auth/auth-core/src/main/java/org/onap/aaf/auth/org/Organization.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.org;
  23
  24 import java.util.ArrayList;
  25 import java.util.Date;
  26 import java.util.GregorianCalendar;
  27 import java.util.HashSet;
  28 import java.util.List;
  29 import java.util.Set;
  30
  31 import org.onap.aaf.auth.env.AuthzTrans;
  32
  33 /**
  34  * Organization
  35  *
  36  * There is Organizational specific information required which we have extracted to a plugin
  37  *
  38  * It supports using Company Specific User Directory lookups, as well as supporting an
  39  * Approval/Validation Process to simplify control of Roles and Permissions for large organizations
  40  * in lieu of direct manipulation by a set of Admins.
  41  *
  42  * @author Jonathan
  43  *
  44  */
  45 public interface Organization {
  46         public static final String N_A = "n/a";
  47
  48         public interface Identity {
  49                 public String id();
  50                 public String fullID() throws OrganizationException; // Fully Qualified ID (includes Domain of Organization)
  51                 public String type();                           // Must be one of "IdentityTypes", see below
  52                 public Identity responsibleTo() throws OrganizationException;           // Chain of Command, or Application ID Sponsor
  53                 public List<String> delegate();                 // Someone who has authority to act on behalf of Identity
  54                 public String email();
  55                 public String fullName();
  56                 public String firstName();
  57                 /**
  58                  * If Responsible entity, then String returned is "null"  meaning "no Objection".
  59                  * If String exists, it is the Policy objection text setup by the entity.
  60                  * @return
  61                  */
  62                 public String mayOwn();                 // Is id passed belong to a person suitable to be Responsible for content Management
  63                 public boolean isFound();                               // Is Identity found in Identity stores
  64                 public boolean isPerson();                              // Whether a Person or a Machine (App)
  65                 public Organization org();                              // Organization of Identity
  66
  67         }
  68
  69
  70         /**
  71          * Name of Organization, suitable for Logging
  72          * @return
  73          */
  74         public String getName();
  75
  76         /**
  77          * Realm, for use in distinguishing IDs from different systems/Companies
  78          * @return
  79          */
  80         public String getRealm();
  81
  82         public boolean supportsRealm(String user);
  83
  84         public void addSupportedRealm(String r);
  85
  86
  87
  88         String getDomain();
  89
  90         /**
  91          * Get Identity information based on userID
  92          *
  93          * @param id
  94          * @return
  95          */
  96         public Identity getIdentity(AuthzTrans trans, String id) throws OrganizationException;
  97
  98
  99         /**
 100          * Does the ID pass Organization Standards
 101          *
 102          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of
 103          * reasons why it fails
 104          *
 105          * @param id
 106          * @return
 107          */
 108         public String isValidID(AuthzTrans trans, String id);
 109
 110         /**
 111          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of
 112          * reasons why it fails
 113          *
 114          *  Identity is passed in to allow policies regarding passwords that are the same as user ID
 115          *
 116          *  any entries for "prev" imply a reset
 117          *
 118          * @param id
 119          * @param password
 120          * @return
 121          */
 122         public String isValidPassword(final AuthzTrans trans, final String id, final String password, final String ... prev);
 123
 124     /**
 125          * Return a list of Strings denoting Organization Password Rules, suitable for posting on a WebPage with <p>
 126          */
 127         public String[] getPasswordRules();
 128
 129         /**
 130          *
 131          * @param id
 132          * @return
 133          */
 134         public boolean isValidCred(final AuthzTrans trans, final String id);
 135
 136         /**
 137          * If response is Null, then it is valid.  Otherwise, the Organization specific reason is returned.
 138          *
 139          * @param trans
 140          * @param policy
 141          * @param executor
 142          * @param vars
 143          * @return
 144          * @throws OrganizationException
 145          */
 146         public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars) throws OrganizationException;
 147
 148         /**
 149          * Does your Company distinguish essential permission structures by kind of Identity?
