import java.util.regex.Pattern;
import org.onap.aaf.auth.env.AuthzTrans;
+import org.onap.aaf.auth.local.AbsData.Reuse;
import org.onap.aaf.auth.org.EmailWarnings;
import org.onap.aaf.auth.org.Executor;
import org.onap.aaf.auth.org.Mailer;
import org.onap.aaf.auth.org.Organization;
import org.onap.aaf.auth.org.OrganizationException;
+import org.onap.aaf.cadi.config.Config;
import org.onap.aaf.cadi.util.FQI;
import org.onap.aaf.misc.env.Env;
+import org.onap.aaf.org.Identities.Data;
public class DefaultOrg implements Organization {
private static final String AAF_DATA_DIR = "aaf_data_dir";
final String atDomain;
final String realm;
+ private final String root_ns;
+
private final String NAME;
private final Set<String> supportedRealms;
+
public DefaultOrg(Env env, String realm) throws OrganizationException {
this.realm = realm;
domain=FQI.reverseDomain(realm);
atDomain = '@'+domain;
NAME=env.getProperty(realm + ".name","Default Organization");
-
+ root_ns = env.getProperty(Config.AAF_ROOT_NS,Config.AAF_ROOT_NS_DEF);
+
try {
- String defFile;
- String temp=env.getProperty(defFile = (getClass().getName()+".file"));
+ String temp=env.getProperty(realm +".file");
File fIdentities=null;
if (temp==null) {
temp = env.getProperty(AAF_DATA_DIR);
if (temp!=null) {
- env.warn().log(defFile, " is not defined. Using default: ",temp+"/identities.dat");
+ env.warn().log("Datafile for " + realm + " is not defined. Using default: ",temp+"/identities.dat");
File dir = new File(temp);
fIdentities=new File(dir,"identities.dat");
}
fIdentities.createNewFile();
}
+
}
} else {
fIdentities = new File(temp);
throw new OrganizationException(fIdentities.getCanonicalPath() + " does not exist.");
}
}
+
+ File fRevoked=null;
+ temp=env.getProperty(getClass().getName()+".file.revoked");
+ if(temp==null) {
+ temp = env.getProperty(AAF_DATA_DIR);
+ if (temp!=null) {
+ File dir = new File(temp);
+ fRevoked=new File(dir,"revoked.dat");
+ }
+ } else {
+ fRevoked = new File(temp);
+ }
+ if (fRevoked!=null && fRevoked.exists()) {
+ revoked = new Identities(fRevoked);
+ } else {
+ revoked = null;
+ }
+
} catch (IOException e) {
throw new OrganizationException(e);
}
static final List<String> NULL_DELEGATES = new ArrayList<>();
public Identities identities;
+ public Identities revoked;
private boolean dryRun;
private Mailer mailer;
public enum Types {Employee, Contractor, Application, NotActive};
return new DefaultOrgIdentity(trans,at<0?id:id.substring(0, at),this);
}
+ /**
+ * If the ID isn't in the revoked file, if it exists, it is revoked.
+ */
+ @Override
+ public Date isRevoked(AuthzTrans trans, String key) {
+ if(revoked!=null) {
+ try {
+ revoked.open(trans, DefaultOrgIdentity.TIMEOUT);
+ try {
+ Reuse r = revoked.reuse();
+ int at = key.indexOf(domain);
+ String search;
+ if (at>=0) {
+ search = key.substring(0,at);
+ } else {
+ search = key;
+ }
+ Data revokedData = revoked.find(search, r);
+ return revokedData==null?null:new Date();
+ } finally {
+ revoked.close(trans);
+ }
+ } catch (IOException e) {
+ trans.error().log(e);
+ }
+ }
+ return null;
+ }
+
+ /* (non-Javadoc)
+ * @see org.onap.aaf.auth.org.Organization#getEsclaations(org.onap.aaf.auth.env.AuthzTrans, java.lang.String, int)
+ */
+ @Override
+ public List<Identity> getIDs(AuthzTrans trans, String user, int escalate) throws OrganizationException {
+ List<Identity> rv = new ArrayList<>();
+ int end = Math.min(3,Math.abs(escalate));
+ Identity id = null;
+ for(int i=0;i<end;++i) {
+ if(id==null) {
+ id = getIdentity(trans,user);
+ } else {
+ id = id.responsibleTo();
+ }
+ if(id==null) {
+ break;
+ } else {
+ rv.add(id);
+ }
+ }
+ return rv;
+ }
+
// Note: Return a null if found; return a String Message explaining why not found.
@Override
public String isValidID(final AuthzTrans trans, final String id) {
/**
* ( # Start of group
* (?=.*[a-z,A-Z]) # must contain one character
- *
- * (?=.*\d) # must contain one digit from 0-9
+ *
+ * (?=.*\d) # must contain one digit from 0-9
* OR
* (?=.*[@#$%]) # must contain one special symbols in the list SPEC_CHARS
- *
+ *
* . # match anything with previous condition checking
* {6,20} # length at least 6 characters and maximum of 20
* ) # End of group
now.add(GregorianCalendar.MONTH, 6);
rv = now;
break;
+ case RevokedGracePeriodEnds:
+ now.add(GregorianCalendar.DATE, 3);
+ rv = now;
+ break;
default:
// Unless other wise set, 6 months is default
now.add(GregorianCalendar.MONTH, 6);
@Override
public String validate(AuthzTrans trans, Policy policy, Executor executor, String... vars) throws OrganizationException {
+ String user;
switch(policy) {
case OWNS_MECHID:
case CREATE_MECHID:
case CREATE_MECHID_BY_PERM_ONLY:
return getName() + " only allows sponsors to create MechIDs";
+ case MAY_EXTEND_CRED_EXPIRES:
+ // If parm, use it, otherwise, trans
+ user = vars.length>1?vars[1]:trans.user();
+ return executor.hasPermission(user, root_ns,"password", root_ns , "extend")
+ ?null:user + " does not have permission to extend passwords at " + getName();
+
default:
return policy.name() + " is unsupported at " + getName();
}
}
return false;
}
+
+ @Override
+ public String supportedDomain(String user) {
+ if(user!=null) {
+ int after_at = user.indexOf('@')+1;
+ if(after_at<user.length()) {
+ String ud = FQI.reverseDomain(user);
+ if(ud.startsWith(getDomain())) {
+ return getDomain();
+ }
+ for(String s : supportedRealms) {
+ if(ud.startsWith(s)) {
+ return FQI.reverseDomain(s);
+ }
+ }
+ }
+ }
+ return null;
+ }
@Override
public synchronized void addSupportedRealm(final String r) {
public int sendEmail(AuthzTrans trans, List<String> toList, List<String> ccList, String subject, String body,
Boolean urgent) throws OrganizationException {
if (mailer!=null) {
- String mailFrom = mailer.mailFrom();
+ String mailFrom = mailer.mailFrom();
List<String> to = new ArrayList<>();
for (String em : toList) {
if (em.indexOf('@')<0) {
}
}
- return mailer.sendEmail(trans,dryRun,mailFrom,to,cc,subject,body,urgent);
+ return mailer.sendEmail(trans,dryRun?"DefaultOrg":null,to,cc,subject,body,urgent)?0:1;
} else {
return 0;
}
}
- @Override
- public boolean mayAutoDelete(AuthzTrans trans, String user) {
- // provide a corresponding feed that indicates that an ID has been intentionally removed from identities.dat table.
- return false;
- }
+ @Override
+ public boolean isUserExpireExempt(String user, Date expires) {
+ return false;
+ }
}
Code Review / aaf / authz.git / blobdiff