Merge "[SDNC] Enable SDNC to use external oauth provider"

diff --combined kubernetes/sdnc/components/sdnc-web/values.yaml
index 72126b6,95756eb..3577c84
--- 1/kubernetes/sdnc/components/sdnc-web/values.yaml
--- 2/kubernetes/sdnc/components/sdnc-web/values.yaml
+++ b/kubernetes/sdnc/components/sdnc-web/values.yaml
@@@ -23,7 -23,7 +23,7 @@@ global
  # Application configuration defaults.
  #################################################################
  # application image
 -image: "onap/sdnc-web-image:2.0.5"
 +image: "onap/sdnc-web-image:2.1.3"
  pullPolicy: Always
  
  config:
@@@ -36,6 -36,10 +36,10 @@@
    sslCertDir: "/opt/app/osaaf/local/certs"
    sslCertiticate: "cert.pem"
    sslCertKey: "key.pem"
+   oauth:
+     enabled: false
+     odluxRbac:
+       enabled: false
    transportpce:
      enabled: false
      transportpceUrl: http://transportpce.transportpce:8181

diff --combined kubernetes/sdnc/templates/statefulset.yaml
index 027f01c,bb3948e..01cc0c0
--- 1/kubernetes/sdnc/templates/statefulset.yaml
--- 2/kubernetes/sdnc/templates/statefulset.yaml
+++ b/kubernetes/sdnc/templates/statefulset.yaml
@@@ -41,36 -41,6 +41,36 @@@ spec
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-user-creds" "key" "login") | indent 10 }}
          - name: AAI_CLIENT_PASSWORD
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-user-creds" "key" "password") | indent 10 }}
 +        - name: AAI_TRUSTSTORE_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-truststore-password" "key" "password") | indent 10 }}
 +        - name: ANSIBLE_TRUSTSTORE_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ansible-truststore-password" "key" "password") | indent 10 }}
 +        - name: SO_USER
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "so-user-creds" "key" "login") | indent 10 }}
 +        - name: SO_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "so-user-creds" "key" "password") | indent 10 }}
 +        - name: NENG_USER
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "neng-user-creds" "key" "login") | indent 10 }}
 +        - name: NENG_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "neng-user-creds" "key" "password") | indent 10 }}
 +        - name: CDS_USER
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cds-user-creds" "key" "login") | indent 10 }}
 +        - name: CDS_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cds-user-creds" "key" "password") | indent 10 }}
 +        - name: HONEYCOMB_USER
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "honeycomb-user-creds" "key" "login") | indent 10 }}
 +        - name: HONEYCOMB_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "honeycomb-user-creds" "key" "password") | indent 10 }}
 +        - name: TRUSTSTORE_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "truststore-password" "key" "password") | indent 10 }}
 +        - name: KEYSTORE_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "keystore-password" "key" "password") | indent 10 }}
 +        - name: DMAAP_USER
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-user-creds" "key" "login") | indent 10 }}
 +        - name: DMAAP_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-user-creds" "key" "password") | indent 10 }}
 +        - name: DMAAP_AUTHKEY
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-authkey" "key" "password") | indent 10 }}
          - name: MODELSERVICE_USER
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "modeling-user-creds" "key" "login") | indent 10 }}
          - name: MODELSERVICE_PASSWORD
@@@ -93,24 -63,25 +93,33 @@@
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 10 }}
          - name: SDNC_DB_PASSWORD
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 10 }}
 +        - name: MYSQL_USER
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 10 }}
 +        - name: MYSQL_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 10 }}
          - name: ODL_ADMIN_USERNAME
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "login") | indent 10 }}
 +        - name: ODL_USER
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "login") | indent 10 }}
          - name: ODL_ADMIN_PASSWORD
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "password") | indent 10 }}
 +        - name: ODL_PASSWORD
 +          {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "password") | indent 10 }}
          {{ if and .Values.config.sdnr.dmaapProxy.enabled  .Values.config.sdnr.dmaapProxy.usepwd }}
          - name: DMAAP_HTTP_PROXY_USERNAME
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-proxy-creds" "key" "login") | indent 10 }}
          - name: DMAAP_HTTP_PROXY_PASSWORD
            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-proxy-creds" "key" "password") | indent 10 }}
          {{- end }}
+         {{ if .Values.config.sdnr.oauth.enabled }}
+         - name: OAUTH_TOKEN_SECRET
+           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "oauth-token-secret" "key" "password") | indent 10 }}
+         - name: KEYCLOAK_SECRET
+           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "keycloak-secret" "key" "password") | indent 10 }}
+ 
+         - name: ENABLE_ODLUX_RBAC
+           value: "{{ .Values.config.sdnr.oauth.odluxRbac.enabled | default "true" }}"
+         {{ end }}
  
