+++ /dev/null
-/*******************************************************************************\r
- * ============LICENSE_START====================================================\r
- * * org.onap.aaf\r
- * * ===========================================================================\r
- * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
- * * ===========================================================================\r
- * * Licensed under the Apache License, Version 2.0 (the "License");\r
- * * you may not use this file except in compliance with the License.\r
- * * You may obtain a copy of the License at\r
- * * \r
- * * http://www.apache.org/licenses/LICENSE-2.0\r
- * * \r
- * * Unless required by applicable law or agreed to in writing, software\r
- * * distributed under the License is distributed on an "AS IS" BASIS,\r
- * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
- * * See the License for the specific language governing permissions and\r
- * * limitations under the License.\r
- * * ============LICENSE_END====================================================\r
- * *\r
- * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
- * *\r
- ******************************************************************************/\r
-package org.onap.aaf.cadi.taf.basic;\r
-\r
-import java.io.IOException;\r
-import java.security.Principal;\r
-\r
-import javax.servlet.http.HttpServletRequest;\r
-import javax.servlet.http.HttpServletResponse;\r
-\r
-import org.onap.aaf.cadi.Access;\r
-import org.onap.aaf.cadi.BasicCred;\r
-import org.onap.aaf.cadi.CachedPrincipal;\r
-import org.onap.aaf.cadi.CredVal;\r
-import org.onap.aaf.cadi.Taf;\r
-import org.onap.aaf.cadi.Access.Level;\r
-import org.onap.aaf.cadi.CachedPrincipal.Resp;\r
-import org.onap.aaf.cadi.CredVal.Type;\r
-import org.onap.aaf.cadi.principal.BasicPrincipal;\r
-import org.onap.aaf.cadi.principal.CachedBasicPrincipal;\r
-import org.onap.aaf.cadi.taf.HttpTaf;\r
-import org.onap.aaf.cadi.taf.TafResp;\r
-import org.onap.aaf.cadi.taf.TafResp.RESP;\r
-import org.onap.aaf.cadi.taf.dos.DenialOfServiceTaf;\r
-\r
-/**\r
- * BasicHttpTaf\r
- * \r
- * This TAF implements the "Basic Auth" protocol. \r
- * \r
- * WARNING! It is true for any implementation of "Basic Auth" that the password is passed unencrypted. \r
- * This is because the expectation, when designed years ago, was that it would only be used in \r
- * conjunction with SSL (https). It is common, however, for users to ignore this on the assumption that\r
- * their internal network is secure, or just ignorance. Therefore, a WARNING will be printed\r
- * when the HTTP Channel is not encrypted (unless explicitly turned off).\r
- * \r
- *\r
- */\r
-public class BasicHttpTaf implements HttpTaf {\r
- private Access access;\r
- private String realm;\r
- private CredVal rbac;\r
- private boolean warn;\r
- private long timeToLive;\r
- \r
- public BasicHttpTaf(Access access, CredVal rbac, String realm, long timeToLive, boolean turnOnWarning) {\r
- this.access = access;\r
- this.realm = realm;\r
- this.rbac = rbac;\r
- this.warn = turnOnWarning;\r
- this.timeToLive = timeToLive;\r
- }\r
-\r
- /**\r
- * Note: BasicHttp works for either Carbon Based (Humans) or Silicon Based (machine) Lifeforms. \r
- * @see Taf\r
- */\r
- public TafResp validate(Taf.LifeForm reading, HttpServletRequest req, HttpServletResponse resp) {\r
