ONAP-XACML/src/main/java/org/onap/policy/xacml/std/pip/engines/aaf/AAFEngine.java

   1 /*-
   2  * ============LICENSE_START=======================================================
   3  * ONAP-XACML
   4  * ================================================================================
   5  * Copyright (C) 2017-2018 AT&T Intellectual Property. All rights reserved.
   6  * ================================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END=========================================================
  19  */
  20 package org.onap.policy.xacml.std.pip.engines.aaf;
  21
  22 import java.io.IOException;
  23 import java.util.ArrayList;
  24 import java.util.Collection;
  25 import java.util.HashMap;
  26 import java.util.Iterator;
  27 import java.util.List;
  28 import java.util.Map;
  29 import java.util.Properties;
  30
  31 import org.apache.commons.logging.Log;
  32 import org.apache.commons.logging.LogFactory;
  33 import org.onap.policy.utils.AAFPolicyClient;
  34 import org.onap.policy.utils.AAFPolicyException;
  35
  36 import com.att.research.xacml.api.Attribute;
  37 import com.att.research.xacml.api.AttributeValue;
  38 import com.att.research.xacml.api.Identifier;
  39 import com.att.research.xacml.api.XACML3;
  40 import com.att.research.xacml.api.pip.PIPException;
  41 import com.att.research.xacml.api.pip.PIPFinder;
  42 import com.att.research.xacml.api.pip.PIPRequest;
  43 import com.att.research.xacml.api.pip.PIPResponse;
  44 import com.att.research.xacml.std.IdentifierImpl;
  45 import com.att.research.xacml.std.StdMutableAttribute;
  46 import com.att.research.xacml.std.datatypes.DataTypes;
  47 import com.att.research.xacml.std.pip.StdMutablePIPResponse;
  48 import com.att.research.xacml.std.pip.StdPIPRequest;
  49 import com.att.research.xacml.std.pip.StdPIPResponse;
  50 import com.att.research.xacml.std.pip.engines.StdConfigurableEngine;
  51 import com.att.research.xacml.util.XACMLProperties;
  52
  53 /**
  54  * PIP Engine for Implementing {@link com.att.research.xacml.std.pip.engines.ConfigurableEngine} interface to provide
  55  * attribute retrieval from AAF interface.
  56  *
  57  * @version $Revision$
  58  */
  59 public class AAFEngine extends StdConfigurableEngine {
  60
  61         public static final String DEFAULT_DESCRIPTION          = "PIP for authenticating aaf attributes using the AAF REST interface";
  62         public static final String DEFAULT_ISSUER                       = "aaf";
  63
  64         private static final String SUCCESS = "Success";
  65
  66         public static final String AAF_RESULT= "AAF_RESULT";
  67         public static final String AAF_RESPONSE= "AAF_RESPONSE";
  68         //
  69         public static final Identifier AAF_RESPONSE_ID = new IdentifierImpl(AAF_RESPONSE);
  70         public static final Identifier AAF_RESULT_ID = new IdentifierImpl(AAF_RESULT);
  71
  72         //
  73         private static final PIPRequest PIP_REQUEST_UID = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ID"), XACML3.ID_DATATYPE_STRING);
  74         private static final PIPRequest PIP_REQUEST_PASS =  new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_PASS"), XACML3.ID_DATATYPE_STRING);
  75         private static final PIPRequest PIP_REQUEST_TYPE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_TYPE"), XACML3.ID_DATATYPE_STRING);
  76         private static final PIPRequest PIP_REQUEST_INSTANCE = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_INSTANCE"), XACML3.ID_DATATYPE_STRING);
  77         private static final PIPRequest PIP_REQUEST_ACTION = new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, new IdentifierImpl("AAF_ACTION"), XACML3.ID_DATATYPE_STRING);
  78
  79         private static final List<PIPRequest> mapRequiredAttributes     = new ArrayList<>();
  80         static{
  81                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_UID));
  82                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_PASS));
  83                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_TYPE));
  84                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_INSTANCE));
  85                 mapRequiredAttributes.add(new StdPIPRequest(PIP_REQUEST_ACTION));
  86         }
  87
  88         private static final Map<PIPRequest, String> mapSupportedAttributes     = new HashMap<>();
  89         static{
  90                 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, XACML3.ID_DATATYPE_STRING), "response");
  91                 mapSupportedAttributes.put(new StdPIPRequest(XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, XACML3.ID_DATATYPE_BOOLEAN), "result");
  92         }
  93
  94         protected Log logger    = LogFactory.getLog(this.getClass());
  95
  96         public AAFEngine(){
  97                 //default constructor
  98         }
  99
 100         private PIPResponse getAttribute(PIPRequest pipRequest, PIPFinder pipFinder) {
 101                 PIPResponse pipResponse = null;
 102                 try {
