core/src/main/java/com/att/cadi/filter/PathFilter.java

   1 /*******************************************************************************\r
   2  * ============LICENSE_START====================================================\r
   3  * * org.onap.aaf\r
   4  * * ===========================================================================\r
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
   6  * * ===========================================================================\r
   7  * * Licensed under the Apache License, Version 2.0 (the "License");\r
   8  * * you may not use this file except in compliance with the License.\r
   9  * * You may obtain a copy of the License at\r
  10  * * \r
  11  *  *      http://www.apache.org/licenses/LICENSE-2.0\r
  12  * * \r
  13  *  * Unless required by applicable law or agreed to in writing, software\r
  14  * * distributed under the License is distributed on an "AS IS" BASIS,\r
  15  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  16  * * See the License for the specific language governing permissions and\r
  17  * * limitations under the License.\r
  18  * * ============LICENSE_END====================================================\r
  19  * *\r
  20  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
  21  * *\r
  22  ******************************************************************************/\r
  23 package com.att.cadi.filter;\r
  24 \r
  25 import java.io.IOException;\r
  26 \r
  27 import javax.servlet.Filter;\r
  28 import javax.servlet.FilterChain;\r
  29 import javax.servlet.FilterConfig;\r
  30 import javax.servlet.ServletContext;\r
  31 import javax.servlet.ServletException;\r
  32 import javax.servlet.ServletRequest;\r
  33 import javax.servlet.ServletResponse;\r
  34 import javax.servlet.http.HttpServletRequest;\r
  35 import javax.servlet.http.HttpServletResponse;\r
  36 \r
  37 import com.att.cadi.Access;\r
  38 import com.att.cadi.Access.Level;\r
  39 import com.att.cadi.config.Config;\r
  40 \r
  41 /**\r
  42  * PathFilter\r
  43  * \r
  44  * This class implements Servlet Filter, and uses AAF to validate access to a Path.\r
  45  * \r
  46  * This class can be used in a standard J2EE Servlet manner.\r
  47  *  \r
  48  *\r
  49  */\r
  50 public class PathFilter implements Filter {\r
  51         private ServletContext context;\r
  52         private String aaf_type;\r
  53         private String not_authorized_msg;\r
  54         private final Log log;\r
  55 \r
  56         /**\r
  57          * Construct a viable Filter for installing in Container WEB.XML, etc.\r
  58          * \r
  59          */\r
  60         public PathFilter() {\r
  61                 log = new Log() {\r
  62                         public void info(String ... msg) {\r
  63                                 context.log(build("INFO:",msg));\r
  64                         }\r
  65                         public void audit(String ... msg) {\r
  66                                 context.log(build("AUDIT:",msg));\r
  67                         }\r
  68                         private String build(String type, String []msg) {\r
  69                                 StringBuilder sb = new StringBuilder(type);\r
  70                                 for(String s : msg) {\r
  71                                         sb.append(' ');\r
  72                                         sb.append(s);\r
  73                                 }\r
  74                                 return sb.toString();\r
  75                         }\r
  76                 \r
  77                 };\r
  78         }\r
  79         \r
  80         /**\r
  81          * Filter that can be constructed within Java\r
  82          * @param access\r
  83          */\r
  84         public PathFilter(final Access access) {\r
  85                 log = new Log() {\r
  86                         public void info(String ... msg) {\r
  87                                 access.log(Level.INFO, (Object[])msg);\r
  88                         }\r
  89                         public void audit(String ... msg) {\r
  90                                 access.log(Level.AUDIT, (Object[])msg);\r
  91                         }\r
  92                 };\r
  93         }\r
  94         \r
  95         /**\r
  96          * Init\r
  97          * \r
  98          * Standard Filter "init" call with FilterConfig to obtain properties.  POJOs can construct a\r
  99          * FilterConfig with the mechanism of their choice, and standard J2EE Servlet engines utilize this\r
 100          * mechanism already.\r
 101          */\r
 102         public void init(FilterConfig filterConfig) throws ServletException {\r
 103                 // need the Context for Logging, instantiating ClassLoader, etc\r
 104                 context = filterConfig.getServletContext();\r
 105                 StringBuilder sb = new StringBuilder();\r
 106                 StringBuilder err = new StringBuilder(); \r
 107                 Object attr = context.getAttribute(Config.PATHFILTER_NS);\r
 108                 if(attr==null) {\r
 109                         err.append("PathFilter - pathfilter_ns is not set");\r
 110                 } else {\r
 111                         sb.append(attr.toString()); \r
 112                 }\r
 113 \r
 114                 attr = context.getAttribute(Config.PATHFILTER_STACK);\r
 115                 if(attr==null) {\r
 116                         log.info("PathFilter - No pathfilter_stack set, ignoring");\r
 117                 } else {\r
 118                         sb.append('.');\r
 119                         sb.append(attr.toString());\r
 120                 }\r
 121 \r
 122                 attr = context.getAttribute(Config.PATHFILTER_URLPATTERN);\r
 123                 if(attr==null) {\r
 124                         log.info("PathFilter - No pathfilter_urlpattern set, defaulting to 'urlpattern'");\r
 125                         sb.append(".urlpattern");\r
 126                 } else {\r
 127                         sb.append('.');\r
 128                         sb.append(attr.toString());\r
 129                 }\r
 130 \r
 131                 log.info("PathFilter - AAF Permission Type is",sb.toString());\r
 132                 \r
 133                 sb.append('|');\r
 134                 \r
 135                 aaf_type = sb.toString();\r
 136 \r
 137                 attr = context.getAttribute(Config.PATHFILTER_NOT_AUTHORIZED_MSG);\r
 138                 if(attr==null) {\r
 139                         not_authorized_msg = "Forbidden - Not Authorized to access this Path";\r
 140                 } else {\r
 141                         not_authorized_msg = attr.toString();\r
 142                 }\r
 143 \r
 144                 if(err.length()>0) {\r
 145                         throw new ServletException(err.toString());\r
 146                 }\r
 147         }\r
 148 \r
 149         private interface Log {\r
 150                 public void info(String ... msg);\r
 151                 public void audit(String ... msg);\r
 152         }\r
 153 \r
 154         /**\r
 155          * doFilter\r
 156          * \r
 157          * This is the standard J2EE invocation.  Analyze the request, modify response as necessary, and\r
 158          * only call the next item in the filterChain if request is suitably Authenticated.\r
 159          */\r
 160         //TODO Always validate changes against Tomcat AbsCadiValve and Jaspi CadiSAM functions\r
 161         public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {\r
 162                 HttpServletRequest hreq = (HttpServletRequest)request;\r
 163                 HttpServletResponse hresp = (HttpServletResponse)response;\r
 164                 String perm = aaf_type+hreq.getPathInfo()+'|'+hreq.getMethod();\r
 165                 if(hreq.isUserInRole(perm)) {\r
 166                         chain.doFilter(request, response);\r
 167                 } else {\r
 168                         log.audit("PathFilter has denied",hreq.getUserPrincipal().getName(),"access to",perm);\r
 169                         hresp.sendError(403,not_authorized_msg);\r
 170                 }\r
 171         }\r
 172 \r
 173         /**\r
 174          * Containers call "destroy" when time to cleanup \r
 175          */\r
 176         public void destroy() {\r
 177                 log.info("PathFilter destroyed.");\r
 178         }\r
 179 \r
 180 \r
 181 \r
 182 }\r
 183 \r