aaf/src/main/java/com/att/cadi/aaf/v2_0/AAFTrustChecker.java

   1 /*******************************************************************************\r
   2  * ============LICENSE_START====================================================\r
   3  * * org.onap.aai\r
   4  * * ===========================================================================\r
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
   6  * * Copyright © 2017 Amdocs\r
   7  * * ===========================================================================\r
   8  * * Licensed under the Apache License, Version 2.0 (the "License");\r
   9  * * you may not use this file except in compliance with the License.\r
  10  * * You may obtain a copy of the License at\r
  11  * * \r
  12  *  *      http://www.apache.org/licenses/LICENSE-2.0\r
  13  * * \r
  14  *  * Unless required by applicable law or agreed to in writing, software\r
  15  * * distributed under the License is distributed on an "AS IS" BASIS,\r
  16  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  17  * * See the License for the specific language governing permissions and\r
  18  * * limitations under the License.\r
  19  * * ============LICENSE_END====================================================\r
  20  * *\r
  21  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
  22  * *\r
  23  ******************************************************************************/\r
  24 package com.att.cadi.aaf.v2_0;\r
  25 \r
  26 import javax.servlet.http.HttpServletRequest ;\r
  27 \r
  28 import com.att.cadi.Access;\r
  29 import com.att.cadi.Lur;\r
  30 import com.att.cadi.TrustChecker;\r
  31 import com.att.cadi.aaf.AAFPermission;\r
  32 import com.att.cadi.config.Config;\r
  33 import com.att.cadi.principal.TrustPrincipal;\r
  34 import com.att.cadi.taf.TafResp;\r
  35 import com.att.cadi.taf.TrustNotTafResp;\r
  36 import com.att.cadi.taf.TrustTafResp;\r
  37 import com.att.inno.env.Env;\r
  38 import com.att.inno.env.util.Split;\r
  39 \r
  40 public class AAFTrustChecker implements TrustChecker {\r
  41         private final String tag, id;\r
  42         private final AAFPermission perm;\r
  43         private Lur lur;\r
  44 \r
  45         /**\r
  46          * \r
  47          * Instance will be replaced by Identity\r
  48          * @param lur \r
  49          *    \r
  50          * @param tag\r
  51          * @param perm\r
  52          */\r
  53         public AAFTrustChecker(final Env env) {\r
  54                 tag = env.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);\r
  55                 id = env.getProperty(Config.CADI_ALIAS,env.getProperty(Config.AAF_MECHID)); // share between components\r
  56                 String str = env.getProperty(Config.CADI_TRUST_PERM);\r
  57                 AAFPermission temp=null;\r
  58                 if(str!=null) {\r
  59                         String[] sp = Split.splitTrim('|', str);\r
  60                         if(sp.length==3) {\r
  61                                 temp = new AAFPermission(sp[0],sp[1],sp[2]);\r
  62                         }\r
  63                 }\r
  64                 perm=temp;\r
  65         }\r
  66 \r
  67         public AAFTrustChecker(final Access access) {\r
  68                 tag = access.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);\r
  69                 id = access.getProperty(Config.CADI_ALIAS,access.getProperty(Config.AAF_MECHID,null)); // share between components\r
  70                 String str = access.getProperty(Config.CADI_TRUST_PERM,null);\r
  71                 AAFPermission temp=null;\r
  72                 if(str!=null) {\r
  73                         String[] sp = Split.splitTrim('|', str);\r
  74                         if(sp.length==3) {\r
  75                                 temp = new AAFPermission(sp[0],sp[1],sp[2]);\r
  76                         }\r
  77                 }\r
  78                 perm=temp;\r
  79         }\r
  80 \r
  81         /* (non-Javadoc)\r
  82          * @see com.att.cadi.TrustChecker#setLur(com.att.cadi.Lur)\r
  83          */\r
  84         @Override\r
  85         public void setLur(Lur lur) {\r
  86                 this.lur = lur;\r
  87         }\r
  88 \r
  89         @Override\r
  90         public TafResp mayTrust(TafResp tresp, HttpServletRequest req) {\r
  91                 String user_info = req.getHeader(tag);\r
  92                 if(user_info !=null ) {\r
  93                         String[] info = Split.split(',', user_info);\r
  94                         if(info.length>0) {\r
  95                                 String[] flds = Split.splitTrim(':',info[0]);\r
  96                                 if(flds.length>3 && "AS".equals(flds[3])) { // is it set for "AS"\r
  97                                         String pn = tresp.getPrincipal().getName();\r
  98                                         if(pn.equals(id)  // We do trust our own App Components: if a trust entry is made with self, always accept\r
  99                                            || lur.fish(tresp.getPrincipal(), perm)) { // Have Perm set by Config.CADI_TRUST_PERM\r
 100                                                 return new TrustTafResp(tresp,\r
 101                                                                 new TrustPrincipal(tresp.getPrincipal(), flds[0]),\r
 102                                                                 "  " + flds[0] + " validated using " + flds[2] + " by " + flds[1] + ','\r
 103                                                         );\r
 104                                         } else if(pn.equals(flds[0])) { // Ignore if same identity \r
 105                                                 return tresp;\r
 106                                         } else {\r
 107                                                 return new TrustNotTafResp(tresp, tresp.getPrincipal().getName() + " requested trust as "\r
 108                                                                 + flds[0] + ", but does not have Authorization");\r
 109                                         }\r
 110                                 }\r
 111                         }\r
 112                 }\r
 113                 return tresp;\r
 114         }\r
 115 \r
 116 }\r