authz-core/src/main/java/com/att/authz/org/Organization.java

   1 /*******************************************************************************\r
   2  * ============LICENSE_START====================================================\r
   3  * * org.onap.aai\r
   4  * * ===========================================================================\r
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
   6  * * Copyright © 2017 Amdocs\r
   7  * * ===========================================================================\r
   8  * * Licensed under the Apache License, Version 2.0 (the "License");\r
   9  * * you may not use this file except in compliance with the License.\r
  10  * * You may obtain a copy of the License at\r
  11  * * \r
  12  *  *      http://www.apache.org/licenses/LICENSE-2.0\r
  13  * * \r
  14  *  * Unless required by applicable law or agreed to in writing, software\r
  15  * * distributed under the License is distributed on an "AS IS" BASIS,\r
  16  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  17  * * See the License for the specific language governing permissions and\r
  18  * * limitations under the License.\r
  19  * * ============LICENSE_END====================================================\r
  20  * *\r
  21  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
  22  * *\r
  23  ******************************************************************************/\r
  24 package com.att.authz.org;\r
  25 \r
  26 import java.util.ArrayList;\r
  27 import java.util.Date;\r
  28 import java.util.GregorianCalendar;\r
  29 import java.util.HashSet;\r
  30 import java.util.List;\r
  31 import java.util.Set;\r
  32 \r
  33 import com.att.authz.env.AuthzTrans;\r
  34 \r
  35 /**\r
  36  * Organization\r
  37  * \r
  38  * There is Organizational specific information required which we have extracted to a plugin\r
  39  * \r
  40  * It supports using Company Specific User Directory lookups, as well as supporting an\r
  41  * Approval/Validation Process to simplify control of Roles and Permissions for large organizations\r
  42  * in lieu of direct manipulation by a set of Admins. \r
  43  *  \r
  44  *\r
  45  */\r
  46 public interface Organization {\r
  47         public static final String N_A = "n/a";\r
  48 \r
  49         public interface Identity {\r
  50                 public String id();\r
  51                 public String fullID();                                 // Fully Qualified ID (includes Domain of Organization)\r
  52                 public String type();                                   // Must be one of "IdentityTypes", see below\r
  53                 public String responsibleTo();          // Chain of Command, Comma Separated if required\r
  54                 public List<String> delegate();                 // Someone who has authority to act on behalf of Identity\r
  55                 public String email();\r
  56                 public String fullName();\r
  57                 public boolean isResponsible();                 // Is id passed belong to a person suitable to be Responsible for content Management\r
  58                 public boolean isFound();                               // Is Identity found in Identity stores\r
  59                 public Identity owner() throws OrganizationException;                                   // Identity is directly responsible for App ID\r
  60                 public Organization org();                              // Organization of Identity\r
  61         }\r
  62 \r
  63 \r
  64         /**\r
  65          * Name of Organization, suitable for Logging\r
  66          * @return\r
  67          */\r
  68         public String getName();\r
  69 \r
  70         /**\r
  71          * Realm, for use in distinguishing IDs from different systems/Companies\r
  72          * @return\r
  73          */\r
  74         public String getRealm();\r
  75 \r
  76         String getDomain();\r
  77 \r
  78         /**\r
  79          * Get Identity information based on userID\r
  80          * \r
  81          * @param id\r
  82          * @return\r
  83          */\r
  84         public Identity getIdentity(AuthzTrans trans, String id) throws OrganizationException;\r
  85         \r
  86 \r
  87         /**\r
  88          * Does the ID pass Organization Standards\r
  89          * \r
  90          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of \r
  91          * reasons why it fails\r
  92          * \r
  93          * @param id\r
  94          * @return\r
  95          */\r
  96         public String isValidID(String id);\r
  97 \r
  98         /**\r
  99          * Return a Blank (empty) String if empty, otherwise, return a "\n" separated list of \r
 100          * reasons why it fails\r
 101          *  \r
 102          *  Identity is passed in to allow policies regarding passwords that are the same as user ID\r
 103          *  \r
 104          *  any entries for "prev" imply a reset\r
 105          *  \r
 106          * @param id\r
 107          * @param password\r
 108          * @return\r
 109          */\r
 110         public String isValidPassword(String user, String password, String ... prev);\r
