core/src/main/java/com/att/cadi/filter/CadiHTTPManip.java

   1 /*******************************************************************************\r
   2  * ============LICENSE_START====================================================\r
   3  * * org.onap.aai\r
   4  * * ===========================================================================\r
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
   6  * * Copyright © 2017 Amdocs\r
   7  * * ===========================================================================\r
   8  * * Licensed under the Apache License, Version 2.0 (the "License");\r
   9  * * you may not use this file except in compliance with the License.\r
  10  * * You may obtain a copy of the License at\r
  11  * * \r
  12  *  *      http://www.apache.org/licenses/LICENSE-2.0\r
  13  * * \r
  14  *  * Unless required by applicable law or agreed to in writing, software\r
  15  * * distributed under the License is distributed on an "AS IS" BASIS,\r
  16  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  17  * * See the License for the specific language governing permissions and\r
  18  * * limitations under the License.\r
  19  * * ============LICENSE_END====================================================\r
  20  * *\r
  21  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
  22  * *\r
  23  ******************************************************************************/\r
  24 package com.att.cadi.filter;\r
  25 \r
  26 import java.io.IOException;\r
  27 import java.util.ArrayList;\r
  28 import java.util.List;\r
  29 \r
  30 import javax.servlet.http.HttpServletRequest;\r
  31 import javax.servlet.http.HttpServletResponse;\r
  32 \r
  33 import com.att.cadi.Access;\r
  34 import com.att.cadi.Access.Level;\r
  35 import com.att.cadi.CadiException;\r
  36 import com.att.cadi.CadiWrap;\r
  37 import com.att.cadi.Connector;\r
  38 import com.att.cadi.CredVal;\r
  39 import com.att.cadi.Lur;\r
  40 import com.att.cadi.Taf;\r
  41 import com.att.cadi.TrustChecker;\r
  42 import com.att.cadi.config.Config;\r
  43 import com.att.cadi.lur.EpiLur;\r
  44 import com.att.cadi.taf.HttpTaf;\r
  45 import com.att.cadi.taf.TafResp;\r
  46 import com.att.cadi.util.UserChainManip;\r
  47 \r
  48 /**\r
  49  * Encapsulate common HTTP Manipulation Behavior.  It will appropriately set\r
  50  * HTTPServletResponse for Redirect or Forbidden, as needed.\r
  51  * \r
  52  * Further, this is useful, because it avoids multiple creates of Connections, where some Filters\r
  53  * are created and destroyed regularly.\r
  54  * \r
  55  *\r
  56  *\r
  57  */\r
  58 public class CadiHTTPManip {\r
  59         private static final String ACCESS_CADI_CONTROL = ".access|cadi|control";\r
  60         private static final String METH = "OPTIONS";\r
  61         private static final String CADI = "/cadi/";\r
  62         private static final String CADI_CACHE_PRINT = "/cadi/cache/print";\r
  63         private static final String CADI_CACHE_CLEAR = "/cadi/cache/clear";\r
  64         private static final String CADI_LOG_SET = "/cadi/log/set/";\r
  65         private Access access;\r
  66         private HttpTaf taf;\r
  67         private CredVal up;\r
  68         private Lur lur;\r
  69         private String thisPerm,companyPerm,aaf_id;\r
  70         \r
  71         public static final Object[] noAdditional = new Object[0]; // CadiFilter can be created each call in some systems\r
  72 \r
  73 \r
  74         public CadiHTTPManip(Access access, Connector con, TrustChecker tc, Object ... additionalTafLurs) throws CadiException {\r
  75                 synchronized(CADI) {\r
  76                         this.access = access;\r
  77 //                      Get getter = new AccessGetter(access);\r
  78                         Config.setDefaultRealm(access);\r
  79         \r
  80                         aaf_id = access.getProperty(Config.CADI_ALIAS,access.getProperty(Config.AAF_MECHID, null));\r
  81                         if(aaf_id==null) {\r
  82                                 access.printf(Level.INIT, "%s is not set. %s can be used instead",Config.AAF_MECHID,Config.CADI_ALIAS);\r
  83                         } else {\r
  84                                 access.printf(Level.INIT, "%s is set to %s",Config.AAF_MECHID,aaf_id);\r
  85                         }\r
  86                         String ns = aaf_id==null?null:UserChainManip.idToNS(aaf_id);\r
  87                         if(ns!=null) {\r
  88                                 thisPerm = ns+ACCESS_CADI_CONTROL;\r
