+++ /dev/null
-/**\r
- * ============LICENSE_START=======================================================\r
- * org.onap.aai\r
- * ================================================================================\r
- * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
- * Copyright © 2017 Amdocs\r
- * ================================================================================\r
- * Licensed under the Apache License, Version 2.0 (the "License");\r
- * you may not use this file except in compliance with the License.\r
- * You may obtain a copy of the License at\r
- *\r
- * http://www.apache.org/licenses/LICENSE-2.0\r
- *\r
- * Unless required by applicable law or agreed to in writing, software\r
- * distributed under the License is distributed on an "AS IS" BASIS,\r
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
- * See the License for the specific language governing permissions and\r
- * limitations under the License.\r
- * ============LICENSE_END=========================================================\r
- *\r
- * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
- */\r
-package org.openecomp.restclient.rest;\r
-\r
-import java.io.FileInputStream;\r
-import java.security.KeyStore;\r
-import java.security.cert.X509Certificate;\r
-\r
-import javax.net.ssl.HostnameVerifier;\r
-import javax.net.ssl.KeyManagerFactory;\r
-import javax.net.ssl.SSLContext;\r
-import javax.net.ssl.SSLSession;\r
-import javax.net.ssl.TrustManager;\r
-import javax.net.ssl.X509TrustManager;\r
-\r
-import org.openecomp.restclient.enums.RestAuthenticationMode;\r
-\r
-import com.sun.jersey.api.client.Client;\r
-import com.sun.jersey.api.client.config.ClientConfig;\r
-import com.sun.jersey.api.client.config.DefaultClientConfig;\r
-import com.sun.jersey.client.urlconnection.HTTPSProperties;\r
-\r
-/**\r
- * This is a generic REST Client builder with flexible security validation. Sometimes it's nice to\r
- * be able to disable server chain cert validation and hostname validation to work-around lab\r
- * issues, but at the same time be able to provide complete validation with client cert + hostname +\r
- * server cert chain validation. I used the ModelLoader REST client as a base and merged in the TSUI\r
- * client I wrote which also validates the server hostname and server certificate chain.\r
- */\r
-public class RestClientBuilder {\r
-\r
- public static final boolean DEFAULT_VALIDATE_SERVER_HOST = false;\r
- public static final boolean DEFAULT_VALIDATE_CERT_CHAIN = false;\r
- public static final String DEFAULT_CLIENT_CERT_FILENAME = null;\r
- public static final String DEFAULT_CERT_PASSWORD = null;\r
- public static final String DEFAULT_TRUST_STORE_FILENAME = null;\r
- public static final int DEFAULT_CONNECT_TIMEOUT_MS = 60000;\r
- public static final int DEFAULT_READ_TIMEOUT_MS = 60000;\r
- public static final RestAuthenticationMode DEFAULT_AUTH_MODE = RestAuthenticationMode.SSL_CERT;\r
- public static final String DEFAULT_BASIC_AUTH_USERNAME = "";\r
- public static final String DEFAULT_BASIC_AUTH_PASSWORD = "";\r
-\r
- private static final String SSL_PROTOCOL = "TLS";\r
- private static final String KEYSTORE_ALGORITHM = "SunX509";\r
- private static final String KEYSTORE_TYPE = "PKCS12";\r
- private static final String TRUST_STORE_PROPERTY = "javax.net.ssl.trustStore";\r
-\r
- private boolean validateServerHostname;\r
- private boolean validateServerCertChain;\r
- private String clientCertFileName;\r
- private String clientCertPassword;\r
- private String truststoreFilename;\r
- private int connectTimeoutInMs;\r
- private int readTimeoutInMs;\r
- private RestAuthenticationMode authenticationMode;\r
- private String basicAuthUsername;\r
- private String basicAuthPassword;\r
