2 * ============LICENSE_START=======================================================
4 * ================================================================================
5 * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6 * ================================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END=========================================================
20 package org.openecomp.policy.xacml.std.pip.engines.aaf;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.Collection;
25 import java.util.HashMap;
26 import java.util.Iterator;
27 import java.util.List;
29 import java.util.Properties;
31 import org.apache.commons.logging.Log;
32 import org.apache.commons.logging.LogFactory;
33 import org.openecomp.policy.utils.AAFPolicyClient;
34 import org.openecomp.policy.utils.AAFPolicyException;
36 import com.att.research.xacml.api.Attribute;
37 import com.att.research.xacml.api.AttributeValue;
38 import com.att.research.xacml.api.Identifier;
39 import com.att.research.xacml.api.XACML3;
40 import com.att.research.xacml.api.pip.PIPException;
41 import com.att.research.xacml.api.pip.PIPFinder;
42 import com.att.research.xacml.api.pip.PIPRequest;
43 import com.att.research.xacml.api.pip.PIPResponse;
44 import com.att.research.xacml.std.IdentifierImpl;
45 import com.att.research.xacml.std.StdMutableAttribute;
46 import com.att.research.xacml.std.datatypes.DataTypes;
47 import com.att.research.xacml.std.pip.StdMutablePIPResponse;
48 import com.att.research.xacml.std.pip.StdPIPRequest;
49 import com.att.research.xacml.std.pip.StdPIPResponse;
50 import com.att.research.xacml.std.pip.engines.StdConfigurableEngine;
51 import com.att.research.xacml.util.XACMLProperties;
54 * PIP Engine for Implementing {@link com.att.research.xacml.std.pip.engines.ConfigurableEngine} interface to provide
55 * attribute retrieval from AT&T AAF interface.
59 public class AAFEngine extends StdConfigurableEngine {
61 public static final String DEFAULT_DESCRIPTION = "PIP for authenticating aaf attributes using the AT&T AAF REST interface";
62 public static final String DEFAULT_ISSUER = "att-aaf";
64 private static final String SUCCESS = "Success";
66 public static final String AAF_RESULT= "AAF_RESULT";
67 public static final String AAF_RESPONSE= "AAF_RESPONSE";
69 public static final Identifier AAF_RESPONSE_ID = new IdentifierImpl(AAF_RESPONSE);
70 public static final Identifier AAF_RESULT_ID = new IdentifierImpl(AAF_RESULT);
73 private static final PIPRequest PIP_REQUEST_UID = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ID"), XACML3.ID_DATATYPE_STRING);
74 private static final PIPRequest PIP_REQUEST_PASS = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_PASS"), XACML3.ID_DATATYPE_STRING);
75 private static final PIPRequest PIP_REQUEST_TYPE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_TYPE"), XACML3.ID_DATATYPE_STRING);
76 private static final PIPRequest PIP_REQUEST_INSTANCE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_INSTANCE"), XACML3.ID_DATATYPE_STRING);
77 private static final PIPRequest PIP_REQUEST_ACTION = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ACTION"), XACML3.ID_DATATYPE_STRING);
79 private static final List<PIPRequest> mapRequiredAttributes = new ArrayList<>();
81 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_UID));
82 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_PASS));
83 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_TYPE));
84 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_INSTANCE));
85 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_ACTION));
88 private static final Map<PIPRequest, String> mapSupportedAttributes = new HashMap<>();
90 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, XACML3.ID_DATATYPE_STRING), "response");
91 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, XACML3.ID_DATATYPE_BOOLEAN), "result");
94 protected Log logger = LogFactory.getLog(this.getClass());
100 private PIPResponse getAttribute(PIPRequest pipRequest, PIPFinder pipFinder) {
101 PIPResponse pipResponse = null;
103 pipResponse = pipFinder.getMatchingAttributes(pipRequest, this);
104 if (pipResponse.getStatus() != null && !pipResponse.getStatus().isOk()) {
105 this.logger.warn("Error retrieving " + pipRequest.getAttributeId().stringValue() + ": " + pipResponse.getStatus().toString());
108 if (pipResponse != null && pipResponse.getAttributes().isEmpty()) {
109 this.logger.warn("No value for " + pipRequest.getAttributeId().stringValue());
112 } catch (PIPException ex) {
113 this.logger.error("PIPException getting subject-id attribute: " + ex.getMessage(), ex);
118 private String getValue(PIPResponse pipResponse){
119 String result = null;
120 Collection<Attribute> listAttributes = pipResponse.getAttributes();
121 for(Attribute attribute: listAttributes){
122 Iterator<AttributeValue<String>> iterAttributeValues = attribute.findValues(DataTypes.DT_STRING);
123 if(iterAttributeValues!=null) {
124 while(iterAttributeValues.hasNext()){
125 result = iterAttributeValues.next().getValue();
133 private synchronized String getResult(PIPFinder pipFinder) {
134 PIPResponse pipResponseUID = this.getAttribute(PIP_REQUEST_UID, pipFinder);
135 PIPResponse pipResponsePass = this.getAttribute(PIP_REQUEST_PASS, pipFinder);
136 PIPResponse pipResponseType = this.getAttribute(PIP_REQUEST_TYPE, pipFinder);
137 PIPResponse pipResponseAction = this.getAttribute(PIP_REQUEST_ACTION, pipFinder);
138 PIPResponse pipResponseInstance = this.getAttribute(PIP_REQUEST_INSTANCE, pipFinder);
139 String response = null;
140 // Evaluate AAF if we have all the required values.
