ECOMP-XACML/src/main/java/org/openecomp/policy/xacml/std/pip/engines/aaf/AAFEngine.java

   1 /*-
   2  * ============LICENSE_START=======================================================
   3  * ECOMP-XACML
   4  * ================================================================================
   5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
   6  * ================================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END=========================================================
  19  */
  20 package org.openecomp.policy.xacml.std.pip.engines.aaf;
  21
  22 import java.io.IOException;
  23 import java.util.ArrayList;
  24 import java.util.Collection;
  25 import java.util.HashMap;
  26 import java.util.Iterator;
  27 import java.util.List;
  28 import java.util.Map;
  29 import java.util.Properties;
  30
  31 import org.apache.commons.logging.Log;
  32 import org.apache.commons.logging.LogFactory;
  33 import org.openecomp.policy.utils.AAFPolicyClient;
  34 import org.openecomp.policy.utils.AAFPolicyException;
  35
  36 import com.att.research.xacml.api.Attribute;
  37 import com.att.research.xacml.api.AttributeValue;
  38 import com.att.research.xacml.api.Identifier;
  39 import com.att.research.xacml.api.XACML3;
  40 import com.att.research.xacml.api.pip.PIPException;
  41 import com.att.research.xacml.api.pip.PIPFinder;
  42 import com.att.research.xacml.api.pip.PIPRequest;
  43 import com.att.research.xacml.api.pip.PIPResponse;
  44 import com.att.research.xacml.std.IdentifierImpl;
  45 import com.att.research.xacml.std.StdMutableAttribute;
  46 import com.att.research.xacml.std.datatypes.DataTypes;
  47 import com.att.research.xacml.std.pip.StdMutablePIPResponse;
  48 import com.att.research.xacml.std.pip.StdPIPRequest;
  49 import com.att.research.xacml.std.pip.StdPIPResponse;
  50 import com.att.research.xacml.std.pip.engines.StdConfigurableEngine;
  51 import com.att.research.xacml.util.XACMLProperties;
  52
  53 /**
  54  * PIP Engine for Implementing {@link com.att.research.xacml.std.pip.engines.ConfigurableEngine} interface to provide
  55  * attribute retrieval from AT&T AAF interface.
  56  *
  57  * @version $Revision$
  58  */
  59 public class AAFEngine extends StdConfigurableEngine {
  60
  61         public static final String DEFAULT_DESCRIPTION          = "PIP for authenticating aaf attributes using the AT&T AAF REST interface";
  62         public static final String DEFAULT_ISSUER                       = "att-aaf";
  63
  64         private static final String SUCCESS = "Success";
  65
  66         public static final String AAF_RESULT= "AAF_RESULT";
  67         public static final String AAF_RESPONSE= "AAF_RESPONSE";
  68         //
  69         public static final Identifier AAF_RESPONSE_ID = new IdentifierImpl(AAF_RESPONSE);
  70         public static final Identifier AAF_RESULT_ID = new IdentifierImpl(AAF_RESULT);
  71
  72         //
  73         private static final PIPRequest PIP_REQUEST_UID = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ID"), XACML3.ID_DATATYPE_STRING);
  74         private static final PIPRequest PIP_REQUEST_PASS =  new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_PASS"), XACML3.ID_DATATYPE_STRING);
  75         private static final PIPRequest PIP_REQUEST_TYPE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_TYPE"), XACML3.ID_DATATYPE_STRING);
  76         private static final PIPRequest PIP_REQUEST_INSTANCE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_INSTANCE"), XACML3.ID_DATATYPE_STRING);
  77         private static final PIPRequest PIP_REQUEST_ACTION = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ACTION"), XACML3.ID_DATATYPE_STRING);
  78
  79         private static final List<PIPRequest> mapRequiredAttributes     = new ArrayList<>();
  80         static{
  81                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_UID));
  82                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_PASS));
  83                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_TYPE));
  84                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_INSTANCE));
  85                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_ACTION));
  86         }
  87
  88         private static final Map<PIPRequest, String> mapSupportedAttributes     = new HashMap<>();
  89         static{
  90                 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, XACML3.ID_DATATYPE_STRING), "response");
  91                 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, XACML3.ID_DATATYPE_BOOLEAN), "result");
  92         }
  93
  94         protected Log logger    = LogFactory.getLog(this.getClass());
  95
  96         public AAFEngine(){
  97         }
  98
  99         private PIPResponse getAttribute(PIPRequest pipRequest, PIPFinder pipFinder) {
 100                 PIPResponse pipResponse = null;
 101                 try {
 102                         pipResponse     = pipFinder.getMatchingAttributes(pipRequest, this);
