hd.memo = memo
? String.format("%s by %s", override[0], hd.user)
: (modified.name() + "d credential for " + data.id);
+ String spacer = ": ";
+ if(data.notes!=null) {
+ hd.memo+=spacer + data.notes;
+ spacer = ", ";
+ }
+
+ if(data.tag!=null) {
+ hd.memo+=spacer + data.tag;
+ }
+
// Detail?
if (modified==CRUD.delete) {
try {
return Result.err(Status.ERR_DependencyExists, sb.toString());
}
- if (move && (parent == null || parent.type == NsType.COMPANY.type)) {
+ if (move && parent == null) {
+ return Result
+ .err(Status.ERR_DependencyExists,
+ "Cannot move users, roles or permissions - parent is missing.\nDelete dependencies and try again");
+ }
+ else if (move && parent.type == NsType.COMPANY.type) {
return Result
.err(Status.ERR_DependencyExists,
"Cannot move users, roles or permissions to [%s].\nDelete dependencies and try again",
}
public boolean isAdmin(AuthzTrans trans, String user, String ns) {
- Date now = new Date();
Result<List<UserRoleDAO.Data>> rur = userRoleDAO.read(trans, user,ns+DOT_ADMIN);
if (rur.isOKhasData()) {
+ Date now = new Date();
for (UserRoleDAO.Data urdd : rur.value){
if (urdd.expires.after(now)) {
return true;
public boolean isOwner(AuthzTrans trans, String user, String ns) {
Result<List<UserRoleDAO.Data>> rur = userRoleDAO.read(trans, user,ns+DOT_OWNER);
- Date now = new Date();
if (rur.isOKhasData()) {for (UserRoleDAO.Data urdd : rur.value){
+ Date now = new Date();
if (urdd.expires.after(now)) {
return true;
}
import org.onap.aaf.auth.org.OrganizationException;
import org.onap.aaf.cadi.Hash;
import org.onap.aaf.cadi.Permission;
+import org.onap.aaf.cadi.Access.Level;
import org.onap.aaf.cadi.aaf.AAFPermission;
import org.onap.aaf.cadi.config.Config;
import org.onap.aaf.cadi.configure.Factory;
private final CredDAO credDAO;
private final ArtiDAO artiDAO;
private AAF_CM certManager;
+ private Boolean allowIgnoreIPs;
// @SuppressWarnings("unchecked")
public CMService(final AuthzTrans trans, AAF_CM certman) throws APIException, IOException {
"*",
"read"
);
+ allowIgnoreIPs = Boolean.valueOf(certman.access.getProperty(Config.CM_ALLOW_IGNORE_IPS, "false"));
+ if(allowIgnoreIPs) {
+ trans.env().access().log(Level.INIT, "Allowing DNS Evaluation to be turned off with <ns>.certman|<ca name>|"+IGNORE_IPS);
+ }
}
public Result<CertResp> requestCert(final AuthzTrans trans, final Result<CertReq> req, final CA ca) {
try {
Organization org = trans.org();
- boolean ignoreIPs = trans.fish(new AAFPermission(mechNS,CERTMAN, ca.getName(), IGNORE_IPS));
+ boolean ignoreIPs;
+ if(allowIgnoreIPs) {
+ ignoreIPs = trans.fish(new AAFPermission(mechNS,CERTMAN, ca.getName(), IGNORE_IPS));
+ } else {
+ ignoreIPs = false;
+ }
+
InetAddress primary = null;
// Organize incoming information to get to appropriate Artifact
}
} else {
- for (String cn : req.value.fqdns) {
- if (!ignoreIPs) {
+ if (!ignoreIPs) {
+ for (String cn : req.value.fqdns) {
try {
InetAddress[] ias = InetAddress.getAllByName(cn);
Set<String> potentialSanNames = new HashSet<>();
this(access,new AuthzEnv(access.getProperties()),wtr,hman, si,ss);
}
- public AuthzEnv env() {
- return env;
- }
-
public AAFcli(Access access, AuthzEnv env, Writer wtr, HMangr hman, SecurityInfoC<HttpURLConnection> si, SecuritySetter<HttpURLConnection> ss) throws APIException {
