Add shiro.realm.RealmAuthProvider

This is a spiritual successor to TokenAuthenticators, expressed as
a service. It improves wiring by deferring the access to authenticators
to when they are needed -- thus decoupling
AAAShiroProvider/AAAWebEnvironment lifecycle.

JIRA: AAA-290
Change-Id: I52174348d0feee214c266ebd13e59a119beb4f9d
Signed-off-by: Robert Varga <robert.varga@pantheon.tech>

diff --git a/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/AAAShiroProvider.java b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/AAAShiroProvider.java
index 955af92b72cd006ea7b7e14875a62955f4758d13..b9e7ea67cd0c70bef10d29081c3c60e2a0e9cd57 100644 (file)
--- a/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/AAAShiroProvider.java
+++ b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/AAAShiroProvider.java
@@ -14,6 +14,7 @@ import org.opendaylight.aaa.api.IIDMStore;
 import org.opendaylight.aaa.api.PasswordCredentialAuth;
 import org.opendaylight.aaa.api.StoreBuilder;
 import org.opendaylight.aaa.api.TokenAuth;
+import org.opendaylight.aaa.shiro.realm.RealmAuthProvider;
 import org.opendaylight.aaa.tokenauthrealm.auth.HttpBasicAuth;
 import org.opendaylight.yang.gen.v1.urn.opendaylight.aaa.app.config.rev170619.DatastoreConfig;
 import org.slf4j.Logger;
@@ -22,7 +23,7 @@ import org.slf4j.LoggerFactory;
 /**
  * Provider for AAA shiro implementation.
  */
-public final class AAAShiroProvider implements AutoCloseable {
+public final class AAAShiroProvider implements RealmAuthProvider, AutoCloseable {
     private static final Logger LOG = LoggerFactory.getLogger(AAAShiroProvider.class);
 
     private final @NonNull List<TokenAuth> tokenAuthenticators;
@@ -60,7 +61,8 @@ public final class AAAShiroProvider implements AutoCloseable {
         }
     }
 
-    public @NonNull List<TokenAuth> getTokenAuthenticators() {
+    @Override
+    public List<TokenAuth> tokenAuthenticators() {
         return tokenAuthenticators;
     }
 }

diff --git a/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/RealmAuthProvider.java b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/RealmAuthProvider.java
new file mode 100644 (file)
index 0000000..340e0d5
--- /dev/null
+++ b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/RealmAuthProvider.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2025 PANTHEON.tech, s.r.o. and others.  All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v1.0 which accompanies this distribution,
+ * and is available at http://www.eclipse.org/legal/epl-v10.html
+ */
+package org.opendaylight.aaa.shiro.realm;
+
+import java.util.List;
+import org.eclipse.jdt.annotation.NonNullByDefault;
+import org.opendaylight.aaa.api.TokenAuth;
+
+/**
+ * {@link TokenAuth}s forming a realm.
+ */
+@FunctionalInterface
+@NonNullByDefault
+public interface RealmAuthProvider {
+    /**
+     * Returns the realm's token authenticators.
+     *
+     * @return the realm's token authenticators
+     */
+    List<TokenAuth> tokenAuthenticators();
+}

diff --git a/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java
index 682e645aa3777248ada06418b32a38d30de516f0..24279681b4d01f44139792d46ba917af5ed6cb0c 100644 (file)
--- a/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java
+++ b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java
@@ -11,7 +11,6 @@ import static com.google.common.base.Verify.verifyNotNull;
 import static java.util.Objects.requireNonNull;
 
 import com.google.common.base.Strings;
-import java.util.List;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
@@ -22,7 +21,6 @@ import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;
 import org.opendaylight.aaa.api.Authentication;
 import org.opendaylight.aaa.api.AuthenticationService;
-import org.opendaylight.aaa.api.TokenAuth;
 import org.opendaylight.aaa.api.shiro.principal.ODLPrincipal;
 import org.opendaylight.aaa.shiro.principal.ODLPrincipalImpl;
 import org.opendaylight.aaa.shiro.realm.util.TokenUtils;
@@ -37,26 +35,26 @@ import org.slf4j.LoggerFactory;
  */
 public class TokenAuthRealm extends AuthorizingRealm {
     private static final Logger LOG = LoggerFactory.getLogger(TokenAuthRealm.class);
-    private static final ThreadLocal<List<TokenAuth>> AUTHENICATORS_TL = new ThreadLocal<>();
+    private static final ThreadLocal<RealmAuthProvider> AUTHENICATORS_TL = new ThreadLocal<>();
     private static final ThreadLocal<AuthenticationService> AUTH_SERVICE_TL = new ThreadLocal<>();
 
-    private final List<TokenAuth> authenticators;
+    private final RealmAuthProvider realmAuthProvider;
     private final AuthenticationService authService;
 
     public TokenAuthRealm() {
         this(verifyLoad(AUTH_SERVICE_TL), verifyLoad(AUTHENICATORS_TL));
     }
 