 111 \r
 112 \r
 113         /**\r
 114          * Does your Company distinguish essential permission structures by kind of Identity?\r
 115          * i.e. Employee, Contractor, Vendor \r
 116          * @return\r
 117          */\r
 118         public Set<String> getIdentityTypes();\r
 119 \r
 120         public enum Notify {\r
 121                 Approval(1),\r
 122                 PasswordExpiration(2),\r
 123         RoleExpiration(3);\r
 124 \r
 125                 final int id;\r
 126                 Notify(int id) {this.id = id;}\r
 127                 public int getValue() {return id;}\r
 128                 public static Notify from(int type) {\r
 129                         for(Notify t : Notify.values()) {\r
 130                                 if(t.id==type) {\r
 131                                         return t;\r
 132                                 }\r
 133                         }\r
 134                         return null;\r
 135                 }\r
 136         }\r
 137 \r
 138         public enum Response{\r
 139                 OK,\r
 140                 ERR_NotImplemented,\r
 141                 ERR_UserNotExist,\r
 142                 ERR_NotificationFailure,\r
 143                 };\r
 144                 \r
 145         public enum Expiration {\r
 146                 Password,\r
 147                 TempPassword, \r
 148                 Future,\r
 149                 UserInRole,\r
 150                 UserDelegate, \r
 151                 ExtendPassword\r
 152         }\r
 153         \r
 154         public enum Policy {\r
 155                 CHANGE_JOB, \r
 156                 LEFT_COMPANY, \r
 157                 CREATE_MECHID, \r
 158                 CREATE_MECHID_BY_PERM_ONLY,\r
 159                 OWNS_MECHID,\r
 160                 AS_EMPLOYEE, \r
 161                 MAY_EXTEND_CRED_EXPIRES\r
 162         }\r
 163         \r
 164         /**\r
 165          * Notify a User of Action or Info\r
 166          * \r
 167          * @param type\r
 168          * @param url\r
 169          * @param users (separated by commas)\r
 170          * @param ccs (separated by commas)\r
 171          * @param summary\r
 172          */\r
 173 \r
 174     public Response notify(AuthzTrans trans, Notify type, String url, String ids[], String ccs[], String summary, Boolean urgent);\r
 175 \r
 176         /**\r
 177          * (more) generic way to send an email\r
 178          * \r
 179          * @param toList\r
 180          * @param ccList\r
 181          * @param subject\r
 182          * @param body\r
 183          * @param urgent\r
 184          */\r
 185 \r
 186         public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, String subject, String body, Boolean urgent) throws OrganizationException;\r
 187 \r
 188         /**\r
 189          * whenToValidate\r
 190          * \r
 191          * Authz support services will ask the Organization Object at startup when it should\r
 192          * kickoff Validation processes given particular types. \r
 193          * \r
 194          * This allows the Organization to express Policy\r
 195          * \r
 196          * Turn off Validation behavior by returning "null"\r
 197          * \r
 198          */\r
 199         public Date whenToValidate(Notify type, Date lastValidated);\r
 200 \r
 201         \r
 202         /**\r
 203          * Expiration\r
 204          * \r
 205          * Given a Calendar item of Start (or now), set the Expiration Date based on the Policy\r
 206          * based on type.\r
 207          * \r
 208          * For instance, "Passwords expire in 3 months"\r
 209          * \r
 210          * The Extra Parameter is used by certain Orgs.\r
 211          * \r
 212          * For Password, the extra is UserID, so it can check the Identity Type\r
 213          * \r
 214          * @param gc\r
 215          * @param exp\r
 216          * @return\r
 217          */\r
 218         public GregorianCalendar expiration(GregorianCalendar gc, Expiration exp, String ... extra);\r
 219         \r
 220         /**\r
 221          * Get Email Warning timing policies\r
 222          * @return\r
 223          */\r
 224         public EmailWarnings emailWarningPolicy();\r
 225 \r
 226         /**\r
 227          * \r
 228          * @param trans\r
 229          * @param user\r
 230          * @return\r
 231          */\r
 232         public List<Identity> getApprovers(AuthzTrans trans, String user) throws OrganizationException ;\r
 233         \r
 234         /*\r
 235          * \r
 236          * @param user\r
 237          * @param type\r
 238          * @param users\r
 239          * @return\r
 240         public Response notifyRequest(AuthzTrans trans, String user, Approval type, List<User> approvers);\r
 241         */\r
 242         \r
 243         /**\r
 244          * \r
 245          * @return\r
 246          */\r
 247         public String getApproverType();\r
 248 \r
 249         /*\r
 250          * startOfDay - define for company what hour of day business starts (specifically for password and other expiration which\r
 251          *   were set by Date only.)\r
