aboutsummaryrefslogtreecommitdiffstats
path: root/tutorials/tutorial-xacml-application/src
diff options
context:
space:
mode:
Diffstat (limited to 'tutorials/tutorial-xacml-application/src')
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/Dockerfile7
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/README.txt36
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/config/db/db.conf20
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/config/db/db.sh26
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/config/sim/simParameters.json15
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/docker-compose.yml106
-rw-r--r--tutorials/tutorial-xacml-application/src/main/docker/xacml.properties31
-rw-r--r--tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java58
-rw-r--r--tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialRequest.java97
-rw-r--r--tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java168
-rw-r--r--tutorials/tutorial-xacml-application/src/main/resources/META-INF/services/org.onap.policy.pdp.xacml.application.common.XacmlApplicationServiceProvider1
-rw-r--r--tutorials/tutorial-xacml-application/src/main/resources/xacml.properties31
-rw-r--r--tutorials/tutorial-xacml-application/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java120
-rw-r--r--tutorials/tutorial-xacml-application/src/test/resources/tutorial-decision-request.json12
-rw-r--r--tutorials/tutorial-xacml-application/src/test/resources/tutorial-policies.yaml34
-rw-r--r--tutorials/tutorial-xacml-application/src/test/resources/tutorial-policy-type.yaml32
-rw-r--r--tutorials/tutorial-xacml-application/src/test/resources/xacml.properties31
17 files changed, 825 insertions, 0 deletions
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/Dockerfile b/tutorials/tutorial-xacml-application/src/main/docker/Dockerfile
new file mode 100644
index 00000000..26106512
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/Dockerfile
@@ -0,0 +1,7 @@
+FROM onap/policy-xacml-pdp
+
+ADD maven/${project.build.finalName}.jar /opt/app/policy/pdpx/lib/${project.build.finalName}.jar
+
+RUN mkdir -p /opt/app/policy/pdpx/apps/tutorial
+
+COPY --chown=policy:policy xacml.properties /opt/app/policy/pdpx/apps/tutorial \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/README.txt b/tutorials/tutorial-xacml-application/src/main/docker/README.txt
new file mode 100644
index 00000000..a29a44b2
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/README.txt
@@ -0,0 +1,36 @@
+docker-compose -f docker-compose.yml run --rm start_dependencies
+
+docker-compose -f docker-compose.yml run --rm start_all
+
+
+curl -X POST http://0.0.0.0:3904/events/POLICY-PDP-PAP
+
+Should return JSON similar to this:
+{"serverTimeMs":0,"count":0}
+
+
+curl -k -u 'healthcheck:zb!XztG34' 'https://0.0.0.0:6969/policy/pdpx/v1/healthcheck'
+
+Should return JSON similar to this:
+{"name":"Policy Xacml PDP","url":"self","healthy":true,"code":200,"message":"alive"}
+
+
+curl -k -u 'healthcheck:zb!XztG34' 'https://0.0.0.0:6767/policy/api/v1/healthcheck'
+Should return JSON similar to this:
+{
+ "name": "Policy API",
+ "url": "policy-api",
+ "healthy": true,
+ "code": 200,
+ "message": "alive"
+}
+
+curl -k -u 'healthcheck:zb!XztG34' 'https://0.0.0.0:6868/policy/pap/v1/healthcheck'
+Should return JSON similar to this:
+{
+ "name": "Policy PAP",
+ "url": "policy-pap",
+ "healthy": true,
+ "code": 200,
+ "message": "alive"
+} \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/config/db/db.conf b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db.conf
new file mode 100644
index 00000000..42f35844
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db.conf
@@ -0,0 +1,20 @@
+# ============LICENSE_START=======================================================
+# Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+MYSQL_ROOT_PASSWORD=secret
+MYSQL_USER=policy_user
+MYSQL_PASSWORD=policy_user \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/config/db/db.sh b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db.sh
new file mode 100644
index 00000000..499764df
