auth/auth-core/src/main/java/org/onap/aaf/auth/org/Organization.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.org;
  23
  24 import java.util.ArrayList;
  25 import java.util.Date;
  26 import java.util.GregorianCalendar;
  27 import java.util.HashSet;
  28 import java.util.List;
  29 import java.util.Set;
  30
  31 import org.onap.aaf.auth.env.AuthzTrans;
  32
  33 /**
  34  * Organization
  35  *
  36  * There is Organizational specific information required which we have extracted to a plugin
  37  *
  38  * It supports using Company Specific User Directory lookups, as well as supporting an
  39  * Approval/Validation Process to simplify control of Roles and Permissions for large organizations
  40  * in lieu of direct manipulation by a set of Admins.
  41  *
  42  * @author Jonathan
  43  *
  44  */
  45 public interface Organization {
  46         public static final String N_A = "n/a";
  47
  48         public interface Identity {
  49                 public String id();
  50                 public String fullID() throws OrganizationException; // Fully Qualified ID (includes Domain of Organization)
  51                 public String type();                           // Must be one of "IdentityTypes", see below
  52                 public Identity responsibleTo() throws OrganizationException;           // Chain of Command, or Application ID Sponsor
  53                 public List<String> delegate();                 // Someone who has authority to act on behalf of Identity
  54                 public String email();
  55                 public String fullName();
  56                 public String firstName();
  57                 /**
  58                  * If Responsible entity, then String returned is "null"  meaning "no Objection".
  59                  * If String exists, it is the Policy objection text setup by the entity.
  60                  * @return
  61                  */
  62                 public String mayOwn();                 // Is id passed belong to a person suitable to be Responsible for content Management
  63                 public boolean isFound();                               // Is Identity found in Identity stores
  64                 public boolean isPerson();                              // Whether a Person or a Machine (App)
  65                 public Organization org();                              // Organization of Identity
  66
  67         }
  68
  69
  70         /**
  71          * Name of Organization, suitable for Logging
  72          * @return
  73          */
  74         public String getName();
  75
  76         /**
  77          * Realm, for use in distinguishing IDs from different systems/Companies
  78          * @return
  79          */
  80         public String getRealm();
  81
  82         String getDomain();
  83
  84         /**
  85          * Get Identity information based on userID
  86          *
  87          * @param id
  88          * @return
  89          */
  90         public Identity getIdentity(AuthzTrans trans, String id) throws OrganizationException;
  91
  92
  93         /**
  94          * Does the ID pass Organization Standards
  95          *
  96          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of
  97          * reasons why it fails
  98          *
  99          * @param id
 100          * @return
 101          */
 102         public String isValidID(AuthzTrans trans, String id);
 103
 104         /**
 105          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of
 106          * reasons why it fails
 107          *
 108          *  Identity is passed in to allow policies regarding passwords that are the same as user ID
 109          *
 110          *  any entries for "prev" imply a reset
 111          *
 112          * @param id
 113          * @param password
 114          * @return
 115          */
 116         public String isValidPassword(final AuthzTrans trans, final String id, final String password, final String ... prev);
 117
 118     /**
 119          * Return a list of Strings denoting Organization Password Rules, suitable for posting on a WebPage with <p>
 120          */
 121         public String[] getPasswordRules();
 122
 123         /**
 124          *
 125          * @param id
 126          * @return
 127          */
 128         public boolean isValidCred(final AuthzTrans trans, final String id);
 129
 130         /**
 131          * If response is Null, then it is valid.  Otherwise, the Organization specific reason is returned.
 132          *
 133          * @param trans
 134          * @param policy
 135          * @param executor
 136          * @param vars
 137          * @return
 138          * @throws OrganizationException
 139          */
 140         public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars) throws OrganizationException;
 141
 142         /**
 143          * Does your Company distinguish essential permission structures by kind of Identity?
