add check and showpass

Issue-ID: AAF-378
Change-Id: If06c33ffd45eb61ab881cdb89f9689dae951f82c
Signed-off-by: Instrumental <jonathan.gathman@att.com>

diff --git a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java
index af2d2f6..893e9f3 100644 (file)
--- a/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java
+++ b/auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/ca/LocalCA.java
@@ -203,7 +203,7 @@ public class LocalCA extends CA {
        public X509andChain sign(Trans trans, CSRMeta csrmeta) throws IOException, CertException {
                GregorianCalendar gc = new GregorianCalendar();
                Date start = gc.getTime();
-               gc.add(GregorianCalendar.MONTH, 2);
+               gc.add(GregorianCalendar.MONTH, 6);
                Date end = gc.getTime();
                X509Certificate x509;
                TimeTaken tt = trans.start("Create/Sign Cert",Env.SUB);

diff --git a/auth/docker/.gitignore b/auth/docker/.gitignore
index a03737d..c058b04 100644 (file)
--- a/auth/docker/.gitignore
+++ b/auth/docker/.gitignore
@@ -1,2 +1,3 @@
 local
 d.props
+aaf.props

diff --git a/auth/docker/aaf.props b/auth/docker/aaf.props
index 8d18f55..5c65480 100644 (file)
--- a/auth/docker/aaf.props
+++ b/auth/docker/aaf.props
@@ -1,14 +1,11 @@
-FQI=clamp@clamp.onap.org
-VOLUME=clamp_aaf
-LONGITUDE=-92
-FQDN=meriadoc.mithril.sbc.com
 VERSION=2.1.2-SNAPSHOT
-DRIVER=local
-LATITUDE=38
-FQDN_IP=192.168.99.100
 AAF_FQDN=meriadoc.mithril.sbc.com
-AAF_AAF_FQDN_IP=192.168.99.100
 DEPLOY_FQI=deployer@people.osaaf.org
-DEPLOY_PASSWORD=demo123456!
 APP_FQDN=meriadoc.mithril.sbc.com
 APP_FQI=clamp@clamp.onap.org
+VOLUME=clamp_aaf
+DRIVER=local
+LATITUDE=38.432899
+LONGITUDE=-90.43248
+AAF_AAF_FQDN_IP=192.168.99.100
+DEPLOY_PASSWORD=demo123456!

diff --git a/auth/docker/dbuild.sh b/auth/docker/dbuild.sh
index 10ca9d9..da0b9b6 100755 (executable)
--- a/auth/docker/dbuild.sh
+++ b/auth/docker/dbuild.sh
@@ -24,7 +24,6 @@ docker build -t ${ORG}/${PROJECT}/aaf_agent:${VERSION} sample
 # Clean up 
 rm sample/Dockerfile sample/bin/aaf-cadi-aaf-${VERSION}-full.jar
 cd -
-
 ########
 # Second, build a core Docker Image
 echo Building aaf_$AAF_COMPONENT...

diff --git a/auth/sample/bin/client.sh b/auth/sample/bin/client.sh
index 2c73614..46c85be 100644 (file)
--- a/auth/sample/bin/client.sh
+++ b/auth/sample/bin/client.sh
@@ -87,9 +87,16 @@ if [ ! "$CMD" = "" ]; then
             rsync -uh --exclude=.gitignore /opt/app/aaf_config/$D/* /opt/app/osaaf/$D
         done
         ;;
+    showpass)
+        echo "## Show Passwords"
+        $JAVA -jar /opt/app/aaf_config/bin/aaf-cadi-aaf-*-full.jar showpass ${APP_FQI} ${APP_FQDN}
+        ;;
+    check)
+        $JAVA -Dcadi_prop_files=/opt/app/osaaf/local/${NS}.props -jar /opt/app/aaf_config/bin/aaf-cadi-aaf-*-full.jar check ${APP_FQI} ${APP_FQDN}
+        ;;
     validate)
         echo "## validate requested"
-        $JAVA -jar /opt/app/aaf_config/bin/aaf-cadi-aaf-*-full.jar validate cadi_prop_files=/opt/app/osaaf/local/${NS}.props
+        $JAVA -jar /opt/app/aaf_config/bin/aaf-cadi-aaf-*-full.jar validate /opt/app/osaaf/local/${NS}.props
         ;;
     bash)
         if [ ! -e ~/.bash_aliases ]; then

diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/AAFPermission.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/AAFPermission.java
index 6b69f79..c4ca808 100644 (file)
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/AAFPermission.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/AAFPermission.java
@@ -50,7 +50,11 @@ public class AAFPermission implements Permission {
                type = name;
                this.instance = instance;
                this.action = action;
-               key = ns + '|' + type + '|' + instance + '|' + action;
+               if(ns==null) {
+                       key = type + '|' + instance + '|' + action;
+               } else {
+                       key = ns + '|' + type + '|' + instance + '|' + action;
+               }
                this.roles = NO_ROLES;
 