  89                                 int dot = ns.indexOf('.');\r
  90                                 if(dot>=0) {\r
  91                                         int dot2=ns.indexOf('.',dot+1);\r
  92                                         if(dot2<0) {\r
  93                                                 dot2=dot;\r
  94                                         }\r
  95                                         companyPerm = ns.substring(0, dot2)+ACCESS_CADI_CONTROL;\r
  96                                 } else {\r
  97                                         companyPerm = "com"+ACCESS_CADI_CONTROL;\r
  98                                 }\r
  99                         } else {\r
 100                                 thisPerm = companyPerm = "com"+ACCESS_CADI_CONTROL;\r
 101                         }\r
 102                         \r
 103                         if(con!=null) { // try to reutilize connector\r
 104                                 List<Lur> ll = null;\r
 105                                 for(Object tl : additionalTafLurs) {\r
 106                                         if(tl instanceof Lur) {\r
 107                                                 if(ll==null) {\r
 108                                                         ll = new ArrayList<Lur>();\r
 109                                                         ll.add(con.newLur());\r
 110                                                 }\r
 111                                                 ll.add((Lur)tl);\r
 112                                         }\r
 113                                 }\r
 114                                 if(ll==null) {\r
 115                                         lur = con.newLur();\r
 116                                 } else {\r
 117                                         lur = new EpiLur((Lur[])ll.toArray());\r
 118                                 }\r
 119                         } else {\r
 120                                 lur = Config.configLur(access, additionalTafLurs);\r
 121                         }\r
 122                         tc.setLur(lur);\r
 123                         if(lur instanceof EpiLur) {\r
 124                                 up = ((EpiLur)lur).getUserPassImpl();\r
 125                         } else if(lur instanceof CredVal) {\r
 126                                 up = (CredVal)lur;\r
 127                         } else {\r
 128                                 up = null;\r
 129                         }\r
 130                         taf = Config.configHttpTaf(access, tc, up, lur, additionalTafLurs);\r
 131                 }\r
 132         }\r
 133 \r
 134         public TafResp validate(HttpServletRequest hreq, HttpServletResponse hresp) throws IOException {\r
 135                 TafResp tresp = taf.validate(Taf.LifeForm.LFN, hreq, hresp);\r
 136                 switch(tresp.isAuthenticated()) {\r
 137                         case IS_AUTHENTICATED:\r
 138                                 access.printf(Level.INFO,"Authenticated: %s from %s:%d"\r
 139                                                 , tresp.desc(), hreq.getRemoteAddr(), hreq.getRemotePort());\r
 140                                 break;\r
 141                         case TRY_AUTHENTICATING:\r
 142                                 switch (tresp.authenticate()) {\r
 143                                         case IS_AUTHENTICATED:\r
 144                                                 access.printf(Level.INFO,"Authenticated: %s from %s:%d"\r
 145                                                                 , tresp.desc(), hreq.getRemoteAddr(), hreq.getRemotePort());\r
 146                                                 break;\r
 147                                         case HTTP_REDIRECT_INVOKED:\r
 148                                                 access.log(Level.INFO,"Authenticating via redirection: ", tresp.desc());\r
 149                                                 break;\r
 150                                         case NO_FURTHER_PROCESSING:\r
 151                                                 access.printf(Level.AUDIT,"Authentication Failure: %s from %s:%d"\r
 152                                                                 , tresp.desc(), hreq.getRemoteAddr(), hreq.getRemotePort());\r
 153                                                 hresp.sendError(403, tresp.desc()); // Forbidden\r
 154                                                 break;\r
 155 \r
 156                                         default:\r
