From f527ac93d843bd545bd6637cb012378c75a62e65 Mon Sep 17 00:00:00 2001 From: "Determe, Sebastien (sd378r)" Date: Tue, 29 Aug 2017 04:12:52 -0700 Subject: Add dynamic ports for HTTP/HTTPS The ports can now be configured in the application.properties and the both protocols can run at the same time (HTTP+HTTPS) Change-Id: I57d1b5643df33da45af2f6798923d94bff1d560d Issue-Id: CLAMP-43 Signed-off-by: Determe, Sebastien (sd378r) --- src/main/java/org/onap/clamp/clds/Application.java | 68 +++++- ...EmbeddedServletContainerFactoryRedirection.java | 55 +++++ src/main/resources/application.properties | 269 ++++++++++++--------- 3 files changed, 272 insertions(+), 120 deletions(-) create mode 100644 src/main/java/org/onap/clamp/clds/TomcatEmbeddedServletContainerFactoryRedirection.java (limited to 'src/main') diff --git a/src/main/java/org/onap/clamp/clds/Application.java b/src/main/java/org/onap/clamp/clds/Application.java index 037935175..bebb07844 100644 --- a/src/main/java/org/onap/clamp/clds/Application.java +++ b/src/main/java/org/onap/clamp/clds/Application.java @@ -30,7 +30,10 @@ import javax.ws.rs.client.Client; import javax.ws.rs.client.ClientBuilder; import org.apache.camel.component.servlet.CamelHttpTransportServlet; +import org.apache.catalina.connector.Connector; import org.camunda.bpm.spring.boot.starter.webapp.CamundaBpmWebappAutoConfiguration; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; import org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration; import org.springframework.boot.autoconfigure.EnableAutoConfiguration; @@ -39,13 +42,18 @@ import org.springframework.boot.autoconfigure.data.jpa.JpaRepositoriesAutoConfig import org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration; import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration; import org.springframework.boot.builder.SpringApplicationBuilder; +import org.springframework.boot.context.embedded.EmbeddedServletContainerFactory; +import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory; import org.springframework.boot.web.servlet.ServletRegistrationBean; import org.springframework.boot.web.support.SpringBootServletInitializer; +import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.ComponentScan; import org.springframework.scheduling.annotation.EnableAsync; import com.att.ajsc.common.utility.SystemPropertiesLoader; +import com.att.eelf.configuration.EELFLogger; +import com.att.eelf.configuration.EELFManager; @SpringBootApplication @ComponentScan(basePackages = { "org.onap.clamp.clds", "com.att.ajsc" }) @@ -55,8 +63,29 @@ import com.att.ajsc.common.utility.SystemPropertiesLoader; @EnableAsync public class Application extends SpringBootServletInitializer { - private static final String CAMEL_SERVLET_NAME = "CamelServlet"; - private static final String CAMEL_URL_MAPPING = "/restservices/clds/v1/*"; + protected static final EELFLogger logger = EELFManager.getInstance().getLogger(Application.class); + + @Autowired + protected ApplicationContext appContext; + + private static final String CAMEL_SERVLET_NAME = "CamelServlet"; + private static final String CAMEL_URL_MAPPING = "/restservices/clds/v1/*"; + + // This settings is an additional one to Spring config, + // only if we want to have an additional port automatically redirected to + // HTTPS + @Value("${server.http-to-https-redirection.port:none}") + private String httpRedirectedPort; + + /** + * This 8080 is the default port used by spring if this parameter is not + * specified in application.properties. + */ + @Value("${server.port:8080}") + private String springServerPort; + + @Value("${server.ssl.key-store:none}") + private String sslKeystoreFile; @Override protected SpringApplicationBuilder configure(SpringApplicationBuilder application) { @@ -84,4 +113,39 @@ public class Application extends SpringBootServletInitializer { return ClientBuilder.newClient(); } + /** + * This method is used by Spring to create the servlet container factory. + * + * @return The TomcatEmbeddedServletContainerFactory just created + */ + @Bean + public EmbeddedServletContainerFactory getEmbeddedServletContainerFactory() { + TomcatEmbeddedServletContainerFactory tomcat = new TomcatEmbeddedServletContainerFactory(); + if (!"none".equals(httpRedirectedPort) && !"none".equals(sslKeystoreFile)) { + // Automatically redirect to HTTPS + tomcat = new TomcatEmbeddedServletContainerFactoryRedirection(); + Connector newConnector = createRedirectConnector(Integer.parseInt(springServerPort)); + if (newConnector != null) { + tomcat.addAdditionalTomcatConnectors(newConnector); + } + + } + return tomcat; + + } + + private Connector