2 * ============LICENSE_START=======================================================
4 * ================================================================================
5 * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6 * ================================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END=========================================================
21 package org.openecomp.policy.pdp.rest;
23 import java.io.FileOutputStream;
24 import java.io.IOException;
25 import java.io.InputStream;
26 import java.io.OutputStream;
27 import java.net.MalformedURLException;
30 import java.net.URLConnection;
31 import java.nio.charset.StandardCharsets;
32 import java.nio.file.Files;
33 import java.nio.file.Path;
34 import java.nio.file.Paths;
35 import java.util.Base64;
36 import java.util.ConcurrentModificationException;
37 import java.util.HashMap;
38 import java.util.Properties;
41 import org.apache.commons.io.IOUtils;
42 import org.openecomp.policy.pdp.rest.notifications.NotificationController;
43 import org.openecomp.policy.rest.XACMLRest;
44 import org.openecomp.policy.rest.XACMLRestProperties;
45 import org.openecomp.policy.common.logging.flexlogger.FlexLogger;
46 import org.openecomp.policy.common.logging.flexlogger.Logger;
48 import org.openecomp.policy.xacml.api.XACMLErrorConstants;
49 import com.att.research.xacml.api.pap.PAPException;
50 import com.att.research.xacml.api.pap.PDPStatus;
51 import com.att.research.xacml.api.pap.PDPStatus.Status;
52 import com.att.research.xacml.api.pdp.PDPEngine;
53 import com.att.research.xacml.api.pdp.PDPEngineFactory;
54 import com.att.research.xacml.api.pip.PIPEngine;
55 import com.att.research.xacml.api.pip.PIPException;
56 import com.att.research.xacml.api.pip.PIPFinder;
57 import com.att.research.xacml.api.pip.PIPFinderFactory;
58 import org.openecomp.policy.xacml.std.pap.StdPDPPIPConfig;
59 import org.openecomp.policy.xacml.std.pap.StdPDPPolicy;
60 import org.openecomp.policy.xacml.std.pap.StdPDPStatus;
61 import com.att.research.xacml.util.FactoryException;
62 import com.att.research.xacml.util.XACMLProperties;
63 import com.att.research.xacmlatt.pdp.policy.PolicyDef;
64 import com.att.research.xacmlatt.pdp.policy.dom.DOMPolicyDef;
65 import com.att.research.xacmlatt.pdp.std.StdPolicyFinderFactory;
66 import com.google.common.base.Splitter;
69 * Does the work for loading policy and PIP configurations sent from the PAP
75 public class XACMLPdpLoader {
76 private static final Logger LOGGER = FlexLogger.getLogger(XACMLPdpLoader.class);
77 private static NotificationController notificationController = new NotificationController();
78 private static final Long notifyDelay = (long) XACMLPdpServlet.getNotificationDelay();
81 public static synchronized PDPEngine loadEngine(StdPDPStatus status,
82 Properties policyProperties, Properties pipProperties) {
83 LOGGER.info("loadEngine: " + policyProperties + " " + pipProperties);
85 // First load our policies
89 // Were we given some properties?
91 if (policyProperties == null) {
93 // On init we have no incoming configuration, so just
94 // Load our current saved configuration
96 policyProperties = new Properties();
97 try (InputStream is = Files.newInputStream(getPDPPolicyCache())) {
98 policyProperties.load(is);
103 // Get our policy cache up-to-date
105 // Side effects of this include:
106 // - downloading of policies from remote locations, and
107 // - creating new "<PolicyId>.file" properties for files existing
110 XACMLPdpLoader.cachePolicies(policyProperties);
112 // Validate the policies
114 XACMLPdpLoader.validatePolicies(policyProperties, status);
115 if (LOGGER.isDebugEnabled()) {
116 LOGGER.debug("Status: " + status);
118 } catch (ConcurrentModificationException e) {
119 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + e.getMessage() + e);
120 } catch (Exception e) {
121 String error = "Failed to load Policy Cache properties file: "
123 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + error, e);
124 status.addLoadError(error);
125 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
128 // Load our PIP configuration
132 // Were we given some properties to use?
134 if (pipProperties == null) {
136 // Load our current saved configuration
138 pipProperties = new Properties();
139 try (InputStream is = Files.newInputStream(getPIPConfig())) {
140 pipProperties.load(is);
144 // Validate our PIP configurations
146 XACMLPdpLoader.validatePipConfiguration(pipProperties, status);
147 if (LOGGER.isDebugEnabled()) {
148 LOGGER.debug("Status: " + status);
150 } catch (Exception e) {
151 String error = "Failed to load/validate Pip Config properties file: "
153 LOGGER.error(XACMLErrorConstants.ERROR_DATA_ISSUE + error, e);
154 status.addLoadError(XACMLErrorConstants.ERROR_PROCESS_FLOW + error);
155 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
158 // Were they validated?