this.env = env;
this.access = access;
cmds.add(new Mgmt(this));
}
- public static int timeout() {
+ public AuthzEnv env() {
+ return env;
+ }
+
+ public static int timeout() {
return TIMEOUT;
}
import org.onap.aaf.auth.cmd.BaseCmd;
import org.onap.aaf.auth.cmd.DeprecatedCMD;
+import org.onap.aaf.auth.common.Define;
import org.onap.aaf.cadi.client.Future;
import org.onap.aaf.misc.env.util.Chrono;
if ((type=u.getType())==null) {
type = 9999;
}
- switch(type) {
- case 0: return "NoCrd";
- case 1: return "U/P";
- case 2: return "U/P2";
- case 10: return "FQI";
- case 200: return "x509";
- default:
- return "n/a";
- }
+ return Define.getCredType(type);
}
+
}
pw().println(']');
} else if (fp.code()==202) {
pw().println("Credential Action Accepted, but requires Approvals before actualizing");
- } else if (fp.code()==300) {
+ } else if (fp.code()==300 || fp.code()==406) {
Error err = em.getError(fp);
String text = err.getText();
List<String> vars = err.getVariables();
import aaf.v2_0.CredRequest;
public class ID extends Cmd {
- public static final String ATTEMPT_FAILED_SPECIFICS_WITHELD = "Attempt Failed. Specifics witheld.";
private static final String CRED_PATH = "/authn/cred";
private static final String[] options = {"add","del"};
public ID(User parent) {
} else if (fp.code()==406 && option==1) {
pw().println("FQI does not exist");
} else {
- pw().println(ATTEMPT_FAILED_SPECIFICS_WITHELD);
+ pw().println(Cred.ATTEMPT_FAILED_SPECIFICS_WITHELD);
}
return fp.code();
}
void report(Users users, boolean count, String ... str) {
reportHead(str);
- int idx = 0;
java.util.List<aaf.v2_0.Users.User> sorted = users.getUser();
Collections.sort(sorted, (Comparator<aaf.v2_0.Users.User>) (u1, u2) -> {
if (u1==null || u2 == null) {
}
return u1.getId().compareTo(u2.getId());
});
- String format = reportColHead("%-48s %-5s %-11s %-16s\n","User","Type","Expires","Tag");
+ String format = reportColHead("%-36s %-5s %-20s %-16s\n","User","Type","Expires","Tag");
String date = "XXXX-XX-XX";
for (aaf.v2_0.Users.User user : sorted) {
if (!aafcli.isTest()) {
- date = Chrono.dateOnlyStamp(user.getExpires());
+ date = Chrono.niceUTCStamp(user.getExpires());
}
String tag=user.getTag();
Integer type = user.getType();
tag = "\n\tfingerprint: " + tag;
}
pw().format(format,
- count? (Integer.valueOf(++idx) + ") " + user.getId()): user.getId(),
+ user.getId(),
org.onap.aaf.auth.cmd.ns.List.getType(user),
date,
tag);
import java.util.Map.Entry;
import org.onap.aaf.cadi.Access;
-import org.onap.aaf.cadi.CadiException;
import org.onap.aaf.cadi.Access.Level;
+import org.onap.aaf.cadi.CadiException;
import org.onap.aaf.cadi.config.Config;
public class Define {
return initialized;
}
+ public static String getCredType(int type) {
+ switch(type) {
+ case 0: return "NoCrd";
+ case 1: return "U/P";
+ case 2: return "U/P2";
+ case 10: return "FQI";
+ case 200: return "x509";
+ default:
+ return "n/a";
+ }
+ }
+
}
//Need to do the "Pick Entry" mechanism
// Note, this sorts
- Result<Integer> ri = selectEntryIfMultiple((CredRequest)from, lcdd, "extend");
+ Result<Integer> ri = selectEntryIfMultiple((CredRequest)from, lcdd, MayChangeCred.EXTEND);
if (ri.notOK()) {
return Result.err(ri);
}
cd.type = found.type;
