gerrit.onap Code Review - sdc.git/blob

   1 /*
   2  * Copyright © 2018 European Support Limited
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15 */
  16
  17 package org.openecomp.server.filters;
  18
  19 import java.io.IOException;
  20 import java.security.Principal;
  21 import java.util.Base64;
  22 import javax.servlet.Filter;
  23 import javax.servlet.FilterChain;
  24 import javax.servlet.FilterConfig;
  25 import javax.servlet.ServletException;
  26 import javax.servlet.ServletRequest;
  27 import javax.servlet.ServletResponse;
  28 import javax.servlet.http.HttpServletRequest;
  29 import javax.servlet.http.HttpServletRequestWrapper;
  30 import javax.servlet.http.HttpServletResponse;
  31
  32 import org.openecomp.sdc.logging.api.Logger;
  33 import org.openecomp.sdc.logging.api.LoggerFactory;
  34
  35 public class ActionAuthenticationFilter implements Filter {
  36
  37   private final Logger log = (Logger) LoggerFactory.getLogger(this.getClass().getName());
  38   private boolean runningOnLocal = true;
  39
  40   @Override
  41   public void destroy() {
  42     // TODO Auto-generated method stub
  43
  44   }
  45
  46   @Override
  47   public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)
  48       throws IOException, ServletException {
  49     if (runningOnLocal) {
  50
  51       HttpServletRequest httpRequest = (HttpServletRequest) arg0;
  52       String authorizationHeader = httpRequest.getHeader("Authorization");
  53       if (authorizationHeader != null && !authorizationHeader.isEmpty()) {
  54         String username;
  55         try {
  56           String base64Credentials =
  57               httpRequest.getHeader("Authorization").replace("Basic", "").trim();
  58           String decodedCredentials = new String(Base64.getDecoder().decode(base64Credentials));
  59           username = decodedCredentials.substring(0, decodedCredentials.indexOf(":"));
  60         } catch (Exception exception) {
  61           log.error("Failed to decode credentials", exception);
  62           setResponseStatus((HttpServletResponse) arg1, HttpServletResponse.SC_FORBIDDEN);
  63           return;
  64         }
  65         if (username.startsWith("AUTH")) {
  66           HttpServletRequestWrapper servletRequest = new HttpServletRequestWrapper(httpRequest) {
  67             @Override
  68             public java.lang.String getRemoteUser() {
  69               return getUserPrincipal().getName();
  70             }
  71
  72             @Override
  73             public Principal getUserPrincipal() {
  74               return () -> username.substring(0, username.indexOf("-"));
  75             }
  76
  77             @Override
  78             public boolean isUserInRole(String role) {
  79               try {
  80                 ActionLibraryPrivilege requiredPrivilege =
  81                     ActionLibraryPrivilege.getPrivilege(httpRequest.getMethod());
  82                 ActionLibraryPrivilege userPrivilege = ActionLibraryPrivilege
  83                     .valueOf(username.substring(username.indexOf("-") + 1).toUpperCase());
  84                 return userPrivilege.ordinal() >= requiredPrivilege.ordinal();
  85               } catch (Exception exception) {
  86                 log.error("Failed to validate UserInRole", exception);
  87                 return false;
  88               }
  89             }
  90           };
  91           arg2.doFilter(servletRequest, arg1);
  92         } else {
  93           setResponseStatus((HttpServletResponse) arg1, HttpServletResponse.SC_FORBIDDEN);
  94         }
  95       } else {
  96         setResponseStatus((HttpServletResponse) arg1, HttpServletResponse.SC_UNAUTHORIZED);
  97       }
  98     } else {
  99       //call super doFilter of cadi authentication filter
 100     }
 101
 102
 103   }
 104
 105   private void setResponseStatus(HttpServletResponse response, int status) {
 106     response.setStatus(status);
 107   }
 108
 109   @Override
 110   public void init(FilterConfig arg0) throws ServletException {
 111
 112   }
 113
 114 }