160 if (status.getStatus() == Status.LOAD_ERRORS) {
161 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW +"there were load errors");
165 // Reset our official properties the PDP factory
166 // uses to configure the PDP engine.
168 XACMLRest.loadXacmlProperties(policyProperties, pipProperties);
170 // Dump ALL our properties that we are trying to load
173 LOGGER.info(XACMLProperties.getProperties().toString());
174 } catch (IOException e) {
175 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to get XACML Properties", e);
178 // Now load the PDP engine
180 PDPEngineFactory factory = null;
181 PDPEngine engine = null;
183 factory = PDPEngineFactory.newInstance();
184 engine = factory.newEngine();
185 LOGGER.info("Loaded new PDP engine.");
186 status.setStatus(Status.UP_TO_DATE);
187 } catch (FactoryException e) {
188 String error = "Failed to create new PDP Engine";
189 LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR +error, e);
190 status.addLoadError(error);
192 // Notification will be Sent Here.
197 private static HashMap<String, PolicyDef> policyContainer = null;
199 private static void sendNotification(){
200 Thread notify = new Thread(){
203 Thread.sleep(notifyDelay);
204 NotificationController.sendNotification();
206 LOGGER.error(XACMLErrorConstants.ERROR_UNKNOWN + e);
213 public static synchronized void validatePolicies(Properties properties,
214 StdPDPStatus status) throws PAPException {
215 Set<String> rootPolicies = XACMLProperties.getRootPolicyIDs(properties);
216 Set<String> refPolicies = XACMLProperties
217 .getReferencedPolicyIDs(properties);
218 policyContainer = new HashMap<String, PolicyDef>();
220 for (String id : rootPolicies) {
221 loadPolicy(properties, status, id, true);
223 // remember which policies were root policies
224 status.addAllLoadedRootPolicies(status.getLoadedPolicies());
226 for (String id : refPolicies) {
227 loadPolicy(properties, status, id, false);
229 LOGGER.info("Loaded " + status.getLoadedPolicies().size()
230 + " policies, failed to load "
231 + status.getFailedPolicies().size() + " policies, "
232 + status.getLoadedRootPolicies().size() + " root policies");
233 notificationController.check(status, policyContainer);
234 if (status.getLoadedRootPolicies().size() == 0) {
235 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW +"NO ROOT POLICIES LOADED!!! Cannot serve PEP Requests.");
236 status.addLoadWarning("NO ROOT POLICIES LOADED!!! Cannot serve PEP Requests.");
238 policyContainer.clear();
242 public static synchronized void loadPolicy(Properties properties,
243 StdPDPStatus status, String id, boolean isRoot) throws PAPException {
244 PolicyDef policy = null;
245 String location = null;
246 URI locationURI = null;
247 boolean isFile = false;
248 boolean rougeFile = false;
250 location = properties.getProperty(id + ".file");
251 if(location != null){
253 locationURI = Paths.get(location).toUri();
254 try (InputStream is = Files.newInputStream(Paths.get(location))) {
255 policy = DOMPolicyDef.load(is);
256 } catch (Exception e){
257 // This Happens if a any issue with the error policyFile. Lets remove it.
259 LOGGER.error("Corrupted policy file, deleting: " + location + e);
260 Files.delete(Paths.get(location));
261 properties.remove(id + ".file");
263 } catch (IOException e1) {
268 if(location==null || rougeFile){
272 location = properties.getProperty(id + ".url");
273 if (location != null) {
278 boolean error= false;
281 PapUrlResolver papUrls = PapUrlResolver.getInstance();
282 while(papUrls.hasMoreUrls()){
283 String papID = papUrls.getUserId();
284 String papPass = papUrls.getPass();
285 Base64.Encoder encoder = Base64.getEncoder();
286 String encoding = encoder.encodeToString((papID+":"+papPass).getBytes(StandardCharsets.UTF_8));
287 locationURI = URI.create(papUrls.getUrl(PapUrlResolver.extractIdFromUrl(location)));
288 URL url = locationURI.toURL();
289 URLConnection urlConnection = null;
291 urlConnection = url.openConnection();
292 } catch (IOException e){
293 LOGGER.error("Exception Occured while opening connection" +e);
298 urlConnection.setRequestProperty(XACMLRestProperties.PROP_PDP_HTTP_HEADER_ID,
299 XACMLProperties.getProperty(XACMLRestProperties.PROP_PDP_ID));
300 urlConnection.setRequestProperty("Authorization", "Basic " + encoding);
302 // Now construct the output file name
304 Path outFile = Paths.get(getPDPConfig().toAbsolutePath()
309 try (FileOutputStream fos = new FileOutputStream(
311 IOUtils.copy(urlConnection.getInputStream(), fos);
312 } catch(IOException e){
313 LOGGER.error("Exception Occured while Copying input stream" +e);
322 try (InputStream fis = Files.newInputStream(outFile)) {
323 policy = DOMPolicyDef.load(fis);
326 LOGGER.error("Corrupted policy file, deleting: " + location +e);
327 Files.delete(outFile);
331 } catch (IOException e1) {
338 properties.setProperty(id + ".file", outFile
339 .toAbsolutePath().toString());
343 }while(error && errorCount>2);
346 if (policy != null) {
347 status.addLoadedPolicy(new StdPDPPolicy(id, isRoot,
348 locationURI, properties));
349 LOGGER.info("Loaded policy: " + policy.getIdentifier()
350 + " version: " + policy.getVersion().stringValue());
351 // Sending the policy objects to the Notification Controller.
