You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airavata.apache.org by sm...@apache.org on 2015/06/02 14:01:21 UTC
[2/8] airavata git commit: modified Airavata server side to secure
the API.
modified Airavata server side to secure the API.
Project: http://git-wip-us.apache.org/repos/asf/airavata/repo
Commit: http://git-wip-us.apache.org/repos/asf/airavata/commit/14a1621a
Tree: http://git-wip-us.apache.org/repos/asf/airavata/tree/14a1621a
Diff: http://git-wip-us.apache.org/repos/asf/airavata/diff/14a1621a
Branch: refs/heads/master
Commit: 14a1621a8218d49e8b1fc775d62c1fe63e4b3983
Parents: 5c3c9bd
Author: Hasini Gunasinghe <ha...@gmail.com>
Authored: Sat May 23 13:24:54 2015 +0530
Committer: Hasini Gunasinghe <ha...@gmail.com>
Committed: Sat May 23 13:24:54 2015 +0530
----------------------------------------------------------------------
.../security/AiravataSecurityManager.java | 27 +
.../DefaultAiravataSecurityManager.java | 55 ++
.../api/server/security/DefaultOAuthClient.java | 124 +++++
.../api/server/security/Properties.java | 27 +
.../api/server/security/SecurityException.java | 11 +
.../server/security/SecurityManagerFactory.java | 32 ++
.../airavata/model/security/AuthzToken.java | 553 +++++++++++++++++++
.../securityModel.thrift | 35 ++
8 files changed, 864 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/AiravataSecurityManager.java
----------------------------------------------------------------------
diff --git a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/AiravataSecurityManager.java b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/AiravataSecurityManager.java
new file mode 100644
index 0000000..b39c951
--- /dev/null
+++ b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/AiravataSecurityManager.java
@@ -0,0 +1,27 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.airavata.api.server.security;
+
+import org.apache.airavata.model.security.AuthzToken;
+
+public interface AiravataSecurityManager {
+ public boolean isUserAuthenticatedAndAuthorized(AuthzToken authzToken) throws SecurityException;
+}
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultAiravataSecurityManager.java
----------------------------------------------------------------------
diff --git a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultAiravataSecurityManager.java b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultAiravataSecurityManager.java
new file mode 100644
index 0000000..c8aca68
--- /dev/null
+++ b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultAiravataSecurityManager.java
@@ -0,0 +1,55 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.airavata.api.server.security;
+
+import org.apache.airavata.common.utils.ServerSettings;
+import org.apache.airavata.model.security.AuthzToken;
+import org.apache.axis2.AxisFault;
+import org.apache.axis2.context.ConfigurationContext;
+import org.apache.axis2.context.ConfigurationContextFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.wso2.carbon.identity.oauth2.stub.dto.OAuth2TokenValidationResponseDTO;
+
+/**
+ * This enforces authentication and authorization on Airavata API calls.
+ */
+public class DefaultAiravataSecurityManager implements AiravataSecurityManager {
+ private final static Logger logger = LoggerFactory.getLogger(DefaultAiravataSecurityManager.class);
+
+ public boolean isUserAuthenticatedAndAuthorized(AuthzToken authzToken) throws SecurityException {
+ try {
+ ConfigurationContext configContext =
+ ConfigurationContextFactory.createConfigurationContextFromFileSystem(null, null);
+ //TODO:read following properties from server-settings.properties file.
+ DefaultOAuthClient oauthClient = new DefaultOAuthClient(ServerSettings.getRemoteOauthServerUrl(),
+ ServerSettings.getAdminUsername(), ServerSettings.getAdminPassword(), configContext);
+ OAuth2TokenValidationResponseDTO validationResponse = oauthClient.validateAccessToken(
+ authzToken.getAccessToken());
+ return validationResponse.getValid();
+ } catch (AxisFault axisFault) {
+ throw new SecurityException(axisFault.getMessage());
+ } catch (Exception exception) {
+ logger.error(exception.getCause().toString());
+ throw new SecurityException(exception.getMessage());
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultOAuthClient.java
----------------------------------------------------------------------
diff --git a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultOAuthClient.java b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultOAuthClient.java
new file mode 100644
index 0000000..d85f2bc
--- /dev/null
+++ b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/DefaultOAuthClient.java
@@ -0,0 +1,124 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.airavata.api.server.security;
+
+import org.apache.axis2.AxisFault;
+import org.apache.axis2.context.ConfigurationContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.wso2.carbon.identity.oauth2.stub.OAuth2TokenValidationServiceStub;
+import org.wso2.carbon.identity.oauth2.stub.dto.OAuth2TokenValidationRequestDTO;
+import org.wso2.carbon.identity.oauth2.stub.dto.OAuth2TokenValidationRequestDTO_OAuth2AccessToken;
+import org.wso2.carbon.identity.oauth2.stub.dto.OAuth2TokenValidationResponseDTO;
+import org.wso2.carbon.utils.CarbonUtils;
+
+import javax.net.ssl.*;
+import java.rmi.RemoteException;
+
+/**
+ * This is the default OAuth Client that talks to WSO2 IS's OAuth Authentication Server
+ * to get the OAuth token validated.
