From: ToineSiebelink Date: Wed, 16 Apr 2025 12:47:09 +0000 (+0100) Subject: Remove Basic Authentication References X-Git-Tag: 3.6.3~38 X-Git-Url: https://gerrit.onap.org/r/gitweb?a=commitdiff_plain;h=5ed5c84a47301755d078b7b10ed99cba3861d2de;p=cps.git Remove Basic Authentication References - Remove whole ‘security’ section from application.yml file(s) also in testware - Remove whole ‘security’ section from open api yml file(s) except Policy Executor - Remove whole ‘component.securitySchemes’ section from open api yml files - Remove references to security.auth.username from xml config files - Removed cps authentication details from Docker compose and readme files (tested) - Removed authentication groovy test rom cps-application - Side note: cps-application added test, coverage increased to 100% - Updated Docker-Compose (CSIT & K6) to latest version - Minor csit script updates to help troubleshooting - Removed auth header from ALL csit tests files Issue-ID: CPS-2600 Change-Id: Ie1cf02461943f4e43029a3dbfaef052e347a4d4d Signed-off-by: ToineSiebelink --- diff --git a/cps-application/pom.xml b/cps-application/pom.xml index eab39a0f44..76a2da95d3 100644 --- a/cps-application/pom.xml +++ b/cps-application/pom.xml @@ -3,7 +3,7 @@ ============LICENSE_START======================================================= Copyright (c) 2021 Pantheon.tech. Modifications Copyright (C) 2021 Bell Canada. - Modifications Copyright (C) 2021-2024 Nordix Foundation + Modifications Copyright (C) 2021-2025 OpenInfra Foundation Europe. All rights reserved. Modifications Copyright (C) 2022 Deutsche Telekom AG ================================================================================ Licensed under the Apache License, Version 2.0 (the "License"); @@ -37,7 +37,6 @@ org.onap.cps.Application yyyyMMdd'T'HHmmss'Z' - 0.68 ${docker.pull.registry}/onap/integration-java17:12.0.0 ${project.version}-${maven.build.timestamp} diff --git a/cps-application/src/main/resources/application.yml b/cps-application/src/main/resources/application.yml index c934b47cdd..26cc9e034a 100644 --- a/cps-application/src/main/resources/application.yml +++ b/cps-application/src/main/resources/application.yml @@ -143,13 +143,6 @@ springdoc: - name: cps-ncmp-inventory url: /api-docs/cps-ncmp/openapi-inventory.yaml -security: - # comma-separated uri patterns which do not require authorization - permit-uri: /actuator/**,/swagger-ui.html,/swagger-ui/**,/swagger-resources/**,/api-docs/**,/v3/api-docs/** - auth: - username: ${CPS_USERNAME:cpsuser} - password: ${CPS_PASSWORD:cpsr0cks!} - cps: monitoring: micrometer-jvm-extras: false diff --git a/cps-application/src/test/groovy/org/onap/cps/ApplicationSpec.groovy b/cps-application/src/test/groovy/org/onap/cps/ApplicationSpec.groovy new file mode 100644 index 0000000000..3ad5fadfd3 --- /dev/null +++ b/cps-application/src/test/groovy/org/onap/cps/ApplicationSpec.groovy @@ -0,0 +1,34 @@ +/* + * ============LICENSE_START======================================================= + * Copyright (C) 2025 OpenInfra Foundation Europe. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + * ============LICENSE_END========================================================= + */ + +package org.onap.cps + + +import spock.lang.Specification + +class ApplicationSpec extends Specification { + + def 'Starting CPS application.'