2 * ============LICENSE_START====================================================
4 * ===========================================================================
5 * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
6 * ===========================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END====================================================
22 package com.att.cadi.enduser;
24 import java.io.IOException;
25 import java.net.ConnectException;
26 import java.security.GeneralSecurityException;
27 import java.util.Date;
28 import java.util.GregorianCalendar;
30 import org.onap.aaf.cadi.Access.Level;
31 import org.onap.aaf.cadi.CadiException;
32 import org.onap.aaf.cadi.LocatorException;
33 import org.onap.aaf.cadi.PropAccess;
34 import org.onap.aaf.cadi.client.Future;
35 import org.onap.aaf.cadi.client.Rcli;
36 import org.onap.aaf.cadi.client.Result;
37 import org.onap.aaf.cadi.client.Retryable;
38 import org.onap.aaf.cadi.config.Config;
39 import org.onap.aaf.cadi.oauth.TimedToken;
40 import org.onap.aaf.cadi.oauth.TokenClient;
41 import org.onap.aaf.cadi.oauth.TokenClientFactory;
42 import org.onap.aaf.cadi.oauth.TzClient;
43 import org.onap.aaf.cadi.util.FQI;
44 import org.onap.aaf.misc.env.APIException;
45 import org.onap.aaf.misc.env.util.Chrono;
47 import aafoauth.v2_0.Introspect;
48 import aafoauth.v2_0.Token;
51 public class OAuthExample {
52 private static TokenClientFactory tcf;
53 private static PropAccess access;
55 public final static void main(final String args[]) {
56 // These Objects are expected to be Long-Lived... Construct once
59 // This method will allow you to set "cadi_prop_files" (or any other property) on Command line
60 access = new PropAccess(args);
62 // access = PropAccess();
63 // Note: This style will load "cadi_prop_files" from VM Args
65 // Token aware Client Factory
67 tcf = TokenClientFactory.instance(access);
68 } catch (APIException | GeneralSecurityException | IOException | CadiException e1) {
69 access.log(e1, "Unable to setup OAuth Client Factory, Fail Fast");
74 // Obtain Endpoints for OAuth2 from Properties. Expected is "cadi.properties" file, pointed to by "cadi_prop_files"
75 String tokenServiceURL = access.getProperty(Config.AAF_OAUTH2_TOKEN_URL,
76 "https://AAF_LOCATE_URL/AAF_NS.token/2.0"); // Default to AAF
77 String tokenIntrospectURL = access.getProperty(Config.AAF_OAUTH2_INTROSPECT_URL,
78 "https://AAF_LOCATE_URL/AAF_NS.introspect/2.0"); // Default to AAF);
80 final String endServicesURL = access.getProperty(Config.AAF_OAUTH2_HELLO_URL,
81 "https://AAF_LOCATE_URL/AAF_NS.hello/2.0");
83 final int CALL_TIMEOUT = Integer.parseInt(access.getProperty(Config.AAF_CALL_TIMEOUT,Config.AAF_CALL_TIMEOUT_DEF));
86 //////////////////////////////////////////////////////////////////////
88 // Get and use an OAuth Client, which understands Token Management
89 //////////////////////////////////////////////////////////////////////
90 // Create a Token Client, that gets its tokens from expected OAuth Server
91 // In this example, it is AAF, but it can be the Alternate OAuth
93 TokenClient tc = tcf.newClient(tokenServiceURL); // can set your own timeout here (url, timeoutMilliseconds)
94 // Set your Application (MicroService, whatever) Credentials here
95 // These are how your Application is known, particularly to the OAuth Server.
96 // If AAF Token server, then its just the same as your other AAF MechID creds
97 // If it is the Alternate OAUTH, you'll need THOSE credentials. See that tool's Onboarding procedures.
98 String client_id = access.getProperty(Config.AAF_APPID);
100 // For AAF, client_id CAN be Certificate. This is not necessarily true elsewhere
101 client_id = access.getProperty(Config.CADI_ALIAS);
103 String client_secret = access.getProperty(Config.AAF_APPPASS);
104 tc.client_creds(client_id, client_secret);
106 // If you are working with Credentials the End User, set username/password as appropriate to the OAuth Server
107 // tc.password(end_user_id, end_user_password);
109 // if you are setting client Credentials, you MAY NOT reuse this Client mid-transaction. You CAN reuse after setting
110 // tc.clearEndUser();
111 // You may want to see "Pooled Client" example, using special CADI utility
113 // With AAF, the Scopes you put in are the AAF Namespaces you want access to. Your Token will contain the
114 // AAF Permissions of the Namespaces (you can put in more than one), the user name (or client_id if no user_name),
115 // is allowed to see.
