Merge "Enhancement to use the common CryptoUtils"

7 files changed, 240 insertions, 233 deletions

diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/PapUrlResolver.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/PapUrlResolver.java
index 5462dd908..0fab3db61 100644
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/PapUrlResolver.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/PapUrlResolver.java
@@ -2,7 +2,7 @@
  * ============LICENSE_START=======================================================
  * ONAP-PDP-REST
  * ================================================================================
- * Copyright (C) 2017-2018 AT&T Intellectual Property. All rights reserved.
+ * Copyright (C) 2017-2019 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 
 package org.onap.policy.pdp.rest;
 
+import com.att.research.xacml.util.XACMLProperties;
 import java.net.URI;
 import java.text.DateFormat;
 import java.text.ParseException;
@@ -28,13 +29,10 @@ import java.util.Date;
 import java.util.NoSuchElementException;
 import java.util.Objects;
 import java.util.Properties;
-
 import org.onap.policy.common.logging.flexlogger.FlexLogger;
 import org.onap.policy.common.logging.flexlogger.Logger;
 import org.onap.policy.rest.XACMLRestProperties;
-import org.onap.policy.utils.CryptoUtils;
-
-import com.att.research.xacml.util.XACMLProperties;
+import org.onap.policy.utils.PeCryptoUtils;
 
 public class PapUrlResolver {
     private static final Logger LOGGER = FlexLogger.getLogger(PapUrlResolver.class);
@@ -119,10 +117,11 @@ public class PapUrlResolver {
             String userId = null;
             String pass = null;
             userId = XACMLProperties.getProperty(urls[i] + "." + XACMLRestProperties.PROP_PAP_USERID);
-            pass = XACMLProperties.getProperty(urls[i] + "." + CryptoUtils.decryptTxtNoExStr(XACMLRestProperties.PROP_PAP_PASS));
+            pass = XACMLProperties.getProperty(urls[i] + "."
+                    + PeCryptoUtils.decrypt(XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_PASS)));
             if (userId == null || pass == null) {
                 userId = XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_USERID);
-                pass = CryptoUtils.decryptTxtNoExStr(XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_PASS));
+                pass = PeCryptoUtils.decrypt(XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_PASS));
             }
             if (userId == null || pass == null) {
                 userId = "";
diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpServlet.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpServlet.java
index c227d9d2a..c86e21c09 100644
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpServlet.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/XACMLPdpServlet.java
@@ -7,9 +7,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -20,6 +20,17 @@
 
 package org.onap.policy.pdp.rest;
 
+import com.att.research.xacml.api.Request;
+import com.att.research.xacml.api.Response;
+import com.att.research.xacml.api.pap.PDPStatus.Status;
+import com.att.research.xacml.api.pdp.PDPEngine;
+import com.att.research.xacml.api.pdp.PDPException;
+import com.att.research.xacml.std.dom.DOMRequest;
+import com.att.research.xacml.std.dom.DOMResponse;
+import com.att.research.xacml.std.json.JSONRequest;
+import com.att.research.xacml.std.json.JSONResponse;
+import com.att.research.xacml.util.XACMLProperties;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import java.io.BufferedReader;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
@@ -60,40 +71,30 @@ import org.onap.policy.common.logging.eelf.PolicyLogger;
 import org.onap.policy.pdp.rest.jmx.PdpRestMonitor;
 import org.onap.policy.rest.XACMLRest;
 import org.onap.policy.rest.XACMLRestProperties;
+import org.onap.policy.utils.PeCryptoUtils;
 import org.onap.policy.xacml.api.XACMLErrorConstants;
 import org.onap.policy.xacml.pdp.std.functions.PolicyList;
 import org.onap.policy.xacml.std.pap.StdPDPStatus;
-import com.att.research.xacml.api.Request;
-import com.att.research.xacml.api.Response;
-import com.att.research.xacml.api.pap.PDPStatus.Status;
-import com.att.research.xacml.api.pdp.PDPEngine;
-import com.att.research.xacml.api.pdp.PDPException;
-import com.att.research.xacml.std.dom.DOMRequest;
-import com.att.research.xacml.std.dom.DOMResponse;
-import com.att.research.xacml.std.json.JSONRequest;
-import com.att.research.xacml.std.json.JSONResponse;
-import com.att.research.xacml.util.XACMLProperties;
-import com.fasterxml.jackson.databind.ObjectMapper;
 