141 if(pipResponseUID!=null && pipResponsePass!=null && pipResponseType != null && pipResponseAction!= null && pipResponseInstance!=null){
142 String userName = getValue(pipResponseUID);
143 String pass = getValue(pipResponsePass);
145 AAFPolicyClient aafClient = null;
146 Properties properties;
148 properties = XACMLProperties.getProperties();
149 logger.debug("environment : " + properties.getProperty("ENVIRONMENT"));
150 } catch (IOException e1) {
151 logger.error("Exception while getting the properties " + e1);
152 properties = new Properties();
153 properties.setProperty("AAF_LOG_LEVEL", "DEBUG");
155 if(userName!=null && pass!=null){
157 aafClient = AAFPolicyClient.getInstance(properties);
158 } catch (AAFPolicyException e) {
159 logger.error("AAF configuration failed. " + e.getMessage() +e);
162 if(aafClient.checkAuth(userName, pass)){
163 String type = getValue(pipResponseType);
164 String instance = getValue(pipResponseInstance);
165 String action = getValue(pipResponseAction);
166 if(aafClient.checkPerm(userName, pass, type, instance, action)){
167 response = SUCCESS + "Permissions Validated";
169 response = "No Permissions for "+userName+" to: "+type+", "+instance+", "+action;
172 response = "Authentication Failed for the given Values";
176 response = "ID and Password are not given";
180 response = "Insufficient Values to Evaluate AAF";
185 private void addStringAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, String value) {
187 AttributeValue<String> attributeValue = null;
189 attributeValue = DataTypes.DT_STRING.createAttributeValue(value);
190 } catch (Exception ex) {
191 this.logger.error("Failed to convert " + value + " to an AttributeValue<String>", ex);
193 if (attributeValue != null) {
194 stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
199 private void addBooleanAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, boolean value) {
200 AttributeValue<Boolean> attributeValue = null;
202 attributeValue = DataTypes.DT_BOOLEAN.createAttributeValue(value);
203 } catch (Exception ex) {
204 this.logger.error("Failed to convert " + value + " to an AttributeValue<Boolean>", ex);
206 if (attributeValue != null) {
207 stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
212 public PIPResponse getAttributes(PIPRequest pipRequest, PIPFinder pipFinder) throws PIPException {
214 * First check to see if the issuer is set and then match it
218 if((string = pipRequest.getIssuer()) != null && !string.equals(this.getIssuer())) {
219 this.logger.debug("Requested issuer '" + string + "' does not match " + (this.getIssuer() == null ? "null" : "'" + this.getIssuer() + "'"));
220 return StdPIPResponse.PIP_RESPONSE_EMPTY;
225 * Drop the issuer and see if the request matches any of our supported queries
227 PIPRequest pipRequestSupported = (pipRequest.getIssuer() == null ? pipRequest : new StdPIPRequest(pipRequest.getCategory(), pipRequest.getAttributeId(), pipRequest.getDataTypeId()));
228 if (!mapSupportedAttributes.containsKey(pipRequestSupported)) {
229 this.logger.debug("Requested attribute '" + pipRequest.toString() + "' is not supported");
230 return StdPIPResponse.PIP_RESPONSE_EMPTY;
232 StdMutablePIPResponse stdPIPResponse = new StdMutablePIPResponse();
233 String response = this.getResult(pipFinder);
234 boolean result = false;
235 if(response != null && response.contains(SUCCESS)){
238 this.addBooleanAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, result);
239 this.addStringAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, response);
240 return new StdPIPResponse(stdPIPResponse);
244 public void configure(String id, Properties properties) throws PIPException {
245 super.configure(id, properties);
246 if (this.getDescription() == null) {
247 this.setDescription(DEFAULT_DESCRIPTION);
249 if (this.getIssuer() == null) {
250 this.setIssuer(DEFAULT_ISSUER);
255 public Collection<PIPRequest> attributesRequired() {
256 List<PIPRequest> attributes = new ArrayList<>();
257 for (PIPRequest attribute: mapRequiredAttributes) {
258 attributes.add(new StdPIPRequest(attribute));
264 public Collection<PIPRequest> attributesProvided() {
265 List<PIPRequest> attributes = new ArrayList<>();
266 for (PIPRequest attribute : mapSupportedAttributes.keySet()) {
267 attributes.add(new StdPIPRequest(attribute));