createRedirectConnector(int redirectSecuredPort) { + if (redirectSecuredPort <= 0) { + logger.warn( + "HTTP port redirection to HTTPS is disabled because the HTTPS port is 0 (random port) or -1 (Connector disabled)"); + return null; + } + Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol"); + connector.setScheme("http"); + connector.setSecure(false); + connector.setPort(Integer.parseInt(httpRedirectedPort)); + connector.setRedirectPort(redirectSecuredPort); + return connector; + } + } diff --git a/src/main/java/org/onap/clamp/clds/TomcatEmbeddedServletContainerFactoryRedirection.java b/src/main/java/org/onap/clamp/clds/TomcatEmbeddedServletContainerFactoryRedirection.java new file mode 100644 index 000000000..2878140f9 --- /dev/null +++ b/src/main/java/org/onap/clamp/clds/TomcatEmbeddedServletContainerFactoryRedirection.java @@ -0,0 +1,55 @@ +/*- + * ============LICENSE_START======================================================= + * ONAP CLAMP + * ================================================================================ + * Copyright (C) 2017 AT&T Intellectual Property. All rights + * reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END============================================ + * =================================================================== + * ECOMP is a trademark and service mark of AT&T Intellectual Property. + */ + +package org.onap.clamp.clds; + +import org.apache.catalina.Context; +import org.apache.tomcat.util.descriptor.web.SecurityCollection; +import org.apache.tomcat.util.descriptor.web.SecurityConstraint; +import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory; + +/** + * This class is a factory that redirects by default all HTTP to HTTPS + * connector. It is used by the Application.java class and defined in a Spring + * Bean. + * + * In order to do this, the method postProcessContext has been overridden to + * provide another behavior. + * + */ +public class TomcatEmbeddedServletContainerFactoryRedirection extends TomcatEmbeddedServletContainerFactory { + + /** + * This method is there to force the automatic redirection of all calls done + * on the tomcat server to a Secure connection. + */ + @Override + protected void postProcessContext(Context context) { + SecurityConstraint securityConstraint = new SecurityConstraint(); + securityConstraint.setUserConstraint("CONFIDENTIAL"); + SecurityCollection collection = new SecurityCollection(); + collection.addPattern("/*"); + securityConstraint.addCollection(collection); + context.addConstraint(securityConstraint); + } +} diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index ce4158bbd..9ed7c6ede 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -1,119 +1,152 @@ -### -# ============LICENSE_START======================================================= -# ONAP CLAMP -# ================================================================================ -# Copyright (C) 2017 AT&T Intellectual Property. All rights -# reserved. -# ================================================================================ -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# ============LICENSE_END============================================ -# =================================================================== -# ECOMP is a trademark and service mark of AT&T Intellectual Property. -### - -info.build.artifact=@project.artifactId@ -info.build.name=@project.name@ -info.build.description=@project.description@ -info.build.version=@project.version@ - - -server.contextPath=/ -#Modified engine-rest applicationpath -spring.jersey.application-path=/engine-rest -spring.profiles.active=clamp-default,clamp-spring-authentication -spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration,org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration - -#The max number of active threads in this pool -server.tomcat.max-threads=200 -#The minimum number of threads always kept alive -server.tomcat.min-Spare-Threads=25 -#The number of milliseconds before an idle thread shutsdown, unless the number of active threads are less or equal to minSpareThreads -server.tomcat.max-idle-time=60000 - - -#Add this properties only if you want to change the URL, AJSC Framework interceptors will intercept -#com.att.ajsc.common.interceptors.PreInterceptor.url=/** -#com.att.ajsc.common.interceptors.PostInterceptor.url=/** - -#Servlet context parameters -server.context_parameters.p-name=value #context parameter with p-name as key and value as value. - -camel.springboot.consumer-template-cache-size=1000 -camel.springboot.producer-template-cache-size=1000 -camel.springboot.jmx-enabled=true -camel.defaultthreadpool.poolsize=10 -camel.defaultthreadpool.maxpoolsize=20 -camel.defaultthreadpool.maxqueuesize=1000 -camel.defaultthreadpool.keepaliveTime=60 -camel.defaultthreadpool.rejectpolicy=CallerRuns - -kubernetes.namespace=com-att-ajsc - -#server.port=0 - -#Camunda Process Engine DataSource connection Details -spring.datasource.camunda.