 /**
  * Servlet implementation class XacmlPdpServlet
- * 
+ *
  * This is an implementation of the XACML 3.0 RESTful Interface with added features to support simple PAP RESTful API
  * for policy publishing and PIP configuration changes.
- * 
+ *
  * If you are running this the first time, then we recommend you look at the xacml.pdp.properties file. This properties
  * file has all the default parameter settings. If you are running the servlet as is, then we recommend setting up
  * you're container to run it on port 8080 with context "/pdp". Wherever the default working directory is set to, a
  * "config" directory will be created that holds the policy and pip cache. This setting is located in the
  * xacml.pdp.properties file.
- * 
+ *
  * When you are ready to customize, you can create a separate xacml.pdp.properties on you're local file system and setup
  * the parameters as you wish. Just set the Java VM System variable to point to that file:
- * 
+ *
  * -Dxacml.properties=/opt/app/xacml/etc/xacml.pdp.properties
- * 
+ *
  * Or if you only want to change one or two properties, simply set the Java VM System variable for that property.
- * 
+ *
  * -Dxacml.rest.pdp.register=false
  *
  *
@@ -268,9 +269,13 @@ public class XACMLPdpServlet extends HttpServlet implements Runnable {
                 properties.getProperty("createUpdatePolicy.impl.className", CREATE_UPDATE_POLICY_SERVICE);
         setCreateUpdatePolicyConstructor(createUpdateResourceName);
 
+        PeCryptoUtils.initAesKey(properties.getProperty(XACMLRestProperties.PROP_AES_KEY));
+
         // Create an IntegrityMonitor
         try {
             logger.info("Creating IntegrityMonitor");
+            properties.setProperty("javax.persistence.jdbc.password",
+                    PeCryptoUtils.decrypt(properties.getProperty("javax.persistence.jdbc.password", "")));
             im = IntegrityMonitor.getInstance(pdpResourceName, properties);
         } catch (Exception e) {
             PolicyLogger.error(MessageCodes.ERROR_SYSTEM_ERROR, e, "Failed to create IntegrityMonitor" + e);
@@ -380,42 +385,42 @@ public class XACMLPdpServlet extends HttpServlet implements Runnable {
 
     /**
      * PUT - The PAP engine sends configuration information using HTTP PUT request.
-     * 
+     *
      * One parameter is expected:
-     * 
+     *
      * config=[policy|pip|all]
-     * 
+     *
      * policy - Expect a properties file that contains updated lists of the root and referenced policies that the PDP
      * should be using for PEP requests.
-     * 
+     *
      * Specifically should AT LEAST contain the following properties: xacml.rootPolicies xacml.referencedPolicies
-     * 
+     *
      * In addition, any relevant information needed by the PDP to load or retrieve the policies to store in its cache.
      *
      * EXAMPLE: xacml.rootPolicies=PolicyA.1, PolicyB.1
      *
      * PolicyA.1.url=http://localhost:9090/PAP?id=b2d7b86d-d8f1-4adf-ba9d-b68b2a90bee1&version=1
      * PolicyB.1.url=http://localhost:9090/PAP/id=be962404-27f6-41d8-9521-5acb7f0238be&version=1
-     * 
+     *
      * xacml.referencedPolicies=RefPolicyC.1, RefPolicyD.1
      *
      * RefPolicyC.1.url=http://localhost:9090/PAP?id=foobar&version=1
      * RefPolicyD.1.url=http://localhost:9090/PAP/id=example&version=1
-     * 
+     *
      * pip - Expect a properties file that contain PIP engine configuration properties.
-     * 
+     *
      * Specifically should AT LEAST the following property: xacml.pip.engines
-     * 
+     *
      * In addition, any relevant information needed by the PDP to load and configure the PIPs.
-     * 
+     *
      * EXAMPLE: xacml.pip.engines=foo,bar
-     * 
+     *
      * foo.classname=com.foo foo.sample=abc foo.example=xyz ......
-     * 
+     *
      * bar.classname=com.bar ......
-     * 
+     *
      * all - Expect ALL new configuration properties for the PDP
-     * 
+     *
      * @see HttpServlet#doPut(HttpServletRequest request, HttpServletResponse response)
      */
     @Override
@@ -625,13 +630,13 @@ public class XACMLPdpServlet extends HttpServlet implements Runnable {
 
     /**
      * Parameters: type=hb|config|Status
-     * 
+     *
      * 1. HeartBeat Status HeartBeat OK - All Policies are Loaded, All PIPs are Loaded LOADING_IN_PROGRESS - Currently
      * loading a new policy set/pip configuration LAST_UPDATE_FAILED - Need to track the items that failed during last
      * update LOAD_FAILURE - ??? Need to determine what information is sent and how 2. Configuration 3. Status return
      * the StdPDPStatus object in the Response content
-     * 
-     * 
+     *
+     *
      * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
      */
     @Override
@@ -812,8 +817,8 @@ public class XACMLPdpServlet extends HttpServlet implements Runnable {
     /**
      * POST - We expect XACML requests to be posted by PEP applications. They can be in the form of XML or JSON
      * according to the XACML 3.0 Specifications for both.
-     * 
-     * 
+     *
+     *
      * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
      */
     @Override
diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java
index 425bcebf9..7704a96a6 100644
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/api/services/PAPServices.java
@@ -2,14 +2,14 @@
  * ============LICENSE_START=======================================================
  * ONAP-PDP-REST
  * ================================================================================
- * Copyright (C) 2017-2018 AT&T Intellectual Property. All rights reserved.
+ * Copyright (C) 2017-2019 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -17,8 +17,11 @@
  * limitations under the License.
  * ============LICENSE_END=========================================================
  */
+
 package org.onap.policy.pdp.rest.api.services;
 