() { + when: 'start the application' + Application.main() + then: 'no exception is thrown' + noExceptionThrown() + } + +} diff --git a/cps-application/src/test/groovy/org/onap/cps/rest/controller/ControllerSecuritySpec.groovy b/cps-application/src/test/groovy/org/onap/cps/rest/controller/ControllerSecuritySpec.groovy deleted file mode 100755 index b86f824888..0000000000 --- a/cps-application/src/test/groovy/org/onap/cps/rest/controller/ControllerSecuritySpec.groovy +++ /dev/null @@ -1,66 +0,0 @@ -/* - * ============LICENSE_START======================================================= - * Copyright (C) 2020 Pantheon.tech - * Modifications Copyright (C) 2023 Nordix Foundation - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * SPDX-License-Identifier: Apache-2.0 - * ============LICENSE_END========================================================= - */ - -package org.onap.cps.rest.controller - -import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get - -import org.springframework.beans.factory.annotation.Autowired -import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest -import org.springframework.http.HttpStatus -import org.springframework.test.web.servlet.MockMvc -import spock.lang.Ignore -import spock.lang.Specification - -@WebMvcTest(TestController) -class ControllerSecuritySpec extends Specification { - - @Autowired - MockMvc mvc - - def testEndpoint = '/test' - - def 'Get request with authentication'() { - when: 'request is sent with authentication' - def response = mvc.perform( - get(testEndpoint).header("Authorization", 'Basic Y3BzdXNlcjpjcHNyMGNrcyE=') - ).andReturn().response - then: 'HTTP OK status code is returned' - assert response.status == HttpStatus.OK.value() - } - - @Ignore // CPS-2126 - def 'Get request without authentication is not authorized'() { - when: 'request is sent without authentication' - def response = mvc.perform(get(testEndpoint)).andReturn().response - then: 'HTTP Unauthorized status code is returned' - assert response.status == HttpStatus.UNAUTHORIZED.value() - } - - @Ignore // CPS-2126 - def 'Get request with invalid authentication is not authorized'() { - when: 'request is sent with invalid authentication' - def response = mvc.perform( - get(testEndpoint).header("Authorization", 'Basic invalid auth') - ).andReturn().response - then: 'HTTP Unauthorized status code is returned' - assert response.status == HttpStatus.UNAUTHORIZED.value() - } -} diff --git a/cps-application/src/test/resources/application.yml b/cps-application/src/test/resources/application.yml index 69e4febcff..e20aa0c4ed 100644 --- a/cps-application/src/test/resources/application.yml +++ b/cps-application/src/test/resources/application.yml @@ -1,11 +1,12 @@ -# ============LICENSE_START======================================================= -# Copyright (C) 2021 Pantheon.tech -# ================================================================================ -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at +# ============LICENSE_START======================================================= +# Copyright (C) 2021-2025 OpenInfra Foundation Europe. All rights reserved. +# ================================================================================ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 +# # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -15,7 +16,242 @@ # SPDX-License-Identifier: Apache-2.0 # ============LICENSE_END========================================================= -security: - auth: - username: cpsuser - password: cpsr0cks! +# This is a full copy of the real application.yml except that liquibase.enabled is set to false! +# This is needed te be able to test Application.main () method (coverage and context loading test). +# Cannot use a custom profile. That would require the test to be a springboot test which is even harder to achieve + +rest: + api: + cps-base-path: /cps/api + ncmp-base-path: /ncmp + ncmp-inventory-base-path: /ncmpInventory + +spring: + main: + banner-mode: "off" + application: + name: "cps-application" + jpa: + show-sql: false + ddl-auto: create + open-in-view: false + properties: + hibernate.enable_lazy_load_no_trans: true + hibernate.dialect: org.hibernate.dialect.PostgreSQLDialect + # Please ensure these values match those used in integration-test/src/test/resources/application.yml + hibernate.id.new_generator_mappings: true + hibernate.jdbc.batch_size: 100 + + datasource: + url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/cpsdb + username: ${DB_USERNAME} + password: ${DB_PASSWORD} + driverClassName: org.postgresql.Driver + hikari: + minimumIdle: 5 + maximumPoolSize: 80 + idleTimeout: 60000 + connectionTimeout: 30000 + leakDetectionThreshold: 30000 + pool-name: CpsDatabasePool + + cache: + type: caffeine + cache-names: yangSchema + caffeine: + spec: maximumSize=10000,expireAfterAccess=10m + + liquibase: + enabled: false + + servlet: + multipart: + enabled: true + max-file-size: 100MB + max-request-size: 100MB + + kafka: + bootstrap-servers: ${KAFKA_BOOTSTRAP_SERVER:localhost:9092} + security: + protocol: PLAINTEXT + producer: + value-serializer: io.cloudevents.kafka.CloudEventSerializer + client-id: cps-core + consumer: + group-id: ${NCMP_CONSUMER_GROUP_ID:ncmp-group} + key-deserializer: org.springframework.kafka.support.serializer.ErrorHandlingDeserializer + value-deserializer: org.springframework.kafka.support.serializer.ErrorHandlingDeserializer + properties: + spring.deserializer.key.delegate.class: org.apache.kafka.common.serialization.StringDeserializer + spring.deserializer.value.delegate.class: io.cloudevents.kafka.CloudEventDeserializer + spring.json.use.type.headers: false + + jackson: + default-property-inclusion: NON_NULL + serialization: + FAIL_ON_EMPTY_BEANS: false + sql: + init: + mode: ALWAYS +app: + ncmp: + async-m2m: + topic: ${NCMP_ASYNC_M2M_TOPIC:ncmp-async-m2m} + avc: + cm-subscription-ncmp-in: ${CM_SUBSCRIPTION_NCMP_IN_TOPIC:subscription} + cm-subscription-dmi-in: ${CM_SUBSCRIPTION_DMI_IN_TOPIC:ncmp-dmi-cm-avc-subscription} + cm-subscription-dmi-out: ${CM_SUBSCRIPTION_DMI_OUT_TOPIC:dmi-ncmp-cm-avc-subscription} + cm-subscription-ncmp-out: ${CM_SUBSCRIPTION_NCMP_OUT_TOPIC:subscription-response} + cm-events-topic: ${NCMP_CM_EVENTS_TOPIC:cm-events} + inventory-events-topic: ncmp-inventory-events + lcm: + events: + topic: ${LCM_EVENTS_TOPIC:ncmp-events} + dmi: + cm-events: + topic: ${DMI_CM_EVENTS_TOPIC:dmi-cm-events} + device-heartbeat: + topic: ${DMI_DEVICE_HEARTBEAT_TOPIC:dmi-device-heartbeat} + cps: + data-updated: + change-event-notifications-enabled: ${CPS_CHANGE_EVENT_NOTIFICATIONS_ENABLED:false} + topic: ${CPS_CHANGE_EVENT_TOPIC:cps-data-updated-events} + +notification: + enabled: true + async: + executor: + core-pool-size: 2 + max-pool-size: 10 + queue-capacity: 500 + wait-for-tasks-to-complete-on-shutdown: true + thread-name-prefix: Async- + time-out-value-in-ms: 60000 + +springdoc: + swagger-ui: + disable-swagger-default-url: true + urlsPrimaryName: cps-core + urls: + - name: cps-core + url: /api-docs/cps-core/openapi.yaml + - name: cps-ncmp + url: /api-docs/cps-ncmp/openapi.yaml + - name: cps-ncmp-inventory + url: /api-docs/cps-ncmp/openapi-inventory.yaml + +cps: + monitoring: + micrometer-jvm-extras: false + tracing: + sampler: + jaeger_remote: + endpoint: ${ONAP_OTEL_SAMPLER_JAEGER_REMOTE_ENDPOINT:http://onap-otel-collector:14250} + exporter: + endpoint: ${ONAP_OTEL_EXPORTER_ENDPOINT:http://onap-otel-collector:4317} + protocol: ${ONAP_OTEL_EXPORTER_PROTOCOL:grpc} + enabled: ${ONAP_TRACING_ENABLED:false} + excluded-observation-names: ${ONAP_EXCLUDED_OBSERVATION_NAMES:tasks.scheduled.execution} + +# Actuator +management: + tracing: + propagation: + produce: ${ONAP_PROPAGATOR_PRODUCE:[W3C]} + sampling: + probability: 1.0 + endpoints: + web: + exposure: + include: info,health,loggers,prometheus,metrics,heapdump,threaddump + endpoint: + health: + show-details: always + # kubernetes probes: liveness and readiness + probes: + enabled: true + + info: + git: + enabled: true + mode: full + +logging: + format: json + level: + org: + springframework: INFO + onap: + cps: INFO +ncmp: + policy-executor: + enabled: ${POLICY_SERVICE_ENABLED:false} + defaultDecision: ${POLICY_SERVICE_DEFAULT_DECISION:"allow"} + server: + address: ${POLICY_SERVICE_URL:http://policy-executor-stub} + port: ${POLICY_SERVICE_PORT:8093} + httpclient: + all-services: + maximumInMemorySizeInMegabytes: 16 + maximumConnectionsTotal: 100 + pendingAcquireMaxCount: 50 + connectionTimeoutInSeconds: 30 + readTimeoutInSeconds: 30 + writeTimeoutInSeconds: 30 + responseTimeoutInSeconds: 60 + dmi: + httpclient: + data-services: + maximumInMemorySizeInMegabytes: 16 + maximumConnectionsTotal: 100 + pendingAcquireMaxCount: 50 + connectionTimeoutInSeconds: 30 + readTimeoutInSeconds: 30 + writeTimeoutInSeconds: 30 + responseTimeoutInSeconds: 60 + model-services: + maximumInMemorySizeInMegabytes: 16 + maximumConnectionsTotal: 100 + pendingAcquireMaxCount: 50 + connectionTimeoutInSeconds: 30 + readTimeoutInSeconds: 30 + writeTimeoutInSeconds: 30 + responseTimeoutInSeconds: 60 + auth: + username: ${DMI_USERNAME:cpsuser} + password: ${DMI_PASSWORD:cpsr0cks!} + enabled: ${DMI_AUTH_ENABLED:true} + api: + base-path: dmi + + timers: + advised-modules-sync: + initial-delay-ms: 40000 + sleep-time-ms: 5000 + cm-handle-data-sync: + initial-delay-ms: 40000 + sleep-time-ms: 30000 + subscription-forwarding: + dmi-response-timeout-ms: 30000 + model-loader: + retry-time-ms: 1000 + trust-level: + dmi-availability-watchdog-ms: 30000 + + model-loader: + maximum-attempt-count: 20 + +# Custom Hazelcast Config. +hazelcast: + cluster-name: ${CPS_NCMP_CACHES_CLUSTER_NAME:"cps-and-ncmp-common-cache-cluster"} + instance-config-name: ${CPS_NCMP_INSTANCE_CONFIG_NAME:"cps-and-ncmp-hazelcast-instance-config"} + mode: + kubernetes: + enabled: ${HAZELCAST_MODE_KUBERNETES_ENABLED:false} + service-name: ${CPS_NCMP_SERVICE_NAME:"cps-and-ncmp-service"} + +otel: + exporter: + otlp: + traces: + protocol: ${ONAP_OTEL_EXPORTER_OTLP_TRACES_PROTOCOL:grpc} diff --git a/cps-ncmp-rest/docs/openapi/openapi-inventory.yml b/cps-ncmp-rest/docs/openapi/openapi-inventory.yml index cd497e78f1..7658075043 100755 --- a/cps-ncmp-rest/docs/openapi/openapi-inventory.yml +++ b/cps-ncmp-rest/docs/openapi/openapi-inventory.yml @@ -24,11 +24,6 @@ info: version: "3.6.2" servers: - url: /ncmpInventory -components: - securitySchemes: - basicAuth: - type: http - scheme: basic paths: /v1/ch: $ref: 'ncmp-inventory.yml#/updateDmiRegistration' @@ -38,6 +33,3 @@ paths: /v1/ch/searches: $ref: 'ncmp-inventory.yml#/searchCmHandleIds' - -security: - - basicAuth: [] diff --git a/cps-ncmp-rest/docs/openapi/openapi.yml b/cps-ncmp-rest/docs/openapi/openapi.yml index 156aa6bf9e..1f69cc681f 100755 --- a/cps-ncmp-rest/docs/openapi/openapi.yml +++ b/cps-ncmp-rest/docs/openapi/openapi.yml @@ -25,11 +25,6 @@ info: version: "3.6.2" servers: - url: /ncmp -components: - securitySchemes: - basicAuth: - type: http - scheme: basic paths: /v1/ch/{cm-handle}/data/ds/{datastore-name}: $ref: 'ncmp.yml#/resourceDataForCmHandle' @@ -63,5 +58,3 @@ paths: /v1/ch/{cm-handle}/data-sync: $ref: 'ncmp.yml#/setDataSyncEnabledFlag' -security: - - basicAuth: [] diff --git a/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/data/DmiDataOperations.java b/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/data/DmiDataOperations.java index 0e9db3d17b..ed67be64d5 100644 --- a/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/data/DmiDataOperations.java +++ b/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/data/DmiDataOperations.java @@ -125,7 +125,7 @@ public class DmiDataOperations { PASSTHROUGH_OPERATIONAL.getDatastoreName(), yangModelCmHandle, "/", null, null); return dmiRestClient.synchronousPostOperationWithJsonData(DATA, urlTemplateParameters, jsonRequestBody, READ, - null); + DmiRestClient.NO_AUTHORIZATION); } /** diff --git a/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/dmi/DmiRestClient.java b/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/dmi/DmiRestClient.java index ccda476081..060051eca7 100644 --- a/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/dmi/DmiRestClient.java +++ b/cps-ncmp-service/src/main/java/org/onap/cps/ncmp/impl/dmi/DmiRestClient.java @@ -1,6 +1,6 @@ /* * ============LICENSE_START======================================================= - * Copyright (C) 2021-2025 Nordix Foundation + * Copyright (C) 2021-2025 OpenInfra Foundation Europe. All rights reserved. * Modifications Copyright (C) 2022 Bell Canada * ================================================================================ * Licensed under the Apache License, Version 2.0 (the "License"); @@ -53,8 +53,9 @@ import reactor.core.publisher.Mono; @Slf4j public class DmiRestClient { + public static final String NO_AUTHORIZATION = null; + private static final String NOT_SPECIFIED = ""; - private static final String NO_AUTHORIZATION = null; private final DmiProperties dmiProperties; private final JsonObjectMapper jsonObjectMapper; diff --git a/cps-rest/docs/openapi/openapi.yml b/cps-rest/docs/openapi/openapi.yml index 3aeee4a118..747531b30e 100644 --- a/cps-rest/docs/openapi/openapi.yml +++ b/cps-rest/docs/openapi/openapi.yml @@ -34,11 +34,6 @@ info: servers: - url: /cps/api -components: - securitySchemes: - basicAuth: - type: http - scheme: basic tags: - name: cps-admin description: cps Admin @@ -119,6 +114,3 @@ paths: /v2/notification-subscription: $ref: 'cpsAdminV2.yml#/notificationSubscription' - -security: - - basicAuth: [] diff --git a/cps-service/src/main/resources/logback-spring.xml b/cps-service/src/main/resources/logback-spring.xml index 03076023b3..6f7ba4d0fb 100644 --- a/cps-service/src/main/resources/logback-spring.xml +++ b/cps-service/src/main/resources/logback-spring.xml @@ -1,6 +1,6 @@