cadi/shiro/src/main/java/org/onap/aaf/cadi/shiro/AAFRealm.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21 package org.onap.aaf.cadi.shiro;
  22
  23 import java.io.IOException;
  24 import java.security.Principal;
  25 import java.util.ArrayList;
  26 import java.util.HashSet;
  27 import java.util.List;
  28
  29 import org.apache.shiro.authc.AuthenticationException;
  30 import org.apache.shiro.authc.AuthenticationInfo;
  31 import org.apache.shiro.authc.AuthenticationToken;
  32 import org.apache.shiro.authc.UsernamePasswordToken;
  33 import org.apache.shiro.realm.AuthorizingRealm;
  34 import org.apache.shiro.subject.PrincipalCollection;
  35 import org.onap.aaf.cadi.Access.Level;
  36 import org.onap.aaf.cadi.CadiException;
  37 import org.onap.aaf.cadi.LocatorException;
  38 import org.onap.aaf.cadi.Permission;
  39 import org.onap.aaf.cadi.PropAccess;
  40 import org.onap.aaf.cadi.aaf.v2_0.AAFAuthn;
  41 import org.onap.aaf.cadi.aaf.v2_0.AAFCon;
  42 import org.onap.aaf.cadi.aaf.v2_0.AAFLurPerm;
  43 import org.onap.aaf.cadi.config.Config;
  44 import org.onap.aaf.misc.env.APIException;
  45
  46 public class AAFRealm extends AuthorizingRealm {
  47         public static final String AAF_REALM = "AAFRealm";
  48
  49         private PropAccess access;
  50         private AAFCon<?> acon;
  51         private AAFAuthn<?> authn;
  52         private HashSet<Class<? extends AuthenticationToken>> supports;
  53         private AAFLurPerm authz;
  54
  55
  56         /**
  57          *
  58          * There appears to be no configuration objects or references available for CADI to start with.
  59          *
  60          */
  61         public AAFRealm () {
  62                 access = new PropAccess(); // pick up cadi_prop_files from VM_Args
  63                 String cadi_prop_files = access.getProperty(Config.CADI_PROP_FILES);
  64                 if(cadi_prop_files==null) {
  65                         String msg = Config.CADI_PROP_FILES + " in VM Args is required to initialize AAFRealm.";
  66                         access.log(Level.INIT,msg);
  67                         throw new RuntimeException(msg);
  68                 } else {
  69                         try {
  70                                 acon = AAFCon.newInstance(access);
  71                                 authn = acon.newAuthn();
  72                                 authz = acon.newLur(authn);
  73                         } catch (APIException | CadiException | LocatorException e) {
  74                                 String msg = "Cannot initiate AAFRealm";
  75                                 access.log(Level.INIT,msg,e.getMessage());
  76                                 throw new RuntimeException(msg,e);
  77                         }
  78                 }
  79                 supports = new HashSet<Class<? extends AuthenticationToken>>();
  80                 supports.add(UsernamePasswordToken.class);
  81         }
  82
  83         @Override
  84         protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  85                 access.log(Level.DEBUG, "AAFRealm.doGetAuthenticationInfo",token);
  86
  87                 final UsernamePasswordToken upt = (UsernamePasswordToken)token;
  88                 String password=new String(upt.getPassword());
  89                 String err;
  90                 try {
  91                         err = authn.validate(upt.getUsername(),password);
  92                 } catch (IOException|CadiException e) {
  93                         err = "Credential cannot be validated";
  94                         access.log(e, err);
  95                 }
  96
  97                 if(err != null) {
  98                         access.log(Level.DEBUG, err);
  99                         throw new AuthenticationException(err);
 100                 }
 101
 102             return new AAFAuthenticationInfo(
 103                         access,
 104                         upt.getUsername(),
 105                         password
 106             );
 107         }
 108
 109         @Override
 110         protected void assertCredentialsMatch(AuthenticationToken atoken, AuthenticationInfo ai)throws AuthenticationException {
 111                 if(ai instanceof AAFAuthenticationInfo) {
 112                         if(!((AAFAuthenticationInfo)ai).matches(atoken)) {
 113                                 throw new AuthenticationException("Credentials do not match");
 114                         }
 115                 } else {
 116                         throw new AuthenticationException("AuthenticationInfo is not an AAFAuthenticationInfo");
 117                 }
 118         }
 119
 120
 121         @Override
 122         protected AAFAuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
 123                 access.log(Level.DEBUG, "AAFRealm.doGetAuthenthorizationInfo");
 124                 Principal bait = (Principal)principals.getPrimaryPrincipal();
 125                 List<Permission> pond = new ArrayList<Permission>();
 126                 authz.fishAll(bait,pond);
 127
 128                 return new AAFAuthorizationInfo(access,bait,pond);
 129
 130         }
 131
 132         @Override
 133         public boolean supports(AuthenticationToken token) {
 134                 return supports.contains(token.getClass());
 135         }
 136
 137         @Override
 138         public String getName() {
 139                 return AAF_REALM;
 140         }
 141
 142 }