PAGE STATUS: UNDER CONSTRUCTION

STATUS: Project Approved (next step is Architecture ApprovalDraft (seeking PTL approval)

AAF (Application Authorization Framework):

...

AAF (Application Authentication Framework) provides the services for authentication, authorization and certificate management for the ONAP components.  It provides the capability to

• Create control loop from DCAE blueprint sent by SDC
• Create configuration policy from the policy Tosca sent by SDC
•  Configure DCAE applications of the control loop
• Associate µService configuration policies to the DCAE application
• Configure the operations to be taken by the control loop (by creating/updating/deleting operational policies)
• Deploy/un-deploy control loop flow (blueprints) to DCAE
• Control loop visualization. 

CLAMP relies on Policy to communicate to App-C/VF-C/SDN-C/SO in runtime, hence these are not part of CLAMP 

2. API definitions

CLAMP provides services to the ONAP components to manage the lifecycle of authentication and authorization elements such as Permissions, Roles and Credentials.  It supports:

• Manage authentication and authorization elements such as: Perminssions, Roles, Credentials
• Access to organizational entities
• Manage the lifecycle of passwords and certificates
• Access to external credential authoriites (e.g. CA)
• Autogenerate ONAP certificates

2. API definitions

AAF provides the following interfaces:

Note:   xxxI interface is a Component internal interface.  xxxxE interface is a component external interface

AAF Consumes no Interfaces:

The current API documents can be found at:

• The provided UI interfaces are found at: CLAMP latest user guide

• CLAMP internal APIs can be found: clamp swagger pdf

AAF Consumes no Interfaces:

...

• AAFE-1 (to be added)

• AAFE2 (to be added)
• AAFE3 (to be added)

3. Component Description:

A more detailed figure and description of the component.

<< For later inclusion >>

Link to read the docs

4. known system limitations: (IN PROGRESS)

Runtime: None

Clamp data redundancy is dependent on Kubernetes and the persistent volume.

Clamp application redundancy HA relies on Kubernetes

5. Used Models

...

:

...

(N/A)

6. System Deployment Architecture

...

AAF consists of x containers:

• CLAMP container
• MariaDB container
• Kibana container
• E_Search container
• LogStash container 

...

:

FFS

7. New Capabilities in this Release

This release, AAF adds the following Capabilities:

• AAF Locator differentiates public Fully Qualified Domain Name (FQDN) from Kubernetes FQDN

  • Internal Kubernetes FQDN generated when client declares its Container Namespace
  • Public FQDN are accessible for both:
    
    • GUIs/Management outside Cluster
    • Non-ONAP entities outside the Cluster
    • Other Clusters
• Improved documentation and enhanced configuration
  
  • Example "Helm" init containers to setup Volumes
• Refactored maintenance processes online for Open Source (meaning non company specific), including
  
  • Analysis of expiring Creds and Roles
  • Generation of Approval records
  • Notification of Approvals, Creds and Roles in an external company configurable way.

8. References

1.  AAF Overview & User Guide: https://onap.readthedocs.io/en/latest/submodules/clampaaf/authz.git/docs/index.html AAF internal interfaces:  https://onap.readthedocs.io/en/latest/_downloads/d3c9f924c6586fe411d40a05ad9b1bb7/swagger.pdf