2 * ============LICENSE_START====================================================
4 * ===========================================================================
5 * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
6 * ===========================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END====================================================
22 package org.onap.aaf.cadi.taf.basic;
24 import java.io.IOException;
25 import java.security.Principal;
27 import java.util.TreeMap;
29 import javax.servlet.http.HttpServletRequest;
30 import javax.servlet.http.HttpServletResponse;
32 import org.onap.aaf.cadi.Access;
33 import org.onap.aaf.cadi.Access.Level;
34 import org.onap.aaf.cadi.BasicCred;
35 import org.onap.aaf.cadi.CachedPrincipal;
36 import org.onap.aaf.cadi.CachedPrincipal.Resp;
37 import org.onap.aaf.cadi.CadiException;
38 import org.onap.aaf.cadi.CredVal;
39 import org.onap.aaf.cadi.CredVal.Type;
40 import org.onap.aaf.cadi.CredValDomain;
41 import org.onap.aaf.cadi.Taf;
42 import org.onap.aaf.cadi.config.Config;
43 import org.onap.aaf.cadi.filter.MapBathConverter;
44 import org.onap.aaf.cadi.principal.BasicPrincipal;
45 import org.onap.aaf.cadi.principal.CachedBasicPrincipal;
46 import org.onap.aaf.cadi.taf.HttpTaf;
47 import org.onap.aaf.cadi.taf.TafResp;
48 import org.onap.aaf.cadi.taf.TafResp.RESP;
49 import org.onap.aaf.cadi.taf.dos.DenialOfServiceTaf;
50 import org.onap.aaf.cadi.util.CSV;
55 * This TAF implements the "Basic Auth" protocol.
57 * WARNING! It is true for any implementation of "Basic Auth" that the password is passed unencrypted.
58 * This is because the expectation, when designed years ago, was that it would only be used in
59 * conjunction with SSL (https). It is common, however, for users to ignore this on the assumption that
60 * their internal network is secure, or just ignorance. Therefore, a WARNING will be printed
61 * when the HTTP Channel is not encrypted (unless explicitly turned off).
66 public class BasicHttpTaf implements HttpTaf {
67 private Access access;
70 private Map<String,CredVal> rbacs = new TreeMap<>();
72 private long timeToLive;
73 private MapBathConverter mapIds;
75 public BasicHttpTaf(Access access, CredVal rbac, String realm, long timeToLive, boolean turnOnWarning) {
79 this.warn = turnOnWarning;
80 this.timeToLive = timeToLive;
81 String csvFile = access.getProperty(Config.CADI_BATH_CONVERT, null);
86 mapIds = new MapBathConverter(access, new CSV(access,csvFile));
87 } catch (IOException | CadiException e) {
88 access.log(e,"Bath Map Conversion is not initialzed (non fatal)");
93 public void add(final CredValDomain cvd) {
94 rbacs.put(cvd.domain(), cvd);
98 * Note: BasicHttp works for either Carbon Based (Humans) or Silicon Based (machine) Lifeforms.
101 public TafResp validate(Taf.LifeForm reading, HttpServletRequest req, HttpServletResponse resp) {
102 // See if Request implements BasicCred (aka CadiWrap or other), and if User/Pass has already been set separately
103 if (req instanceof BasicCred) {
104 BasicCred bc = (BasicCred)req;
105 if (bc.getUser()!=null) { // CadiWrap, if set, makes sure User & Password are both valid, or both null
106 if (DenialOfServiceTaf.isDeniedID(bc.getUser())!=null) {
107 return DenialOfServiceTaf.respDenyID(access,bc.getUser());
109 CachedBasicPrincipal bp = new CachedBasicPrincipal(this,bc,realm,timeToLive);
111 // Be able to do Organizational specific lookups by Domain
112 CredVal cv = rbacs.get(bp.getDomain());
117 // ONLY FOR Last Ditch DEBUGGING...
118 // access.log(Level.WARN,bp.getName() + ":" + new String(bp.getCred()));
119 if (cv.validate(bp.getName(),Type.PASSWORD,bp.getCred(),req)) {
120 return new BasicHttpTafResp(access,bp,bp.getName()+" authenticated by password",RESP.IS_AUTHENTICATED,resp,realm,false);
122 //TODO may need timed retries in a given time period
123 return new BasicHttpTafResp(access,bc.getUser(),buildMsg(bp,req,"user/pass combo invalid for ",bc.getUser(),"from",req.getRemoteAddr()),
124 RESP.TRY_AUTHENTICATING,resp,realm,true);
128 // Get User/Password from Authorization Header value
129 String authz = req.getHeader("Authorization");
130 String target="unknown";
132 if (authz != null && authz.startsWith("Basic ")) {
133 if (warn&&!req.isSecure()) {
134 access.log(Level.WARN,"WARNING! BasicAuth has been used over an insecure channel");
137 authz = mapIds.convert(access, authz);
140 CachedBasicPrincipal ba = new CachedBasicPrincipal(this,authz,realm,timeToLive);
142 if (DenialOfServiceTaf.isDeniedID(ba.getName())!=null) {
143 return DenialOfServiceTaf.respDenyID(access,ba.getName());
146 final int at = ba.getName().indexOf('@');
147 CredVal cv = rbacs.get(ba.getName().substring(at+1));
149 cv = rbac; // default
152 // ONLY FOR Last Ditch DEBUGGING...
153 // access.log(Level.WARN,ba.getName() + ":" + new String(ba.getCred()));
154 if (cv.validate(ba.getName(), Type.PASSWORD, ba.getCred(), req)) {
155 return new BasicHttpTafResp(access,ba, ba.getName()+" authenticated by BasicAuth password",RESP.IS_AUTHENTICATED,resp,realm,false);
157 //TODO may need timed retries in a given time period
158 return new BasicHttpTafResp(access,target,buildMsg(ba,req,"user/pass combo invalid"),
159 RESP.TRY_AUTHENTICATING,resp,realm,true);
161 } catch (IOException e) {
162 String msg = buildMsg(null,req,"Failed HTTP Basic Authorization (", e.getMessage(), ')');
163 access.log(Level.INFO,msg);
164 return new BasicHttpTafResp(access,target,msg, RESP.TRY_AUTHENTICATING, resp, realm,true);
167 return new BasicHttpTafResp(access,target,"Requesting HTTP Basic Authorization",RESP.TRY_AUTHENTICATING,resp,realm,false);
170 protected String buildMsg(Principal pr, HttpServletRequest req, Object ... msg) {
171 StringBuilder sb = new StringBuilder();
174 sb.append(pr.getName());
178 sb.append(req.getRemoteAddr());
180 sb.append(req.getRemotePort());
182 sb.append(",msg=\"");
183 for (Object s : msg) {
184 sb.append(s.toString());
188 return sb.toString();
191 public void addCredVal(final String realm, final CredVal cv) {
192 rbacs.put(realm, cv);
195 public CredVal getCredVal(String key) {
196 CredVal cv = rbacs.get(key);
204 public Resp revalidate(CachedPrincipal prin, Object state) {
205 if (prin instanceof BasicPrincipal) {
206 BasicPrincipal ba = (BasicPrincipal)prin;
207 if (DenialOfServiceTaf.isDeniedID(ba.getName())!=null) {
208 return Resp.UNVALIDATED;
210 return rbac.validate(ba.getName(), Type.PASSWORD, ba.getCred(), state)?Resp.REVALIDATED:Resp.UNVALIDATED;
212 return Resp.NOT_MINE;
215 public String toString() {
216 return "Basic Auth enabled on realm: " + realm;