+ */
+public class DefaultOAuthClient {
+ private OAuth2TokenValidationServiceStub stub;
+ private final static Logger logger = LoggerFactory.getLogger(DefaultOAuthClient.class);
+ public static final String BEARER_TOKEN_TYPE = "bearer";
+
+ /**
+ * OAuth2TokenValidationService Admin Service Client
+ *
+ * @param auhorizationServerURL
+ * @param username
+ * @param password
+ * @param configCtx
+ * @throws Exception
+ */
+ public DefaultOAuthClient(String auhorizationServerURL, String username, String password,
+ ConfigurationContext configCtx) throws Exception {
+ String serviceURL = auhorizationServerURL + "OAuth2TokenValidationService";
+ try {
+ stub = new OAuth2TokenValidationServiceStub(configCtx, serviceURL);
+ CarbonUtils.setBasicAccessSecurityHeaders(username, password, true, stub._getServiceClient());
+ } catch (AxisFault e) {
+ logger.error("Error initializing OAuth2 Client");
+ throw new Exception("Error initializing OAuth Client", e);
+ }
+
+ try {
+ // Get SSL context
+ SSLContext sc = SSLContext.getInstance("SSL");
+
+ // Create empty HostnameVerifier
+ HostnameVerifier hv = new HostnameVerifier() {
+ public boolean verify(String urlHostName, SSLSession session) {
+ return true;
+ }
+ };
+ HttpsURLConnection.setDefaultHostnameVerifier(hv);
+
+ // Create a trust manager that does not validate certificate chains
+ TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
+ public java.security.cert.X509Certificate[] getAcceptedIssuers() {
+ return null;
+ }
+
+ public void checkClientTrusted(java.security.cert.X509Certificate[] certs,
+ String authType) {
+ }
+
+ public void checkServerTrusted(java.security.cert.X509Certificate[] certs,
+ String authType) {
+ }
+ }};
+
+ sc.init(null, trustAllCerts, new java.security.SecureRandom());
+ SSLContext.setDefault(sc);
+ } catch (Exception e) {
+ e.printStackTrace();
+ //ignore
+ }
+ }
+
+ /**
+ * Validates the OAuth 2.0 access token
+ *
+ * @param accessToken
+ * @return
+ * @throws Exception
+ */
+ public OAuth2TokenValidationResponseDTO validateAccessToken(String accessToken)
+ throws Exception {
+ OAuth2TokenValidationRequestDTO oauthReq = new OAuth2TokenValidationRequestDTO();
+ OAuth2TokenValidationRequestDTO_OAuth2AccessToken token =
+ new OAuth2TokenValidationRequestDTO_OAuth2AccessToken();
+ token.setIdentifier(accessToken);
+ token.setTokenType(BEARER_TOKEN_TYPE);
+ oauthReq.setAccessToken(token);
+ try {
+ return stub.validate(oauthReq);
+ } catch (RemoteException e) {
+ logger.error("Error while validating OAuth2 request");
+ throw new Exception("Error while validating OAuth2 request", e);
+ }
+ }
+
+
+}
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/Properties.java
----------------------------------------------------------------------
diff --git a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/Properties.java b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/Properties.java
new file mode 100644
index 0000000..b6e5a39
--- /dev/null
+++ b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/Properties.java
@@ -0,0 +1,27 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.airavata.api.server.security;
+
+public class Properties {
+ public static String oauthAuthzServerURL = "https://localhost:9443/services/";
+ public static String userName = "admin";
+ public static String password = "admin";
+}
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityException.java
----------------------------------------------------------------------
diff --git a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityException.java b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityException.java
new file mode 100644
index 0000000..8d22658
--- /dev/null
+++ b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityException.java
@@ -0,0 +1,11 @@
+package org.apache.airavata.api.server.security;
+
+public class SecurityException extends Exception {
+ public SecurityException(String message) {
+ super(message);
+ }
+
+ public SecurityException() {
+ super();
+ }
+}
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityManagerFactory.java
----------------------------------------------------------------------
diff --git a/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityManagerFactory.java b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityManagerFactory.java
new file mode 100644
index 0000000..9e71b93
--- /dev/null
+++ b/airavata-api/airavata-api-server/src/main/java/org/apache/airavata/api/server/security/SecurityManagerFactory.java
@@ -0,0 +1,32 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.airavata.api.server.security;
+
+/**
+ * This initializes an instance of the appropriate security manager according to the
+ * configuration.
