X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=auth%2Fauth-service%2Fsrc%2Fmain%2Fjava%2Forg%2Fonap%2Faaf%2Fauth%2Fservice%2Fapi%2FAPI_Creds.java;h=fbc1baa245c4fe93e356eaac36b31b40b0d076a4;hb=07fb3ece74a9aa1fad8e2a9fab73b4de3e36853b;hp=68e0f14569152d78a0a25ea0a6bf9995039b2856;hpb=4b5a7d721d994a49057e9bfb403c7bff1b376660;p=aaf%2Fauthz.git

diff --git a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java
index 68e0f145..fbc1baa2 100644
--- a/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java
+++ b/auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java
@@ -91,16 +91,16 @@ public class API_Creds {
                 } else if (p instanceof X509Principal) {
                     // have to check Basic Auth here, because it might be CSP.
                     String authz = req.getHeader("Authorization");
-                    if(authz.startsWith("Basic ")) {
+                    if (authz.startsWith("Basic ")) {
                         BasicHttpTaf bht = ((X509Principal)p).getBasicHttpTaf(); 
-                        if(bht!=null) {
+                        if (bht!=null) {
                             BasicPrincipal bp = new BasicPrincipal(authz,"");
                             CredVal cv = bht.getCredVal(bp.getDomain());
-                            if(cv!=null) {
-                                if(cv.validate(bp.getName(), Type.PASSWORD, bp.getCred(), null) ) {
+                            if (cv!=null) {
+                                if (cv.validate(bp.getName(), Type.PASSWORD, bp.getCred(), null) ) {
                                     resp.setStatus(HttpStatus.OK_200);
                                 } else {
-                                    resp.setStatus(HttpStatus.FORBIDDEN_403);
+                                    resp.setStatus(HttpStatus.UNAUTHORIZED_401);
                                 }
                             }
                         } else {
@@ -108,11 +108,10 @@ public class API_Creds {
                             int colon = decoded.indexOf(':');
                             TimeTaken tt = trans.start("Direct Validation", Env.REMOTE);
                             try {
-                                if(directAAFUserPass.validate(
+                                if (directAAFUserPass.validate(
                                         decoded.substring(0,colon), 
                                         CredVal.Type.PASSWORD , 
                                         decoded.substring(colon+1).getBytes(),trans)) {
-                                    
                                     resp.setStatus(HttpStatus.OK_200);
                                 } else {
                                     // DME2 at this version crashes without some sort of response
@@ -124,7 +123,7 @@ public class API_Creds {
                             }
                         }
                     }
-                } else if(p == null) {
+                } else if (p == null) {
                     trans.error().log("Transaction not Authenticated... no Principal");
                     resp.setStatus(HttpStatus.FORBIDDEN_403);
                 } else {
@@ -144,14 +143,16 @@ public class API_Creds {
                     AuthzTrans trans, 
                     HttpServletRequest req,
                     HttpServletResponse resp) throws Exception {
-                
+                // will be a valid Entity.  Do we need to add permission
+            	//if(trans.fish("ns","password","request")) or the like
                 Result<Date> r = context.doesCredentialMatch(trans, req, resp);
-                if(r.isOK()) {
+                if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200);
                 } else {
                     // For Security, we don't give any info out on why failed, other than forbidden
                     // Can't do "401", because that is on the call itself
-                    resp.setStatus(HttpStatus.FORBIDDEN_403);
+                	// 403 Implies you MAY NOT Ask.
+                    resp.setStatus(HttpStatus.NOT_ACCEPTABLE_406);
                 }
             }
         });  
@@ -167,7 +168,7 @@ public class API_Creds {
                     HttpServletResponse resp) throws Exception {
                 
                 Result<Void> r = context.getCertInfoByID(trans, req, resp, pathParam(req,":id") );
-                if(r.isOK()) {
+                if (r.isOK()) {
                         resp.setStatus(HttpStatus.OK_200); 
                 } else {
                         // For Security, we don't give any info out on why failed, other than forbidden
@@ -194,8 +195,9 @@ public class API_Creds {
          */
         authzAPI.route(POST,"/authn/cred",API.CRED_REQ,new Code(facade,"Add a New ID/Credential", true) {
             @Override
-            public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {                Result<Void> r = context.createUserCred(trans, req);
-                if(r.isOK()) {
+            public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {                
+                Result<Void> r = context.createUserCred(trans, req);
+                if (r.isOK()) {
                     resp.setStatus(HttpStatus.CREATED_201);
                 } else {
                     context.error(trans,resp,r);
@@ -214,7 +216,7 @@ public class API_Creds {
                     HttpServletResponse resp) throws Exception {
                 
                 Result<Void> r = context.getCredsByNS(trans, resp, pathParam(req, "ns"));
-                if(r.isOK()) {
+                if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200); 
                 } else {
                     context.error(trans,resp,r);
@@ -234,7 +236,7 @@ public class API_Creds {
                     HttpServletResponse resp) throws Exception {
                 
                 Result<Void> r = context.getCredsByID(trans, resp, pathParam(req, "id"));
-                if(r.isOK()) {
+                if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200); 
                 } else {
                     context.error(trans,resp,r);
@@ -252,7 +254,7 @@ public class API_Creds {
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {
                 
                 Result<Void> r = context.changeUserCred(trans, req);
-                if(r.isOK()) {
+                if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200);
                 } else {
                     context.error(trans,resp,r);
@@ -273,7 +275,7 @@ public class API_Creds {
             @Override
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {
                 Result<Void> r = context.extendUserCred(trans, req, pathParam(req, "days"));
-                if(r.isOK()) {
+                if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200);
                 } else {
                     context.error(trans,resp,r);
@@ -288,7 +290,7 @@ public class API_Creds {
             @Override
             public void handle(AuthzTrans trans, HttpServletRequest req, HttpServletResponse resp) throws Exception {
                 Result<Void> r = context.deleteUserCred(trans, req);
-                if(r.isOK()) {
+                if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200);
                 } else {
                     context.error(trans,resp,r);