auth/auth-batch/src/main/java/org/onap/aaf/auth/reports/Expiring.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.reports;
  23
  24 import java.io.File;
  25 import java.io.FileNotFoundException;
  26 import java.io.IOException;
  27 import java.security.cert.Certificate;
  28 import java.security.cert.CertificateException;
  29 import java.security.cert.X509Certificate;
  30 import java.util.Date;
  31 import java.util.HashMap;
  32 import java.util.HashSet;
  33 import java.util.List;
  34 import java.util.Map;
  35 import java.util.Set;
  36 import java.util.TreeMap;
  37
  38 import org.onap.aaf.auth.Batch;
  39 import org.onap.aaf.auth.dao.cass.CredDAO;
  40 import org.onap.aaf.auth.env.AuthzTrans;
  41 import org.onap.aaf.auth.helpers.Cred;
  42 import org.onap.aaf.auth.helpers.Cred.Instance;
  43 import org.onap.aaf.auth.helpers.UserRole;
  44 import org.onap.aaf.auth.helpers.Visitor;
  45 import org.onap.aaf.auth.helpers.X509;
  46 import org.onap.aaf.auth.org.ExpireRange;
  47 import org.onap.aaf.auth.org.ExpireRange.Range;
  48 import org.onap.aaf.auth.org.OrganizationException;
  49 import org.onap.aaf.cadi.configure.Factory;
  50 import org.onap.aaf.cadi.util.CSV;
  51 import org.onap.aaf.misc.env.APIException;
  52 import org.onap.aaf.misc.env.Env;
  53 import org.onap.aaf.misc.env.TimeTaken;
  54 import org.onap.aaf.misc.env.util.Chrono;
  55
  56
  57 public class Expiring extends Batch {
  58
  59         private static final String CSV = ".csv";
  60         private static final String INFO = "info";
  61         private static final String EXPIRED_OWNERS = "ExpiredOwners";
  62         private int minOwners;
  63         private Map<String, CSV.Writer> writerList;
  64         private File logDir;
  65         private ExpireRange expireRange;
  66         private Date deleteDate;
  67
  68         public Expiring(AuthzTrans trans) throws APIException, IOException, OrganizationException {
  69         super(trans.env());
  70         trans.info().log("Starting Connection Process");
  71
  72         TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB);
  73         try {
  74             TimeTaken tt = trans.start("Connect to Cluster", Env.REMOTE);
  75             try {
  76                 session = cluster.connect();
  77             } finally {
  78                 tt.done();
  79             }
  80
  81             // Load Cred.  We don't follow Visitor, because we have to gather up everything into Identity Anyway
  82             Cred.load(trans, session);
  83             UserRole.load(trans, session, UserRole.v2_0_11, new UserRole.DataLoadVisitor());
  84
  85             minOwners=1;
  86
  87             // Create Intermediate Output
  88             writerList = new HashMap<>();
  89             logDir = new File(logDir());
  90             logDir.mkdirs();
  91
  92             expireRange = new ExpireRange(trans.env().access());
  93             String sdate = Chrono.dateOnlyStamp(expireRange.now);
  94             for( List<Range> lr : expireRange.ranges.values()) {
  95                 for(Range r : lr ) {
  96                         if(writerList.get(r.name())==null) {
  97                         File file = new File(logDir,r.name() + sdate +CSV);
  98                         CSV csv = new CSV(file);
  99                         CSV.Writer cw = csv.writer(false);
 100                         cw.row(INFO,r.name(),Chrono.dateOnlyStamp(expireRange.now),r.reportingLevel());
 101                         writerList.put(r.name(),cw);
 102                         if("Delete".equals(r.name())) {
 103                                 deleteDate = r.getStart();
 104                         }
 105                         }
 106                 }
 107             }
 108
 109         } finally {
 110             tt0.done();
 111         }
 112     }
 113
 114     @Override
 115     protected void run(AuthzTrans trans) {
 116                 try {
 117                         File file = new File(logDir, EXPIRED_OWNERS + Chrono.dateOnlyStamp(expireRange.now) + CSV);
 118                         final CSV ownerCSV = new CSV(file);
 119
 120                         Map<String, Set<UserRole>> owners = new TreeMap<String, Set<UserRole>>();
 121                         trans.info().log("Process UserRoles");
 122                         UserRole.load(trans, session, UserRole.v2_0_11, new Visitor<UserRole>() {
 123                                 @Override
 124                                 public void visit(UserRole ur) {
 125                                         // Cannot just delete owners, unless there is at least one left. Process later
 126                                         if ("owner".equals(ur.rname())) {
 127                                                 Set<UserRole> urs = owners.get(ur.role());
 128                                                 if (urs == null) {
 129                                                         urs = new HashSet<UserRole>();
 130                                                         owners.put(ur.role(), urs);
 131                                                 }
 132                                                 urs.add(ur);
 133                                         } else {
 134                                                 writeAnalysis(trans,ur);
 135                                         }
 136                                 }
 137                         });
 138
 139                         // Now Process Owners, one owner Role at a time, ensuring one is left,
 140                         // preferably
 141                         // a good one. If so, process the others as normal. Otherwise, write
 142                         // ExpiredOwners
 143                         // report
 144                         if (!owners.values().isEmpty()) {
 145                                 // Lazy Create file
 146                                 CSV.Writer expOwner = null;
 147                                 try {
 148                                         for (Set<UserRole> sur : owners.values()) {
 149                                                 int goodOwners = 0;
 150                                                 for (UserRole ur : sur) {
 151                                                         if (ur.expires().after(expireRange.now)) {
 152                                                                 ++goodOwners;
 153                                                         }
 154                                                 }
 155
 156                                                 for (UserRole ur : sur) {
 157                                                         if (goodOwners >= minOwners) {
 158                                                                 writeAnalysis(trans, ur);
 159                                                         } else {
 160                                                                 if (expOwner == null) {
