# auth.method flags:\r
#\r
# noAuth - default option - no security (http)\r
-# certOnly - auth by certificate (https)\r
-# basicAuth - auth by basic auth username and password (https)\r
# certBasicAuth - auth by certificate and basic auth username / password (https)\r
auth.method=noAuth\r
\r
</parent>\r
<groupId>org.onap.dcaegen2.collectors.ves</groupId>\r
<artifactId>VESCollector</artifactId>\r
- <version>1.5.1-SNAPSHOT</version>\r
+ <version>1.5.2-SNAPSHOT</version>\r
<name>dcaegen2-collectors-ves</name>\r
<description>VESCollector</description>\r
<properties>\r
public enum AuthMethodType {
- NO_AUTH("noAuth"),CERT_ONLY("certOnly"),CERT_BASIC_AUTH("certBasicAuth"),BASIC_AUTH("basicAuth");
+ NO_AUTH("noAuth"),CERT_BASIC_AUTH("certBasicAuth");
private final String value;
+++ /dev/null
-/*
- * ============LICENSE_START=======================================================
- * PROJECT
- * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
- * Copyright (C) 2018 Nokia. All rights reserved.s
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============LICENSE_END=========================================================
- */
-
-package org.onap.dcae.common.configuration;
-
-import org.onap.dcae.ApplicationSettings;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
-
-public class BasicAuth implements AuthMethod {
-
- private static final Logger log = LoggerFactory.getLogger(BasicAuth.class);
- private final ConfigurableServletWebServerFactory container;
- private final ApplicationSettings properties;
-
- public BasicAuth(ConfigurableServletWebServerFactory container, ApplicationSettings properties) {
- this.container = container;
- this.properties = properties;
- }
-
- @Override
- public void configure() {
- SslContextCreator sslContextCreator = new SslContextCreator(properties);
- container.setPort(properties.httpsPort());
- container.setSsl(sslContextCreator.simpleHttpsContext());
- log.info(String.format("Application work in %s mode on %s port.",
- properties.authMethod(), properties.httpsPort()));
- }
-}
+++ /dev/null
-/*
- * ============LICENSE_START=======================================================
- * PROJECT
- * ================================================================================
- * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
- * Copyright (C) 2018 - 2019 Nokia. All rights reserved.
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============LICENSE_END=========================================================
- */
-
-package org.onap.dcae.common.configuration;
-
-import org.onap.dcae.ApplicationSettings;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.boot.web.server.Ssl.ClientAuth;
-import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
-
-public class CertAuth implements AuthMethod {
-
- private static final Logger log = LoggerFactory.getLogger(CertAuth.class);
- private final ConfigurableServletWebServerFactory container;
- private final ApplicationSettings properties;
-
- public CertAuth(ConfigurableServletWebServerFactory container, ApplicationSettings properties) {
- this.container = container;
- this.properties = properties;
- }
-
- @Override
- public void configure() {
- SslContextCreator sslContextCreator = new SslContextCreator(properties);
- container.setSsl(sslContextCreator.httpsContextWithTlsAuthentication(ClientAuth.NEED));
- container.setPort(properties.httpsPort());
- log.info(String.format("Application work in %s mode on %s port.",
- properties.authMethod(), properties.httpsPort()));
- }
-}
public class CertBasicAuth implements AuthMethod{
- private static final Logger log = LoggerFactory.getLogger(CertAuth.class);
+ private static final Logger log = LoggerFactory.getLogger(CertBasicAuth.class);
private final ConfigurableServletWebServerFactory container;
private final ApplicationSettings properties;
}
private boolean validateAuthMethod() {
- return properties.authMethod().equalsIgnoreCase(AuthMethodType.BASIC_AUTH.value())
- || properties.authMethod().equalsIgnoreCase(AuthMethodType.CERT_ONLY.value())
- || properties.authMethod().equalsIgnoreCase(AuthMethodType.CERT_BASIC_AUTH.value());
+ return properties.authMethod().equalsIgnoreCase(AuthMethodType.CERT_BASIC_AUTH.value());
}
private void logContainerConfiguration(int port) {
