diff options
9 files changed, 287 insertions, 6 deletions
diff --git a/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile b/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile index 8cc83104..022c099e 100644 --- a/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile +++ b/packages/policy-xacmlpdp-docker/src/main/docker/Dockerfile @@ -29,6 +29,7 @@ ENV POLICY_LOGS=$POLICY_LOGS ENV POLICY_HOME=$POLICY_HOME/pdpx RUN apk update && \ apk add mariadb-client && \ + apk add postgresql-client && \ mkdir -p $POLICY_HOME $POLICY_LOGS $POLICY_HOME/etc/ssl $POLICY_HOME/bin $POLICY_HOME/apps && \ chown -R policy:policy $POLICY_HOME $POLICY_LOGS && mkdir /packages @@ -38,7 +39,8 @@ RUN tar xvfz /packages/policy-xacmlpdp.tar.gz --directory $POLICY_HOME && \ WORKDIR $POLICY_HOME COPY policy-pdpx.sh bin/. -RUN chown -R policy:policy * && chmod 755 bin/*.sh && chmod 755 mysql/bin/*.sh +COPY policy-pdpx-pg.sh bin/. +RUN chown -R policy:policy * && chmod 755 bin/*.sh && chmod 755 mysql/bin/*.sh && chmod 755 postgres/bin/*.sh USER policy WORKDIR $POLICY_HOME/bin diff --git a/packages/policy-xacmlpdp-docker/src/main/docker/policy-pdpx-pg.sh b/packages/policy-xacmlpdp-docker/src/main/docker/policy-pdpx-pg.sh new file mode 100644 index 00000000..d6d42e0e --- /dev/null +++ b/packages/policy-xacmlpdp-docker/src/main/docker/policy-pdpx-pg.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env sh +# +# ============LICENSE_START======================================================= +# Copyright (C) 2022 Nordix Foundation. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# + +JAVA_HOME=/usr/lib/jvm/java-11-openjdk/ +KEYSTORE="${KEYSTORE:-$POLICY_HOME/etc/ssl/policy-keystore}" +TRUSTSTORE="${TRUSTSTORE:-$POLICY_HOME/etc/ssl/policy-truststore}" +KEYSTORE_PASSWD="${KEYSTORE_PASSWD:-Pol1cy_0nap}" +TRUSTSTORE_PASSWD="${TRUSTSTORE_PASSWD:-Pol1cy_0nap}" + +if [ "$#" -ge 1 ]; then + CONFIG_FILE=$1 +else + CONFIG_FILE=${CONFIG_FILE} +fi + +if [ -z "$CONFIG_FILE" ]; then + CONFIG_FILE="${POLICY_HOME}/etc/defaultConfig.json" +fi + +if [ -f "${POLICY_HOME}/etc/mounted/policy-truststore" ]; then + echo "overriding policy-truststore" + cp -f "${POLICY_HOME}"/etc/mounted/policy-truststore "${TRUSTSTORE}" +fi + +if [ -f "${POLICY_HOME}/etc/mounted/policy-keystore" ]; then + echo "overriding policy-keystore" + cp -f "${POLICY_HOME}"/etc/mounted/policy-keystore "${KEYSTORE}" +fi + +if [ -f "${POLICY_HOME}/etc/mounted/xacml.properties" ]; then + echo "overriding xacml.properties in guards application" + cp -f "${POLICY_HOME}"/etc/mounted/xacml-pg.properties "${POLICY_HOME}"/apps/guard/ +fi + +if [ -f "${POLICY_HOME}/etc/mounted/logback.xml" ]; then + echo "overriding logback.xml" + cp -f "${POLICY_HOME}"/etc/mounted/logback.xml "${POLICY_HOME}"/etc/ +fi + +# Create operationshistory table +"${POLICY_HOME}"/postgres/bin/create-guard-table-pg.sh + +echo "Policy Xacml PDP config file: $CONFIG_FILE" + +$JAVA_HOME/bin/java -cp "${POLICY_HOME}/etc:${POLICY_HOME}/lib/*" -Dlogback.configurationFile="${POLICY_HOME}/etc/logback.xml" -Djavax.net.ssl.keyStore="${KEYSTORE}" -Djavax.net.ssl.keyStorePassword="${KEYSTORE_PASSWD}" -Djavax.net.ssl.trustStore="${TRUSTSTORE}" -Djavax.net.ssl.trustStorePassword="${TRUSTSTORE_PASSWD}" org.onap.policy.pdpx.main.startstop.Main -c "${CONFIG_FILE}" diff --git a/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml b/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml index 1f5e7164..354b12a7 100644 --- a/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml +++ b/packages/policy-xacmlpdp-tarball/src/main/package/tarball/assembly.xml @@ -1,6 +1,7 @@ <!-- ============LICENSE_START======================================================= Copyright (C) 2019-2020 AT&T Intellectual Property. All rights reserved. + Modifications Copyright (C) 2022 Nordix Foundation. ================================================================================ Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -78,6 +79,24 @@ <lineEnding>unix</lineEnding> </fileSet> <fileSet> + <directory>${project.basedir}/src/main/resources/postgres/bin + </directory> + <includes> + <include>*.sh</include> + </includes> + <outputDirectory>${file.separator}postgres${file.separator}bin</outputDirectory> + <lineEnding>unix</lineEnding> + </fileSet> + <fileSet> + <directory>${project.basedir}/src/main/resources/postgres/sql + </directory> + <includes> + <include>*.sql</include> + </includes> + <outputDirectory>${file.separator}postgres${file.separator}sql</outputDirectory> + <lineEnding>unix</lineEnding> + </fileSet> + <fileSet> <directory>${project.basedir}/src/main/resources/apps/guard </directory> <includes> diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/apps/guard/xacml-pg.properties