Improved multi Proxy DNSLocator based 74/95774/1
authorInstrumental <jonathan.gathman@att.com>
Mon, 16 Sep 2019 14:22:24 +0000 (09:22 -0500)
committerInstrumental <jonathan.gathman@att.com>
Mon, 16 Sep 2019 21:16:51 +0000 (16:16 -0500)
Issue-ID: AAF-961
Change-Id: I21d4a8013ca6f65306e32c5a2e2fa4ba230df2b7
Signed-off-by: Instrumental <jonathan.gathman@att.com>
15 files changed:
auth/auth-batch/src/main/java/org/onap/aaf/auth/batch/helpers/BatchDataView.java
auth/auth-batch/src/main/java/org/onap/aaf/auth/batch/helpers/Visitor.java
auth/auth-batch/src/main/java/org/onap/aaf/auth/batch/reports/ApprovedRpt.java
auth/auth-batch/src/main/java/org/onap/aaf/auth/batch/reports/bodies/NotifyCredBody.java
auth/auth-batch/src/main/java/org/onap/aaf/auth/batch/reports/bodies/OneMonthNotifyCredBody.java
auth/auth-batch/src/main/java/org/onap/aaf/auth/batch/reports/bodies/OneWeekNotifyCredBody.java
auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Question.java
auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/service/CMService.java
auth/auth-core/src/main/java/org/onap/aaf/auth/env/AuthzTransFilter.java
auth/auth-service/src/main/java/org/onap/aaf/auth/service/api/API_Creds.java
cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFAuthn.java
cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFCon.java
cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AbsAAFLocator.java
cadi/core/src/main/java/org/onap/aaf/cadi/User.java
cadi/core/src/main/java/org/onap/aaf/cadi/util/CSV.java

index d3209a0..b5d25a4 100644 (file)
@@ -20,7 +20,6 @@
  */
 package org.onap.aaf.auth.batch.helpers;
 
  */
 package org.onap.aaf.auth.batch.helpers;
 
-import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
 
 import java.util.ArrayList;
 import java.util.List;
 
@@ -34,7 +33,6 @@ import org.onap.aaf.auth.dao.cass.UserRoleDAO.Data;
 import org.onap.aaf.auth.env.AuthzTrans;
 import org.onap.aaf.auth.layer.Result;
 import org.onap.aaf.cadi.Hash;
 import org.onap.aaf.auth.env.AuthzTrans;
 import org.onap.aaf.auth.layer.Result;
 import org.onap.aaf.cadi.Hash;
-import org.onap.aaf.misc.env.APIException;
 import org.onap.aaf.misc.env.TimeTaken;
 import org.onap.aaf.misc.env.Trans;
 import org.onap.aaf.misc.env.util.Chrono;
 import org.onap.aaf.misc.env.TimeTaken;
 import org.onap.aaf.misc.env.Trans;
 import org.onap.aaf.misc.env.util.Chrono;
index 3e7b30b..38a7647 100644 (file)
@@ -3,7 +3,6 @@
  * org.onap.aaf
  * ===========================================================================
  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
  * org.onap.aaf
  * ===========================================================================
  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
- * Modifications Copyright (C) 2019 IBM.
  * ===========================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * ===========================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,7 +20,6 @@
 
 package org.onap.aaf.auth.batch.helpers;
 
 
 package org.onap.aaf.auth.batch.helpers;
 
-@FunctionalInterface
 public interface Visitor<T> {
     void visit(T t);
     
 public interface Visitor<T> {
     void visit(T t);
     
index ea196b1..b2fd8a9 100644 (file)
@@ -3,7 +3,6 @@
  * org.onap.aaf
  * ===========================================================================
  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
  * org.onap.aaf
  * ===========================================================================
  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
- * Modifications Copyright (C) 2019 IBM.
  * ===========================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * ===========================================================================
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -64,6 +63,13 @@ public class ApprovedRpt extends Batch {
         
         TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB);
         try {
         
         TimeTaken tt0 = trans.start("Cassandra Initialization", Env.SUB);
         try {
+//            TimeTaken tt = trans.start("Connect to Cluster", Env.REMOTE);
+//            try {
+//                session = cluster.connect();
+//            } finally {
+//                tt.done();
+//            }
+            
             now = new Date();
             String sdate = Chrono.dateOnlyStamp(now);
             File file = new File(logDir(),APPR_RPT + sdate +CSV);
             now = new Date();
             String sdate = Chrono.dateOnlyStamp(now);
             File file = new File(logDir(),APPR_RPT + sdate +CSV);
@@ -84,6 +90,29 @@ public class ApprovedRpt extends Batch {
             Map<String,Boolean> checked = new TreeMap<String, Boolean>();
             
             final AuthzTrans transNoAvg = trans.env().newTransNoAvg();
             Map<String,Boolean> checked = new TreeMap<String, Boolean>();
             
             final AuthzTrans transNoAvg = trans.env().newTransNoAvg();
+//            ResultSet results;
+//            Statement stmt = new SimpleStatement( "select dateof(id), approver, status, user, type, memo from authz.approved;" );
+//            results = session.execute(stmt);
+//            Iterator<Row> iter = results.iterator();
+//            Row row;
+            /*
+             *             while (iter.hasNext()) {
+                ++totalLoaded;
+                row = iter.next();
+                d = row.getTimestamp(0);
+                if(d.after(begin)) {
+                    approvedW.row("aprvd",
+                            Chrono.dateOnlyStamp(d),
+                            row.getString(1),
+                            row.getString(2),
+                            row.getString(3),
+                            row.getString(4),
+                            row.getString(5)
+                    );
+                }
+            }
+
+             */
             int totalLoaded = 0;
             Date d;
             GregorianCalendar gc = new GregorianCalendar();
             int totalLoaded = 0;
             Date d;
             GregorianCalendar gc = new GregorianCalendar();
index 8eaf6a8..7001c02 100644 (file)
@@ -22,7 +22,7 @@
  */
 package org.onap.aaf.auth.batch.reports.bodies;
 
  */
 package org.onap.aaf.auth.batch.reports.bodies;
 
-
+import java.io.IOException;
 import java.util.GregorianCalendar;
 import java.util.List;
 
 import java.util.GregorianCalendar;
 import java.util.List;
 
index 417d4be..8747ebf 100644 (file)
@@ -26,7 +26,7 @@ import org.onap.aaf.auth.batch.helpers.ExpireRange;
 import org.onap.aaf.cadi.Access;
 
 public class OneMonthNotifyCredBody extends NotifyCredBody {
 import org.onap.aaf.cadi.Access;
 
 public class OneMonthNotifyCredBody extends NotifyCredBody {
-    public OneMonthNotifyCredBody(Access access){
+    public OneMonthNotifyCredBody(Access access) throws IOException {
         super(access, ExpireRange.ONE_MONTH);
     }
     
         super(access, ExpireRange.ONE_MONTH);
     }
     
index dae48d8..a1277d5 100644 (file)
@@ -26,7 +26,7 @@ import org.onap.aaf.auth.batch.helpers.ExpireRange;
 import org.onap.aaf.cadi.Access;
 
 public class OneWeekNotifyCredBody extends NotifyCredBody {
 import org.onap.aaf.cadi.Access;
 
 public class OneWeekNotifyCredBody extends NotifyCredBody {
-    public OneWeekNotifyCredBody(Access access){
+    public OneWeekNotifyCredBody(Access access) throws IOException {
         super(access, ExpireRange.ONE_WEEK);
     }
 