public class SslContextCreator {
- private static final Logger log = LoggerFactory.getLogger(CertAuth.class);
+ private static final Logger log = LoggerFactory.getLogger(SslContextCreator.class);
private final ApplicationSettings properties;
public SslContextCreator(ApplicationSettings properties) {
import io.vavr.control.Option;
import java.io.IOException;
import java.security.cert.X509Certificate;
+import java.util.Arrays;
import java.util.Base64;
+import java.util.stream.Collectors;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.onap.dcae.ApplicationSettings;
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
throws IOException {
- SubjectMatcher subjectMatcher = new SubjectMatcher(settings,(X509Certificate[]) request.getAttribute(CERTIFICATE_X_509));
+ X509Certificate[] certificates = (X509Certificate[]) request.getAttribute(CERTIFICATE_X_509);
+ SubjectMatcher subjectMatcher = new SubjectMatcher(settings, certificates);
if(isHttpPortCalledWithAuthTurnedOn(request)){
if(isHealthcheckCalledFromInsideCluster(request)){
return false;
}
- if(settings.authMethod().equalsIgnoreCase(AuthMethodType.CERT_ONLY.value())){
- return validateCertRequest(response, subjectMatcher);
- }
-
if(isCertSubject(subjectMatcher)){
+ LOG.debug("Cert and subjectDN is valid. Subject: " + extractSubject(certificates));
return true;
}
- if (isBasicAuth() ) {
+ if (isBasicAuth()) {
return validateBasicHeader(request, response);
}
return true;
}
+ private String extractSubject(X509Certificate[] certs) {
+ return Arrays.stream(certs)
+ .map(e -> e.getSubjectDN().getName())
+ .collect(Collectors.joining(","));
+ }
+
private boolean isHttpPortCalledWithAuthTurnedOn(HttpServletRequest request) {
return !settings.authMethod().equalsIgnoreCase(AuthMethodType.NO_AUTH.value())
&& request.getLocalPort() == settings.httpPort();
response.getWriter().write(ApiException.UNAUTHORIZED_USER.toJSON().toString());
return false;
}
- LOG.info("Request is authorized by basic auth");
- return true;
- }
-
- private boolean validateCertRequest(HttpServletResponse response, SubjectMatcher subjectMatcher)
- throws IOException {
- if (!isCertSubject(subjectMatcher)) {
- response.setStatus(HttpServletResponse.SC_FORBIDDEN);
- response.getWriter().write(String.format(MESSAGE, settings.certSubjectMatcher()));
- return false;
- }
- LOG.info("Cert and subjectDN is valid");
+ LOG.debug("Request is authorized by basic auth. User: " + extractUser(decodeCredentials(authorizationHeader)));
return true;
}
private boolean isCertSubject(SubjectMatcher subjectMatcher) {
if(subjectMatcher.isCert() && subjectMatcher.match()){
- LOG.info("Cert and subjectDN is valid");
return true;
}
LOG.info(String.format(MESSAGE, settings.certSubjectMatcher()));
}
private boolean isBasicAuth() {
- return settings.authMethod().equalsIgnoreCase(AuthMethodType.BASIC_AUTH.value())
- || settings.authMethod().equalsIgnoreCase(AuthMethodType.CERT_BASIC_AUTH.value());
+ return settings.authMethod().equalsIgnoreCase(AuthMethodType.CERT_BASIC_AUTH.value());
}
private boolean isAuthorized(String authorizationHeader) {
try {
- String encodedData = authorizationHeader.split(" ")[1];
- String decodedData = new String(Base64.getDecoder().decode(encodedData));
- String providedUser = decodedData.split(":")[0].trim();
- String providedPassword = decodedData.split(":")[1].trim();
+ String decodeCredentials = decodeCredentials(authorizationHeader);
+ String providedUser = extractUser(decodeCredentials);
+ String providedPassword = extractPassword(decodeCredentials);
Option<String> maybeSavedPassword = settings.validAuthorizationCredentials().get(providedUser);
boolean userRegistered = maybeSavedPassword.isDefined();
return userRegistered && cryptPassword.matches(providedPassword,maybeSavedPassword.get());
return false;
}
}
+
+ private String extractPassword(String decodeCredentials) {
+ return decodeCredentials.split(":")[1].trim();
+ }
+
+ private String extractUser(String decodeCredentials) {
+ return decodeCredentials.split(":")[0].trim();
+ }
+
+ private String decodeCredentials(String authorizationHeader) {
+ String encodedData = authorizationHeader.split(" ")[1];
+ return new String(Base64.getDecoder().decode(encodedData));
+ }
}
\ No newline at end of file