 150          * i.e. Employee, Contractor, Vendor
 151          * @return
 152          */
 153         public Set<String> getIdentityTypes();
 154
 155         public enum Notify {
 156                 Approval(1),
 157                 PasswordExpiration(2),
 158         RoleExpiration(3);
 159
 160                 final int id;
 161                 Notify(int id) {this.id = id;}
 162                 public int getValue() {return id;}
 163                 public static Notify from(int type) {
 164                         for(Notify t : Notify.values()) {
 165                                 if(t.id==type) {
 166                                         return t;
 167                                 }
 168                         }
 169                         return null;
 170                 }
 171         }
 172
 173         public enum Response{
 174                 OK,
 175                 ERR_NotImplemented,
 176                 ERR_UserNotExist,
 177                 ERR_NotificationFailure,
 178                 };
 179
 180         public enum Expiration {
 181                 Password,
 182                 TempPassword,
 183                 Future,
 184                 UserInRole,
 185                 UserDelegate,
 186                 ExtendPassword
 187         }
 188
 189         public enum Policy {
 190                 CHANGE_JOB,
 191                 LEFT_COMPANY,
 192                 CREATE_MECHID,
 193                 CREATE_MECHID_BY_PERM_ONLY,
 194                 OWNS_MECHID,
 195                 AS_RESPONSIBLE,
 196                 MAY_EXTEND_CRED_EXPIRES,
 197                 MAY_APPLY_DEFAULT_REALM
 198         }
 199
 200         /**
 201          * Notify a User of Action or Info
 202          *
 203          * @param type
 204          * @param url
 205          * @param users (separated by commas)
 206          * @param ccs (separated by commas)
 207          * @param summary
 208          */
 209
 210     public Response notify(AuthzTrans trans, Notify type, String url, String ids[], String ccs[], String summary, Boolean urgent);
 211
 212         /**
 213          * (more) generic way to send an email
 214          *
 215          * @param toList
 216          * @param ccList
 217          * @param subject
 218          * @param body
 219          * @param urgent
 220          */
 221
 222         public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, String subject, String body, Boolean urgent) throws OrganizationException;
 223
 224         /**
 225          * whenToValidate
 226          *
 227          * Authz support services will ask the Organization Object at startup when it should
 228          * kickoff Validation processes given particular types.
 229          *
 230          * This allows the Organization to express Policy
 231          *
 232          * Turn off Validation behavior by returning "null"
 233          *
 234          */
 235         public Date whenToValidate(Notify type, Date lastValidated);
 236
 237
 238         /**
 239          * Expiration
 240          *
 241          * Given a Calendar item of Start (or now), set the Expiration Date based on the Policy
 242          * based on type.
 243          *
 244          * For instance, "Passwords expire in 3 months"
 245          *
 246          * The Extra Parameter is used by certain Orgs.
 247          *
 248          * For Password, the extra is UserID, so it can check the User Type
 249          *
 250          * @param gc
 251          * @param exp
 252          * @return
 253          */
 254         public GregorianCalendar expiration(GregorianCalendar gc, Expiration exp, String ... extra);
 255
 256         /**
 257          * Get Email Warning timing policies
 258          * @return
 259          */
 260         public EmailWarnings emailWarningPolicy();
 261
 262         /**
 263          *
 264          * @param trans
 265          * @param user
 266          * @return
 267          */
 268         public List<Identity> getApprovers(AuthzTrans trans, String user) throws OrganizationException ;
 269
 270         /*
 271          *
 272          * @param user
 273          * @param type
 274          * @param users
 275          * @return
 276         public Response notifyRequest(AuthzTrans trans, String user, Approval type, List<User> approvers);
 277         */
 278
 279         /**
 280          *
 281          * @return
 282          */
 283         public String getApproverType();
 284
 285         /*
 286          * startOfDay - define for company what hour of day business starts (specifically for password and other expiration which
 287          *   were set by Date only.)
 288          *
 289          * @return
 290          */
 291         public int startOfDay();
 292
 293     /**
 294      * implement this method to support any IDs that can have multiple entries in the cred table
 295      * NOTE: the combination of ID/expiration date/(encryption type when implemented) must be unique.
 296      *           Since expiration date is based on startOfDay for your company, you cannot create many
 297      *           creds for the same ID in the same day.
