summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwaynedunican <wayne.dunican@est.tech>2022-05-05 09:25:49 +0100
committerWayne Dunican <wayne.dunican@est.tech>2022-05-17 17:07:41 +0100
commit86c91fd09daeb36367bf4c99eda9a52b4523521b (patch)
treee69f3c4ab904b879b0ce7c914dd7c091ba09bc63
parent0949037a3ba7b646183acdeff83473527783b5ca (diff)
Support postgres in XACML-PDP
Issue-ID: POLICY-4187 Change-Id: Ifed655e214ce95b9cc8208cd5b0907e7bb00b463 Signed-off-by: Wayne Dunican <wayne.dunican@est.tech>
-rw-r--r--packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile4
-rw-r--r--packages/policy-xacmlpdp-docker/src/main/docker/policy-pdpx-pg.sh63
-rw-r--r--packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml19
-rw-r--r--packages/policy-xacmlpdp-tarball/src/main/resources/apps/guard/xacml-pg.properties54
-rw-r--r--packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh10
-rw-r--r--packages/policy-xacmlpdp-tarball/src/main/resources/postgres/bin/create-guard-table-pg.sh56
-rw-r--r--packages/policy-xacmlpdp-tarball/src/main/resources/postgres/sql/createguardtable-pg.sql37
-rw-r--r--tutorials/tutorial-enforcement/src/main/docker/config/db/db-pg.sh25
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/config/db/db-pg.sh25
9 files changed, 287 insertions, 6 deletions
diff --git a/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile b/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile
index 8cc83104..022c099e 100644
--- a/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile
+++ b/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile
@@ -29,6 +29,7 @@ ENV POLICY_LOGS=$POLICY_LOGS
ENV POLICY_HOME=$POLICY_HOME/pdpx
RUN apk update && \
apk add mariadb-client && \
+ apk add postgresql-client && \
mkdir -p $POLICY_HOME $POLICY_LOGS $POLICY_HOME/etc/ssl $POLICY_HOME/bin $POLICY_HOME/apps && \
chown -R policy:policy $POLICY_HOME $POLICY_LOGS && mkdir /packages
@@ -38,7 +39,8 @@ RUN tar xvfz /packages/policy-xacmlpdp.tar.gz --directory $POLICY_HOME && \
WORKDIR $POLICY_HOME
COPY policy-pdpx.sh bin/.
-RUN chown -R policy:policy * && chmod 755 bin/*.sh && chmod 755 mysql/bin/*.sh
+COPY policy-pdpx-pg.sh bin/.
+RUN chown -R policy:policy * && chmod 755 bin/*.sh && chmod 755 mysql/bin/*.sh && chmod 755 postgres/bin/*.sh
USER policy
WORKDIR $POLICY_HOME/bin
diff --git a/packages/policy-xacmlpdp-docker/src/main/docker/policy-pdpx-pg.sh b/packages/policy-xacmlpdp-docker/src/main/docker/policy-pdpx-pg.sh
new file mode 100644
index 00000000..d6d42e0e
--- /dev/null
+++ b/packages/policy-xacmlpdp-docker/src/main/docker/policy-pdpx-pg.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env sh
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2022 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+
+JAVA_HOME=/usr/lib/jvm/java-11-openjdk/
+KEYSTORE="${KEYSTORE:-$POLICY_HOME/etc/ssl/policy-keystore}"
+TRUSTSTORE="${TRUSTSTORE:-$POLICY_HOME/etc/ssl/policy-truststore}"
+KEYSTORE_PASSWD="${KEYSTORE_PASSWD:-Pol1cy_0nap}"
+TRUSTSTORE_PASSWD="${TRUSTSTORE_PASSWD:-Pol1cy_0nap}"
+
+if [ "$#" -ge 1 ]; then
+ CONFIG_FILE=$1
+else
+ CONFIG_FILE=${CONFIG_FILE}
+fi
+
+if [ -z "$CONFIG_FILE" ]; then
+ CONFIG_FILE="${POLICY_HOME}/etc/defaultConfig.json"
+fi
+
+if [ -f "${POLICY_HOME}/etc/mounted/policy-truststore" ]; then
+ echo "overriding policy-truststore"
+ cp -f "${POLICY_HOME}"/etc/mounted/policy-truststore "${TRUSTSTORE}"
+fi
+
+if [ -f "${POLICY_HOME}/etc/mounted/policy-keystore" ]; then
+ echo "overriding policy-keystore"
+ cp -f "${POLICY_HOME}"/etc/mounted/policy-keystore "${KEYSTORE}"
+fi
+
+if [ -f "${POLICY_HOME}/etc/mounted/xacml.properties" ]; then