352 policyContainer.put(id, policy);
354 String error = "Failed to load policy " + location;
355 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + error);
356 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
357 status.addLoadError(error);
358 status.addFailedPolicy(new StdPDPPolicy(id, isRoot));
360 } catch (Exception e) {
361 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW +"Failed to load policy '" + id + "' from location '"
362 + location + "'", e);
363 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
364 status.addFailedPolicy(new StdPDPPolicy(id, isRoot));
373 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Corrupted policy file, deleting: " + location);
374 Files.delete(Paths.get(location));
376 } catch (IOException e1) {
377 LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR + e1);
383 public static synchronized void validatePipConfiguration(
384 Properties properties, StdPDPStatus status) throws PAPException {
386 PIPFinderFactory factory = PIPFinderFactory.newInstance(properties);
387 if (factory == null) {
388 throw new FactoryException(
389 "Could not create PIP Finder Factory: "
391 .getProperty(XACMLProperties.PROP_PIPFINDERFACTORY));
393 PIPFinder finder = factory.getFinder(properties);
395 // Check for this, although it should always return something
397 if (finder == null) {
398 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "pip finder factory returned a null engine.");
399 throw new PIPException("Could not create PIP Finder");
401 LOGGER.info("Loaded PIP finder");
403 for (PIPEngine engine : finder.getPIPEngines()) {
404 LOGGER.info("Configured PIP Engine: " + engine.getName());
405 StdPDPPIPConfig config = new StdPDPPIPConfig();
406 config.setName(engine.getName());
407 status.addLoadedPipConfig(config);
409 } catch (FactoryException | PIPException e) {
410 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "validate PIP configuration failed: "
411 + e.getLocalizedMessage());
412 status.addLoadError(e.getLocalizedMessage());
413 status.setStatus(Status.LOAD_ERRORS);
414 throw new PAPException(e);
419 * Iterates the policies defined in the props object to ensure they are
420 * loaded locally. Policies are searched for in the following order: - see
421 * if the current properties has a "<PolicyID>.file" entry and that
422 * file exists in the local directory - if not, see if the file exists in
423 * the local directory; if so create a ".file" property for it. - if not,
424 * get the "<PolicyID>.url" property and try to GET the policy from
425 * that location (and set the ".file" property)
427 * If the ".file" property is created, then true is returned to tell the
428 * caller that the props object changed.
431 * @return true/false if anything was changed in the props object
432 * @throws PAPException
434 public static synchronized boolean cachePolicies(Properties props)
435 throws PAPException {
436 boolean changed = false;
437 String[] lists = new String[2];
438 lists[0] = props.getProperty(XACMLProperties.PROP_ROOTPOLICIES);
439 lists[1] = props.getProperty(XACMLProperties.PROP_REFERENCEDPOLICIES);
440 for (String list : lists) {
442 // Check for a null or empty parameter
444 if (list == null || list.length() == 0) {
447 Iterable<String> policies = Splitter.on(',').trimResults()
448 .omitEmptyStrings().split(list);
449 for (String policy : policies) {
450 boolean policyExists = false;
452 // First look for ".file" property and verify the file exists
453 String propLocation = props.getProperty(policy
454 + StdPolicyFinderFactory.PROP_FILE);
455 if (propLocation != null) {
459 policyExists = Files.exists(Paths.get(propLocation));
460 if (policyExists == false) {
461 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy file " + policy + " expected at "
462 + propLocation + " does NOT exist.");
466 // If ".file" property does not exist, try looking for the local
468 // (it might exist without having a ".file" property set for it)
469 if (policyExists == false) {
471 // Now construct the output file name
473 Path outFile = Paths.get(getPDPConfig().toAbsolutePath()
474 .toString(), policy);
476 // Double check to see if we pulled it at some point
478 policyExists = Files.exists(outFile);
481 // Set the property so the PDP engine doesn't have
482 // to pull it from the URL but rather the FILE.
