| /* |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| * |
| */ |
| |
| /* |
| * AT&T - PROPRIETARY |
| * THIS FILE CONTAINS PROPRIETARY INFORMATION OF |
| * AT&T AND IS NOT TO BE DISCLOSED OR USED EXCEPT IN |
| * ACCORDANCE WITH APPLICABLE AGREEMENTS. |
| * |
| * Copyright (c) 2013 AT&T Knowledge Ventures |
| * Unpublished and Not for Publication |
| * All Rights Reserved |
| */ |
| package org.apache.openaz.xacml.rest; |
| |
| import java.io.IOException; |
| import java.io.InputStream; |
| import java.io.OutputStream; |
| import java.net.ConnectException; |
| import java.net.HttpURLConnection; |
| import java.net.MalformedURLException; |
| import java.net.SocketTimeoutException; |
| import java.net.URL; |
| import java.net.URLDecoder; |
| import java.net.UnknownHostException; |
| import java.util.ArrayList; |
| import java.util.HashMap; |
| import java.util.HashSet; |
| import java.util.List; |
| import java.util.Properties; |
| import java.util.Scanner; |
| import java.util.Set; |
| import java.util.concurrent.CopyOnWriteArrayList; |
| |
| import javax.servlet.Servlet; |
| import javax.servlet.ServletConfig; |
| import javax.servlet.ServletException; |
| import javax.servlet.annotation.WebInitParam; |
| import javax.servlet.annotation.WebServlet; |
| import javax.servlet.http.HttpServlet; |
| import javax.servlet.http.HttpServletRequest; |
| import javax.servlet.http.HttpServletResponse; |
| |
| import org.apache.commons.io.IOUtils; |
| import org.apache.commons.logging.Log; |
| import org.apache.commons.logging.LogFactory; |
| import org.apache.openaz.xacml.api.pap.PAPEngine; |
| import org.apache.openaz.xacml.api.pap.PAPEngineFactory; |
| import org.apache.openaz.xacml.api.pap.PAPException; |
| import org.apache.openaz.xacml.api.pap.PDP; |
| import org.apache.openaz.xacml.api.pap.PDPGroup; |
| import org.apache.openaz.xacml.api.pap.PDPPolicy; |
| import org.apache.openaz.xacml.api.pap.PDPStatus; |
| import org.apache.openaz.xacml.std.pap.StdPDP; |
| import org.apache.openaz.xacml.std.pap.StdPDPGroup; |
| import org.apache.openaz.xacml.std.pap.StdPDPItemSetChangeNotifier.StdItemSetChangeListener; |
| import org.apache.openaz.xacml.std.pap.StdPDPStatus; |
| import org.apache.openaz.xacml.util.FactoryException; |
| import org.apache.openaz.xacml.util.XACMLProperties; |
| |
| import com.fasterxml.jackson.databind.ObjectMapper; |
| import com.google.common.base.Splitter; |
| |
| /** |
| * Servlet implementation class XacmlPapServlet |
| */ |
| @WebServlet(description = "Implements the XACML PAP RESTful API.", urlPatterns = { |
| "/" |
| }, loadOnStartup = 1, initParams = { |
| @WebInitParam(name = "XACML_PROPERTIES_NAME", value = "xacml.pap.properties", description = "The location of the properties file holding configuration information.") |
| }) |
| public class XACMLPapServlet extends HttpServlet implements StdItemSetChangeListener, Runnable { |
| private static final long serialVersionUID = 1L; |
| private static final Log logger = LogFactory.getLog(XACMLPapServlet.class); |
| |
| /* |
| * papEngine - This is our engine workhorse that manages the PDP Groups and Nodes. |
| */ |
| private PAPEngine papEngine = null; |
| |
| /* |
| * This PAP instance's own URL. Need this when creating URLs to send to the PDPs so they can GET the |
| * Policy files from this process. |
| */ |
| private static String papURL = null; |
| |
| /* |
| * List of Admin Console URLs. Used to send notifications when configuration changes. The |
| * CopyOnWriteArrayList *should* protect from concurrency errors. This list is seldom changed but often |
| * read, so the costs of this approach make sense. |
| */ |
| private static final CopyOnWriteArrayList<String> adminConsoleURLStringList = new CopyOnWriteArrayList<String>(); |
| |
| /* |
| * This thread may be invoked upon startup to initiate sending PDP policy/pip configuration when this |
| * servlet starts. Its configurable by the admin. |
| */ |
| private Thread initiateThread = null; |
| |
| /* |
| * // The heartbeat thread. |
| */ |
| private static Heartbeat heartbeat = null; |
| private static Thread heartbeatThread = null; |
| |
| /** |
| * @see HttpServlet#HttpServlet() |
| */ |
| public XACMLPapServlet() { |
| super(); |
| } |
| |
| /** |
| * @see Servlet#init(ServletConfig) |
| */ |
| @Override |
| public void init(ServletConfig config) throws ServletException { |
| try { |
| // |
| // Initialize |
| // |
| XACMLRest.xacmlInit(config); |
| // |
| // Load the properties |
| // |
| XACMLRest.loadXacmlProperties(null, null); |
| // |
| // Load our PAP engine, first create a factory |
| // |
| PAPEngineFactory factory = PAPEngineFactory.newInstance(XACMLProperties |
| .getProperty(XACMLProperties.PROP_PAP_PAPENGINEFACTORY)); |
| // |
| // The factory knows how to go about creating a PAP Engine |
| // |
| this.papEngine = factory.newEngine(); |
| // |
| // we are about to call the PDPs and give them their configuration. |
| // To do that we need to have the URL of this PAP so we can construct the Policy file URLs |
| // |
| XACMLPapServlet.papURL = XACMLProperties.getProperty(XACMLRestProperties.PROP_PAP_URL); |
| // |
| // Sanity check that a URL was defined somewhere, its essential. |
| // |
| // How to check that its valid? We can validate the form, but since we are in the init() method we |
| // are not fully loaded yet so we really couldn't ping ourself to see if the URL will work. One |
| // will have to look for errors in the PDP logs to determine if they are failing to initiate a |
| // request to this servlet. |
| // |
| if (XACMLPapServlet.papURL == null) { |
| throw new PAPException("The property " + XACMLRestProperties.PROP_PAP_URL + " is not valid: " |
| + XACMLPapServlet.papURL); |
| } |
| // |
| // Configurable - have the PAP servlet initiate sending the latest PDP policy/pip configuration |
| // to all its known PDP nodes. |
| // |
| // Note: parseBoolean will return false if there is no property defined. This is fine for a |
| // default. |
| // |
| if (Boolean.parseBoolean(XACMLProperties |
| .getProperty(XACMLRestProperties.PROP_PAP_INITIATE_PDP_CONFIG))) { |
| this.initiateThread = new Thread(this); |
| this.initiateThread.start(); |
| } |
| // |
| // After startup, the PAP does Heartbeats to each of the PDPs periodically |
| // |
| XACMLPapServlet.heartbeat = new Heartbeat(this.papEngine); |
| XACMLPapServlet.heartbeatThread = new Thread(XACMLPapServlet.heartbeat); |
| XACMLPapServlet.heartbeatThread.start(); |
| } catch (FactoryException | PAPException e) { |
| logger.error("Failed to create engine", e); |
| throw new ServletException("PAP not initialized; error: " + e); |
| } catch (Exception e) { |
| logger.error("Failed to create engine - unexpected error: ", e); |
| throw new ServletException("PAP not initialized; unexpected error: " + e); |
| } |
| } |
| |
| /** |