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/config/db/db.sh
@@ -0,0 +1,26 @@
+#!/bin/bash -xv
+# ============LICENSE_START=======================================================
+# Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+
+for db in policyadmin operationshistory
+do
+ mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" --execute "CREATE DATABASE IF NOT EXISTS ${db};"
+ mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" --execute "GRANT ALL PRIVILEGES ON \`${db}\`.* TO '${MYSQL_USER}'@'%' ;"
+done
+
+mysql -uroot -p"${MYSQL_ROOT_PASSWORD}" --execute "FLUSH PRIVILEGES;"
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/config/sim/simParameters.json b/tutorials/tutorial-xacml-application/src/main/docker/config/sim/simParameters.json
new file mode 100644
index 00000000..bd435201
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/config/sim/simParameters.json
@@ -0,0 +1,15 @@
+{
+ "dmaapProvider": {
+ "name": "DMaaP simulator",
+ "topicSweepSec": 300
+ },
+ "restServers": [
+ {
+ "name": "DMaaP simulator",
+ "providerClass": "org.onap.policy.models.sim.dmaap.rest.DmaapSimRestControllerV1",
+ "host": "0.0.0.0",
+ "port": 3904,
+ "https": false
+ }
+ ]
+} \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/docker-compose.yml b/tutorials/tutorial-xacml-application/src/main/docker/docker-compose.yml
new file mode 100644
index 00000000..2809f646
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/docker-compose.yml
@@ -0,0 +1,106 @@
+# ============LICENSE_START=======================================================
+# Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+# ================================================================================
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# ============LICENSE_END=========================================================
+version: '2'
+services:
+ mariadb:
+ image: mariadb:10.2.14
+ container_name: mariadb
+ hostname: mariadb
+ command: ['--lower-case-table-names=1', '--wait_timeout=28800']
+ env_file: config/db/db.conf
+ volumes:
+ - ./config/db:/docker-entrypoint-initdb.d
+ expose:
+ - 3306
+ message-router:
+ image: nexus3.onap.org:10001/onap/policy-models-simulator:latest
+ container_name: dmaap-simulator
+ hostname: dmaap-simulator
+ volumes:
+ - ./config/sim:/opt/app/policy/simulators/etc/mounted:ro
+ ports:
+ - "3904:3904"
+ expose:
+ - 3904
+ api:
+ # Guilin released images
+ image: nexus3.onap.org:10001/onap/policy-api:2.3.3
+ container_name: policy-api
+ depends_on:
+ - mariadb
+ hostname: policy-api
+ ports:
+ - "6767:6969"
+ expose:
+ - 6767
+ pap:
+ # Guilin released images
+ image: nexus3.onap.org:10001/onap/policy-pap:2.3.3
+ container_name: policy-pap
+ depends_on:
+ - mariadb
+ - message-router
+ - api
+ hostname: policy-pap
+ ports:
+ - "6868:6969"
+ expose:
+ - 6868
+ xacml-pdp:
+ image: onap/policy-xacml-tutorial
+ container_name: policy-xacml-pdp
+ depends_on:
+ - mariadb
+ - message-router
+ - api
+ - pap
+ hostname: policy-xacml-pdp
+ ports:
+ - "6969:6969"
+ expose:
+ - 6969
+ start_dependencies:
+ image: dadarek/wait-for-dependencies
+ environment:
+ TIMEOUT_LENGTH: 60
+ container_name: policy-wait
+ depends_on:
+ - mariadb
+ - message-router
+ hostname: policy-wait
+ command:
+ mariadb:3306
+ message-router:3904
+ start_all:
+ image: dadarek/wait-for-dependencies
+ environment:
+ TIMEOUT_LENGTH: 60
+ container_name: policy-wait-all
+ depends_on:
+ - mariadb
+ - message-router
+ - api
+ - pap
+ - xacml-pdp
+ hostname: policy-wait-all
+ command:
+ mariadb:3306
+ message-router:3904
+ api:6969
+ pap:6969
+ xacml-pdp:6969
diff --git a/tutorials/tutorial-xacml-application/src/main/docker/xacml.properties b/tutorials/tutorial-xacml-application/src/main/docker/xacml.properties
new file mode 100644
index 00000000..277b098e
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/docker/xacml.properties
@@ -0,0 +1,31 @@
+#
+# Properties that the embedded PDP engine uses to configure and load
+#
+# Standard API Factories
+#
+xacml.dataTypeFactory=com.att.research.xacml.std.StdDataTypeFactory
+xacml.pdpEngineFactory=com.att.research.xacmlatt.pdp.ATTPDPEngineFactory
