Support for Authorization Generic Filters

These will aid applications using there own authorization
system at their desired granularity.

Change-Id: Iba7fca8742127bcec177b93452f111d28c7f8ec7
Signed-off-by: Jorge Hernandez <jh1730@att.com>
Issue-ID: POLICY-1043

8 files changed, 283 insertions, 1 deletions

diff --git a/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/AuthorizationFilter.java b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/AuthorizationFilter.java
new file mode 100644
index 00000000..8ddf305f
--- /dev/null
+++ b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/AuthorizationFilter.java
@@ -0,0 +1,67 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP
+ * ================================================================================
+ * Copyright (C) 2018 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.common.endpoints.http.server;
+
+import java.io.IOException;
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public abstract class AuthorizationFilter implements Filter {
+
+    private static Logger logger = LoggerFactory.getLogger(AuthorizationFilter.class);
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
+        throws IOException, ServletException {
+
+        if (!(servletRequest instanceof HttpServletRequest)) {
+            throw new ServletException("Not an HttpServletRequest instance");
+        }
+
+        if (!(servletResponse instanceof HttpServletResponse)) {
+            throw new ServletException("Not an HttpServletResponse instance");
+        }
+
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+
+        String role = getRole(request);
+        boolean authorized = request.isUserInRole(role);
+
+        logger.info("user {} in role {}  is {}authorized to {}",
+            request.getUserPrincipal().getName(), role, ((authorized) ? "" : "NOT "), request.getMethod());
+
+        if (!authorized) {
+            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+        } else {
+            filterChain.doFilter(servletRequest, servletResponse);
+        }
+    }
+
+    protected abstract String getRole(HttpServletRequest request);
+}
diff --git a/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/HttpServletServerFactory.java b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/HttpServletServerFactory.java
index c789cd26..b5c701ac 100644
--- a/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/HttpServletServerFactory.java
+++ b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/HttpServletServerFactory.java
@@ -264,7 +264,6 @@ class IndexedHttpServletServerFactory implements HttpServletServerFactory {
                 }
             }
 
-
             serviceList.add(service);
         }
 
diff --git a/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/aaf/AafAuthFilter.java b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/aaf/AafAuthFilter.java
new file mode 100644
index 00000000..05267385
--- /dev/null
+++ b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/aaf/AafAuthFilter.java
@@ -0,0 +1,37 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP
+ * ================================================================================
+ * Copyright (C) 2018 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.common.endpoints.http.server.aaf;
+
+import javax.servlet.http.HttpServletRequest;
+import org.onap.policy.common.endpoints.http.server.AuthorizationFilter;
+
+public abstract class AafAuthFilter extends AuthorizationFilter {
+
+    @Override
+    protected String getRole(HttpServletRequest request) {
+        return
+            String.format("%s|%s|%s", getPermissionType(request), getPermissionInstance(request),
+                          request.getMethod().toLowerCase());
+    }
+
+    protected abstract String getPermissionType(HttpServletRequest request);
+    protected abstract String getPermissionInstance(HttpServletRequest request);
+}
diff --git a/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/aaf/AafGranularAuthFilter.java b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/aaf/AafGranularAuthFilter.java
new file mode 100644
index 00000000..86e35323
--- /dev/null
+++ b/policy-endpoints/src/main/java/org/onap/policy/common/endpoints/http/server/aaf/AafGranularAuthFilter.java
@@ -0,0 +1,51 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP
+ * ================================================================================
+ * Copyright (C) 2018 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.common.endpoints.http.server.aaf;
+
+import javax.servlet.http.HttpServletRequest;
+import org.onap.policy.common.utils.network.NetworkUtil;
+
+/**
+ * Allows per server direct permissions from all rest apis to aaf permission types
+ * for evaluation, hence the granularity.
+ */
+public abstract class AafGranularAuthFilter extends AafAuthFilter {
+
+    @Override
+    protected String getRole(HttpServletRequest request) {
+        return
+            String.format("%s|%s|%s", getPermissionType(request), getPermissionInstance(request),
+                request.getMethod().toLowerCase());
+    }
+
+    @Override
+    protected String getPermissionType(HttpServletRequest request) {
+        return getPermissionTypeRoot() + "." +
+                request.getRequestURI().replace('/', '.');
+    }
+
+    @Override
+    protected String getPermissionInstance(HttpServletRequest request) {
+        return NetworkUtil.getHostname();
+    }
+
+    public abstract String getPermissionTypeRoot();
+}
diff --git a/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/HttpClientTest.java b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/HttpClientTest.java
index 6805cdff..5ffde38e 100644
--- a/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/HttpClientTest.java
+++ b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/HttpClientTest.java
@@ -109,6 +109,9 @@ public class HttpClientTest {
         echoServerAuth.setBasicAuthentication("x", "y", null);
         echoServerAuth.addServletPackage("/*", HttpClientTest.class.getPackage().getName());
         echoServerAuth.addFilterClass("/*", TestFilter.class.getCanonicalName());
+        echoServerAuth.addFilterClass("/*", TestAuthorizationFilter.class.getCanonicalName());
+        echoServerAuth.addFilterClass("/*", TestAafAuthFilter.class.getCanonicalName());
+        echoServerAuth.addFilterClass("/*", TestAafGranularAuthFilter.class.getCanonicalName());
         echoServerAuth.waitedStart(5000);
 