| * Thread used only during PAP startup to initiate change messages to all known PDPs. This must be on a |
| * separate thread so that any GET requests from the PDPs during this update can be serviced. |
| */ |
| @Override |
| public void run() { |
| // |
| // send the current configuration to all the PDPs that we know about |
| // |
| changed(); |
| } |
| |
| /** |
| * @see Servlet#destroy() Depending on how this servlet is run, we may or may not care about cleaning up |
| * the resources. For now we assume that we do care. |
| */ |
| @Override |
| public void destroy() { |
| // |
| // Make sure our threads are destroyed |
| // |
| if (XACMLPapServlet.heartbeatThread != null) { |
| // |
| // stop the heartbeat |
| // |
| try { |
| if (XACMLPapServlet.heartbeat != null) { |
| XACMLPapServlet.heartbeat.terminate(); |
| } |
| XACMLPapServlet.heartbeatThread.interrupt(); |
| XACMLPapServlet.heartbeatThread.join(); |
| } catch (InterruptedException e) { |
| logger.error(e); |
| } |
| } |
| if (this.initiateThread != null) { |
| try { |
| this.initiateThread.interrupt(); |
| this.initiateThread.join(); |
| } catch (InterruptedException e) { |
| logger.error(e); |
| } |
| } |
| } |
| |
| /** |
| * Called by: - PDP nodes to register themselves with the PAP, and - Admin Console to make changes in the |
| * PDP Groups. |
| * |
| * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response) |
| */ |
| @Override |
| protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, |
| IOException { |
| try { |
| |
| XACMLRest.dumpRequest(request); |
| |
| // since getParameter reads the content string, explicitly get the content before doing that. |
| // Simply getting the inputStream seems to protect it against being consumed by getParameter. |
| request.getInputStream(); |
| |
| // |
| // Is this from the Admin Console? |
| // |
| String groupId = request.getParameter("groupId"); |
| if (groupId != null) { |
| // |
| // this is from the Admin Console, so handle separately |
| // |
| doACPost(request, response, groupId); |
| return; |
| } |
| |
| // |
| // Request is from a PDP. |
| // It is coming up and asking for its config |
| // |
| |
| // |
| // Get the PDP's ID |
| // |
| String id = this.getPDPID(request); |
| logger.info("doPost from: " + id); |
| // |
| // Get the PDP Object |
| // |
| PDP pdp = this.papEngine.getPDP(id); |
| // |
| // Is it known? |
| // |
| if (pdp == null) { |
| logger.info("Unknown PDP: " + id); |
| try { |
| this.papEngine.newPDP(id, this.papEngine.getDefaultGroup(), id, |
| "Registered on first startup"); |
| } catch (NullPointerException | PAPException e) { |
| logger.error("Failed to create new PDP", e); |
| response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage()); |
| return; |
| } |
| // get the PDP we just created |
| pdp = this.papEngine.getPDP(id); |
| if (pdp == null) { |
| String message = "Failed to create new PDP for id: " + id; |
| logger.error(message); |
| response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message); |
| return; |
| } |
| } |
| // |
| // Get the PDP's Group |
| // |
| PDPGroup group = this.papEngine.getPDPGroup(pdp); |
| if (group == null) { |
| response.sendError(HttpServletResponse.SC_UNAUTHORIZED, |
| "PDP not associated with any group, even the default"); |
| return; |
| } |
| // |
| // Determine what group the PDP node is in and get |
| // its policy/pip properties. |
| // |
| Properties policies = group.getPolicyProperties(); |
| Properties pipconfig = group.getPipConfigProperties(); |
| // |
| // Get the current policy/pip configuration that the PDP has |
| // |
| Properties pdpProperties = new Properties(); |
| pdpProperties.load(request.getInputStream()); |
| logger.info("PDP Current Properties: " + pdpProperties.toString()); |
| logger.info("Policies: " + (policies != null ? policies.toString() : "null")); |
| logger.info("Pip config: " + (pipconfig != null ? pipconfig.toString() : "null")); |
| // |
| // Validate the node's properties |
| // |
| boolean isCurrent = this.isPDPCurrent(policies, pipconfig, pdpProperties); |
| // |
| // Send back current configuration |
| // |
| if (!isCurrent) { |
| // |
| // Tell the PDP we are sending back the current policies/pip config |
| // |
| logger.info("PDP configuration NOT current."); |
| if (policies != null) { |
| // |
| // Put URL's into the properties in case the PDP needs to |
| // retrieve them. |
| // |
| this.populatePolicyURL(request.getRequestURL(), policies); |
| // |
| // Copy the properties to the output stream |
| // |
| policies.store(response.getOutputStream(), ""); |
| } |
| if (pipconfig != null) { |
| // |
| // Copy the properties to the output stream |
| // |
| pipconfig.store(response.getOutputStream(), ""); |
| } |
| // |
| // We are good - and we are sending them information |
| // |
| response.setStatus(HttpServletResponse.SC_OK); |
| // TODO - Correct? |
| setPDPSummaryStatus(pdp, PDPStatus.Status.OUT_OF_SYNCH); |
| } else { |
| // |
| // Tell them they are good |
| // |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| |
| // TODO - Correct? |
| setPDPSummaryStatus(pdp, PDPStatus.Status.UP_TO_DATE); |
| |
| } |
| // |
| // tell the AC that something changed |
| // |
| notifyAC(); |
| } catch (PAPException e) { |
| logger.debug("POST exception: " + e, e); |
| response.sendError(500, e.getMessage()); |
| return; |
| } |
| } |
| |
| /** |
| * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response) |
| */ |
| @Override |
| protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, |
| IOException { |
| try { |
| XACMLRest.dumpRequest(request); |
| |
| // Is this from the Admin Console? |
| String groupId = request.getParameter("groupId"); |
| if (groupId != null) { |
| // this is from the Admin Console, so handle separately |
| doACGet(request, response, groupId); |
| return; |
| } |
| // |
| // Get the PDP's ID |
| // |
| String id = this.getPDPID(request); |
| logger.info("doGet from: " + id); |
| // |
| // Get the PDP Object |
| // |
| PDP pdp = this.papEngine.getPDP(id); |
| // |
| // Is it known? |
| // |
| if (pdp == null) { |
| // |
| // Check if request came from localhost |
| // |
| String message = "Unknown PDP: " + id + " from " + request.getRemoteHost() + " us: " |
| + request.getLocalAddr(); |
| logger.info(message); |
| if (request.getRemoteHost().equals("localhost") |
| || request.getRemoteHost().equals("127.0.0.1") //NOPMD |
| || request.getRemoteHost().equals(request.getLocalAddr())) { |
| // |
| // Return status information - basically all the groups |
| // |
| Set<PDPGroup> groups = papEngine.getPDPGroups(); |
| |
| // convert response object to JSON and include in the response |
| ObjectMapper mapper = new ObjectMapper(); |
| mapper.writeValue(response.getOutputStream(), groups); |
| response.setHeader("content-type", "application/json"); |
| response.setStatus(HttpServletResponse.SC_OK); |
