...

Scope

What is this release trying to address?

AAF trying to address the secured communication threw certificate management & token based Authentication,AuthorizationBeijing established enhanced capabilities and components, built in ONAP methodologies and instantiating with ONAP defined deployment strategies.  In Casablanca, the goal is to enable AAF to provide these capabilities as infrastructure utilized by ONAP entities by establishing Authenticated and Authorization Development and Deployment of ONAP Test environments, as well as being a tool for groups to deploy.  The special emphasis for Casablanca is to unify the x509 Trust Structures, allowing both real-time and development-time communications to be 2-way x509 wherever possible, and to establish easy-to-deploy security credentials for ONAP Components and People.

Use Cases

The existing Beijing use cases are still going to be supported 

Minimum Viable Product

The minimum viable product we are targeting is  integrating AAF  with multiple ONAP applications and perform secured transactions. using CAsupported.

AAF Team will provide an ONAP focused CADI Client in Java to make App-to-App communications consistent.

AAF Team will provide a standard "Authz Enforcement Point" in Java both for realtime Authorization of Access, but also as a stepping point to longer term security goals and improvements.

AAF Team will start the process of researching and creating a CADI Client in Python

AAF Team will start the process of researching an "Authz Enforcement Point" in Python

AAF Team will continue to improve its standing as a security component within ONAP by adhering and improving on ONAP measures.

Minimum Viable Product

AAF is already a Viable Product as of Beijing.  Casablanca is focused on allowing ONAP Apps to utilize AAF for their Authentication and Authorization needs both in terms of Development, but also Realtime modes.

Functionalities

List the functionalities that this release is committing to deliver by providing a link to JIRA Epics and Stories. In the JIRA Priority field, specify the priority (either High, Medium, Low). The priority will be used in case de-scoping is required. Don't assign High priority to all functionalities.

Epics

Stories

Longer term roadmap

 AAF is to organize software authorizations so that applications, tools and services can match the access needed to perform job functions.  This is a critical function for Cloud environments, as Services need to be able to be installed and running in a very short time, and should not be encumbered with local configurations of Users, Permissions and Passwords.To be effective during a computer transaction, Security must not only be secure, but very fast. Given that each transaction must be checked and validated for Authorization and Authentication, it is critical that all elements on this path perform optimally.

...

Sub-Components

AAF already delivers

1. AAF Service
2. AAF Location
3. AAF OAuth2
4. AAF GUI
5. AAF Certificate Manger
6. AAF FS (File server for public component access)
7. AAF Hello - OAuth2 testable Service, for helping developers learn.
8. CADI Framework (Clients and tools)
9. CMAgent - Certificate Deployment Tool

These will be improved upon in the context of ONAP.

Architecture

High level architecture diagram

Platform Maturity

Refering to CII Badging Security Program and Platform Maturity Requirements, fill out the table below by indicating the actual level , the targeted level for the current release and the evidences on how you plan to achieve the targeted level.

API Incoming Dependencies

• List the API this project is expecting from other projects.
  Prior to Release Planning review, Team Leads must agreed on the date by which the API will be fully defined. The API Delivery date must not be later than the release API Freeze date.

  Prior to the delivery date, it is a good practice to organize an API review with the API consumers.

  
  

  Note: AAF is a resource to other ONAP components

  API Name	API Description	API Definition Date	API Delivery date	API Definition link (i.e.swagger)
  None	None	None	None	None

  
  

  Required elements of Environment:

     Certificate Authority (AAF currently accesses with SCEP).  It is expected that EVERY organization will have one.

     DNS - TLS protocols require a DNS to validate FQDI.  it is expected that EVERY organization will have one.

     Organizational information to establish hierarchy for Authorization (think ILM or Organizational Hierarchy, minimally expressed a file, but better if tied to Organizations' internals.

  API Outgoing Dependencies

• API this project is delivering to other projects.

  API Name	API Description	API Definition Date	API Delivery date	API Definition link (i.e.swagger)
  ProvisiningProvisioning	API for creating,deleting and listing the administrative objects (exists)	Aug 02 2017	March 08 2018	AAF API
  Admin API	API for the admin access (exists)	Aug 02 2017	March 08 2018	AAF API
  CADI	CADI ( CODE ACCESS DATA IDENTITY)	Aug 02 2017	March 08 2018	AAF API

  Third Party Products Dependencies

  Third Party Products mean products that are mandatory to provide services for your components. Development of new functionality in third party product may or not be expected.
  List the Third Party Products (OpenStack, ODL, RabbitMQ, ElasticSearch,Crystal Reports, ...).

  Name	Description	Version
  Docker	Container engine	1.7
  Cassandra	database container	3.11

  In case there are specific dependencies  (Centos 7 vs Ubuntu 16. Etc.) list them as well.

  Testing and Integration Plans

  1. Unit test: Unit tests has at least 50% code coverage.
  2. Functional test: Leverage the robot framework infrastructure to provide the functional test.
  3. Integration test: Support integration team to provide the end to end integration test.
  4. All the above should be automation tests run on the LF Jenkins Infrastructure.

• Gaps

This section is used to document a limitation on a functionality or platform support. We are currently aware of this limitation and it will be delivered in a future Release.
List identified release gaps (if any), and its impact.

• Known Defects and Issues

Provide a link toward the list of all known project bugs.

• Risks

List the risks identified for this release along with the plan to prevent the risk to occur (mitigation) and the plan of action in the case the risk would materialized (contingency).

• Resources

Fill out the Resources Committed to the Release centralized page.

• Release Milestone

The milestones are defined at the Release Level and all the supporting project agreed to comply with these dates.

• Team Internal Milestone

This section is optional and may be used to document internal milestones within a project team or multiple project teams. For instance, in the case the team has made agreement with other team to deliver some artifacts on a certain date that are not in the release milestone, it is erecommended to provide these agreements and dates in this section.

...

• Documentation, Training

• Highlight the team contributions to the specific document related to he project (Config guide, installation guide...).
• Highlight the team contributions to the overall Release Documentation and training asset
• High level list of documentation, training and tutorials necessary to understand the release capabilities, configuration and operation.
• Documentation includes items such as:
  • Installation instructions
  • Configuration instructions
  • Developer guide
  • End User guide
  • Admin guide
  • ...

Other Information

• Vendor Neutral

If this project is coming from an existing proprietary codebase, ensure that all proprietary trademarks, logos, product names, etc. have been removed. All ONAP deliverables must comply with this rule and be agnostic of any proprietary symbols.

• Free and Open Source Software

FOSS activities are critical to the delivery of the whole ONAP initiative. The information may not be fully available at Release Planning, however to avoid late refactoring, it is critical to accomplish this task as early as possible.
List all third party Free and Open Source Software used within the release and provide License type (BSD, MIT, Apache, GNU GPL,... ).
In the case non Apache License are found inform immediately the TSC and the Release Manager and document your reasoning on why you believe we can use a non Apache version 2 license.

...