cd.ns = found.ns;
cd.notes = "Extended";
- cd.expires = org.expiration(null, Expiration.ExtendPassword,days).getTime();
cd.tag = found.tag;
+ cd.expires = org.expiration(null, Expiration.ExtendPassword,days).getTime();
+ if(cd.expires.before(found.expires)) {
+ return Result.err(Result.ERR_BadData,String.format("Credential's expiration date is more than %s days in the future",days));
+ }
cred = ques.credDAO().create(trans, cd);
if (cred.isOK()) {
}
boolean isLastCred = rlcd.value.size()==1;
- int entry = -1;
- int fentry = entry;
- if(cred.value.type==CredDAO.FQI) {
- entry = -1;
- for(CredDAO.Data cdd : rlcd.value) {
- ++fentry;
- if(cdd.type == CredDAO.FQI) {
- entry = fentry;
- break;
- }
+ int entry;
+ CredRequest cr = (CredRequest)from;
+ if(isLastCred) {
+ if(cr.getEntry()==null || "1".equals(cr.getEntry())) {
+ entry = 0;
+ } else {
+ return Result.err(Status.ERR_BadData, "User chose invalid credential selection");
}
} else {
- if (!doForce) {
- if (rlcd.value.size() > 1) {
- CredRequest cr = (CredRequest)from;
- String inputOption = cr.getEntry();
- if (inputOption == null) {
- List<CredDAO.Data> list = filterList(rlcd.value,CredDAO.BASIC_AUTH,CredDAO.BASIC_AUTH_SHA256,CredDAO.CERT_SHA256_RSA);
- String message = selectCredFromList(list, MayChangeCred.DELETE);
- Object[] variables = buildVariables(list);
- return Result.err(Status.ERR_ChoiceNeeded, message, variables);
- } else {
- try {
- if (inputOption.length()>5) { // should be a date
- Date d = Chrono.xmlDatatypeFactory.newXMLGregorianCalendar(inputOption).toGregorianCalendar().getTime();
- for (CredDAO.Data cd : rlcd.value) {
- ++fentry;
- if (cd.type.equals(cr.getType()) && cd.expires.equals(d)) {
- entry = fentry;
- break;
- }
- }
- } else {
- entry = Integer.parseInt(inputOption) - 1;
- int count = 0;
- for (CredDAO.Data cd : rlcd.value) {
- if(cd.type!=CredDAO.BASIC_AUTH && cd.type!=CredDAO.BASIC_AUTH_SHA256 && cd.type!=CredDAO.CERT_SHA256_RSA) {
- ++entry;
- }
- if(++count>entry) {
- break;
- }
- }
- }
- } catch (NullPointerException e) {
- return Result.err(Status.ERR_BadData, "Invalid Date Format for Entry");
- } catch (NumberFormatException e) {
- return Result.err(Status.ERR_BadData, "User chose invalid credential selection");
- }
- }
- isLastCred = (entry==-1)?true:false;
- } else {
- isLastCred = true;
- }
- if (entry < -1 || entry >= rlcd.value.size()) {
- return Result.err(Status.ERR_BadData, "User chose invalid credential selection");
- }
+ entry = -1;
+ int fentry = entry;
+ if(cred.value.type==CredDAO.FQI) {
+ entry = -1;
+ for(CredDAO.Data cdd : rlcd.value) {
+ ++fentry;
+ if(cdd.type == CredDAO.FQI) {
+ entry = fentry;
+ break;
+ }
+ }
+ } else {
+ if (!doForce) {
+ if (rlcd.value.size() > 1) {
+ String inputOption = cr.getEntry();
+ if (inputOption == null) {
+ List<CredDAO.Data> list = filterList(rlcd.value,CredDAO.BASIC_AUTH,CredDAO.BASIC_AUTH_SHA256,CredDAO.CERT_SHA256_RSA);
+ String message = selectCredFromList(list, MayChangeCred.DELETE);
+ Object[] variables = buildVariables(list);
+ return Result.err(Status.ERR_ChoiceNeeded, message, variables);
+ } else {
+ try {
+ if (inputOption.length()>5) { // should be a date
+ Date d = Chrono.xmlDatatypeFactory.newXMLGregorianCalendar(inputOption).toGregorianCalendar().getTime();