| return; |
| } |
| response.sendError(HttpServletResponse.SC_UNAUTHORIZED, message); |
| return; |
| } |
| // |
| // Get the PDP's Group |
| // |
| PDPGroup group = this.papEngine.getPDPGroup(pdp); |
| if (group == null) { |
| String message = "No group associated with pdp " + pdp.getId(); |
| logger.warn(message); |
| response.sendError(HttpServletResponse.SC_UNAUTHORIZED, message); |
| return; |
| } |
| // |
| // Which policy do they want? |
| // |
| String policyId = request.getParameter("id"); |
| if (policyId == null) { |
| String message = "Did not specify an id for the policy"; |
| logger.warn(message); |
| response.sendError(HttpServletResponse.SC_NOT_FOUND, message); |
| return; |
| } |
| PDPPolicy policy = group.getPolicy(policyId); |
| if (policy == null) { |
| String message = "Unknown policy: " + policyId; |
| logger.warn(message); |
| response.sendError(HttpServletResponse.SC_NOT_FOUND, message); |
| return; |
| } |
| // |
| // Get its stream |
| // |
| try (InputStream is = policy.getStream(); OutputStream os = response.getOutputStream()) { |
| // |
| // Send the policy back |
| // |
| IOUtils.copy(is, os); |
| |
| response.setStatus(HttpServletResponse.SC_OK); |
| } catch (PAPException e) { |
| String message = "Failed to open policy id " + policyId; |
| logger.error(message); |
| response.sendError(HttpServletResponse.SC_NOT_FOUND, message); |
| } |
| } catch (PAPException e) { |
| logger.error("GET exception: " + e, e); |
| response.sendError(500, e.getMessage()); |
| return; |
| } |
| } |
| |
| protected String getPDPID(HttpServletRequest request) { |
| String pdpURL = request.getHeader(XACMLRestProperties.PROP_PDP_HTTP_HEADER_ID); |
| if (pdpURL == null || pdpURL.isEmpty()) { |
| // |
| // Should send back its port for identification |
| // |
| logger.warn("PDP did not send custom header"); |
| pdpURL = ""; |
| } |
| return pdpURL; |
| } |
| |
| private boolean isPDPCurrent(Properties policies, Properties pipconfig, Properties pdpProperties) { |
| String localRootPolicies = policies.getProperty(XACMLProperties.PROP_ROOTPOLICIES); |
| String localReferencedPolicies = policies.getProperty(XACMLProperties.PROP_REFERENCEDPOLICIES); |
| if (localRootPolicies == null || localReferencedPolicies == null) { |
| logger.warn("Missing property on PAP server: RootPolicies=" + localRootPolicies |
| + " ReferencedPolicies=" + localReferencedPolicies); |
| return false; |
| } |
| // |
| // Compare the policies and pipconfig properties to the pdpProperties |
| // |
| try { |
| // |
| // the policy properties includes only xacml.rootPolicies and |
| // xacml.referencedPolicies without any .url entries |
| // |
| Properties pdpPolicies = XACMLProperties.getPolicyProperties(pdpProperties, false); |
| Properties pdpPipConfig = XACMLProperties.getPipProperties(pdpProperties); |
| if (localRootPolicies.equals(pdpPolicies.getProperty(XACMLProperties.PROP_ROOTPOLICIES)) |
| && localReferencedPolicies.equals(pdpPolicies |
| .getProperty(XACMLProperties.PROP_REFERENCEDPOLICIES)) && pdpPipConfig.equals(pipconfig)) { |
| // |
| // The PDP is current |
| // |
| return true; |
| } |
| } catch (Exception e) { //NOPMD |
| // we get here if the PDP did not include either xacml.rootPolicies or xacml.pip.engines, |
| // or if there are policies that do not have a corresponding ".url" property. |
| // Either of these cases means that the PDP is not up-to-date, so just drop-through to return |
| // false. |
| } |
| return false; |
| } |
| |
| private void populatePolicyURL(StringBuffer urlPath, Properties policies) { |
| String lists[] = new String[2]; |
| lists[0] = policies.getProperty(XACMLProperties.PROP_ROOTPOLICIES); |
| lists[1] = policies.getProperty(XACMLProperties.PROP_REFERENCEDPOLICIES); |
| for (String list : lists) { |
| if (list != null && !list.isEmpty()) { |
| for (String id : Splitter.on(',').trimResults().omitEmptyStrings().split(list)) { |
| String url = urlPath + "?id=" + id; |
| logger.info("Policy URL for " + id + ": " + url); |
| policies.setProperty(id + ".url", url); |
| } |
| } |
| } |
| } |
| |
| /** |
| * @see HttpServlet#doPut(HttpServletRequest request, HttpServletResponse response) |
| */ |
| @Override |
| protected void doPut(HttpServletRequest request, HttpServletResponse response) throws ServletException, |
| IOException { |
| XACMLRest.dumpRequest(request); |
| // |
| // since getParameter reads the content string, explicitly get the content before doing that. |
| // Simply getting the inputStream seems to protect it against being consumed by getParameter. |
| // |
| request.getInputStream(); |
| // |
| // See if this is Admin Console registering itself with us |
| // |
| String acURLString = request.getParameter("adminConsoleURL"); |
| if (acURLString != null) { |
| // |
| // remember this Admin Console for future updates |
| // |
| if (!adminConsoleURLStringList.contains(acURLString)) { |
| adminConsoleURLStringList.add(acURLString); |
| } |
| if (logger.isDebugEnabled()) { |
| logger.debug("Admin Console registering with URL: " + acURLString); |
| } |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| return; |
| } |
| // |
| // Is this some other operation from the Admin Console? |
| // |
| String groupId = request.getParameter("groupId"); |
| if (groupId != null) { |
| // |
| // this is from the Admin Console, so handle separately |
| // |
| doACPut(request, response, groupId); |
| return; |
| } |
| // |
| // We do not expect anything from anywhere else. |
| // This method is here in case we ever need to support other operations. |
| // |
| response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Request does not have groupId"); |
| } |
| |
| /** |
| * @see HttpServlet#doDelete(HttpServletRequest request, HttpServletResponse response) |
| */ |
| @Override |
| protected void doDelete(HttpServletRequest request, HttpServletResponse response) |
| throws ServletException, IOException { |
| XACMLRest.dumpRequest(request); |
| // |
| // Is this from the Admin Console? |
| // |
| String groupId = request.getParameter("groupId"); |
| if (groupId != null) { |
| // |
| // this is from the Admin Console, so handle separately |
| // |
| doACDelete(request, response, groupId); |
| return; |
| } |
| // |
| // We do not expect anything from anywhere else. |
| // This method is here in case we ever need to support other operations. |
| // |
| response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Request does not have groupId"); |
| } |
| |
| // |
| // Admin Console request handling |
| // |
| |
| /** |
| * Requests from the Admin Console to GET info about the Groups and PDPs |
| * |
| * @param request |
| * @param response |
| * @param groupId |
| * @throws ServletException |
| * @throws java.io.IOException |
| */ |
| private void doACGet(HttpServletRequest request, HttpServletResponse response, String groupId) |