+import com.att.research.xacml.util.XACMLProperties;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -33,20 +36,16 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
-
 import org.apache.commons.io.IOUtils;
 import org.onap.policy.api.PolicyException;
 import org.onap.policy.common.logging.flexlogger.FlexLogger;
 import org.onap.policy.common.logging.flexlogger.Logger;
 import org.onap.policy.pdp.rest.config.PDPApiAuth;
 import org.onap.policy.rest.XACMLRestProperties;
-import org.onap.policy.utils.CryptoUtils;
+import org.onap.policy.utils.PeCryptoUtils;
 import org.onap.policy.xacml.api.XACMLErrorConstants;
 import org.onap.policy.xacml.std.pap.StdPDPPolicy;
 
-import com.att.research.xacml.util.XACMLProperties;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 public class PAPServices {
     private static final String SUCCESS = "success";
     private static Logger LOGGER = FlexLogger.getLogger(PAPServices.class.getName());
@@ -79,10 +78,9 @@ public class PAPServices {
 
     private String getPAPEncoding() {
         if (encoding == null) {
-            final String userID = XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_USERID);
-            final String pass =
-                    CryptoUtils.decryptTxtNoExStr(XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_PASS));
-            final Base64.Encoder encoder = Base64.getEncoder();
+            String userID = XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_USERID);
+            String pass = PeCryptoUtils.decrypt(XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_PASS));
+            Base64.Encoder encoder = Base64.getEncoder();
             encoding = encoder.encodeToString((userID + ":" + pass).getBytes(StandardCharsets.UTF_8));
         }
         return encoding;
@@ -131,7 +129,7 @@ public class PAPServices {
                 String fullURL = getPAP();
                 fullURL = checkParameter(parameters, fullURL);
                 final URL url = new URL(fullURL);
-                LOGGER.debug("--- Sending Request to PAP : " + url.toString() + " ---");
+                LOGGER.info("--- Sending Request to PAP : " + url.toString() + " ---" + " RequestId:" + requestID);
                 // Open the connection
                 connection = (HttpURLConnection) url.openConnection();
                 // Setting Content-Type
@@ -149,9 +147,9 @@ public class PAPServices {
                 // Adding RequestID
                 if (requestID == null) {
                     requestID = UUID.randomUUID();
-                    LOGGER.info("No request ID provided, sending generated ID: " + requestID.toString());
+                    LOGGER.debug("No request ID provided, sending generated ID: " + requestID.toString());
                 } else {
-                    LOGGER.info("Using provided request ID: " + requestID.toString());
+                    LOGGER.debug("Using provided request ID: " + requestID.toString());
                 }
                 connection.setRequestProperty("X-ECOMP-RequestID", requestID.toString());
                 if (content != null && (content instanceof InputStream)) {
@@ -168,6 +166,9 @@ public class PAPServices {
                     if (!isJunit) {
                         mapper.writeValue(connection.getOutputStream(), content);
                     }
+                } else {
+                    LOGGER.info(XACMLErrorConstants.ERROR_DATA_ISSUE + "content is null for calling: " + url.getHost()
+                            + requestID.toString());
                 }
                 // DO the connect
                 connection.connect();
@@ -215,10 +216,12 @@ public class PAPServices {
                 }
             } else {
                 response = XACMLErrorConstants.ERROR_SYSTEM_ERROR + "connection is null";
+                LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR + "connection is null - RequestId: " + requestID);
             }
             return response;
         } else {
             response = XACMLErrorConstants.ERROR_DATA_ISSUE + "Unable to get valid response from PAP(s) " + paps;
+            LOGGER.error("For RequestId: " + requestID + ", " + response);
             return response;
         }
     }
@@ -228,7 +231,7 @@ public class PAPServices {
         String version = null;
         HttpURLConnection connection = null;
         final String[] parameters = {"apiflag=version", "policyScope=" + policyScope, "filePrefix=" + filePrefix,
-            "policyName=" + policyName};
+                "policyName=" + policyName};
         if (paps == null || paps.isEmpty()) {
             LOGGER.error(XACMLErrorConstants.ERROR_DATA_ISSUE + "PAPs List is Empty.");
         } else {
@@ -311,7 +314,8 @@ public class PAPServices {
                         version = "pe300";
                     } else {
                         LOGGER.error(XACMLErrorConstants.ERROR_DATA_ISSUE
-                                + "BAD REQUEST:  Error occured while getting the version from the PAP. The request may be incorrect. The response code of the URL is '"
+                                + "BAD REQUEST:  Error occured while getting the version from the PAP. "
+                                + "The request may be incorrect. The response code of the URL is '"
                                 + connection.getResponseCode() + "'");
                     }
                 } catch (final IOException e) {
@@ -436,14 +440,16 @@ public class PAPServices {
                         + "Please create a new Dictionary Item or use the update API to modify the existing one.";
             } else if ("duplicateGroup".equals(connection.getHeaderField("error"))) {
                 response = XACMLErrorConstants.ERROR_DATA_ISSUE
-                        + "Group Policy Scope List Exist Error:  The Group Policy Scope List for this Dictionary Item already exist in the database. "
+                        + "Group Policy Scope List Exist Error:  "
+                        + "The Group Policy Scope List for this Dictionary Item already exist in the database. "
                         + "Duplicate Group Policy Scope Lists for multiple groupNames is not allowed. "
-                        + "Please review the request and verify that the groupPolicyScopeListData1 is unique compared to existing groups.";
+                        + "Please review the request and "
+                        + "verify that the groupPolicyScopeListData1 is unique compared to existing groups.";
             } else if ("PolicyInPDP".equals(connection.getHeaderField("error"))) {
                 response = XACMLErrorConstants.ERROR_DATA_ISSUE
                         + "Policy Exist Error:  The Policy trying to be deleted is active in PDP. "
                         + "Active PDP Polcies are not allowed to be deleted from PAP. "
-                        + "Please First remove the policy from PDP in order to successfully delete the Policy from PAP.";
+                        + "Please First remove the policy from PDP in order to successfully delete the Policy from PAP";
             }
             LOGGER.error(response);
         } else if (connection.getResponseCode() == 500 && connection.getHeaderField("error") != null) {
@@ -457,7 +463,8 @@ public class PAPServices {
                 response = connection.getHeaderField("message");
             } else if ("unknown".equals(connection.getHeaderField("error"))) {
                 response = XACMLErrorConstants.ERROR_UNKNOWN
-                        + "Failed to delete the policy for an unknown reason.  Check the file system and other logs for further information.";
+                        + "Failed to delete the policy for an unknown reason.  "
+                        + "Check the file system and other logs for further information.";
             } else if ("deleteConfig".equals(connection.getHeaderField("error"))) {
                 response = XACMLErrorConstants.ERROR_DATA_ISSUE
                         + "Cannot delete the configuration or action body file in specified location.";
diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPApiAuth.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPApiAuth.java
index 246f5a26d..163298186 100644
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPApiAuth.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPApiAuth.java
@@ -2,14 +2,14 @@
  * ============LICENSE_START=======================================================
  * ONAP-PDP-REST
  * ================================================================================
- * Copyright (C) 2017-2018 AT&T Intellectual Property. All rights reserved.
+ * Copyright (C) 2017-2019 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -17,8 +17,10 @@
  * limitations under the License.
  * ============LICENSE_END=========================================================
  */
+
 package org.onap.policy.pdp.rest.config;
 