         super(access, ExpireRange.ONE_WEEK);
     }
 
index 1b20b90..c7ee593 100644 (file)
@@ -26,12 +26,13 @@ import java.nio.ByteBuffer;
 import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.util.ArrayList;
-import java.util.Collections;
+import java.util.Collection;
 import java.util.Date;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.Date;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.TreeMap;
 import java.util.TreeSet;
 
 import org.onap.aaf.auth.common.Define;
 import java.util.TreeSet;
 
 import org.onap.aaf.auth.common.Define;
@@ -496,6 +497,7 @@ public class Question {
             Result<List<NsDAO.Data>> rld = nsDAO.read(trans, lookup);
             if (rld.isOKhasData()) {
                 nsd=rld.value.get(0);
             Result<List<NsDAO.Data>> rld = nsDAO.read(trans, lookup);
             if (rld.isOKhasData()) {
                 nsd=rld.value.get(0);
+                lookup = nsd.parent;
                 if (type.type == nsd.type) {
                     return Result.ok(nsd);
                 } else {
                 if (type.type == nsd.type) {
                     return Result.ok(nsd);
                 } else {
@@ -898,18 +900,28 @@ public class Question {
                 }
             } else {
                 Date now = new Date();
                 }
             } else {
                 Date now = new Date();
-                // Bug noticed 6/22. Sorting on the result can cause Concurrency Issues.     
-                List<CredDAO.Data> cddl;
+                // Bug noticed 6/22. Sorting on the result can cause Concurrency Issues.  
+                // 9/14/2019. Use TreeSet for sorting, and using only the LAST of a Tagged entry
+                Collection<CredDAO.Data> cddl;
                 if (result.value.size() > 1) {
                 if (result.value.size() > 1) {
-                    cddl = new ArrayList<>(result.value.size());
-                    for (CredDAO.Data old : result.value) {
-                        if (old.type==CredDAO.BASIC_AUTH || old.type==CredDAO.BASIC_AUTH_SHA256) {
-                            cddl.add(old);
+                       Map<String,CredDAO.Data> mcdd = new TreeMap<>();
+                       CredDAO.Data cdd;
+                       String tag;
+                       int pseudoTag = 0;
+                    for (CredDAO.Data rcdd : result.value) {
+                        if (rcdd.type==CredDAO.BASIC_AUTH || rcdd.type==CredDAO.BASIC_AUTH_SHA256) {
+                               if(rcdd.tag==null) {
+                                       mcdd.put(Integer.toString(++pseudoTag),rcdd);
+                               } else {
+                                       tag = rcdd.tag;
+                                       cdd = mcdd.get(tag);
+                                       if(cdd==null || cdd.expires.before(rcdd.expires)) {
+                                               mcdd.put(tag,rcdd);
+                                       }
+                               }
                         }
                     }
                         }
                     }
-                    if (cddl.size()>1) {
-                        Collections.sort(cddl, (a, b) -> b.expires.compareTo(a.expires));
-                    }
+                    cddl = mcdd.values();
                 } else {
                     cddl = result.value;
                 }
                 } else {
                     cddl = result.value;
                 }
index 4788ee4..aa145f1 100644 (file)
@@ -367,7 +367,7 @@ public class CMService {
                             for(Iterator<? extends Certificate> iter = certs.iterator(); iter.hasNext();) {
                                 X509Certificate x509 = (X509Certificate)iter.next();
                                 if(x509.getNotAfter().after(now) && x509.getSubjectDN().getName().contains(cn)) {
                             for(Iterator<? extends Certificate> iter = certs.iterator(); iter.hasNext();) {
                                 X509Certificate x509 = (X509Certificate)iter.next();
                                 if(x509.getNotAfter().after(now) && x509.getSubjectDN().getName().contains(cn)) {
-                                    if(++count>MAX_X509s) {
+                                    if(++count>max_509s) {
                                         break;
                                     }
                                 }
                                         break;
                                     }
                                 }
index e4420ab..bd9f887 100644 (file)
@@ -167,6 +167,8 @@ public class AuthzTransFilter extends TransFilter<AuthzTrans> {
 //            }
             sb.append(",ms=");
             sb.append(m.total);
 //            }
             sb.append(",ms=");
             sb.append(m.total);
+            sb.append(",status=");
+            sb.append(trans.hresp().getStatus());
             sb.append(",meth=");
             sb.append(trans.meth());
             sb.append(",path=");
             sb.append(",meth=");
             sb.append(trans.meth());
             sb.append(",path=");
index f7c3868..fbc1baa 100644 (file)
@@ -143,14 +143,16 @@ public class API_Creds {
                     AuthzTrans trans, 
                     HttpServletRequest req,
                     HttpServletResponse resp) throws Exception {
                     AuthzTrans trans, 
                     HttpServletRequest req,
                     HttpServletResponse resp) throws Exception {
-                
+                // will be a valid Entity.  Do we need to add permission
+               //if(trans.fish("ns","password","request")) or the like
                 Result<Date> r = context.doesCredentialMatch(trans, req, resp);
                 if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200);
                 } else {
                     // For Security, we don't give any info out on why failed, other than forbidden
                     // Can't do "401", because that is on the call itself
                 Result<Date> r = context.doesCredentialMatch(trans, req, resp);
                 if (r.isOK()) {
                     resp.setStatus(HttpStatus.OK_200);
                 } else {
                     // For Security, we don't give any info out on why failed, other than forbidden
                     // Can't do "401", because that is on the call itself
-                    resp.setStatus(HttpStatus.FORBIDDEN_403);
+                       // 403 Implies you MAY NOT Ask.
+                    resp.setStatus(HttpStatus.NOT_ACCEPTABLE_406);
                 }
             }
         });  
                 }
             }
         });  
index ec0875c..216468c 100644 (file)
@@ -29,9 +29,10 @@ import org.onap.aaf.cadi.CadiException;
 import org.onap.aaf.cadi.User;
 import org.onap.aaf.cadi.aaf.AAFPermission;
 import org.onap.aaf.cadi.client.Future;
 import org.onap.aaf.cadi.User;
 import org.onap.aaf.cadi.aaf.AAFPermission;
 import org.onap.aaf.cadi.client.Future;
-import org.onap.aaf.cadi.client.Rcli;
 import org.onap.aaf.cadi.lur.ConfigPrincipal;
 