+ */
+public class SecurityManagerFactory {
+ public static AiravataSecurityManager getSecurityManager(){
+ //TODO:read from configuration and create the appropriate security manager.
+ return new DefaultAiravataSecurityManager();
+ }
+}
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/airavata-data-models/src/main/java/org/apache/airavata/model/security/AuthzToken.java
----------------------------------------------------------------------
diff --git a/airavata-api/airavata-data-models/src/main/java/org/apache/airavata/model/security/AuthzToken.java b/airavata-api/airavata-data-models/src/main/java/org/apache/airavata/model/security/AuthzToken.java
new file mode 100644
index 0000000..cf05dd8
--- /dev/null
+++ b/airavata-api/airavata-data-models/src/main/java/org/apache/airavata/model/security/AuthzToken.java
@@ -0,0 +1,553 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Autogenerated by Thrift Compiler (0.9.1)
+ *
+ * DO NOT EDIT UNLESS YOU ARE SURE THAT YOU KNOW WHAT YOU ARE DOING
+ * @generated
+ */
+package org.apache.airavata.model.security;
+
+import org.apache.thrift.scheme.IScheme;
+import org.apache.thrift.scheme.SchemeFactory;
+import org.apache.thrift.scheme.StandardScheme;
+
+import org.apache.thrift.scheme.TupleScheme;
+import org.apache.thrift.protocol.TTupleProtocol;
+import org.apache.thrift.protocol.TProtocolException;
+import org.apache.thrift.EncodingUtils;
+import org.apache.thrift.TException;
+import org.apache.thrift.async.AsyncMethodCallback;
+import org.apache.thrift.server.AbstractNonblockingServer.*;
+import java.util.List;
+import java.util.ArrayList;
+import java.util.Map;
+import java.util.HashMap;
+import java.util.EnumMap;
+import java.util.Set;
+import java.util.HashSet;
+import java.util.EnumSet;
+import java.util.Collections;
+import java.util.BitSet;
+import java.nio.ByteBuffer;
+import java.util.Arrays;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+@SuppressWarnings("all") public class AuthzToken implements org.apache.thrift.TBase<AuthzToken, AuthzToken._Fields>, java.io.Serializable, Cloneable, Comparable<AuthzToken> {
+ private static final org.apache.thrift.protocol.TStruct STRUCT_DESC = new org.apache.thrift.protocol.TStruct("AuthzToken");
+
+ private static final org.apache.thrift.protocol.TField ACCESS_TOKEN_FIELD_DESC = new org.apache.thrift.protocol.TField("accessToken", org.apache.thrift.protocol.TType.STRING, (short)1);
+ private static final org.apache.thrift.protocol.TField CLAIMS_MAP_FIELD_DESC = new org.apache.thrift.protocol.TField("claimsMap", org.apache.thrift.protocol.TType.MAP, (short)2);
+
+ private static final Map<Class<? extends IScheme>, SchemeFactory> schemes = new HashMap<Class<? extends IScheme>, SchemeFactory>();
+ static {
+ schemes.put(StandardScheme.class, new AuthzTokenStandardSchemeFactory());
+ schemes.put(TupleScheme.class, new AuthzTokenTupleSchemeFactory());
+ }
+
+ private String accessToken; // required
+ private Map<String,String> claimsMap; // optional
+
+ /** The set of fields this struct contains, along with convenience methods for finding and manipulating them. */
+ @SuppressWarnings("all") public enum _Fields implements org.apache.thrift.TFieldIdEnum {
+ ACCESS_TOKEN((short)1, "accessToken"),
+ CLAIMS_MAP((short)2, "claimsMap");
+
+ private static final Map<String, _Fields> byName = new HashMap<String, _Fields>();
+
+ static {
+ for (_Fields field : EnumSet.allOf(_Fields.class)) {
+ byName.put(field.getFieldName(), field);
+ }
+ }
+
+ /**
+ * Find the _Fields constant that matches fieldId, or null if its not found.