-\r
- /**\r
- * Rest Client Builder.\r
- */\r
- public RestClientBuilder() {\r
- validateServerHostname = DEFAULT_VALIDATE_SERVER_HOST;\r
- validateServerCertChain = DEFAULT_VALIDATE_CERT_CHAIN;\r
- clientCertFileName = DEFAULT_CLIENT_CERT_FILENAME;\r
- clientCertPassword = DEFAULT_CERT_PASSWORD;\r
- truststoreFilename = DEFAULT_TRUST_STORE_FILENAME;\r
- connectTimeoutInMs = DEFAULT_CONNECT_TIMEOUT_MS;\r
- readTimeoutInMs = DEFAULT_READ_TIMEOUT_MS;\r
- authenticationMode = DEFAULT_AUTH_MODE;\r
- basicAuthUsername = DEFAULT_BASIC_AUTH_USERNAME;\r
- basicAuthPassword = DEFAULT_BASIC_AUTH_PASSWORD;\r
- }\r
-\r
- public boolean isValidateServerHostname() {\r
- return validateServerHostname;\r
- }\r
-\r
- public void setValidateServerHostname(boolean validateServerHostname) {\r
- this.validateServerHostname = validateServerHostname;\r
- }\r
-\r
- public boolean isValidateServerCertChain() {\r
- return validateServerCertChain;\r
- }\r
-\r
- public void setValidateServerCertChain(boolean validateServerCertChain) {\r
- this.validateServerCertChain = validateServerCertChain;\r
- }\r
-\r
- public String getClientCertFileName() {\r
- return clientCertFileName;\r
- }\r
-\r
- public void setClientCertFileName(String clientCertFileName) {\r
- this.clientCertFileName = clientCertFileName;\r
- }\r
-\r
- public String getClientCertPassword() {\r
- return clientCertPassword;\r
- }\r
-\r
- public void setClientCertPassword(String clientCertPassword) {\r
- this.clientCertPassword = clientCertPassword;\r
- }\r
-\r
- public String getTruststoreFilename() {\r
- return truststoreFilename;\r
- }\r
-\r
- public void setTruststoreFilename(String truststoreFilename) {\r
- this.truststoreFilename = truststoreFilename;\r
- }\r
-\r
- public int getConnectTimeoutInMs() {\r
- return connectTimeoutInMs;\r
- }\r
-\r
- public void setConnectTimeoutInMs(int connectTimeoutInMs) {\r
- this.connectTimeoutInMs = connectTimeoutInMs;\r
- }\r
-\r
- public int getReadTimeoutInMs() {\r
- return readTimeoutInMs;\r
- }\r
-\r
- public void setReadTimeoutInMs(int readTimeoutInMs) {\r
- this.readTimeoutInMs = readTimeoutInMs;\r
- }\r
-\r
-\r
-\r
- public RestAuthenticationMode getAuthenticationMode() {\r
- return authenticationMode;\r
- }\r
-\r
- public void setAuthenticationMode(RestAuthenticationMode authenticationMode) {\r
- this.authenticationMode = authenticationMode;\r
- }\r
-\r
- public String getBasicAuthUsername() {\r
- return basicAuthUsername;\r
- }\r
-\r
- public void setBasicAuthUsername(String basicAuthUsername) {\r
- this.basicAuthUsername = basicAuthUsername;\r
- }\r
-\r
- public String getBasicAuthPassword() {\r
- return basicAuthPassword;\r
- }\r
-\r
- public void setBasicAuthPassword(String basicAuthPassword) {\r
- this.basicAuthPassword = basicAuthPassword;\r
- }\r
-\r
- /**\r
- * Returns Client configured for SSL\r
- */\r
- public Client getClient() throws Exception {\r
-\r
- switch (authenticationMode) {\r
- case SSL_BASIC:\r
- case SSL_CERT:\r
- return getClient(true);\r
-\r
- default:\r
- // return basic non-authenticating HTTP client\r
- return getClient(false);\r
- }\r
-\r
- }\r
-\r
- protected void setupSecureSocketLayerClientConfig(ClientConfig clientConfig) throws Exception {\r
- // Check to see if we need to perform proper validation of\r
- // the certificate chains.\r
- TrustManager[] trustAllCerts = null;\r
- if (validateServerCertChain) {\r
- if (truststoreFilename != null) {\r
- System.setProperty(TRUST_STORE_PROPERTY, truststoreFilename);\r
- } else {\r
- throw new IllegalArgumentException("Trust store filename must be set!");\r
- }\r
-\r
- } else {\r
-\r
- // We aren't validating certificates, so create a trust manager that does\r
