authz-core/src/main/java/com/att/authz/org/Organization.java

   1 /*******************************************************************************\r
   2  * ============LICENSE_START====================================================\r
   3  * * org.onap.aaf\r
   4  * * ===========================================================================\r
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
   6  * * ===========================================================================\r
   7  * * Licensed under the Apache License, Version 2.0 (the "License");\r
   8  * * you may not use this file except in compliance with the License.\r
   9  * * You may obtain a copy of the License at\r
  10  * * \r
  11  *  *      http://www.apache.org/licenses/LICENSE-2.0\r
  12  * * \r
  13  *  * Unless required by applicable law or agreed to in writing, software\r
  14  * * distributed under the License is distributed on an "AS IS" BASIS,\r
  15  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  16  * * See the License for the specific language governing permissions and\r
  17  * * limitations under the License.\r
  18  * * ============LICENSE_END====================================================\r
  19  * *\r
  20  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
  21  * *\r
  22  ******************************************************************************/\r
  23 package com.att.authz.org;\r
  24 \r
  25 import java.util.ArrayList;\r
  26 import java.util.Date;\r
  27 import java.util.GregorianCalendar;\r
  28 import java.util.HashSet;\r
  29 import java.util.List;\r
  30 import java.util.Set;\r
  31 \r
  32 import com.att.authz.env.AuthzTrans;\r
  33 \r
  34 /**\r
  35  * Organization\r
  36  * \r
  37  * There is Organizational specific information required which we have extracted to a plugin\r
  38  * \r
  39  * It supports using Company Specific User Directory lookups, as well as supporting an\r
  40  * Approval/Validation Process to simplify control of Roles and Permissions for large organizations\r
  41  * in lieu of direct manipulation by a set of Admins. \r
  42  *  \r
  43  *\r
  44  */\r
  45 public interface Organization {\r
  46         public static final String N_A = "n/a";\r
  47 \r
  48         public interface Identity {\r
  49                 public String id();\r
  50                 public String fullID();                                 // Fully Qualified ID (includes Domain of Organization)\r
  51                 public String type();                                   // Must be one of "IdentityTypes", see below\r
  52                 public String responsibleTo();          // Chain of Command, Comma Separated if required\r
  53                 public List<String> delegate();                 // Someone who has authority to act on behalf of Identity\r
  54                 public String email();\r
  55                 public String fullName();\r
  56                 public boolean isResponsible();                 // Is id passed belong to a person suitable to be Responsible for content Management\r
  57                 public boolean isFound();                               // Is Identity found in Identity stores\r
  58                 public Identity owner() throws OrganizationException;                                   // Identity is directly responsible for App ID\r
  59                 public Organization org();                              // Organization of Identity\r
  60         }\r
  61 \r
  62 \r
  63         /**\r
  64          * Name of Organization, suitable for Logging\r
  65          * @return\r
  66          */\r
  67         public String getName();\r
  68 \r
  69         /**\r
  70          * Realm, for use in distinguishing IDs from different systems/Companies\r
  71          * @return\r
  72          */\r
  73         public String getRealm();\r
  74 \r
  75         String getDomain();\r
  76 \r
  77         /**\r
  78          * Get Identity information based on userID\r
  79          * \r
  80          * @param id\r
  81          * @return\r
  82          */\r
  83         public Identity getIdentity(AuthzTrans trans, String id) throws OrganizationException;\r
  84         \r
  85 \r
  86         /**\r
  87          * Does the ID pass Organization Standards\r
  88          * \r
  89          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of \r
  90          * reasons why it fails\r
  91          * \r
  92          * @param id\r
  93          * @return\r
  94          */\r
  95         public String isValidID(String id);\r
  96 \r
  97         /**\r
  98          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of \r
  99          * reasons why it fails\r
 100          *  \r
 101          *  Identity is passed in to allow policies regarding passwords that are the same as user ID\r
 102          *  \r
 103          *  any entries for "prev" imply a reset\r
 104          *  \r
 105          * @param id\r
 106          * @param password\r
 107          * @return\r
 108          */\r
 109         public String isValidPassword(String user, String password, String ... prev);\r
 110 \r