+ */
+ public static _Fields findByThriftId(int fieldId) {
+ switch(fieldId) {
+ case 1: // ACCESS_TOKEN
+ return ACCESS_TOKEN;
+ case 2: // CLAIMS_MAP
+ return CLAIMS_MAP;
+ default:
+ return null;
+ }
+ }
+
+ /**
+ * Find the _Fields constant that matches fieldId, throwing an exception
+ * if it is not found.
+ */
+ public static _Fields findByThriftIdOrThrow(int fieldId) {
+ _Fields fields = findByThriftId(fieldId);
+ if (fields == null) throw new IllegalArgumentException("Field " + fieldId + " doesn't exist!");
+ return fields;
+ }
+
+ /**
+ * Find the _Fields constant that matches name, or null if its not found.
+ */
+ public static _Fields findByName(String name) {
+ return byName.get(name);
+ }
+
+ private final short _thriftId;
+ private final String _fieldName;
+
+ _Fields(short thriftId, String fieldName) {
+ _thriftId = thriftId;
+ _fieldName = fieldName;
+ }
+
+ public short getThriftFieldId() {
+ return _thriftId;
+ }
+
+ public String getFieldName() {
+ return _fieldName;
+ }
+ }
+
+ // isset id assignments
+ private _Fields optionals[] = {_Fields.CLAIMS_MAP};
+ public static final Map<_Fields, org.apache.thrift.meta_data.FieldMetaData> metaDataMap;
+ static {
+ Map<_Fields, org.apache.thrift.meta_data.FieldMetaData> tmpMap = new EnumMap<_Fields, org.apache.thrift.meta_data.FieldMetaData>(_Fields.class);
+ tmpMap.put(_Fields.ACCESS_TOKEN, new org.apache.thrift.meta_data.FieldMetaData("accessToken", org.apache.thrift.TFieldRequirementType.REQUIRED,
+ new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
+ tmpMap.put(_Fields.CLAIMS_MAP, new org.apache.thrift.meta_data.FieldMetaData("claimsMap", org.apache.thrift.TFieldRequirementType.OPTIONAL,
+ new org.apache.thrift.meta_data.MapMetaData(org.apache.thrift.protocol.TType.MAP,
+ new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING),
+ new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING))));
+ metaDataMap = Collections.unmodifiableMap(tmpMap);
+ org.apache.thrift.meta_data.FieldMetaData.addStructMetaDataMap(AuthzToken.class, metaDataMap);
+ }
+
+ public AuthzToken() {
+ }
+
+ public AuthzToken(
+ String accessToken)
+ {
+ this();
+ this.accessToken = accessToken;
+ }
+
+ /**
+ * Performs a deep copy on <i>other</i>.