+import com.att.research.xacml.util.XACMLProperties;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -33,7 +35,6 @@ import java.util.List;
 import java.util.Map;
 import java.util.Properties;
 import java.util.StringTokenizer;
-
 import org.onap.policy.api.PolicyEngineException;
 import org.onap.policy.common.logging.eelf.MessageCodes;
 import org.onap.policy.common.logging.flexlogger.FlexLogger;
@@ -41,21 +42,20 @@ import org.onap.policy.common.logging.flexlogger.Logger;
 import org.onap.policy.rest.XACMLRestProperties;
 import org.onap.policy.utils.AAFPolicyClient;
 import org.onap.policy.utils.AAFPolicyException;
+import org.onap.policy.utils.PeCryptoUtils;
 import org.onap.policy.utils.PolicyUtils;
 import org.onap.policy.xacml.api.XACMLErrorConstants;
 
-import com.att.research.xacml.util.XACMLProperties;
-
 public class PDPApiAuth {
     private static final Logger LOGGER = FlexLogger.getLogger(PDPApiAuth.class);
 
     private static String environment = null;
     private static Path clientPath = null;
-    private static Map<String,ArrayList<String>> clientMap = null;
+    private static Map<String, ArrayList<String>> clientMap = null;
     private static Long oldModified = null;
     private static AAFPolicyClient aafClient = null;
 
-    private PDPApiAuth(){
+    private PDPApiAuth() {
         // Private Constructor
     }
 
@@ -65,7 +65,7 @@ public class PDPApiAuth {
     public static void setProperty() {
         environment = XACMLProperties.getProperty("ENVIRONMENT", "DEVL");
         String clientFile = XACMLProperties.getProperty(XACMLRestProperties.PROP_PEP_IDFILE);
-        if(clientFile!=null){
+        if (clientFile != null) {
             clientPath = Paths.get(clientFile);
         }
         try {
@@ -76,84 +76,84 @@ public class PDPApiAuth {
     }
 
     /*
-     * Return Environment value of the PDP servlet. 
+     * Return Environment value of the PDP servlet.
      */
     public static String getEnvironment() {
-        if(environment==null){
+        if (environment == null) {
             setProperty();
         }
         return environment;
     }
 
