of active threads are less or equal to minSpareThreads
-server.tomcat.max-idle-time=60000
-
-
-#Add this properties only if you want to change the URL, AJSC Framework interceptors will intercept
-#com.att.ajsc.common.interceptors.PreInterceptor.url=/**
-#com.att.ajsc.common.interceptors.PostInterceptor.url=/**
-
-#Servlet context parameters
-server.context_parameters.p-name=value #context parameter with p-name as key and value as value.
-
-camel.springboot.consumer-template-cache-size=1000
-camel.springboot.producer-template-cache-size=1000
-camel.springboot.jmx-enabled=true
-camel.defaultthreadpool.poolsize=10
-camel.defaultthreadpool.maxpoolsize=20
-camel.defaultthreadpool.maxqueuesize=1000
-camel.defaultthreadpool.keepaliveTime=60
-camel.defaultthreadpool.rejectpolicy=CallerRuns
-
-kubernetes.namespace=com-att-ajsc
-
-#server.port=0
-
-#Camunda Process Engine DataSource connection Details
-spring.datasource.camunda.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/camundabpm?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100
-spring.datasource.camunda.username=camunda
-spring.datasource.camunda.password=ndMSpw4CAM
-spring.datasource.camunda.driverClassName=com.mysql.jdbc.Driver
-spring.datasource.camunda.validationQuery=SELECT 1
-spring.datasource.camunda.validationQueryTimeout=20000
-spring.datasource.camunda.validationInterval=60000
-spring.datasource.camunda.testWhileIdle = true
-# Automatically test whether a connection provided is good or not
-spring.datasource.camunda.testOnBorrow=true
-
-#Camunda application properties
-#Camunda history level
-camunda.bpm.history-level=auto
-
-#clds datasource connection details
-spring.datasource.cldsdb.driver-class-name=com.mysql.jdbc.Driver
-spring.datasource.cldsdb.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/cldsdb4?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100
-spring.datasource.cldsdb.username=clds
-spring.datasource.cldsdb.password=sidnnd83K
-spring.datasource.cldsdb.driverClassName=com.mysql.jdbc.Driver
-spring.datasource.cldsdb.validationQuery=SELECT 1
-spring.datasource.cldsdb.validationQueryTimeout=20000
-spring.datasource.cldsdb.validationInterval=60000
-spring.datasource.cldsdb.testWhileIdle = true
-# Automatically test whether a connection provided is good or not
-spring.datasource.cldsdb.testOnBorrow=true
-
-#Async Executor default Parameters
-async.core.pool.size=10
-async.max.pool.size=20
-async.queue.capacity=500
-
-org.onap.clamp.config.dcae.url=http://localhost:9000/closedloop-dcae-services
-
-#GRM Edge endpoint details
-service.name=ajsc6camundademo
-service.version=1.0.0.0
-routeoffer=TEST
-#Update with your application name
-application.name=AJSC6CAMUNDA
-
-org.onap.clamp.config.files.cldsReference=classpath:/clds/clds-reference.properties
-org.onap.clamp.config.files.cldsPolicyConfig=classpath:/clds/clds-policy-config.properties
-org.onap.clamp.config.files.cldsUsers=classpath:/clds/clds-users.json
-org.onap.clamp.config.files.globalClds=classpath:/clds/globalClds.properties
-
-#Define user permission related parameters, the permission type can be changed but MUST be redefined in clds-users.properties in that case !
-CLDS_PERMISSION_TYPE_CL=permission-type-cl
-CLDS_PERMISSION_TYPE_CL_MANAGE=permission-type-cl-manage
-CLDS_PERMISSION_TYPE_CL_EVENT=permission-type-cl-event
-CLDS_PERMISSION_TYPE_FILTER_VF=permission-type-filter-vf
-CLDS_PERMISSION_TYPE_TEMPLATE=permission-type-template
-#This one indicates the type of instances (dev|prod|perf...), this must be set accordingly in clds-users.properties
+###

+# ============LICENSE_START=======================================================

+# ONAP CLAMP

+# ================================================================================

+# Copyright (C) 2017 AT&T Intellectual Property. All rights

+#                             reserved.

+# ================================================================================

+# Licensed under the Apache License, Version 2.0 (the "License");

+# you may not use this file except in compliance with the License.

+# You may obtain a copy of the License at

+#

+# http://www.apache.org/licenses/LICENSE-2.0

+#

+# Unless required by applicable law or agreed to in writing, software

+# distributed under the License is distributed on an "AS IS" BASIS,

+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+# See the License for the specific language governing permissions and

+# limitations under the License.

+# ============LICENSE_END============================================

+# ===================================================================

+# ECOMP is a trademark and service mark of AT&T Intellectual Property.

+###

+

+info.build.artifact=@project.artifactId@

+info.build.name=@project.name@

+info.build.description=@project.description@

+info.build.version=@project.version@

+

+### Set the port for HTTP or HTTPS protocol (Controlled by Spring framework, only one at a time).

+### (See below for the parameter 'server.http.port' if you want to have both enabled) 

+### To have only HTTP, keep the lines server.ssl.* commented

+### To have only HTTPS enabled, uncomment the server.ssl.* lines and specify a right keystore location

+server.port=8080

+### Settings for HTTPS (this automatically enables the HTTPS on the port 'server.port') 

+#server.ssl.key-store=file:/tmp/mykey.jks

+#server.ssl.key-store-password=pass

+#server.ssl.key-password=pass

+

+### In order to be user friendly when HTTPS is enabled, 

+### you can add another HTTP port that will be automatically redirected to HTTPS

+### by enabling this parameter (server.http.port) and set it to another port (80 or 8080, 8090, etc ...)