+xacml.pepEngineFactory=com.att.research.xacml.std.pep.StdEngineFactory
+xacml.pipFinderFactory=com.att.research.xacml.std.pip.StdPIPFinderFactory
+xacml.traceEngineFactory=com.att.research.xacml.std.trace.LoggingTraceEngineFactory
+#
+# AT&T PDP Implementation Factories
+#
+xacml.att.evaluationContextFactory=com.att.research.xacmlatt.pdp.std.StdEvaluationContextFactory
+xacml.att.combiningAlgorithmFactory=com.att.research.xacmlatt.pdp.std.StdCombiningAlgorithmFactory
+xacml.att.functionDefinitionFactory=com.att.research.xacmlatt.pdp.std.StdFunctionDefinitionFactory
+#
+# ONAP PDP Implementation Factories
+#
+xacml.att.policyFinderFactory=org.onap.policy.pdp.xacml.application.common.OnapPolicyFinderFactory
+
+#
+# Use a root combining algorithm
+#
+xacml.att.policyFinderFactory.combineRootPolicies=urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides
+
+#
+# Policies to load
+#
+xacml.rootPolicies=
+xacml.referencedPolicies= \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java b/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java
new file mode 100644
index 00000000..3c76494b
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialApplication.java
@@ -0,0 +1,58 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.tutorial.tutorial;
+
+import java.util.Arrays;
+import java.util.List;
+import org.onap.policy.models.tosca.authorative.concepts.ToscaPolicyTypeIdentifier;
+import org.onap.policy.pdp.xacml.application.common.ToscaPolicyTranslator;
+import org.onap.policy.pdp.xacml.application.common.std.StdXacmlApplicationServiceProvider;
+
+public class TutorialApplication extends StdXacmlApplicationServiceProvider {
+
+ private final ToscaPolicyTypeIdentifier supportedPolicyType =
+ new ToscaPolicyTypeIdentifier("onap.policies.Authorization", "1.0.0");
+ private final TutorialTranslator translator = new TutorialTranslator();
+
+ @Override
+ public String applicationName() {
+ return "tutorial";
+ }
+
+ @Override
+ public List<String> actionDecisionsSupported() {
+ return Arrays.asList("authorize");
+ }
+
+ @Override
+ public synchronized List<ToscaPolicyTypeIdentifier> supportedPolicyTypes() {
+ return Arrays.asList(supportedPolicyType);
+ }
+
+ @Override
+ public boolean canSupportPolicyType(ToscaPolicyTypeIdentifier policyTypeId) {
+ return supportedPolicyType.equals(policyTypeId);
+ }
+
+ @Override
+ protected ToscaPolicyTranslator getTranslator(String type) {
+ return translator;
+ }
+
+}
diff --git a/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialRequest.java b/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialRequest.java
new file mode 100644
index 00000000..4bb94cd7
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialRequest.java
@@ -0,0 +1,97 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.tutorial.tutorial;
+
+import com.att.research.xacml.std.annotations.XACMLAction;
+import com.att.research.xacml.std.annotations.XACMLRequest;
+import com.att.research.xacml.std.annotations.XACMLResource;
+import com.att.research.xacml.std.annotations.XACMLSubject;
+import java.util.Map;
+import java.util.Map.Entry;
+import lombok.Getter;
+import lombok.Setter;
+import lombok.ToString;
+import org.onap.policy.models.decisions.concepts.DecisionRequest;
+
+@Getter
+@Setter
+@ToString
+@XACMLRequest(ReturnPolicyIdList = true)
+public class TutorialRequest {
+ @XACMLSubject(includeInResults = true)
+ private String onapName;
+
+ @XACMLSubject(attributeId = "urn:org:onap:onap-component", includeInResults = true)
+ private String onapComponent;
+
+ @XACMLSubject(attributeId = "urn:org:onap:onap-instance", includeInResults = true)
+ private String onapInstance;
+
+ @XACMLAction()
+ private String action;
+
+ @XACMLResource(attributeId = "urn:org:onap:tutorial-user", includeInResults = true)
+ private String user;
+
+ @XACMLResource(attributeId = "urn:org:onap:tutorial-entity", includeInResults = true)
+ private String entity;
+
+ @XACMLResource(attributeId = "urn:org:onap:tutorial-permission", includeInResults = true)
+ private String permission;
+
+ /**
+ * createRequest.
