auth/auth-oauth/src/main/java/org/onap/aaf/auth/oauth/service/OAuthService.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.oauth.service;
  23
  24 import java.io.IOException;
  25 import java.security.GeneralSecurityException;
  26 import java.util.Date;
  27 import java.util.List;
  28 import java.util.Set;
  29 import java.util.UUID;
  30
  31 import javax.servlet.http.HttpServletRequest;
  32
  33 import org.onap.aaf.auth.dao.DAO;
  34 import org.onap.aaf.auth.dao.cass.OAuthTokenDAO;
  35 import org.onap.aaf.auth.dao.cass.Status;
  36 import org.onap.aaf.auth.dao.cass.OAuthTokenDAO.Data;
  37 import org.onap.aaf.auth.dao.hl.Question;
  38 import org.onap.aaf.auth.direct.DirectAAFUserPass;
  39 import org.onap.aaf.auth.env.AuthzTrans;
  40 import org.onap.aaf.auth.env.NullTrans;
  41 import org.onap.aaf.auth.layer.Result;
  42 import org.onap.aaf.cadi.Access;
  43 import org.onap.aaf.cadi.CadiException;
  44 import org.onap.aaf.cadi.LocatorException;
  45 import org.onap.aaf.cadi.CredVal.Type;
  46 import org.onap.aaf.cadi.client.Holder;
  47 import org.onap.aaf.cadi.config.Config;
  48 import org.onap.aaf.cadi.oauth.AAFToken;
  49 import org.onap.aaf.cadi.oauth.TokenClient;
  50 import org.onap.aaf.cadi.oauth.TokenClientFactory;
  51 import org.onap.aaf.cadi.util.Split;
  52 import org.onap.aaf.misc.env.APIException;
  53
  54 import aafoauth.v2_0.Introspect;
  55
  56 public class OAuthService {
  57
  58         private static final int TOK_EXP = 60*60*1000; // 1 hour, millis.
  59
  60         public enum TOKEN_TYPE {unknown,bearer,refresh}
  61         public enum GRANT_TYPE {unknown,password,client_credentials,refresh_token};
  62         public enum CLIENT_TYPE {unknown,confidential};
  63
  64         // Additional Expires
  65         private final DAO<AuthzTrans, ?>[] daos;
  66         public final OAuthTokenDAO tokenDAO;
  67         private final DirectAAFUserPass directUserPass;
  68         private final TokenClientFactory tcf;
  69         private TokenClient altIntrospectClient;
  70         private String altDomain;
  71         private final JSONPermLoader permLoader;
  72
  73
  74         // If we add more CAs, may want to parameterize
  75
  76         @SuppressWarnings("unchecked")
  77         public OAuthService(final Access access, final AuthzTrans trans, final Question q) throws APIException, IOException {
  78                 permLoader = JSONPermLoaderFactory.direct(q);
  79                 tokenDAO = new OAuthTokenDAO(trans, q.historyDAO);
  80                 daos =(DAO<AuthzTrans, ?>[]) new DAO<?,?>[] {
  81                         tokenDAO
  82                 };
  83                 try {
  84                         String alt_url = access.getProperty(Config.AAF_ALT_OAUTH2_INTROSPECT_URL,null);
  85                         if(alt_url!=null) {
  86                                 tcf = TokenClientFactory.instance(access);
  87                                 String[] split = Split.split(',', alt_url);
  88                                 int timeout = split.length>1?Integer.parseInt(split[1]):3000;
  89                                 altIntrospectClient = tcf.newClient(split[0], timeout);
  90                                 altIntrospectClient.client_creds(access.getProperty(Config.AAF_ALT_CLIENT_ID,null),
  91                                                                                    access.getProperty(Config.AAF_ALT_CLIENT_SECRET,null));
  92                                 altDomain = '@'+access.getProperty(Config.AAF_ALT_OAUTH2_DOMAIN,null);
  93                         } else {
  94                                 tcf = null;
  95                         }
  96                         directUserPass = new DirectAAFUserPass(trans.env(), q);
  97                 } catch (GeneralSecurityException | CadiException | LocatorException e) {
  98                         throw new APIException("Could not construct TokenClientFactory",e);
  99                 }
 100
 101         }
 102
 103         public Result<Void> validate(AuthzTrans trans, OCreds creds) {
 104                 if(directUserPass.validate(creds.username, Type.PASSWORD, creds.password, trans)) {
 105                         return Result.ok();
 106                 } else {
 107                         return Result.err(Result.ERR_Security, "Invalid Credential for ",creds.username);
 108                 }
 109         }
 110
 111         public Result<Data> createToken(AuthzTrans trans, HttpServletRequest req, OAuthTokenDAO.Data odd, Holder<GRANT_TYPE> hgt) {
 112                 switch(hgt.get()) {
 113                         case client_credentials:
 114                         case password:
 115                                 return createBearerToken(trans, odd);
 116                         case refresh_token:
 117                                 return refreshBearerToken(trans, odd);
 118                         default:
 119                                 return Result.err(Result.ERR_BadData, "Unknown Grant Type");
 120                 }
 121         }
 122
 123         private Result<Data> createBearerToken(AuthzTrans trans, OAuthTokenDAO.Data odd) {
 124                 if(odd.user==null) {
 125                         odd.user = trans.user();
 126                 }
 127                 odd.id = AAFToken.toToken(UUID.randomUUID());
 128                 odd.refresh = AAFToken.toToken(UUID.randomUUID());
 129                 odd.active = true;
 130                 long exp;