+ */
+ public AuthzToken(AuthzToken other) {
+ if (other.isSetAccessToken()) {
+ this.accessToken = other.accessToken;
+ }
+ if (other.isSetClaimsMap()) {
+ Map<String,String> __this__claimsMap = new HashMap<String,String>(other.claimsMap);
+ this.claimsMap = __this__claimsMap;
+ }
+ }
+
+ public AuthzToken deepCopy() {
+ return new AuthzToken(this);
+ }
+
+ @Override
+ public void clear() {
+ this.accessToken = null;
+ this.claimsMap = null;
+ }
+
+ public String getAccessToken() {
+ return this.accessToken;
+ }
+
+ public void setAccessToken(String accessToken) {
+ this.accessToken = accessToken;
+ }
+
+ public void unsetAccessToken() {
+ this.accessToken = null;
+ }
+
+ /** Returns true if field accessToken is set (has been assigned a value) and false otherwise */
+ public boolean isSetAccessToken() {
+ return this.accessToken != null;
+ }
+
+ public void setAccessTokenIsSet(boolean value) {
+ if (!value) {
+ this.accessToken = null;
+ }
+ }
+
+ public int getClaimsMapSize() {
+ return (this.claimsMap == null) ? 0 : this.claimsMap.size();
+ }
+
+ public void putToClaimsMap(String key, String val) {
+ if (this.claimsMap == null) {
+ this.claimsMap = new HashMap<String,String>();
+ }
+ this.claimsMap.put(key, val);
+ }
+
+ public Map<String,String> getClaimsMap() {
+ return this.claimsMap;
+ }
+
+ public void setClaimsMap(Map<String,String> claimsMap) {
+ this.claimsMap = claimsMap;
+ }
+
+ public void unsetClaimsMap() {
+ this.claimsMap = null;
+ }
+
+ /** Returns true if field claimsMap is set (has been assigned a value) and false otherwise */
+ public boolean isSetClaimsMap() {
+ return this.claimsMap != null;
+ }
+
+ public void setClaimsMapIsSet(boolean value) {
+ if (!value) {
+ this.claimsMap = null;
+ }
+ }
+
+ public void setFieldValue(_Fields field, Object value) {
+ switch (field) {
+ case ACCESS_TOKEN:
+ if (value == null) {
+ unsetAccessToken();
+ } else {
+ setAccessToken((String)value);
+ }
+ break;
+
+ case CLAIMS_MAP:
+ if (value == null) {
+ unsetClaimsMap();
+ } else {
+ setClaimsMap((Map<String,String>)value);
+ }
+ break;
+
+ }
+ }
+
+ public Object getFieldValue(_Fields field) {
+ switch (field) {
+ case ACCESS_TOKEN:
+ return getAccessToken();
+
+ case CLAIMS_MAP:
+ return getClaimsMap();
+
+ }
+ throw new IllegalStateException();
+ }
+
+ /** Returns true if field corresponding to fieldID is set (has been assigned a value) and false otherwise */
+ public boolean isSet(_Fields field) {
+ if (field == null) {
+ throw new IllegalArgumentException();
+ }
+
+ switch (field) {
+ case ACCESS_TOKEN:
+ return isSetAccessToken();
+ case CLAIMS_MAP:
+ return isSetClaimsMap();
+ }
+ throw new IllegalStateException();
+ }
+
+ @Override
+ public boolean equals(Object that) {
+ if (that == null)
+ return false;
+ if (that instanceof AuthzToken)
+ return this.equals((AuthzToken)that);
+ return false;
+ }
+
+ public boolean equals(AuthzToken that) {
+ if (that == null)
+ return false;
+
+ boolean this_present_accessToken = true && this.isSetAccessToken();
+ boolean that_present_accessToken = true && that.isSetAccessToken();
+ if (this_present_accessToken || that_present_accessToken) {
+ if (!(this_present_accessToken && that_present_accessToken))
+ return false;
+ if (!this.accessToken.equals(that.accessToken))
+ return false;
+ }
+
+ boolean this_present_claimsMap = true && this.isSetClaimsMap();
+ boolean that_present_claimsMap = true && that.isSetClaimsMap();
+ if (this_present_claimsMap || that_present_claimsMap) {
+ if (!(this_present_claimsMap && that_present_claimsMap))
+ return false;
+ if (!this.claimsMap.equals(that.claimsMap))
+ return false;
+ }
+
+ return true;
+ }
+
+ @Override
+ public int hashCode() {
+ return 0;
+ }
+
+ @Override
+ public int compareTo(AuthzToken other) {
+ if (!getClass().equals(other.getClass())) {
+ return getClass().getName().compareTo(other.getClass().getName());
+ }
+
