PAGE STATUS: UNDER CONSTRUCTION

STATUS: Project Approved (next step is Architecture ApprovalDraft (seeking PTL approval)

AAF (Application Authorization Framework):

...

AAF (Application Authentication Framework) provides the services for authentication, authorization and certificate management for the ONAP components.  It provides the capability to

• Create control loop from DCAE blueprint sent by SDC
• Create configuration policy from the policy Tosca sent by SDC
•  Configure DCAE applications of the control loop
• Associate µService configuration policies to the DCAE application
• Configure the operations to be taken by the control loop (by creating/updating/deleting operational policies)
• Deploy/un-deploy control loop flow (blueprints) to DCAE
• Control loop visualization. 

CLAMP relies on Policy to communicate to App-C/VF-C/SDN-C/SO in runtime, hence these are not part of CLAMP services to the ONAP components to manage the lifecycle of authentication and authorization elements such as Permissions, Roles and Credentials.  It supports:

• Manage authentication and authorization elements such as: Perminssions, Roles, Credentials
• Access to organizational entities
• Manage the lifecycle of passwords and certificates
• Access to external credential authoriites (e.g. CA)
• Autogenerate ONAP certificates

2. API definitions

CLAMP provides AAF provides the following interfaces:

Note:   xxxI interface is a Component internal interface.  xxxxE interface is a component external interface

The current API documents can be found at:

• The provided UI interfaces are found at: CLAMP latest user guide

• CLAMP internal APIs can be found: clamp swagger pdf

CLAMP consumes the following AAF Consumes no Interfaces:

The current API documents can be found at:

• AAFE-1 (to be added)

• AAFE2 (to be added)
• AAFE3 (to be added)

3. Component Description:

A more detailed figure and description of the component.

<< For later inclusion >>Link to read the docs

4. known system limitations: (IN PROGRESS)

Runtime: None

Clamp data redundancy is dependent on Kubernetes and the persistent volume.

Clamp application redundancy HA relies on Kubernetes

5. Used Models

...

:

...

• Service model (received from SDC)
• VNF model (received from SDC)
• Policy Model.

(N/A)

6. System Deployment Architecture

...

AAF consists of x containers:

• CLAMP container
• MariaDB container
• Kibana container
• E_Search container
• LogStash container 

...

:

FFS

7. New Capabilities in this Release

This release, AAF adds the following Capabilities:

• AAF Locator differentiates public Fully Qualified Domain Name (FQDN) from Kubernetes FQDN

  • Internal Kubernetes FQDN generated when client declares its Container Namespace
  • Public FQDN are accessible for both:
    
    • GUIs/Management outside Cluster
    • Non-ONAP entities outside the Cluster
    • Other Clusters
• Improved documentation and enhanced configuration
  
  • Example "Helm" init containers to setup Volumes
• Refactored maintenance processes online for Open Source (meaning non company specific), including
  
  • Analysis of expiring Creds and Roles
  • Generation of Approval records
  • Notification of Approvals, Creds and Roles in an external company configurable way.

8. References

1.  AAF Overview & User Guide: https://onap.readthedocs.io/en/latest/submodules/clampaaf/authz.git/docs/index.html AAF internal interfaces:  https://onap.readthedocs.io/en/latest/_downloads/d3c9f924c6586fe411d40a05ad9b1bb7/swagger.pdf