+ *
+ * @param decisionRequest Incoming
+ * @return TutorialRequest object
+ */
+ public static TutorialRequest createRequest(DecisionRequest decisionRequest) {
+ //
+ // Create our object
+ //
+ TutorialRequest request = new TutorialRequest();
+ //
+ // Add the subject attributes
+ //
+ request.onapName = decisionRequest.getOnapName();
+ request.onapComponent = decisionRequest.getOnapComponent();
+ request.onapInstance = decisionRequest.getOnapInstance();
+ //
+ // Add the action attribute
+ //
+ request.action = decisionRequest.getAction();
+ //
+ // Add the resource attributes
+ //
+ Map<String, Object> resources = decisionRequest.getResource();
+ for (Entry<String, Object> entrySet : resources.entrySet()) {
+ if ("user".equals(entrySet.getKey())) {
+ request.user = entrySet.getValue().toString();
+ }
+ if ("entity".equals(entrySet.getKey())) {
+ request.entity = entrySet.getValue().toString();
+ }
+ if ("permission".equals(entrySet.getKey())) {
+ request.permission = entrySet.getValue().toString();
+ }
+ }
+
+ return request;
+ }
+}
diff --git a/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java b/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java
new file mode 100644
index 00000000..7a6b5d8a
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/java/org/onap/policy/tutorial/tutorial/TutorialTranslator.java
@@ -0,0 +1,168 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.tutorial.tutorial;
+
+import com.att.research.xacml.api.DataTypeException;
+import com.att.research.xacml.api.Decision;
+import com.att.research.xacml.api.Identifier;
+import com.att.research.xacml.api.Request;
+import com.att.research.xacml.api.Response;
+import com.att.research.xacml.api.Result;
+import com.att.research.xacml.api.XACML3;
+import com.att.research.xacml.std.IdentifierImpl;
+import com.att.research.xacml.std.annotations.RequestParser;
+import java.util.List;
+import java.util.Map;
+import oasis.names.tc.xacml._3_0.core.schema.wd_17.AnyOfType;
+import oasis.names.tc.xacml._3_0.core.schema.wd_17.EffectType;
+import oasis.names.tc.xacml._3_0.core.schema.wd_17.MatchType;
+import oasis.names.tc.xacml._3_0.core.schema.wd_17.PolicyType;
+import oasis.names.tc.xacml._3_0.core.schema.wd_17.RuleType;
+import oasis.names.tc.xacml._3_0.core.schema.wd_17.TargetType;
+import org.onap.policy.models.decisions.concepts.DecisionRequest;
+import org.onap.policy.models.decisions.concepts.DecisionResponse;
+import org.onap.policy.models.tosca.authorative.concepts.ToscaPolicy;
+import org.onap.policy.pdp.xacml.application.common.ToscaDictionary;
+import org.onap.policy.pdp.xacml.application.common.ToscaPolicyConversionException;
+import org.onap.policy.pdp.xacml.application.common.ToscaPolicyTranslator;
+import org.onap.policy.pdp.xacml.application.common.ToscaPolicyTranslatorUtils;
+
+public class TutorialTranslator implements ToscaPolicyTranslator {
+
+ private static final Identifier ID_TUTORIAL_USER = new IdentifierImpl(ToscaDictionary.ID_URN_ONAP, "tutorial-user");
+ private static final Identifier ID_TUTORIAL_ENTITY =
+ new IdentifierImpl(ToscaDictionary.ID_URN_ONAP, "tutorial-entity");
+ private static final Identifier ID_TUTORIAL_PERM =
+ new IdentifierImpl(ToscaDictionary.ID_URN_ONAP, "tutorial-permission");
+
+ /**
+ * Convert Policy from TOSCA to XACML.
