2 * ============LICENSE_START=======================================================
4 * ================================================================================
5 * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6 * ================================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END=========================================================
20 package org.openecomp.policy.xacml.std.pip.engines.aaf;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.Collection;
25 import java.util.HashMap;
26 import java.util.Iterator;
27 import java.util.List;
29 import java.util.Properties;
31 import org.apache.commons.logging.Log;
32 import org.apache.commons.logging.LogFactory;
33 import org.openecomp.policy.utils.AAFPolicyClient;
34 import org.openecomp.policy.utils.AAFPolicyException;
36 import com.att.research.xacml.api.Attribute;
37 import com.att.research.xacml.api.AttributeValue;
38 import com.att.research.xacml.api.Identifier;
39 import com.att.research.xacml.api.XACML3;
40 import com.att.research.xacml.api.pip.PIPException;
41 import com.att.research.xacml.api.pip.PIPFinder;
42 import com.att.research.xacml.api.pip.PIPRequest;
43 import com.att.research.xacml.api.pip.PIPResponse;
44 import com.att.research.xacml.std.IdentifierImpl;
45 import com.att.research.xacml.std.StdMutableAttribute;
46 import com.att.research.xacml.std.datatypes.DataTypes;
47 import com.att.research.xacml.std.pip.StdMutablePIPResponse;
48 import com.att.research.xacml.std.pip.StdPIPRequest;
49 import com.att.research.xacml.std.pip.StdPIPResponse;
50 import com.att.research.xacml.std.pip.engines.StdConfigurableEngine;
51 import com.att.research.xacml.util.XACMLProperties;
54 * PIP Engine for Implementing {@link com.att.research.xacml.std.pip.engines.ConfigurableEngine} interface to provide
55 * attribute retrieval from AT&T AAF interface.
59 public class AAFEngine extends StdConfigurableEngine {
61 public static final String DEFAULT_DESCRIPTION = "PIP for authenticating aaf attributes using the AT&T AAF REST interface";
62 public static final String DEFAULT_ISSUER = "att-aaf";
64 private static final String SUCCESS = "Success";
66 public static final String AAF_RESULT= "AAF_RESULT";
67 public static final String AAF_RESPONSE= "AAF_RESPONSE";
69 public static final Identifier AAF_RESPONSE_ID = new IdentifierImpl(AAF_RESPONSE);
70 public static final Identifier AAF_RESULT_ID = new IdentifierImpl(AAF_RESULT);
73 private static final PIPRequest PIP_REQUEST_UID = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ID"), XACML3.ID_DATATYPE_STRING);
74 private static final PIPRequest PIP_REQUEST_PASS = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_PASS"), XACML3.ID_DATATYPE_STRING);
75 private static final PIPRequest PIP_REQUEST_TYPE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_TYPE"), XACML3.ID_DATATYPE_STRING);
76 private static final PIPRequest PIP_REQUEST_INSTANCE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_INSTANCE"), XACML3.ID_DATATYPE_STRING);
77 private static final PIPRequest PIP_REQUEST_ACTION = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ACTION"), XACML3.ID_DATATYPE_STRING);
79 private static final List<PIPRequest> mapRequiredAttributes = new ArrayList<>();
81 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_UID));
82 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_PASS));
83 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_TYPE));
84 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_INSTANCE));
85 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_ACTION));
88 private static final Map<PIPRequest, String> mapSupportedAttributes = new HashMap<>();
90 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, XACML3.ID_DATATYPE_STRING), "response");
91 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, XACML3.ID_DATATYPE_BOOLEAN), "result");
94 protected Log logger = LogFactory.getLog(this.getClass());
99 private PIPResponse getAttribute(PIPRequest pipRequest, PIPFinder pipFinder) {
100 PIPResponse pipResponse = null;
102 pipResponse = pipFinder.getMatchingAttributes(pipRequest, this);
103 if (pipResponse.getStatus() != null && !pipResponse.getStatus().isOk()) {
104 this.logger.warn("Error retrieving " + pipRequest.getAttributeId().stringValue() + ": " + pipResponse.getStatus().toString());
107 if (pipResponse.getAttributes().size() == 0) {
108 this.logger.warn("No value for " + pipRequest.getAttributeId().stringValue());
111 } catch (PIPException ex) {
112 this.logger.error("PIPException getting subject-id attribute: " + ex.getMessage(), ex);
117 private String getValue(PIPResponse pipResponse){
118 String result = null;
119 Collection<Attribute> listAttributes = pipResponse.getAttributes();
120 for(Attribute attribute: listAttributes){
121 Iterator<AttributeValue<String>> iterAttributeValues = attribute.findValues(DataTypes.DT_STRING);
122 if(iterAttributeValues!=null) {
123 while(iterAttributeValues.hasNext()){
124 result = iterAttributeValues.next().getValue();
132 private synchronized String getResult(PIPFinder pipFinder) {
133 PIPResponse pipResponseUID = this.getAttribute(PIP_REQUEST_UID, pipFinder);
134 PIPResponse pipResponsePass = this.getAttribute(PIP_REQUEST_PASS, pipFinder);
135 PIPResponse pipResponseType = this.getAttribute(PIP_REQUEST_TYPE, pipFinder);
136 PIPResponse pipResponseAction = this.getAttribute(PIP_REQUEST_ACTION, pipFinder);
137 PIPResponse pipResponseInstance = this.getAttribute(PIP_REQUEST_INSTANCE, pipFinder);
138 String response = null;
139 // Evaluate AAF if we have all the required values.