 103                         pipResponse     = pipFinder.getMatchingAttributes(pipRequest, this);
 104                         if (pipResponse.getStatus() != null && !pipResponse.getStatus().isOk()) {
 105                                 this.logger.warn("Error retrieving " + pipRequest.getAttributeId().stringValue() + ": " + pipResponse.getStatus().toString());
 106                                 pipResponse     = null;
 107                         }
 108                         if (pipResponse != null && pipResponse.getAttributes().isEmpty()) {
 109                                 this.logger.warn("No value for " + pipRequest.getAttributeId().stringValue());
 110                                 pipResponse     = null;
 111                         }
 112                 } catch (PIPException ex) {
 113                         this.logger.error("PIPException getting subject-id attribute: " + ex.getMessage(), ex);
 114                 }
 115                 return pipResponse;
 116         }
 117
 118         private String getValue(PIPResponse pipResponse){
 119                 String result = null;
 120                 Collection<Attribute> listAttributes = pipResponse.getAttributes();
 121                 for(Attribute attribute: listAttributes){
 122                         Iterator<AttributeValue<String>> iterAttributeValues = attribute.findValues(DataTypes.DT_STRING);
 123                         if(iterAttributeValues!=null) {
 124                                 while(iterAttributeValues.hasNext()){
 125                                         result = iterAttributeValues.next().getValue();
 126                                         break;
 127                                 }
 128                         }
 129                 }
 130                 return result;
 131         }
 132
 133         private synchronized String getResult(PIPFinder pipFinder) {
 134                 PIPResponse pipResponseUID = this.getAttribute(PIP_REQUEST_UID, pipFinder);
 135                 PIPResponse pipResponsePass = this.getAttribute(PIP_REQUEST_PASS, pipFinder);
 136                 PIPResponse pipResponseType = this.getAttribute(PIP_REQUEST_TYPE, pipFinder);
 137                 PIPResponse pipResponseAction = this.getAttribute(PIP_REQUEST_ACTION, pipFinder);
 138                 PIPResponse pipResponseInstance = this.getAttribute(PIP_REQUEST_INSTANCE, pipFinder);
 139                 String response = null;
 140                 // Evaluate AAF if we have all the required values.
 141                 if(pipResponseUID!=null && pipResponsePass!=null && pipResponseType != null && pipResponseAction!= null && pipResponseInstance!=null){
 142                         String userName = getValue(pipResponseUID);
 143                         String pass = getValue(pipResponsePass);
 144
 145                         AAFPolicyClient aafClient = null;
 146                         Properties properties;
 147                         try {
 148                 properties = XACMLProperties.getProperties();
 149                 logger.debug("environment : " + properties.getProperty("ENVIRONMENT"));
 150             } catch (IOException e1) {
 151                 logger.error("Exception while getting the properties " + e1);
 152                 properties = new Properties();
 153                 properties.setProperty("AAF_LOG_LEVEL", "DEBUG");
 154             }
 155                         if(userName!=null && pass!=null){
 156                                 try {
 157                                         aafClient = AAFPolicyClient.getInstance(properties);
 158                                 } catch (AAFPolicyException e) {
 159                                         logger.error("AAF configuration failed. " + e.getMessage() +e);
 160                                 }
 161                                 if(aafClient!=null){
 162                                         if(aafClient.checkAuth(userName, pass)){
 163                                                 String type = getValue(pipResponseType);
 164                                                 String instance = getValue(pipResponseInstance);
 165                                                 String action = getValue(pipResponseAction);
 166                                                 if(aafClient.checkPerm(userName, pass, type, instance, action)){
 167                                                         response = SUCCESS + "Permissions Validated";
 168                                                 }else{
 169                                                         response = "No Permissions for "+userName+" to: "+type+", "+instance+", "+action;
 170                                                 }
 171                                         }else{
 172                                                 response = "Authentication Failed for the given Values";
 173                                         }
 174                                 }
 175                         }else{
 176                                 response = "ID and Password are not given";