 298      * @param id
 299      * @return
 300      */
 301     public boolean canHaveMultipleCreds(String id);
 302
 303     boolean isTestEnv();
 304
 305         public void setTestMode(boolean dryRun);
 306
 307         public static final Organization NULL = new Organization()
 308         {
 309                 private final GregorianCalendar gc = new GregorianCalendar(1900, 1, 1);
 310                 private final List<Identity> nullList = new ArrayList<Identity>();
 311                 private final Set<String> nullStringSet = new HashSet<String>();
 312                 private String[] nullStringArray = new String[0];
 313                 private final Identity nullIdentity = new Identity() {
 314                         List<String> nullUser = new ArrayList<String>();
 315                         @Override
 316                         public String type() {
 317                                 return N_A;
 318                         }
 319
 320                         @Override
 321                         public String mayOwn() {
 322                                 return N_A; // negative case
 323                         }
 324
 325                         @Override
 326                         public boolean isFound() {
 327                                 return false;
 328                         }
 329
 330                         @Override
 331                         public String id() {
 332                                 return N_A;
 333                         }
 334
 335                         @Override
 336                         public String fullID() {
 337                                 return N_A;
 338                         }
 339
 340                         @Override
 341                         public String email() {
 342                                 return N_A;
 343                         }
 344
 345                         @Override
 346                         public List<String> delegate() {
 347                                 return nullUser;
 348                         }
 349                         @Override
 350                         public String fullName() {
 351                                 return N_A;
 352                         }
 353                         @Override
 354                         public Organization org() {
 355                                 return NULL;
 356                         }
 357                         @Override
 358                         public String firstName() {
 359                                 return N_A;
 360                         }
 361                         @Override
 362                         public boolean isPerson() {
 363                                 return false;
 364                         }
 365
 366                         @Override
 367                         public Identity responsibleTo() {
 368                                 return null;
 369                         }
 370                 };
 371                 @Override
 372                 public String getName() {
 373                         return N_A;
 374                 }
 375
 376                 @Override
 377                 public String getRealm() {
 378                         return N_A;
 379                 }
 380
 381                 @Override
 382                 public boolean supportsRealm(String r) {
 383                         return false;
 384                 }
 385
 386                 @Override
 387                 public void addSupportedRealm(String r) {
 388                 }
 389
 390                 @Override
 391                 public String getDomain() {
 392                         return N_A;
 393                 }
 394
 395                 @Override
 396                 public Identity getIdentity(AuthzTrans trans, String id) {
 397                         return nullIdentity;
 398                 }
 399
 400                 @Override
 401                 public String isValidID(final AuthzTrans trans, String id) {
 402                         return N_A;
 403                 }
 404
 405                 @Override
 406                 public String isValidPassword(final AuthzTrans trans, final String user, final String password, final String... prev) {
 407                         return N_A;
 408                 }
 409
 410                 @Override
 411                 public Set<String> getIdentityTypes() {
 412                         return nullStringSet;
 413                 }
 414
 415                 @Override
 416                 public Response notify(AuthzTrans trans, Notify type, String url,
 417                                 String[] users, String[] ccs, String summary, Boolean urgent) {
 418                         return Response.ERR_NotImplemented;
 419                 }
 420
 421                 @Override
 422                 public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList,
 423                                 String subject, String body, Boolean urgent) throws OrganizationException {
 424                         return 0;
 425                 }
 426
 427                 @Override
 428                 public Date whenToValidate(Notify type, Date lastValidated) {
 429                         return gc.getTime();
 430                 }
 431
 432                 @Override
 433                 public GregorianCalendar expiration(GregorianCalendar gc,
 434                                 Expiration exp, String... extra) {
 435                         return gc;
 436                 }
 437
 438                 @Override
 439                 public List<Identity> getApprovers(AuthzTrans trans, String user)
 440                                 throws OrganizationException {
 441                         return nullList;
 442                 }
 443
 444                 @Override
 445                 public String getApproverType() {
 446                         return "";
 447                 }
 448
 449                 @Override
 450                 public int startOfDay() {
 451                         return 0;
 452                 }
 453
 454                 @Override
 455                 public boolean canHaveMultipleCreds(String id) {
 456                         return false;
 457                 }
 458
 459                 @Override
 460                 public boolean isValidCred(final AuthzTrans trans, final String id) {
 461                         return false;
 462                 }
 463
 464                 @Override
 465                 public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars)
 466                                 throws OrganizationException {
 467                         return "Null Organization rejects all Policies";
 468                 }
 469
 470                 @Override
 471                 public boolean isTestEnv() {
 472                         return false;
 473                 }
 474
 475                 @Override
 476                 public void setTestMode(boolean dryRun) {
 477                 }
 478
 479                 @Override
 480                 public EmailWarnings emailWarningPolicy() {
 481                         return new EmailWarnings() {
 482
 483                                 @Override
 484                             public long credEmailInterval()
 485                             {
 486                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7
 487                             }
 488
 489                                 @Override
 490                             public long roleEmailInterval()
 491                             {
 492                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7
 493                             }
 494
 495                                 @Override
 496                                 public long apprEmailInterval() {
 497                                 return 259200000L; // 3 days in millis 1000 * 86400 * 3
 498                                 }
 499
 500                                 @Override
 501                             public long  credExpirationWarning()
 502                             {
 503                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds
 504                             }
 505
 506                                 @Override
 507                             public long roleExpirationWarning()
 508                             {
 509                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds
 510                             }
 511
 512                                 @Override
 513                             public long emailUrgentWarning()
 514                             {
 515                                 return( 1209600000L ); // Two weeks, in milliseconds 1000 * 86400 * 14  in milliseconds
 516                             }
 517
 518                         };
 519                 }
 520
 521                 @Override
 522                 public String[] getPasswordRules() {
 523                         return nullStringArray;
 524                 }
 525
 526         };
 527
 528 }
 529
 530