2 * ============LICENSE_START====================================================
4 * ===========================================================================
5 * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
6 * ===========================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END====================================================
22 package org.onap.aaf.cadi.aaf.v2_0;
24 import javax.servlet.http.HttpServletRequest ;
26 import org.onap.aaf.cadi.Access;
27 import org.onap.aaf.cadi.Lur;
28 import org.onap.aaf.cadi.TrustChecker;
29 import org.onap.aaf.cadi.aaf.AAFPermission;
30 import org.onap.aaf.cadi.config.Config;
31 import org.onap.aaf.cadi.principal.TrustPrincipal;
32 import org.onap.aaf.cadi.taf.TafResp;
33 import org.onap.aaf.cadi.taf.TrustNotTafResp;
34 import org.onap.aaf.cadi.taf.TrustTafResp;
35 import org.onap.aaf.misc.env.Env;
36 import org.onap.aaf.misc.env.util.Split;
38 public class AAFTrustChecker implements TrustChecker {
39 private final String tag, id;
40 private final AAFPermission perm;
45 * Instance will be replaced by Identity
51 public AAFTrustChecker(final Env env) {
52 tag = env.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);
53 id = env.getProperty(Config.CADI_ALIAS,env.getProperty(Config.AAF_APPID)); // share between components
54 String str = env.getProperty(Config.CADI_TRUST_PERM);
55 AAFPermission temp=null;
57 String[] sp = Split.splitTrim('|', str);
59 temp = new AAFPermission(sp[0],sp[1],sp[2]);
65 public AAFTrustChecker(final Access access) {
66 tag = access.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);
67 id = access.getProperty(Config.CADI_ALIAS,access.getProperty(Config.AAF_APPID,null)); // share between components
68 String str = access.getProperty(Config.CADI_TRUST_PERM,null);
69 AAFPermission temp=null;
71 String[] sp = Split.splitTrim('|', str);
73 temp = new AAFPermission(sp[0],sp[1],sp[2]);
80 * @see org.onap.aaf.cadi.TrustChecker#setLur(org.onap.aaf.cadi.Lur)
83 public void setLur(Lur lur) {
88 public TafResp mayTrust(TafResp tresp, HttpServletRequest req) {
89 String user_info = req.getHeader(tag);
90 if (user_info == null) {
94 String[] info = Split.split(',', user_info);
95 String[] flds = Split.splitTrim(':', info[0]);
96 if (flds.length < 4) {
99 if (!("AS".equals(flds[3]))) { // is it set for "AS"
103 String principalName = tresp.getPrincipal().getName();
104 if(principalName.equals(id) // We do trust our own App Components: if a trust entry is made with self, always accept
105 || lur.fish(tresp.getPrincipal(), perm)) { // Have Perm set by Config.CADI_TRUST_PERM
106 String desc = " " + flds[0] + " validated using " + flds[2] + " by " + flds[1] + ',';
107 return new TrustTafResp(tresp, new TrustPrincipal(tresp.getPrincipal(), flds[0]), desc);
108 } else if(principalName.equals(flds[0])) { // Ignore if same identity
111 String desc = tresp.getPrincipal().getName() + " requested trust as " + flds[0] + ", but does not have Authorization";
112 return new TrustNotTafResp(tresp, desc);