 import org.onap.aaf.cadi.lur.ConfigPrincipal;
 
+import aaf.v2_0.CredRequest;
+
 public class AAFAuthn<CLIENT> extends AbsUserCache<AAFPermission> {
     private AAFCon<CLIENT> con;
     private String realm;
 public class AAFAuthn<CLIENT> extends AbsUserCache<AAFPermission> {
     private AAFCon<CLIENT> con;
     private String realm;
@@ -139,12 +140,16 @@ public class AAFAuthn<CLIENT> extends AbsUserCache<AAFPermission> {
             try {
                 Miss missed = missed(getName(),getCred());
                 if (missed==null || missed.mayContinue()) {
             try {
                 Miss missed = missed(getName(),getCred());
                 if (missed==null || missed.mayContinue()) {
-                    Rcli<CLIENT> client = con.client().forUser(con.basicAuth(getName(), new String(getCred())));
-                    Future<String> fp = client.read(
-                            "/authn/basicAuth",
-                            "text/plain"
-                            );
-                    if (fp.get(con.timeout)) {
+                       CredRequest cr = new CredRequest();
+                       cr.setId(getName());
+                       cr.setPassword(new String(getCred()));
+                       Future<String> fp = con.client().readPost("/authn/validate", con.credReqDF, cr);
+                    //Rcli<CLIENT> client = con.client().forUser(con.basicAuth(getName(), new String(getCred())));
+                    //Future<String> fp = client.read(
+                    //        "/authn/basicAuth",
+                    //        "text/plain"
+                    //       );
+                     if (fp.get(con.timeout)) {
                         expires = System.currentTimeMillis() + timeToLive;
                         addUser(new User<AAFPermission>(this, expires));
                         return Resp.REVALIDATED;
                         expires = System.currentTimeMillis() + timeToLive;
                         addUser(new User<AAFPermission>(this, expires));
                         return Resp.REVALIDATED;
index 4068405..3b97883 100644 (file)
@@ -28,6 +28,7 @@ import java.util.concurrent.ConcurrentHashMap;
 