 111 \r
 112         /**\r
 113          * Does your Company distinguish essential permission structures by kind of Identity?\r
 114          * i.e. Employee, Contractor, Vendor \r
 115          * @return\r
 116          */\r
 117         public Set<String> getIdentityTypes();\r
 118 \r
 119         public enum Notify {\r
 120                 Approval(1),\r
 121                 PasswordExpiration(2),\r
 122         RoleExpiration(3);\r
 123 \r
 124                 final int id;\r
 125                 Notify(int id) {this.id = id;}\r
 126                 public int getValue() {return id;}\r
 127                 public static Notify from(int type) {\r
 128                         for(Notify t : Notify.values()) {\r
 129                                 if(t.id==type) {\r
 130                                         return t;\r
 131                                 }\r
 132                         }\r
 133                         return null;\r
 134                 }\r
 135         }\r
 136 \r
 137         public enum Response{\r
 138                 OK,\r
 139                 ERR_NotImplemented,\r
 140                 ERR_UserNotExist,\r
 141                 ERR_NotificationFailure,\r
 142                 };\r
 143                 \r
 144         public enum Expiration {\r
 145                 Password,\r
 146                 TempPassword, \r
 147                 Future,\r
 148                 UserInRole,\r
 149                 UserDelegate, \r
 150                 ExtendPassword\r
 151         }\r
 152         \r
 153         public enum Policy {\r
 154                 CHANGE_JOB, \r
 155                 LEFT_COMPANY, \r
 156                 CREATE_MECHID, \r
 157                 CREATE_MECHID_BY_PERM_ONLY,\r
 158                 OWNS_MECHID,\r
 159                 AS_EMPLOYEE, \r
 160                 MAY_EXTEND_CRED_EXPIRES\r
 161         }\r
 162         \r
 163         /**\r
 164          * Notify a User of Action or Info\r
 165          * \r
 166          * @param type\r
 167          * @param url\r
 168          * @param users (separated by commas)\r
 169          * @param ccs (separated by commas)\r
 170          * @param summary\r
 171          */\r
 172 \r
 173     public Response notify(AuthzTrans trans, Notify type, String url, String ids[], String ccs[], String summary, Boolean urgent);\r
 174 \r
 175         /**\r
 176          * (more) generic way to send an email\r
 177          * \r
 178          * @param toList\r
 179          * @param ccList\r
 180          * @param subject\r
 181          * @param body\r
 182          * @param urgent\r
 183          */\r
 184 \r
 185         public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, String subject, String body, Boolean urgent) throws OrganizationException;\r
 186 \r
 187         /**\r
 188          * whenToValidate\r
 189          * \r
 190          * Authz support services will ask the Organization Object at startup when it should\r
 191          * kickoff Validation processes given particular types. \r
 192          * \r
 193          * This allows the Organization to express Policy\r
 194          * \r
 195          * Turn off Validation behavior by returning "null"\r
 196          * \r
 197          */\r
 198         public Date whenToValidate(Notify type, Date lastValidated);\r
 199 \r
 200         \r
 201         /**\r
 202          * Expiration\r
 203          * \r
 204          * Given a Calendar item of Start (or now), set the Expiration Date based on the Policy\r
 205          * based on type.\r
 206          * \r
 207          * For instance, "Passwords expire in 3 months"\r
 208          * \r
 209          * The Extra Parameter is used by certain Orgs.\r
 210          * \r
 211          * For Password, the extra is UserID, so it can check the Identity Type\r
 212          * \r
 213          * @param gc\r
 214          * @param exp\r
 215          * @return\r
 216          */\r
 217         public GregorianCalendar expiration(GregorianCalendar gc, Expiration exp, String ... extra);\r
 218         \r
 219         /**\r
 220          * Get Email Warning timing policies\r
 221          * @return\r
 222          */\r
 223         public EmailWarnings emailWarningPolicy();\r
 224 \r
 225         /**\r
 226          * \r
 227          * @param trans\r
 228          * @param user\r
 229          * @return\r
 230          */\r
 231         public List<Identity> getApprovers(AuthzTrans trans, String user) throws OrganizationException ;\r
 232         \r
 233         /*\r
 234          * \r
 235          * @param user\r
 236          * @param type\r
 237          * @param users\r
 238          * @return\r
 239         public Response notifyRequest(AuthzTrans trans, String user, Approval type, List<User> approvers);\r
 240         */\r
 241         \r
 242         /**\r
 243          * \r
 244          * @return\r
 245          */\r
 246         public String getApproverType();\r
 247 \r
 248         /*\r
 249          * startOfDay - define for company what hour of day business starts (specifically for password and other expiration which\r
 250          *   were set by Date only.)\r