140 if(pipResponseUID!=null && pipResponsePass!=null && pipResponseType != null && pipResponseAction!= null && pipResponseInstance!=null){
141 String userName = getValue(pipResponseUID);
142 String pass = getValue(pipResponsePass);
143 AAFPolicyClient aafClient = null;
144 Properties properties;
146 properties = XACMLProperties.getProperties();
147 logger.debug("environment : " + properties.getProperty("ENVIRONMENT"));
148 } catch (IOException e1) {
149 logger.error("Exception while getting the properties " + e1);
150 properties = new Properties();
151 properties.setProperty("AAF_LOG_LEVEL", "DEBUG");
153 if(userName!=null && pass!=null){
155 aafClient = AAFPolicyClient.getInstance(properties);
156 } catch (AAFPolicyException e) {
157 logger.error("AAF configuration failed. " + e.getMessage());
160 if(aafClient.checkAuth(userName, pass)){
161 String type = getValue(pipResponseType);
162 String instance = getValue(pipResponseInstance);
163 String action = getValue(pipResponseAction);
164 if(aafClient.checkPerm(userName, pass, type, instance, action)){
165 response = SUCCESS + "Permissions Validated";
167 response = "No Permissions for "+userName+" to: "+type+", "+instance+", "+action;
170 response = "Authentication Failed for the given Values";
174 response = "ID and Password are not given";
178 response = "Insufficient Values to Evaluate AAF";
183 private void addStringAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, String value) {
185 AttributeValue<String> attributeValue = null;
187 attributeValue = DataTypes.DT_STRING.createAttributeValue(value);
188 } catch (Exception ex) {
189 this.logger.error("Failed to convert " + value + " to an AttributeValue<String>", ex);
191 if (attributeValue != null) {
192 stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
197 private void addBooleanAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, boolean value) {
198 AttributeValue<Boolean> attributeValue = null;
200 attributeValue = DataTypes.DT_BOOLEAN.createAttributeValue(value);
201 } catch (Exception ex) {
202 this.logger.error("Failed to convert " + value + " to an AttributeValue<Boolean>", ex);
204 if (attributeValue != null) {
205 stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
210 public PIPResponse getAttributes(PIPRequest pipRequest, PIPFinder pipFinder) throws PIPException {
212 * First check to see if the issuer is set and then match it
215 if ((string = pipRequest.getIssuer()) != null) {
216 if (!string.equals(this.getIssuer())) {
217 this.logger.debug("Requested issuer '" + string + "' does not match " + (this.getIssuer() == null ? "null" : "'" + this.getIssuer() + "'"));
218 return StdPIPResponse.PIP_RESPONSE_EMPTY;
223 * Drop the issuer and see if the request matches any of our supported queries
225 PIPRequest pipRequestSupported = (pipRequest.getIssuer() == null ? pipRequest : new StdPIPRequest(pipRequest.getCategory(), pipRequest.getAttributeId(), pipRequest.getDataTypeId()));
226 if (!mapSupportedAttributes.containsKey(pipRequestSupported)) {
227 this.logger.debug("Requested attribute '" + pipRequest.toString() + "' is not supported");
228 return StdPIPResponse.PIP_RESPONSE_EMPTY;
230 StdMutablePIPResponse stdPIPResponse = new StdMutablePIPResponse();
231 String response = this.getResult(pipFinder);
232 boolean result = false;
233 if(response.contains(SUCCESS)){
236 this.addBooleanAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, result);
237 this.addStringAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, response);
238 return new StdPIPResponse(stdPIPResponse);
242 public void configure(String id, Properties properties) throws PIPException {
243 super.configure(id, properties);
244 if (this.getDescription() == null) {
245 this.setDescription(DEFAULT_DESCRIPTION);
247 if (this.getIssuer() == null) {
248 this.setIssuer(DEFAULT_ISSUER);
253 public Collection<PIPRequest> attributesRequired() {
254 List<PIPRequest> attributes = new ArrayList<>();
255 for (PIPRequest attribute: mapRequiredAttributes) {
256 attributes.add(new StdPIPRequest(attribute));
262 public Collection<PIPRequest> attributesProvided() {
263 List<PIPRequest> attributes = new ArrayList<>();
264 for (PIPRequest attribute : mapSupportedAttributes.keySet()) {
265 attributes.add(new StdPIPRequest(attribute));