Skip to content

Commit

Permalink
Fase 2 modernisering av abac-grensesnitt (#1173)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jolarsen
jolarsen authored Sep 5, 2022
1 parent c696b4c commit 7163a5c
Show file tree
Hide file tree
Showing 35 changed files with 360 additions and 1,484 deletions.
5 changes: 0 additions & 5 deletions ...s/abac-legacy/src/main/java/no/nav/foreldrepenger/sikkerhet/abac/LegacyTokenProvider.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,6 @@ public String getUid() {
return SubjectHandler.getSubjectHandler().getUid();
}

@Override
public String userToken() {
return SubjectHandler.getSubjectHandler().getInternSsoToken();
}

@Override
public OpenIDToken openIdToken() {
return SubjectHandler.getSubjectHandler().getOpenIDToken();
Expand Down
106 changes: 0 additions & 106 deletions felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/AbacAttributtSamling.java
View file

This file was deleted.

85 changes: 6 additions & 79 deletions felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/AbacAuditlogger.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,6 @@
import static no.nav.vedtak.log.audit.EventClassId.AUDIT_ACCESS;
import static no.nav.vedtak.log.audit.EventClassId.AUDIT_CREATE;
import static no.nav.vedtak.log.audit.EventClassId.AUDIT_UPDATE;
import static no.nav.vedtak.sikkerhet.abac.NavAbacCommonAttributter.RESOURCE_FELLES_PERSON_AKTOERID_RESOURCE;
import static no.nav.vedtak.sikkerhet.abac.NavAbacCommonAttributter.RESOURCE_FELLES_PERSON_FNR;
import static no.nav.vedtak.sikkerhet.abac.StandardAbacAttributtType.BEHANDLING_ID;
import static no.nav.vedtak.sikkerhet.abac.StandardAbacAttributtType.BEHANDLING_UUID;
import static no.nav.vedtak.sikkerhet.abac.StandardAbacAttributtType.FAGSAK_ID;
Expand Down Expand Up @@ -52,33 +50,16 @@ public AbacAuditlogger(Auditlogger auditlogger) {
this.auditlogger = auditlogger;
}

public void loggTilgang(String userId, Tilgangsbeslutning tilgangsbeslutning, AbacAttributtSamling attributter) {
logg(userId, tilgangsbeslutning, attributter, Access.GRANTED);
public void loggTilgang(String userId, Tilgangsbeslutning tilgangsbeslutning) {
logg(userId, tilgangsbeslutning, Access.GRANTED);
}

public void loggDeny(String userId, Tilgangsbeslutning tilgangsbeslutning, AbacAttributtSamling attributter) {
logg(userId, tilgangsbeslutning, attributter, Access.DENIED);
public void loggDeny(String userId, Tilgangsbeslutning tilgangsbeslutning) {
logg(userId, tilgangsbeslutning, Access.DENIED);
}

private void logg(String userId, Tilgangsbeslutning tilgangsbeslutning, AbacAttributtSamling attributter, Access access) {
if (tilgangsbeslutning.pdpRequest() != null) {
logg(userId, tilgangsbeslutning.pdpRequest(), attributter, access);
} else {
logg(userId, tilgangsbeslutning.beskyttetRessursAttributter(), tilgangsbeslutning.appRessursData(), access);
}
}

private void logg(String userId, PdpRequest pdpRequest, AbacAttributtSamling attributter, Access access) {
requireNonNull(pdpRequest);

String abacAction = requireNonNull(pdpRequest.getString(NavAbacCommonAttributter.XACML10_ACTION_ACTION_ID));
var header = createHeader(abacAction, access);
var fields = createDefaultAbacFields(userId, pdpRequest, attributter);

List<String> ids = getBerortBrukerId(pdpRequest);
for (String aktorId : ids) {
loggTilgangPerBerortAktoer(header, fields, aktorId);
}
private void logg(String userId, Tilgangsbeslutning tilgangsbeslutning, Access access) {
logg(userId, tilgangsbeslutning.beskyttetRessursAttributter(), tilgangsbeslutning.appRessursData(), access);
}

private void logg(String userId, BeskyttetRessursAttributter beskyttetRessursAttributter, AppRessursData appRessursData, Access access) {
Expand Down Expand Up @@ -112,31 +93,6 @@ private AuditdataHeader createHeader(String abacAction, Access access) {
.build();
}

private Set<CefField> createDefaultAbacFields(String userId, PdpRequest pdpRequest, AbacAttributtSamling attributter) {
String abacAction = requireNonNull(pdpRequest.getString(NavAbacCommonAttributter.XACML10_ACTION_ACTION_ID));
String abacResourceType = requireNonNull(pdpRequest.getString(NavAbacCommonAttributter.RESOURCE_FELLES_RESOURCE_TYPE));