b/packages/policy-xacmlpdp-tarball/src/main/resources/apps/guard/xacml-pg.properties new file mode 100644 index 00000000..ac6c308f --- /dev/null +++ b/packages/policy-xacmlpdp-tarball/src/main/resources/apps/guard/xacml-pg.properties @@ -0,0 +1,54 @@ +# +# Properties that the embedded PDP engine uses to configure and load +# +# Standard API Factories +# +xacml.dataTypeFactory=com.att.research.xacml.std.StdDataTypeFactory +xacml.pdpEngineFactory=com.att.research.xacmlatt.pdp.ATTPDPEngineFactory +xacml.pepEngineFactory=com.att.research.xacml.std.pep.StdEngineFactory +xacml.pipFinderFactory=com.att.research.xacml.std.pip.StdPIPFinderFactory +xacml.traceEngineFactory=com.att.research.xacml.std.trace.LoggingTraceEngineFactory +# +# AT&T PDP Implementation Factories +# +xacml.att.evaluationContextFactory=com.att.research.xacmlatt.pdp.std.StdEvaluationContextFactory +xacml.att.combiningAlgorithmFactory=com.att.research.xacmlatt.pdp.std.StdCombiningAlgorithmFactory +xacml.att.functionDefinitionFactory=com.att.research.xacmlatt.pdp.std.StdFunctionDefinitionFactory +# +# ONAP PDP Implementation Factories +# +xacml.att.policyFinderFactory=org.onap.policy.pdp.xacml.application.common.OnapPolicyFinderFactory + +# +# Use a root combining algorithm +# +xacml.att.policyFinderFactory.combineRootPolicies=urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides + +# +# PIP Engine Definitions +# +count-recent-operations.classname=org.onap.policy.pdp.xacml.application.common.operationshistory.CountRecentOperationsPip +count-recent-operations.issuer=urn:org:onap:xacml:guard:count-recent-operations +count-recent-operations.name=CountRecentOperations +count-recent-operations.description=Returns operation counts based on time window +count-recent-operations.persistenceunit=OperationsHistoryPU + +get-operation-outcome.classname=org.onap.policy.pdp.xacml.application.common.operationshistory.GetOperationOutcomePip +get-operation-outcome.issuer=urn:org:onap:xacml:guard:get-operation-outcome +get-operation-outcome.name=GetOperationOutcome +get-operation-outcome.description=Returns operation outcome +get-operation-outcome.persistenceunit=OperationsHistoryPU + +# +# Make pips available to finder +# +xacml.pip.engines=count-recent-operations,get-operation-outcome + +# +# JPA Properties +# +eclipselink.target-database=PostgreSQL +javax.persistence.jdbc.driver=org.postgresql.Driver +javax.persistence.jdbc.url=jdbc:postgresql://policy-pg-primary:5432/operationshistory +javax.persistence.jdbc.user=policy_user +javax.persistence.jdbc.password=policy_user diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh b/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh index 7e4bd35f..09a5d409 100644 --- a/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh +++ b/packages/policy-xacmlpdp-tarball/src/main/resources/mysql/bin/create-guard-table.sh @@ -3,6 +3,7 @@ # ============LICENSE_START======================================================= # Copyright (C) 2019-2021 AT&T Intellectual Property. All rights reserved. # Modifications Copyright (C) 2020 Bell Canada. All rights reserved. +# Modifications Copyright (C) 2022 Nordix Foundation. All rights reserved. # ================================================================================ # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -39,20 +40,19 @@ DB_PASSWORD=$(awk -F= '$1 == "javax.persistence.jdbc.password" { print $2 }' /tm rm /tmp/temp.xacml.properties if [ -z "$DB_HOSTNAME" ]; then - echo "No Mariadb host provided in guard xacml.properties." + echo "No db host provided in guard xacml.properties." exit 2 fi if [ -z "$DB_USERNAME" ]; then - echo "No Mariadb username provided in guard xacml.properties." + echo "No db username provided in guard xacml.properties." exit 2 fi if [ -z "$DB_PASSWORD" ]; then - echo "No Mariadb password provided in guard xacml.properties." + echo "No db password provided in guard xacml.properties." exit 2 fi -# Execute mysql command using sql file to create table +# Execute sql command using sql file to create table mysql -u${DB_USERNAME} -p${DB_PASSWORD} -h${DB_HOSTNAME} < "${SQL_FILE}" - diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/bin/create-guard-table-pg.sh b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/bin/create-guard-table-pg.sh new file mode 100644 index 00000000..1a71f8b4 --- /dev/null +++ b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/bin/create-guard-table-pg.sh @@ -0,0 +1,56 @@ +#!/usr/bin/env sh +# +# ============LICENSE_START======================================================= +# Copyright (C) 2022 Nordix Foundation. All rights reserved. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# +SQL_FILE="${POLICY_HOME}/mysql/sql/createguardtable-pg.sql" + +# Remove escape backslashes if present and save output in temp file +sed 's/\\//g' "${POLICY_HOME}"/apps/guard/xacml-pg.properties > /tmp/temp.xacml-pg.properties + +# Remove temp file +if [ ! -f /tmp/temp.xacml-pg.properties ]; then + echo "Temporary guard xacml properties file not found!" + exit 1 +fi + +# Extract Maria DB Credential properties from xacml.properties file +DB_HOSTNAME=$(awk -F[/:] '$1 == "javax.persistence.jdbc.url=jdbc" { print $3 $5 }' /tmp/temp.xacml-pg.properties) +DB_USERNAME=$(awk -F= '$1 == "javax.persistence.jdbc.user" { print $2 }' /tmp/temp.xacml-pg.properties) +DB_PASSWORD=$(awk -F= '$1 == "javax.persistence.jdbc.password" { print $2 }' /tmp/temp.xacml-pg.properties) + +# Remove temp file +rm /tmp/temp.xacml-pg.properties + +if [ -z "$DB_HOSTNAME" ]; then + echo "No db host provided in guard xacml-pg.properties." + exit 2 +fi + +if [ -z "$DB_USERNAME" ]; then + echo "No db username provided in guard xacml-pg.properties." + exit 2 +fi + +if [ -z "$DB_PASSWORD" ]; then + echo "No db password provided in guard xacml-pg.properties." + exit 2 +fi + +# Execute sql command using sql file to create table +psql -U postgres -h ${DB_HOSTNAME} -f ${SQL_FILE} diff --git a/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/sql/createguardtable-pg.sql b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/sql/createguardtable-pg.sql new file mode 100644 index 00000000..501ad77e --- /dev/null +++ b/packages/policy-xacmlpdp-tarball/src/main/resources/postgres/sql/createguardtable-pg.sql @@ -0,0 +1,37 @@ +-- ============LICENSE_START======================================================= +-- Copyright (C) 2022 Nordix Foundation. All rights reserved. +-- ================================================================================ +-- Licensed under the Apache License, Version 2.0 (the "License"); +-- you may not use this file except in compliance with the License. +-- You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- ============LICENSE_END========================================================= + +\c operationshistory; + +create table if not exists operationshistory ( + id int(11) SERIAL PRIMARY KEY, + closedLoopName varchar(255) not null, + requestId varchar(50), + actor varchar(50) not null, + operation varchar(50) not null, + target varchar(50) not null, + starttime timestamp not null, + outcome varchar(50) not null, + message varchar(255), + subrequestId varchar(50), + endtime timestamp not null default current_timestamp +); + +create index if not exists operationshistory_clreqid_index on + operationshistory(requestId, closedLoopName); + +create index if not exists operationshistory_target_index on + operationshistory(target, operation, actor, endtime); diff --git a/tutorials/tutorial-enforcement/src/main/docker/config/db/db-pg.sh b/tutorials/tutorial-enforcement/src/main/docker/config/db/db-pg.sh new file mode 100644 index 00000000..41326c61 --- /dev/null +++ b/tutorials/tutorial-enforcement/src/main/docker/config/db/db-pg.sh @@ -0,0 +1,25 @@ +#!/bin/sh +# +# ============LICENSE_START======================================================= +# Copyright (C) 2022 Nordix Foundation. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# http://www.apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# + +export PGPASSWORD=${PG_ADMIN_PASSWORD}; + +for db in policyadmin operationshistory +do + psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "CREATE DATABASE ${db};" + psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "GRANT ALL PRIVILEGES ON DATABASE ${db} TO ${PG_USER};" +done
\ No newline at end of file diff --git a/tutorials/tutorial-xacml-application/src/main/docker/config/db/db-pg.sh b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db-pg.sh new file mode 100644 index 00000000..41326c61 --- /dev/null +++ b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db-pg.sh @@ -0,0 +1,25 @@ +#!/bin/sh +# +# ============LICENSE_START======================================================= +# Copyright (C) 2022 Nordix Foundation. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# http://www.apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# SPDX-License-Identifier: Apache-2.0 +# ============LICENSE_END========================================================= +# + +export PGPASSWORD=${PG_ADMIN_PASSWORD}; + +for db in policyadmin operationshistory +do + psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "CREATE DATABASE ${db};" + psql -h ${PG_HOST} -p ${PG_PORT} -U postgres --command "GRANT ALL PRIVILEGES ON DATABASE ${db} TO ${PG_USER};" +done
\ No newline at end of file |