# AAF Authentication config
is_aaf_enabled: False
-aaf_cache_expiry_hrs: 3
+aaf_cache_expiry_mins: 5
aaf_url: https://aaftest.simpledemo.onap.org:8095
aaf_user_roles:
- /api/oof/v1/placement:org.onap.osdf.access|*|read ALL
+ - /api/oof/placement/v1:org.onap.osdf.access|*|read ALL
+ - /api/oof/v1/pci:org.onap.osdf.access|*|read ALL
+ - /api/oof/pci/v1:org.onap.osdf.access|*|read ALL
# Secret Management Service from AAF
aaf_sms_url: https://aaf-sms.onap:10443
return has_valid_role(perms)
except Exception as exp:
error_log.error("Error Authenticating the user {} : {}: ".format(uid, exp))
- pass
return False
def has_valid_role(perms):
aaf_user_roles = deploy_config['aaf_user_roles']
+ aaf_roles = get_role_list(perms)
+
for roles in aaf_user_roles:
path_perm = roles.split(':')
uri = path_perm[0]
- role = path_perm[1].split('|')[0]
- if re.search(uri, request.path) and perms:
- roles = perms.get('roles')
- if roles:
- perm_list = roles.get('perm')
- for p in perm_list:
- if role == p['type']:
- return True
+ perm = path_perm[1].split('|')
+ p = (perm[0], perm[1], perm[2].split()[0])
+ if re.search(uri, request.path) and p in aaf_roles:
+ return True
return False
+
"""
-Make the remote aaf api call if user is not in the cache.
+Build a list of roles tuples from the AAF response.
-Return the perms
"""
+
+
+def get_role_list(perms):
+ role_list = []
+ if perms:
+ roles = perms.get('roles')
+ if roles:
+ perm = roles.get('perm', [])
+ for p in perm:
+ role_list.append((p['type'], p['instance'], p['action']))
+ return role_list
+
+
def get_aaf_permissions(uid, passwd):
key = base64.b64encode(bytes("{}_{}".format(uid, passwd), "ascii"))
- time_delta = timedelta(hours=deploy_config.get('aaf_cache_expiry_hrs', 3))
+ time_delta = timedelta(minutes=deploy_config.get('aaf_cache_expiry_mins', 5))
perms = perm_cache.get(key)
osdfPlacementPassword: "testpwd"
is_aaf_enabled: False
-aaf_cache_expiry_hrs: 3
+aaf_cache_expiry_mins: 5
aaf_url: https://aaftest.simpledemo.onap.org:8095
aaf_user_roles:
- /api/oof/v1/placement:org.onap.osdf.access|*|read ALL
# -------------------------------------------------------------------------
#
import os
+
from flask import Flask
from mock import mock
def mock_aaf_response(*args, **kwargs):
return {"perm": [{"instance": "menu_ecd", "action": "*", "type": "org.onap.oof.controller.dev.menu"},
- {"instance": "*", "action": "*", "type": "org.onap.osdf.access"},
+ {"instance": "*", "action": "read", "type": "org.onap.osdf.access"},
{"instance": "aaf", "action": "request", "type": "org.onap.osdf.certman"},
{"instance": "*", "action": "*", "type": "org.onap.osdf.dev.access"},
{"instance": ":*:*", "action": "*", "type": "org.onap.osdf.dev.k8"},
auth.clear_cache()
def mock_aaf_response(*args, **kwargs):
- return {"perm": [{"instance": "menu_ecd", "action": "*", "type": "org.onap.oof.controller.dev.menu"},
- {"instance": "*", "action": "*", "type": "org.onap.osdf.access"},
+ return {"perm": [{"instance": "menu_ecd", "action": "*", "type": "org.onap.osdf.controller.dev.menu"},
+ {"instance": "*", "action": "read", "type": "org.onap.osdf.access"},
{"instance": "aaf", "action": "request", "type": "org.onap.osdf.certman"},
{"instance": "*", "action": "*", "type": "org.onap.osdf.dev.access"},
{"instance": ":*:*", "action": "*", "type": "org.onap.osdf.dev.k8"},