 103                         if (pipResponse.getStatus() != null && !pipResponse.getStatus().isOk()) {
 104                                 this.logger.warn("Error retrieving " + pipRequest.getAttributeId().stringValue() + ": " + pipResponse.getStatus().toString());
 105                                 pipResponse     = null;
 106                         }
 107                         if (pipResponse.getAttributes().size() == 0) {
 108                                 this.logger.warn("No value for " + pipRequest.getAttributeId().stringValue());
 109                                 pipResponse     = null;
 110                         }
 111                 } catch (PIPException ex) {
 112                         this.logger.error("PIPException getting subject-id attribute: " + ex.getMessage(), ex);
 113                 }
 114                 return pipResponse;
 115         }
 116
 117         private String getValue(PIPResponse pipResponse){
 118                 String result = null;
 119                 Collection<Attribute> listAttributes = pipResponse.getAttributes();
 120                 for(Attribute attribute: listAttributes){
 121                         Iterator<AttributeValue<String>> iterAttributeValues = attribute.findValues(DataTypes.DT_STRING);
 122                         if(iterAttributeValues!=null) {
 123                                 while(iterAttributeValues.hasNext()){
 124                                         result = iterAttributeValues.next().getValue();
 125                                         break;
 126                                 }
 127                         }
 128                 }
 129                 return result;
 130         }
 131
 132         private synchronized String getResult(PIPFinder pipFinder) {
 133                 PIPResponse pipResponseUID = this.getAttribute(PIP_REQUEST_UID, pipFinder);
 134                 PIPResponse pipResponsePass = this.getAttribute(PIP_REQUEST_PASS, pipFinder);
 135                 PIPResponse pipResponseType = this.getAttribute(PIP_REQUEST_TYPE, pipFinder);
 136                 PIPResponse pipResponseAction = this.getAttribute(PIP_REQUEST_ACTION, pipFinder);
 137                 PIPResponse pipResponseInstance = this.getAttribute(PIP_REQUEST_INSTANCE, pipFinder);
 138                 String response = null;
 139                 // Evaluate AAF if we have all the required values.
 140                 if(pipResponseUID!=null && pipResponsePass!=null && pipResponseType != null && pipResponseAction!= null && pipResponseInstance!=null){
 141                         String userName = getValue(pipResponseUID);
 142                         String pass = getValue(pipResponsePass);
 143                         AAFPolicyClient aafClient = null;
 144                         Properties properties;
 145                         try {
 146                 properties = XACMLProperties.getProperties();
 147                 logger.debug("environment : " + properties.getProperty("ENVIRONMENT"));
 148             } catch (IOException e1) {
 149                 logger.error("Exception while getting the properties " + e1);
 150                 properties = new Properties();
 151                 properties.setProperty("AAF_LOG_LEVEL", "DEBUG");
 152             }
 153                         if(userName!=null && pass!=null){
 154                                 try {
 155                                         aafClient = AAFPolicyClient.getInstance(properties);
 156                                 } catch (AAFPolicyException e) {
 157                                         logger.error("AAF configuration failed. " + e.getMessage());
 158                                 }
 159                                 if(aafClient!=null){
 160                                         if(aafClient.checkAuth(userName, pass)){
 161                                                 String type = getValue(pipResponseType);
 162                                                 String instance = getValue(pipResponseInstance);
 163                                                 String action = getValue(pipResponseAction);
 164                                                 if(aafClient.checkPerm(userName, pass, type, instance, action)){
 165                                                         response = SUCCESS + "Permissions Validated";
 166                                                 }else{
 167                                                         response = "No Permissions for "+userName+" to: "+type+", "+instance+", "+action;
 168                                                 }
 169                                         }else{
 170                                                 response = "Authentication Failed for the given Values";
 171                                         }
 172                                 }
 173                         }else{
 174                                 response = "ID and Password are not given";
