auth/auth-batch/src/main/java/org/onap/aaf/auth/reports/Expiring.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.reports;
  23
  24 import java.io.File;
  25 import java.io.FileNotFoundException;
  26 import java.io.IOException;
  27 import java.security.cert.Certificate;
  28 import java.security.cert.CertificateException;
  29 import java.security.cert.X509Certificate;
  30 import java.util.ArrayList;
  31 import java.util.Date;
  32 import java.util.GregorianCalendar;
  33 import java.util.HashSet;
  34 import java.util.List;
  35 import java.util.Map;
  36 import java.util.Set;
  37 import java.util.TreeMap;
  38
  39 import org.onap.aaf.auth.Batch;
  40 import org.onap.aaf.auth.dao.cass.CredDAO;
  41 import org.onap.aaf.auth.env.AuthzTrans;
  42 import org.onap.aaf.auth.helpers.Cred;
  43 import org.onap.aaf.auth.helpers.Cred.Instance;
  44 import org.onap.aaf.auth.helpers.UserRole;
  45 import org.onap.aaf.auth.helpers.Visitor;
  46 import org.onap.aaf.auth.helpers.X509;
  47 import org.onap.aaf.auth.org.OrganizationException;
  48 import org.onap.aaf.cadi.configure.Factory;
  49 import org.onap.aaf.cadi.util.CSV;
  50 import org.onap.aaf.cadi.util.CSV.Writer;
  51 import org.onap.aaf.misc.env.APIException;
  52 import org.onap.aaf.misc.env.Env;
  53 import org.onap.aaf.misc.env.TimeTaken;
  54 import org.onap.aaf.misc.env.util.Chrono;
  55
  56
  57 public class Expiring extends Batch {
  58
  59     private int minOwners;
  60         private ArrayList<Writer> writerList;
  61         private File logDir;
  62         private Date now;
  63         private Date twoWeeksPast;
  64         private Writer twoWeeksPastCSV;
  65         private Date twoWeeksAway;
  66         private Writer twoWeeksAwayCSV;
  67         private Date oneMonthAway;
  68         private Writer oneMonthAwayCSV;
  69         private Date twoMonthsAway;
  70         private Writer twoMonthsAwayCSV;
  71
  72         public Expiring(AuthzTrans trans) throws APIException, IOException, OrganizationException {
  73         super(trans.env());
  74         trans.info().log("Starting Connection Process");
  75
  76         TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB);
  77         try {
  78             TimeTaken tt = trans.start("Connect to Cluster", Env.REMOTE);
  79             try {
  80                 session = cluster.connect();
  81             } finally {
  82                 tt.done();
  83             }
  84
  85             // Load Cred.  We don't follow Visitor, because we have to gather up everything into Identity Anyway
  86             Cred.load(trans, session);
  87
  88             minOwners=1;
  89
  90             // Create Intermediate Output
  91             writerList = new ArrayList<CSV.Writer>();
  92             logDir = new File(logDir());
  93             logDir.mkdirs();
  94
  95             GregorianCalendar gc = new GregorianCalendar();
  96             now = gc.getTime();
  97             gc.add(GregorianCalendar.WEEK_OF_MONTH, -2);
  98             twoWeeksPast = gc.getTime();
  99             File file = new File(logDir,"Expired"+Chrono.dateOnlyStamp(now)+".csv");
 100             twoWeeksPastCSV = new CSV(file).writer();
 101             writerList.add(twoWeeksPastCSV);
 102
 103             gc.add(GregorianCalendar.WEEK_OF_MONTH, 2+2);
 104             twoWeeksAway = gc.getTime();
 105             file = new File(logDir,"TwoWeeksAway"+Chrono.dateOnlyStamp(now)+".csv");
 106             twoWeeksAwayCSV = new CSV(file).writer();
 107             writerList.add(twoWeeksAwayCSV);
 108
 109             gc.add(GregorianCalendar.WEEK_OF_MONTH, -2);
 110             gc.add(GregorianCalendar.MONTH, 1);
 111             oneMonthAway = gc.getTime();
 112             file = new File(logDir,"OneMonthAway"+Chrono.dateOnlyStamp(now)+".csv");
 113             oneMonthAwayCSV = new CSV(file).writer();
 114             writerList.add(oneMonthAwayCSV);
 115
 116             gc.add(GregorianCalendar.MONTH, 1);
 117             twoMonthsAway = gc.getTime();
 118             file = new File(logDir,"TwoMonthsAway"+Chrono.dateOnlyStamp(now)+".csv");
 119             twoMonthsAwayCSV = new CSV(file).writer();
 120             writerList.add(twoMonthsAwayCSV);
 121         } finally {
 122             tt0.done();
 123         }
 124     }
 125
 126     @Override
 127     protected void run(AuthzTrans trans) {
 128                 try {
 129                         File file = new File(logDir, "AllOwnersExpired" + Chrono.dateOnlyStamp(now) + ".csv");
 130                         final CSV ownerCSV = new CSV(file);
 131
 132                         Map<String, Set<UserRole>> owners = new TreeMap<String, Set<UserRole>>();
 133                         trans.info().log("Process UserRoles");
 134                         UserRole.load(trans, session, UserRole.v2_0_11, new Visitor<UserRole>() {
 135                                 @Override
 136                                 public void visit(UserRole ur) {
 137                                         // Cannot just delete owners, unless there is at least one left. Process later
 138                                         if ("owner".equals(ur.rname())) {
 139                                                 Set<UserRole> urs = owners.get(ur.role());
 140                                                 if (urs == null) {
 141                                                         urs = new HashSet<UserRole>();
 142                                                         owners.put(ur.role(), urs);
 143                                                 }
 144                                                 urs.add(ur);
 145                                         } else {
 146                                                 writeAnalysis(ur);
 147                                         }
 148                                 }
 149                         });
 150
 151                         // Now Process Owners, one owner Role at a time, ensuring one is left,
 152                         // preferably
 153                         // a good one. If so, process the others as normal. Otherwise, write
 154                         // ExpiredOwners
 155                         // report
 156                         if (!owners.values().isEmpty()) {
 157                                 // Lazy Create file
 158                                 CSV.Writer expOwner = null;
 159                                 try {
