Enable public key based authentication for netconf

Change-Id: Icca97924515537b670688767d41ddd4bd6e1bbf6
Signed-off-by: Atul Gosain <agosain@brocade.com>

diff --git a/features/netconf-connector/odl-netconf-connector/pom.xml b/features/netconf-connector/odl-netconf-connector/pom.xml
index 1af4b9faa7b6b5eafe886515546740966a333b37..5f3774611573246ccc3458455b51a88cb25d4e10 100644 (file)
--- a/features/netconf-connector/odl-netconf-connector/pom.xml
+++ b/features/netconf-connector/odl-netconf-connector/pom.xml
@@ -87,5 +87,12 @@
             <groupId>org.opendaylight.netconf</groupId>
             <artifactId>netconf-config</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.opendaylight.aaa</groupId>
+            <artifactId>odl-aaa-encryption-service</artifactId>
+            <version>0.7.0-SNAPSHOT</version>
+            <type>xml</type>
+            <classifier>features</classifier>
+        </dependency>
     </dependencies>
-</project>
\ No newline at end of file
+</project>

diff --git a/features/netconf/features-netconf/pom.xml b/features/netconf/features-netconf/pom.xml
index c2aa0187bf5b4c8aadd3d3f8c78cfbc02a2c37c7..b54aa1eeea3dddf809588f26d0c37b653df93d1b 100644 (file)
--- a/features/netconf/features-netconf/pom.xml
+++ b/features/netconf/features-netconf/pom.xml
@@ -136,5 +136,17 @@
       <type>xml</type>
       <classifier>features</classifier>
     </dependency>
+    <dependency>
+      <groupId>org.opendaylight.aaa</groupId>
+      <artifactId>aaa-encrypt-service</artifactId>
+      <version>0.7.0-SNAPSHOT</version>
+    </dependency>
+    <dependency>
+      <groupId>org.opendaylight.aaa</groupId>
+      <artifactId>aaa-encrypt-service</artifactId>
+      <version>0.7.0-SNAPSHOT</version>
+      <classifier>config</classifier>
+      <type>xml</type>
+    </dependency>
   </dependencies>
 </project>

diff --git a/netconf/netconf-netty-util/pom.xml b/netconf/netconf-netty-util/pom.xml
index 6d1048ebe324422563842720d2ee4949d12373aa..b387ef3890dff3fd3083dbc39bad2b449f1478cb 100644 (file)
--- a/netconf/netconf-netty-util/pom.xml
+++ b/netconf/netconf-netty-util/pom.xml
@@ -98,6 +98,11 @@
       <groupId>org.opendaylight.yangtools</groupId>
       <artifactId>mockito-configuration</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.opendaylight.aaa</groupId>
+      <artifactId>aaa-encrypt-service</artifactId>
+      <version>0.7.0-SNAPSHOT</version>
+    </dependency>
   </dependencies>
 
   <build>

diff --git a/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/authentication/LoginPassword.java b/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/authentication/LoginPassword.java
index 46cb2c717b314cb64548c553354087bf5df2f082..ec9cd6cbda14db1e8719b4715bbf04ea92032922 100644 (file)
--- a/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/authentication/LoginPassword.java
+++ b/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/authentication/LoginPassword.java
@@ -17,8 +17,8 @@ import org.apache.sshd.client.future.AuthFuture;
  * {@link org.opendaylight.netconf.nettyutil.handler.ssh.client.AsyncSshHandler}.
  */
 public class LoginPassword extends AuthenticationHandler {
-    private final String username;
-    private final String password;
+    protected final String username;
+    protected final String password;
 
     public LoginPassword(String username, String password) {
         this.username = username;