 251          *    \r
 252          * @return\r
 253          */\r
 254         public int startOfDay();\r
 255 \r
 256     /**\r
 257      * implement this method to support any IDs that can have multiple entries in the cred table\r
 258      * NOTE: the combination of ID/expiration date/(encryption type when implemented) must be unique.\r
 259      *           Since expiration date is based on startOfDay for your company, you cannot create many\r
 260      *           creds for the same ID in the same day.\r
 261      * @param id\r
 262      * @return\r
 263      */\r
 264     public boolean canHaveMultipleCreds(String id);\r
 265     \r
 266     /**\r
 267      * \r
 268      * @param id\r
 269      * @return\r
 270      */\r
 271     public boolean isValidCred(String id);\r
 272     \r
 273     /**\r
 274      * If response is Null, then it is valid.  Otherwise, the Organization specific reason is returned.\r
 275      *  \r
 276      * @param trans\r
 277      * @param policy\r
 278      * @param executor\r
 279      * @param vars\r
 280      * @return\r
 281      * @throws OrganizationException\r
 282      */\r
 283     public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars) throws OrganizationException;\r
 284 \r
 285         boolean isTestEnv();\r
 286 \r
 287         public void setTestMode(boolean dryRun);\r
 288 \r
 289         public static final Organization NULL = new Organization() \r
 290         {\r
 291                 private final GregorianCalendar gc = new GregorianCalendar(1900, 1, 1);\r
 292                 private final List<Identity> nullList = new ArrayList<Identity>();\r
 293                 private final Set<String> nullStringSet = new HashSet<String>();\r
 294                 private final Identity nullIdentity = new Identity() {\r
 295                         List<String> nullIdentity = new ArrayList<String>();\r
 296                         @Override\r
 297                         public String type() {\r
 298                                 return N_A;\r
 299                         }\r
 300                         @Override\r
 301                         public String responsibleTo() {\r
 302                                 return N_A;\r
 303                         }\r
 304                         @Override\r
 305                         public boolean isResponsible() {\r
 306                                 return false;\r
 307                         }\r
 308                         \r
 309                         @Override\r
 310                         public boolean isFound() {\r
 311                                 return false;\r
 312                         }\r
 313                         \r
 314                         @Override\r
 315                         public String id() {\r
 316                                 return N_A;\r
 317                         }\r
 318                         \r
 319                         @Override\r
 320                         public String fullID() {\r
 321                                 return N_A;\r
 322                         }\r
 323                         \r
 324                         @Override\r
 325                         public String email() {\r
 326                                 return N_A;\r
 327                         }\r
 328                         \r
 329                         @Override\r
 330                         public List<String> delegate() {\r
 331                                 return nullIdentity;\r
 332                         }\r
 333                         @Override\r
 334                         public String fullName() {\r
 335                                 return N_A;\r
 336                         }\r
 337                         @Override\r
 338                         public Identity owner() {\r
 339                                 return null;\r
 340                         }\r
 341                         @Override\r
 342                         public Organization org() {\r
 343                                 return NULL;\r
 344                         }\r
 345                 };\r
 346 \r
 347                 @Override\r
 348                 public String getName() {\r
 349                         return N_A;\r
 350                 }\r
 351         \r
 352                 @Override\r
 353                 public String getRealm() {\r
 354                         return N_A;\r
 355                 }\r
 356         \r
 357                 @Override\r
 358                 public String getDomain() {\r
 359                         return N_A;\r
 360                 }\r
 361         \r
 362                 @Override\r
 363                 public Identity getIdentity(AuthzTrans trans, String id) {\r
 364                         return nullIdentity;\r
 365                 }\r
 366         \r
 367                 @Override\r
 368                 public String isValidID(String id) {\r
 369                         return N_A;\r
 370                 }\r
 371         \r
 372                 @Override\r
 373                 public String isValidPassword(String user, String password,String... prev) {\r
