1 /*******************************************************************************
\r
2 * ============LICENSE_START====================================================
\r
4 * * ===========================================================================
\r
5 * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
\r
6 * * ===========================================================================
\r
7 * * Licensed under the Apache License, Version 2.0 (the "License");
\r
8 * * you may not use this file except in compliance with the License.
\r
9 * * You may obtain a copy of the License at
\r
11 * * http://www.apache.org/licenses/LICENSE-2.0
\r
13 * * Unless required by applicable law or agreed to in writing, software
\r
14 * * distributed under the License is distributed on an "AS IS" BASIS,
\r
15 * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
\r
16 * * See the License for the specific language governing permissions and
\r
17 * * limitations under the License.
\r
18 * * ============LICENSE_END====================================================
\r
20 * * ECOMP is a trademark and service mark of AT&T Intellectual Property.
\r
22 ******************************************************************************/
\r
23 package com.att.cadi.aaf.v2_0;
\r
25 import javax.servlet.http.HttpServletRequest ;
\r
27 import com.att.cadi.Access;
\r
28 import com.att.cadi.Lur;
\r
29 import com.att.cadi.TrustChecker;
\r
30 import com.att.cadi.aaf.AAFPermission;
\r
31 import com.att.cadi.config.Config;
\r
32 import com.att.cadi.principal.TrustPrincipal;
\r
33 import com.att.cadi.taf.TafResp;
\r
34 import com.att.cadi.taf.TrustNotTafResp;
\r
35 import com.att.cadi.taf.TrustTafResp;
\r
36 import com.att.inno.env.Env;
\r
37 import com.att.inno.env.util.Split;
\r
39 public class AAFTrustChecker implements TrustChecker {
\r
40 private final String tag, id;
\r
41 private final AAFPermission perm;
\r
46 * Instance will be replaced by Identity
\r
52 public AAFTrustChecker(final Env env) {
\r
53 tag = env.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);
\r
54 id = env.getProperty(Config.CADI_ALIAS,env.getProperty(Config.AAF_MECHID)); // share between components
\r
55 String str = env.getProperty(Config.CADI_TRUST_PERM);
\r
56 AAFPermission temp=null;
\r
58 String[] sp = Split.splitTrim('|', str);
\r
60 temp = new AAFPermission(sp[0],sp[1],sp[2]);
\r
66 public AAFTrustChecker(final Access access) {
\r
67 tag = access.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);
\r
68 id = access.getProperty(Config.CADI_ALIAS,access.getProperty(Config.AAF_MECHID,null)); // share between components
\r
69 String str = access.getProperty(Config.CADI_TRUST_PERM,null);
\r
70 AAFPermission temp=null;
\r
72 String[] sp = Split.splitTrim('|', str);
\r
74 temp = new AAFPermission(sp[0],sp[1],sp[2]);
\r
81 * @see com.att.cadi.TrustChecker#setLur(com.att.cadi.Lur)
\r
84 public void setLur(Lur lur) {
\r
89 public TafResp mayTrust(TafResp tresp, HttpServletRequest req) {
\r
90 String user_info = req.getHeader(tag);
\r
91 if(user_info !=null ) {
\r
92 String[] info = Split.split(',', user_info);
\r
94 String[] flds = Split.splitTrim(':',info[0]);
\r
95 if(flds.length>3 && "AS".equals(flds[3])) { // is it set for "AS"
\r
96 String pn = tresp.getPrincipal().getName();
\r
97 if(pn.equals(id) // We do trust our own App Components: if a trust entry is made with self, always accept
\r
98 || lur.fish(tresp.getPrincipal(), perm)) { // Have Perm set by Config.CADI_TRUST_PERM
\r
99 return new TrustTafResp(tresp,
\r
100 new TrustPrincipal(tresp.getPrincipal(), flds[0]),
\r
101 " " + flds[0] + " validated using " + flds[2] + " by " + flds[1] + ','
\r
103 } else if(pn.equals(flds[0])) { // Ignore if same identity
\r
106 return new TrustNotTafResp(tresp, tresp.getPrincipal().getName() + " requested trust as "
\r
107 + flds[0] + ", but does not have Authorization");
\r