+ echo "overriding xacml.properties in guards application"
+ cp -f "${POLICY_HOME}"/etc/mounted/xacml-pg.properties "${POLICY_HOME}"/apps/guard/
+fi
+
+if [ -f "${POLICY_HOME}/etc/mounted/logback.xml" ]; then
+ echo "overriding logback.xml"
+ cp -f "${POLICY_HOME}"/etc/mounted/logback.xml "${POLICY_HOME}"/etc/
+fi
+
+# Create operationshistory table
+"${POLICY_HOME}"/postgres/bin/create-guard-table-pg.sh
+
+echo "Policy Xacml PDP config file: $CONFIG_FILE"
+
+$JAVA_HOME/bin/java -cp "${POLICY_HOME}/etc:${POLICY_HOME}/lib/*" -Dlogback.configurationFile="${POLICY_HOME}/etc/logback.xml" -Djavax.net.ssl.keyStore="${KEYSTORE}" -Djavax.net.ssl.keyStorePassword="${KEYSTORE_PASSWD}" -Djavax.net.ssl.trustStore="${TRUSTSTORE}" -Djavax.net.ssl.trustStorePassword="${TRUSTSTORE_PASSWD}" org.onap.policy.pdpx.main.startstop.Main -c "${CONFIG_FILE}"
diff --git a/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml b/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml
index 1f5e7164..354b12a7 100644
--- a/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml
+++ b/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml
@@ -1,6 +1,7 @@
<!--
============LICENSE_START=======================================================
Copyright (C) 2019-2020 AT&T Intellectual Property. All rights reserved.
+ Modifications Copyright (C) 2022 Nordix Foundation.
================================================================================
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -78,6 +79,24 @@
<lineEnding>unix</lineEnding>
</fileSet>
<fileSet>
+ <directory>${project.basedir}/src/main/resources/postgres/bin
+ </directory>
+ <includes>
+ <include>*.sh</include>
+ </includes>
+ <outputDirectory>${file.separator}postgres${file.separator}bin</outputDirectory>
+ <lineEnding>unix</lineEnding>
+ </fileSet>
+ <fileSet>
+ <directory>${project.basedir}/src/main/resources/postgres/sql
+ </directory>
+ <includes>
+ <include>*.sql</include>
+ </includes>
+ <outputDirectory>${file.separator}postgres${file.separator}sql</outputDirectory>
+ <lineEnding>unix</lineEnding>
+ </fileSet>
+ <fileSet>
<directory>${project.basedir}/src/main/resources/apps/guard
</directory>
<includes>
diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/apps/guard/xacml-pg.properties b/packages/policy-xacmlpdp-tarball/src/main/resources/apps/guard/xacml-pg.properties
new file mode 100644
index 00000000..ac6c308f
--- /dev/null
+++ b/packages/policy-xacmlpdp-tarball/src/main/resources/apps/guard/xacml-pg.properties
@@ -0,0 +1,54 @@
+#
+# Properties that the embedded PDP engine uses to configure and load
+#
+# Standard API Factories
+#
+xacml.dataTypeFactory=com.att.research.xacml.std.StdDataTypeFactory
+xacml.pdpEngineFactory=com.att.research.xacmlatt.pdp.ATTPDPEngineFactory
+xacml.pepEngineFactory=com.att.research.xacml.std.pep.StdEngineFactory
+xacml.pipFinderFactory=com.att.research.xacml.std.pip.StdPIPFinderFactory
+xacml.traceEngineFactory=com.att.research.xacml.std.trace.LoggingTraceEngineFactory
+#
+# AT&T PDP Implementation Factories
+#
+xacml.att.evaluationContextFactory=com.att.research.xacmlatt.pdp.std.StdEvaluationContextFactory
+xacml.att.combiningAlgorithmFactory=com.att.research.xacmlatt.pdp.std.StdCombiningAlgorithmFactory
+xacml.att.functionDefinitionFactory=com.att.research.xacmlatt.pdp.std.StdFunctionDefinitionFactory
+#
+# ONAP PDP Implementation Factories
+#
+xacml.att.policyFinderFactory=org.onap.policy.pdp.xacml.application.common.OnapPolicyFinderFactory
+
+#
+# Use a root combining algorithm
+#
+xacml.att.policyFinderFactory.combineRootPolicies=urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides
+
+#
+# PIP Engine Definitions
+#
+count-recent-operations.classname=org.onap.policy.pdp.xacml.application.common.operationshistory.CountRecentOperationsPip
+count-recent-operations.issuer=urn:org:onap:xacml:guard:count-recent-operations
+count-recent-operations.name=CountRecentOperations
+count-recent-operations.description=Returns operation counts based on time window
+count-recent-operations.persistenceunit=OperationsHistoryPU
+
+get-operation-outcome.classname=org.onap.policy.pdp.xacml.application.common.operationshistory.GetOperationOutcomePip
+get-operation-outcome.issuer=urn:org:onap:xacml:guard:get-operation-outcome
+get-operation-outcome.name=GetOperationOutcome
+get-operation-outcome.description=Returns operation outcome
+get-operation-outcome.persistenceunit=OperationsHistoryPU
+
+#
+# Make pips available to finder
+#
+xacml.pip.engines=count-recent-operations,get-operation-outcome
+
+#
+# JPA Properties
+#
+eclipselink.target-database=PostgreSQL
+javax.persistence.jdbc.driver=org.postgresql.Driver
+javax.persistence.jdbc.url=jdbc:postgresql://policy-pg-primary:5432/operationshistory
+javax.persistence.jdbc.user=policy_user
+javax.persistence.jdbc.password=policy_user
diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh b/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh
index 7e4bd35f..09a5d409 100644
--- a/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh
+++ b/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh
@@ -3,6 +3,7 @@
# ============LICENSE_START=======================================================
# Copyright (C) 2019-2021 AT&T Intellectual Property. All rights reserved.
# Modifications Copyright (C) 2020 Bell Canada. All rights reserved.
+# Modifications Copyright (C) 2022 Nordix Foundation. All rights reserved.
# ================================================================================
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -39,20 +40,19 @@ DB_PASSWORD=$(awk -F= '$1 == "javax.persistence.jdbc.password" { print $2 }' /tm
rm /tmp/temp.xacml.properties
if [ -z "$DB_HOSTNAME" ]; then
- echo "No Mariadb host provided in guard xacml.properties."
+ echo "No db host provided in guard xacml.properties."
exit 2
fi
if [ -z "$DB_USERNAME" ]; then
- echo "No Mariadb username provided in guard xacml.properties."
+ echo "No db username provided in guard xacml.properties."
exit 2
fi
if [ -z "$DB_PASSWORD" ]; then
- echo "No Mariadb password provided in guard xacml.properties."
+ echo "No db password provided in guard xacml.properties."
exit 2
fi
-# Execute mysql command using sql file to create table
+# Execute sql command using sql file to create table
mysql -u${DB_USERNAME} -p${DB_PASSWORD} -h${DB_HOSTNAME} < "${SQL_FILE}"
-
diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/bin/create-guard-table-pg.sh b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/bin/create-guard-table-pg.sh
new file mode 100644
index 00000000..1a71f8b4
--- /dev/null
+++ b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/bin/create-guard-table-pg.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env sh
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2022 Nordix Foundation. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+SQL_FILE="${POLICY_HOME}/mysql/sql/createguardtable-pg.sql"
+
+# Remove escape backslashes if present and save output in temp file
+sed 's/\\//g' "${POLICY_HOME}"/apps/guard/xacml-pg.properties > /tmp/temp.xacml-pg.properties
+
+# Remove temp file
+if [ ! -f /tmp/temp.xacml-pg.properties ]; then
+ echo "Temporary guard xacml properties file not found!"
