2 * ============LICENSE_START=======================================================
4 * ================================================================================
5 * Copyright (C) 2017-2019 AT&T Intellectual Property. All rights reserved.
6 * Modified Copyright (C) 2018 Samsung Electronics Co., Ltd.
7 * Modifications Copyright (C) 2019 Bell Canada
8 * ================================================================================
9 * Licensed under the Apache License, Version 2.0 (the "License");
10 * you may not use this file except in compliance with the License.
11 * You may obtain a copy of the License at
13 * http://www.apache.org/licenses/LICENSE-2.0
15 * Unless required by applicable law or agreed to in writing, software
16 * distributed under the License is distributed on an "AS IS" BASIS,
17 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18 * See the License for the specific language governing permissions and
19 * limitations under the License.
20 * ============LICENSE_END=========================================================
23 package org.onap.policy.admin;
25 import com.att.research.xacml.api.pap.PAPException;
26 import com.att.research.xacml.api.pap.PDPPolicy;
27 import com.att.research.xacml.api.pap.PDPStatus;
28 import com.att.research.xacml.util.XACMLProperties;
29 import com.fasterxml.jackson.databind.DeserializationFeature;
30 import com.fasterxml.jackson.databind.ObjectMapper;
31 import com.fasterxml.jackson.databind.type.CollectionType;
34 import java.io.FileInputStream;
35 import java.io.IOException;
36 import java.io.InputStream;
37 import java.io.OutputStream;
38 import java.io.UnsupportedEncodingException;
39 import java.net.HttpURLConnection;
41 import java.net.URLConnection;
42 import java.net.URLEncoder;
43 import java.nio.charset.StandardCharsets;
44 import java.util.Arrays;
45 import java.util.Base64;
46 import java.util.Collections;
47 import java.util.HashMap;
51 import org.apache.commons.io.IOUtils;
52 import org.apache.commons.lang.StringUtils;
53 import org.onap.policy.common.logging.flexlogger.FlexLogger;
54 import org.onap.policy.common.logging.flexlogger.Logger;
55 import org.onap.policy.rest.XACMLRestProperties;
56 import org.onap.policy.rest.adapter.PolicyRestAdapter;
57 import org.onap.policy.utils.PeCryptoUtils;
58 import org.onap.policy.xacml.api.XACMLErrorConstants;
59 import org.onap.policy.xacml.api.pap.OnapPDP;
60 import org.onap.policy.xacml.api.pap.OnapPDPGroup;
61 import org.onap.policy.xacml.api.pap.PAPPolicyEngine;
62 import org.onap.policy.xacml.std.pap.StdPAPPolicy;
63 import org.onap.policy.xacml.std.pap.StdPDP;
64 import org.onap.policy.xacml.std.pap.StdPDPGroup;
65 import org.onap.policy.xacml.std.pap.StdPDPItemSetChangeNotifier;
66 import org.onap.policy.xacml.std.pap.StdPDPPolicy;
67 import org.onap.policy.xacml.std.pap.StdPDPStatus;
70 * Implementation of the PAPEngine interface that communicates with a PAP engine in a remote servlet through a RESTful
75 public class RESTfulPAPEngine extends StdPDPItemSetChangeNotifier implements PAPPolicyEngine {
76 private static final Logger LOGGER = FlexLogger.getLogger(RESTfulPAPEngine.class);
78 private static final String GROUP_ID = "groupId=";
79 private static final String UNABLE_MSG = "Unable to PUT policy '";
80 private static final String EXCEPTION_MSG = "', e:";
81 private static final String ERROR_MSG = "error";
82 private static final String PDPID_MSG = "pdpId=";
85 // URL of the PAP Servlet that this Admin Console talks to
87 private String papServletUrlString;
90 * Set up link with PAP Servlet and get our initial set of Groups.