+ int lastComparison = 0;
+
+ lastComparison = Boolean.valueOf(isSetAccessToken()).compareTo(other.isSetAccessToken());
+ if (lastComparison != 0) {
+ return lastComparison;
+ }
+ if (isSetAccessToken()) {
+ lastComparison = org.apache.thrift.TBaseHelper.compareTo(this.accessToken, other.accessToken);
+ if (lastComparison != 0) {
+ return lastComparison;
+ }
+ }
+ lastComparison = Boolean.valueOf(isSetClaimsMap()).compareTo(other.isSetClaimsMap());
+ if (lastComparison != 0) {
+ return lastComparison;
+ }
+ if (isSetClaimsMap()) {
+ lastComparison = org.apache.thrift.TBaseHelper.compareTo(this.claimsMap, other.claimsMap);
+ if (lastComparison != 0) {
+ return lastComparison;
+ }
+ }
+ return 0;
+ }
+
+ public _Fields fieldForId(int fieldId) {
+ return _Fields.findByThriftId(fieldId);
+ }
+
+ public void read(org.apache.thrift.protocol.TProtocol iprot) throws org.apache.thrift.TException {
+ schemes.get(iprot.getScheme()).getScheme().read(iprot, this);
+ }
+
+ public void write(org.apache.thrift.protocol.TProtocol oprot) throws org.apache.thrift.TException {
+ schemes.get(oprot.getScheme()).getScheme().write(oprot, this);
+ }
+
+ @Override
+ public String toString() {
+ StringBuilder sb = new StringBuilder("AuthzToken(");
+ boolean first = true;
+
+ sb.append("accessToken:");
+ if (this.accessToken == null) {
+ sb.append("null");
+ } else {
+ sb.append(this.accessToken);
+ }
+ first = false;
+ if (isSetClaimsMap()) {
+ if (!first) sb.append(", ");
+ sb.append("claimsMap:");
+ if (this.claimsMap == null) {
+ sb.append("null");
+ } else {
+ sb.append(this.claimsMap);
+ }
+ first = false;
+ }
+ sb.append(")");
+ return sb.toString();
+ }
+
+ public void validate() throws org.apache.thrift.TException {
+ // check for required fields
+ if (!isSetAccessToken()) {
+ throw new org.apache.thrift.protocol.TProtocolException("Required field 'accessToken' is unset! Struct:" + toString());
+ }
+
+ // check for sub-struct validity
+ }
+
+ private void writeObject(java.io.ObjectOutputStream out) throws java.io.IOException {
+ try {
+ write(new org.apache.thrift.protocol.TCompactProtocol(new org.apache.thrift.transport.TIOStreamTransport(out)));
+ } catch (org.apache.thrift.TException te) {
+ throw new java.io.IOException(te);
+ }
+ }
+
+ private void readObject(java.io.ObjectInputStream in) throws java.io.IOException, ClassNotFoundException {
+ try {
+ read(new org.apache.thrift.protocol.TCompactProtocol(new org.apache.thrift.transport.TIOStreamTransport(in)));
+ } catch (org.apache.thrift.TException te) {
+ throw new java.io.IOException(te);
+ }
+ }
+
+ private static class AuthzTokenStandardSchemeFactory implements SchemeFactory {
+ public AuthzTokenStandardScheme getScheme() {
+ return new AuthzTokenStandardScheme();
+ }
+ }
+
+ private static class AuthzTokenStandardScheme extends StandardScheme<AuthzToken> {
+
+ public void read(org.apache.thrift.protocol.TProtocol iprot, AuthzToken struct) throws org.apache.thrift.TException {
+ org.apache.thrift.protocol.TField schemeField;
+ iprot.readStructBegin();
+ while (true)
+ {
+ schemeField = iprot.readFieldBegin();
+ if (schemeField.type == org.apache.thrift.protocol.TType.STOP) {
+ break;
+ }
+ switch (schemeField.id) {
+ case 1: // ACCESS_TOKEN
+ if (schemeField.type == org.apache.thrift.protocol.TType.STRING) {
+ struct.accessToken = iprot.readString();
+ struct.setAccessTokenIsSet(true);
+ } else {
+ org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
+ }
+ break;
+ case 2: // CLAIMS_MAP
+ if (schemeField.type == org.apache.thrift.protocol.TType.MAP) {
+ {
+ org.apache.thrift.protocol.TMap _map0 = iprot.readMapBegin();
+ struct.claimsMap = new HashMap<String,String>(2*_map0.size);
+ for (int _i1 = 0; _i1 < _map0.size; ++_i1)
+ {
+ String _key2;
+ String _val3;
+ _key2 = iprot.readString();
+ _val3 = iprot.readString();
+ struct.claimsMap.put(_key2, _val3);
+ }
+ iprot.readMapEnd();