 import org.onap.aaf.cadi.AbsUserCache;
 import org.onap.aaf.cadi.Access;
 
 import org.onap.aaf.cadi.AbsUserCache;
 import org.onap.aaf.cadi.Access;
+import org.onap.aaf.cadi.Access.Level;
 import org.onap.aaf.cadi.CadiException;
 import org.onap.aaf.cadi.CadiWrap;
 import org.onap.aaf.cadi.Connector;
 import org.onap.aaf.cadi.CadiException;
 import org.onap.aaf.cadi.CadiWrap;
 import org.onap.aaf.cadi.Connector;
@@ -36,7 +37,6 @@ import org.onap.aaf.cadi.LocatorException;
 import org.onap.aaf.cadi.Lur;
 import org.onap.aaf.cadi.PropAccess;
 import org.onap.aaf.cadi.SecuritySetter;
 import org.onap.aaf.cadi.Lur;
 import org.onap.aaf.cadi.PropAccess;
 import org.onap.aaf.cadi.SecuritySetter;
-import org.onap.aaf.cadi.Access.Level;
 import org.onap.aaf.cadi.aaf.AAFPermission;
 import org.onap.aaf.cadi.aaf.marshal.CertsMarshal;
 import org.onap.aaf.cadi.client.Future;
 import org.onap.aaf.cadi.aaf.AAFPermission;
 import org.onap.aaf.cadi.aaf.marshal.CertsMarshal;
 import org.onap.aaf.cadi.client.Future;
@@ -56,6 +56,7 @@ import org.onap.aaf.misc.rosetta.env.RosettaDF;
 import org.onap.aaf.misc.rosetta.env.RosettaEnv;
 
 import aaf.v2_0.Certs;
 import org.onap.aaf.misc.rosetta.env.RosettaEnv;
 
