Update XACML Tutorial

More code fixes and pointing to src/test/resources artifacts
vs separate yaml/json files.

Added instructions on how to incorporate as Docker image.

Can download the example and import into Eclipse or other tool.

Made sure links point to Master branch.

Added POSTMAN Collection

Issue-ID: POLICY-2565
Change-Id: I65c596b8c89cd87a72660a3d4dfa1085a60a41d2
Signed-off-by: Pamela Dragosh <pdragosh@research.att.com>
(cherry picked from commit 82c1a1040666d1ba33b37ae520076eb8b3bbaa41)
Signed-off-by: Pamela Dragosh <pdragosh@research.att.com>

12 files changed, 317 insertions, 34 deletions

diff --git a/docs/xacml/tutorial/app/pom.xml b/docs/xacml/tutorial/app/pom.xml
index f8afc552..380ee512 100644
--- a/docs/xacml/tutorial/app/pom.xml
+++ b/docs/xacml/tutorial/app/pom.xml
@@ -1,3 +1,23 @@
+<!--
+  ============LICENSE_START=======================================================
+  ONAP Policy Engine - XACML Application Tutorial
+  ================================================================================
+  Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+  ================================================================================
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  ============LICENSE_END=========================================================
+  -->
+
 <project xmlns="http://maven.apache.org/POM/4.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
@@ -33,6 +53,7 @@
       <scope>test</scope>
     </dependency>
   </dependencies>
+
   <build>
     <plugins>
       <plugin>
@@ -43,6 +64,43 @@
           <release>11</release>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>io.fabric8</groupId>
+        <artifactId>docker-maven-plugin</artifactId>
+        <version>0.33.0</version>
+        <configuration>
+          <verbose>true</verbose>
+          <images>
+            <image>
+              <name>onap/policy-xacml-tutorial</name>
+              <alias>xacml-pdp</alias>
+              <build>
+                <contextDir>${project.basedir}/src/main/docker</contextDir>
+                <assembly>
+                    <descriptorRef>artifact-with-dependencies</descriptorRef>
+                </assembly>
+              </build>
+            </image>
+          </images>
+        </configuration>
+        <executions>
+            <execution>
+                <id>clean-images</id>
+                <phase>pre-clean</phase>
+                <goals>
+                    <goal>remove</goal>
+                </goals>
+            </execution>
+
+            <execution>
+                <id>generate-images</id>
+                <phase>package</phase>
+                <goals>
+                    <goal>build</goal>
+                </goals>
+            </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>
 </project>
diff --git a/docs/xacml/tutorial/app/src/main/docker/Dockerfile b/docs/xacml/tutorial/app/src/main/docker/Dockerfile
new file mode 100644
index 00000000..639e94fb
--- /dev/null
+++ b/docs/xacml/tutorial/app/src/main/docker/Dockerfile
@@ -0,0 +1,7 @@
+FROM onap/policy-xacml-pdp:2.2.2
+
+ADD maven/${project.build.finalName}.jar /opt/app/policy/pdpx/lib/${project.build.finalName}.jar
+
+RUN mkdir -p /opt/app/policy/pdpx/apps/tutorial
+
+COPY --chown=policy:policy xacml.properties /opt/app/policy/pdpx/apps/tutorial
\ No newline at end of file