 374                         return N_A;\r
 375                 }\r
 376         \r
 377                 @Override\r
 378                 public Set<String> getIdentityTypes() {\r
 379                         return nullStringSet;\r
 380                 }\r
 381         \r
 382                 @Override\r
 383                 public Response notify(AuthzTrans trans, Notify type, String url,\r
 384                                 String[] users, String[] ccs, String summary, Boolean urgent) {\r
 385                         return Response.ERR_NotImplemented;\r
 386                 }\r
 387         \r
 388                 @Override\r
 389                 public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList,\r
 390                                 String subject, String body, Boolean urgent) throws OrganizationException {\r
 391                         return 0;\r
 392                 }\r
 393         \r
 394                 @Override\r
 395                 public Date whenToValidate(Notify type, Date lastValidated) {\r
 396                         return gc.getTime();\r
 397                 }\r
 398         \r
 399                 @Override\r
 400                 public GregorianCalendar expiration(GregorianCalendar gc,\r
 401                                 Expiration exp, String... extra) {\r
 402                         return gc==null?new GregorianCalendar():gc;\r
 403                 }\r
 404         \r
 405                 @Override\r
 406                 public List<Identity> getApprovers(AuthzTrans trans, String user)\r
 407                                 throws OrganizationException {\r
 408                         return nullList;\r
 409                 }\r
 410         \r
 411                 @Override\r
 412                 public String getApproverType() {\r
 413                         return "";\r
 414                 }\r
 415         \r
 416                 @Override\r
 417                 public int startOfDay() {\r
 418                         return 0;\r
 419                 }\r
 420         \r
 421                 @Override\r
 422                 public boolean canHaveMultipleCreds(String id) {\r
 423                         return false;\r
 424                 }\r
 425         \r
 426                 @Override\r
 427                 public boolean isValidCred(String id) {\r
 428                         return false;\r
 429                 }\r
 430         \r
 431                 @Override\r
 432                 public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars)\r
 433                                 throws OrganizationException {\r
 434                         return "Null Organization rejects all Policies";\r
 435                 }\r
 436         \r
 437                 @Override\r
 438                 public boolean isTestEnv() {\r
 439                         return false;\r
 440                 }\r
 441         \r
 442                 @Override\r
 443                 public void setTestMode(boolean dryRun) {\r
 444                 }\r
 445 \r
 446                 @Override\r
 447                 public EmailWarnings emailWarningPolicy() {\r
 448                         return new EmailWarnings() {\r
 449 \r
 450                                 @Override\r
 451                             public long credEmailInterval()\r
 452                             {\r
 453                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7\r
 454                             }\r
 455                             \r
 456                                 @Override\r
 457                             public long roleEmailInterval()\r
 458                             {\r
 459                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7\r
 460                             }\r
 461                                 \r
 462                                 @Override\r
 463                                 public long apprEmailInterval() {\r
 464                                 return 259200000L; // 3 days in millis 1000 * 86400 * 3\r
 465                                 }\r
 466                             \r
 467                                 @Override\r
 468                             public long  credExpirationWarning()\r
 469                             {\r
 470                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds\r
 471                             }\r
 472                             \r
 473                                 @Override\r
 474                             public long roleExpirationWarning()\r
 475                             {\r
 476                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds\r
 477                             }\r
 478 \r
 479                                 @Override\r
 480                             public long emailUrgentWarning()\r
 481                             {\r
 482                                 return( 1209600000L ); // Two weeks, in milliseconds 1000 * 86400 * 14  in milliseconds\r
 483                             }\r
 484 \r
 485                         };\r
 486                 }\r
 487         };\r
 488 }\r
 489 \r
 490 \r