+ for (CredDAO.Data cd : rlcd.value) {
+ ++fentry;
+ if (cd.type.equals(cr.getType()) && cd.expires.equals(d)) {
+ entry = fentry;
+ break;
+ }
+ }
+ } else {
+ entry = Integer.parseInt(inputOption) - 1;
+ int count = 0;
+ for (CredDAO.Data cd : rlcd.value) {
+ if(cd.type!=CredDAO.BASIC_AUTH && cd.type!=CredDAO.BASIC_AUTH_SHA256 && cd.type!=CredDAO.CERT_SHA256_RSA) {
+ ++entry;
+ }
+ if(++count>entry) {
+ break;
+ }
+ }
+ }
+ } catch (NullPointerException e) {
+ return Result.err(Status.ERR_BadData, "Invalid Date Format for Entry");
+ } catch (NumberFormatException e) {
+ return Result.err(Status.ERR_BadData, "User chose invalid credential selection");
+ }
+ }
+ isLastCred = (entry==-1)?true:false;
+ } else {
+ isLastCred = true;
+ }
+ if (entry < -1 || entry >= rlcd.value.size()) {
+ return Result.err(Status.ERR_BadData, "User chose invalid credential selection");
+ }
+ }
}
}
Object[] variables = buildVariables(lcd);
return Result.err(Status.ERR_ChoiceNeeded, message, variables);
} else {
+ if(MayChangeCred.EXTEND.equals(action)) {
+ // might be Tag
+ if(inputOption.length()>4) { //Tag is at least 12
+ int e = 0;
+ CredDAO.Data last = null;
+ int lastIdx = -1;
+ for(CredDAO.Data cdd : lcd) {
+ if(inputOption.equals(cdd.tag)) {
+ if(last==null) {
+ last = cdd;
+ lastIdx = e;
+ } else {
+ if(last.expires.before(cdd.expires)) {
+ last = cdd;
+ lastIdx = e;
+ }
+ }
+ }
+ ++e;
+ }
+ if(last!=null) {
+ return Result.ok(lastIdx);
+ }
+ return Result.err(Status.ERR_BadData, "User chose unknown Tag");
+ }
+ }
entry = Integer.parseInt(inputOption) - 1;
}
if (entry < 0 || entry >= lcd.size()) {
}
}
}
+ Collections.sort(rv, (o1,o2) -> {
+ if(o1.type==o2.type) {
+ return o1.expires.compareTo(o2.expires);
+ } else {
+ return o1.type.compareTo(o2.type);
+ }
+ });
return rv;
}
private String[] buildVariables(List<CredDAO.Data> value) {
- // ensure credentials are sorted so we can fully automate Cred regression test
- Collections.sort(value, (cred1, cred2) ->
- cred1.type==cred2.type?cred2.expires.compareTo(cred1.expires):
- cred1.type<cred2.type?-1:1);
String [] vars = new String[value.size()];
CredDAO.Data cdd;
for (int i = 0; i < value.size(); i++) {
cdd = value.get(i);
- vars[i] = cdd.id + TWO_SPACE + cdd.type + TWO_SPACE + (cdd.type<10?TWO_SPACE:"")+ cdd.expires + TWO_SPACE + cdd.tag;
+ vars[i] = cdd.id + TWO_SPACE + Define.getCredType(cdd.type) + TWO_SPACE + Chrono.niceUTCStamp(cdd.expires) + TWO_SPACE + cdd.tag;
}
return vars;
}
for (int i = 0; i < numSpaces; i++) {
errMessage.append(' ');
}
- errMessage.append(" Type Expires Tag " + '\n');
+ errMessage.append(" Type Expires Tag " + '\n');
for (int i=0;i<value.size();++i) {
errMessage.append(" %s\n");
}
- errMessage.append("Run same command again with chosen entry as last parameter");
-
+ if(MayChangeCred.EXTEND.equals(action)) {
+ errMessage.append("Run same command again with chosen entry or Tag as last parameter");
+ } else {
+ errMessage.append("Run same command again with chosen entry as last parameter");
+ }
return errMessage.toString();
}
if (mechid==null) {
mechid=access.getProperty(Config.OAUTH_CLIENT_ID,null);
}
- String encpass = access.getProperty(Config.AAF_APPPASS, null);
- if (encpass==null) {