+ */
+ @SuppressWarnings("unchecked")
+ public PolicyType convertPolicy(ToscaPolicy toscaPolicy) throws ToscaPolicyConversionException {
+ //
+ // Here is our policy with a version and default combining algo
+ //
+ PolicyType newPolicyType = new PolicyType();
+ newPolicyType.setPolicyId(toscaPolicy.getMetadata().get("policy-id"));
+ newPolicyType.setVersion(toscaPolicy.getMetadata().get("policy-version"));
+ //
+ // When choosing the rule combining algorithm, be sure to be mindful of the
+ // setting xacml.att.policyFinderFactory.combineRootPolicies in the
+ // xacml.properties file. As that choice for ALL the policies together may have
+ // an impact on the decision rendered from each individual policy.
+ //
+ // In this case, we will only produce XACML rules for permissions. If no permission
+ // combo exists, then the default is to deny.
+ //
+ newPolicyType.setRuleCombiningAlgId(XACML3.ID_RULE_DENY_UNLESS_PERMIT.stringValue());
+ //
+ // Create the target for the Policy.
+ //
+ // For simplicity, let's just match on the action "authorize" and the user
+ //
+ MatchType matchAction = ToscaPolicyTranslatorUtils.buildMatchTypeDesignator(
+ XACML3.ID_FUNCTION_STRING_EQUAL, "authorize", XACML3.ID_DATATYPE_STRING,
+ XACML3.ID_ACTION_ACTION_ID, XACML3.ID_ATTRIBUTE_CATEGORY_ACTION);
+ Map<String, Object> props = toscaPolicy.getProperties();
+ String user = props.get("user").toString();
+ MatchType matchUser = ToscaPolicyTranslatorUtils.buildMatchTypeDesignator(XACML3.ID_FUNCTION_STRING_EQUAL, user,
+ XACML3.ID_DATATYPE_STRING, ID_TUTORIAL_USER, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE);
+ AnyOfType anyOf = new AnyOfType();
+ //
+ // Create AllOf (AND) of just Policy Id
+ //
+ anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchAction, matchUser));
+ TargetType target = new TargetType();
+ target.getAnyOf().add(anyOf);
+ newPolicyType.setTarget(target);
+ //
+ // Now add the rule for each permission
+ //
+ int ruleNumber = 0;
+ List<Object> permissions = (List<Object>) props.get("permissions");
+ for (Object permission : permissions) {
+
+ MatchType matchEntity = ToscaPolicyTranslatorUtils.buildMatchTypeDesignator(XACML3.ID_FUNCTION_STRING_EQUAL,
+ ((Map<String, String>) permission).get("entity"), XACML3.ID_DATATYPE_STRING, ID_TUTORIAL_ENTITY,
+ XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE);
+
+ MatchType matchPermission = ToscaPolicyTranslatorUtils.buildMatchTypeDesignator(
+ XACML3.ID_FUNCTION_STRING_EQUAL, ((Map<String, String>) permission).get("permission"),
+ XACML3.ID_DATATYPE_STRING, ID_TUTORIAL_PERM, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE);
+ anyOf = new AnyOfType();
+ anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(matchEntity, matchPermission));
+ target = new TargetType();
+ target.getAnyOf().add(anyOf);
+
+ RuleType rule = new RuleType();
+ rule.setDescription("Default is to PERMIT if the policy matches.");
+ rule.setRuleId(newPolicyType.getPolicyId() + ":rule" + ruleNumber);
+
+ rule.setEffect(EffectType.PERMIT);
+ rule.setTarget(target);
+
+ newPolicyType.getCombinerParametersOrRuleCombinerParametersOrVariableDefinition().add(rule);
+
+ ruleNumber++;
+ }
+ return newPolicyType;
+ }
+
+ /**
+ * Convert ONAP DecisionRequest to XACML Request.
+ */
+ public Request convertRequest(DecisionRequest request) {
+ try {
+ return RequestParser.parseRequest(TutorialRequest.createRequest(request));
+ } catch (IllegalArgumentException | IllegalAccessException | DataTypeException e) {
+ // Empty
+ }
+ return null;
+ }
+
+ /**
+ * Convert XACML Response to ONAP DecisionResponse.