 160                                         for (Set<UserRole> sur : owners.values()) {
 161                                                 int goodOwners = 0;
 162                                                 for (UserRole ur : sur) {
 163                                                         if (ur.expires().after(now)) {
 164                                                                 ++goodOwners;
 165                                                         }
 166                                                 }
 167
 168                                                 for (UserRole ur : sur) {
 169                                                         if (goodOwners >= minOwners) {
 170                                                                 writeAnalysis(ur);
 171                                                         } else {
 172                                                                 if (expOwner == null) {
 173                                                                         expOwner = ownerCSV.writer();
 174                                                                 }
 175                                                                 expOwner.row(ur.role(), ur.user(), ur.expires());
 176                                                         }
 177                                                 }
 178                                         }
 179                                 } finally {
 180                                         expOwner.close();
 181                                 }
 182                         }
 183
 184                         trans.info().log("Checking for Expired Credentials");
 185                         for (Cred cred : Cred.data.values()) {
 186                         List<Instance> linst = cred.instances;
 187                         if(linst!=null) {
 188                                 Instance lastBath = null;
 189                                 for(Instance inst : linst) {
 190                                         if(inst.expires.before(twoWeeksPast)) {
 191                                                 cred.row(twoWeeksPastCSV,inst);
 192                                         } else if(inst.expires.after(now)){
 193                                                 if (inst.type == CredDAO.BASIC_AUTH || inst.type == CredDAO.BASIC_AUTH_SHA256) {
 194                                                         if(lastBath==null || lastBath.expires.before(inst.expires)) {
 195                                                                 lastBath = inst;
 196                                                         }
 197                                                 } else if(inst.type==CredDAO.CERT_SHA256_RSA) {
 198                                                         writeAnalysis(cred, inst);
 199                                                 }
 200                                         }
 201                                 }
 202                                 writeAnalysis(cred, lastBath);
 203                         }
 204                         }
 205
 206                         trans.info().log("Checking for Expired X509s");
 207                         X509.load(trans, session, new Visitor<X509>() {
 208                                 @Override
 209                                 public void visit(X509 x509) {
 210                                         try {
 211                                                 for(Certificate cert : Factory.toX509Certificate(x509.x509)) {
 212                                                         writeAnalysis(x509, (X509Certificate)cert);
 213                                                 }
 214                                         } catch (CertificateException | IOException e) {
 215                                                 trans.error().log(e, "Error Decrypting X509");
 216                                         }
 217
 218                                 }
 219                         });
 220                 } catch (FileNotFoundException e) {
 221                         trans.info().log(e);
 222                 }
 223         }
 224
 225
 226         protected void writeAnalysis(UserRole ur) {
 227         if(ur.expires().before(twoWeeksPast)) {
 228                 ur.row(twoWeeksPastCSV);
 229                 } else {
 230                         if(ur.expires().after(now) && ur.expires().before(twoWeeksAway)) {
 231                         ur.row(twoWeeksAwayCSV);
 232                         } else {
 233                                 if(ur.expires().before(oneMonthAway)) {
 234                                 ur.row(oneMonthAwayCSV);
 235                                 } else {
 236                                         if(ur.expires().before(twoMonthsAway)) {
 237                                         ur.row(twoMonthsAwayCSV);
 238                                         }
 239                                 }
 240                         }
 241                 }
 242         }
 243
 244     protected void writeAnalysis(Cred cred, Instance inst) {
 245         if(inst!=null) {
 246                         if(inst.expires.after(now) && inst.expires.before(twoWeeksAway)) {
 247                         cred.row(twoWeeksAwayCSV, inst);
 248                         } else {
 249                                 if(inst.expires.before(oneMonthAway)) {
 250                                 cred.row(oneMonthAwayCSV, inst);
 251                                 } else {
 252                                         if(inst.expires.before(twoMonthsAway)) {
 253                                         cred.row(twoMonthsAwayCSV, inst);
 254                                         }
 255                                 }
 256                         }
 257                 }
 258         }
 259
 260     protected void writeAnalysis(X509 x509, X509Certificate x509Cert) throws IOException {
 261         if(x509Cert!=null) {
 262                 if(twoWeeksPast.after(x509Cert.getNotAfter())) {
 263                                 x509.row(twoWeeksPastCSV,x509Cert);
 264                         }
 265         }
 266         }
 267
 268         @Override
 269     protected void _close(AuthzTrans trans) {
 270         session.close();
 271         for(CSV.Writer cw : writerList) {
 272                 cw.close();
 273         }
 274     }
 275
 276 }