+#server.http-to-https-redirection.port=8090

+

+### HTTP Example:

+###--------------

+### server.port=8080

+

+### HTTPS Example:

+### --------------

+### server.port=8443

+### server.ssl.key-store=file:/tmp/mykey.jks

+### server.ssl.key-store-password=mypass

+### server.ssl.key-password=mypass

+

+### HTTP (Redirected to HTTPS) and HTTPS Example:

+### --------------------------------------------

+### server.port=8443           <-- The HTTPS port

+### server.ssl.key-store=file:/tmp/mykey.jks

+### server.ssl.key-store-password=mypass

+### server.ssl.key-password=mypass

+### server.http-to-https-redirection.port=8090  <-- The HTTP port

+

+server.contextPath=/

+#Modified engine-rest applicationpath

+spring.jersey.application-path=/engine-rest

+spring.profiles.active=clamp-default,clamp-spring-authentication

+spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration,org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration

+

+#The max number of active threads in this pool

+server.tomcat.max-threads=200

+#The minimum number of threads always kept alive

+server.tomcat.min-Spare-Threads=25

+#The number of milliseconds before an idle thread shutsdown, unless the number of active threads are less or equal to minSpareThreads

+server.tomcat.max-idle-time=60000

+

+

+#Add this properties only if you want to change the URL, AJSC Framework interceptors will intercept

+#com.att.ajsc.common.interceptors.PreInterceptor.url=/**

+#com.att.ajsc.common.interceptors.PostInterceptor.url=/**

+

+#Servlet context parameters

+server.context_parameters.p-name=value #context parameter with p-name as key and value as value.

+

+camel.springboot.consumer-template-cache-size=1000

+camel.springboot.producer-template-cache-size=1000

+camel.springboot.jmx-enabled=true

+camel.defaultthreadpool.poolsize=10

+camel.defaultthreadpool.maxpoolsize=20

+camel.defaultthreadpool.maxqueuesize=1000

+camel.defaultthreadpool.keepaliveTime=60

+camel.defaultthreadpool.rejectpolicy=CallerRuns

+

+kubernetes.namespace=com-att-ajsc

+

+#server.port=0

+

+#Camunda Process Engine DataSource connection Details

+spring.datasource.camunda.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/camundabpm?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100

+spring.datasource.camunda.username=camunda

+spring.datasource.camunda.password=ndMSpw4CAM

+spring.datasource.camunda.driverClassName=com.mysql.jdbc.Driver

+spring.datasource.camunda.validationQuery=SELECT 1

+spring.datasource.camunda.validationQueryTimeout=20000

+spring.datasource.camunda.validationInterval=60000

+spring.datasource.camunda.testWhileIdle = true

+# Automatically test whether a connection provided is good or not

+spring.datasource.camunda.testOnBorrow=true

+

+#Camunda application properties

+#Camunda history level

+camunda.bpm.history-level=auto

+

+#clds datasource connection details

+spring.datasource.cldsdb.driver-class-name=com.mysql.jdbc.Driver

+spring.datasource.cldsdb.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/cldsdb4?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100

+spring.datasource.cldsdb.username=clds

+spring.datasource.cldsdb.password=sidnnd83K

+spring.datasource.cldsdb.driverClassName=com.mysql.jdbc.Driver

+spring.datasource.cldsdb.validationQuery=SELECT 1

+spring.datasource.cldsdb.validationQueryTimeout=20000

+spring.datasource.cldsdb.validationInterval=60000

+spring.datasource.cldsdb.testWhileIdle = true

+# Automatically test whether a connection provided is good or not

+spring.datasource.cldsdb.testOnBorrow=true

+

+#Async Executor default Parameters

+async.core.pool.size=10

+async.max.pool.size=20

+async.queue.capacity=500

+

+org.onap.clamp.config.dcae.url=http://localhost:9000/closedloop-dcae-services

+

+#GRM Edge endpoint details

+service.name=ajsc6camundademo

+service.version=1.0.0.0

+routeoffer=TEST

+#Update with your application name

+application.name=AJSC6CAMUNDA

+

+org.onap.clamp.config.files.cldsReference=classpath:/clds/clds-reference.properties

+org.onap.clamp.config.files.cldsPolicyConfig=classpath:/clds/clds-policy-config.properties

+org.onap.clamp.config.files.cldsUsers=classpath:/clds/clds-users.json

+org.onap.clamp.config.files.globalClds=classpath:/clds/globalClds.properties

+

+#Define user permission related parameters, the permission type can be changed but MUST be redefined in clds-users.properties in that case !

+CLDS_PERMISSION_TYPE_CL=permission-type-cl

+CLDS_PERMISSION_TYPE_CL_MANAGE=permission-type-cl-manage

+CLDS_PERMISSION_TYPE_CL_EVENT=permission-type-cl-event

+CLDS_PERMISSION_TYPE_FILTER_VF=permission-type-filter-vf

+CLDS_PERMISSION_TYPE_TEMPLATE=permission-type-template

+#This one indicates the type of instances (dev|prod|perf...), this must be set accordingly in clds-users.properties

 CLDS_PERMISSION_INSTANCE=dev
\ No newline at end of file