| throws ServletException, IOException { |
| try { |
| String parameterDefault = request.getParameter("default"); |
| String pdpId = request.getParameter("pdpId"); |
| String pdpGroup = request.getParameter("getPDPGroup"); |
| if ("".equals(groupId)) { |
| // request IS from AC but does not identify a group by name |
| if (parameterDefault != null) { |
| // Request is for the Default group (whatever its id) |
| PDPGroup group = papEngine.getDefaultGroup(); |
| |
| // convert response object to JSON and include in the response |
| ObjectMapper mapper = new ObjectMapper(); |
| mapper.writeValue(response.getOutputStream(), group); |
| |
| if (logger.isDebugEnabled()) { |
| logger.debug("GET Default group req from '" + request.getRequestURL() + "'"); |
| } |
| response.setStatus(HttpServletResponse.SC_OK); |
| response.setHeader("content-type", "application/json"); |
| response.getOutputStream().close(); |
| return; |
| |
| } else if (pdpId != null) { |
| // Request is related to a PDP |
| if (pdpGroup == null) { |
| // Request is for the PDP itself |
| // Request is for the (unspecified) group containing a given PDP |
| PDP pdp = papEngine.getPDP(pdpId); |
| |
| // convert response object to JSON and include in the response |
| ObjectMapper mapper = new ObjectMapper(); |
| mapper.writeValue(response.getOutputStream(), pdp); |
| |
| if (logger.isDebugEnabled()) { |
| logger |
| .debug("GET pdp '" + pdpId + "' req from '" + request.getRequestURL() + "'"); |
| } |
| response.setStatus(HttpServletResponse.SC_OK); |
| response.setHeader("content-type", "application/json"); |
| response.getOutputStream().close(); |
| return; |
| |
| } else { |
| // Request is for the (unspecified) group containing a given PDP |
| PDP pdp = papEngine.getPDP(pdpId); |
| PDPGroup group = papEngine.getPDPGroup(pdp); |
| |
| // convert response object to JSON and include in the response |
| ObjectMapper mapper = new ObjectMapper(); |
| mapper.writeValue(response.getOutputStream(), group); |
| |
| if (logger.isDebugEnabled()) { |
| logger.debug("GET PDP '" + pdpId + "' Group req from '" + request.getRequestURL() |
| + "'"); |
| } |
| response.setStatus(HttpServletResponse.SC_OK); |
| response.setHeader("content-type", "application/json"); |
| response.getOutputStream().close(); |
| return; |
| } |
| |
| } else { |
| // request is for top-level properties about all groups |
| Set<PDPGroup> groups = papEngine.getPDPGroups(); |
| |
| // convert response object to JSON and include in the response |
| ObjectMapper mapper = new ObjectMapper(); |
| mapper.writeValue(response.getOutputStream(), groups); |
| |
| // TODO |
| // In "notification" section, ALSO need to tell AC about other changes (made by other |
| // ACs)?' |
| // TODO add new PDP notification (or just "config changed" notification) in appropriate |
| // place |
| if (logger.isDebugEnabled()) { |
| logger.debug("GET All groups req"); |
| } |
| response.setStatus(HttpServletResponse.SC_OK); |
| response.setHeader("content-type", "application/json"); |
| response.getOutputStream().close(); |
| return; |
| } |
| } |
| |
| // for all other GET operations the group must exist before the operation can be done |
| PDPGroup group = papEngine.getGroup(groupId); |
| if (group == null) { |
| logger.error("Unknown groupId '" + groupId + "'"); |
| response.sendError(HttpServletResponse.SC_NOT_FOUND, "Unknown groupId '" + groupId + "'"); |
| return; |
| } |
| |
| // Figure out which request this is based on the parameters |
| String policyId = request.getParameter("policyId"); |
| |
| if (policyId != null) { |
| // // retrieve a policy |
| // PDPPolicy policy = papEngine.getPDPPolicy(policyId); |
| // |
| // // convert response object to JSON and include in the response |
| // ObjectMapper mapper = new ObjectMapper(); |
| // mapper.writeValue(response.getOutputStream(), pdp); |
| // |
| // logger.debug("GET group '" + group.getId() + "' req from '" + request.getRequestURL() + |
| // "'"); |
| // response.setStatus(HttpServletResponse.SC_OK); |
| // response.setHeader("content-type", "application/json"); |
| // response.getOutputStream().close(); |
| // return; |
| response.sendError(HttpServletResponse.SC_BAD_REQUEST, "GET Policy not implemented"); |
| |
| } else { |
| // No other parameters, so return the identified Group |
| |
| // convert response object to JSON and include in the response |
| ObjectMapper mapper = new ObjectMapper(); |
| mapper.writeValue(response.getOutputStream(), group); |
| |
| if (logger.isDebugEnabled()) { |
| logger.debug("GET group '" + group.getId() + "' req from '" + request.getRequestURL() |
| + "'"); |
| } |
| response.setStatus(HttpServletResponse.SC_OK); |
| response.setHeader("content-type", "application/json"); |
| response.getOutputStream().close(); |
| return; |
| } |
| |
| // |
| // Currently there are no other GET calls from the AC. |
| // The AC uses the "GET All Groups" operation to fill its local cache and uses that cache for all |
| // other GETs without calling the PAP. |
| // Other GETs that could be called: |
| // Specific Group (groupId=<groupId>) |
| // A Policy (groupId=<groupId> policyId=<policyId>) |
| // A PDP (groupId=<groupId> pdpId=<pdpId>) |
| |
| // TODO - implement other GET operations if needed |
| |
| logger.error("UNIMPLEMENTED "); |
| response.sendError(HttpServletResponse.SC_BAD_REQUEST, "UNIMPLEMENTED"); |
| } catch (PAPException e) { |
| logger.error("AC Get exception: " + e, e); |
| response.sendError(500, e.getMessage()); |
| return; |
| } |
| |
| } |
| |
| /** |
| * Requests from the Admin Console for operations not on single specific objects |
| * |
| * @param request |
| * @param response |
| * @param groupId |
| * @throws ServletException |
| * @throws java.io.IOException |
| */ |
| private void doACPost(HttpServletRequest request, HttpServletResponse response, String groupId) |
| throws ServletException, IOException { |
| try { |
| String groupName = request.getParameter("groupName"); |
| String groupDescription = request.getParameter("groupDescription"); |
| if (groupName != null && groupDescription != null) { |
| // Args: group=<groupId> groupName=<name> groupDescription=<description> <= create a new group |
| String unescapedName = URLDecoder.decode(groupName, "UTF-8"); |
| String unescapedDescription = URLDecoder.decode(groupDescription, "UTF-8"); |
| try { |
| papEngine.newGroup(unescapedName, unescapedDescription); |
| } catch (Exception e) { |
| logger.error("Unable to create new group: " + e.getLocalizedMessage()); |
| response.sendError(500, "Unable to create new group '" + groupId + "'"); |
| return; |
| } |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| if (logger.isDebugEnabled()) { |
| logger.debug("New Group '" + groupId + "' created"); |
| } |
| // tell the Admin Consoles there is a change |
| notifyAC(); |
| // new group by definition has no PDPs, so no need to notify them of changes |
