cadi/core/src/main/java/org/onap/aaf/cadi/taf/HttpEpiTaf.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.cadi.taf;
  23
  24 import java.net.URI;
  25 import java.security.Principal;
  26 import java.util.ArrayList;
  27 import java.util.List;
  28
  29 import javax.servlet.http.HttpServletRequest;
  30 import javax.servlet.http.HttpServletResponse;
  31
  32 import org.onap.aaf.cadi.Access;
  33 import org.onap.aaf.cadi.Access.Level;
  34 import org.onap.aaf.cadi.CachedPrincipal;
  35 import org.onap.aaf.cadi.CachedPrincipal.Resp;
  36 import org.onap.aaf.cadi.CadiException;
  37 import org.onap.aaf.cadi.Locator;
  38 import org.onap.aaf.cadi.Taf.LifeForm;
  39 import org.onap.aaf.cadi.TrustChecker;
  40
  41 /**
  42  * HttpEpiTaf
  43  *
  44  * An extension of the basic "EpiTAF" concept, check known HTTP Related TAFs for valid credentials
  45  *
  46  * @author Jonathan
  47  *
  48  */
  49 public class HttpEpiTaf implements HttpTaf {
  50         private HttpTaf[] tafs;
  51         private Access access;
  52         private Locator<URI> locator;
  53         private TrustChecker trustChecker;
  54
  55         /**
  56          * HttpEpiTaf constructor
  57          *
  58          * Construct the HttpEpiTaf from variable Http specific TAF parameters
  59
  60          * @param tafs
  61          * @throws CadiException
  62          */
  63         public HttpEpiTaf(Access access, Locator<URI> locator, TrustChecker tc, HttpTaf ... tafs) throws CadiException{
  64                 this.tafs = tafs;
  65                 this.access = access;
  66                 this.locator = locator;
  67                 this.trustChecker = tc;
  68                 // Establish what Header Property to look for UserChain/Trust Props
  69 //              trustChainProp = access.getProperty(Config.CADI_TRUST_PROP, Config.CADI_TRUST_PROP_DEFAULT);
  70
  71                 if(tafs.length==0) throw new CadiException("Need at least one HttpTaf implementation in constructor");
  72         }
  73
  74         /**
  75          * validate
  76          *
  77          * Respond with the first Http specific TAF to authenticate user based on variable info
  78          * and "LifeForm" (is it a human behind a browser, or a server utilizing HTTP Protocol).
  79          *
  80          * If there is no HttpTAF that can authenticate, respond with the first TAF that suggests it can
  81          * establish an Authentication conversation (TRY_AUTHENTICATING) (Examples include a redirect to CSP
  82          * Servers for CSP Cookie, or BasicAuth 401 response, suggesting User/Password for given Realm
  83          * submission
  84          *
  85          * If no TAF declares either, respond with NullTafResp (which denies all questions)
  86          */
  87         public TafResp validate(LifeForm reading, HttpServletRequest req, HttpServletResponse resp) {
  88                 // Given a LifeForm Neutral, for HTTP, we need to discover true Life-Form Readings
  89                 if(reading==LifeForm.LFN) {
  90                         reading = tricorderScan(req);
  91                 }
  92                 TafResp tresp=null, firstTry = null;
  93                 List<Redirectable> redirectables = null;
  94                 List<TafResp> trlog = access.willLog(Level.DEBUG)?new ArrayList<TafResp>():null;
  95                 try {
  96                         for(HttpTaf taf : tafs) {
  97                                 tresp = taf.validate(reading, req, resp);
  98                                 if(trlog!=null) {
  99                                         trlog.add(tresp);
 100                                 }
 101                                 switch(tresp.isAuthenticated()) {
 102                                         case TRY_ANOTHER_TAF:
 103                                                 break; // and loop
 104                                         case TRY_AUTHENTICATING:
 105                                                 if(tresp instanceof Redirectable) {
 106                                                         if(redirectables==null) {
 107                                                                 redirectables = new ArrayList<Redirectable>();
 108                                                         }
 109                                                         redirectables.add((Redirectable)tresp);
 110                                                 } else if(firstTry==null) {
 111                                                         firstTry = tresp;
 112                                                 }
 113                                                 break;
 114                                         case IS_AUTHENTICATED:
 115                                                 tresp = trustChecker.mayTrust(tresp, req);
 116                                                 return tresp;
 117                                         default:
 118                                                 return tresp;
 119                                 }
 120                         }
 121                 } finally {
 122                         if(trlog!=null) {
 123                                 for( TafResp tr : trlog) {
 124                                         access.log(Level.DEBUG, tr.desc());
 125                                 }
 126                         }
 127                 }
 128
 129                 // If No TAFs configured, at this point.  It is safer at this point to be "not validated",
 130                 // rather than "let it go"
 131                 // Note: if exists, there will always be more than 0 entries, according to above code
 132                 if(redirectables==null) {
 133                         return firstTry!=null?firstTry:NullTafResp.singleton();
 134                 }
 135
 136                 // If there is one Tryable entry then return it
 137                 if(redirectables.size()>1) {
 138                         return LoginPageTafResp.create(access,locator,resp,redirectables);
 139                 } else {
 140                         return redirectables.get(0);
 141                 }
 142         }
 143
 144         public boolean revalidate(Principal prin) throws Exception {
 145                 return false;
 146         }
 147
 148         /*
 149          * Since this is internal, we use a little Star Trek humor to indicate looking in the HTTP Request to see if we can determine what kind
 150          * of "LifeForm" reading we can determine, i.e. is there a Human (CarbonBasedLifeForm) behind a browser, or is it mechanical
 151          * id (SiliconBasedLifeForm)?  This makes a difference in some Authentication, i.e CSP, which doesn't work well for SBLFs
 152          */
 153         private LifeForm tricorderScan(HttpServletRequest req) {
 154                 // For simplicity's sake, we'll say Humans use FQDNs, not IPs.
 155
 156                 // Current guess that only Browsers bother to set "Agent" codes that identify the kind of browser they are.
 157                 // If mechanical frameworks are found that populate this, then more advanced analysis may be required
 158                 // Jonathan 1/22/2013
 159                 String agent = req.getHeader("User-Agent");
 160                 if(agent!=null && agent.startsWith("Mozilla")) { // covers I.E./Firefox/Safari/probably any other "advanced" Browser see http://en.wikipedia.org/wiki/User_agent
 161                         return LifeForm.CBLF;
 162                 }
 163                 return LifeForm.SBLF;                                                   // notably skips "curl","wget", (which is desired behavior.  We don't want to try CSP, etc on these)
 164         }
 165
 166         public Resp revalidate(CachedPrincipal prin, Object state) {
 167                 Resp resp;
 168                 for(HttpTaf taf : tafs) {
 169                         resp = taf.revalidate(prin,state);
 170                         switch(resp) {
 171                                 case NOT_MINE:
 172                                         break;
 173                                 default:
 174                                         return resp;
 175                         }
 176                 }
 177                 return Resp.NOT_MINE;
 178         }
 179
 180         /**
 181          * List HttpTafs with their "toString" representations... primarily useful for Debugging in an IDE
 182          * like Eclipse.
 183          */
 184         public String toString() {
 185                 StringBuilder sb = new StringBuilder();
 186                 for(HttpTaf ht : tafs) {
 187                         sb.append(ht.toString());
 188                         sb.append(". ");
 189                 }
 190                 return sb.toString();
 191         }
 192 }