diff --git a/docs/xacml/tutorial/app/src/main/docker/README.txt b/docs/xacml/tutorial/app/src/main/docker/README.txt
new file mode 100644
index 00000000..a29a44b2
--- /dev/null
+++ b/docs/xacml/tutorial/app/src/main/docker/README.txt
@@ -0,0 +1,36 @@
+docker-compose -f docker-compose.yml run --rm start_dependencies
+
+docker-compose -f docker-compose.yml run --rm start_all
+
+
+curl -X POST http://0.0.0.0:3904/events/POLICY-PDP-PAP
+
+Should return JSON similar to this:
+{"serverTimeMs":0,"count":0}
+
+
+curl -k -u 'healthcheck:zb!XztG34' 'https://0.0.0.0:6969/policy/pdpx/v1/healthcheck'
+
+Should return JSON similar to this:
+{"name":"Policy Xacml PDP","url":"self","healthy":true,"code":200,"message":"alive"}
+
+
+curl -k -u 'healthcheck:zb!XztG34' 'https://0.0.0.0:6767/policy/api/v1/healthcheck'
+Should return JSON similar to this:
+{
+    "name": "Policy API",
+    "url": "policy-api",
+    "healthy": true,
+    "code": 200,
+    "message": "alive"
+}
+
+curl -k -u 'healthcheck:zb!XztG34' 'https://0.0.0.0:6868/policy/pap/v1/healthcheck'
+Should return JSON similar to this:
+{
+    "name": "Policy PAP",
+    "url": "policy-pap",
+    "healthy": true,
+    "code": 200,
+    "message": "alive"
+}
\ No newline at end of file
diff --git a/docs/xacml/tutorial/app/src/main/docker/config/db/db.conf b/docs/xacml/tutorial/app/src/main/docker/config/db/db.conf
new file mode 100644
index 00000000..42f35844
--- /dev/null
+++ b/docs/xacml/tutorial/app/src/main/docker/config/db/db.conf
@@ -0,0 +1,20 @@
+# ============LICENSE_START=======================================================
+#  Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+MYSQL_ROOT_PASSWORD=secret
+MYSQL_USER=policy_user
+MYSQL_PASSWORD=policy_user
\ No newline at end of file
diff --git a/docs/xacml/tutorial/app/src/main/docker/config/db/db.sh b/docs/xacml/tutorial/app/src/main/docker/config/db/db.sh
new file mode 100644
index 00000000..499764df
--- /dev/null
+++ b/docs/xacml/tutorial/app/src/main/docker/config/db/db.sh
@@ -0,0 +1,26 @@
+#!/bin/bash -xv
+# ============LICENSE_START=======================================================
+#  Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+for db in policyadmin operationshistory
+do
+     mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" --execute "CREATE DATABASE IF NOT EXISTS ${db};"
+     mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" --execute "GRANT ALL PRIVILEGES ON \`${db}\`.* TO '${MYSQL_USER}'@'%' ;"
+done
+
+mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" --execute "FLUSH PRIVILEGES;"
diff --git a/docs/xacml/tutorial/app/src/main/docker/docker-compose.yml b/docs/xacml/tutorial/app/src/main/docker/docker-compose.yml
new file mode 100644
index 00000000..b65098c1
--- /dev/null
+++ b/docs/xacml/tutorial/app/src/main/docker/docker-compose.yml
@@ -0,0 +1,102 @@
+# ============LICENSE_START=======================================================
+#  Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+version: '2'
+services:
+   mariadb:
+      image: mariadb:10.2.14
+      container_name: mariadb
+      hostname: mariadb
+      command: ['--lower-case-table-names=1', '--wait_timeout=28800']
+      env_file: config/db/db.conf
+      volumes:
+         - ./config/db:/docker-entrypoint-initdb.d
+      expose:
+       - 3306
+   message-router:
+      image: dmaap/simulator
+      container_name: dmaap-simulator
+      hostname: dmaap-simulator
+      ports:
+       - "3904:3904"