 177                         }
 178
 179                 }else{
 180                         response = "Insufficient Values to Evaluate AAF";
 181                 }
 182                 return response;
 183         }
 184
 185         private void addStringAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, String value) {
 186                 if (value != null) {
 187                         AttributeValue<String> attributeValue   = null;
 188                         try {
 189                                 attributeValue  = DataTypes.DT_STRING.createAttributeValue(value);
 190                         } catch (Exception ex) {
 191                                 this.logger.error("Failed to convert " + value + " to an AttributeValue<String>", ex);
 192                         }
 193                         if (attributeValue != null) {
 194                                 stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
 195                         }
 196                 }
 197         }
 198
 199         private void addBooleanAttribute(StdMutablePIPResponse stdPIPResponse, Identifier category, Identifier attributeId, boolean value) {
 200                 AttributeValue<Boolean> attributeValue  = null;
 201                 try {
 202                         attributeValue  = DataTypes.DT_BOOLEAN.createAttributeValue(value);
 203                 } catch (Exception ex) {
 204                         this.logger.error("Failed to convert " + value + " to an AttributeValue<Boolean>", ex);
 205                 }
 206                 if (attributeValue != null) {
 207                         stdPIPResponse.addAttribute(new StdMutableAttribute(category, attributeId, attributeValue, this.getIssuer(), false));
 208                 }
 209         }
 210
 211         @Override
 212         public PIPResponse getAttributes(PIPRequest pipRequest, PIPFinder pipFinder) throws PIPException {
 213                 /*
 214                  * First check to see if the issuer is set and then match it
 215                  */
 216                 String string;
 217
 218                 if((string = pipRequest.getIssuer()) != null && !string.equals(this.getIssuer())) {
 219                         this.logger.debug("Requested issuer '" + string + "' does not match " + (this.getIssuer() == null ? "null" : "'" + this.getIssuer() + "'"));
 220                         return StdPIPResponse.PIP_RESPONSE_EMPTY;
 221                 }
 222
 223
 224                 /*
 225                  * Drop the issuer and see if the request matches any of our supported queries
 226                  */
 227                 PIPRequest pipRequestSupported  = pipRequest.getIssuer() == null ? pipRequest : new StdPIPRequest(pipRequest.getCategory(), pipRequest.getAttributeId(), pipRequest.getDataTypeId());
 228                 if (!mapSupportedAttributes.containsKey(pipRequestSupported)) {
 229                         this.logger.debug("Requested attribute '" + pipRequest.toString() + "' is not supported");
 230                         return StdPIPResponse.PIP_RESPONSE_EMPTY;
 231                 }
 232                 StdMutablePIPResponse stdPIPResponse = new StdMutablePIPResponse();
 233                 String response = this.getResult(pipFinder);
 234                 boolean result = false;
 235                 if(response != null && response.contains(SUCCESS)){
 236                         result = true;
 237                 }
 238                 this.addBooleanAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESULT_ID, result);
 239                 this.addStringAttribute(stdPIPResponse, XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE, AAF_RESPONSE_ID, response);
 240                 return new StdPIPResponse(stdPIPResponse);
 241         }
 242
 243         @Override
 244         public void configure(String id, Properties properties) throws PIPException {
 245                 super.configure(id, properties);
 246                 if (this.getDescription() == null) {
 247                         this.setDescription(DEFAULT_DESCRIPTION);
 248                 }
 249                 if (this.getIssuer() == null) {
 250                         this.setIssuer(DEFAULT_ISSUER);
 251                 }
 252         }
 253
 254         @Override
 255         public Collection<PIPRequest> attributesRequired() {
 256                 List<PIPRequest> attributes = new ArrayList<>();
 257                 for (PIPRequest attribute: mapRequiredAttributes) {
 258                         attributes.add(new StdPIPRequest(attribute));
 259                 }
 260                 return attributes;
 261         }
 262
 263         @Override
 264         public Collection<PIPRequest> attributesProvided() {
 265                 List<PIPRequest> attributes = new ArrayList<>();
 266                 for (PIPRequest attribute : mapSupportedAttributes.keySet()) {
 267                         attributes.add(new StdPIPRequest(attribute));
 268                 }
 269                 return attributes;
 270         }
 271
 272 }