        }
@@ -60,7 +64,11 @@ public class AAFPermission implements Permission {
                type = name;
                this.instance = instance;
                this.action = action;
-               key = ns + '|' + type + '|' + instance + '|' + action;
+               if(ns==null) {
+                       key = type + '|' + instance + '|' + action;
+               } else {
+                       key = ns + '|' + type + '|' + instance + '|' + action;
+               }
                this.roles = roles==null?NO_ROLES:roles;
        }
        
@@ -117,7 +125,15 @@ public class AAFPermission implements Permission {
                        }
                }
                boolean typeMatches;
-               if(aafNS.length() == ns.length()) {
+               if(aafNS==null) {
+                       if(ns==null) {
+                               typeMatches = aafType.equals(type);
+                       } else {
+                               typeMatches = aafType.equals(ns+'.'+type);
+                       }
+               } else if(ns==null) {
+                       typeMatches = type.equals(aafNS+'.'+aafType);
+               } else if(aafNS.length() == ns.length()) {
                        typeMatches = aafNS.equals(ns) && aafType.equals(type);
                } else { // Allow for restructuring of NS/Perm structure
                        typeMatches = (aafNS+'.'+aafType).equals(ns+'.'+type);

diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/TestConnectivity.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/TestConnectivity.java
index 3e90087..df2ad4f 100644 (file)
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/TestConnectivity.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/TestConnectivity.java
@@ -55,7 +55,7 @@ public class TestConnectivity {
                        System.out.println("Usage: ConnectivityTester <cadi_prop_files> [<AAF FQDN (i.e. aaf.dev.att.com)>]");
                } else {
                        print(true,"START OF CONNECTIVITY TESTS",new Date().toString(),System.getProperty("user.name"),
-                                       "Note: All API Calls are /authz/perms/user/<MechID/Alias of the caller>");
+                                       "Note: All API Calls are /authz/perms/user/<AppID/Alias of the caller>");
 
                        if(!args[0].contains(Config.CADI_PROP_FILES+'=')) {
                                args[0]=Config.CADI_PROP_FILES+'='+args[0];

diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFLurPerm.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFLurPerm.java
index b7cf62c..a5ef6d1 100644 (file)
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFLurPerm.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/aaf/v2_0/AAFLurPerm.java
@@ -62,7 +62,7 @@ public class AAFLurPerm extends AbsAAFLur<AAFPermission> {
        private static final String ORG_OSAAF_CADI_OAUTH_O_AUTH2_LUR = "org.osaaf.cadi.oauth.OAuth2Lur";
 
        /**
-        *  Need to be able to transmutate a Principal into either ATTUID or MechID, which are the only ones accepted at this
+        *  Need to be able to transmutate a Principal into either Person or AppID, which are the only ones accepted at this
         *  point by AAF.  There is no "domain", aka, no "@att.com" in "ab1234@att.com".  
         *  
         *  The only thing that matters here for AAF is that we don't waste calls with IDs that obviously aren't valid.
@@ -107,12 +107,6 @@ public class AAFLurPerm extends AbsAAFLur<AAFPermission> {
 
        protected User<AAFPermission> loadUser(final Principal principal)  {
                final String name = principal.getName();
-//             // Note: The rules for AAF is that it only stores permissions for ATTUID and MechIDs, which don't 
-//             // have domains.  We are going to make the Transitive Class (see this.transmutative) to convert
-//             final Principal tp = principal; //transmutate.mutate(principal);
-//             if(tp==null) {
-//                     return null; // if not a valid Transmutated credential, don't bother calling...
-//             }
 //             TODO Create a dynamic way to declare domains supported.
                final long start = System.nanoTime();
                final boolean[] success = new boolean[]{false};

diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java
index b3de975..ef73ada 100644 (file)
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/Agent.java
@@ -89,8 +89,8 @@ public class Agent {
        private static final String HASHES = "################################################################";
        private static final String PRINT = "print";
        private static final String FILE = "file";
-       private static final String PKCS12 = "pkcs12";
-       private static final String JKS = "jks";
+       public static final String PKCS12 = "pkcs12";
+       public static final String JKS = "jks";
        private static final String SCRIPT="script";
        
        private static final String CM_VER = "1.0";
@@ -127,7 +127,7 @@ public class Agent {
                                AAFSSO aafsso=null;
                                PropAccess access;
                                