92 * @throws PAPException When failing to register with PAP
94 public RESTfulPAPEngine(String myUrlString) throws PAPException {
96 // Get our URL to the PAP servlet
98 this.papServletUrlString = XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_URL);
99 if (StringUtils.isBlank(this.papServletUrlString)) {
100 String message = "The property 'POLICYENGINE_ADMIN_ACTIVE' was not set during installation. "
101 + "Admin Console cannot call PAP.";
102 LOGGER.error(message);
103 throw new PAPException(message);
107 // register this Admin Console with the PAP Servlet to get updates
109 Object newUrl = sendToPap("PUT", null, null, null, "adminConsoleURL=" + myUrlString);
110 if (newUrl != null) {
111 // assume this was a re-direct and try again
112 LOGGER.warn("Redirecting to '" + newUrl + "'");
113 this.papServletUrlString = (String) newUrl;
114 newUrl = sendToPap("PUT", null, null, null, "adminConsoleURL=" + myUrlString);
115 if (newUrl != null) {
116 LOGGER.error("Failed to redirect to " + this.papServletUrlString);
117 throw new PAPException("Failed to register with PAP");
123 // High-level commands used by the Admin Console code through the PAPEngine Interface
127 public OnapPDPGroup getDefaultGroup() throws PAPException {
128 return (OnapPDPGroup) sendToPap("GET", null, null, StdPDPGroup.class, GROUP_ID, "default=");
132 public void setDefaultGroup(OnapPDPGroup group) throws PAPException {
133 sendToPap("POST", null, null, null, GROUP_ID + group.getId(), "default=true");
136 @SuppressWarnings("unchecked")
138 public Set<OnapPDPGroup> getOnapPDPGroups() throws PAPException {
139 Set<OnapPDPGroup> newGroupSet;
140 newGroupSet = (Set<OnapPDPGroup>) this.sendToPap("GET", null, Set.class, StdPDPGroup.class, GROUP_ID);
141 return Collections.unmodifiableSet(newGroupSet);
145 public OnapPDPGroup getGroup(String id) throws PAPException {
146 return (OnapPDPGroup) sendToPap("GET", null, null, StdPDPGroup.class, GROUP_ID + id);
150 public void newGroup(String name, String description) throws PAPException {
152 String escapedDescription;
154 escapedName = URLEncoder.encode(name, "UTF-8");
155 escapedDescription = URLEncoder.encode(description, "UTF-8");
156 } catch (UnsupportedEncodingException e) {
157 throw new PAPException("Unable to send name or description to PAP: " + e.getMessage() + e);
160 this.sendToPap("POST", null, null, null, GROUP_ID, "groupName=" + escapedName,
161 "groupDescription=" + escapedDescription);
165 public void updateGroup(OnapPDPGroup group) throws PAPException {
168 // ASSUME that all of the policies mentioned in this group are already located in the correct directory on
171 // Whenever a Policy is added to the group, that file must be automatically copied to the PAP from the
174 // Copy all policies from the local machine's workspace to the PAP's PDPGroup directory.
175 // This is not efficient since most of the policies will already exist there.
176 // However, the policy files are (probably!) not too huge, and this is a good way to ensure that any
177 // corrupted files on the PAP get refreshed.
178 // now update the group object on the PAP
179 sendToPap("PUT", group, null, null, GROUP_ID + group.getId());
180 } catch (Exception e) {
181 String message = UNABLE_MSG + group.getId() + EXCEPTION_MSG + e;
182 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + message, e);
183 throw new PAPException(message);
188 * Passing UserName to PAP Rest for Audit Logging.