         if (!NetworkUtil.isTcpPortOpen("localhost", echoServerAuth.getPort(), 5, 10000L)) {
diff --git a/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAafAuthFilter.java b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAafAuthFilter.java
new file mode 100644
index 00000000..27d45c8d
--- /dev/null
+++ b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAafAuthFilter.java
@@ -0,0 +1,47 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP
+ * ================================================================================
+ * Copyright (C) 2018 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.common.endpoints.http.server.test;
+
+import javax.servlet.http.HttpServletRequest;
+import org.onap.policy.common.endpoints.http.server.aaf.AafAuthFilter;
+
+public class TestAafAuthFilter extends AafAuthFilter {
+
+    @Override
+    protected String getRole(HttpServletRequest request) {
+        String expectedPerm = "test|test|" + request.getMethod().toLowerCase();
+        if (!expectedPerm.equals(super.getRole(request))) {
+            throw new IllegalStateException("unexpected permission");
+        } else {
+            return "user";
+        }
+    }
+
+    @Override
+    protected String getPermissionType(HttpServletRequest request) {
+        return "test";
+    }
+
+    @Override
+    protected String getPermissionInstance(HttpServletRequest request) {
+        return "test";
+    }
+}
\ No newline at end of file
diff --git a/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAafGranularAuthFilter.java b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAafGranularAuthFilter.java
new file mode 100644
index 00000000..cad6fb5c
--- /dev/null
+++ b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAafGranularAuthFilter.java
@@ -0,0 +1,46 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP
+ * ================================================================================
+ * Copyright (C) 2018 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.common.endpoints.http.server.test;
+
+import javax.servlet.http.HttpServletRequest;
+import org.onap.policy.common.endpoints.http.server.aaf.AafGranularAuthFilter;
+import org.onap.policy.common.utils.network.NetworkUtil;
+
+public class TestAafGranularAuthFilter extends AafGranularAuthFilter {
+
+    @Override
+    protected String getRole(HttpServletRequest request) {
+        String expectedPerm = this.getPermissionTypeRoot() + "."
+            + request.getRequestURI().replace('/', '.') + "|"
+            + NetworkUtil.getHostname() + "|"
+            + request.getMethod().toLowerCase();
+        if (!expectedPerm.equals(super.getRole(request))) {
+            throw new IllegalStateException("unexpected AAF granular permission");
+        } else {
+            return "user";
+        }
+    }
+
+    @Override
+    public String getPermissionTypeRoot() {
+        return "org.onap.policy";
+    }
+}
\ No newline at end of file
diff --git a/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAuthorizationFilter.java b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAuthorizationFilter.java
new file mode 100644
index 00000000..f3cd7424
--- /dev/null
+++ b/policy-endpoints/src/test/java/org/onap/policy/common/endpoints/http/server/test/TestAuthorizationFilter.java
@@ -0,0 +1,32 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP
+ * ================================================================================
+ * Copyright (C) 2018 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.common.endpoints.http.server.test;
+
+import javax.servlet.http.HttpServletRequest;
+import org.onap.policy.common.endpoints.http.server.AuthorizationFilter;
+
+public class TestAuthorizationFilter extends AuthorizationFilter {
+
+    @Override
+    protected String getRole(HttpServletRequest request) {
+        return "user";
+    }
+}
\ No newline at end of file