PAGE STATUS: UNDER CONSTRUCTION

STATUS: Project Approved (next step is Architecture ApprovalDraft (seeking PTL approval)

AAF (Application Authorization Framework):

1 High Level Component Definition and Architectural Relationships 

AAFSecurityArchFull.svg

...

Drawio
border true viewerToolbar true fitWindow false diagramName AAF System Context simpleViewer false width diagramWidth 754 revision 3

AAF (Application Authentication Framework) provides the services for authentication, authorization and certificate management for the ONAP components.  It provides the services to the capability to

• Create control loop from DCAE blueprint sent by SDC
• Create configuration policy from the policy Tosca sent by SDC
•  Configure DCAE applications of the control loop
• Associate µService configuration policies to the DCAE application
• Configure the operations to be taken by the control loop (by creating/updating/deleting operational policies)
• Deploy/un-deploy control loop flow (blueprints) to DCAE
• Control loop visualization. 

CLAMP relies on Policy to communicate to App-C/VF-C/SDN-C/SO in runtime, hence these are not part of CLAMP 

2. API definitions

CLAMP provides ONAP components to manage the lifecycle of authentication and authorization elements such as Permissions, Roles and Credentials.  It supports:

• Manage authentication and authorization elements such as: Perminssions, Roles, Credentials
• Access to organizational entities
• Manage the lifecycle of passwords and certificates
• Access to external credential authoriites (e.g. CA)
• Autogenerate ONAP certificates

2. API definitions

AAF provides the following interfaces:

Note:   xxxI interface is a Component internal interface.  xxxxE interface is a component external interface

The current API documents can be found at:

• The provided UI interfaces are found at: CLAMP latest user guide

• CLAMP internal APIs can be found: clamp swagger pdf

CLAMP consumes the following AAF Consumes no Interfaces:

The current API documents can be found at:

• AAFE-1 (to be added)

• AAFE2 (to be added)
• AAFE3 (to be added)

3. Component Description:

A more detailed figure and description of the component.

<< For later inclusion >>Link to read the docs

4. known system limitations: (IN PROGRESS)

Runtime: None

Clamp data redundancy is dependent on Kubernetes and the persistent volume.

Clamp application redundancy HA relies on Kubernetes

5. Used Models

...

:

...

• Service model (received from SDC)
• VNF model (received from SDC)
• Policy Model.

(N/A)

6. System Deployment Architecture

...

AAF consists of x containers:

• CLAMP container
• MariaDB container
• Kibana container
• E_Search container
• LogStash container 

...

:

FFS

7. New Capabilities in this Release

This release, AAF adds the following Capabilities:

...

AAF Locator differentiates public Fully Qualified Domain Name (FQDN) from Kubernetes FQDN

• Internal Kubernetes FQDN generated when client declares its Container Namespace
• Public FQDN are accessible for both:
  
  • GUIs/Management outside Cluster
  • Non-ONAP entities outside the Cluster
  • Other Clusters

...

• Example "Helm" init containers to setup Volumes

...

8. References

1.  AAF Overview & User Guide: https://onap.readthedocs.io/en/latest/submodules/aaf/clampauthz.git/docs/index.html AAF internal interfaces:  https://onap.readthedocs.io/en/latest/_downloads/d3c9f924c6586fe411d40a05ad9b1bb7/swagger.pdf