- // See if Request implements BasicCred (aka CadiWrap or other), and if User/Pass has already been set separately\r
- if(req instanceof BasicCred) {\r
- BasicCred bc = (BasicCred)req;\r
- if(bc.getUser()!=null) { // CadiWrap, if set, makes sure User & Password are both valid, or both null\r
- if(DenialOfServiceTaf.isDeniedID(bc.getUser())!=null) {\r
- return DenialOfServiceTaf.respDenyID(access,bc.getUser());\r
- }\r
- CachedBasicPrincipal bp = new CachedBasicPrincipal(this,bc,realm,timeToLive);\r
- // ONLY FOR Last Ditch DEBUGGING... \r
- // access.log(Level.WARN,bp.getName() + ":" + new String(bp.getCred()));\r
- if(rbac.validate(bp.getName(),Type.PASSWORD,bp.getCred())) {\r
- return new BasicHttpTafResp(access,bp,bp.getName()+" authenticated by password",RESP.IS_AUTHENTICATED,resp,realm,false);\r
- } else {\r
- //TODO may need timed retries in a given time period\r
- return new BasicHttpTafResp(access,null,buildMsg(bp,req,"User/Pass combo invalid for ",bc.getUser()), \r
- RESP.TRY_AUTHENTICATING,resp,realm,true);\r
- }\r
- }\r
- }\r
- // Get User/Password from Authorization Header value\r
- String authz = req.getHeader("Authorization");\r
- if(authz != null && authz.startsWith("Basic ")) {\r
- if(warn&&!req.isSecure()) {\r
- access.log(Level.WARN,"WARNING! BasicAuth has been used over an insecure channel");\r
- }\r
- try {\r
- CachedBasicPrincipal ba = new CachedBasicPrincipal(this,authz,realm,timeToLive);\r
- if(DenialOfServiceTaf.isDeniedID(ba.getName())!=null) {\r
- return DenialOfServiceTaf.respDenyID(access,ba.getName());\r
- }\r
-\r
- // ONLY FOR Last Ditch DEBUGGING... \r
- // access.log(Level.WARN,ba.getName() + ":" + new String(ba.getCred()));\r
- if(rbac.validate(ba.getName(), Type.PASSWORD, ba.getCred())) {\r
- return new BasicHttpTafResp(access,ba, ba.getName()+" authenticated by BasicAuth password",RESP.IS_AUTHENTICATED,resp,realm,false);\r
- } else {\r
- //TODO may need timed retries in a given time period\r
- return new BasicHttpTafResp(access,null,buildMsg(ba,req,"User/Pass combo invalid"), \r
- RESP.TRY_AUTHENTICATING,resp,realm,true);\r
- }\r
- } catch (IOException e) {\r
- String msg = buildMsg(null,req,"Failed HTTP Basic Authorization (", e.getMessage(), ')');\r
- access.log(Level.INFO,msg);\r
- return new BasicHttpTafResp(access,null,msg, RESP.TRY_AUTHENTICATING, resp, realm,true);\r
- }\r
- }\r
- return new BasicHttpTafResp(access,null,"Requesting HTTP Basic Authorization",RESP.TRY_AUTHENTICATING,resp,realm,false);\r
- }\r
- \r
- protected String buildMsg(Principal pr, HttpServletRequest req, Object ... msg) {\r
- StringBuilder sb = new StringBuilder();\r
- for(Object s : msg) {\r
- sb.append(s.toString());\r
- }\r
- if(pr!=null) {\r
- sb.append(" for ");\r
- sb.append(pr.getName());\r
- }\r
- sb.append(" from ");\r
- sb.append(req.getRemoteAddr());\r
- sb.append(':');\r
- sb.append(req.getRemotePort());\r
- return sb.toString();\r
- }\r
-\r
- @Override\r
- public Resp revalidate(CachedPrincipal prin) {\r
- if(prin instanceof BasicPrincipal) {\r
- BasicPrincipal ba = (BasicPrincipal)prin;\r
- if(DenialOfServiceTaf.isDeniedID(ba.getName())!=null) {\r
- return Resp.UNVALIDATED;\r
- }\r
- return rbac.validate(ba.getName(), Type.PASSWORD, ba.getCred())?Resp.REVALIDATED:Resp.UNVALIDATED;\r
- }\r
- return Resp.NOT_MINE;\r
- }\r
- \r
- public String toString() {\r
- return "Basic Auth enabled on realm: " + realm;\r
- }\r
-}\r
Code Review / aaf / cadi.git / blobdiff