diff --git a/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/authentication/PublicKeyAuth.java b/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/authentication/PublicKeyAuth.java
new file mode 100644 (file)
index 0000000..283089c
--- /dev/null
+++ b/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/authentication/PublicKeyAuth.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2017 Brocade Communication Systems and others.  All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v1.0 which accompanies this distribution,
+ * and is available at http://www.eclipse.org/legal/epl-v10.html
+ */
+package org.opendaylight.netconf.nettyutil.handler.ssh.authentication;
+
+import com.google.common.base.Strings;
+import java.io.IOException;
+import java.security.KeyPair;
+import org.apache.sshd.ClientSession;
+import org.apache.sshd.client.future.AuthFuture;
+import org.opendaylight.aaa.encrypt.PKIUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Represents Auth information for the public key based authentication for netconf.
+ */
+public class PublicKeyAuth extends LoginPassword {
+    private KeyPair keyPair = null;
+    private static final Logger LOG = LoggerFactory.getLogger(PublicKeyAuth.class);
+
+    public PublicKeyAuth(String username, String password, String keyPath, String passPhrase) {
+        super(username, password);
+        try {
+            boolean isKeyPathAbsent = Strings.isNullOrEmpty(keyPath);
+            passPhrase = Strings.isNullOrEmpty(passPhrase) ? "" : passPhrase;
+            if (!isKeyPathAbsent) {
+                this.keyPair = new PKIUtil().decodePrivateKey(keyPath, passPhrase);
+            } else {
+                LOG.info("Private key path not specified in the config file.");
+            }
+        } catch (IOException ioEx) {
+            LOG.warn("Not able to read the private key and passphrase for netconf client", ioEx);
+        }
+    }
+
+    @Override
+    public AuthFuture authenticate(final ClientSession session) throws IOException {
+        if (keyPair != null) {
+            session.addPublicKeyIdentity(keyPair);
+        }
+        session.addPasswordIdentity(password);
+        return session.auth();
+    }
+}

diff --git a/netconf/netconf-topology-config/pom.xml b/netconf/netconf-topology-config/pom.xml
index e046e80cd9cee8099f4065ee20398a5e03175097..bb085f05cb0ea69d05ccda44eb4235307c4a291d 100644 (file)
--- a/netconf/netconf-topology-config/pom.xml
+++ b/netconf/netconf-topology-config/pom.xml
@@ -56,6 +56,29 @@
                     </instructions>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>build-helper-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>attach-artifacts</id>
+                        <goals>
+                            <goal>attach-artifact</goal>
+                        </goals>
+                        <phase>package</phase>
+                        <configuration>
+                            <artifacts>
+                                <artifact>
+                                    <file>${project.build.directory}/classes/initial/odl-sb-netconf-client-keypair.cfg
+                                    </file>
+                                    <type>cfg</type>
+                                    <classifier>config</classifier>
+                                </artifact>
+                            </artifacts>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
 </project>

diff --git a/netconf/netconf-topology-config/src/main/resources/initial/odl-sb-netconf-client-keypair.cfg b/netconf/netconf-topology-config/src/main/resources/initial/odl-sb-netconf-client-keypair.cfg
new file mode 100644 (file)
index 0000000..8aa5993
--- /dev/null
+++ b/netconf/netconf-topology-config/src/main/resources/initial/odl-sb-netconf-client-keypair.cfg
@@ -0,0 +1,10 @@
+# This configuration provides the provision to enable key based authentication for netconf southbound client. 
+# The configuration file should be created by name odl-sb-netconf-client-keypair.cfg inside controller/etc directory. 
+# Following configurations should be done in this file
+# private-key-path - Path for private key file. (Paths are identified relative to controller directory).
+#     eg. If private key file exists in controller/etc/id_rsa, the path can be mentioned as etc/id_rsa
+# private-key-passphrase - Passphrase that was used to encrypt the private key. 
+#       In case of no passphrase, keep it blank or unassigned.
+
+private-key-path=etc/RSA-PK
+private-key-passphrase=abc

