auth/auth-batch/src/main/java/org/onap/aaf/auth/update/Expiring.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.update;
  23
  24 import java.io.BufferedReader;
  25 import java.io.File;
  26 import java.io.FileOutputStream;
  27 import java.io.FileReader;
  28 import java.io.IOException;
  29 import java.io.PrintStream;
  30 import java.util.Date;
  31 import java.util.GregorianCalendar;
  32 import java.util.List;
  33 import java.util.UUID;
  34
  35 import org.onap.aaf.auth.Batch;
  36 import org.onap.aaf.auth.BatchPrincipal;
  37 import org.onap.aaf.auth.actions.Action;
  38 import org.onap.aaf.auth.actions.ActionDAO;
  39 import org.onap.aaf.auth.actions.CacheTouch;
  40 import org.onap.aaf.auth.actions.CredDelete;
  41 import org.onap.aaf.auth.actions.CredPrint;
  42 import org.onap.aaf.auth.actions.Email;
  43 import org.onap.aaf.auth.actions.Message;
  44 import org.onap.aaf.auth.actions.URDelete;
  45 import org.onap.aaf.auth.actions.URFutureApprove;
  46 import org.onap.aaf.auth.actions.URFutureApproveExec;
  47 import org.onap.aaf.auth.actions.URPrint;
  48 import org.onap.aaf.auth.dao.cass.ApprovalDAO;
  49 import org.onap.aaf.auth.dao.cass.CredDAO;
  50 import org.onap.aaf.auth.dao.cass.FutureDAO;
  51 import org.onap.aaf.auth.dao.hl.Function.FUTURE_OP;
  52 import org.onap.aaf.auth.dao.hl.Function.OP_STATUS;
  53 import org.onap.aaf.auth.env.AuthzTrans;
  54 import org.onap.aaf.auth.helpers.Approval;
  55 import org.onap.aaf.auth.helpers.Cred;
  56 import org.onap.aaf.auth.helpers.Future;
  57 import org.onap.aaf.auth.helpers.NS;
  58 import org.onap.aaf.auth.helpers.Role;
  59 import org.onap.aaf.auth.helpers.UserRole;
  60 import org.onap.aaf.auth.helpers.Cred.Instance;
  61 import org.onap.aaf.auth.layer.Result;
  62 import org.onap.aaf.auth.org.OrganizationException;
  63 import org.onap.aaf.auth.org.Organization.Identity;
  64 import org.onap.aaf.misc.env.APIException;
  65 import org.onap.aaf.misc.env.Env;
  66 import org.onap.aaf.misc.env.TimeTaken;
  67 import org.onap.aaf.misc.env.util.Chrono;
  68
  69 public class Expiring extends Batch {
  70     private CredPrint crPrint;
  71     private URFutureApprove urFutureApprove;
  72     private URFutureApproveExec urFutureApproveExec;
  73     private CredDelete crDelete;
  74     private URDelete urDelete;
  75     private final CacheTouch cacheTouch;
  76     private final AuthzTrans noAvg;
  77     private final ApprovalDAO apprDAO;
  78     private final FutureDAO futureDAO;
  79     private final PrintStream urDeleteF,urRecoverF;
  80     private final URPrint urPrint;
  81     private Email email;
  82     private File deletesFile;
  83
  84     public Expiring(AuthzTrans trans) throws APIException, IOException, OrganizationException {
  85         super(trans.env());
  86         trans.info().log("Starting Connection Process");
  87
  88         noAvg = env.newTransNoAvg();
  89         noAvg.setUser(new BatchPrincipal("batch:Expiring"));
  90
  91         TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB);
  92         try {
  93             crPrint = new CredPrint("Expired:");
  94
  95             TimeTaken tt = trans.start("Connect to Cluster with DAOs", Env.REMOTE);
  96             try {
  97                 urFutureApprove = new URFutureApprove(trans, cluster,isDryRun());
  98                 checkOrganizationAcccess(trans, urFutureApprove.question());
  99                 urFutureApproveExec = new URFutureApproveExec(trans, urFutureApprove);
 100                 urPrint = new URPrint("User Roles:");
 101                 crDelete = new CredDelete(trans, urFutureApprove);
 102                 urDelete = new URDelete(trans,urFutureApprove);
 103                 cacheTouch = new CacheTouch(trans, urFutureApprove);
 104
 105                 // Reusing... don't destroy
 106                 apprDAO = urFutureApprove.question().approvalDAO;
 107                 futureDAO = urFutureApprove.question().futureDAO;
 108
 109                 TimeTaken tt2 = trans.start("Connect to Cluster", Env.REMOTE);
 110                 try {
 111                     session = urFutureApprove.getSession(trans);
 112                 } finally {
 113                     tt2.done();
 114                 }
 115             } finally {
 116                 tt.done();
 117             }
 118
 119             File data_dir = new File(env.getProperty("aaf_data_dir"));
 120             if (!data_dir.exists() || !data_dir.canWrite() || !data_dir.canRead()) {
 121                 throw new IOException("Cannot read/write to Data Directory "+ data_dir.getCanonicalPath() + ": EXITING!!!");
 122             }
 123             UserRole.setDeleteStream(
 124                 urDeleteF = new PrintStream(new FileOutputStream(deletesFile = new File(data_dir,"UserRoleDeletes.dat"),false)));
 125             UserRole.setRecoverStream(
 126                 urRecoverF = new PrintStream(new FileOutputStream(new File(data_dir,"UserRoleRecover.dat"),false)));
 127             UserRole.load(trans, session, UserRole.v2_0_11);
 128
 129             Cred.load(trans, session);
 130             NS.load(trans, session,NS.v2_0_11);
 131             Future.load(trans,session,Future.withConstruct);
 132             Approval.load(trans,session,Approval.v2_0_17);
 133             Role.load(trans, session);
 134
 135             email = new Email();
 136             email.subject("AAF Expiring Process Alert (ENV: %s)",batchEnv);
 137             email.preamble("Expiring Process Alert for %s",batchEnv);
 138             email.signature("Sincerely,\nAAF Expiring Batch Process\n");
 139             String address = env.getProperty("ALERT_TO_ADDRESS");
 140             if (address==null) {
 141                 throw new APIException("ALERT_TO_ADDRESS property is required");
 142             }
 143             email.addTo(address);
 144
 145         } catch (OrganizationException e) {
 146             throw new APIException("Error getting valid Organization",e);
 147         } finally {
 148             tt0.done();
 149         }
 150     }
 151
 152     @Override
 153     protected void run(AuthzTrans trans) {
 154         // Setup Date boundaries
 155
 156         final GregorianCalendar gc = new GregorianCalendar();
 157         final Date now = gc.getTime();
 158
 159         gc.add(GregorianCalendar.MONTH, 1);
 160         Date future = gc.getTime();
 161 //        Date earliest = null;
 162
 163         // reset
 164         gc.setTime(now);
 165         gc.add(GregorianCalendar.DAY_OF_MONTH, -7); // save Expired Roles for 7 days.
 166         Date tooLate = gc.getTime();
 167
 168         TimeTaken tt;
 169
 170         // Clean out Approvals UserRoles are fixed up.
 171         String memo;
 172         for (List<Approval> la : Approval.byUser.values()) {
 173             for (Approval a : la ) {
 174                 memo = a.getMemo();
 175                 if (memo!=null && (memo.contains("Re-Approval") || memo.contains("Re-Validate"))) {
 176                         String role = a.getRole();
 177                         if (role!=null) {
 178                         UserRole ur = UserRole.get(a.getUser(), a.getRole());
 179                         Future f=null;
 180                         if (ur!=null) {
 181                             if (ur.expires().after(future)) { // no need for Approval anymore
 182                                 a.delayDelete(noAvg, apprDAO, dryRun, "User Role already Extended");
 183                                 UUID tkt = a.getTicket();
 184                                 if (tkt!=null && Future.data.containsKey(tkt)) {
 185                                     f = Future.data.get(a.getTicket());
 186                                 }
 187                             }
 188                         } else {
 189                             a.delayDelete(noAvg, apprDAO, dryRun, "User Role does not exist");
 190                             UUID tkt = a.getTicket();
 191                             if (tkt !=null && Future.data.containsKey(tkt)) {
 192                                 f = Future.data.get(a.getTicket());
 193                             }
 194                         }
 195                         if (f!=null) {
 196                             f.delayedDelete(noAvg, futureDAO, dryRun, "Approvals removed");
 197                         }
 198                         }
 199                 }
 200             }
 201         }
 202         try {
 203                 trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals");
 204                 Future.resetLocalData();
 205             Approval.resetLocalData();
 206             } catch (Exception t) {
 207                 t.printStackTrace();
 208             }
 209
 210         // Run for Expired Futures
 211         trans.info().log("Checking for Expired Approval/Futures");
 212         tt = trans.start("Delete old Futures", Env.REMOTE);
 213         trans.info().log("### Running Future Execution on ",Future.data.size(), "Items");
 214         // Execute any Futures waiting
 215             for (Future f : Future.data.values()) {
 216                 if (f.memo().contains("Re-Approval") || f.memo().contains("Re-Validate")) {
 217                     List<Approval> la = Approval.byTicket.get(f.id());
 218                     if (la!=null) {
 219                         Result<OP_STATUS> ruf = urFutureApproveExec.exec(noAvg,la,f);
 220                         if (ruf.isOK()) {
 221                             switch(ruf.value) {
 222                                 case P:
 223                                     break;
 224                                 case E:
 225                                 case D:
 226                                 case L:
 227                                     f.delayedDelete(noAvg, futureDAO, dryRun,OP_STATUS.L.desc());
 228                                     Approval.delayDelete(noAvg, apprDAO, dryRun, la,OP_STATUS.L.desc());
 229                                     break;
 230                             }
 231                         }
 232                     }
 233                 }
 234             }
 235             try {
 236                 trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals");
 237                 Future.resetLocalData();
 238             Approval.resetLocalData();
 239             } catch (Exception t) {
 240                 t.printStackTrace();
 241             }
 242
 243
 244         trans.info().log("### Remove Expired on ",Future.data.size(), "Items, or premature ones");
 245         // Remove Expired
 246         String expiredBeforeNow = "Expired before " + tooLate;
 247         String expiredAfterFuture = "Expired after " + future;
 248         try {
 249                 for (Future f : Future.data.values()) {
 250                     if (f.expires().before(tooLate)) {
 251                         f.delayedDelete(noAvg,futureDAO,dryRun, expiredBeforeNow);
 252                         Approval.delayDelete(noAvg, apprDAO, dryRun, Approval.byTicket.get(f.id()), expiredBeforeNow);
 253                     } else if (f.expires().after(future)) {
 254                         f.delayedDelete(noAvg,futureDAO,dryRun, expiredAfterFuture);
 255                         Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), expiredAfterFuture);
 256                     }
 257                 }
 258                 try {
 259                     trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals");
 260                     Future.resetLocalData();
 261                 Approval.resetLocalData();
 262                 } catch (Exception t) {
 263                     t.printStackTrace();
 264                 }
 265         } finally {
 266                 tt.done();
 267         }
 268
 269         trans.info().log("### Checking Approvals valid (",Approval.byApprover.size(),"Items)");
 270         // Make sure users of Approvals are still valid
 271         for (List<Approval> lapp : Approval.byTicket.values()) {
 272                 for (Approval app : lapp) {
 273                     Future f;
 274                     if (app.getTicket()==null) {
 275                         f = null;
 276                     } else {
 277                         f = Future.data.get(app.getTicket());
 278                         if (Future.pendingDelete(f)) {
 279                             f=null;
 280                         }
 281                     }
 282                     String msg;
 283                     if (f!=null && app.getRole()!=null && Role.byName.get(app.getRole())==null) {
 284                         f.delayedDelete(noAvg,futureDAO,dryRun,msg="Role '" + app.getRole() + "' no longer exists");
 285                         Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), msg);
 286                         continue;
 287                     }
 288
 289                     switch(app.getStatus()) {
 290                         case "pending":
 291                             if (f==null) {
 292                             app.delayDelete(noAvg,apprDAO, isDryRun(), "ticketDeleted");
 293                             continue;
 294                             }
 295                             switch(app.getType()) {
 296                                 case "owner":
 297                                 boolean anOwner=false;
 298                                     String approle = app.getRole();
 299                                     if (approle!=null) {
 300                                         Role role = Role.byName.get(approle);
 301                                         if (role==null) {
 302                                         app.delayDelete(noAvg, apprDAO, dryRun, "Role No Longer Exists");
 303                                         continue;
 304                                     } else {
 305                                         // Make sure Owner Role exists
 306                                         String owner = role.ns + ".owner";
 307                                         if (Role.byName.containsKey(owner)) {
 308                                                 List<UserRole> lur = UserRole.getByRole().get(owner);
 309                                                 if (lur != null) {
 310                                                     for (UserRole ur : lur) {
 311                                                         if (ur.user().equals(app.getApprover())) {
 312                                                             anOwner = true;
 313                                                             break;
 314                                                         }
 315                                                     }
 316                                                 }
 317                                         }
 318                                         }
 319                                         if (!anOwner) {
 320                                         app.delayDelete(noAvg, apprDAO, dryRun, "No longer Owner");
 321                                         }
 322
 323                                     }
 324                                     break;
 325                                 case "supervisor":
 326                                 try {
 327                                     Identity identity = org.getIdentity(noAvg, app.getUser());
 328                                     if (identity==null) {
 329                                         if (f!=null) {
 330                                                 f.delayedDelete(noAvg,futureDAO,dryRun,msg = app.getUser() + " is no longer associated with " + org.getName());
 331                                                 Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), msg);
 332                                         }
 333                                     } else {
 334                                         if (!app.getApprover().equals(identity.responsibleTo().fullID())) {
 335                                             if (f!=null) {
 336                                                     f.delayedDelete(noAvg,futureDAO,dryRun,msg = app.getApprover() + " is no longer a Supervisor of " + app.getUser());
 337                                                     Approval.delayDelete(noAvg,apprDAO,dryRun, Approval.byTicket.get(f.id()), msg);
 338                                             }
 339                                         }
 340                                     }
 341                                 } catch (OrganizationException e) {
 342                                     e.printStackTrace();
 343                                 }
 344                                 break;
 345                             }
 346                             break;
 347                     }
 348                 }
 349         }
 350             try {
 351                 trans.info().log("### Removed",Future.sizeForDeletion(),"Future and",Approval.sizeForDeletion(),"Approvals");
 352                 Future.resetLocalData();
 353             Approval.resetLocalData();
 354             } catch (Exception t) {
 355                 t.printStackTrace();
 356             }
 357
 358         int count = 0, deleted=0, delayedURDeletes = 0;
 359
 360         // Run for User Roles
 361         trans.info().log("Checking for Expired User Roles");
 362         try {
 363                 for (UserRole ur : UserRole.getData()) {
 364                     if (org.getIdentity(noAvg, ur.user())==null) {  // if not part of Organization;
 365                         if (isSpecial(ur.user())) {
 366                             trans.info().log(ur.user(),"is not part of organization, but may not be deleted");
 367                         } else {
 368                             ur.delayDelete(noAvg, "Not Part of Organization", dryRun);
 369                             ++deleted;
 370                             ++delayedURDeletes;
 371                         }
 372                     } else {
 373                         if (NS.data.get(ur.ns())==null) {
 374                             ur.delayDelete(noAvg,"Namespace " + ur.ns() + " does not exist.",dryRun);
 375                             ++delayedURDeletes;
 376                             ++deleted;
 377                         } else if (!Role.byName.containsKey(ur.role())) {
 378                             ur.delayDelete(noAvg,"Role " + ur.role() + " does not exist.",dryRun);
 379                             ++deleted;
 380                             ++delayedURDeletes;
 381                         } else if (ur.expires().before(tooLate)) {
 382                             if ("owner".equals(ur.rname())) { // don't delete Owners, even if Expired
 383                                 urPrint.exec(noAvg,ur,"Owner Expired (but not deleted)");
 384                             } else {
 385                                 // In this case, when UR is expired, not dependent on other lookups, we delete straight out.