-    public TokenAuthRealm(final AuthenticationService authService, final List<TokenAuth> authenticators) {
+    public TokenAuthRealm(final AuthenticationService authService, final RealmAuthProvider realmAuthProvider) {
         this.authService = requireNonNull(authService);
-        this.authenticators = List.copyOf(authenticators);
+        this.realmAuthProvider = requireNonNull(realmAuthProvider);
         super.setName("TokenAuthRealm");
     }
 
     public static Registration prepareForLoad(final AuthenticationService authService,
-            final List<TokenAuth> authenticators) {
+            final RealmAuthProvider realmAuthProvider) {
         AUTH_SERVICE_TL.set(requireNonNull(authService));
-        AUTHENICATORS_TL.set(requireNonNull(authenticators));
+        AUTHENICATORS_TL.set(requireNonNull(realmAuthProvider));
         return () -> {
             AUTH_SERVICE_TL.remove();
             AUTHENICATORS_TL.remove();
@@ -114,7 +112,7 @@ public class TokenAuthRealm extends AuthorizingRealm {
             // iterate over <code>TokenAuth</code> implementations and
             // attempt to
             // authentication with each one
-            for (var ta : authenticators) {
+            for (var ta : realmAuthProvider.tokenAuthenticators()) {
                 try {
                     LOG.debug("Authentication attempt using {}", ta.getClass().getName());
                     final Authentication auth = ta.validate(headers);

diff --git a/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/web/env/AAAWebEnvironment.java b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/web/env/AAAWebEnvironment.java
index 37e4781dad8daca5fb5eeb9d99cd20349f13e651..003281333ba000d8f717b05cb583084e0e7247c1 100644 (file)
--- a/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/web/env/AAAWebEnvironment.java
+++ b/aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/web/env/AAAWebEnvironment.java
@@ -8,17 +8,16 @@
  */
 package org.opendaylight.aaa.shiro.web.env;
 
-import java.util.List;
 import org.apache.shiro.config.Ini;
 import org.apache.shiro.web.env.IniWebEnvironment;
 import org.opendaylight.aaa.api.AuthenticationService;
-import org.opendaylight.aaa.api.TokenAuth;
 import org.opendaylight.aaa.api.password.service.PasswordHashService;
 import org.opendaylight.aaa.cert.api.ICertificateManager;
 import org.opendaylight.aaa.shiro.realm.KeystoneAuthRealm;
 import org.opendaylight.aaa.shiro.realm.MDSALDynamicAuthorizationFilter;
 import org.opendaylight.aaa.shiro.realm.MdsalRealm;
 import org.opendaylight.aaa.shiro.realm.MoonRealm;
+import org.opendaylight.aaa.shiro.realm.RealmAuthProvider;
 import org.opendaylight.aaa.shiro.realm.TokenAuthRealm;
 import org.opendaylight.aaa.web.servlet.ServletSupport;
 import org.opendaylight.mdsal.binding.api.DataBroker;
@@ -37,7 +36,7 @@ public final class AAAWebEnvironment extends IniWebEnvironment implements AAAShi
 
     public AAAWebEnvironment(final ShiroIni shiroConfiguration, final DataBroker dataBroker,
             final ICertificateManager certificateManager, final AuthenticationService authenticationService,
-            final List<TokenAuth> tokenAuthenticators, final PasswordHashService passwordHashService,
+            final RealmAuthProvider realmAuthProvider, final PasswordHashService passwordHashService,
             final ServletSupport servletSupport) {
         // Turn ShiroConfiguration into an Ini
         final var ini = new Ini();
@@ -63,7 +62,7 @@ public final class AAAWebEnvironment extends IniWebEnvironment implements AAAShi
                  var keyStoneLoad = KeystoneAuthRealm.prepareForLoad(certificateManager, servletSupport);
                  var mdsalLoad = MdsalRealm.prepareForLoad(passwordHashService, dataBroker);
                  var moonLoad = MoonRealm.prepareForLoad(servletSupport);
-                 var tokenAuthLoad = TokenAuthRealm.prepareForLoad(authenticationService, tokenAuthenticators)) {
+                 var tokenAuthLoad = TokenAuthRealm.prepareForLoad(authenticationService, realmAuthProvider)) {
                 configure();
             }
         });

diff --git a/aaa-shiro/impl/src/main/resources/OSGI-INF/blueprint/impl-blueprint.xml b/aaa-shiro/impl/src/main/resources/OSGI-INF/blueprint/impl-blueprint.xml
index c93c6d13b70520e3bfd24d6e06585dad2d375ad9..7e119b10a2eee49d14dfe2336d75c2b3255ed95a 100644 (file)
--- a/aaa-shiro/impl/src/main/resources/OSGI-INF/blueprint/impl-blueprint.xml
+++ b/aaa-shiro/impl/src/main/resources/OSGI-INF/blueprint/impl-blueprint.xml
@@ -37,9 +37,7 @@ and is available at http://www.eclipse.org/legal/epl-v10.html
     <argument ref="dataBroker"/>
     <argument ref="certManager"/>
     <argument ref="authService"/>
-    <argument>
-      <bean factory-ref="provider" factory-method="getTokenAuthenticators"/>
-    </argument>
+    <argument ref="provider"/>
     <argument ref="passwordService"/>
     <argument ref="servletSupport"/>
   </bean>

diff --git a/aaa-shiro/impl/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java b/aaa-shiro/impl/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java
index 2216c955a780e1a0daa00cce068dd1b1b4483a0a..65dacd8a8d1742c2e375961e4209b6da3654b679 100644 (file)
--- a/aaa-shiro/impl/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java
+++ b/aaa-shiro/impl/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java
@@ -25,7 +25,7 @@ import org.opendaylight.aaa.shiro.realm.util.http.header.HeaderUtils;
 import org.opendaylight.aaa.tokenauthrealm.auth.AuthenticationManager;
 
 public class TokenAuthRealmTest {
-    private final TokenAuthRealm testRealm = new TokenAuthRealm(new AuthenticationManager(), List.of());
+    private final TokenAuthRealm testRealm = new TokenAuthRealm(new AuthenticationManager(), List::of);
 
     @Test
     public void testTokenAuthRealm() {