  
          volumeMounts:
@@@ -191,58 -162,14 +200,58 @@@
              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-root-password" "key" "password") | indent 12 }}
            - name: ODL_ADMIN_USERNAME
              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "login") | indent 12 }}
 +          - name: ODL_USER
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "login") | indent 12 }}
            - name: ODL_ADMIN_PASSWORD
              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "password") | indent 12 }}
 +          - name: ODL_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "odl-creds" "key" "password") | indent 12 }}
            - name: SDNC_DB_USER
              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 12 }}
            - name: SDNC_DB_PASSWORD
              {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 12 }}
 +          - name: MYSQL_USER
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 12 }}
 +          - name: MYSQL_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 12 }}
 +          - name: MYSQL_DATABASE
 +            value: "{{ .Values.config.dbSdnctlDatabase }}"
            - name: SDNC_CONFIG_DIR
              value: "{{ .Values.config.configDir }}"
 +          - name: AAI_CLIENT_NAME
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-user-creds" "key" "login") | indent 12 }}
 +          - name: AAI_CLIENT_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-user-creds" "key" "password") | indent 12 }}
 +          - name: AAI_TRUSTSTORE_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "aai-truststore-password" "key" "password") | indent 12 }}
 +          - name: ANSIBLE_TRUSTSTORE_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "ansible-truststore-password" "key" "password") | indent 12 }}
 +          - name: SO_USER
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "so-user-creds" "key" "login") | indent 12 }}
 +          - name: SO_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "so-user-creds" "key" "password") | indent 12 }}
 +          - name: NENG_USER
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "neng-user-creds" "key" "login") | indent 12 }}
 +          - name: NENG_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "neng-user-creds" "key" "password") | indent 12 }}
 +          - name: CDS_USER
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cds-user-creds" "key" "login") | indent 12 }}
 +          - name: CDS_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "cds-user-creds" "key" "password") | indent 12 }}
 +          - name: HONEYCOMB_USER
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "honeycomb-user-creds" "key" "login") | indent 12 }}
 +          - name: HONEYCOMB_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "honeycomb-user-creds" "key" "password") | indent 12 }}
 +          - name: TRUSTSTORE_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "truststore-password" "key" "password") | indent 12 }}
 +          - name: KEYSTORE_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "keystore-password" "key" "password") | indent 12 }}
 +          - name: DMAAP_USER
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-user-creds" "key" "login") | indent 12 }}
 +          - name: DMAAP_PASSWORD
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-user-creds" "key" "password") | indent 12 }}
 +          - name: DMAAP_AUTHKEY
 +            {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "dmaap-authkey" "key" "password") | indent 12 }}
            - name: ENABLE_ODL_CLUSTER
              value: "{{ .Values.config.enableClustering }}"
            - name: MY_ODL_CLUSTER
@@@ -292,7 -219,8 +301,8 @@@
            - name: ODL_CERT_DIR
              value: {{ (mustFirst (.Values.certificates)).mountPath }}
            {{- end }}
- 
+           - name: ENABLE_OAUTH
+             value: "{{ .Values.config.sdnr.oauth.enabled | default "false" }}"
            volumeMounts:
  {{ include "common.certInitializer.volumeMount" . | indent 10 }}
  {{ include "common.certServiceClient.volumeMounts" . | indent 10 }}
@@@ -360,6 -288,11 +370,11 @@@
            - mountPath: {{ .Values.config.odl.etcDir }}/org.opendaylight.daexim.cfg
              name: properties
              subPath: org.opendaylight.daexim.cfg
+           {{- if .Values.config.sdnr.oauth.enabled }}
+           - mountPath: {{ .Values.config.odl.etcDir }}/oauth-provider.config.json
+             name: properties
+             subPath: oauth-provider.config.json
+           {{ end }}
            resources:
  {{ include "common.resources" . | indent 12 }}
          {{- if .Values.nodeSelector }}