+ */
+ public DecisionResponse convertResponse(Response xacmlResponse) {
+ DecisionResponse decisionResponse = new DecisionResponse();
+ //
+ // Iterate through all the results
+ //
+ for (Result xacmlResult : xacmlResponse.getResults()) {
+ //
+ // Check the result
+ //
+ if (xacmlResult.getDecision() == Decision.PERMIT) {
+ //
+ // Just simply return a Permit response
+ //
+ decisionResponse.setStatus(Decision.PERMIT.toString());
+ } else {
+ //
+ // Just simply return a Deny response
+ //
+ decisionResponse.setStatus(Decision.DENY.toString());
+ }
+ }
+
+ return decisionResponse;
+ }
+
+}
diff --git a/tutorials/tutorial-xacml-application/src/main/resources/META-INF/services/org.onap.policy.pdp.xacml.application.common.XacmlApplicationServiceProvider b/tutorials/tutorial-xacml-application/src/main/resources/META-INF/services/org.onap.policy.pdp.xacml.application.common.XacmlApplicationServiceProvider
new file mode 100644
index 00000000..942cc596
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/resources/META-INF/services/org.onap.policy.pdp.xacml.application.common.XacmlApplicationServiceProvider
@@ -0,0 +1 @@
+org.onap.policy.tutorial.tutorial.TutorialApplication \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/main/resources/xacml.properties b/tutorials/tutorial-xacml-application/src/main/resources/xacml.properties
new file mode 100644
index 00000000..277b098e
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/main/resources/xacml.properties
@@ -0,0 +1,31 @@
+#
+# Properties that the embedded PDP engine uses to configure and load
+#
+# Standard API Factories
+#
+xacml.dataTypeFactory=com.att.research.xacml.std.StdDataTypeFactory
+xacml.pdpEngineFactory=com.att.research.xacmlatt.pdp.ATTPDPEngineFactory
+xacml.pepEngineFactory=com.att.research.xacml.std.pep.StdEngineFactory
+xacml.pipFinderFactory=com.att.research.xacml.std.pip.StdPIPFinderFactory
+xacml.traceEngineFactory=com.att.research.xacml.std.trace.LoggingTraceEngineFactory
+#
+# AT&T PDP Implementation Factories
+#
+xacml.att.evaluationContextFactory=com.att.research.xacmlatt.pdp.std.StdEvaluationContextFactory
+xacml.att.combiningAlgorithmFactory=com.att.research.xacmlatt.pdp.std.StdCombiningAlgorithmFactory
+xacml.att.functionDefinitionFactory=com.att.research.xacmlatt.pdp.std.StdFunctionDefinitionFactory
+#
+# ONAP PDP Implementation Factories
+#
+xacml.att.policyFinderFactory=org.onap.policy.pdp.xacml.application.common.OnapPolicyFinderFactory
+
+#
+# Use a root combining algorithm
+#
+xacml.att.policyFinderFactory.combineRootPolicies=urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides
+
+#
+# Policies to load
+#
+xacml.rootPolicies=
+xacml.referencedPolicies= \ No newline at end of file
diff --git a/tutorials/tutorial-xacml-application/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java b/tutorials/tutorial-xacml-application/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java
new file mode 100644
index 00000000..28d25ee8
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/test/java/org/onap/policy/tutorial/tutorial/TutorialApplicationTest.java
@@ -0,0 +1,120 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * Copyright (C) 2020 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.policy.tutorial.tutorial;
+
+import static org.junit.Assert.assertEquals;
+
+import com.att.research.xacml.api.Response;
+import java.io.File;
+import java.io.IOException;
+import java.util.Properties;
+import java.util.ServiceLoader;
+import org.apache.commons.lang3.tuple.Pair;
+import org.junit.BeforeClass;
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+import org.onap.policy.common.endpoints.parameters.RestServerParameters;
+import org.onap.policy.common.utils.coder.CoderException;
+import org.onap.policy.common.utils.coder.StandardCoder;
+import org.onap.policy.common.utils.resources.TextFileUtils;
+import org.onap.policy.models.decisions.concepts.DecisionRequest;
+import org.onap.policy.models.decisions.concepts.DecisionResponse;
+import org.onap.policy.pdp.xacml.application.common.XacmlApplicationException;
+import org.onap.policy.pdp.xacml.application.common.XacmlApplicationServiceProvider;
+import org.onap.policy.pdp.xacml.application.common.XacmlPolicyUtils;
+import org.onap.policy.pdp.xacml.xacmltest.TestUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class TutorialApplicationTest {
+ private static final Logger LOGGER = LoggerFactory.getLogger(TutorialApplicationTest.class);
+ private static Properties properties = new Properties();
+ private static File propertiesFile;
+ private static XacmlApplicationServiceProvider service;
+ private static StandardCoder gson = new StandardCoder();
+
+ @ClassRule
+ public static final TemporaryFolder policyFolder = new TemporaryFolder();
+
+ /**
+ * setup the tests.