-                               if(args.length>1 && args[0].equals("validate")) {
+                               if(args.length>1 && args[0].equals("validate") ) {
                                        int idx = args[1].indexOf('=');
                                        aafsso = null;
                                        access = new PropAccess(
@@ -329,7 +329,7 @@ public class Agent {
        private static String fqi(Deque<String> cmds) {
                if(cmds.size()<1) {
                        String alias = env.getProperty(Config.CADI_ALIAS);
-                       return alias!=null?alias:AAFSSO.cons.readLine("MechID: ");
+                       return alias!=null?alias:AAFSSO.cons.readLine("AppID: ");
                }
                return cmds.removeFirst();      
        }
@@ -360,11 +360,11 @@ public class Agent {
                Artifacts artifacts = new Artifacts();
                Artifact arti = new Artifact();
                artifacts.getArtifact().add(arti);
-               arti.setMechid(mechID!=null?mechID:AAFSSO.cons.readLine("MechID: "));
+               arti.setMechid(mechID!=null?mechID:AAFSSO.cons.readLine("AppID: "));
                arti.setMachine(machine!=null?machine:AAFSSO.cons.readLine("Machine (%s): ",InetAddress.getLocalHost().getHostName()));
                arti.setCa(AAFSSO.cons.readLine("CA: (%s): ","aaf"));
                
-               String resp = AAFSSO.cons.readLine("Types [file,jks,script] (%s): ", "jks");
+               String resp = AAFSSO.cons.readLine("Types [file,pkcs12,jks,script] (%s): ", PKCS12);
                for(String s : Split.splitTrim(',', resp)) {
                        arti.getType().add(s);
                }
@@ -419,7 +419,7 @@ public class Agent {
                        if(future.get(TIMEOUT)) {
                                boolean printed = false;
                                for(Artifact a : future.value.getArtifact()) {
-                                       AAFSSO.cons.printf("MechID:          %s\n",a.getMechid()); 
+                                       AAFSSO.cons.printf("AppID:          %s\n",a.getMechid()); 
                                        AAFSSO.cons.printf("  Sponsor:       %s\n",a.getSponsor()); 
                                        AAFSSO.cons.printf("Machine:         %s\n",a.getMachine()); 
                                        AAFSSO.cons.printf("CA:              %s\n",a.getCa()); 
@@ -650,7 +650,7 @@ public class Agent {
                                // Have to wait for JDK 1.7 source...
                                //switch(artifact.getType()) {
                                if(acf.value.getArtifact()==null || acf.value.getArtifact().isEmpty()) {
-                                       AAFSSO.cons.printf("No Artifacts found for %s on %s", mechID, machine);
+                                       AAFSSO.cons.printf("No Artifacts found for %s on %s ", mechID, machine);
                                } else {
                                        String id = aafcon.defID();
                                        boolean allowed;
@@ -660,7 +660,7 @@ public class Agent {
                                                                                && aafcon.securityInfo().defSS.getClass().isAssignableFrom(HBasicAuthSS.class)));
                                                if(!allowed) {
                                                        Future<String> pf = aafcon.client(CM_VER).read("/cert/may/" + 
-                                                                       a.getNs() + ".certman|"+a.getCa()+"|showpass","*/*");
+                                                                       a.getNs()+"|certman|"+a.getCa()+"|showpass","*/*");
                                                        if(pf.get(TIMEOUT)) {
                                                                allowed = true;
                                                        } else {
@@ -1017,13 +1017,13 @@ public class Agent {
                                                        String prop;                                            
                                                        File f;
        
-                                                       if((prop=props.getProperty(Config.CADI_KEYFILE))==null ||
+                                                       if((prop=trans.getProperty(Config.CADI_KEYFILE))==null ||
                                                                !(f=new File(prop)).exists()) {
                                                                        trans.error().printf("Keyfile must exist to check Certificates for %s on %s",
                                                                                a.getMechid(), a.getMachine());
                                                        } else {
-                                                               String ksf = props.getProperty(Config.CADI_KEYSTORE);
-                                                               String ksps = props.getProperty(Config.CADI_KEYSTORE_PASSWORD);
+                                                               String ksf = trans.getProperty(Config.CADI_KEYSTORE);
+                                                               String ksps = trans.getProperty(Config.CADI_KEYSTORE_PASSWORD);
                                                                if(ksf==null || ksps == null) {
                                                                        trans.error().printf("Properties %s and %s must exist to check Certificates for %s on %s",
                                                                                        Config.CADI_KEYSTORE, Config.CADI_KEYSTORE_PASSWORD,a.getMechid(), a.getMachine());

diff --git a/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/PlaceArtifactInKeystore.java b/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/PlaceArtifactInKeystore.java
index 3123b89..c541391 100644 (file)
--- a/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/PlaceArtifactInKeystore.java
+++ b/cadi/aaf/src/main/java/org/onap/aaf/cadi/configure/PlaceArtifactInKeystore.java
@@ -28,7 +28,6 @@ import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -51,7 +50,7 @@ public class PlaceArtifactInKeystore extends ArtifactDir {
 