190 * @see org.onap.policy.xacml.api.pap.PAPPolicyEngine#updateGroup(org.onap.policy.xacml.api.pap.OnapPDPGroup,
194 public void updateGroup(OnapPDPGroup group, String userName) throws PAPException {
196 sendToPap("PUT", group, null, null, GROUP_ID + group.getId(), "userId=" + userName);
197 } catch (Exception e) {
198 String message = UNABLE_MSG + group.getId() + EXCEPTION_MSG + e;
199 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + message, e);
200 throw new PAPException(message);
205 public void removeGroup(OnapPDPGroup group, OnapPDPGroup newGroup) throws PAPException {
206 String moveToGroupString = null;
207 if (newGroup != null) {
208 moveToGroupString = "movePDPsToGroupId=" + newGroup.getId();
210 sendToPap("DELETE", null, null, null, GROUP_ID + group.getId(), moveToGroupString);
214 public OnapPDPGroup getPDPGroup(OnapPDP pdp) throws PAPException {
215 return getPDPGroup(pdp.getId());
218 public OnapPDPGroup getPDPGroup(String pdpId) throws PAPException {
219 return (OnapPDPGroup) sendToPap("GET", null, null, StdPDPGroup.class, GROUP_ID, PDPID_MSG + pdpId,
224 public OnapPDP getPDP(String pdpId) throws PAPException {
225 return (OnapPDP) sendToPap("GET", null, null, StdPDP.class, GROUP_ID, PDPID_MSG + pdpId);
229 public void newPDP(String id, OnapPDPGroup group, String name, String description, int jmxport)
230 throws PAPException {
231 StdPDP newPdp = new StdPDP(id, name, description, jmxport);
232 sendToPap("PUT", newPdp, null, null, GROUP_ID + group.getId(), PDPID_MSG + id);
236 public void movePDP(OnapPDP pdp, OnapPDPGroup newGroup) throws PAPException {
237 sendToPap("POST", null, null, null, GROUP_ID + newGroup.getId(), PDPID_MSG + pdp.getId());
241 public void updatePDP(OnapPDP pdp) throws PAPException {
242 OnapPDPGroup group = getPDPGroup(pdp);
243 sendToPap("PUT", pdp, null, null, GROUP_ID + group.getId(), PDPID_MSG + pdp.getId());
247 public void removePDP(OnapPDP pdp) throws PAPException {
248 OnapPDPGroup group = getPDPGroup(pdp);
249 sendToPap("DELETE", null, null, null, GROUP_ID + group.getId(), PDPID_MSG + pdp.getId());
253 * validatePolicyRequest Creates a pap policy and then send to pap.
255 * @param policyAdapter Input Adapter
256 * @param policyType Type of Policy
257 * @return true if validated
258 * @throws PAPException exception if invalid
260 public boolean validatePolicyRequest(PolicyRestAdapter policyAdapter, String policyType) throws PAPException {
261 StdPAPPolicy newPapPolicy = new StdPAPPolicy(policyAdapter.getPolicyName(), policyAdapter.getConfigBodyData(),
262 policyAdapter.getConfigType(), "Base");
264 // send JSON object to PAP
265 return (Boolean) sendToPap("PUT", newPapPolicy, null, null, "operation=validate", "apiflag=admin",
266 "policyType=" + policyType);
270 public void publishPolicy(String id, String name, boolean isRoot, InputStream policy, OnapPDPGroup group)
271 throws PAPException {
272 // copy the (one) file into the target directory on the PAP servlet
273 copyFile(id, group, policy);
275 // adjust the local copy of the group to include the new policy
276 PDPPolicy pdpPolicy = new StdPDPPolicy(id, isRoot, name);
277 group.getPolicies().add(pdpPolicy);
279 // tell the PAP servlet to include the policy in the configuration
284 * Copy a single Policy file from the input stream to the PAP Servlet. Either this works (silently) or it throws an
287 * @param policyId ID of policy
288 * @param group PDP Group
289 * @param policy Input stream of policy
290 * @throws PAPException exception
292 public void copyFile(String policyId, OnapPDPGroup group, InputStream policy) throws PAPException {
293 // send the policy file to the PAP Servlet
295 sendToPap("POST", policy, null, null, GROUP_ID + group.getId(), "policyId=" + policyId);
296 } catch (Exception e) {
297 String message = UNABLE_MSG + policyId + EXCEPTION_MSG + e;
298 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + message, e);
299 throw new PAPException(message);
304 public void copyPolicy(PDPPolicy policy, OnapPDPGroup group) throws PAPException {
305 if (policy == null || group == null) {
306 throw new PAPException("Null input policy=" + policy + " group=" + group);
308 try (InputStream is = new FileInputStream(new File(policy.getLocation()))) {
309 copyFile(policy.getId(), group, is);
310 } catch (Exception e) {
311 String message = UNABLE_MSG + policy.getId() + EXCEPTION_MSG + e;
312 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + message, e);
313 throw new PAPException(message);
318 public void removePolicy(PDPPolicy policy, OnapPDPGroup group) throws PAPException {
319 throw new PAPException("NOT IMPLEMENTED");
323 * Special operation - Similar to the normal PAP operations but this one contacts the PDP directly to get detailed
326 * @param pdp PDP to get status
327 * @return PDPStatus object
328 * @throws PAPException Exception
331 public PDPStatus getStatus(OnapPDP pdp) throws PAPException {
332 return (StdPDPStatus) sendToPap("GET", pdp, null, StdPDPStatus.class);
336 // Internal Operations called by the PAPEngine Interface methods
340 * Send a request to the PAP Servlet and get the response.