diff --combined kubernetes/sdnc/values.yaml
index e3f3a6e,d20c364..399740e
--- 1/kubernetes/sdnc/values.yaml
--- 2/kubernetes/sdnc/values.yaml
+++ b/kubernetes/sdnc/values.yaml
@@@ -86,67 -86,12 +86,67 @@@ secrets
      externalSecret: '{{ .Values.config.netboxApikeyExternalSecret }}'
      password: '{{ .Values.config.netboxApikey }}'
      passwordPolicy: required
 +  - uid: aai-truststore-password
 +    type: password
 +    externalSecret: '{{ .Values.config.aaiTruststoreExternalSecret }}'
 +    password: '{{ .Values.config.aaiTruststorePassword }}'
 +    passwordPolicy: required
 +  - uid: ansible-truststore-password
 +    type: password
 +    externalSecret: '{{ .Values.config.ansibleTruststoreExternalSecret }}'
 +    password: '{{ .Values.config.ansibleTruststorePassword }}'
 +    passwordPolicy: required
 +  - uid: truststore-password
 +    type: password
 +    externalSecret: '{{ .Values.config.truststoreExternalSecret }}'
 +    password: '{{ .Values.config.truststorePassword }}'
 +    passwordPolicy: required
 +  - uid: keystore-password
 +    type: password
 +    externalSecret: '{{ .Values.config.keystoreExternalSecret }}'
 +    password: '{{ .Values.config.keystorePassword }}'
 +    passwordPolicy: required
 +  - uid: dmaap-authkey
 +    type: password
 +    externalSecret: '{{ .Values.config.dmaapAuthKeyExternalSecret }}'
 +    password: '{{ .Values.config.dmaapAuthKey }}'
 +    passwordPolicy: required
    - uid: aai-user-creds
      type: basicAuth
      externalSecret: '{{ .Values.config.aaiCredsExternalSecret}}'
      login: '{{ .Values.config.aaiUser }}'
      password: '{{ .Values.config.aaiPassword }}'
      passwordPolicy: required
 +  - uid: so-user-creds
 +    type: basicAuth
 +    externalSecret: '{{ .Values.config.soCredsExternalSecret}}'
 +    login: '{{ .Values.config.soUser }}'
 +    password: '{{ .Values.config.soPassword }}'
 +    passwordPolicy: required
 +  - uid: neng-user-creds
 +    type: basicAuth
 +    externalSecret: '{{ .Values.config.nengCredsExternalSecret}}'
 +    login: '{{ .Values.config.nengUser }}'
 +    password: '{{ .Values.config.nengPassword }}'
 +    passwordPolicy: required
 +  - uid: cds-user-creds
 +    type: basicAuth
 +    externalSecret: '{{ .Values.config.cdsCredsExternalSecret}}'
 +    login: '{{ .Values.config.cdsUser }}'
 +    password: '{{ .Values.config.cdsPassword }}'
 +    passwordPolicy: required
 +  - uid: honeycomb-user-creds
 +    type: basicAuth
 +    externalSecret: '{{ .Values.config.honeycombCredsExternalSecret}}'
 +    login: '{{ .Values.config.honeycombUser }}'
 +    password: '{{ .Values.config.honeycombPassword }}'
 +    passwordPolicy: required
 +  - uid: dmaap-user-creds
 +    type: basicAuth
 +    externalSecret: '{{ .Values.config.dmaapCredsExternalSecret}}'
 +    login: '{{ .Values.config.dmaapUser }}'
 +    password: '{{ .Values.config.dmaapPassword }}'
 +    passwordPolicy: required
    - uid: modeling-user-creds
      type: basicAuth
      externalSecret: '{{ .Values.config.modelingCredsExternalSecret}}'
@@@ -172,6 -117,17 +172,17 @@@
      login: '{{ .Values.config.scaleoutUser }}'
      password: '{{ .Values.config.scaleoutPassword }}'
      passwordPolicy: required
+   - uid: oauth-token-secret
+     type: password
+     externalSecret: '{{ ternary (tpl (default "" .Values.config.sdnr.oauth.tokenExternalSecret) .) "oauth-disabled" .Values.config.sdnr.oauth.enabled }}'
+     password: '{{ .Values.config.sdnr.oauth.tokenSecret }}'
+     passwordPolicy: required
+   - uid: keycloak-secret
+     type: password
+     externalSecret: '{{ ternary (tpl (default "" .Values.config.sdnr.oauth.providersSecrets.keycloakExternalSecret) .) "oauth-disabled" .Values.config.sdnr.oauth.enabled }}'
+     password: '{{ .Values.config.sdnr.oauth.providersSecrets.keycloak }}'
+     passwordPolicy: required
+ 
  #################################################################
  # Certificates
  #################################################################
@@@ -196,7 -152,7 +207,7 @@@ certificates
  # application images
  
