auth/auth-cass/src/main/java/org/onap/aaf/auth/direct/DirectAAFLur.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.direct;
  23
  24 import static org.onap.aaf.auth.layer.Result.OK;
  25
  26 import java.security.Principal;
  27 import java.util.List;
  28
  29 import org.onap.aaf.auth.dao.cass.NsSplit;
  30 import org.onap.aaf.auth.dao.cass.PermDAO;
  31 import org.onap.aaf.auth.dao.cass.PermDAO.Data;
  32 import org.onap.aaf.auth.dao.cass.Status;
  33 import org.onap.aaf.auth.dao.hl.Question;
  34 import org.onap.aaf.auth.env.AuthzEnv;
  35 import org.onap.aaf.auth.env.AuthzTrans;
  36 import org.onap.aaf.auth.env.NullTrans;
  37 import org.onap.aaf.auth.layer.Result;
  38 import org.onap.aaf.cadi.Access.Level;
  39 import org.onap.aaf.cadi.Lur;
  40 import org.onap.aaf.cadi.Permission;
  41 import org.onap.aaf.cadi.lur.LocalPermission;
  42 import org.onap.aaf.misc.env.util.Split;
  43
  44 public class DirectAAFLur implements Lur {
  45         private final AuthzEnv env;
  46         private final Question question;
  47
  48         public DirectAAFLur(AuthzEnv env, Question question/*, TokenMgr tm*/) {
  49                 this.env = env;
  50                 this.question = question;
  51 //              oauth = new OAuth2Lur(null);
  52         }
  53
  54         @Override
  55         public boolean fish(Principal bait, Permission ... pond) {
  56                 return fish(env.newTransNoAvg(),bait,pond);
  57         }
  58
  59         public boolean fish(AuthzTrans trans, Principal bait, Permission ... pond) {
  60                 boolean rv = false;
  61                 Result<List<Data>> pdr = question.getPermsByUser(trans, bait.getName(),false);
  62                 switch(pdr.status) {
  63                         case OK:
  64                                 for(PermDAO.Data d : pdr.value) {
  65                                         if(!rv) {
  66                                                 for (Permission p : pond) {
  67                                                         if(new PermPermission(d).match(p)) {
  68                                                                 rv=true;
  69                                                                 break;
  70                                                         }
  71                                                 }
  72                                         }
  73                                 }
  74                                 break;
  75                         case Status.ERR_UserRoleNotFound:
  76                         case Status.ERR_BadData:
  77                                 return false;
  78                         default:
  79                                 trans.error().log("Can't access Cassandra to fulfill Permission Query: ",pdr.status,"-",pdr.details);
  80                 }
  81                 return rv;
  82         }
  83
  84         @Override
  85         public void fishAll(Principal bait, List<Permission> permissions) {
  86                 Result<List<Data>> pdr = question.getPermsByUser(env.newTrans(), bait.getName(),false);
  87                 switch(pdr.status) {
  88                         case OK:
  89                                 for(PermDAO.Data d : pdr.value) {
  90                                         permissions.add(new PermPermission(d));
  91                                 }
  92                                 break;
  93                         default:
  94                                 env.error().log("Can't access Cassandra to fulfill Permission Query: ",pdr.status,"-", pdr.details);
  95                 }
  96         }
  97
  98         @Override
  99         public void destroy() {
 100         }
 101
 102         @Override
 103         public boolean handlesExclusively(Permission ... pond) {
 104                 return false;
 105         }
 106
 107         /**
 108          * Small Class implementing CADI's Permission with Cassandra Data
 109          * @author Jonathan
 110          *
 111          */
 112         public static class PermPermission implements Permission {
 113                 private PermDAO.Data data;
 114
 115                 public PermPermission(PermDAO.Data d) {
 116                         data = d;
 117                 }
 118
 119                 public PermPermission(AuthzTrans trans, Question q, String p) {
 120                         data = PermDAO.Data.create(trans, q, p);
 121                 }
 122
 123                 public PermPermission(String ns, String type, String instance, String action) {
 124                         data = new PermDAO.Data();
 125                         data.ns = ns;
 126                         data.type = type;
 127                         data.instance = instance;
 128                         data.action = action;
 129                 }
 130
 131                 @Override
 132                 public String getKey() {
 133                         return data.type;
 134                 }
 135
 136                 @Override
 137                 public boolean match(Permission p) {
 138                         if(p==null) {
 139                                 return false;
 140                         }
 141                         PermDAO.Data pd;
 142                         if(p instanceof DirectAAFLur.PermPermission) {
 143                                 pd = ((DirectAAFLur.PermPermission)p).data;
 144                                 if(data.ns.equals(pd.ns))
 145                                         if(data.type.equals(pd.type))
 146                                                 if(data.instance!=null && (data.instance.equals(pd.instance) || "*".equals(data.instance)))
 147                                                         if(data.action!=null && (data.action.equals(pd.action) || "*".equals(data.action)))
 148                                                                 return true;
 149                         } else{
 150                                 String[] lp = p.getKey().split("\\|");
 151                                 if(lp.length<3)return false;
 152                                 if(data.fullType().equals(lp[0]))
 153                                         if(data.instance!=null && (data.instance.equals(lp[1]) || "*".equals(data.instance)))
 154                                                 if(data.action!=null && (data.action.equals(lp[2]) || "*".equals(data.action)))
 155                                                         return true;
 156                         }
 157                         return false;
 158                 }
 159
 160                 @Override
 161                 public String permType() {
 162                         return "AAFLUR";
 163                 }
 164
 165         }
 166
 167         public String toString() {
 168                 return "DirectAAFLur is enabled";
 169
 170         }
 171
 172         /* (non-Javadoc)
 173          * @see org.onap.aaf.cadi.Lur#handles(java.security.Principal)
 174          */
 175         @Override
 176         public boolean handles(Principal principal) {
 177                 return true;
 178         }
 179
 180         @Override
 181         public Permission createPerm(String p) {
 182                 String[] params = Split.split('|', p);
 183                 if(params.length==3) {
 184                         Result<NsSplit> nss = question.deriveNsSplit(NullTrans.singleton(), params[0]);
 185                         if(nss.isOK()) {
 186                                 return new PermPermission(nss.value.ns,nss.value.name,params[1],params[2]);
 187                         }
 188                 }
 189                 return new LocalPermission(p);
 190         }
 191
 192         @Override
 193         public void clear(Principal p, StringBuilder sb) {
 194                 AuthzTrans trans = env.newTrans();
 195                 question.clearCache(trans,"all");
 196                 env.log(Level.AUDIT, p.getName(), "has cleared Cache for",getClass().getSimpleName());
 197                 trans.auditTrail(0, sb);
 198         }
 199 }