diff --git a/netconf/netconf-topology-config/src/main/resources/org/opendaylight/blueprint/netconf-topology.xml b/netconf/netconf-topology-config/src/main/resources/org/opendaylight/blueprint/netconf-topology.xml
index 11e922f34d9220a3f153a3bfce9671f7fbd2f52e..d095bc0a8e0a50378437ac503c79e1ae12f6a555 100755 (executable)
--- a/netconf/netconf-topology-config/src/main/resources/org/opendaylight/blueprint/netconf-topology.xml
+++ b/netconf/netconf-topology-config/src/main/resources/org/opendaylight/blueprint/netconf-topology.xml
@@ -8,6 +8,7 @@
 -->
 <blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
            xmlns:odl="http://opendaylight.org/xmlns/blueprint/v1.0.0"
+           xmlns:cm="http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0"
            odl:use-default-for-reference-types="true">
 
     <reference id="clientDispatcherDependency"
@@ -32,9 +33,18 @@
         <argument value="shared-schema-repository-impl"/>
     </bean>
 
+    <cm:property-placeholder persistent-id="odl-sb-netconf-client-keypair" update-strategy="none">
+      <cm:default-properties>
+        <cm:property name="private-key-path" value=""/>
+        <cm:property name="private-key-passphrase" value=""/>
+      </cm:default-properties>
+    </cm:property-placeholder>
+
     <bean id="netconfTopology" class="org.opendaylight.netconf.topology.impl.NetconfTopologyImpl"
           init-method="init"
           destroy-method="close">
+        <cm:managed-properties persistent-id="odl-sb-netconf-client-keypair"
+                           update-strategy="container-managed"/>
         <argument value="topology-netconf"/>
         <argument ref="clientDispatcherDependency"/>
         <argument ref="eventExecutor"/>
@@ -43,10 +53,12 @@
         <argument ref="schemaRepository"/>
         <argument ref="dataBroker"/>
         <argument ref="mountPointService"/>
+        <property name="privateKeyPath" value="${private-key-path}"/>
+        <property name="privateKeyPassphrase" value="${private-key-passphrase}"/>
     </bean>
 
     <bean id="netconfConnectorFactory" class="org.opendaylight.netconf.topology.impl.NetconfConnectorFactoryImpl"/>
     <service ref="netconfConnectorFactory" interface="org.opendaylight.netconf.topology.api.NetconfConnectorFactory"
              odl:type="default"/>
 
-</blueprint>
\ No newline at end of file
+</blueprint>

diff --git a/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/NetconfTopologyManager.java b/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/NetconfTopologyManager.java
index 3c33a19199cfef65b73d51c3d3adb3ef6a175252..d031379a14bc8ced3e47dafaaa0b4adccb099ae2 100644 (file)
--- a/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/NetconfTopologyManager.java
+++ b/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/NetconfTopologyManager.java
@@ -77,6 +77,8 @@ public class NetconfTopologyManager
     private final DOMMountPointService mountPointService;
 
     private ListenerRegistration<NetconfTopologyManager> dataChangeListenerRegistration;
+    private String privateKeyPath;
+    private String privateKeyPassphrase;
 
     public NetconfTopologyManager(final DataBroker dataBroker, final RpcProviderRegistry rpcProviderRegistry,
                                   final ClusterSingletonServiceProvider clusterSingletonServiceProvider,
@@ -219,6 +221,20 @@ public class NetconfTopologyManager
         clusterRegistrations.clear();
     }
 
+    /**
+     * Sets the private key path from location specified in configuration file using blueprint.
+     */
+    public void setPrivateKeyPath(String privateKeyPath) {
+        this.privateKeyPath = privateKeyPath;
+    }
+
+    /**
+     * Sets the private key passphrase from location specified in configuration file using blueprint.
+     */
+    public void setPrivateKeyPassphrase(String privateKeyPassphrase) {
+        this.privateKeyPassphrase = privateKeyPassphrase;
+    }
+
     private ListenerRegistration<NetconfTopologyManager> registerDataTreeChangeListener(final String topologyId) {
         final WriteTransaction wtx = dataBroker.newWriteOnlyTransaction();
         initTopology(wtx, LogicalDatastoreType.CONFIGURATION, topologyId);
@@ -266,7 +282,9 @@ public class NetconfTopologyManager
                 .setTopologyId(topologyId)
                 .setNetconfClientDispatcher(clientDispatcher)
                 .setSchemaResourceDTO(NetconfTopologyUtils.setupSchemaCacheDTO(node))
-                .setIdleTimeout(writeTxIdleTimeout);
+                .setIdleTimeout(writeTxIdleTimeout)
+                .setPrivateKeyPath(privateKeyPath)
+                .setPrivateKeyPassphrase(privateKeyPassphrase);
 
         return builder.build();
     }

diff --git a/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/RemoteDeviceConnectorImpl.java b/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/RemoteDeviceConnectorImpl.java
index f242558f051736bf43a05c37b610a90103c717d7..57bd458bf514e1614ba6c2589f4d29b9aa384bd2 100644 (file)
--- a/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/RemoteDeviceConnectorImpl.java
+++ b/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/RemoteDeviceConnectorImpl.java
@@ -33,7 +33,7 @@ import org.opendaylight.netconf.client.conf.NetconfClientConfiguration;
 import org.opendaylight.netconf.client.conf.NetconfReconnectingClientConfiguration;
 import org.opendaylight.netconf.client.conf.NetconfReconnectingClientConfigurationBuilder;
 import org.opendaylight.netconf.nettyutil.handler.ssh.authentication.AuthenticationHandler;
-import org.opendaylight.netconf.nettyutil.handler.ssh.authentication.LoginPassword;
+import org.opendaylight.netconf.nettyutil.handler.ssh.authentication.PublicKeyAuth;
 import org.opendaylight.netconf.sal.connect.api.RemoteDevice;
 import org.opendaylight.netconf.sal.connect.api.RemoteDeviceHandler;
 import org.opendaylight.netconf.sal.connect.netconf.LibraryModulesSchemas;
@@ -78,6 +78,8 @@ public class RemoteDeviceConnectorImpl implements RemoteDeviceConnector {
     private final RemoteDeviceId remoteDeviceId;
     private final DOMMountPointService mountService;
     private final Timeout actorResponseWaitTime;
+    private final String privateKeyPath;
+    private final String privateKeyPassphrase;
 
     private NetconfConnectorDTO deviceCommunicatorDTO;
 
@@ -89,6 +91,8 @@ public class RemoteDeviceConnectorImpl implements RemoteDeviceConnector {
         this.remoteDeviceId = remoteDeviceId;
         this.actorResponseWaitTime = actorResponseWaitTime;
         this.mountService = mountService;
+        this.privateKeyPath = netconfTopologyDeviceSetup.getPrivateKeyPath();
+        this.privateKeyPassphrase = netconfTopologyDeviceSetup.getPrivateKeyPassphrase();
     }
 
     @Override
@@ -276,11 +280,12 @@ public class RemoteDeviceConnectorImpl implements RemoteDeviceConnector {
         final Credentials credentials = node.getCredentials();
         if (credentials instanceof org.opendaylight.yang.gen.v1.urn.opendaylight.netconf.node.topology.rev150114.netconf
                 .node.credentials.credentials.LoginPassword) {
-            authHandler = new LoginPassword(
+            authHandler = new PublicKeyAuth(
                     ((org.opendaylight.yang.gen.v1.urn.opendaylight.netconf.node.topology.rev150114.netconf
                             .node.credentials.credentials.LoginPassword) credentials).getUsername(),
                     ((org.opendaylight.yang.gen.v1.urn.opendaylight.netconf.node.topology.rev150114.netconf
-                            .node.credentials.credentials.LoginPassword) credentials).getPassword());
+                            .node.credentials.credentials.LoginPassword) credentials).getPassword(),
+                    this.privateKeyPath, this.privateKeyPassphrase);
         } else {
             throw new IllegalStateException(remoteDeviceId + ": Only login/password authentication is supported");
         }

diff --git a/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/utils/NetconfTopologySetup.java b/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/utils/NetconfTopologySetup.java
index cee8c0d80774b077665c771a27a36142439872b1..9ba578f7025b788502b9bc649bb6ff26e5626a98 100644 (file)
--- a/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/utils/NetconfTopologySetup.java
+++ b/netconf/netconf-topology-singleton/src/main/java/org/opendaylight/netconf/topology/singleton/impl/utils/NetconfTopologySetup.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 Cisco Systems, Inc. and others. All rights reserved.
+ * Copyright (c) 2017 Cisco Systems, Inc. and others. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
@@ -36,6 +36,8 @@ public class NetconfTopologySetup {
     private final String topologyId;
     private final NetconfDevice.SchemaResourcesDTO schemaResourceDTO;
     private final Duration idleTimeout;
+    private final String privateKeyPath;
+    private final String privateKeyPassphrase;
 
     private NetconfTopologySetup(final NetconfTopologySetupBuilder builder) {
         this.clusterSingletonServiceProvider = builder.getClusterSingletonServiceProvider();
@@ -51,6 +53,8 @@ public class NetconfTopologySetup {
         this.topologyId = builder.getTopologyId();
         this.schemaResourceDTO = builder.getSchemaResourceDTO();
         this.idleTimeout = builder.getIdleTimeout();
+        this.privateKeyPath = builder.getPrivateKeyPath();
+        this.privateKeyPassphrase = builder.getPrivateKeyPassphrase();
     }
 
     public ClusterSingletonServiceProvider getClusterSingletonServiceProvider() {
@@ -98,13 +102,21 @@ public class NetconfTopologySetup {
     }
 
     public NetconfDevice.SchemaResourcesDTO getSchemaResourcesDTO() {
-        return  schemaResourceDTO;
+        return schemaResourceDTO;
     }
 
     public Duration getIdleTimeout() {
         return idleTimeout;
     }
 
+    public String getPrivateKeyPath() {
+        return privateKeyPath;
+    }
+
+    public String getPrivateKeyPassphrase() {
+        return privateKeyPassphrase;
+    }
+
     public static class NetconfTopologySetupBuilder {
 
         private ClusterSingletonServiceProvider clusterSingletonServiceProvider;
@@ -120,8 +132,10 @@ public class NetconfTopologySetup {
         private NetconfClientDispatcher netconfClientDispatcher;
         private NetconfDevice.SchemaResourcesDTO schemaResourceDTO;
         private Duration idleTimeout;
+        private String privateKeyPath;
+        private String privateKeyPassphrase;
 
-        public NetconfTopologySetupBuilder(){
+        public NetconfTopologySetupBuilder() {
         }
 
         private ClusterSingletonServiceProvider getClusterSingletonServiceProvider() {
@@ -247,6 +261,24 @@ public class NetconfTopologySetup {
             return idleTimeout;
         }
 
+        public NetconfTopologySetupBuilder setPrivateKeyPath(String privateKeyPath) {
+            this.privateKeyPath = privateKeyPath;
+            return this;
+        }
+
+        public String getPrivateKeyPath() {
+            return this.privateKeyPath;
+        }
+
+        public NetconfTopologySetupBuilder setPrivateKeyPassphrase(String privateKeyPassphrase) {
+            this.privateKeyPassphrase = privateKeyPassphrase;
+            return this;
+        }
+
+        public String getPrivateKeyPassphrase() {
+            return this.privateKeyPassphrase;
+        }
+
         public static NetconfTopologySetupBuilder create() {
             return new NetconfTopologySetupBuilder();
         }

diff --git a/netconf/netconf-topology-singleton/src/main/resources/org/opendaylight/blueprint/netconf-topology-singleton.xml b/netconf/netconf-topology-singleton/src/main/resources/org/opendaylight/blueprint/netconf-topology-singleton.xml
index 8c60682605e6f2534db9cc9bbdcb69cd67369368..26de967c7516d61aa815118fd703c39b03065596 100644 (file)
--- a/netconf/netconf-topology-singleton/src/main/resources/org/opendaylight/blueprint/netconf-topology-singleton.xml
+++ b/netconf/netconf-topology-singleton/src/main/resources/org/opendaylight/blueprint/netconf-topology-singleton.xml
@@ -9,6 +9,7 @@ and is available at http://www.eclipse.org/legal/epl-v10.html
 -->
 <blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
            xmlns:odl="http://opendaylight.org/xmlns/blueprint/v1.0.0"
+           xmlns:cm="http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0"
            odl:use-default-for-reference-types="true">
 