     /*
-     * Security check for authentication and authorizations. 
+     * Security check for authentication and authorizations.
      */
-    public static boolean checkPermissions(String clientEncoding, String requestID,
-            String resource) {
-        try{            
+    public static boolean checkPermissions(String clientEncoding, String requestID, String resource) {
+        try {
             String[] userNamePass = PolicyUtils.decodeBasicEncoding(clientEncoding);
-            if(userNamePass==null || userNamePass.length==0){
+            if (userNamePass == null || userNamePass.length == 0) {
                 String usernameAndPassword = null;
                 byte[] decodedBytes = Base64.getDecoder().decode(clientEncoding);
                 usernameAndPassword = new String(decodedBytes, "UTF-8");
                 StringTokenizer tokenizer = new StringTokenizer(usernameAndPassword, ":");
                 String username = tokenizer.nextToken();
                 String password = tokenizer.nextToken();
-                userNamePass=  new String[]{username,  password};
+                userNamePass = new String[] {username, password};
             }
             LOGGER.info("User " + userNamePass[0] + " is Accessing Policy Engine API.");
             Boolean result = false;
-            // Check Backward Compatibility. 
-            try{
+            // Check Backward Compatibility.
+            try {
                 /*
-                 * If AAF is NOT enabled in the properties we will allow the user to 
-                 * continue to use the client.properties file to authenticate.
-                 * Note: Disabling AAF is for testing purposes and not intended for production.
+                 * If AAF is NOT enabled in the properties we will allow the user to continue to use the
+                 * client.properties file to authenticate. Note: Disabling AAF is for testing purposes and not intended
+                 * for production.
                  */
                 if ("false".equals(XACMLProperties.getProperty("enable_aaf"))) {
                     result = clientAuth(userNamePass);
                 }
-            }catch(Exception e){
+            } catch (Exception e) {
                 LOGGER.error(MessageCodes.ERROR_PERMISSIONS, e);
             }
-            if(!result){
+            if (!result) {
                 String aafPolicyNameSpace = XACMLProperties.getProperty("policy.aaf.namespace");
                 String aafResource = XACMLProperties.getProperty("policy.aaf.root.permission");
                 String type = null;
-                if(!userNamePass[0].contains("@") && aafPolicyNameSpace!= null){
+                if (!userNamePass[0].contains("@") && aafPolicyNameSpace != null) {
                     userNamePass[0] = userNamePass[0] + "@" + reverseNamespace(aafPolicyNameSpace);
-                }else{
+                } else {
                     LOGGER.info("No AAF NameSpace specified in properties");
                 }
-                if(aafResource != null){
+                if (aafResource != null) {
                     type = aafResource + "." + resource;
-                }else{
+                } else {
                     LOGGER.warn("No AAF Resource specified in properties");
                     return false;
                 }
-                LOGGER.info("Contacting AAF in : "  + environment);
+                LOGGER.info("Contacting AAF in : " + environment);
                 result = aafClient.checkAuthPerm(userNamePass[0], userNamePass[1], type, environment, "*");
             }
             return result;
-        }catch(Exception e){
+        } catch (Exception e) {
             LOGGER.error(MessageCodes.ERROR_PERMISSIONS, e);
             return false;
         }
     }
 
-    private static Boolean clientAuth(String[] userNamePass){
-        if(clientPath==null){
+    private static Boolean clientAuth(String[] userNamePass) {
+        if (clientPath == null) {
             setProperty();
         }
         if (!clientPath.toFile().exists()) {
             return false;
-        }else if(clientPath.toString().endsWith(".properties")) {
+        } else if (clientPath.toString().endsWith(".properties")) {
             try {
                 readProps(clientPath);
-                if (clientMap.containsKey(userNamePass[0]) && clientMap.get(userNamePass[0]).get(0).equals(userNamePass[1])) {
+                if (clientMap.containsKey(userNamePass[0])
+                        && clientMap.get(userNamePass[0]).get(0).equals(userNamePass[1])) {
                     return true;
                 }
-            }catch(PolicyEngineException e){
+            } catch (PolicyEngineException e) {
                 LOGGER.error(MessageCodes.ERROR_PERMISSIONS, e);
                 return false;
             }
@@ -163,12 +163,12 @@ public class PDPApiAuth {
 
     private static String reverseNamespace(String namespace) {
         final List<String> components = Arrays.asList(namespace.split("\\."));
-        Collections.reverse(components);   
+        Collections.reverse(components);
         return String.join(".", components);
     }
 
-    private static Map<String, ArrayList<String>> readProps(Path clientPath) throws PolicyEngineException{
-        if(oldModified!=null){
+    private static Map<String, ArrayList<String>> readProps(Path clientPath) throws PolicyEngineException {
+        if (oldModified != null) {
             Long newModified = clientPath.toFile().lastModified();
             if (newModified == oldModified) {
                 return clientMap;
@@ -180,27 +180,31 @@ public class PDPApiAuth {
             in = new FileInputStream(clientPath.toFile());
             clientProp.load(in);
         } catch (IOException e) {
-            LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR , e);
-            throw new PolicyEngineException(XACMLErrorConstants.ERROR_SYSTEM_ERROR +"Cannot Load the Properties file", e);
+            LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR, e);
+            throw new PolicyEngineException(XACMLErrorConstants.ERROR_SYSTEM_ERROR + "Cannot Load the Properties file",
+                    e);
         }
         // Read the Properties and Load the Clients and their scopes.
         clientMap = new HashMap<>();
-        // 
+        //
         for (Object propKey : clientProp.keySet()) {
-            String clientID = (String)propKey; 
+            String clientID = (String) propKey;
             String clientValue = clientProp.getProperty(clientID);
             if (clientValue != null && clientValue.contains(",")) {
                 ArrayList<String> clientValues = new ArrayList<>(Arrays.asList(clientValue.split("\\s*,\\s*")));
-                if(clientValues.get(0)!=null || clientValues.get(1)!=null || clientValues.get(0).isEmpty() || clientValues.get(1).isEmpty()){
+                if (clientValues.get(0) != null || clientValues.get(1) != null || clientValues.get(0).isEmpty()
+                        || clientValues.get(1).isEmpty()) {
+                    clientValues.set(0, PeCryptoUtils.decrypt(clientValues.get(0)));
                     clientMap.put(clientID, clientValues);
                 }
             }
         }
         if (clientMap.isEmpty()) {
-            LOGGER.debug(XACMLErrorConstants.ERROR_PERMISSIONS + "No Clients ID , Client Key and Scopes are available. Cannot serve any Clients !!");
+            LOGGER.debug(XACMLErrorConstants.ERROR_PERMISSIONS
+                    + "No Clients ID , Client Key and Scopes are available. Cannot serve any Clients !!");
             throw new PolicyEngineException("Empty Client file");
         }
         oldModified = clientPath.toFile().lastModified();
         return clientMap;
     }
-}
\ No newline at end of file
+}
diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPRestConfig.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPRestConfig.java
index b563c6cce..9c3213bef 100644
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPRestConfig.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/config/PDPRestConfig.java
@@ -2,14 +2,14 @@
  * ============LICENSE_START=======================================================
  * ONAP-PDP-REST
  * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
+ * Copyright (C) 2017,2019 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -17,23 +17,21 @@
  * limitations under the License.
  * ============LICENSE_END=========================================================
  */
+
 package org.onap.policy.pdp.rest.config;
 