import org.onap.dcae.ApplicationSettings;
import org.onap.dcae.common.configuration.AuthMethod;
import org.onap.dcae.common.configuration.AuthMethodType;
-import org.onap.dcae.common.configuration.BasicAuth;
-import org.onap.dcae.common.configuration.CertAuth;
import org.onap.dcae.common.configuration.CertBasicAuth;
import org.onap.dcae.common.configuration.NoAuth;
import org.springframework.beans.factory.annotation.Autowired;
private Map<String, AuthMethod> provideAuthConfigurations(ConfigurableServletWebServerFactory container) {
Map<String, AuthMethod> authMethods = new HashMap<>();
- authMethods.put(AuthMethodType.CERT_ONLY.value(), new CertAuth(container, properties));
- authMethods.put(AuthMethodType.BASIC_AUTH.value(), new BasicAuth(container, properties));
authMethods.put(AuthMethodType.CERT_BASIC_AUTH.value(), new CertBasicAuth(container, properties));
authMethods.put(AuthMethodType.NO_AUTH.value(), new NoAuth(container, properties));
return authMethods;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.mockito.Mockito.when;
-import static org.onap.dcae.TLSTest.HttpsConfiguration.USERNAME;
-import static org.onap.dcae.TLSTest.HttpsConfiguration.PASSWORD;
+import static org.onap.dcae.TLSTest.HttpsConfigurationWithTLSAuthenticationAndBasicAuth.USERNAME;
+import static org.onap.dcae.TLSTest.HttpsConfigurationWithTLSAuthenticationAndBasicAuth.PASSWORD;
public class TLSTest extends TLSTestBase {
}
}
- @Nested
- @Import(HttpsConfiguration.class)
- class HttpsTest extends TestClassBase {
-
-
- @Test
- public void shouldHttpsRequestWithoutBasicAuthFail() {
- assertThrows(Exception.class, this::makeHttpsRequest);
- }
-
- @Test
- public void shouldHttpsRequestWithBasicAuthSucceed() {
- assertEquals(HttpStatus.OK, makeHttpsRequestWithBasicAuth(USERNAME, PASSWORD).getStatusCode());
- }
- }
-
- @Nested
- @Import(HttpsConfigurationWithTLSAuthentication.class)
- class HttpsWithTLSAuthenticationTest extends TestClassBase {
-
- @Test
- public void shouldHttpsRequestWithoutCertificateFail() {
- assertThrows(Exception.class, this::makeHttpsRequest);
- }
-
- @Test
- public void shouldHttpsRequestWithCertificateSucceed() {
- assertEquals(HttpStatus.OK, makeHttpsRequestWithClientCert().getStatusCode());
- }
- }
-
@Nested
@Import(HttpsConfigurationWithTLSAuthenticationAndBasicAuth.class)
class HttpsWithTLSAuthenticationAndBasicAuthTest extends TestClassBase {
}
}
- static class HttpsConfiguration extends TLSTestBase.ConfigurationBase {
+ static class HttpsConfigurationWithTLSAuthenticationAndBasicAuth extends TLSTestBase.ConfigurationBase {
public static final String USERNAME = "TestUser";
public static final String PASSWORD = "TestPassword";
-
@Override
protected void configureSettings(ApplicationSettings settings) {
when(settings.keystoreFileLocation()).thenReturn(KEYSTORE.toString());
when(settings.keystorePasswordFileLocation()).thenReturn(KEYSTORE_PASSWORD_FILE.toString());
- when(settings.authMethod()).thenReturn(AuthMethodType.BASIC_AUTH.value());
when(settings.validAuthorizationCredentials()).thenReturn(HashMap.of(USERNAME, "$2a$10$51tDgG2VNLde5E173Ay/YO.Fq.aD.LR2Rp8pY3QAKriOSPswvGviy"));
- when(settings.httpPort()).thenReturn(1111);
- }
- }
-
- static class HttpsConfigurationWithTLSAuthentication extends HttpsConfiguration {
- @Override
- protected void configureSettings(ApplicationSettings settings) {
- super.configureSettings(settings);
- when(settings.authMethod()).thenReturn(AuthMethodType.CERT_ONLY.value());
+ when(settings.authMethod()).thenReturn(AuthMethodType.CERT_BASIC_AUTH.value());
when(settings.truststoreFileLocation()).thenReturn(TRUSTSTORE.toString());
when(settings.truststorePasswordFileLocation()).thenReturn(TRUSTSTORE_PASSWORD_FILE.toString());
when(settings.certSubjectMatcher()).thenReturn(CERT_SUBJECT_MATCHER.toString());
when(settings.httpPort()).thenReturn(1111);
}
}
-
- static class HttpsConfigurationWithTLSAuthenticationAndBasicAuth extends HttpsConfigurationWithTLSAuthentication {
- @Override
- protected void configureSettings(ApplicationSettings settings) {
- super.configureSettings(settings);
- when(settings.authMethod()).thenReturn(AuthMethodType.CERT_BASIC_AUTH.value());
- when(settings.httpPort()).thenReturn(1111);
- }
- }
}
\ No newline at end of file
package org.onap.dcae.restapi;