 import aaf.v2_0.Certs;
+import aaf.v2_0.CredRequest;
 import aaf.v2_0.Error;
 import aaf.v2_0.Perms;
 import aaf.v2_0.Users;
 import aaf.v2_0.Error;
 import aaf.v2_0.Perms;
 import aaf.v2_0.Users;
@@ -69,6 +70,7 @@ public abstract class AAFCon<CLIENT> implements Connector {
     final public RosettaDF<Perms> permsDF;
     final public RosettaDF<Certs> certsDF;
     final public RosettaDF<Users> usersDF;
     final public RosettaDF<Perms> permsDF;
     final public RosettaDF<Certs> certsDF;
     final public RosettaDF<Users> usersDF;
+    final public RosettaDF<CredRequest> credReqDF;
     final public RosettaDF<Error> errDF;
     private String realm;
     public final String app;
     final public RosettaDF<Error> errDF;
     private String realm;
     public final String app;
@@ -90,6 +92,7 @@ public abstract class AAFCon<CLIENT> implements Connector {
         permsDF = copy.permsDF;
         certsDF = copy.certsDF;
         usersDF = copy.usersDF;
         permsDF = copy.permsDF;
         certsDF = copy.certsDF;
         usersDF = copy.usersDF;
+        credReqDF = copy.credReqDF;
         errDF = copy.errDF;
         app = copy.app;
         si = copy.si;
         errDF = copy.errDF;
         app = copy.app;
         si = copy.si;
@@ -186,6 +189,7 @@ public abstract class AAFCon<CLIENT> implements Connector {
             usersDF = env.newDataFactory(Users.class);
             certsDF = env.newDataFactory(Certs.class);
             certsDF.rootMarshal(new CertsMarshal()); // Speedier Marshaling
             usersDF = env.newDataFactory(Users.class);
             certsDF = env.newDataFactory(Certs.class);
             certsDF.rootMarshal(new CertsMarshal()); // Speedier Marshaling
+            credReqDF = env.newDataFactory(CredRequest.class);
             errDF = env.newDataFactory(Error.class);
         } catch (APIException e) {
             throw new CadiException("AAFCon cannot be configured",e);
             errDF = env.newDataFactory(Error.class);
         } catch (APIException e) {
             throw new CadiException("AAFCon cannot be configured",e);
index 5ef25bc..a654e6f 100644 (file)
@@ -236,7 +236,10 @@ public abstract class AbsAAFLocator<TRANS extends Trans> implements Locator<URI>
     @Override
     public Item best() throws LocatorException {
         if (!hasItems()) {
     @Override
     public Item best() throws LocatorException {
         if (!hasItems()) {
-            throw new LocatorException("No Entries found for '" + aaf_locator_uri.toString() + '/' + name + ':' + version + '\'');
+            throw new LocatorException(String.format("No Entries found for '%s/%s:%s'",
+                       (aaf_locator_uri==null?aaf_locator_host:aaf_locator_uri.toString()),
+                       name,
+                       version));
         }
         List<EP> lep = new ArrayList<>();
         EP first = null;
         }
         List<EP> lep = new ArrayList<>();
         EP first = null;
index 4848e50..cb3b4e8 100644 (file)
@@ -40,7 +40,7 @@ public final class User<PERM extends Permission> {
     public String name;
     private byte[] cred;
     public Principal principal;
     public String name;
     private byte[] cred;
     public Principal principal;
-    Map<String, Permission> perms ;
+    Map<String, Permission> perms;
     long permExpires;
     private final long interval;
     int count;
     long permExpires;
     private final long interval;
     int count;
index fbaa4a5..2c9bb8c 100644 (file)
@@ -45,17 +45,20 @@ public class CSV {
     private Access access;
     private boolean processAll;
     private char delimiter = ',';
     private Access access;
     private boolean processAll;
     private char delimiter = ',';
+    private boolean go;
     
     public CSV(Access access, File file) {
         this.access = access;
         csv = file;
         processAll = false;
     
     public CSV(Access access, File file) {
         this.access = access;
         csv = file;
         processAll = false;
+        go = true;
     }
     
     public CSV(Access access, String csvFilename) {
         this.access = access;
         csv = new File(csvFilename);
         processAll = false;
     }
     
     public CSV(Access access, String csvFilename) {
         this.access = access;
         csv = new File(csvFilename);
         processAll = false;
+        go = true;
     }
     
     public CSV setDelimiter(char delimiter) {
     }
     
     public CSV setDelimiter(char delimiter) {
@@ -88,7 +91,7 @@ public class CSV {
         try {
             String line;
             StringBuilder sb = new StringBuilder();
         try {
             String line;
             StringBuilder sb = new StringBuilder();
-            while((line = br.readLine())!=null) {
+            while(go && (line = br.readLine())!=null) {
                 line=line.trim();
                 if(!line.startsWith("#") && line.length()>0) {
 //                    System.out.println(line);  uncomment to debug
                 line=line.trim();
                 if(!line.startsWith("#") && line.length()>0) {
 //                    System.out.println(line);  uncomment to debug
@@ -268,6 +271,13 @@ public class CSV {
             return csv.getAbsolutePath();
         }
     }
             return csv.getAbsolutePath();
         }
     }
+    
+    /**
+     * Provides a way to stop processing records from inside a Visit
+     */
+    public void stop() {
+       go = false;
+    }
 
     public void delete() {
         csv.delete();
 
     public void delete() {
         csv.delete();