        @Override
        public boolean _place(Trans trans, CertInfo certInfo, Artifact arti) throws CadiException {
-               File fks = new File(dir,arti.getNs()+'.'+(kst=="pkcs12"?"p12":kst));
+               File fks = new File(dir,arti.getNs()+'.'+(kst==Agent.PKCS12?"p12":kst));
                try {
                        KeyStore jks = KeyStore.getInstance(kst);
                        if(fks.exists()) {
@@ -125,7 +124,7 @@ public class PlaceArtifactInKeystore extends ArtifactDir {
                                fks.renameTo(backup);
                        }       
 
-                       jks = KeyStore.getInstance("jks");
+                       jks = KeyStore.getInstance(Agent.JKS);
                        
                        // Set Truststore Password
                        addProperty(Config.CADI_TRUSTSTORE,fks.getAbsolutePath());

diff --git a/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_ArtifactDir.java b/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_ArtifactDir.java
index ecadb6e..d50b87a 100644 (file)
--- a/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_ArtifactDir.java
+++ b/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_ArtifactDir.java
@@ -42,6 +42,7 @@ import org.junit.Test;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 import org.onap.aaf.cadi.CadiException;
+import org.onap.aaf.cadi.configure.Agent;
 import org.onap.aaf.cadi.configure.ArtifactDir;
 import org.onap.aaf.cadi.util.Chmod;
 import org.onap.aaf.misc.env.Trans;
@@ -112,7 +113,7 @@ public class JU_ArtifactDir {
                } catch(NullPointerException e) {
                }
                
-               KeyStore ks = KeyStore.getInstance("pkcs12");
+               KeyStore ks = KeyStore.getInstance(Agent.PKCS12);
                try {
                        ArtifactDir.write(writableFile, Chmod.to755, ks, luggagePassword.toCharArray());
                        fail("Should've thrown an exception");

diff --git a/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_PlaceArtifactInKeystore.java b/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_PlaceArtifactInKeystore.java
index 0b086f1..d61ac49 100644 (file)
--- a/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_PlaceArtifactInKeystore.java
+++ b/cadi/aaf/src/test/java/org/onap/aaf/cadi/cm/test/JU_PlaceArtifactInKeystore.java
@@ -21,9 +21,11 @@
 
 package org.onap.aaf.cadi.cm.test;
 
-import static org.junit.Assert.*;
-import static org.hamcrest.CoreMatchers.*;
-import static org.mockito.Mockito.*;
+import static org.hamcrest.CoreMatchers.is;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.fail;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
 
 import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
@@ -31,14 +33,17 @@ import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.FileReader;
 import java.io.IOException;
+import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.List;
 
-import java.security.cert.CertificateException;
-
-import org.junit.*;
-import org.mockito.*;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
 import org.onap.aaf.cadi.CadiException;
+import org.onap.aaf.cadi.configure.Agent;
 import org.onap.aaf.cadi.configure.PlaceArtifactInKeystore;
 import org.onap.aaf.misc.env.Env;
 import org.onap.aaf.misc.env.TimeTaken;
@@ -97,12 +102,12 @@ public class JU_PlaceArtifactInKeystore {
        @Test
        public void test() throws CadiException {
                // Note: PKCS12 can't be tested in JDK 7 and earlier.  Can't handle Trusting Certificates.
-               PlaceArtifactInKeystore placer = new PlaceArtifactInKeystore("jks");
+               PlaceArtifactInKeystore placer = new PlaceArtifactInKeystore(Agent.JKS);
 
                certs.add(x509String);
                certs.add(x509Chain);
                assertThat(placer.place(transMock, certInfoMock, artiMock, "machine"), is(true));
-               for (String ext : new String[] {"chal", "keyfile", "jks", "trust.jks", "cred.props"}) {
+               for (String ext : new String[] {"chal", "keyfile", Agent.JKS, "trust.jks", "cred.props"}) {
                        File f = new File(dirName + '/' + nsName + '.' + ext);
                        assertThat(f.exists(), is(true));
                }