+ *
+ * @throws Exception Should not have exceptions thrown.
+ */
+ @BeforeClass
+ public static void setup() throws Exception {
+ //
+ // Setup our temporary folder
+ //
+ XacmlPolicyUtils.FileCreator myCreator = (String filename) -> policyFolder.newFile(filename);
+ propertiesFile = XacmlPolicyUtils.copyXacmlPropertiesContents("src/test/resources/xacml.properties",
+ properties, myCreator);
+ //
+ // Load XacmlApplicationServiceProvider service
+ //
+ ServiceLoader<XacmlApplicationServiceProvider> applicationLoader =
+ ServiceLoader.load(XacmlApplicationServiceProvider.class);
+ //
+ // Look for our class instance and save it
+ //
+ for (XacmlApplicationServiceProvider application : applicationLoader) {
+ //
+ // Is it our service?
+ //
+ if (application instanceof TutorialApplication) {
+ service = application;
+ }
+ }
+ //
+ // Tell the application to initialize based on the properties file
+ // we just built for it.
+ //
+ service.initialize(propertiesFile.toPath().getParent(), new RestServerParameters());
+ }
+
+ @Test
+ public void test() throws CoderException, XacmlApplicationException, IOException {
+ //
+ // Now load the tutorial policies.
+ //
+ TestUtils.loadPolicies("src/test/resources/tutorial-policies.yaml", service);
+ //
+ // Load a Decision request
+ //
+ DecisionRequest decisionRequest = gson.decode(
+ TextFileUtils
+ .getTextFileAsString("src/test/resources/tutorial-decision-request.json"),
+ DecisionRequest.class);
+ //
+ // Test a decision - should start with a permit
+ //
+ Pair<DecisionResponse, Response> decision = service.makeDecision(decisionRequest, null);
+ LOGGER.info(decision.getLeft().toString());
+ assertEquals("Permit", decision.getLeft().getStatus());
+ //
+ // This should be a deny
+ //
+ decisionRequest.getResource().put("user", "audit");
+ decision = service.makeDecision(decisionRequest, null);
+ LOGGER.info(decision.getLeft().toString());
+ assertEquals("Deny", decision.getLeft().getStatus());
+ }
+
+}
diff --git a/tutorials/tutorial-xacml-application/src/test/resources/tutorial-decision-request.json b/tutorials/tutorial-xacml-application/src/test/resources/tutorial-decision-request.json
new file mode 100644
index 00000000..f3a7f9a2
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/test/resources/tutorial-decision-request.json
@@ -0,0 +1,12 @@
+{
+ "ONAPName": "TutorialPEP",
+ "ONAPComponent": "TutorialPEPComponent",
+ "ONAPInstance": "TutorialPEPInstance",
+ "requestId": "unique-request-id-tutorial",
+ "action": "authorize",
+ "resource": {
+ "user": "demo",
+ "entity": "foo",
+ "permission" : "write"
+ }
+}
diff --git a/tutorials/tutorial-xacml-application/src/test/resources/tutorial-policies.yaml b/tutorials/tutorial-xacml-application/src/test/resources/tutorial-policies.yaml
new file mode 100644
index 00000000..fa353653
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/test/resources/tutorial-policies.yaml
@@ -0,0 +1,34 @@
+tosca_definitions_version: tosca_simple_yaml_1_1_0
+topology_template:
+ policies:
+ -
+ onap.policy.tutorial.demo:
+ type: onap.policies.Authorization
+ type_version: 1.0.0