| return; |
| } |
| |
| // for all remaining POST operations the group must exist before the operation can be done |
| PDPGroup group = papEngine.getGroup(groupId); |
| if (group == null) { |
| logger.error("Unknown groupId '" + groupId + "'"); |
| response.sendError(HttpServletResponse.SC_NOT_FOUND, "Unknown groupId '" + groupId + "'"); |
| return; |
| } |
| |
| // determine the operation needed based on the parameters in the request |
| if (request.getParameter("policyId") != null) { |
| // Args: group=<groupId> policy=<policyId> <= copy file |
| // copy a policy from the request contents into a file in the group's directory on this |
| // machine |
| String policyId = request.getParameter("policyId"); |
| try { |
| ((StdPDPGroup)group).copyPolicyToFile(policyId, request.getInputStream()); |
| } catch (Exception e) { |
| String message = "Policy '" + policyId + "' not copied to group '" + groupId + "': " + e; |
| logger.error(message); |
| response.sendError(500, message); |
| return; |
| } |
| // policy file copied ok |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| if (logger.isDebugEnabled()) { |
| logger.debug("policy '" + policyId + "' copied to directory for group '" + groupId + "'"); |
| } |
| return; |
| |
| } else if (request.getParameter("default") != null) { |
| // Args: group=<groupId> default=true <= make default |
| // change the current default group to be the one identified in the request. |
| // |
| // This is a POST operation rather than a PUT "update group" because of the side-effect that |
| // the current default group is also changed. |
| // It should never be the case that multiple groups are currently marked as the default, but |
| // protect against that anyway. |
| try { |
| papEngine.SetDefaultGroup(group); |
| } catch (Exception e) { |
| logger.error("Unable to set group: " + e.getLocalizedMessage()); |
| response.sendError(500, "Unable to set group '" + groupId + "' to default"); |
| return; |
| } |
| |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| if (logger.isDebugEnabled()) { |
| logger.debug("Group '" + groupId + "' set to be default"); |
| } |
| // Notify the Admin Consoles that something changed |
| // For now the AC cannot handle anything more detailed than the whole set of PDPGroups, so |
| // just notify on that |
| // TODO - Future: FIGURE OUT WHAT LEVEL TO NOTIFY: 2 groups or entire set - currently notify |
| // AC to update whole configuration of all groups |
| notifyAC(); |
| // This does not affect any PDPs in the existing groups, so no need to notify them of this |
| // change |
| return; |
| |
| } else if (request.getParameter("pdpId") != null) { |
| // Args: group=<groupId> pdpId=<pdpId> <= move PDP to group |
| String pdpId = request.getParameter("pdpId"); |
| PDP pdp = papEngine.getPDP(pdpId); |
| |
| PDPGroup originalGroup = papEngine.getPDPGroup(pdp); |
| |
| papEngine.movePDP(pdp, group); |
| |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| if (logger.isDebugEnabled()) { |
| logger.debug("PDP '" + pdp.getId() + "' moved to group '" + group.getId() |
| + "' set to be default"); |
| } |
| |
| // update the status of both the original group and the new one |
| ((StdPDPGroup)originalGroup).resetStatus(); |
| ((StdPDPGroup)group).resetStatus(); |
| |
| // Notify the Admin Consoles that something changed |
| // For now the AC cannot handle anything more detailed than the whole set of PDPGroups, so |
| // just notify on that |
| notifyAC(); |
| // Need to notify the PDP that it's config may have changed |
| pdpChanged(pdp); |
| return; |
| |
| } |
| } catch (PAPException e) { |
| logger.error("AC POST exception: " + e, e); |
| response.sendError(500, e.getMessage()); |
| return; |
| } |
| } |
| |
| /** |
| * Requests from the Admin Console to create new items or update existing ones |
| * |
| * @param request |
| * @param response |
| * @param groupId |
| * @throws ServletException |
| * @throws java.io.IOException |
| */ |
| private void doACPut(HttpServletRequest request, HttpServletResponse response, String groupId) |
| throws ServletException, IOException { |
| try { |
| |
| // for PUT operations the group may or may not need to exist before the operation can be done |
| PDPGroup group = papEngine.getGroup(groupId); |
| |
| // determine the operation needed based on the parameters in the request |
| |
| // for remaining operations the group must exist before the operation can be done |
| if (group == null) { |
| logger.error("Unknown groupId '" + groupId + "'"); |
| response.sendError(HttpServletResponse.SC_NOT_FOUND, "Unknown groupId '" + groupId + "'"); |
| return; |
| } |
| if (request.getParameter("policy") != null) { |
| // group=<groupId> policy=<policyId> contents=policy file <= Create new policy file in group |
| // dir, or replace it if it already exists (do not touch properties) |
| // TODO - currently this is done by the AC, but it should be done here by getting the policy |
| // file out of the contents and saving to disk |
| logger.error("PARTIALLY IMPLEMENTED!!! ACTUAL CHANGES SHOULD BE MADE BY PAP SERVLET!!! "); |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| return; |
| } else if (request.getParameter("pdpId") != null) { |
| // ARGS: group=<groupId> pdpId=<pdpId/URL> <= create a new PDP or Update an Existing one |
| |
| String pdpId = request.getParameter("pdpId"); |
| |
| // get the request content into a String |
| String json = null; |
| // read the inputStream into a buffer (trick found online scans entire input looking for |
| // end-of-file) |
| Scanner scanner = new Scanner(request.getInputStream()); |
| scanner.useDelimiter("\\A"); |
| json = scanner.hasNext() ? scanner.next() : ""; |
| scanner.close(); |
| logger.info("JSON request from AC: " + json); |
| |
| // convert Object sent as JSON into local object |
| ObjectMapper mapper = new ObjectMapper(); |
| |
| Object objectFromJSON = mapper.readValue(json, StdPDP.class); |
| |
| if (pdpId == null || objectFromJSON == null || !(objectFromJSON instanceof StdPDP) |
| || ((StdPDP)objectFromJSON).getId() == null |
| || !((StdPDP)objectFromJSON).getId().equals(pdpId)) { |
| logger.error("PDP new/update had bad input. pdpId=" + pdpId + " objectFromJSON=" |
| + objectFromJSON); |
| response.sendError(500, "Bad input, pdpid=" + pdpId + " object=" + objectFromJSON); |
| } |
| StdPDP pdp = (StdPDP)objectFromJSON; |
| |
| if (papEngine.getPDP(pdpId) == null) { |
| // this is a request to create a new PDP object |
| papEngine.newPDP(pdp.getId(), group, pdp.getName(), pdp.getDescription()); |
| } else { |
| // this is a request to update the pdp |
| papEngine.updatePDP(pdp); |
| } |
| |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| if (logger.isDebugEnabled()) { |
| logger.debug("PDP '" + pdpId + "' created/updated"); |
| } |
| |
| // adjust the group's state including the new PDP |