 252          *    \r
 253          * @return\r
 254          */\r
 255         public int startOfDay();\r
 256 \r
 257     /**\r
 258      * implement this method to support any IDs that can have multiple entries in the cred table\r
 259      * NOTE: the combination of ID/expiration date/(encryption type when implemented) must be unique.\r
 260      *           Since expiration date is based on startOfDay for your company, you cannot create many\r
 261      *           creds for the same ID in the same day.\r
 262      * @param id\r
 263      * @return\r
 264      */\r
 265     public boolean canHaveMultipleCreds(String id);\r
 266     \r
 267     /**\r
 268      * \r
 269      * @param id\r
 270      * @return\r
 271      */\r
 272     public boolean isValidCred(String id);\r
 273     \r
 274     /**\r
 275      * If response is Null, then it is valid.  Otherwise, the Organization specific reason is returned.\r
 276      *  \r
 277      * @param trans\r
 278      * @param policy\r
 279      * @param executor\r
 280      * @param vars\r
 281      * @return\r
 282      * @throws OrganizationException\r
 283      */\r
 284     public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars) throws OrganizationException;\r
 285 \r
 286         boolean isTestEnv();\r
 287 \r
 288         public void setTestMode(boolean dryRun);\r
 289 \r
 290         public static final Organization NULL = new Organization() \r
 291         {\r
 292                 private final GregorianCalendar gc = new GregorianCalendar(1900, 1, 1);\r
 293                 private final List<Identity> nullList = new ArrayList<Identity>();\r
 294                 private final Set<String> nullStringSet = new HashSet<String>();\r
 295                 private final Identity nullIdentity = new Identity() {\r
 296                         List<String> nullIdentity = new ArrayList<String>();\r
 297                         @Override\r
 298                         public String type() {\r
 299                                 return N_A;\r
 300                         }\r
 301                         @Override\r
 302                         public String responsibleTo() {\r
 303                                 return N_A;\r
 304                         }\r
 305                         @Override\r
 306                         public boolean isResponsible() {\r
 307                                 return false;\r
 308                         }\r
 309                         \r
 310                         @Override\r
 311                         public boolean isFound() {\r
 312                                 return false;\r
 313                         }\r
 314                         \r
 315                         @Override\r
 316                         public String id() {\r
 317                                 return N_A;\r
 318                         }\r
 319                         \r
 320                         @Override\r
 321                         public String fullID() {\r
 322                                 return N_A;\r
 323                         }\r
 324                         \r
 325                         @Override\r
 326                         public String email() {\r
 327                                 return N_A;\r
 328                         }\r
 329                         \r
 330                         @Override\r
 331                         public List<String> delegate() {\r
 332                                 return nullIdentity;\r
 333                         }\r
 334                         @Override\r
 335                         public String fullName() {\r
 336                                 return N_A;\r
 337                         }\r
 338                         @Override\r
 339                         public Identity owner() {\r
 340                                 return null;\r
 341                         }\r
 342                         @Override\r
 343                         public Organization org() {\r
 344                                 return NULL;\r
 345                         }\r
 346                 };\r
 347 \r
 348                 @Override\r
 349                 public String getName() {\r
 350                         return N_A;\r
 351                 }\r
 352         \r
 353                 @Override\r
 354                 public String getRealm() {\r
 355                         return N_A;\r
 356                 }\r
 357         \r
 358                 @Override\r
 359                 public String getDomain() {\r
 360                         return N_A;\r
 361                 }\r
 362         \r
 363                 @Override\r
 364                 public Identity getIdentity(AuthzTrans trans, String id) {\r
 365                         return nullIdentity;\r
 366                 }\r
 367         \r
 368                 @Override\r
 369                 public String isValidID(String id) {\r
 370                         return N_A;\r
 371                 }\r
 372         \r
 373                 @Override\r
 374                 public String isValidPassword(String user, String password,String... prev) {\r
 375                         return N_A;\r