 import java.io.FileInputStream;
-import java.io.IOException;
 import java.io.InputStream;
 import java.util.Properties;
-
 import javax.annotation.PostConstruct;
 import javax.servlet.MultipartConfigElement;
 import javax.sql.DataSource;
-
 import org.apache.tomcat.dbcp.dbcp2.BasicDataSource;
 import org.hibernate.SessionFactory;
 import org.onap.policy.common.logging.eelf.PolicyLogger;
 import org.onap.policy.common.logging.flexlogger.FlexLogger;
 import org.onap.policy.common.logging.flexlogger.Logger;
-import org.onap.policy.pdp.rest.api.controller.PolicyEngineServices;
+import org.onap.policy.utils.PeCryptoUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
@@ -43,7 +41,6 @@ import org.springframework.orm.hibernate4.LocalSessionFactoryBuilder;
 import org.springframework.web.servlet.config.annotation.EnableWebMvc;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
-
 import springfox.documentation.builders.ApiInfoBuilder;
 import springfox.documentation.builders.PathSelectors;
 import springfox.documentation.builders.RequestHandlerSelectors;
@@ -55,124 +52,118 @@ import springfox.documentation.swagger2.annotations.EnableSwagger2;
 @Configuration
 @EnableWebMvc
 @EnableSwagger2
-@ComponentScan(basePackages = { "org.onap.*", "com.*" })
-public class PDPRestConfig extends WebMvcConfigurerAdapter{
-	
-	private static final Logger LOGGER	= FlexLogger.getLogger(PDPRestConfig.class);
-
-	private static String dbDriver = null;
-	private static String dbUrl = null;
-	private static String dbUserName = null;
-	private static String dbPassword = null;
-	
-	@PostConstruct
-	public void init(){
-		Properties prop = new Properties();
-		try (InputStream input = new FileInputStream("xacml.pdp.properties")){
-			// load a properties file
-			prop.load(input);
-			setDbDriver(prop.getProperty("javax.persistence.jdbc.driver"));
-			setDbUrl(prop.getProperty("javax.persistence.jdbc.url"));
-			setDbUserName(prop.getProperty("javax.persistence.jdbc.user"));
-			setDbPassword(prop.getProperty("javax.persistence.jdbc.password"));
-		}catch(Exception e){
-			LOGGER.error("Exception Occured while loading properties file"+e);
-		}
-	}
-	
-	@Override 
+@ComponentScan(basePackages = {"org.onap.*", "com.*"})
+public class PDPRestConfig extends WebMvcConfigurerAdapter {
+
+    private static final Logger LOGGER = FlexLogger.getLogger(PDPRestConfig.class);
+
+    private static String dbDriver = null;
+    private static String dbUrl = null;
+    private static String dbUserName = null;
+    private static String dbPassword = null;
+
+    @PostConstruct
+    public void init() {
+        Properties prop = new Properties();
+        try (InputStream input = new FileInputStream("xacml.pdp.properties")) {
+            // load a properties file
+            prop.load(input);
+            setDbDriver(prop.getProperty("javax.persistence.jdbc.driver"));
+            setDbUrl(prop.getProperty("javax.persistence.jdbc.url"));
+            setDbUserName(prop.getProperty("javax.persistence.jdbc.user"));
+            PeCryptoUtils.initAesKey(prop.getProperty("org.onap.policy.encryption.aes.key"));
+            setDbPassword(PeCryptoUtils.decrypt(prop.getProperty("javax.persistence.jdbc.password")));
+        } catch (Exception e) {
+            LOGGER.error("Exception Occured while loading properties file" + e);
+        }
+    }
+
+    @Override
     public void addResourceHandlers(ResourceHandlerRegistry registry) {
         registry.addResourceHandler("swagger-ui.html").addResourceLocations("classpath:/META-INF/resources/");
         registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
     }
-    
-    private ApiInfo apiInfo(){
-        return new ApiInfoBuilder()
-                .title("Policy Engine REST API")
-                .description("This API helps to make queries against Policy Engine")
-                .version("3.0")
-                .build();
+
+    private ApiInfo apiInfo() {
+        return new ApiInfoBuilder().title("Policy Engine REST API")
+                .description("This API helps to make queries against Policy Engine").version("3.0").build();
     }
-    
+
     @Bean
-    public Docket policyAPI(){
+    public Docket policyAPI() {
         PolicyLogger.info("Setting up Swagger... ");
-        return new Docket(DocumentationType.SWAGGER_2)                
-                .select()
-                .apis(RequestHandlerSelectors.basePackage("org.onap.policy.pdp.rest.api"))
-                .paths(PathSelectors.any())
-                .build()
-                .apiInfo(apiInfo());
-    }
-    
-	@Bean(name = "dataSource")
-	public DataSource getDataSource() {
-	    BasicDataSource dataSource = new BasicDataSource();
-	    dataSource.setDriverClassName(PDPRestConfig.getDbDriver());
-	    dataSource.setUrl(PDPRestConfig.getDbUrl());
-	    dataSource.setUsername(PDPRestConfig.getDbUserName());
-	    dataSource.setPassword(PDPRestConfig.getDbPassword());
-	    return dataSource;
-	}
-	
-	@Autowired
-	@Bean(name = "sessionFactory")
-	public SessionFactory getSessionFactory(DataSource dataSource) {
-	    LocalSessionFactoryBuilder sessionBuilder = new LocalSessionFactoryBuilder(dataSource);
-	    sessionBuilder.scanPackages("org.onap.*", "com.*");
-	    sessionBuilder.addProperties(getHibernateProperties());
-	    return sessionBuilder.buildSessionFactory();
-	}
-	
-	private Properties getHibernateProperties() {
-		Properties properties = new Properties();
-		properties.put("hibernate.show_sql", "true");
-		properties.put("hibernate.dialect", "org.hibernate.dialect.MySQLDialect");
-		return properties;
-	}
-	
-	@Autowired
-	@Bean(name = "transactionManager")
-	public HibernateTransactionManager getTransactionManager(SessionFactory sessionFactory) {
-		return new HibernateTransactionManager(sessionFactory);
-	}
-    
+        return new Docket(DocumentationType.SWAGGER_2).select()
+                .apis(RequestHandlerSelectors.basePackage("org.onap.policy.pdp.rest.api")).paths(PathSelectors.any())
+                .build().apiInfo(apiInfo());
+    }
+
+    @Bean(name = "dataSource")
+    public DataSource getDataSource() {
+        BasicDataSource dataSource = new BasicDataSource();
+        dataSource.setDriverClassName(PDPRestConfig.getDbDriver());
+        dataSource.setUrl(PDPRestConfig.getDbUrl());
+        dataSource.setUsername(PDPRestConfig.getDbUserName());
+        dataSource.setPassword(PDPRestConfig.getDbPassword());
+        return dataSource;
+    }
+
+    @Autowired
+    @Bean(name = "sessionFactory")
+    public SessionFactory getSessionFactory(DataSource dataSource) {
+        LocalSessionFactoryBuilder sessionBuilder = new LocalSessionFactoryBuilder(dataSource);
+        sessionBuilder.scanPackages("org.onap.*", "com.*");
+        sessionBuilder.addProperties(getHibernateProperties());
+        return sessionBuilder.buildSessionFactory();
+    }
+
+    private Properties getHibernateProperties() {
+        Properties properties = new Properties();
+        properties.put("hibernate.show_sql", "true");
+        properties.put("hibernate.dialect", "org.hibernate.dialect.MySQLDialect");
+        return properties;
+    }
+
+    @Autowired
+    @Bean(name = "transactionManager")
+    public HibernateTransactionManager getTransactionManager(SessionFactory sessionFactory) {
+        return new HibernateTransactionManager(sessionFactory);
+    }
+
     @Bean
-    public MultipartConfigElement multipartConfigElement(){
+    public MultipartConfigElement multipartConfigElement() {
         String location = System.getProperty("java.io.tmpdir");
-        MultipartConfigElement mp = new MultipartConfigElement(location);
-        return mp;
+        return new MultipartConfigElement(location);
     }
 