 131                 odd.expires = new Date(exp=(System.currentTimeMillis()+TOK_EXP));
 132                 odd.exp_sec = exp/1000;
 133                 odd.req_ip = trans.ip();
 134
 135                 try {
 136                         Result<Data> rd = loadToken(trans, odd);
 137                         if(rd.notOK()) {
 138                                 return rd;
 139                         }
 140                 } catch (APIException | CadiException e) {
 141                         return Result.err(e);
 142                 }
 143                 return tokenDAO.create(trans, odd);
 144         }
 145
 146         private Result<Data> loadToken(AuthzTrans trans, Data odd) throws APIException, CadiException {
 147                 Result<String> rs = permLoader.loadJSONPerms(trans,odd.user,odd.scopes(false));
 148                 if(rs.isOK()) {
 149                         odd.content = rs.value;
 150                         odd.type = TOKEN_TYPE.bearer.ordinal();
 151                         return Result.ok(odd);
 152                 } else if(rs.status == Result.ERR_NotFound || rs.status==Status.ERR_UserRoleNotFound) {
 153                         odd.type = TOKEN_TYPE.bearer.ordinal();
 154                         return Result.ok(odd);
 155                 } else {
 156                         return Result.err(Result.ERR_Backend,"Error accessing AAF Info: %s",rs.errorString());
 157                 }
 158         }
 159
 160
 161
 162         private Result<Data> refreshBearerToken(AuthzTrans trans, Data odd) {
 163                 Result<List<Data>> rld = tokenDAO.readByUser(trans, trans.user());
 164                 if(rld.notOK()) {
 165                         return Result.err(rld);
 166                 }
 167                 if(rld.isEmpty()) {
 168                         return Result.err(Result.ERR_NotFound,"Data not Found for %1 %2",trans.user(),odd.refresh==null?"":odd.refresh.toString());
 169                 }
 170                 Data token = null;
 171                 for(Data d : rld.value) {
 172                         if(d.refresh.equals(odd.refresh)) {
 173                                 token = d;
 174                                 boolean scopesNE = false;
 175                                 Set<String> scopes = odd.scopes(false);
 176                                 if(scopes.size()>0) { // only check if Scopes listed, RFC 6749, Section 6
 177                                         if(scopesNE=!(scopes.size() == d.scopes(false).size())) {
 178                                                 for(String s : odd.scopes(false)) {
 179                                                         if(!d.scopes(false).contains(s)) {
 180                                                                 scopesNE=true;
 181                                                                 break;
 182                                                         }
 183                                                 }
 184                                         }
 185                                         if(scopesNE) {
 186                                                 return Result.err(Result.ERR_BadData,"Requested Scopes do not match existing Token");
 187                                         }
 188                                 }
 189                                 break;
 190                         }
 191                 }
 192
 193                 if(token==null) {
 194                         trans.audit().printf("Duplicate Refresh Token (%s) attempted for %s. Possible Replay Attack",odd.refresh.toString(),trans.user());
 195                         return Result.err(Result.ERR_Security,"Invalid Refresh Token");
 196                 } else {
 197                         // Got the Result
 198                         Data deleteMe = new Data();
 199                         deleteMe.id = token.id;
 200                         token.id = AAFToken.toToken(UUID.randomUUID());
 201                         token.client_id = trans.user();
 202                         token.refresh = AAFToken.toToken(UUID.randomUUID());
 203                         long exp;
 204                         token.expires = new Date(exp=(System.currentTimeMillis()+TOK_EXP));
 205                         token.exp_sec = exp/1000;
 206                         token.req_ip = trans.ip();
 207                         Result<Data> rd = tokenDAO.create(trans, token);
 208                         if(rd.notOK()) {
 209                                 return Result.err(rd);
 210                         }
 211                         Result<Void> rv = tokenDAO.delete(trans, deleteMe,false);
 212                         if(rv.notOK()) {
 213                                 trans.error().log("Unable to delete token", token);
 214                         }
 215                 }
 216                 return Result.ok(token);
 217         }
 218
 219         public Result<OAuthTokenDAO.Data> introspect(AuthzTrans trans, String token) {
 220                 Result<List<Data>> rld;
 221                 try {
 222                         UUID uuid = AAFToken.fromToken(token);
 223                         if(uuid==null) { // not an AAF Token
 224                                 // Attempt to get Alternative Token
 225                                 if(altIntrospectClient!=null) {
 226                                          org.onap.aaf.cadi.client.Result<Introspect> rai = altIntrospectClient.introspect(token);
