AT&T 2.0.19 Code drop, stage 2

[aaf/authz.git] / cadi / aaf / src / main / java / org / onap / aaf / cadi / aaf / v2_0 / AAFTrustChecker.java

diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFTrustChecker.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFTrustChecker.java
new file mode 100644 (file)
index 0000000..074b704
--- /dev/null
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFTrustChecker.java
@@ -0,0 +1,114 @@
+/**
+ * ============LICENSE_START====================================================
+ * org.onap.aaf
+ * ===========================================================================
+ * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
+ * ===========================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END====================================================
+ *
+ */
+
+package org.onap.aaf.cadi.aaf.v2_0;
+
+import javax.servlet.http.HttpServletRequest ;
+
+import org.onap.aaf.cadi.Access;
+import org.onap.aaf.cadi.Lur;
+import org.onap.aaf.cadi.TrustChecker;
+import org.onap.aaf.cadi.aaf.AAFPermission;
+import org.onap.aaf.cadi.config.Config;
+import org.onap.aaf.cadi.principal.TrustPrincipal;
+import org.onap.aaf.cadi.taf.TafResp;
+import org.onap.aaf.cadi.taf.TrustNotTafResp;
+import org.onap.aaf.cadi.taf.TrustTafResp;
+import org.onap.aaf.misc.env.Env;
+import org.onap.aaf.misc.env.util.Split;
+
+public class AAFTrustChecker implements TrustChecker {
+       private final String tag, id;
+       private final AAFPermission perm;
+       private Lur lur;
+
+       /**
+        * 
+        * Instance will be replaced by Identity
+        * @param lur 
+        *    
+        * @param tag
+        * @param perm
+        */
+       public AAFTrustChecker(final Env env) {
+               tag = env.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);
+               id = env.getProperty(Config.CADI_ALIAS,env.getProperty(Config.AAF_APPID)); // share between components
+               String str = env.getProperty(Config.CADI_TRUST_PERM);
+               AAFPermission temp=null;
+               if(str!=null) {
+                       String[] sp = Split.splitTrim('|', str);
+                       if(sp.length==3) {
+                               temp = new AAFPermission(sp[0],sp[1],sp[2]);
+                       }
+               }
+               perm=temp;
+       }
+
+       public AAFTrustChecker(final Access access) {
+               tag = access.getProperty(Config.CADI_USER_CHAIN_TAG, Config.CADI_USER_CHAIN);
+               id = access.getProperty(Config.CADI_ALIAS,access.getProperty(Config.AAF_APPID,null)); // share between components
+               String str = access.getProperty(Config.CADI_TRUST_PERM,null);
+               AAFPermission temp=null;
+               if(str!=null) {
+                       String[] sp = Split.splitTrim('|', str);
+                       if(sp.length==3) {
+                               temp = new AAFPermission(sp[0],sp[1],sp[2]);
+                       }
+               }
+               perm=temp;
+       }
+
+       /* (non-Javadoc)
+        * @see org.onap.aaf.cadi.TrustChecker#setLur(org.onap.aaf.cadi.Lur)
+        */
+       @Override
+       public void setLur(Lur lur) {
+               this.lur = lur;
+       }
+
+       @Override
+       public TafResp mayTrust(TafResp tresp, HttpServletRequest req) {
+               String user_info = req.getHeader(tag);
+               if(user_info !=null ) {
+                       String[] info = Split.split(',', user_info);
+                       if(info.length>0) {
+                               String[] flds = Split.splitTrim(':',info[0]);
+                               if(flds.length>3 && "AS".equals(flds[3])) { // is it set for "AS"
+                                       String pn = tresp.getPrincipal().getName();
+                                       if(pn.equals(id)  // We do trust our own App Components: if a trust entry is made with self, always accept
+                                          || lur.fish(tresp.getPrincipal(), perm)) { // Have Perm set by Config.CADI_TRUST_PERM
+                                               return new TrustTafResp(tresp,
+                                                               new TrustPrincipal(tresp.getPrincipal(), flds[0]),
+                                                               "  " + flds[0] + " validated using " + flds[2] + " by " + flds[1] + ','
+                                                       );
+                                       } else if(pn.equals(flds[0])) { // Ignore if same identity 
+                                               return tresp;
+                                       } else {
+                                               return new TrustNotTafResp(tresp, tresp.getPrincipal().getName() + " requested trust as "
+                                                               + flds[0] + ", but does not have Authorization");
+                                       }
+                               }
+                       }
+               }
+               return tresp;
+       }
+
+}
\ No newline at end of file