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/camundabpm?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100 -spring.datasource.camunda.username=camunda -spring.datasource.camunda.password=ndMSpw4CAM -spring.datasource.camunda.driverClassName=com.mysql.jdbc.Driver -spring.datasource.camunda.validationQuery=SELECT 1 -spring.datasource.camunda.validationQueryTimeout=20000 -spring.datasource.camunda.validationInterval=60000 -spring.datasource.camunda.testWhileIdle = true -# Automatically test whether a connection provided is good or not -spring.datasource.camunda.testOnBorrow=true - -#Camunda application properties -#Camunda history level -camunda.bpm.history-level=auto - -#clds datasource connection details -spring.datasource.cldsdb.driver-class-name=com.mysql.jdbc.Driver -spring.datasource.cldsdb.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/cldsdb4?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100 -spring.datasource.cldsdb.username=clds -spring.datasource.cldsdb.password=sidnnd83K -spring.datasource.cldsdb.driverClassName=com.mysql.jdbc.Driver -spring.datasource.cldsdb.validationQuery=SELECT 1 -spring.datasource.cldsdb.validationQueryTimeout=20000 -spring.datasource.cldsdb.validationInterval=60000 -spring.datasource.cldsdb.testWhileIdle = true -# Automatically test whether a connection provided is good or not -spring.datasource.cldsdb.testOnBorrow=true - -#Async Executor default Parameters -async.core.pool.size=10 -async.max.pool.size=20 -async.queue.capacity=500 - -org.onap.clamp.config.dcae.url=http://localhost:9000/closedloop-dcae-services - -#GRM Edge endpoint details -service.name=ajsc6camundademo -service.version=1.0.0.0 -routeoffer=TEST -#Update with your application name -application.name=AJSC6CAMUNDA - -org.onap.clamp.config.files.cldsReference=classpath:/clds/clds-reference.properties -org.onap.clamp.config.files.cldsPolicyConfig=classpath:/clds/clds-policy-config.properties -org.onap.clamp.config.files.cldsUsers=classpath:/clds/clds-users.json -org.onap.clamp.config.files.globalClds=classpath:/clds/globalClds.properties - -#Define user permission related parameters, the permission type can be changed but MUST be redefined in clds-users.properties in that case ! -CLDS_PERMISSION_TYPE_CL=permission-type-cl -CLDS_PERMISSION_TYPE_CL_MANAGE=permission-type-cl-manage -CLDS_PERMISSION_TYPE_CL_EVENT=permission-type-cl-event -CLDS_PERMISSION_TYPE_FILTER_VF=permission-type-filter-vf -CLDS_PERMISSION_TYPE_TEMPLATE=permission-type-template -#This one indicates the type of instances (dev|prod|perf...), this must be set accordingly in clds-users.properties +### +# ============LICENSE_START======================================================= +# ONAP CLAMP +# ================================================================================ +# Copyright (C) 2017 AT&T Intellectual Property. All rights +# reserved. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# ============LICENSE_END============================================ +# =================================================================== +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +### + +info.build.artifact=@project.artifactId@ +info.build.name=@project.name@ +info.build.description=@project.description@ +info.build.version=@project.version@ + +### Set the port for HTTP or HTTPS protocol (Controlled by Spring framework, only one at a time). +### (See below for the parameter 'server.http.port' if you want to have both enabled) +### To have only HTTP, keep the lines server.ssl.* commented +### To have only HTTPS enabled, uncomment the server.ssl.* lines and specify a right keystore location +server.port=8080 +### Settings for HTTPS (this automatically enables the HTTPS on the port 'server.port') +#server.ssl.key-store=file:/tmp/mykey.jks +#server.ssl.key-store-password=pass +#server.ssl.key-password=pass + +### In order to be user friendly when HTTPS is enabled, +### you can add another HTTP port that will be automatically redirected to HTTPS +### by enabling this parameter (server.http.port) and set it to another port (80 or 8080, 8090, etc ...) +#server.http-to-https-redirection.port=8090 + +### HTTP Example: +###-------------- +### server.port=8080 + +### HTTPS Example: +### -------------- +### server.port=8443 +### server.ssl.key-store=file:/tmp/mykey.jks +### server.ssl.key-store-password=mypass +### server.ssl.key-password=mypass + +### HTTP (Redirected to HTTPS) and HTTPS Example: +### -------------------------------------------- +### server.port=8443 <-- The HTTPS port +### server.ssl.key-store=file:/tmp/mykey.jks +### server.ssl.key-store-password=mypass +### server.ssl.key-password=mypass +### server.http-to-https-redirection.port=8090 <-- The HTTP port + +server.contextPath=/ +#Modified engine-rest applicationpath +spring.jersey.application-path=/engine-rest +spring.profiles.active=clamp-default,clamp-spring-authentication +spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration,org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration + +#The max number of active threads in this pool +server.tomcat.max-threads=200 +#The minimum number of threads always kept alive +server.tomcat.min-Spare-Threads=25 +#The number of milliseconds before an idle thread shutsdown, unless the number of active threads are less or equal to minSpareThreads +server.tomcat.max-idle-time=60000 + + +#Add this properties only if you want to change the URL, AJSC Framework interceptors will intercept +#com.att.ajsc.common.interceptors.PreInterceptor.url=/** +#com.att.ajsc.common.interceptors.PostInterceptor.url=/** + +#Servlet context parameters +server.context_parameters.p-name=value #context parameter with p-name as key and value as value. + +camel.springboot.consumer-template-cache-size=1000 +camel.springboot.producer-template-cache-size=1000 +camel.springboot.jmx-enabled=true +camel.defaultthreadpool.poolsize=10 +camel.defaultthreadpool.maxpoolsize=20 +camel.defaultthreadpool.maxqueuesize=1000 +camel.defaultthreadpool.keepaliveTime=60 +camel.defaultthreadpool.rejectpolicy=CallerRuns + +kubernetes.namespace=com-att-ajsc + +#server.port=0 + +#Camunda Process Engine DataSource connection Details +spring.datasource.camunda.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/camundabpm?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100 +spring.datasource.camunda.username=camunda +spring.datasource.camunda.password=ndMSpw4CAM +spring.datasource.camunda.driverClassName=com.mysql.jdbc.Driver +spring.datasource.camunda.validationQuery=SELECT 1 +spring.datasource.camunda.validationQueryTimeout=20000 +spring.datasource.camunda.validationInterval=60000 +spring.datasource.camunda.testWhileIdle = true +# Automatically test whether a connection provided is good or not +spring.datasource.camunda.testOnBorrow=true + +#Camunda application properties +#Camunda history level +camunda.bpm.history-level=auto + +#clds datasource connection details +spring.datasource.cldsdb.driver-class-name=com.mysql.jdbc.Driver +spring.datasource.cldsdb.url=jdbc:mysql://localhost:${docker.mariadb.port.host}/cldsdb4?verifyServerCertificate=false&useSSL=false&requireSSL=false&autoReconnect=true&maxReconnects=100 +spring.datasource.cldsdb.username=clds +spring.datasource.cldsdb.password=sidnnd83K +spring.datasource.cldsdb.driverClassName=com.mysql.jdbc.Driver +spring.datasource.cldsdb.validationQuery=SELECT 1 +spring.datasource.cldsdb.validationQueryTimeout=20000 +spring.datasource.cldsdb.validationInterval=60000 +spring.datasource.cldsdb.testWhileIdle = true +# Automatically test whether a connection provided is good or not +spring.datasource.cldsdb.testOnBorrow=true + +#Async Executor default Parameters +async.core.pool.size=10 +async.max.pool.size=20 +async.queue.capacity=500 + +org.onap.clamp.config.dcae.url=http://localhost:9000/closedloop-dcae-services + +#GRM Edge endpoint details +service.name=ajsc6camundademo +service.version=1.0.0.0 +routeoffer=TEST +#Update with your application name +application.name=AJSC6CAMUNDA + +org.onap.clamp.config.files.cldsReference=classpath:/clds/clds-reference.properties +org.onap.clamp.config.files.cldsPolicyConfig=classpath:/clds/clds-policy-config.properties +org.onap.clamp.config.files.cldsUsers=classpath:/clds/clds-users.json +org.onap.clamp.config.files.globalClds=classpath:/clds/globalClds.properties + +#Define user permission related parameters, the permission type can be changed but MUST be redefined in clds-users.properties in that case ! +CLDS_PERMISSION_TYPE_CL=permission-type-cl +CLDS_PERMISSION_TYPE_CL_MANAGE=permission-type-cl-manage +CLDS_PERMISSION_TYPE_CL_EVENT=permission-type-cl-event +CLDS_PERMISSION_TYPE_FILTER_VF=permission-type-filter-vf +CLDS_PERMISSION_TYPE_TEMPLATE=permission-type-template +#This one indicates the type of instances (dev|prod|perf...), this must be set accordingly in clds-users.properties CLDS_PERMISSION_INSTANCE=dev \ No newline at end of file -- cgit 1.2.3-korg