+ exit 1
+fi
+
+# Extract Maria DB Credential properties from xacml.properties file
+DB_HOSTNAME=$(awk -F[/:] '$1 == "javax.persistence.jdbc.url=jdbc" { print $3 $5 }' /tmp/temp.xacml-pg.properties)
+DB_USERNAME=$(awk -F= '$1 == "javax.persistence.jdbc.user" { print $2 }' /tmp/temp.xacml-pg.properties)
+DB_PASSWORD=$(awk -F= '$1 == "javax.persistence.jdbc.password" { print $2 }' /tmp/temp.xacml-pg.properties)
+
+# Remove temp file
+rm /tmp/temp.xacml-pg.properties
+
+if [ -z "$DB_HOSTNAME" ]; then
+ echo "No db host provided in guard xacml-pg.properties."
+ exit 2
+fi
+
+if [ -z "$DB_USERNAME" ]; then
+ echo "No db username provided in guard xacml-pg.properties."
+ exit 2
+fi
+
+if [ -z "$DB_PASSWORD" ]; then
+ echo "No db password provided in guard xacml-pg.properties."
+ exit 2
+fi
+
+# Execute sql command using sql file to create table
+psql -U postgres -h ${DB_HOSTNAME} -f ${SQL_FILE}
diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/sql/createguardtable-pg.sql b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/sql/createguardtable-pg.sql
new file mode 100644
index 00000000..501ad77e
--- /dev/null
+++ b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/sql/createguardtable-pg.sql
@@ -0,0 +1,37 @@
+-- ============LICENSE_START=======================================================
+-- Copyright (C) 2022 Nordix Foundation. All rights reserved.
+-- ================================================================================
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+-- ============LICENSE_END=========================================================
+
+\c operationshistory;
+
+create table if not exists operationshistory (
+ id int(11) SERIAL PRIMARY KEY,
+ closedLoopName varchar(255) not null,
+ requestId varchar(50),
+ actor varchar(50) not null,
+ operation varchar(50) not null,
+ target varchar(50) not null,
+ starttime timestamp not null,
+ outcome varchar(50) not null,
+ message varchar(255),
+ subrequestId varchar(50),
+ endtime timestamp not null default current_timestamp
+);
+
+create index if not exists operationshistory_clreqid_index on
+ operationshistory(requestId, closedLoopName);
+
+create index if not exists operationshistory_target_index on
+ operationshistory(target, operation, actor, endtime);
diff --git a/tutorials/tutorial-enforcement/src/main/docker/config/db/db-pg.sh b/tutorials/tutorial-enforcement/src/main/docker/config/db/db-pg.sh
new file mode 100644
index 00000000..41326c61
--- /dev/null
+++ b/tutorials/tutorial-enforcement/src/main/docker/config/db/db-pg.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2022 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+
+export PGPASSWORD=${PG_ADMIN_PASSWORD};
+
+for db in policyadmin operationshistory
+do
+ psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "CREATE DATABASE ${db};"
+ psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "GRANT ALL PRIVILEGES ON DATABASE ${db} TO ${PG_USER};"
+done \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/config/db/db-pg.sh b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db-pg.sh
new file mode 100644
index 00000000..41326c61
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db-pg.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+# ============LICENSE_START=======================================================
+# Copyright (C) 2022 Nordix Foundation.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+#
+
+export PGPASSWORD=${PG_ADMIN_PASSWORD};
+
+for db in policyadmin operationshistory
+do
+ psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "CREATE DATABASE ${db};"
+ psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "GRANT ALL PRIVILEGES ON DATABASE ${db} TO ${PG_USER};"
+done \ No newline at end of file