+      expose:
+       - 3904
+   api:
+      image: nexus3.onap.org:10001/onap/policy-api:2.2.4
+      container_name: policy-api
+      depends_on:
+       - mariadb
+      hostname: policy-api
+      ports:
+       - "6767:6969"
+      expose:
+       - 6767
+   pap:
+      image: nexus3.onap.org:10001/onap/policy-pap:2.2.3
+      container_name: policy-pap
+      depends_on:
+       - mariadb
+       - message-router
+       - api
+      hostname: policy-pap
+      ports:
+       - "6868:6969"
+      expose:
+       - 6868
+   xacml-pdp:
+      image: onap/policy-xacml-tutorial
+      container_name: policy-xacml-pdp
+      depends_on:
+       - mariadb
+       - message-router
+       - api
+       - pap
+      hostname: policy-xacml-pdp
+      ports:
+       - "6969:6969"
+      expose:
+       - 6969
+   start_dependencies:
+      image: dadarek/wait-for-dependencies
+      environment:
+        TIMEOUT_LENGTH: 60
+      container_name: policy-wait
+      depends_on:
+        - mariadb
+        - message-router
+      hostname: policy-wait
+      command:
+        mariadb:3306
+        message-router:3904
+   start_all:
+      image: dadarek/wait-for-dependencies
+      environment:
+        TIMEOUT_LENGTH: 60
+      container_name: policy-wait-all
+      depends_on:
+        - mariadb
+        - message-router
+        - api
+        - pap
+        - xacml-pdp
+      hostname: policy-wait-all
+      command:
+        mariadb:3306
+        message-router:3904
+        api:6969
+        pap:6969
+        xacml-pdp:6969
diff --git a/docs/xacml/tutorial/app/src/main/docker/xacml.properties b/docs/xacml/tutorial/app/src/main/docker/xacml.properties
new file mode 100644
index 00000000..277b098e
--- /dev/null
+++ b/docs/xacml/tutorial/app/src/main/docker/xacml.properties
@@ -0,0 +1,31 @@
+#
+# Properties that the embedded PDP engine uses to configure and load
+#
+# Standard API Factories
+#
+xacml.dataTypeFactory=com.att.research.xacml.std.StdDataTypeFactory
+xacml.pdpEngineFactory=com.att.research.xacmlatt.pdp.ATTPDPEngineFactory
+xacml.pepEngineFactory=com.att.research.xacml.std.pep.StdEngineFactory
+xacml.pipFinderFactory=com.att.research.xacml.std.pip.StdPIPFinderFactory
+xacml.traceEngineFactory=com.att.research.xacml.std.trace.LoggingTraceEngineFactory
+#
+# AT&T PDP Implementation Factories
+#
+xacml.att.evaluationContextFactory=com.att.research.xacmlatt.pdp.std.StdEvaluationContextFactory
+xacml.att.combiningAlgorithmFactory=com.att.research.xacmlatt.pdp.std.StdCombiningAlgorithmFactory
+xacml.att.functionDefinitionFactory=com.att.research.xacmlatt.pdp.std.StdFunctionDefinitionFactory
+#
+# ONAP PDP Implementation Factories
+#
+xacml.att.policyFinderFactory=org.onap.policy.pdp.xacml.application.common.OnapPolicyFinderFactory
+
+#
+# Use a root combining algorithm
+#
+xacml.att.policyFinderFactory.combineRootPolicies=urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides
+
+#
+# Policies to load
+#
+xacml.rootPolicies=
+xacml.referencedPolicies=
\ No newline at end of file
diff --git a/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java b/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java
index 7f0c2b99..5727f1c1 100644
--- a/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java
+++ b/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java
@@ -26,7 +26,7 @@ import org.onap.policy.pdp.xacml.application.common.std.StdXacmlApplicationServi
 