+ version: 1.0.0
+ metadata:
+ policy-id: onap.policy.tutorial.demo
+ policy-version: 1
+ properties:
+ user: demo
+ permissions:
+ -
+ entity: foo
+ permission: read
+ -
+ entity: foo
+ permission: write
+ -
+ onap.policy.tutorial.audit:
+ type: onap.policies.Authorization
+ version: 1.0.0
+ type_version: 1.0.0
+ metadata:
+ policy-id: onap.policy.tutorial.bar
+ policy-version: 1
+ properties:
+ user: audit
+ permissions:
+ -
+ entity: foo
+ permission: read
diff --git a/tutorials/tutorial-xacml-application/src/test/resources/tutorial-policy-type.yaml b/tutorials/tutorial-xacml-application/src/test/resources/tutorial-policy-type.yaml
new file mode 100644
index 00000000..7948bd28
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/test/resources/tutorial-policy-type.yaml
@@ -0,0 +1,32 @@
+tosca_definitions_version: tosca_simple_yaml_1_1_0
+policy_types:
+ onap.policies.Authorization:
+ derived_from: tosca.policies.Root
+ version: 1.0.0
+ description: Example tutorial policy type for doing user authorization
+ properties:
+ user:
+ type: string
+ required: true
+ description: The unique user name
+ permissions:
+ type: list
+ required: true
+ description: A list of resource permissions
+ entry_schema:
+ type: onap.datatypes.Tutorial
+data_types:
+ onap.datatypes.Tutorial:
+ derived_from: tosca.datatypes.Root
+ version: 1.0.0
+ properties:
+ entity:
+ type: string
+ required: true
+ description: The resource
+ permission:
+ type: string
+ required: true
+ description: The permission level
+ constraints:
+ - valid_values: [read, write, delete]
diff --git a/tutorials/tutorial-xacml-application/src/test/resources/xacml.properties b/tutorials/tutorial-xacml-application/src/test/resources/xacml.properties
new file mode 100644
index 00000000..277b098e
--- /dev/null
+++ b/tutorials/tutorial-xacml-application/src/test/resources/xacml.properties
@@ -0,0 +1,31 @@
+#
+# Properties that the embedded PDP engine uses to configure and load
+#
+# Standard API Factories
+#
+xacml.dataTypeFactory=com.att.research.xacml.std.StdDataTypeFactory
+xacml.pdpEngineFactory=com.att.research.xacmlatt.pdp.ATTPDPEngineFactory
+xacml.pepEngineFactory=com.att.research.xacml.std.pep.StdEngineFactory
+xacml.pipFinderFactory=com.att.research.xacml.std.pip.StdPIPFinderFactory
+xacml.traceEngineFactory=com.att.research.xacml.std.trace.LoggingTraceEngineFactory
+#
+# AT&T PDP Implementation Factories
+#
+xacml.att.evaluationContextFactory=com.att.research.xacmlatt.pdp.std.StdEvaluationContextFactory
+xacml.att.combiningAlgorithmFactory=com.att.research.xacmlatt.pdp.std.StdCombiningAlgorithmFactory
+xacml.att.functionDefinitionFactory=com.att.research.xacmlatt.pdp.std.StdFunctionDefinitionFactory
+#
+# ONAP PDP Implementation Factories
+#
+xacml.att.policyFinderFactory=org.onap.policy.pdp.xacml.application.common.OnapPolicyFinderFactory
+
+#
+# Use a root combining algorithm
+#
+xacml.att.policyFinderFactory.combineRootPolicies=urn:oasis:names:tc:xacml:3.0:policy-combining-algorithm:deny-overrides
+
+#
+# Policies to load
+#
+xacml.rootPolicies=
+xacml.referencedPolicies= \ No newline at end of file