 175                         }
 176
 177                 }else{
 178                         response = "Insufficient Values to Evaluate AAF";
 179                 }
 180                 return response;
 181         }
 182
 183         private void addStringAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, String value) {
 184                 if (value != null) {
 185                         AttributeValue<String> attributeValue   = null;
 186                         try {
 187                                 attributeValue  = DataTypes.DT_STRING.createAttributeValue(value);
 188                         } catch (Exception ex) {
 189                                 this.logger.error("Failed to convert " + value + " to an AttributeValue<String>", ex);
 190                         }
 191                         if (attributeValue != null) {
 192                                 stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
 193                         }
 194                 }
 195         }
 196
 197         private void addBooleanAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, boolean value) {
 198                 AttributeValue<Boolean> attributeValue  = null;
 199                 try {
 200                         attributeValue  = DataTypes.DT_BOOLEAN.createAttributeValue(value);
 201                 } catch (Exception ex) {
 202                         this.logger.error("Failed to convert " + value + " to an AttributeValue<Boolean>", ex);
 203                 }
 204                 if (attributeValue != null) {
 205                         stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
 206                 }
 207         }
 208
 209         @Override
 210         public PIPResponse getAttributes(PIPRequest pipRequest, PIPFinder pipFinder) throws PIPException {
 211                 /*
 212                  * First check to see if the issuer is set and then match it
 213                  */
 214                 String string;
 215                 if ((string = pipRequest.getIssuer()) != null) {
 216                         if (!string.equals(this.getIssuer())) {
 217                                 this.logger.debug("Requested issuer '" + string + "' does not match " + (this.getIssuer() == null ? "null" : "'" + this.getIssuer() + "'"));
 218                                 return StdPIPResponse.PIP_RESPONSE_EMPTY;
 219                         }
 220                 }
 221
 222                 /*
 223                  * Drop the issuer and see if the request matches any of our supported queries
 224                  */
 225                 PIPRequest pipRequestSupported  = (pipRequest.getIssuer() == null ? pipRequest : new StdPIPRequest(pipRequest.getCategory(), pipRequest.getAttributeId(), pipRequest.getDataTypeId()));
 226                 if (!mapSupportedAttributes.containsKey(pipRequestSupported)) {
 227                         this.logger.debug("Requested attribute '" + pipRequest.toString() + "' is not supported");
 228                         return StdPIPResponse.PIP_RESPONSE_EMPTY;
 229                 }
 230                 StdMutablePIPResponse stdPIPResponse = new StdMutablePIPResponse();
 231                 String response = this.getResult(pipFinder);
 232                 boolean result = false;
 233                 if(response.contains(SUCCESS)){
 234                         result = true;
 235                 }
 236                 this.addBooleanAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, result);
 237                 this.addStringAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, response);
 238                 return new StdPIPResponse(stdPIPResponse);
 239         }
 240
 241         @Override
 242         public void configure(String id, Properties properties) throws PIPException {
 243                 super.configure(id, properties);
 244                 if (this.getDescription() == null) {
 245                         this.setDescription(DEFAULT_DESCRIPTION);
 246                 }
 247                 if (this.getIssuer() == null) {
 248                         this.setIssuer(DEFAULT_ISSUER);
 249                 }
 250         }
 251
 252         @Override
 253         public Collection<PIPRequest> attributesRequired() {
 254                 List<PIPRequest> attributes = new ArrayList<>();
 255                 for (PIPRequest attribute: mapRequiredAttributes) {
 256                         attributes.add(new StdPIPRequest(attribute));
 257                 }
 258                 return attributes;
 259         }
 260
 261         @Override
 262         public Collection<PIPRequest> attributesProvided() {
 263                 List<PIPRequest> attributes = new ArrayList<>();
 264                 for (PIPRequest attribute : mapSupportedAttributes.keySet()) {
 265                         attributes.add(new StdPIPRequest(attribute));
 266                 }
 267                 return attributes;
 268         }
 269
 270 }