- // not validate certificate chains.\r
- trustAllCerts = new TrustManager[] {new X509TrustManager() {\r
- public X509Certificate[] getAcceptedIssuers() {\r
- return null;\r
- }\r
-\r
- public void checkClientTrusted(X509Certificate[] certs, String authType) {}\r
-\r
- public void checkServerTrusted(X509Certificate[] certs, String authType) {}\r
- }};\r
- }\r
-\r
- // Set up the SSL context, keystore, etc. to use for our connection\r
- // to the AAI.\r
- SSLContext ctx = SSLContext.getInstance(SSL_PROTOCOL);\r
- KeyManagerFactory kmf = KeyManagerFactory.getInstance(KEYSTORE_ALGORITHM);\r
- KeyStore ks = KeyStore.getInstance(KEYSTORE_TYPE);\r
-\r
- char[] pwd = null;\r
- if (clientCertPassword != null) {\r
- pwd = clientCertPassword.toCharArray();\r
- }\r
-\r
- if (clientCertFileName != null) {\r
- FileInputStream fin = new FileInputStream(clientCertFileName);\r
-\r
- // Load the keystore and initialize the key manager factory.\r
- ks.load(fin, pwd);\r
- kmf.init(ks, pwd);\r
-\r
- ctx.init(kmf.getKeyManagers(), trustAllCerts, null);\r
- } else {\r
- ctx.init(null, trustAllCerts, null);\r
- }\r
-\r
- // Are we performing validation of the server host name?\r
- if (validateServerHostname) {\r
- clientConfig.getProperties().put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES,\r
- new HTTPSProperties(null, ctx));\r
-\r
- } else {\r
- clientConfig.getProperties().put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES,\r
- new HTTPSProperties(new HostnameVerifier() {\r
- @Override\r
- public boolean verify(String str, SSLSession sslSession) {\r
- return true;\r
- }\r
- }, ctx));\r
- }\r
- }\r
-\r
-\r
- /**\r
- * Returns client instance\r
- * \r
- * @param useSsl - used to configure the client with an ssl-context or just plain http\r
- */\r
- protected Client getClient(boolean useSsl) throws Exception {\r
-\r
- ClientConfig clientConfig = new DefaultClientConfig();\r
-\r
- if (useSsl) {\r
- setupSecureSocketLayerClientConfig(clientConfig);\r
- }\r
-\r
- // Finally, create and initialize our client...\r
- Client client = null;\r
- client = Client.create(clientConfig);\r
- client.setConnectTimeout(connectTimeoutInMs);\r
- client.setReadTimeout(readTimeoutInMs);\r
-\r
- // ...and return it to the caller.\r
- return client;\r
- }\r
-\r
- public String getBasicAuthenticationCredentials() {\r
-\r
- String usernameAndPassword = getBasicAuthUsername() + ":" + getBasicAuthPassword();\r
- return "Basic " + java.util.Base64.getEncoder().encodeToString(usernameAndPassword.getBytes());\r
- }\r
-\r
- /* \r
- * Added a little bit of logic to obfuscate passwords that could be logged out\r
- * (non-Javadoc)\r
- * @see java.lang.Object#toString()\r
- */\r
- @Override\r
- public String toString() {\r
- return "RestClientBuilder [validateServerHostname=" + validateServerHostname\r
- + ", validateServerCertChain=" + validateServerCertChain + ", "\r
- + (clientCertFileName != null ? "clientCertFileName=" + clientCertFileName + ", " : "")\r
- + (clientCertPassword != null\r
- ? "clientCertPassword="\r
- + java.util.Base64.getEncoder().encodeToString(clientCertPassword.getBytes()) + ", "\r
- : "")\r
- + (truststoreFilename != null ? "truststoreFilename=" + truststoreFilename + ", " : "")\r
- + "connectTimeoutInMs=" + connectTimeoutInMs + ", readTimeoutInMs=" + readTimeoutInMs + ", "\r
- + (authenticationMode != null ? "authenticationMode=" + authenticationMode + ", " : "")\r
- + (basicAuthUsername != null ? "basicAuthUsername=" + basicAuthUsername + ", " : "")\r
- + (basicAuthPassword != null ? "basicAuthPassword="\r
- + java.util.Base64.getEncoder().encodeToString(basicAuthPassword.getBytes()) : "")\r
- + "]";\r
- }\r
-\r
-}\r
Code Review / aai / rest-client.git / blobdiff