 161                                                                         expOwner = ownerCSV.writer();
 162                                                                         expOwner.row(INFO,EXPIRED_OWNERS,Chrono.dateOnlyStamp(expireRange.now),2);
 163                                                                 }
 164                                                                 expOwner.row("owner",ur.role(), ur.user(), Chrono.dateOnlyStamp(ur.expires()));
 165                                                         }
 166                                                 }
 167                                         }
 168                                 } finally {
 169                                         expOwner.close();
 170                                 }
 171                         }
 172
 173                         trans.info().log("Checking for Expired Credentials");
 174
 175                         for (Cred cred : Cred.data.values()) {
 176                         List<Instance> linst = cred.instances;
 177                         if(linst!=null) {
 178                                 Instance lastBath = null;
 179                                 for(Instance inst : linst) {
 180                                         // Special Behavior: only eval the LAST Instance
 181                                         if (inst.type == CredDAO.BASIC_AUTH || inst.type == CredDAO.BASIC_AUTH_SHA256) {
 182                                                 if(deleteDate!=null && inst.expires.before(deleteDate)) {
 183                                                         writeAnalysis(trans, cred, inst); // will go to Delete
 184                                                 } else if(lastBath==null || lastBath.expires.before(inst.expires)) {
 185                                                         lastBath = inst;
 186                                                 }
 187                                         } else {
 188                                                 writeAnalysis(trans, cred, inst);
 189                                         }
 190                                 }
 191                                 if(lastBath!=null) {
 192                                         writeAnalysis(trans, cred, lastBath);
 193                                 }
 194                         }
 195                         }
 196
 197                         trans.info().log("Checking for Expired X509s");
 198                         X509.load(trans, session, new Visitor<X509>() {
 199                                 @Override
 200                                 public void visit(X509 x509) {
 201                                         try {
 202                                                 for(Certificate cert : Factory.toX509Certificate(x509.x509)) {
 203                                                         writeAnalysis(trans, x509, (X509Certificate)cert);
 204                                                 }
 205                                         } catch (CertificateException | IOException e) {
 206                                                 trans.error().log(e, "Error Decrypting X509");
 207                                         }
 208
 209                                 }
 210                         });
 211                 } catch (FileNotFoundException e) {
 212                         trans.info().log(e);
 213                 }
 214         }
 215
 216
 217         private void writeAnalysis(AuthzTrans trans, UserRole ur) {
 218                 Range r = expireRange.getRange("ur", ur.expires());
 219                 if(r!=null) {
 220                         CSV.Writer cw = writerList.get(r.name());
 221                         if(cw!=null) {
 222                                 ur.row(cw);
 223                         }
 224                 }
 225         }
 226
 227     private void writeAnalysis(AuthzTrans trans, Cred cred, Instance inst) {
 228         if(cred!=null && inst!=null) {
 229                         Range r = expireRange.getRange("cred", inst.expires);
 230                         if(r!=null) {
 231                                 CSV.Writer cw = writerList.get(r.name());
 232                                 if(cw!=null) {
 233                                         cred.row(cw,inst);
 234                                 }
 235                         }
 236         }
 237         }
 238
 239     private void writeAnalysis(AuthzTrans trans, X509 x509, X509Certificate x509Cert) throws IOException {
 240                 Range r = expireRange.getRange("x509", x509Cert.getNotAfter());
 241                 if(r!=null) {
 242                         CSV.Writer cw = writerList.get(r.name());
 243                         if(cw!=null) {
 244                                 x509.row(cw,x509Cert);
 245                         }
 246                 }
 247         }
 248
 249     /*
 250     private String[] contacts(final AuthzTrans trans, final String ns, final int levels) {
 251         List<UserRole> owners = UserRole.getByRole().get(ns+".owner");
 252         List<UserRole> current = new ArrayList<>();
 253         for(UserRole ur : owners) {
 254                 if(expireRange.now.before(ur.expires())) {
 255                         current.add(ur);
 256                 }
 257         }
 258         if(current.isEmpty()) {
 259                 trans.warn().log(ns,"has no current owners");
 260                 current = owners;
 261         }
 262
 263         List<String> email = new ArrayList<>();
 264         for(UserRole ur : current) {
 265                 Identity id;
 266                 int i=0;
 267                 boolean go = true;
 268                 try {
 269                         id = org.getIdentity(trans, ur.user());
 270                         do {
 271                                 if(id!=null) {
 272                                                 email.add(id.email());
 273                                                 if(i<levels) {
 274                                                         id = id.responsibleTo();
 275                                                 } else {
 276                                                         go = false;
 277                                                 }
 278                                 } else {
 279                                         go = false;
 280                                 }
 281                         } while(go);
 282                         } catch (OrganizationException e) {
 283                                 trans.error().log(e);
 284                         }
 285         }
 286
 287         return email.toArray(new String[email.size()]);
 288     }
 289 */
 290
 291         @Override
 292     protected void _close(AuthzTrans trans) {
 293         session.close();
 294         for(CSV.Writer cw : writerList.values()) {
 295                 cw.close();
 296         }
 297     }
 298
 299 }