- encpass = access.getProperty(Config.OAUTH_CLIENT_SECRET,null);
- }
- if (encpass==null) {
- String alias = access.getProperty(Config.CADI_ALIAS, mechid);
- if (alias==null) {
- access.printf(Access.Level.WARN,"%s, %s or %s required before use.", Config.CADI_ALIAS, Config.AAF_APPID, Config.OAUTH_CLIENT_ID);
- set(si.defSS);
- } else {
- si.defSS=x509Alias(alias);
- set(si.defSS);
- }
+ String alias = access.getProperty(Config.CADI_ALIAS, null);
+ if(alias != null) {
+ si.defSS=x509Alias(alias);
+ set(si.defSS);
} else {
- if (mechid!=null) {
- si.defSS=basicAuth(mechid, encpass);
- set(si.defSS);
- } else {
- si.defSS=new SecuritySetter<CLIENT>() {
-
- @Override
- public String getID() {
- return "";
- }
-
- @Override
- public void setSecurity(CLIENT client) throws CadiException {
- throw new CadiException("AAFCon has not been initialized with Credentials (SecuritySetter)");
- }
- @Override
- public int setLastResponse(int respCode) {
- return 0;
- }
- };
- set(si.defSS);
- }
+ String encpass = access.getProperty(Config.AAF_APPPASS, null);
+ if (encpass==null) {
+ encpass = access.getProperty(Config.OAUTH_CLIENT_SECRET,null);
+ }
+
+ if (encpass==null) {
+ if (alias==null) {
+ access.printf(Access.Level.WARN,"%s, %s or %s required before use.", Config.CADI_ALIAS, Config.AAF_APPID, Config.OAUTH_CLIENT_ID);
+ set(si.defSS);
+ }
+ } else {
+ if (mechid!=null) {
+ si.defSS=basicAuth(mechid, encpass);
+ set(si.defSS);
+ } else {
+ si.defSS=new SecuritySetter<CLIENT>() {
+
+ @Override
+ public String getID() {
+ return "";
+ }
+
+ @Override
+ public void setSecurity(CLIENT client) throws CadiException {
+ throw new CadiException("AAFCon has not been initialized with Credentials (SecuritySetter)");
+ }
+
+ @Override
+ public int setLastResponse(int respCode) {
+ return 0;
+ }
+ };
+ set(si.defSS);
+ }
+ }
}
}
public AAFConHttp(Access access, String tag) throws CadiException, LocatorException {
super(access,tag,SecurityInfoC.instance(access, HttpURLConnection.class));
- bestSS(si);
hman = new HMangr(access,Config.loadLocator(si, access.getProperty(tag,tag/*try the content itself*/)));
}
public AAFConHttp(Access access, String urlTag, SecurityInfoC<HttpURLConnection> si) throws CadiException, LocatorException {
super(access,urlTag,si);
- bestSS(si);
hman = new HMangr(access,Config.loadLocator(si, access.getProperty(urlTag,null)));
}
public AAFConHttp(Access access, Locator<URI> locator) throws CadiException, LocatorException {
super(access,Config.AAF_URL,SecurityInfoC.instance(access, HttpURLConnection.class));
- bestSS(si);
hman = new HMangr(access,locator);
}
public AAFConHttp(Access access, Locator<URI> locator, SecurityInfoC<HttpURLConnection> si) throws CadiException, LocatorException, APIException {
super(access,Config.AAF_URL,si);
- bestSS(si);
hman = new HMangr(access,locator);
}
public AAFConHttp(Access access, Locator<URI> locator, SecurityInfoC<HttpURLConnection> si, String tag) throws CadiException, LocatorException, APIException {
super(access,tag,si);
- bestSS(si);
hman = new HMangr(access, locator);
}
} else {
try {
AAFSSO aafsso=null;
- PropAccess access;
+ PropAccess access=null;
- if (args.length>1 && args[0].equals("validate") ) {
- int idx = args[1].indexOf('=');
- aafsso = null;
- access = new PropAccess(