  pullPolicy: Always
 -image: onap/sdnc-image:2.0.5
 +image: onap/sdnc-image:2.1.3
  
  # flag to enable debugging - application support required
  debugEnabled: false
@@@ -210,34 -166,9 +221,34 @@@ config
    # odlCredsExternalSecret: some secret
    netboxApikey: onceuponatimeiplayedwithnetbox20180814
    # netboxApikeyExternalSecret: some secret
 +  aaiTruststorePassword: changeit
 +  # aaiTruststoreExternalSecret: some secret
 +  ansibleTruststorePassword: changeit
 +  # ansibleTruststoreExternalSecret: some secret
 +  truststorePassword: adminadmin
 +  # truststoreExternalSecret: some secret
 +  keystorePassword: adminadmin
 +  # keystoreExternalSecret: some secret
    aaiUser: sdnc@sdnc.onap.org
    aaiPassword: demo123456!
    # aaiCredsExternalSecret: some secret
 +  soUser: sdncaBpmn
 +  soPassword: password1$
 +  # soCredsExternalSecret: some secret
 +  nengUser: ccsdkapps
 +  nengPassword: ccsdkapps
 +  # nengCredsExternalSecret: some secret
 +  cdsUser: ccsdkapps
 +  cdsPassword: ccsdkapps
 +  # cdsCredsExternalSecret: some secret
 +  honeycombUser: admin
 +  honeycombPassword: admin
 +  # honeycombCredsExternalSecret: some secret
 +  dmaapUser: admin
 +  dmaapPassword: admin
 +  dmaapAuthKey: "fs20cKwalJ6ry4kX:7Hqm6BDZK47IKxGRkOPFk33qMYs="
 +  # dmaapCredsExternalSecret: some secret
 +  # dmaapAuthKeyExternalSecret: some secret
    modelingUser: ccsdkapps
    modelingPassword: ccsdkapps
    # modelingCredsExternalSecret: some secret
@@@ -311,6 -242,7 +322,7 @@@
      sdnrdbTrustAllCerts: true
      mountpointRegistrarEnabled: false
      mountpointStateProviderEnabled: false
+     #
      # enable and set dmaap-proxy for mountpointRegistrar
      dmaapProxy:
        enabled: false
@@@ -318,10 -250,28 +330,28 @@@
        user: addUserHere
        password: addPasswordHere
        url: addProxyUrlHere
- 
- 
- 
- 
+     oauth:
+       enabled: false
+       tokenIssuer: ONAP SDNC
+       tokenSecret: secret
+       supportOdlusers: true
+       redirectUri: null
+       publicUrl: none
+       odluxRbac:
+         enabled: true
+       # example definition for a oauth provider
+       providersSecrets:
+         keycloak: d8d7ed52-0691-4353-9ac6-5383e72e9c46
+       providers:
+       - id: keycloak
+         type: KEYCLOAK
+         host: http://keycloak:8080
+         clientId: odlux.app
+         secret: ${KEYCLOAK_SECRET}
+         scope: openid
+         title: ONAP Keycloak Provider
+         roleMapping:
+           mykeycloak: admin
  
  # dependency / sub-chart configuration
  certInitializer: