Integration details

A&AI webservices resources and traversal are integrated with AAF through the Cadi filter. The request workflow looks as follows:

The request is authenticated in AAF
The request is authorized through a permission in AAF (see section: A&AI permissions)
If the request passes all the checks (authentication and authorization), it is forwarded to the A&AI servlet which handles the web services.

The AAF model

Permissions in AAF are triplets - type, instance, action.

Type: core name of the permission
Instance: the object that is being interacted
Action: What is happening with this object

Users have roles assigned and each role has permissions.

A&AI permissions

There will be a separate permission for traversal and resources web services. Let's call these permissions org.onap.aai.resources and org.onap.aai.traversal. For now we will not distinguish between different objects we could affect, so the instance will always be "*" meaning everything. Actions will be mapped to HTTP verbs - GET, PUT, POST, DELETE, PATCH.

For a seemless transition to AAF, the first roles we use for our clients will be called org.onap.aai.resources_all and org.onap.aai.traversal_advanced and org.onap.aai.resources_readonly and org.onap.aai.traversal_basic. These roles will be assigned to all users/applications which access A&AI web services.

Role name	Meaning
org.onap.aai.resources_all	read + write access to the resources web service
org.onap.aai.resources_readonly	read-only access to the resources web service
org.onap.aai.traversal_advanced	applications may issue basic and advanced queries in the traversal web service
org.onap.aai.traversal_basic	applications may issue only basic queries in the traversal web service

Role org.onap.aai.traversal_advanced

Permission type	instances	action
org.onap.aai.traversal	*	advanced

Role org.onap.aai.resources_all

Permission type	instances	action
org.onap.aai.resources	*	get
org.onap.aai.resources	*	put
org.onap.aai.resources	*	post
org.onap.aai.resources	*	delete
org.onap.aai.resources	*	patch

Role org.onap.aai.resources_readonly

Permission type	instances	action
org.onap.aai.resources	*	get

Role org.onap.aai.traversal_basic

Permission type	instances	action
org.onap.aai.traversal	*	basic

A&AI webservice AAF role and permission script

AAF role permission setup

#resources read-write role
role create org.onap.aai.resources_all
perm create org.onap.aai.resources * get org.onap.aai.resources_all
perm create org.onap.aai.resources * put org.onap.aai.resources_all
perm create org.onap.aai.resources * post org.onap.aai.resources_all
perm create org.onap.aai.resources * patch org.onap.aai.resources_all
perm create org.onap.aai.resources * delete org.onap.aai.resources_all

#resources read-only role
role create org.onap.aai.resources_readonly
perm create org.onap.aai.resources * get org.onap.aai.resources_readonly
 
#traversal basic role 
role create org.onap.aai.traversal_basic
perm create org.onap.aai.traversal * basic org.onap.aai.traversal_basic

#traversal advanced role
role create org.onap.aai.traversal_advanced
perm create org.onap.aai.traversal * advanced org.onap.aai.traversal_advanced

#adding users to roles

user role add aai@aai.onap.org org.onap.aai.traversal_advanced 
user role add so@so.onap.org org.onap.aai.traversal_advanced 
user role add sdnc@sdnc.onap.org org.onap.aai.traversal_advanced
user role add dcae@dcae.onap.org org.onap.aai.traversal_advanced
user role add policy@policy.onap.org org.onap.aai.traversal_advanced
user role add sdc@sdc.onap.org org.onap.aai.traversal_advanced
user role add vid@vid.onap.org org.onap.aai.traversal_advanced
user role add appc@appc.onap.org org.onap.aai.traversal_advanced
user role add oof@oof.onap.org org.onap.aai.traversal_advanced
user role add pomba@pomba.onap.org org.onap.aai.traversal_advanced
user role add vfc@vfc.onap.org org.onap.aai.traversal_advanced
user role add demo@people.osaaf.org org.onap.aai.traversal_basic

user role add aai@aai.onap.org org.onap.aai.resources_all 
user role add so@so.onap.org org.onap.aai.resources_all 
user role add sdnc@sdnc.onap.org org.onap.aai.resources_all 
user role add dcae@dcae.onap.org org.onap.aai.resources_all 
user role add policy@policy.onap.org org.onap.aai.resources_all 
user role add sdc@sdc.onap.org org.onap.aai.resources_all 
user role add vid@vid.onap.org org.onap.aai.resources_all 
user role add appc@appc.onap.org org.onap.aai.resources_all 
user role add oof@oof.onap.org org.onap.aai.resources_all 
user role add pomba@pomba.onap.org org.onap.aai.resources_all 
user role add vfc@vfc.onap.org org.onap.aai.resources_all 
user role add demo@people.osaaf.org org.onap.aai.resources_readonly

The AAF model

A&AI permissions

A&AI webservice AAF role and permission script

Open questions

Browser not supported