-	public static String getDbDriver() {
-		return dbDriver;
-	}
+    public static String getDbDriver() {
+        return dbDriver;
+    }
 
-	public static void setDbDriver(String dbDriver) {
-		PDPRestConfig.dbDriver = dbDriver;
-	}
+    public static void setDbDriver(String dbDriver) {
+        PDPRestConfig.dbDriver = dbDriver;
+    }
 
-	public static String getDbUrl() {
-		return dbUrl;
-	}
+    public static String getDbUrl() {
+        return dbUrl;
+    }
 
-	public static void setDbUrl(String dbUrl) {
-		PDPRestConfig.dbUrl = dbUrl;
-	}
+    public static void setDbUrl(String dbUrl) {
+        PDPRestConfig.dbUrl = dbUrl;
+    }
 
-	public static String getDbUserName() {
-		return dbUserName;
-	}
+    public static String getDbUserName() {
+        return dbUserName;
+    }
 
-	public static void setDbUserName(String dbUserName) {
-		PDPRestConfig.dbUserName = dbUserName;
-	}
+    public static void setDbUserName(String dbUserName) {
+        PDPRestConfig.dbUserName = dbUserName;
+    }
 
-	public static String getDbPassword() {
-		return dbPassword;
-	}
+    public static String getDbPassword() {
+        return dbPassword;
+    }
 
-	public static void setDbPassword(String dbPassword) {
-		PDPRestConfig.dbPassword = dbPassword;
-	}
+    public static void setDbPassword(String dbPassword) {
+        PDPRestConfig.dbPassword = dbPassword;
+    }
 }
diff --git a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/restAuth/AuthenticationService.java b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/restAuth/AuthenticationService.java
index 0d066c59c..b1b092431 100644
--- a/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/restAuth/AuthenticationService.java
+++ b/ONAP-PDP-REST/src/main/java/org/onap/policy/pdp/rest/restAuth/AuthenticationService.java
@@ -2,14 +2,14 @@
  * ============LICENSE_START=======================================================
  * ONAP-PDP-REST
  * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
+ * Copyright (C) 2017,2019 AT&T Intellectual Property. All rights reserved.
  * ================================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -20,25 +20,23 @@
 
 package org.onap.policy.pdp.rest.restAuth;
 
+import com.att.research.xacml.util.XACMLProperties;
 import java.util.Base64;
 import java.util.StringTokenizer;
-
-import org.onap.policy.rest.XACMLRestProperties;
-
-import com.att.research.xacml.util.XACMLProperties;
-
 import org.onap.policy.common.logging.eelf.MessageCodes;
 import org.onap.policy.common.logging.eelf.PolicyLogger;
+import org.onap.policy.rest.XACMLRestProperties;
+import org.onap.policy.utils.PeCryptoUtils;
 
 public class AuthenticationService {
 	private String pdpID = XACMLProperties.getProperty(XACMLRestProperties.PROP_PDP_USERID);
-	private String pdpPass = XACMLProperties.getProperty(XACMLRestProperties.PROP_PDP_PASS);
-	
+	private String pdpPass = PeCryptoUtils.decrypt(XACMLProperties.getProperty(XACMLRestProperties.PROP_PDP_PASS));
+
 	public boolean authenticate(String authCredentials) {
 
 		if (null == authCredentials)
 			return false;
-		// header value format will be "Basic encodedstring" for Basic authentication. 
+		// header value format will be "Basic encodedstring" for Basic authentication.
 		final String encodedUserPassword = authCredentials.replaceFirst("Basic"	+ " ", "");
 		String usernameAndPassword = null;
 		try {
@@ -58,5 +56,5 @@ public class AuthenticationService {
 			return false;
 		}
 	}
-	
+
 }
diff --git a/ONAP-PDP-REST/xacml.pdp.properties b/ONAP-PDP-REST/xacml.pdp.properties
index 90e0f5c3c..51feec6f5 100644
--- a/ONAP-PDP-REST/xacml.pdp.properties
+++ b/ONAP-PDP-REST/xacml.pdp.properties
@@ -199,3 +199,6 @@ msToscaModel.home=/home/users/PolicyEngine/webapps/ConfigPAP/
 # Decision Response settings. 
 # can be either PERMIT or DENY. 
 decision.indeterminate.response=PERMIT
+
+# AES key for password encryption in config files
+#org.onap.policy.encryption.aes.key=12345678901234567890123456789012