 386                                 urDelete.exec(noAvg, ur,"Expired before " + tooLate);
 387                                 ++deleted;
 388                             }
 389                             //trans.logAuditTrail(trans.info());
 390                         } else if (ur.expires().before(future) && ur.expires().after(now)) {
 391                             ++count;
 392                             // Is there an Approval set already
 393                             boolean needNew = true;
 394                             if (ur.role()!=null && ur.user()!=null) {
 395                                 List<Approval> abm = Approval.byUser.get(ur.user());
 396                                 if (abm!=null) {
 397                                     for (Approval a : abm) {
 398                                         if (a.getOperation().equals(FUTURE_OP.A.name()) && ur.role().equals(a.getRole())) {
 399                                             if (Future.data.get(a.getTicket())!=null) {
 400                                                 needNew = false;
 401                                                 break;
 402                                             }
 403                                         }
 404                                     }
 405                                 }
 406                             }
 407                             if (needNew) {
 408                                 urFutureApprove.exec(noAvg, ur,"");
 409                             }
 410                         }
 411                     }
 412                 }
 413         } catch (OrganizationException e) {
 414             env.info().log(e,"Exiting ...");
 415         } finally {
 416                 env.info().log("Found",count,"user roles expiring before",future);
 417                 env.info().log("deleting",deleted,"user roles expiring before",tooLate);
 418         }
 419
 420         // Actualize UR Deletes, or send Email
 421         if (UserRole.sizeForDeletion()>0) {
 422                 count+=UserRole.sizeForDeletion();
 423             double onePercent = 0.01;
 424             if (((double)UserRole.sizeForDeletion())/UserRole.getData().size() > onePercent) {
 425                     Message msg = new Message();
 426                     try {
 427                     msg.line("Found %d of %d UserRoles marked for Deletion in file %s",
 428                         delayedURDeletes,UserRole.getData().size(),deletesFile.getCanonicalPath());
 429                 } catch (IOException e) {
 430                     msg.line("Found %d of %d UserRoles marked for Deletion.\n",
 431                             delayedURDeletes);
 432                 }
 433                     msg.line("Review the File.  If data is ok, Use ExpiringP2 BatchProcess to complete the deletions");
 434
 435                     email.msg(msg);
 436                     email.exec(trans, org, "Email Support");
 437             } else {
 438                     urDeleteF.flush();
 439                     try {
 440                         BufferedReader br = new BufferedReader(new FileReader(deletesFile));
 441                         try {
 442                             ExpiringP2.deleteURs(noAvg, br, urDelete, null /* don't touch Cache here*/);
 443                         } finally {
 444                             br.close();
 445                         }
 446                     } catch (IOException io) {
 447                         noAvg.error().log(io);
 448                     }
 449             }
 450         }
 451         if (count>0) {
 452                 String str = String.format("%d UserRoles modified or deleted", count);
 453                 cacheTouch.exec(trans, "user_role", str);
 454         }
 455
 456         // Run for Creds
 457         trans.info().log("Checking for Expired Credentials");
 458         System.out.flush();
 459         count = 0;
 460         try {
 461                 CredDAO.Data crd = new CredDAO.Data();
 462                 Date last = null;
 463                 for ( Cred creds : Cred.data.values()) {
 464                 crd.id = creds.id;
 465                     for (int type : creds.types()) {
 466                     crd.type = type;
 467                         for ( Instance inst : creds.instances) {
 468                             if (inst.expires.before(tooLate)) {
 469                                 crd.expires = inst.expires;
 470                                 crDelete.exec(noAvg, crd,"Expired before " + tooLate);
 471                             } else if (last==null || inst.expires.after(last)) {
 472                                 last = inst.expires;
 473                             }
 474                         }
 475                         if (last!=null) {
 476                             if (last.before(future)) {
 477                                 crd.expires = last;
 478                                 crPrint.exec(noAvg, crd,"");
 479                                 ++count;
 480                             }
 481                         }
 482                     }
 483                 }
 484         } finally {
 485                 String str = String.format("Found %d current creds expiring before %s", count, Chrono.dateOnlyStamp(future));
 486                 if (count>0) {
 487                     cacheTouch.exec(trans, "cred", str);
 488                 }
 489         }
 490
 491     }
 492
 493     @Override
 494     protected void _close(AuthzTrans trans) {
 495         aspr.info("End " + this.getClass().getSimpleName() + " processing" );
 496         for (Action<?,?,?> action : new Action<?,?,?>[] {crDelete}) {
 497             if (action instanceof ActionDAO) {
 498                 ((ActionDAO<?,?,?>)action).close(trans);
 499             }
 500         }
 501         session.close();
 502         urDeleteF.close();
 503         urRecoverF.close();
 504     }
 505
 506 }