342 * <p>The content is either an InputStream to be copied to the Request OutputStream OR it is an object that is to be
343 * encoded into JSON and pushed into the Request OutputStream.
345 * <p>The Request parameters may be encoded in multiple "name=value" sets, or parameters may be
346 * combined by the caller.
348 * @param method method
349 * @param content - EITHER an InputStream OR an Object to be encoded in JSON
350 * @param collectionTypeClass Collection
351 * @param responseContentClass Response Content
352 * @param parameters List of parameters
354 * @throws PAPException exception
356 @SuppressWarnings({"rawtypes", "unchecked"})
357 private Object sendToPap(String method, Object content, Class collectionTypeClass, Class responseContentClass,
358 String... parameters) throws PAPException {
359 HttpURLConnection connection = null;
360 String papID = XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_USERID);
361 LOGGER.info("User Id is " + papID);
362 PeCryptoUtils.initAesKey(XACMLProperties.getProperty(XACMLRestProperties.PROP_AES_KEY));
363 String papPass = PeCryptoUtils
364 .decrypt(PeCryptoUtils.decrypt(XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_PASS)));
365 Base64.Encoder encoder = Base64.getEncoder();
366 String encoding = encoder.encodeToString((papID + ":" + papPass).getBytes(StandardCharsets.UTF_8));
367 Object contentObj = content;
368 LOGGER.info("Encoding for the PAP is: " + encoding);
370 String fullUrl = papServletUrlString;
371 if (parameters != null && parameters.length > 0) {
372 StringBuilder queryString = new StringBuilder();
373 Arrays.stream(parameters).map(p -> "&" + p).forEach(queryString::append);
374 fullUrl += "?" + queryString.substring(1);
377 // special case - Status (actually the detailed status) comes from the PDP directly, not the PAP
378 if ("GET".equals(method) && (contentObj instanceof OnapPDP) && responseContentClass == StdPDPStatus.class) {
379 // Adjust the url and properties appropriately
380 String pdpID = ((OnapPDP) contentObj).getId();
381 fullUrl = pdpID + "?type=Status";
383 if (CheckPdpProperties.validateId(pdpID)) {
384 encoding = CheckPdpProperties.getEncoding(pdpID);
389 // Open up the connection
391 connection = (HttpURLConnection) makeConnection(fullUrl);
393 // Setup our method and headers
395 connection.setRequestMethod(method);
396 connection.setUseCaches(false);
398 // Adding this in. It seems the HttpUrlConnection class does NOT
399 // properly forward our headers for POST re-direction. It does so
400 // for a GET re-direction.
402 // So we need to handle this ourselves.