| ((StdPDPGroup)group).resetStatus(); |
| |
| // tell the Admin Consoles there is a change |
| notifyAC(); |
| // this might affect the PDP, so notify it of the change |
| pdpChanged(pdp); |
| return; |
| } else if (request.getParameter("pipId") != null) { |
| // group=<groupId> pipId=<pipEngineId> contents=pip properties <= add a PIP to pip config, or |
| // replace it if it already exists (lenient operation) |
| // TODO |
| logger.error("UNIMPLEMENTED "); |
| response.sendError(HttpServletResponse.SC_BAD_REQUEST, "UNIMPLEMENTED"); |
| return; |
| } else { |
| // Assume that this is an update of an existing PDP Group |
| // ARGS: group=<groupId> <= Update an Existing Group |
| |
| // get the request content into a String |
| String json = null; |
| // read the inputStream into a buffer (trick found online scans entire input looking for |
| // end-of-file) |
| Scanner scanner = new Scanner(request.getInputStream()); |
| scanner.useDelimiter("\\A"); |
| json = scanner.hasNext() ? scanner.next() : ""; |
| scanner.close(); |
| logger.info("JSON request from AC: " + json); |
| |
| // convert Object sent as JSON into local object |
| ObjectMapper mapper = new ObjectMapper(); |
| |
| Object objectFromJSON = mapper.readValue(json, StdPDPGroup.class); |
| |
| if (objectFromJSON == null || !(objectFromJSON instanceof StdPDPGroup) |
| || !((StdPDPGroup)objectFromJSON).getId().equals(group.getId())) { |
| logger.error("Group update had bad input. id=" + group.getId() + " objectFromJSON=" |
| + objectFromJSON); |
| response.sendError(500, "Bad input, id=" + group.getId() + " object=" + objectFromJSON); |
| } |
| |
| // The Path on the PAP side is not carried on the RESTful interface with the AC |
| // (because it is local to the PAP) |
| // so we need to fill that in before submitting the group for update |
| ((StdPDPGroup)objectFromJSON).setDirectory(((StdPDPGroup)group).getDirectory()); |
| |
| papEngine.updateGroup((StdPDPGroup)objectFromJSON); |
| |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| if (logger.isDebugEnabled()) { |
| logger.debug("Group '" + group.getId() + "' updated"); |
| } |
| // tell the Admin Consoles there is a change |
| notifyAC(); |
| // Group changed, which might include changing the policies |
| groupChanged(group); |
| return; |
| } |
| } catch (PAPException e) { |
| logger.error("AC PUT exception: " + e, e); |
| response.sendError(500, e.getMessage()); |
| return; |
| } |
| } |
| |
| /** |
| * Requests from the Admin Console to delete/remove items |
| * |
| * @param request |
| * @param response |
| * @param groupId |
| * @throws ServletException |
| * @throws java.io.IOException |
| */ |
| private void doACDelete(HttpServletRequest request, HttpServletResponse response, String groupId) |
| throws ServletException, IOException { |
| try { |
| // for all DELETE operations the group must exist before the operation can be done |
| PDPGroup group = papEngine.getGroup(groupId); |
| if (group == null) { |
| logger.error("Unknown groupId '" + groupId + "'"); |
| response.sendError(HttpServletResponse.SC_NOT_FOUND, "Unknown groupId '" + groupId + "'"); |
| return; |
| } |
| // determine the operation needed based on the parameters in the request |
| if (request.getParameter("policy") != null) { |
| // group=<groupId> policy=<policyId> [delete=<true|false>] <= delete policy file from group |
| // TODO |
| logger.error("UNIMPLEMENTED "); |
| response.sendError(HttpServletResponse.SC_BAD_REQUEST, "UNIMPLEMENTED"); |
| return; |
| } else if (request.getParameter("pdpId") != null) { |
| // ARGS: group=<groupId> pdpId=<pdpId> <= delete PDP |
| String pdpId = request.getParameter("pdpId"); |
| PDP pdp = papEngine.getPDP(pdpId); |
| |
| papEngine.removePDP(pdp); |
| |
| // adjust the status of the group, which may have changed when we removed this PDP |
| ((StdPDPGroup)group).resetStatus(); |
| |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| notifyAC(); |
| |
| // update the PDP and tell it that it has NO Policies (which prevents it from serving PEP |
| // Requests) |
| pdpChanged(pdp); |
| return; |
| } else if (request.getParameter("pipId") != null) { |
| // group=<groupId> pipId=<pipEngineId> <= delete PIP config for given engine |
| // TODO |
| logger.error("UNIMPLEMENTED "); |
| response.sendError(HttpServletResponse.SC_BAD_REQUEST, "UNIMPLEMENTED"); |
| return; |
| } else { |
| // ARGS: group=<groupId> movePDPsToGroupId=<movePDPsToGroupId> <= delete a group and move all |
| // its PDPs to the given group |
| String moveToGroupId = request.getParameter("movePDPsToGroupId"); |
| PDPGroup moveToGroup = null; |
| if (moveToGroupId != null) { |
| moveToGroup = papEngine.getGroup(moveToGroupId); |
| } |
| |
| // get list of PDPs in the group being deleted so we can notify them that they got changed |
| Set<PDP> movedPDPs = new HashSet<PDP>(); |
| movedPDPs.addAll(group.getPdps()); |
| |
| // do the move/remove |
| papEngine.removeGroup(group, moveToGroup); |
| |
| response.setStatus(HttpServletResponse.SC_NO_CONTENT); |
| notifyAC(); |
| // notify any PDPs in the removed set that their config may have changed |
| for (PDP pdp : movedPDPs) { |
| pdpChanged(pdp); |
| } |
| return; |
| } |
| |
| } catch (PAPException e) { |
| logger.error("AC DELETE exception: " + e, e); |
| response.sendError(500, e.getMessage()); |
| return; |
| } |
| } |
| |
| // |
| // Heartbeat thread - periodically check on PDPs' status |
| // |
| |
| /** |
| * Heartbeat with all known PDPs. Implementation note: The PDPs are contacted Sequentially, not in |
| * Parallel. If we did this in parallel using multiple threads we would simultaneously use - 1 thread and |
| * - 1 connection for EACH PDP. This could become a resource problem since we already use multiple threads |
| * and connections for updating the PDPs when user changes occur. Using separate threads can also make it |
| * tricky dealing with timeouts on PDPs that are non-responsive. The Sequential operation does a heartbeat |
| * request to each PDP one at a time. This has the flaw that any PDPs that do not respond will hold up the |
| * entire heartbeat sequence until they timeout. If there are a lot of non-responsive PDPs and the timeout |
| * is large-ish (the default is 20 seconds) it could take a long time to cycle through all of the PDPs. |
| * That means that this may not notice a PDP being down in a predictable time. |
| */ |
| private class Heartbeat implements Runnable { |
| private PAPEngine papEngine; |
| private Set<PDP> pdps = new HashSet<PDP>(); |
| private int heartbeatInterval; |
| private int heartbeatTimeout; |
| |
| public volatile boolean isRunning = false; |
| |
| public synchronized boolean isRunning() { |
| return this.isRunning; |
| } |
| |
| public synchronized void terminate() { |
| this.isRunning = false; |
| } |
| |
| public Heartbeat(PAPEngine engine) { |