 144          * i.e. Employee, Contractor, Vendor
 145          * @return
 146          */
 147         public Set<String> getIdentityTypes();
 148
 149         public enum Notify {
 150                 Approval(1),
 151                 PasswordExpiration(2),
 152         RoleExpiration(3);
 153
 154                 final int id;
 155                 Notify(int id) {this.id = id;}
 156                 public int getValue() {return id;}
 157                 public static Notify from(int type) {
 158                         for(Notify t : Notify.values()) {
 159                                 if(t.id==type) {
 160                                         return t;
 161                                 }
 162                         }
 163                         return null;
 164                 }
 165         }
 166
 167         public enum Response{
 168                 OK,
 169                 ERR_NotImplemented,
 170                 ERR_UserNotExist,
 171                 ERR_NotificationFailure,
 172                 };
 173
 174         public enum Expiration {
 175                 Password,
 176                 TempPassword,
 177                 Future,
 178                 UserInRole,
 179                 UserDelegate,
 180                 ExtendPassword
 181         }
 182
 183         public enum Policy {
 184                 CHANGE_JOB,
 185                 LEFT_COMPANY,
 186                 CREATE_MECHID,
 187                 CREATE_MECHID_BY_PERM_ONLY,
 188                 OWNS_MECHID,
 189                 AS_RESPONSIBLE,
 190                 MAY_EXTEND_CRED_EXPIRES,
 191                 MAY_APPLY_DEFAULT_REALM
 192         }
 193
 194         /**
 195          * Notify a User of Action or Info
 196          *
 197          * @param type
 198          * @param url
 199          * @param users (separated by commas)
 200          * @param ccs (separated by commas)
 201          * @param summary
 202          */
 203
 204     public Response notify(AuthzTrans trans, Notify type, String url, String ids[], String ccs[], String summary, Boolean urgent);
 205
 206         /**
 207          * (more) generic way to send an email
 208          *
 209          * @param toList
 210          * @param ccList
 211          * @param subject
 212          * @param body
 213          * @param urgent
 214          */
 215
 216         public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, String subject, String body, Boolean urgent) throws OrganizationException;
 217
 218         /**
 219          * whenToValidate
 220          *
 221          * Authz support services will ask the Organization Object at startup when it should
 222          * kickoff Validation processes given particular types.
 223          *
 224          * This allows the Organization to express Policy
 225          *
 226          * Turn off Validation behavior by returning "null"
 227          *
 228          */
 229         public Date whenToValidate(Notify type, Date lastValidated);
 230
 231
 232         /**
 233          * Expiration
 234          *
 235          * Given a Calendar item of Start (or now), set the Expiration Date based on the Policy
 236          * based on type.
 237          *
 238          * For instance, "Passwords expire in 3 months"
 239          *
 240          * The Extra Parameter is used by certain Orgs.
 241          *
 242          * For Password, the extra is UserID, so it can check the User Type
 243          *
 244          * @param gc
 245          * @param exp
 246          * @return
 247          */
 248         public GregorianCalendar expiration(GregorianCalendar gc, Expiration exp, String ... extra);
 249
 250         /**
 251          * Get Email Warning timing policies
 252          * @return
 253          */
 254         public EmailWarnings emailWarningPolicy();
 255
 256         /**
 257          *
 258          * @param trans
 259          * @param user
 260          * @return
 261          */
 262         public List<Identity> getApprovers(AuthzTrans trans, String user) throws OrganizationException ;
 263
 264         /*
 265          *
 266          * @param user
 267          * @param type
 268          * @param users
 269          * @return
 270         public Response notifyRequest(AuthzTrans trans, String user, Approval type, List<User> approvers);
 271         */
 272
 273         /**
 274          *
 275          * @return
 276          */
 277         public String getApproverType();
 278
 279         /*
 280          * startOfDay - define for company what hour of day business starts (specifically for password and other expiration which
 281          *   were set by Date only.)
 282          *
 283          * @return
 284          */
 285         public int startOfDay();
 286
 287     /**
 288      * implement this method to support any IDs that can have multiple entries in the cred table
 289      * NOTE: the combination of ID/expiration date/(encryption type when implemented) must be unique.
 290      *           Since expiration date is based on startOfDay for your company, you cannot create many
 291      *           creds for the same ID in the same day.