404 connection.setInstanceFollowRedirects(false);
405 connection.setRequestProperty("Authorization", "Basic " + encoding);
406 connection.setDoOutput(true);
407 connection.setDoInput(true);
409 if (contentObj != null) {
410 if (contentObj instanceof InputStream) {
411 sendCurrPolicyConfig(method, connection, (InputStream) contentObj);
413 // The contentObj is an object to be encoded in JSON
414 ObjectMapper mapper = new ObjectMapper();
415 mapper.writeValue(connection.getOutputStream(), contentObj);
421 connection.connect();
422 if (connection.getResponseCode() == 204) {
423 LOGGER.info("Success - no content.");
425 } else if (connection.getResponseCode() == 200) {
426 LOGGER.info("Success. We have a return object.");
427 String isValidData = connection.getHeaderField("isValidData");
428 String isSuccess = connection.getHeaderField("successMapKey");
429 Map<String, String> successMap = new HashMap<>();
430 if ("true".equalsIgnoreCase(isValidData)) {
431 LOGGER.info("Policy Data is valid.");
433 } else if ("false".equalsIgnoreCase(isValidData)) {
434 LOGGER.info("Policy Data is invalid.");
436 } else if ("success".equalsIgnoreCase(isSuccess)) {
437 LOGGER.info("Policy Created Successfully!");
438 String finalPolicyPath = connection.getHeaderField("finalPolicyPath");
439 successMap.put("success", finalPolicyPath);
441 } else if (ERROR_MSG.equalsIgnoreCase(isSuccess)) {
442 LOGGER.info("There was an error while creating the policy!");
443 successMap.put(ERROR_MSG, ERROR_MSG);
446 // get the response content into a String
447 String json = getJsonString(connection);
449 // convert Object sent as JSON into local object
450 ObjectMapper mapper = new ObjectMapper();
451 mapper.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
452 if (collectionTypeClass != null) {
453 // collection of objects expected
454 final CollectionType javaType = mapper.getTypeFactory()
455 .constructCollectionType(collectionTypeClass, responseContentClass);
456 return mapper.readValue(json, javaType);
458 // single value object expected
459 return mapper.readValue(json, responseContentClass);
462 } else if (connection.getResponseCode() >= 300 && connection.getResponseCode() <= 399) {
464 String newUrl = connection.getHeaderField("Location");
465 if (newUrl == null) {
467 "No Location header to redirect to when response code=" + connection.getResponseCode());
468 throw new IOException(
469 "No redirect Location header when response code=" + connection.getResponseCode());
471 int qindex = newUrl.indexOf('?');
473 newUrl = newUrl.substring(0, qindex);
475 LOGGER.info("Redirect seen. Redirecting " + fullUrl + " to " + newUrl);
478 LOGGER.warn("Unexpected response code: " + connection.getResponseCode() + " message: "
479 + connection.getResponseMessage());
480 throw new IOException(
481 "Server Response: " + connection.getResponseCode() + ": " + connection.getResponseMessage());
483 } catch (Exception e) {
484 LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR + "HTTP Request/Response to PAP: " + e, e);
485 throw new PAPException("Request/Response threw :" + e);
487 // cleanup the connection
488 if (connection != null) {
490 // For some reason trying to get the inputStream from the connection
491 // throws an exception rather than returning null when the InputStream does not exist.
492 InputStream is = connection.getInputStream();
496 } catch (IOException ex) {
497 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to close connection: " + ex, ex);
499 connection.disconnect();
504 private void sendCurrPolicyConfig(String method, final HttpURLConnection connection, InputStream contentObj) {
507 // Send our current policy configuration
509 try (OutputStream os = connection.getOutputStream()) {
510 int count = IOUtils.copy(contentObj, os);
511 if (LOGGER.isDebugEnabled()) {
512 LOGGER.debug("copied to output, bytes=" + count);
515 } catch (Exception e) {
516 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to write content in '" + method + "'", e);
520 private String getJsonString(final HttpURLConnection connection) throws IOException {
522 // read the inputStream into a buffer (trick found online scans entire input looking for end-of-file)
523 try (java.util.Scanner scanner = new java.util.Scanner(connection.getInputStream())) {
524 scanner.useDelimiter("\\A");
525 json = scanner.hasNext() ? scanner.next() : "";
526 } catch (Exception e) {
527 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to read inputStream from connection: " + e,
531 LOGGER.info("JSON response from PAP: " + json);
535 // these may be overridden by junit tests
537 protected URLConnection makeConnection(String fullUrl) throws IOException {
538 return new URL(fullUrl).openConnection();