| this.papEngine = engine; |
| this.heartbeatInterval = Integer.parseInt(XACMLProperties |
| .getProperty(XACMLRestProperties.PROP_PAP_HEARTBEAT_INTERVAL, "10000")); |
| this.heartbeatTimeout = Integer.parseInt(XACMLProperties |
| .getProperty(XACMLRestProperties.PROP_PAP_HEARTBEAT_TIMEOUT, "10000")); |
| } |
| |
| @Override |
| public void run() { |
| // |
| // Set ourselves as running |
| // |
| synchronized (this) { |
| this.isRunning = true; |
| } |
| HashMap<String, URL> idToURLMap = new HashMap<String, URL>(); |
| try { |
| while (this.isRunning()) { |
| // Wait the given time |
| Thread.sleep(heartbeatInterval); |
| |
| // get the list of PDPs (may have changed since last time) |
| pdps.clear(); |
| synchronized (papEngine) { |
| try { |
| for (PDPGroup g : papEngine.getPDPGroups()) { |
| for (PDP p : g.getPdps()) { |
| pdps.add(p); |
| } |
| } |
| } catch (PAPException e) { |
| logger |
| .error("Heartbeat unable to read PDPs from PAPEngine: " + e.getMessage(), e); |
| } |
| } |
| // |
| // Check for shutdown |
| // |
| if (!this.isRunning()) { |
| logger.info("isRunning is false, getting out of loop."); |
| break; |
| } |
| |
| // try to get the summary status from each PDP |
| boolean changeSeen = false; |
| for (PDP pdp : pdps) { |
| // |
| // Check for shutdown |
| // |
| if (!this.isRunning()) { |
| logger.info("isRunning is false, getting out of loop."); |
| break; |
| } |
| // the id of the PDP is its url (though we add a query parameter) |
| URL pdpURL = idToURLMap.get(pdp.getId()); |
| if (pdpURL == null) { |
| // haven't seen this PDP before |
| String fullURLString = null; |
| try { |
| fullURLString = pdp.getId() + "?type=hb"; |
| pdpURL = new URL(fullURLString); |
| idToURLMap.put(pdp.getId(), pdpURL); |
| } catch (MalformedURLException e) { |
| logger.error("PDP id '" + fullURLString + "' is not a valid URL: " + e, e); |
| continue; |
| } |
| } |
| |
| // Do a GET with type HeartBeat |
| String newStatus = ""; |
| |
| HttpURLConnection connection = null; |
| try { |
| |
| // |
| // Open up the connection |
| // |
| connection = (HttpURLConnection)pdpURL.openConnection(); |
| // |
| // Setup our method and headers |
| // |
| connection.setRequestMethod("GET"); |
| connection.setConnectTimeout(heartbeatTimeout); |
| // |
| // Do the connect |
| // |
| connection.connect(); |
| if (connection.getResponseCode() == 204) { |
| newStatus = connection |
| .getHeaderField(XACMLRestProperties.PROP_PDP_HTTP_HEADER_HB); |
| if (logger.isDebugEnabled()) { |
| logger |
| .debug("Heartbeat '" + pdp.getId() + "' status='" + newStatus + "'"); |
| } |
| } else { |
| // anything else is an unexpected result |
| newStatus = PDPStatus.Status.UNKNOWN.toString(); |
| logger.error("Heartbeat connect response code " |
| + connection.getResponseCode() + ": " + pdp.getId()); |
| } |
| } catch (UnknownHostException e) { |
| newStatus = PDPStatus.Status.NO_SUCH_HOST.toString(); |
| logger.error("Heartbeat '" + pdp.getId() + "' NO_SUCH_HOST"); |
| } catch (SocketTimeoutException e) { |
| newStatus = PDPStatus.Status.CANNOT_CONNECT.toString(); |
| logger.error("Heartbeat '" + pdp.getId() + "' connection timeout: " + e); |
| } catch (ConnectException e) { |
| newStatus = PDPStatus.Status.CANNOT_CONNECT.toString(); |
| logger.error("Heartbeat '" + pdp.getId() + "' cannot connect: " + e); |
| } catch (Exception e) { |
| newStatus = PDPStatus.Status.UNKNOWN.toString(); |
| logger.error("Heartbeat '" + pdp.getId() + "' connect exception: " + e, e); |
| } finally { |
| // cleanup the connection |
| connection.disconnect(); |
| } |
| |
| if (!pdp.getStatus().getStatus().toString().equals(newStatus)) { |
| if (logger.isDebugEnabled()) { |
| logger.debug("previous status='" + pdp.getStatus().getStatus() |
| + "' new Status='" + newStatus + "'"); |
| } |
| try { |
| setPDPSummaryStatus(pdp, newStatus); |
| } catch (PAPException e) { |
| logger.error("Unable to set state for PDP '" + pdp.getId() + "': " + e, e); |
| } |
| changeSeen = true; |
| } |
| |
| } |
| // |
| // Check for shutdown |
| // |
| if (!this.isRunning()) { |
| logger.info("isRunning is false, getting out of loop."); |
| break; |
| } |
| |
| // if any of the PDPs changed state, tell the ACs to update |
| if (changeSeen) { |
| notifyAC(); |
| } |
| |
| } |
| } catch (InterruptedException e) { |
| logger.error("Heartbeat interrupted. Shutting down"); |
| this.terminate(); |
| } |
| } |
| } |
| |
| // |
| // HELPER to change Group status when PDP status is changed |
| // |
| // (Must NOT be called from a method that is synchronized on the papEngine or it may deadlock) |
| // |
| |
| private void setPDPSummaryStatus(PDP pdp, PDPStatus.Status newStatus) throws PAPException { |
| setPDPSummaryStatus(pdp, newStatus.toString()); |
| } |
| |
| private void setPDPSummaryStatus(PDP pdp, String newStatus) throws PAPException { |
| synchronized (papEngine) { |
| StdPDPStatus status = (StdPDPStatus)pdp.getStatus(); |
| status.setStatus(PDPStatus.Status.valueOf(newStatus)); |
| ((StdPDP)pdp).setStatus(status); |
| |
| // now adjust the group |
| StdPDPGroup group = (StdPDPGroup)papEngine.getPDPGroup(pdp); |
| // if the PDP was just deleted it may transiently exist but not be in a group |
| if (group != null) { |
| group.resetStatus(); |
| } |
| } |
| } |
| |
| // |
| // Callback methods telling this servlet to notify PDPs of changes made by the PAP StdEngine |
| // in the PDP group directories |
| // |
| |
| @Override |
| public void changed() { |
| // all PDPs in all groups need to be updated/sync'd |
| Set<PDPGroup> groups; |
| try { |
| groups = papEngine.getPDPGroups(); |
| } catch (PAPException e) { |
| logger.error("getPDPGroups failed: " + e.getLocalizedMessage()); |
| throw new RuntimeException("Unable to get Groups: " + e); |
| } |
| for (PDPGroup group : groups) { |
| groupChanged(group); |
| } |
| } |
| |
| @Override |
| public void groupChanged(PDPGroup group) { |
| // all PDPs within one group need to be updated/sync'd |
| for (PDP pdp : group.getPdps()) { |
| pdpChanged(pdp); |
| } |
| } |
| |
| @Override |
| public void pdpChanged(PDP pdp) { |
| // kick off a thread to do an event notification for each PDP. |
| // This needs to be on a separate thread so that PDPs that do not respond (down, non-existent, etc) |
| // do not block the PSP response to the AC, which would freeze the GUI until all PDPs sequentially |
| // respond or time-out. |
| Thread t = new Thread(new UpdatePDPThread(pdp)); |
| t.start(); |
| } |
| |
| private class UpdatePDPThread implements Runnable { |
| private PDP pdp; |
| |
| // remember which PDP to notify |
| public UpdatePDPThread(PDP pdp) { |
| this.pdp = pdp; |
| } |
| |
| @Override |
| public void run() { |
| // send the current configuration to one PDP |
| HttpURLConnection connection = null; |
| try { |
| |
| // |
| // the Id of the PDP is its URL |
| // |