 376                 }\r
 377         \r
 378                 @Override\r
 379                 public Set<String> getIdentityTypes() {\r
 380                         return nullStringSet;\r
 381                 }\r
 382         \r
 383                 @Override\r
 384                 public Response notify(AuthzTrans trans, Notify type, String url,\r
 385                                 String[] users, String[] ccs, String summary, Boolean urgent) {\r
 386                         return Response.ERR_NotImplemented;\r
 387                 }\r
 388         \r
 389                 @Override\r
 390                 public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList,\r
 391                                 String subject, String body, Boolean urgent) throws OrganizationException {\r
 392                         return 0;\r
 393                 }\r
 394         \r
 395                 @Override\r
 396                 public Date whenToValidate(Notify type, Date lastValidated) {\r
 397                         return gc.getTime();\r
 398                 }\r
 399         \r
 400                 @Override\r
 401                 public GregorianCalendar expiration(GregorianCalendar gc,\r
 402                                 Expiration exp, String... extra) {\r
 403                         return gc==null?new GregorianCalendar():gc;\r
 404                 }\r
 405         \r
 406                 @Override\r
 407                 public List<Identity> getApprovers(AuthzTrans trans, String user)\r
 408                                 throws OrganizationException {\r
 409                         return nullList;\r
 410                 }\r
 411         \r
 412                 @Override\r
 413                 public String getApproverType() {\r
 414                         return "";\r
 415                 }\r
 416         \r
 417                 @Override\r
 418                 public int startOfDay() {\r
 419                         return 0;\r
 420                 }\r
 421         \r
 422                 @Override\r
 423                 public boolean canHaveMultipleCreds(String id) {\r
 424                         return false;\r
 425                 }\r
 426         \r
 427                 @Override\r
 428                 public boolean isValidCred(String id) {\r
 429                         return false;\r
 430                 }\r
 431         \r
 432                 @Override\r
 433                 public String validate(AuthzTrans trans, Policy policy, Executor executor, String ... vars)\r
 434                                 throws OrganizationException {\r
 435                         return "Null Organization rejects all Policies";\r
 436                 }\r
 437         \r
 438                 @Override\r
 439                 public boolean isTestEnv() {\r
 440                         return false;\r
 441                 }\r
 442         \r
 443                 @Override\r
 444                 public void setTestMode(boolean dryRun) {\r
 445                 }\r
 446 \r
 447                 @Override\r
 448                 public EmailWarnings emailWarningPolicy() {\r
 449                         return new EmailWarnings() {\r
 450 \r
 451                                 @Override\r
 452                             public long credEmailInterval()\r
 453                             {\r
 454                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7\r
 455                             }\r
 456                             \r
 457                                 @Override\r
 458                             public long roleEmailInterval()\r
 459                             {\r
 460                                 return 604800000L; // 7 days in millis 1000 * 86400 * 7\r
 461                             }\r
 462                                 \r
 463                                 @Override\r
 464                                 public long apprEmailInterval() {\r
 465                                 return 259200000L; // 3 days in millis 1000 * 86400 * 3\r
 466                                 }\r
 467                             \r
 468                                 @Override\r
 469                             public long  credExpirationWarning()\r
 470                             {\r
 471                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds\r
 472                             }\r
 473                             \r
 474                                 @Override\r
 475                             public long roleExpirationWarning()\r
 476                             {\r
 477                                 return( 2592000000L ); // One month, in milliseconds 1000 * 86400 * 30  in milliseconds\r
 478                             }\r
 479 \r
 480                                 @Override\r
 481                             public long emailUrgentWarning()\r
 482                             {\r
 483                                 return( 1209600000L ); // Two weeks, in milliseconds 1000 * 86400 * 14  in milliseconds\r
 484                             }\r
 485 \r
 486                         };\r
 487                 }\r
 488         };\r
 489 }\r
 490 \r
 491 \r