 292      * @param id
 293      * @return
 294      */
 295     public boolean canHaveMultipleCreds(String id);
 296
 297     boolean isTestEnv();
 298
 299         public void setTestMode(boolean dryRun);
 300
 301         public static final Organization NULL = new Organization()
 302         {
 303                 private final GregorianCalendar gc = new GregorianCalendar(1900, 1, 1);
 304                 private final List<Identity> nullList = new ArrayList<Identity>();
 305                 private final Set<String> nullStringSet = new HashSet<String>();
 306                 private String[] nullStringArray = new String[0];
 307                 private final Identity nullIdentity = new Identity() {
 308                         List<String> nullUser = new ArrayList<String>();
 309                         @Override
 310                         public String type() {
 311                                 return N_A;
 312                         }
 313
 314                         @Override
 315                         public String mayOwn() {
 316                                 return N_A; // negative case
 317                         }
 318
 319                         @Override
 320                         public boolean isFound() {
 321                                 return false;
 322                         }
 323
 324                         @Override
 325                         public String id() {
 326                                 return N_A;
 327                         }
 328
 329                         @Override
 330                         public String fullID() {
 331                                 return N_A;
 332                         }
 333
 334                         @Override
 335                         public String email() {
 336                                 return N_A;
 337                         }
 338
 339                         @Override
 340                         public List<String> delegate() {
 341                                 return nullUser;
 342                         }
 343                         @Override
 344                         public String fullName() {
 345                                 return N_A;
 346                         }
 347                         @Override
 348                         public Organization org() {
 349                                 return NULL;
 350                         }
 351                         @Override
 352                         public String firstName() {
 353                                 return N_A;
 354                         }
 355                         @Override
 356                         public boolean isPerson() {
 357                                 return false;
 358                         }
 359
 360                         @Override
 361                         public Identity responsibleTo() {
 362                                 return null;
 363                         }
 364                 };
 365                 @Override
 366                 public String getName() {
 367                         return N_A;
 368                 }
 369
 370                 @Override
 371                 public String getRealm() {
 372                         return N_A;
 373                 }
 374
 375                 @Override
 376                 public String getDomain() {
 377                         return N_A;
 378                 }
 379
 380                 @Override
 381                 public Identity getIdentity(AuthzTrans trans, String id) {
 382                         return nullIdentity;
 383                 }
 384
 385                 @Override
 386                 public String isValidID(final AuthzTrans trans, String id) {
 387                         return N_A;
 388                 }
 389
 390                 @Override
 391                 public String isValidPassword(final AuthzTrans trans, final String user, final String password, final String... prev) {
 392                         return N_A;
 393                 }
 394
 395                 @Override
 396                 public Set<String> getIdentityTypes() {
 397                         return nullStringSet;
 398                 }
 399
 400                 @Override
 401                 public Response notify(AuthzTrans trans, Notify type, String url,
 402                                 String[] users, String[] ccs, String summary, Boolean urgent) {
 403                         return Response.ERR_NotImplemented;
 404                 }
 405
 406                 @Override
 407                 public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList,
 408                                 String subject, String body, Boolean urgent) throws OrganizationException {
 409                         return 0;
 410                 }
 411
 412                 @Override
 413                 public Date whenToValidate(Notify type, Date lastValidated) {
 414                         return gc.getTime();
 415                 }
 416
 417                 @Override
 418                 public GregorianCalendar expiration(GregorianCalendar gc,
 419                                 Expiration exp, String... extra) {
 420                         return gc;
 421                 }
 422
 423                 @Override
 424                 public List<Identity> getApprovers(AuthzTrans trans, String user)
 425                                 throws OrganizationException {
 426                         return nullList;
 427                 }
 428
 429                 @Override
 430                 public String getApproverType() {
 431                         return "";
 432                 }
 433
 434                 @Override
 435                 public int startOfDay() {
 436                         return 0;
 437                 }
 438
 439                 @Override
 440                 public boolean canHaveMultipleCreds(String id) {
 441                         return false;
 442                 }
 443
 444                 @Override
 445                 public boolean isValidCred(final AuthzTrans trans, final String id) {
 446                         return false;
 447                 }
 448
 449                 @Override
 450                 public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars)
 451                                 throws OrganizationException {
 452                         return "Null Organization rejects all Policies";
 453                 }
 454
 455                 @Override
 456                 public boolean isTestEnv() {
 457                         return false;
 458                 }
 459
 460                 @Override
 461                 public void setTestMode(boolean dryRun) {
 462                 }
 463
 464                 @Override
 465                 public EmailWarnings emailWarningPolicy() {
 466                         return new EmailWarnings() {
 467
 468                                 @Override
 469                             public long credEmailInterval()
 470                             {
 471                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7
 472                             }
 473
 474                                 @Override
 475                             public long roleEmailInterval()
 476                             {
 477                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7
 478                             }
 479
 480                                 @Override
 481                                 public long apprEmailInterval() {
 482                                 return 259200000L; // 3 days in millis 1000 * 86400 * 3
 483                                 }
 484
 485                                 @Override
 486                             public long  credExpirationWarning()
 487                             {
 488                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds
 489                             }
 490
 491                                 @Override
 492                             public long roleExpirationWarning()
 493                             {
 494                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds
 495                             }
 496
 497                                 @Override
 498                             public long emailUrgentWarning()
 499                             {
 500                                 return( 1209600000L ); // Two weeks, in milliseconds 1000 * 86400 * 14  in milliseconds
 501                             }
 502
 503                         };
 504                 }
 505
 506                 @Override
 507                 public String[] getPasswordRules() {
 508                         return nullStringArray;
 509                 }
 510
 511         };
 512
 513 }
 514
 515