+ }
+ struct.setClaimsMapIsSet(true);
+ } else {
+ org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
+ }
+ break;
+ default:
+ org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
+ }
+ iprot.readFieldEnd();
+ }
+ iprot.readStructEnd();
+ struct.validate();
+ }
+
+ public void write(org.apache.thrift.protocol.TProtocol oprot, AuthzToken struct) throws org.apache.thrift.TException {
+ struct.validate();
+
+ oprot.writeStructBegin(STRUCT_DESC);
+ if (struct.accessToken != null) {
+ oprot.writeFieldBegin(ACCESS_TOKEN_FIELD_DESC);
+ oprot.writeString(struct.accessToken);
+ oprot.writeFieldEnd();
+ }
+ if (struct.claimsMap != null) {
+ if (struct.isSetClaimsMap()) {
+ oprot.writeFieldBegin(CLAIMS_MAP_FIELD_DESC);
+ {
+ oprot.writeMapBegin(new org.apache.thrift.protocol.TMap(org.apache.thrift.protocol.TType.STRING, org.apache.thrift.protocol.TType.STRING, struct.claimsMap.size()));
+ for (Map.Entry<String, String> _iter4 : struct.claimsMap.entrySet())
+ {
+ oprot.writeString(_iter4.getKey());
+ oprot.writeString(_iter4.getValue());
+ }
+ oprot.writeMapEnd();
+ }
+ oprot.writeFieldEnd();
+ }
+ }
+ oprot.writeFieldStop();
+ oprot.writeStructEnd();
+ }
+
+ }
+
+ private static class AuthzTokenTupleSchemeFactory implements SchemeFactory {
+ public AuthzTokenTupleScheme getScheme() {
+ return new AuthzTokenTupleScheme();
+ }
+ }
+
+ private static class AuthzTokenTupleScheme extends TupleScheme<AuthzToken> {
+
+ @Override
+ public void write(org.apache.thrift.protocol.TProtocol prot, AuthzToken struct) throws org.apache.thrift.TException {
+ TTupleProtocol oprot = (TTupleProtocol) prot;
+ oprot.writeString(struct.accessToken);
+ BitSet optionals = new BitSet();
+ if (struct.isSetClaimsMap()) {
+ optionals.set(0);
+ }
+ oprot.writeBitSet(optionals, 1);
+ if (struct.isSetClaimsMap()) {
+ {
+ oprot.writeI32(struct.claimsMap.size());
+ for (Map.Entry<String, String> _iter5 : struct.claimsMap.entrySet())
+ {
+ oprot.writeString(_iter5.getKey());
+ oprot.writeString(_iter5.getValue());
+ }
+ }
+ }
+ }
+
+ @Override
+ public void read(org.apache.thrift.protocol.TProtocol prot, AuthzToken struct) throws org.apache.thrift.TException {
+ TTupleProtocol iprot = (TTupleProtocol) prot;
+ struct.accessToken = iprot.readString();
+ struct.setAccessTokenIsSet(true);
+ BitSet incoming = iprot.readBitSet(1);
+ if (incoming.get(0)) {
+ {
+ org.apache.thrift.protocol.TMap _map6 = new org.apache.thrift.protocol.TMap(org.apache.thrift.protocol.TType.STRING, org.apache.thrift.protocol.TType.STRING, iprot.readI32());
+ struct.claimsMap = new HashMap<String,String>(2*_map6.size);
+ for (int _i7 = 0; _i7 < _map6.size; ++_i7)
+ {
+ String _key8;
+ String _val9;
+ _key8 = iprot.readString();
+ _val9 = iprot.readString();
+ struct.claimsMap.put(_key8, _val9);
+ }
+ }
+ struct.setClaimsMapIsSet(true);
+ }
+ }
+ }
+
+}
+
http://git-wip-us.apache.org/repos/asf/airavata/blob/14a1621a/airavata-api/thrift-interface-descriptions/securityModel.thrift
----------------------------------------------------------------------
diff --git a/airavata-api/thrift-interface-descriptions/securityModel.thrift b/airavata-api/thrift-interface-descriptions/securityModel.thrift
new file mode 100644
index 0000000..bda9554
--- /dev/null
+++ b/airavata-api/thrift-interface-descriptions/securityModel.thrift
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+
+namespace java org.apache.airavata.model.security
+namespace php Airavata.Model.Security
+namespace cpp apache.airavata.model.security
+namespace py apache.airavata.model.security
+
+/*
+ * This file describes the definitions of the security model which encapsulates the information that needs to be passed
+ to the API methods in order to authenticate and authorize the users.
+ *
+*/
+
+struct AuthzToken {
+ 1: required string accessToken,
+ 2: optional map<string, string> claimsMap
+}
\ No newline at end of file