484 LOGGER.info("Policy does exist: "
485 + outFile.toAbsolutePath().toString());
486 props.setProperty(policy
487 + StdPolicyFinderFactory.PROP_FILE, outFile
488 .toAbsolutePath().toString());
490 // Indicate that there were changes made to the
496 // File does not exist locally, so we need to get it
497 // from the location given in the ".url" property (which
501 // There better be a URL to retrieve it
503 propLocation = props.getProperty(policy
504 + StdPolicyFinderFactory.PROP_URL);
505 if (propLocation != null) {
509 PapUrlResolver papUrls = PapUrlResolver.getInstance();
510 while(papUrls.hasMoreUrls()){
511 String papID = papUrls.getUserId();
512 String papPass = papUrls.getPass();
513 Base64.Encoder encoder = Base64.getEncoder();
514 String encoding = encoder.encodeToString((papID+":"+papPass).getBytes(StandardCharsets.UTF_8));
520 url = new URL(papUrls.getUrl(PapUrlResolver.extractIdFromUrl(propLocation)));
521 LOGGER.info("Pulling " + url.toString());
523 // Open the connection
525 URLConnection urlConnection = url.openConnection();
526 urlConnection.setRequestProperty(XACMLRestProperties.PROP_PDP_HTTP_HEADER_ID,
527 XACMLProperties.getProperty(XACMLRestProperties.PROP_PDP_ID));
528 urlConnection.setRequestProperty("Authorization", "Basic " + encoding);
532 try (InputStream is = urlConnection
534 OutputStream os = new FileOutputStream(
536 IOUtils.copy(is, os);
539 // Now save it in the properties as a .file
541 LOGGER.info("Pulled policy: "
542 + outFile.toAbsolutePath().toString());
543 props.setProperty(policy
544 + StdPolicyFinderFactory.PROP_FILE,
545 outFile.toAbsolutePath().toString());
548 // Indicate that there were changes made to the
552 } catch (Exception e) {
554 if (e instanceof MalformedURLException) {
555 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy '"
557 + "' had bad URL in new configuration, URL='"
558 + propLocation + "'");
561 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Error while retrieving policy "
570 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy " + policy
571 + " does NOT exist and does NOT have a URL");
580 public static synchronized Path getPDPPolicyCache() throws PAPException {
581 Path config = getPDPConfig();
582 Path policyProperties = Paths.get(config.toAbsolutePath().toString(),
583 "xacml.policy.properties");
584 if (Files.notExists(policyProperties)) {
585 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + policyProperties.toAbsolutePath().toString()
586 + " does NOT exist.");
588 // Try to create the file
591 Files.createFile(policyProperties);
592 } catch (IOException e) {
593 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to create policy properties file: "
594 + policyProperties.toAbsolutePath().toString() +e);
595 throw new PAPException(
596 "Failed to create policy properties file: "
597 + policyProperties.toAbsolutePath().toString());
600 return policyProperties;
603 public static synchronized Path getPIPConfig() throws PAPException {
604 Path config = getPDPConfig();
605 Path pipConfigProperties = Paths.get(
606 config.toAbsolutePath().toString(), "xacml.pip.properties");
607 if (Files.notExists(pipConfigProperties)) {
608 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + pipConfigProperties.toAbsolutePath().toString()
609 + " does NOT exist.");
611 // Try to create the file
614 Files.createFile(pipConfigProperties);
615 } catch (IOException e) {
616 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to create pip properties file: "
617 + pipConfigProperties.toAbsolutePath().toString() +e);
618 throw new PAPException("Failed to create pip properties file: "
619 + pipConfigProperties.toAbsolutePath().toString());
622 return pipConfigProperties;
625 public static synchronized Path getPDPConfig() throws PAPException {
626 Path config = Paths.get(XACMLProperties
627 .getProperty(XACMLRestProperties.PROP_PDP_CONFIG));
628 if (Files.notExists(config)) {
629 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + config.toAbsolutePath().toString() + " does NOT exist.");
631 // Try to create the directory
634 Files.createDirectories(config);
635 } catch (IOException e) {
636 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to create config directory: "
637 + config.toAbsolutePath().toString(), e);
638 throw new PAPException("Failed to create config directory: "
639 + config.toAbsolutePath().toString());