-import io.vavr.collection.HashMap;
-import io.vavr.collection.Map;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.InjectMocks;
import org.onap.dcae.ApplicationSettings;
import org.onap.dcae.common.configuration.AuthMethodType;
import org.slf4j.Logger;
-import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors;
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
import javax.servlet.http.HttpServletRequest;
@RunWith(MockitoJUnitRunner.Silent.class)
public class ApiAuthInterceptionTest {
- private static final String USERNAME = "Foo";
- private static final String PASSWORD = "Bar";
- private static final Map<String, String> CREDENTIALS = HashMap.of(USERNAME, PASSWORD);
private static final int HTTP_PORT = 8080;
private static final int OUTSIDE_PORT = 30235;
- public static final String HEALTHCHECK_URL = "/healthcheck";
+ private static final String HEALTHCHECK_URL = "/healthcheck";
@Mock
private Logger log;
assertTrue(isAuthorized);
}
- @Test
- public void shouldFailDueToEmptyBasicAuthorizationHeader() throws IOException {
- // given
- final HttpServletRequest request = createEmptyRequest();
-
- when(settings.authMethod()).thenReturn(AuthMethodType.BASIC_AUTH.value());
- when(response.getWriter()).thenReturn(writer);
-
- // when
- final boolean isAuthorized = sut.preHandle(request, response, obj);
-
-
- // then
- assertFalse(isAuthorized);
-
- verify(response).setStatus(HttpStatus.UNAUTHORIZED.value());
- verify(writer).write(ApiException.UNAUTHORIZED_USER.toJSON().toString());
- }
-
- @Test
- public void shouldFailDueToBasicAuthenticationUserMissingFromSettings() throws IOException {
- // given
- final HttpServletRequest request = createRequestWithAuthorizationHeader();
-
- when(settings.authMethod()).thenReturn(AuthMethodType.BASIC_AUTH.value());
- when(response.getWriter()).thenReturn(writer);
-
- // when
- final boolean isAuthorized = sut.preHandle(request, response, obj);
-
- // then
- assertFalse(isAuthorized);
-
- verify(response).setStatus(HttpStatus.UNAUTHORIZED.value());
- verify(writer).write(ApiException.UNAUTHORIZED_USER.toJSON().toString());
- }
-
- @Test
- public void shouldSucceed() throws IOException {
- // given
- final HttpServletRequest request = createRequestWithAuthorizationHeader();
- when(settings.authMethod()).thenReturn(AuthMethodType.BASIC_AUTH.value());
- when(settings.validAuthorizationCredentials()).thenReturn(
- HashMap.of(USERNAME, "$2a$10$BsZkEynNm/93wbAeeZuxJeu6IHRyQl4XReqDg2BtYOFDhUsz20.3G"));
- when(response.getWriter()).thenReturn(writer);
-
- // when
- final boolean isAuthorized = sut.preHandle(request, response, obj);
-
- // then
- assertTrue(isAuthorized);
- }
-
- @Test
- public void shouldFailDueToInvalidBasicAuthorizationHeaderValue() throws IOException {
- // given
- final HttpServletRequest request =
- MockMvcRequestBuilders
- .post("")
- .header(HttpHeaders.AUTHORIZATION, "FooBar")
- .buildRequest(null);
-
- when(settings.authMethod()).thenReturn(AuthMethodType.BASIC_AUTH.value());
- when(settings.validAuthorizationCredentials()).thenReturn(CREDENTIALS);
- when(response.getWriter()).thenReturn(writer);
-
- // when
- final boolean isAuthorized = sut.preHandle(request, response, obj);
-
- // then
- assertFalse(isAuthorized);
-
- verify(response).setStatus(HttpStatus.UNAUTHORIZED.value());
- verify(writer).write(ApiException.UNAUTHORIZED_USER.toJSON().toString());
- }
-
@Test
public void shouldSucceedForHealthcheckOnHealthcheckPortWhenRequestFromInsideCluster() throws IOException {
// given
.buildRequest(null);
}
- private HttpServletRequest createRequestWithAuthorizationHeader() {
- return SecurityMockMvcRequestPostProcessors
- .httpBasic(USERNAME, PASSWORD)
- .postProcessRequest(
- MockMvcRequestBuilders
- .post("")
- .buildRequest(null));
- }
-
private HttpServletRequest createRequestWithPorts(int localPort, int serverPort, String urlTemplate) {
MockHttpServletRequest healthcheckRequest = MockMvcRequestBuilders
.get(urlTemplate)
healthcheckRequest.setServerPort(serverPort);
return healthcheckRequest;
}
-}
+}
\ No newline at end of file
major=1
minor=5
-patch=1
+patch=2
base_version=${major}.${minor}.${patch}
release_version=${base_version}
snapshot_version=${base_version}-SNAPSHOT
Code Review / dcaegen2 / collectors / ves.git / commitdiff