- (idx<0?Config.CADI_PROP_FILES:args[1].substring(0, idx))+
- '='+
- (idx<0?args[1]:args[1].substring(idx+1)));
- } else {
- aafsso= new AAFSSO(args, new AAFSSO.ProcessArgs() {
- @Override
- public Properties process(String[] args, Properties props) {
- if (args.length>1) {
- if (!args[0].equals("keypairgen")) {
- props.put(Config.AAF_APPID, args[1]);
- }
- }
- return props;
- }
- });
- access = aafsso.access();
+ String hasEtc = null;
+ for(String a : args) {
+ if(a.startsWith(Config.CADI_PROP_FILES)) {
+ access = new PropAccess(args);
+ break;
+ } else if(a.startsWith(Config.CADI_ETCDIR)) {
+ int idx = a.indexOf('=');
+ if(idx>=0 && idx<a.length()) {
+ hasEtc = a.substring(idx+1);
+ }
+ }
+ }
+
+ if(access==null) {
+ if(args.length>1 && args[1].contains("@")) {
+ String domain = FQI.reverseDomain(args[1]);
+ if(domain!=null) {
+ if(hasEtc==null) {
+ hasEtc = ".";
+ }
+ File etc = new File(hasEtc);
+ if(etc.exists()) {
+ File nsprops = new File(etc,domain+".props");
+ if(nsprops.exists()) {
+ access = new PropAccess(new String[] {Config.CADI_PROP_FILES+'='+nsprops.getAbsolutePath()});
+ }
+ }
+ }
+ }
+ }
+
+ if(access==null) {
+ for(Entry<Object, Object> es : System.getProperties().entrySet()) {
+ if(Config.CADI_PROP_FILES.equals(es.getKey())) {
+ access = new PropAccess();
+ }
+ }
+ }
+
+ // When using Config file, check if Cred Exists, and if not, work with Deployer.
+ if(access!=null && !"config".equals(args[0]) && access.getProperty(Config.AAF_APPPASS)==null && access.getProperty(Config.CADI_ALIAS)==null) {
+ // not enough credentials to use Props. Use AAFSSO
+ access = null;
+ }
+
+ if(access==null) {
+ if (args.length>1 && args[0].equals("validate") ) {
+ int idx = args[1].indexOf('=');
+ aafsso = null;
+ access = new PropAccess(
+ (idx<0?Config.CADI_PROP_FILES:args[1].substring(0, idx))+
+ '='+
+ (idx<0?args[1]:args[1].substring(idx+1)));
+ } else {
+ aafsso= new AAFSSO(args, new AAFSSO.ProcessArgs() {
+ @Override
+ public Properties process(String[] args, Properties props) {
+ if (args.length>1) {
+ if (!args[0].equals("keypairgen")) {
+ props.put(Config.AAF_APPID, args[1]);
+ }
+ }
+ return props;
+ }
+ });
+ access = aafsso.access();
+ }
}
if (aafsso!=null && aafsso.loginOnly()) {
try {
final String fqi = fqi(cmds);
Artifact arti = new Artifact();
- arti.setDir(propAccess.getProperty(Config.CADI_ETCDIR, "."));
+ arti.setDir(propAccess.getProperty(Config.CADI_ETCDIR, System.getProperty("user.dir")));
arti.setNs(FQI.reverseDomain(fqi));
PropHolder loc = PropHolder.get(arti, "location.props");
PropHolder cred = PropHolder.get(arti,"cred.props");
loc.add(tag, getProperty(propAccess, trans, false, tag, "%s: ",tag));
}
+ String keyfile = cred.getKeyPath();
+ if(keyfile!=null) {
+ File fkeyfile = new File(keyfile);
+ if(!fkeyfile.exists()) {
+ ArtifactDir.write(fkeyfile,Chmod.to400,Symm.keygen());
+ }
+ }
cred.add(Config.CADI_KEYFILE, cred.getKeyPath());
final String ssoAppID = propAccess.getProperty(Config.AAF_APPID);
if(fqi!=null && fqi.equals(ssoAppID)) {
cred.addEnc(Config.AAF_APPPASS, propAccess, null);
// only Ask for Password when starting scratch
} else if(propAccess.getProperty(Config.CADI_PROP_FILES)==null) {
- char[] pwd = AAFSSO.cons.readPassword("Password for %s: ", fqi);
