X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=cadi%2Faaf%2Fsrc%2Fmain%2Fjava%2Forg%2Fonap%2Faaf%2Fcadi%2Faaf%2Fcert%2FAAFListedCertIdentity.java;h=943e43ef123220ab9fac4bb5c77f02bb22f74747;hb=d16c6d57b3f0a6283960017444d7ffb22b4d583e;hp=de8ae7dfcefa52dfbbba006027d24118e6d679a3;hpb=a20accc73189d8e5454cd26049c0e6fae75da16f;p=aaf%2Fauthz.git

diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/cert/AAFListedCertIdentity.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/cert/AAFListedCertIdentity.java
index de8ae7df..943e43ef 100644
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/cert/AAFListedCertIdentity.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/cert/AAFListedCertIdentity.java
@@ -7,9 +7,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -55,122 +55,122 @@ import aaf.v2_0.Users;
 import aaf.v2_0.Users.User;
 
 public class AAFListedCertIdentity implements CertIdentity {
-	//TODO should 8 hours be configurable? 
-	private static final long EIGHT_HOURS = 1000*60*60*8; 
-			
-	private static Map<ByteArrayHolder,String> certs = null;
-	
-	// Did this to add other Trust Mechanisms
-	// Trust mechanism set by Property: 
-	private static final String[] authMechanisms = new String[] {"tguard","basicAuth","csp"};
-	private static String[] certIDs;
-	
-	private static Map<String,Set<String>> trusted =null;
-
-	public AAFListedCertIdentity(Access access, AAFCon<?> aafcon) throws APIException {
-		synchronized(AAFListedCertIdentity.class) {
-			if(certIDs==null) {
-				String cip = access.getProperty(Config.AAF_CERT_IDS, null);
-				if(cip!=null) {
-					certIDs = Split.split(',',cip);
-				}
-			}
-			if(certIDs!=null && certs==null) {
-				TimerTask cu = new CertUpdate(aafcon);
-				cu.run(); // want this to run in this thread first...
-				new Timer("AAF Identity Refresh Timer",true).scheduleAtFixedRate(cu, EIGHT_HOURS,EIGHT_HOURS);
-			}
-		}
-	}
-
-	public static Set<String> trusted(String authMech) {
-		return trusted.get(authMech);
-	}
-	
-	public TaggedPrincipal identity(HttpServletRequest req, X509Certificate cert,	byte[] certBytes) throws CertificateException {
-		if(cert==null && certBytes==null)return null;
-		if(certBytes==null)certBytes = cert.getEncoded();
-		byte[] fingerprint = X509Taf.getFingerPrint(certBytes);
-		String id = certs.get(new ByteArrayHolder(fingerprint));
-		if(id!=null) { // Caller is Validated
-			return new X509Principal(id,cert,certBytes);
-		}
-		return null;
-	}
-
-	private static class ByteArrayHolder implements Comparable<ByteArrayHolder> {
-		private byte[] ba;
-		public ByteArrayHolder(byte[] ba) {
-			this.ba = ba;
-		}
-		public int compareTo(ByteArrayHolder b) {
-			return Hash.compareTo(ba, b.ba);
-		}
-	}
-	
-	private class CertUpdate extends TimerTask {
-
-		private AAFCon<?> aafcon;
-		public CertUpdate(AAFCon<?> con) {
-			aafcon = con;
-		}
-		
-		@Override
-		public void run() {
-			try {
-				TreeMap<ByteArrayHolder, String> newCertsMap = new TreeMap<ByteArrayHolder,String>();
-				Map<String,Set<String>> newTrustMap = new TreeMap<String,Set<String>>();
-				Set<String> userLookup = new HashSet<String>();
-				for(String s : certIDs) {
-					userLookup.add(s);
-				}
-				for(String authMech : authMechanisms) {
-					Future<Users> fusr = aafcon.client(Config.AAF_DEFAULT_VERSION).read("/authz/users/perm/com.att.aaf.trust/"+authMech+"/authenticate", Users.class, aafcon.usersDF);
-					if(fusr.get(5000)) {
-						List<User> users = fusr.value.getUser();
-						if(users.isEmpty()) {
-							aafcon.access.log(Level.WARN, "AAF Lookup-No IDs in Role com.att.aaf.trustForID <> "+authMech);
-						} else {
-							aafcon.access.log(Level.INFO,"Loading Trust Authentication Info for",authMech);
-							Set<String> hsUser = new HashSet<String>();
-							for(User u : users) {
-								userLookup.add(u.getId());
-								hsUser.add(u.getId());
-							}
-							newTrustMap.put(authMech,hsUser);
-						}
-					} else {
-						aafcon.access.log(Level.WARN, "Could not get Users in Perm com.att.trust|tguard|authenticate",fusr.code(),fusr.body());
-					}
-					
-				}
-				
-				for(String u : userLookup) {
-					Future<Certs> fc = aafcon.client(Config.AAF_DEFAULT_VERSION).read("/authn/cert/id/"+u, Certs.class, aafcon.certsDF);
-					XMLGregorianCalendar now = Chrono.timeStamp();
-					if(fc.get(5000)) {
-						List<Cert> certs = fc.value.getCert();
-						if(certs.isEmpty()) {
-							aafcon.access.log(Level.WARN, "No Cert Associations for",u);
-						} else {
-							for(Cert c : fc.value.getCert()) {
-								XMLGregorianCalendar then =c.getExpires();
-								if(then !=null && then.compare(now)>0) {
-									newCertsMap.put(new ByteArrayHolder(c.getFingerprint()), c.getId());
-									aafcon.access.log(Level.INIT,"Associating "+ c.getId() + " expiring " + Chrono.dateOnlyStamp(c.getExpires()) + " with " + c.getX500());
-								}
-							}
-						}
-					} else {
-						aafcon.access.log(Level.WARN, "Could not get Certificates for",u);
-					}
-				}
-
-				certs = newCertsMap;
-				trusted = newTrustMap;
-			} catch(Exception e) {
-				aafcon.access.log(e, "Failure to update Certificate Identities from AAF");
-			}
-		}
-	}
+    //TODO should 8 hours be configurable?
+    private static final long EIGHT_HOURS = 1000*60*60*8L;
+
+    private static Map<ByteArrayHolder,String> certs = null;
+
+    // Did this to add other Trust Mechanisms
+    // Trust mechanism set by Property:
+    private static final String[] authMechanisms = new String[] {"tguard","basicAuth","csp"};
+    private static String[] certIDs;
+
+    private static Map<String,Set<String>> trusted =null;
+
+    public AAFListedCertIdentity(Access access, AAFCon<?> aafcon) {
+        synchronized(AAFListedCertIdentity.class) {
+            if (certIDs==null) {
+                String cip = access.getProperty(Config.AAF_CERT_IDS, null);
+                if (cip!=null) {
+                    certIDs = Split.split(',',cip);
+                }
+            }
+            if (certIDs!=null && certs==null) {
+                TimerTask cu = new CertUpdate(aafcon);
+                cu.run(); // want this to run in this thread first...
+                new Timer("AAF Identity Refresh Timer",true).scheduleAtFixedRate(cu, EIGHT_HOURS,EIGHT_HOURS);
+            }
+        }
+    }
+
+    public static Set<String> trusted(String authMech) {
+        return trusted.get(authMech);
+    }
+
+    public TaggedPrincipal identity(HttpServletRequest req, X509Certificate cert,    byte[] certBytes) throws CertificateException {
+        if (cert==null && certBytes==null)return null;
+        if (certBytes==null)certBytes = cert.getEncoded();
+        byte[] fingerprint = X509Taf.getFingerPrint(certBytes);
+        String id = certs.get(new ByteArrayHolder(fingerprint));
+        if (id!=null) { // Caller is Validated
+            return new X509Principal(id,cert,certBytes,null);
+        }
+        return null;
+    }
+
+    private static class ByteArrayHolder implements Comparable<ByteArrayHolder> {
+        private byte[] ba;
+        public ByteArrayHolder(byte[] ba) {
+            this.ba = ba;
+        }
+        public int compareTo(ByteArrayHolder b) {
+            return Hash.compareTo(ba, b.ba);
+        }
+    }
+
+    private class CertUpdate extends TimerTask {
+
+        private AAFCon<?> aafcon;
+        public CertUpdate(AAFCon<?> con) {
+            aafcon = con;
+        }
+
+        @Override
+        public void run() {
+            try {
+                TreeMap<ByteArrayHolder, String> newCertsMap = new TreeMap<>();
+                Map<String,Set<String>> newTrustMap = new TreeMap<>();
+                Set<String> userLookup = new HashSet<>();
+                for (String s : certIDs) {
+                    userLookup.add(s);
+                }
+                for (String authMech : authMechanisms) {
+                    Future<Users> fusr = aafcon.client().read("/authz/users/perm/com.att.aaf.trust/"+authMech+"/authenticate", Users.class, aafcon.usersDF);
+                    if (fusr.get(5000)) {
+                        List<User> users = fusr.value.getUser();
+                        if (users.isEmpty()) {
+                            aafcon.access.log(Level.WARN, "AAF Lookup-No IDs in Role com.att.aaf.trustForID <> "+authMech);
+                        } else {
+                            aafcon.access.log(Level.INFO,"Loading Trust Authentication Info for",authMech);
+                            Set<String> hsUser = new HashSet<>();
+                            for (User u : users) {
+                                userLookup.add(u.getId());
+                                hsUser.add(u.getId());
+                            }
+                            newTrustMap.put(authMech,hsUser);
+                        }
+                    } else {
+                        aafcon.access.log(Level.WARN, "Could not get Users in Perm com.att.trust|tguard|authenticate",fusr.code(),fusr.body());
+                    }
+
+                }
+
+                for (String u : userLookup) {
+                    Future<Certs> fc = aafcon.client().read("/authn/cert/id/"+u, Certs.class, aafcon.certsDF);
+                    XMLGregorianCalendar now = Chrono.timeStamp();
+                    if (fc.get(5000)) {
+                        List<Cert> certs = fc.value.getCert();
+                        if (certs.isEmpty()) {
+                            aafcon.access.log(Level.WARN, "No Cert Associations for",u);
+                        } else {
+                            for (Cert c : fc.value.getCert()) {
+                                XMLGregorianCalendar then =c.getExpires();
+                                if (then !=null && then.compare(now)>0) {
+                                    newCertsMap.put(new ByteArrayHolder(c.getFingerprint()), c.getId());
+                                    aafcon.access.log(Level.INIT,"Associating "+ c.getId() + " expiring " + Chrono.dateOnlyStamp(c.getExpires()) + " with " + c.getX500());
+                                }
+                            }
+                        }
+                    } else {
+                        aafcon.access.log(Level.WARN, "Could not get Certificates for",u);
+                    }
+                }
+
+                certs = newCertsMap;
+                trusted = newTrustMap;
+            } catch (Exception e) {
+                aafcon.access.log(e, "Failure to update Certificate Identities from AAF");
+            }
+        }
+    }
 }