Set<CefField> fields = new HashSet<>();
fields.add(new CefField(EVENT_TIME, System.currentTimeMillis()));
fields.add(new CefField(REQUEST, attributter.getAction()));
fields.add(new CefField(ABAC_RESOURCE_TYPE, abacResourceType));
fields.add(new CefField(ABAC_ACTION, abacAction));

if (userId != null) {
fields.add(new CefField(USER_ID, userId));
}

getOneOf(attributter, SAKSNUMMER, FAGSAK_ID).ifPresent(fagsak -> {
fields.addAll(forSaksnummer(fagsak));
});

getOneOf(attributter, BEHANDLING_UUID, BEHANDLING_ID).ifPresent(behandling -> {
fields.addAll(forBehandling(behandling));
});

return Set.copyOf(fields);
}

private Set<CefField> createDefaultAbacFields(String userId, BeskyttetRessursAttributter beskyttetRessursAttributter) {
String abacAction = requireNonNull(beskyttetRessursAttributter.getActionType().getEksternKode());
String abacResourceType = requireNonNull(beskyttetRessursAttributter.getResourceType());
Expand All @@ -162,19 +118,6 @@ private Set<CefField> createDefaultAbacFields(String userId, BeskyttetRessursAtt
return Set.copyOf(fields);
}

private List<String> getBerortBrukerId(PdpRequest pdpRequest) {
/*
* Arcsight foretrekker FNR fremfor AktørID, men det er uklart hvordan de
* håndterer blanding (har sendt forespørsel, men ikke fått svar). Velger derfor
* at AktørID prioriteres (siden alle kallene i k9-sak har denne).
*/
final List<String> ids = allNonNullValues(pdpRequest, RESOURCE_FELLES_PERSON_AKTOERID_RESOURCE);
if (!ids.isEmpty()) {
return ids;
}
return allNonNullValues(pdpRequest, RESOURCE_FELLES_PERSON_FNR);
}

private List<String> getBerortBrukerId(AppRessursData appRessursData) {
/*
* Arcsight foretrekker FNR fremfor AktørID, men det er uklart hvordan de
Expand All @@ -188,16 +131,6 @@ private List<String> getBerortBrukerId(AppRessursData appRessursData) {
return appRessursData.getFødselsnumre().stream().filter(Objects::nonNull).collect(Collectors.toList());
}

private static final Optional<String> getOneOf(AbacAttributtSamling attributter, AbacAttributtType... typer) {
for (AbacAttributtType key : typer) {
final Set<Object> values = attributter.getVerdier(key);
if (!values.isEmpty()) {
return Optional.of(values.stream().map(v -> v.toString()).collect(Collectors.joining(",")));
}
}
return Optional.empty();
}

private static final Optional<String> getOneOfNew(AbacDataAttributter attributter, AbacAttributtType... typer) {
for (AbacAttributtType key : typer) {
final Set<Object> values = attributter.getVerdier(key);
Expand All @@ -217,12 +150,6 @@ private static final EventClassId finnEventClassIdFra(String abacAction) {
};
}

private static final List<String> allNonNullValues(PdpRequest pdpRequest, String key) {
return pdpRequest.getListOfString(key).stream()
.filter(Objects::nonNull)
.collect(Collectors.toList());
}

/**
* Standard hos NAV er at tilgang logges som "INFO" og avslag som "WARN". Merk
* at dette avviker fra CEF-standarden.
Expand Down
63 changes: 0 additions & 63 deletions felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/AbacIdToken.java
View file

This file was deleted.

3 changes: 0 additions & 3 deletions felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/BeskyttetRessurs.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,6 @@
@Target({ ElementType.TYPE, ElementType.METHOD })
@NameBinding
public @interface BeskyttetRessurs {
@Nonbinding
BeskyttetRessursActionAttributt action() default BeskyttetRessursActionAttributt.DUMMY;

@Nonbinding
ActionType actionType() default ActionType.DUMMY;

Expand Down
17 changes: 0 additions & 17 deletions felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/BeskyttetRessursActionAttributt.java
View file

This file was deleted.

Loading

0 comments on commit 7163a5c

Please sign in to comment.