+ char[] pwd = AAFSSO.cons.readPassword("Password for %s (leave blank for NO password): ", fqi);
if(pwd.length>0) {
cred.addEnc(Config.AAF_APPPASS, new String(pwd));
}
import java.io.File;
import org.onap.aaf.cadi.CadiException;
+import org.onap.aaf.cadi.aaf.Defaults;
+import org.onap.aaf.cadi.config.Config;
import org.onap.aaf.cadi.util.Chmod;
import org.onap.aaf.misc.env.Trans;
import org.onap.aaf.misc.env.util.Chrono;
classpath.append(File.pathSeparatorChar);
}
File f = new File(pth);
- classpath.append(f.getCanonicalPath().replaceAll("[0-9]+\\.[0-9]+\\.[0-9]+","*"));
+ classpath.append(f.getCanonicalPath().replaceAll("[0-9]+\\.[0-9]+\\.[0-9]+",Defaults.AAF_VERSION+".*"));
}
write(f1,Chmod.to644,
"# Certificate Manager Check Script\n",
"# Check on Certificate, and renew if needed.\n",
"# Generated by Certificate Manager " + Chrono.timeStamp()+'\n',
+ "# by Deployer " + trans.getProperty(Config.AAF_APPID,"") + '\n',
+ "#\n",
"DIR="+arti.getDir()+'\n',
+ "APP_ID=" + arti.getMechid() + '\n',
+ "FQDN=" + arti.getMachine()+ '\n',
"APP="+arti.getNs()+'\n',
- "EMAIL="+email,
- "CP=\""+classpath.toString()+"\"\n",
+ "EMAIL="+email+ '\n',
+ "JAR=\""+classpath.toString()+"\"\n",
+ "JAVA=\""+javaHome() + "/bin/" +"java\"\n",
checkScript
);
return rc==null?System.getProperty("java.home"):rc;
}
private final static String checkScript =
- "> $DIR/$APP.msg\n\n" +
"function mailit {\n" +
" if [ -e /bin/mail ]; then\n" +
" MAILER=/bin/mail\n" +
" printf \"$*\" | $MAILER -s \"AAF Certman Notification for `uname -n`\" $EMAIL\n"+
" fi\n" +
"}\n\n" +
- javaHome() + "/bin/" +"java -cp $CP " +
- Agent.class.getName() +
- " cadi_prop_files=$DIR/$APP.props check 2> $DIR/$APP.STDERR > $DIR/$APP.STDOUT\n" +
+ "> $DIR/$APP.msg\n\n" +
+ "$JAVA -jar $JAR check $APP_ID $FQDN cadi_prop_files=$DIR/$APP.props 2> $DIR/$APP.STDERR > $DIR/$APP.STDOUT\n" +
"case \"$?\" in\n" +
" 0)\n" +
" # Note: Validation will be mailed only the first day after any modification\n" +
}
sb.append('_');
sb.append(tokenSource);
- byte[] tohash=scope.getBytes();
- if (hash!=null && hash.length>0) {
- byte temp[] = new byte[hash.length+tohash.length];
- System.arraycopy(tohash, 0, temp, 0, tohash.length);
- System.arraycopy(hash, 0, temp, tohash.length, hash.length);
- tohash = temp;
- }
- if (scope!=null && scope.length()>0) {
- sb.append(Hash.toHexNo0x(Hash.hashSHA256(tohash)));
+ if (scope!=null) {
+ byte[] tohash=scope.getBytes();
+ if (hash!=null && hash.length>0) {
+ byte temp[] = new byte[hash.length+tohash.length];
+ System.arraycopy(tohash, 0, temp, 0, tohash.length);
+ System.arraycopy(hash, 0, temp, tohash.length, hash.length);
+ tohash = temp;
+ }
+ if (scope.length()>0) {
+ sb.append(Hash.toHexNo0x(Hash.hashSHA256(tohash)));
+ }
}
return sb.toString();
} catch (NoSuchAlgorithmException e) {
addProp(Config.AAF_LOCATE_URL, locateUrl);
try {
if(access.getProperty(Config.AAF_URL)==null) {
- access.setProperty(Config.AAF_URL, "https://AAF_LOCATE/AAF_NS.service:2.1");
+ access.setProperty(Config.AAF_URL, Defaults.AAF_ROOT+".service:"+Defaults.AAF_VERSION);
}
AAFCon<?> aafCon = AAFCon.newInstance(access);
Future<Configuration> acf;
// Jonathan. Oh, well, Deployment services need this behavior. I will put this code in, but leave it undocumented.