 227                                          if(rai.isOK()) {
 228                                                  Introspect in = rai.value;
 229                                                  if(in.getExp()==null) {
 230                                                         trans.audit().printf("Alt OAuth sent back inactive, empty token: requesting_id,%s,access_token=%s,ip=%s\n",trans.user(),token,trans.ip());
 231                                                  }
 232                                                  long expires = in.getExp()*1000;
 233                                                  if(in.isActive() && expires>System.currentTimeMillis()) {
 234                                                         // We have a good Token, modify to be Fully Qualified
 235                                                         String fqid = in.getUsername()+altDomain;
 236                                                         // read contents
 237                                                         rld = tokenDAO.read(trans, token);
 238                                                         if(rld.isOKhasData()) {
 239                                                                 Data td = rld.value.get(0);
 240                                                                 in.setContent(td.content);
 241                                                         } else {
 242                                                                 Data td = new Data();
 243                                                                 td.id = token;
 244                                                                 td.client_id = in.getClientId();
 245                                                                 td.user = fqid;
 246                                                                 td.active=true;
 247                                                                 td.type = TOKEN_TYPE.bearer.ordinal();
 248                                                                 td.expires = new Date(expires);
 249                                                                 td.exp_sec = in.getExp();
 250                                                                 Set<String> scopes = td.scopes(true);
 251                                                                 if(in.getScope()!=null) {
 252                                                                         for(String s : Split.split(' ', in.getScope())) {
 253                                                                                 scopes.add(s);
 254                                                                         }
 255                                                                 }
 256                                                                 // td.state = nothing to add at this point
 257                                                                 td.req_ip = trans.ip();
 258                                                                 trans.checkpoint(td.user + ':' + td.client_id + ", " + td.id);
 259                                                                 return loadToken(trans, td);
 260                                                         }
 261                                                  }
 262 //                                               System.out.println(rai.value.getClientId());
 263                                          } else {
 264                                                 trans.audit().printf("Alt OAuth rejects: requesting_id,%s,access_token=%s,ip=%s,code=%d,error=%s\n",trans.user(),token,trans.ip(),rai.code,rai.error);
 265                                          }
 266                                 } else {
 267                                         trans.audit().printf("Bad Token: requesting_id,%s,access_token=%s,ip=%s\n",trans.user(),token,trans.ip());
 268                                 }
 269                                 return Result.err(Result.ERR_Denied,"Bad Token");
 270                         } else {
 271                                 return dbIntrospect(trans,token);
 272                         }
 273                 } catch (CadiException | APIException | LocatorException e) {
 274                         return Result.err(e);
 275                 }
 276         }
 277
 278         public Result<Data> dbIntrospect(final AuthzTrans trans, final String token) {
 279                 Result<List<Data>> rld = tokenDAO.read(trans, token);
 280                 if(rld.notOKorIsEmpty()) {
 281                         return Result.err(rld);
 282                 }
 283                 OAuthTokenDAO.Data odd = rld.value.get(0);
 284                 trans.checkpoint(odd.user + ':' + odd.client_id + ", " + odd.id);
 285                 if(odd.active) {
 286                         if(odd.expires.before(trans.now())) {
 287                                 return Result.err(Result.ERR_Policy,"Token %1 has expired",token);
 288                         }
 289                         return Result.ok(rld.value.get(0)); // ok keyed on id/token.
 290                 } else {
 291                         return Result.err(Result.ERR_Denied,"Token %1 is inactive",token);
 292                 }
 293         }
 294
 295         public void close() {
 296                 for(DAO<AuthzTrans,?> dao : daos) {
 297                         dao.close(NullTrans.singleton());
 298                 }
 299         }
 300
 301 }