117 // Here's a trick to get the namespace out of a Fully Qualified AAF Identity (your MechID)
118 String ns = FQI.reverseDomain(client_id);
119 System.out.printf("\nNote: The AAF Namespace of FQI (Fully Qualified Identity) %s is %s\n\n",client_id, ns);
121 // Now, we can get a Token. Note: for "scope", use AAF Namespaces to get AAF Permissions embedded in
122 // Note: getToken checks if Token is expired, if so, then refreshes before handing back.
123 Result<TimedToken> rtt = tc.getToken(ns,"org.onap.test");
125 // Note: you can clear a Token's Disk/Memory presence by
126 // 1) removing the Token from the "token/outgoing" directory on the O/S
127 // 2) programmatically by calling "clearToken" with exact params as "getToken", when it has the same credentials set
128 // tc.clearToken("org.onap.aaf","org.onap.test");
130 // Result Object can be queried for success
132 TimedToken token = rtt.value;
133 print(token); // Take a look at what's in a Token
135 // Use this Token in your client calls with "Tokenized Client" (TzClient)
136 // These should NOT be used cross thread.
137 TzClient helloClient = tcf.newTzClient(endServicesURL);
138 helloClient.setToken(client_id, token);
140 // This client call style, "best" call with "Retryable" inner class covers finding an available Service
141 // (when Multi-services exist) for the best service, based (currently) on distance.
143 // the "Generic" in Type gives a Return Value for the Code, which you can set on the "best" method
144 // Note that variables used in the inner class from this part of the code must be "final", see "CALL_TIMEOUT"
145 String rv = helloClient.best(new Retryable<String>() {
147 public String code(Rcli<?> client) throws CadiException, ConnectException, APIException {
148 Future<String> future = client.read("hello","text/plain");
149 // The "future" calling method allows you to do other processing, such as call more than one backend
150 // client before picking up the result
151 // If "get" matches the HTTP Code for the method (i.e. read HTTP Return value is 200), then
152 if(future.get(CALL_TIMEOUT)) {
153 // Client Returned expected value
156 throw new APIException(future.code() + future.body());
161 // You want to do something with returned value. Here, we say "hello"
162 System.out.printf("\nPositive Response from Hello: %s\n",rv);
165 //////////////////////////////////////////////////////////////////////
167 // As a Service, read Introspection information as proof of Authenticated Authorization
168 //////////////////////////////////////////////////////////////////////
169 // CADI Framework (i.e. CadiFilter) works with the Introspection to drive the J2EE interfaces (
170 // i.e. if(isUserInRole("ns.perm|instance|action")) {...
172 // Here, however, is a way to introspect via Java
174 // now, call Introspect (making sure right URLs are set in properties)
175 // We need a Different Introspect TokenClient, because different Endpoint (and usually different Services)
176 TokenClient tci = tcf.newClient(tokenIntrospectURL);
177 tci.client_creds(client_id, client_secret);
178 Result<Introspect> is = tci.introspect(token.getAccessToken());
180 // Note that AAF will add JSON set of Permissions as part of "Content:", legitimate extension of OAuth Structure
181 print(is.value); // do something with Introspect Object
183 access.printf(Level.ERROR, "Unable to introspect OAuth Token %s: %d %s\n",
184 token.getAccessToken(),rtt.code,rtt.error);
187 access.printf(Level.ERROR, "Unable to obtain OAuth Token: %d %s\n",rtt.code,rtt.error);
190 } catch (CadiException | LocatorException | APIException | IOException e) {
195 /////////////////////////////////////////////////////////////
196 // Examples of Object Access
197 /////////////////////////////////////////////////////////////
198 private static void print(Token t) {
199 GregorianCalendar exp_date = new GregorianCalendar();
200 exp_date.add(GregorianCalendar.SECOND, t.getExpiresIn());
201 System.out.printf("Access Token\n\tToken:\t\t%s\n\tToken Type:\t%s\n\tExpires In:\t%d (%s)\n\tScope:\t\t%s\n\tRefresh Token:\t%s\n",
205 Chrono.timeStamp(new Date(System.currentTimeMillis()+(t.getExpiresIn()*1000))),
207 t.getRefreshToken());
210 private static void print(Introspect ti) {
211 if(ti==null || ti.getClientId()==null) {
212 System.out.println("Empty Introspect");
215 Date exp = new Date(ti.getExp()*1000); // seconds
216 System.out.printf("Introspect\n"
217 + "\tAccessToken:\t%s\n"
218 + "\tClient-id:\t%s\n"
219 + "\tClient Type:\t%s\n"
221 + "\tUserName:\t%s\n"
222 + "\tExpires: \t%d (%s)\n"
224 + "\tContent:\t%s\n",
228 ti.isActive()?Boolean.TRUE.toString():Boolean.FALSE.toString(),
231 Chrono.timeStamp(exp),
233 ti.getContent()==null?"":ti.getContent());
235 System.out.println();