 public class TutorialApplication extends StdXacmlApplicationServiceProvider {
 
-    private final ToscaPolicyTypeIdentifier supportedPolicyType = new ToscaPolicyTypeIdentifier();
+    private final ToscaPolicyTypeIdentifier supportedPolicyType = new ToscaPolicyTypeIdentifier("onap.policies.Authorization", "1.0.0");
     private final TutorialTranslator translator = new TutorialTranslator();
 
     @Override
diff --git a/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java b/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java
index 1dd6186e..600c6214 100644
--- a/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java
+++ b/docs/xacml/tutorial/app/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java
@@ -48,10 +48,10 @@ public class TutorialTranslator implements ToscaPolicyTranslator {
     private static final Identifier ID_TUTORIAL_USER = new IdentifierImpl(ToscaDictionary.ID_URN_ONAP, "tutorial-user");
     private static final Identifier ID_TUTORIAL_ENTITY =
             new IdentifierImpl(ToscaDictionary.ID_URN_ONAP, "tutorial-entity");
-    private static final Identifier ID_TUTORIAL_PERM = new IdentifierImpl(ToscaDictionary.ID_URN_ONAP, "tutorial-perm");
+    private static final Identifier ID_TUTORIAL_PERM = new IdentifierImpl(ToscaDictionary.ID_URN_ONAP, "tutorial-permission");
 
     @SuppressWarnings("unchecked")
-	public PolicyType convertPolicy(ToscaPolicy toscaPolicy) throws ToscaPolicyConversionException {
+    public PolicyType convertPolicy(ToscaPolicy toscaPolicy) throws ToscaPolicyConversionException {
         //
         // Here is our policy with a version and default combining algo
         //
@@ -74,7 +74,7 @@ public class TutorialTranslator implements ToscaPolicyTranslator {
         // For simplicity, let's just match on the action "authorize" and the user
         //
         MatchType matchAction = ToscaPolicyTranslatorUtils.buildMatchTypeDesignator(XACML3.ID_FUNCTION_STRING_EQUAL,
-                "authorize", XACML3.ID_DATATYPE_STRING, XACML3.ID_ACTION, XACML3.ID_ATTRIBUTE_CATEGORY_ACTION);
+                "authorize", XACML3.ID_DATATYPE_STRING, XACML3.ID_ACTION_ACTION_ID, XACML3.ID_ATTRIBUTE_CATEGORY_ACTION);
         Map<String, Object> props = toscaPolicy.getProperties();
         String user = props.get("user").toString();
         MatchType matchUser = ToscaPolicyTranslatorUtils.buildMatchTypeDesignator(XACML3.ID_FUNCTION_STRING_EQUAL, user,
@@ -83,14 +83,14 @@ public class TutorialTranslator implements ToscaPolicyTranslator {
         //
         // Create AllOf (AND) of just Policy Id
         //
-        anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchAction));
-        anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchUser));
+        anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchAction, matchUser));
         TargetType target = new TargetType();
         target.getAnyOf().add(anyOf);
         newPolicyType.setTarget(target);
         //
         // Now add the rule for each permission
         //
+        int ruleNumber = 0;
         List<Object> permissions = (List<Object>) props.get("permissions");
         for (Object permission : permissions) {
 
@@ -102,18 +102,20 @@ public class TutorialTranslator implements ToscaPolicyTranslator {
                     XACML3.ID_FUNCTION_STRING_EQUAL, ((Map<String, String>) permission).get("permission"),
                     XACML3.ID_DATATYPE_STRING, ID_TUTORIAL_PERM, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE);
             anyOf = new AnyOfType();
-            anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchEntity));
-            anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchPermission));
+            anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchEntity, matchPermission));
             target = new TargetType();
             target.getAnyOf().add(anyOf);
 
             RuleType rule = new RuleType();
             rule.setDescription("Default is to PERMIT if the policy matches.");
-            rule.setRuleId(newPolicyType.getPolicyId() + ":rule");
+            rule.setRuleId(newPolicyType.getPolicyId() + ":rule" + ruleNumber);
+
             rule.setEffect(EffectType.PERMIT);
             rule.setTarget(target);
 