// One still needs access to the keyfile to read.
// July 2016 - thought of a tool "CMPass" to regurgitate from properties, but only if allowed.
- } else if ("regurgitate".equalsIgnoreCase(args[0]) && args.length>2) {
+ } else if (("regurgitate".equalsIgnoreCase(args[0]) || "undigest".equalsIgnoreCase(args[0]))
+ && args.length>2) {
try {
Symm symm;
FileInputStream fis = new FileInputStream(args[2]);
System.out.flush();
return;
} catch (IOException e) {
- System.err.println("Cannot regurgitate password");
+ System.err.println("Cannot undigest password");
System.err.println(" \""+ e.getMessage() + '"');
}
} else if ("encode64".equalsIgnoreCase(args[0]) && args.length>1) {
System.out.println(" digest [<passwd>|-i|] <keyfile> (Encrypts Password with \"keyfile\"");
System.out.println(" if passwd = -i, will read StdIn");
System.out.println(" if passwd is blank, will ask securely)");
+ System.out.println(" undigest <enc:...> <keyfile> (Decrypts Encoded with \"keyfile\")");
System.out.println(" passgen <digits> (Generate Password of given size)");
System.out.println(" urlgen <digits> (Generate URL field of given size)");
System.out.println(" encode64 <your text> (Encodes to Base64)");
public static final String AAF_URL_CM_DEF = "https://AAF_LOCATE_URL/AAF_NS.cm:"+AAF_DEFAULT_API_VERSION;
public static final String AAF_URL_HELLO = "aaf_url_hello";
public static final String CM_TRUSTED_CAS = "cm_trusted_cas";
+ // let NS Owners choose with <ns>.certman aaf ignoreIPs" to ignoreIP Check for Configs
+ // Probably only want to allow in a DEV Env.
+ public static final String CM_ALLOW_IGNORE_IPS="cm_allow_ignore_ips";
public static final String PATHFILTER_URLPATTERN = "pathfilter_urlpattern";
public static final String PATHFILTER_STACK = "pathfilter_stack";
" digest [<passwd>|-i|] <keyfile> (Encrypts Password with \"keyfile\"" + lineSeparator +
" if passwd = -i, will read StdIn" + lineSeparator +
" if passwd is blank, will ask securely)" + lineSeparator +
+ " undigest <enc:...> <keyfile> (Decrypts Encoded with \"keyfile\")" + lineSeparator +
" passgen <digits> (Generate Password of given size)" + lineSeparator +
" urlgen <digits> (Generate URL field of given size)" + lineSeparator +
" encode64 <your text> (Encodes to Base64)" + lineSeparator +
} else {
ipw = null;
}
-
+
// If it's a fragment, print first Object Name. If root Object, skip first name
Stack<LevelStack> jsonLevel = new Stack<LevelStack>();
jsonLevel.push(new LevelStack(options.length>1 && options[1]));
boolean print = true, hadData=false;
char afterName=0, beforeName=0, maybe = 0, prev=0;
-
+
int count = 0;
while ((p = prs.parse(in,p.reuse())).valid()) {
++count;
default:
print = true;
}
-
+
if (maybe!=0) {
if (ipw==null)writer.append(maybe);
else ipw.println(maybe);
maybe = 0;
}
-
- if (beforeName!=0) {
- if (ipw==null)writer.append(beforeName);
- else ipw.println(beforeName);
- beforeName = 0;
- }
+
+ // commented out unreachable code (as it is, beforeName is never
+ // assigned any value except 0
+ //if (beforeName!=0) {
+ // if (ipw==null)writer.append(beforeName);
+ // else ipw.println(beforeName);
+ // beforeName = 0;
+ //}
if (print) {
if (p.hasName()) {
writer.append('"');
Code Review / aaf / authz.git / commitdiff