 157                                                 access.printf(Level.AUDIT,"No TAF will authorize for request from %s:%d"\r
 158                                                                 , hreq.getRemoteAddr(), hreq.getRemotePort());\r
 159                                                 hresp.sendError(403, tresp.desc()); // Forbidden\r
 160                                 }\r
 161                                 break;\r
 162                         case NO_FURTHER_PROCESSING:\r
 163                                 access.printf(Level.AUDIT,"Authentication Failure: %s from %s:%d", \r
 164                                                 tresp.desc(), hreq.getRemoteAddr(), hreq.getRemotePort());\r
 165                                 hresp.sendError(403, "Access Denied"); // FORBIDDEN\r
 166                                 break;\r
 167                         default:\r
 168                                 access.printf(Level.AUDIT,"No TAF will authorize for request from %s:%d"\r
 169                                                 , hreq.getRemoteAddr(), hreq.getRemotePort());\r
 170                                 hresp.sendError(403, "Access Denied"); // FORBIDDEN\r
 171                 }\r
 172                 return tresp;\r
 173         }\r
 174         \r
 175         public boolean notCadi(CadiWrap req, HttpServletResponse resp) {\r
 176                 \r
 177                 String pathInfo = req.getPathInfo();\r
 178                 if(METH.equalsIgnoreCase(req.getMethod()) && pathInfo!=null && pathInfo.contains(CADI)) {\r
 179                         if(req.getUser().equals(aaf_id) || req.isUserInRole(thisPerm) || req.isUserInRole(companyPerm)) {\r
 180                                 try {\r
 181                                         if(pathInfo.contains(CADI_CACHE_PRINT)) {\r
 182                                                 resp.getOutputStream().println(lur.toString());\r
 183                                                 resp.setStatus(200);\r
 184                                                 return false;\r
 185                                         } else if(pathInfo.contains(CADI_CACHE_CLEAR)) {\r
 186                                                 StringBuilder report = new StringBuilder();\r
 187                                                 lur.clear(req.getUserPrincipal(), report);\r
 188                                                 resp.getOutputStream().println(report.toString());\r
 189                                                 resp.setStatus(200);\r
 190                                                 return false;\r
 191                                         } else if(pathInfo.contains(CADI_LOG_SET))  {\r
 192                                                 Level l;\r
 193                                                 int slash = pathInfo.lastIndexOf('/');\r
 194                                                 String level = pathInfo.substring(slash+1);\r
 195                                                 try {\r
 196                                                         l = Level.valueOf(level);\r
 197                                                         access.printf(Level.AUDIT, "%s has set CADI Log Level to '%s'",req.getUser(),l.name());\r
 198                                                         access.setLogLevel(l);\r
 199                                                 } catch (IllegalArgumentException e) {\r
 200                                                         access.printf(Level.AUDIT, "'%s' is not a valid CADI Log Level",level);\r
 201                                                 }\r
 202                                                 return false;\r
 203                                         }\r
 204                                 } catch (IOException e) {\r
 205                                         access.log(e);\r
 206                                 }\r
 207                         }\r
 208                 }\r
 209                 return true;\r
 210         }\r
 211 \r
 212         public Lur getLur() {\r
 213                 return lur;\r
 214         }\r
 215         \r
 216         public void destroy() {\r
 217                 access.log(Level.INFO,"CadiHttpChecker destroyed.");\r
 218                 if(lur!=null) {\r
 219                         lur.destroy();\r
 220                         lur=null;\r
 221                 }\r
 222         }\r
 223 \r
 224         public Access getAccess() {\r
 225                 return access;\r
 226         }\r
 227 \r
 228 }\r