             newPolicyType.getCombinerParametersOrRuleCombinerParametersOrVariableDefinition().add(rule);
+
+            ruleNumber++;
         }
         return newPolicyType;
     }
@@ -140,19 +142,12 @@ public class TutorialTranslator implements ToscaPolicyTranslator {
                 // Just simply return a Permit response
                 //
                 decisionResponse.setStatus(Decision.PERMIT.toString());
-            }
-            if (xacmlResult.getDecision() == Decision.DENY) {
+            } else {
                 //
                 // Just simply return a Deny response
                 //
                 decisionResponse.setStatus(Decision.DENY.toString());
             }
-            if (xacmlResult.getDecision() == Decision.NOTAPPLICABLE) {
-                //
-                // There is no guard policy, so we return a permit
-                //
-                decisionResponse.setStatus(Decision.PERMIT.toString());
-            }
         }
 
         return decisionResponse;
diff --git a/docs/xacml/tutorial/app/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java b/docs/xacml/tutorial/app/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java
index 65685236..d20c1b38 100644
--- a/docs/xacml/tutorial/app/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java
+++ b/docs/xacml/tutorial/app/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java
@@ -18,6 +18,8 @@
 
 package org.onap.policy.tutorial.tutorial;
 
+import static org.junit.Assert.assertEquals;
+
 import java.io.File;
 import java.io.IOException;
 import java.util.Iterator;
@@ -101,10 +103,18 @@ public class TutorialApplicationTest {
                 .getTextFileAsString("src/test/resources/tutorial-decision-request.json"),
                 DecisionRequest.class);
         //
-        // Test a decision
+        // Test a decision - should start with a permit
         //
         Pair<DecisionResponse, Response> decision = service.makeDecision(decisionRequest, null);
         LOGGER.info(decision.getLeft().toString());
+        assertEquals("Permit", decision.getLeft().getStatus());
+        //
+        // This should be a deny
+        //
+        decisionRequest.getResource().put("user", "audit");
+        decision = service.makeDecision(decisionRequest, null);
+        LOGGER.info(decision.getLeft().toString());
+        assertEquals("Deny", decision.getLeft().getStatus());
     }
 
 }
diff --git a/docs/xacml/tutorial/app/src/test/resources/tutorial-decision-request.json b/docs/xacml/tutorial/app/src/test/resources/tutorial-decision-request.json
index 8c1ec10c..f3a7f9a2 100644
--- a/docs/xacml/tutorial/app/src/test/resources/tutorial-decision-request.json
+++ b/docs/xacml/tutorial/app/src/test/resources/tutorial-decision-request.json
@@ -7,6 +7,6 @@
   "resource": {
     "user": "demo",
     "entity": "foo",
-    "permission" : "read"
+    "permission" : "write"
   }
 }
diff --git a/docs/xacml/tutorial/app/src/test/resources/tutorial-policy-type.yaml b/docs/xacml/tutorial/app/src/test/resources/tutorial-policy-type.yaml
index c742cf3e..7948bd28 100644
--- a/docs/xacml/tutorial/app/src/test/resources/tutorial-policy-type.yaml
+++ b/docs/xacml/tutorial/app/src/test/resources/tutorial-policy-type.yaml
@@ -1,6 +1,5 @@
 tosca_definitions_version: tosca_simple_yaml_1_1_0
 policy_types:
-  -
     onap.policies.Authorization:
         derived_from: tosca.policies.Root
         version: 1.0.0
@@ -17,18 +16,17 @@ policy_types:
                 entry_schema:
                     type: onap.datatypes.Tutorial
 data_types:
-  -
     onap.datatypes.Tutorial:
-    derived_from: tosca.datatypes.Root
-    version: 1.0.0
-    properties:
-        entity:
-            type: string
-            required: true
-            description: The resource
-        permission:
-            type: string
-            required: true
-            description: The permission level
-            constraints:
-                - valid_values: [read, write, delete]
+        derived_from: tosca.datatypes.Root
+        version: 1.0.0
+        properties:
+            entity:
+                type: string
+                required: true
+                description: The resource
+            permission:
+                type: string
+                required: true
+                description: The permission level
+                constraints:
+                    - valid_values: [read, write, delete]