| if (logger.isDebugEnabled()) { |
| logger.debug("creating url for id '" + pdp.getId() + "'"); |
| } |
| // TODO - currently always send both policies and pips. Do we care enough to add code to allow |
| // sending just one or the other? |
| // TODO (need to change "cache=", implying getting some input saying which to change) |
| URL url = new URL(pdp.getId() + "?cache=all"); |
| |
| // |
| // Open up the connection |
| // |
| connection = (HttpURLConnection)url.openConnection(); |
| // |
| // Setup our method and headers |
| // |
| connection.setRequestMethod("PUT"); |
| // connection.setRequestProperty("Accept", "text/x-java-properties"); |
| connection.setRequestProperty("Content-Type", "text/x-java-properties"); |
| // connection.setUseCaches(false); |
| // |
| // Adding this in. It seems the HttpUrlConnection class does NOT |
| // properly forward our headers for POST re-direction. It does so |
| // for a GET re-direction. |
| // |
| // So we need to handle this ourselves. |
| // |
| // TODO - is this needed for a PUT? seems better to leave in for now? |
| // connection.setInstanceFollowRedirects(false); |
| // |
| // PLD - MUST be able to handle re-directs. |
| // |
| connection.setInstanceFollowRedirects(true); |
| connection.setDoOutput(true); |
| // connection.setDoInput(true); |
| try (OutputStream os = connection.getOutputStream()) { |
| |
| PDPGroup group = papEngine.getPDPGroup(pdp); |
| // if the PDP was just deleted, there is no group, but we want to send an update anyway |
| if (group == null) { |
| // create blank properties files |
| Properties policyProperties = new Properties(); |
| policyProperties.put(XACMLProperties.PROP_ROOTPOLICIES, ""); |
| policyProperties.put(XACMLProperties.PROP_REFERENCEDPOLICIES, ""); |
| policyProperties.store(os, ""); |
| |
| Properties pipProps = new Properties(); |
| pipProps.setProperty(XACMLProperties.PROP_PIP_ENGINES, ""); |
| pipProps.store(os, ""); |
| |
| } else { |
| // send properties from the current group |
| group.getPolicyProperties().store(os, ""); |
| Properties policyLocations = new Properties(); |
| for (PDPPolicy policy : group.getPolicies()) { |
| policyLocations.put(policy.getId() + ".url", XACMLPapServlet.papURL + "?id=" |
| + policy.getId()); |
| } |
| policyLocations.store(os, ""); |
| group.getPipConfigProperties().store(os, ""); |
| } |
| |
| } catch (Exception e) { |
| logger.error("Failed to send property file to " + pdp.getId(), e); |
| // Since this is a server-side error, it probably does not reflect a problem on the |
| // client, |
| // so do not change the PDP status. |
| return; |
| } |
| // |
| // Do the connect |
| // |
| connection.connect(); |
| if (connection.getResponseCode() == 204) { |
| logger.info("Success. We are configured correctly."); |
| setPDPSummaryStatus(pdp, PDPStatus.Status.UP_TO_DATE); |
| } else if (connection.getResponseCode() == 200) { |
| logger.info("Success. PDP needs to update its configuration."); |
| setPDPSummaryStatus(pdp, PDPStatus.Status.OUT_OF_SYNCH); |
| } else { |
| logger.warn("Failed: " + connection.getResponseCode() + " message: " |
| + connection.getResponseMessage()); |
| setPDPSummaryStatus(pdp, PDPStatus.Status.UNKNOWN); |
| } |
| } catch (Exception e) { |
| logger.error("Unable to sync config with PDP '" + pdp.getId() + "': " + e, e); |
| try { |
| setPDPSummaryStatus(pdp, PDPStatus.Status.UNKNOWN); |
| } catch (PAPException e1) { |
| logger.error("Unable to set status of PDP '" + pdp.getId() + "' to UNKNOWN: " + e, e); |
| } |
| } finally { |
| // cleanup the connection |
| connection.disconnect(); |
| |
| // tell the AC to update it's status info |
| notifyAC(); |
| } |
| |
| } |
| } |
| |
| // |
| // RESTful Interface from PAP to ACs notifying them of changes |
| // |
| |
| private void notifyAC() { |
| // kick off a thread to do one event notification for all registered ACs |
| // This needs to be on a separate thread so that ACs can make calls back to PAP to get the updated |
| // Group data |
| // as part of processing this message on their end. |
| Thread t = new Thread(new NotifyACThread()); |
| t.start(); |
| } |
| |
| private class NotifyACThread implements Runnable { |
| |
| @Override |
| public void run() { |
| List<String> disconnectedACs = new ArrayList<String>(); |
| // logger.debug("LIST SIZE="+adminConsoleURLStringList.size()); |
| |
| // There should be no Concurrent exception here because the list is a CopyOnWriteArrayList. |
| // The "for each" loop uses the collection's iterator under the covers, so it should be correct. |
| for (String acURL : adminConsoleURLStringList) { |
| HttpURLConnection connection = null; |
| try { |
| |
| acURL += "?PAPNotification=true"; |
| |
| // TODO - Currently we just tell AC that "Something changed" without being specific. Do we |
| // want to tell it which group/pdp changed? |
| // TODO - If so, put correct parameters into the Query string here |
| acURL += "&objectType=all" + "&action=update"; |
| |
| if (logger.isDebugEnabled()) { |
| logger.debug("creating url for id '" + acURL + "'"); |
| } |
| // TODO - currently always send both policies and pips. Do we care enough to add code to |
| // allow sending just one or the other? |
| // TODO (need to change "cache=", implying getting some input saying which to change) |
| |
| URL url = new URL(acURL); |
| |
| // |
| // Open up the connection |
| // |
| connection = (HttpURLConnection)url.openConnection(); |
| // |
| // Setup our method and headers |
| // |
| connection.setRequestMethod("PUT"); |
| connection.setRequestProperty("Content-Type", "text/x-java-properties"); |
| // |
| // Adding this in. It seems the HttpUrlConnection class does NOT |
| // properly forward our headers for POST re-direction. It does so |
| // for a GET re-direction. |
| // |
| // So we need to handle this ourselves. |
| // |
| // TODO - is this needed for a PUT? seems better to leave in for now? |
| connection.setInstanceFollowRedirects(false); |
| // |
| // Do not include any data in the PUT because this is just a |
| // notification to the AC. |
| // The AC will use GETs back to the PAP to get what it needs |
| // to fill in the screens. |
| // |
| |
| // |
| // Do the connect |
| // |
| connection.connect(); |
| if (connection.getResponseCode() == 204) { |
| logger.info("Success. We updated correctly."); |
| } else { |
| logger.warn("Failed: " + connection.getResponseCode() + " message: " |
| + connection.getResponseMessage()); |
| } |
| |
| } catch (Exception e) { |
| logger.error("Unable to sync config AC '" + acURL + "': " + e, e); |
| disconnectedACs.add(acURL); |
| } finally { |
| // cleanup the connection |
| connection.disconnect(); |
| } |
| } |
| |
| // remove any ACs that are no longer connected |
| if (disconnectedACs.size() > 0) { |
| adminConsoleURLStringList.removeAll(disconnectedACs); |
| } |
| |
| } |
| } |
| |
| } |