     <reference id="dataBroker"
@@ -39,9 +40,18 @@ and is available at http://www.eclipse.org/legal/epl-v10.html
             binding-class="org.opendaylight.yang.gen.v1.urn.opendaylight.netconf.topology.singleton.config.rev170419.Config"
     />
 
+    <cm:property-placeholder persistent-id="odl-sb-netconf-client-keypair" update-strategy="none">
+        <cm:default-properties>
+            <cm:property name="private-key-path" value=""/>
+            <cm:property name="private-key-passphrase" value=""/>
+        </cm:default-properties>
+    </cm:property-placeholder>
+
     <bean id="netconfTopologyManager"
           class="org.opendaylight.netconf.topology.singleton.impl.NetconfTopologyManager"
           init-method="init" destroy-method="close">
+        <cm:managed-properties persistent-id="odl-sb-netconf-client-keypair"
+                               update-strategy="container-managed"/>
         <argument ref="dataBroker"/>
         <argument ref="rpcRegistry"/>
         <argument ref="clusterSingletonService"/>
@@ -53,6 +63,8 @@ and is available at http://www.eclipse.org/legal/epl-v10.html
         <argument value="topology-netconf"/>
         <argument ref="singletonConfig"/>
         <argument ref="mountPointService"/>
+        <property name="privateKeyPath" value="${private-key-path}"/>
+        <property name="privateKeyPassphrase" value="${private-key-passphrase}"/>
     </bean>
     <service ref="netconfTopologyManager"
              interface="org.opendaylight.netconf.topology.singleton.api.NetconfTopologySingletonService"/>

diff --git a/netconf/netconf-topology/src/main/java/org/opendaylight/netconf/topology/AbstractNetconfTopology.java b/netconf/netconf-topology/src/main/java/org/opendaylight/netconf/topology/AbstractNetconfTopology.java
index ad4bfa9029425205ccab65efdf3bc4600395a493..a1b89a850a4627633ead36e2bb99984042216ea5 100644 (file)
--- a/netconf/netconf-topology/src/main/java/org/opendaylight/netconf/topology/AbstractNetconfTopology.java
+++ b/netconf/netconf-topology/src/main/java/org/opendaylight/netconf/topology/AbstractNetconfTopology.java
@@ -35,7 +35,7 @@ import org.opendaylight.netconf.client.conf.NetconfClientConfiguration;
 import org.opendaylight.netconf.client.conf.NetconfReconnectingClientConfiguration;
 import org.opendaylight.netconf.client.conf.NetconfReconnectingClientConfigurationBuilder;
 import org.opendaylight.netconf.nettyutil.handler.ssh.authentication.AuthenticationHandler;
-import org.opendaylight.netconf.nettyutil.handler.ssh.authentication.LoginPassword;
+import org.opendaylight.netconf.nettyutil.handler.ssh.authentication.PublicKeyAuth;
 import org.opendaylight.netconf.sal.connect.api.RemoteDevice;
 import org.opendaylight.netconf.sal.connect.api.RemoteDeviceHandler;
 import org.opendaylight.netconf.sal.connect.netconf.LibraryModulesSchemas;
@@ -164,6 +164,8 @@ public abstract class AbstractNetconfTopology implements NetconfTopology {
     protected SchemaSourceRegistry schemaRegistry = DEFAULT_SCHEMA_REPOSITORY;
     protected SchemaRepository schemaRepository = DEFAULT_SCHEMA_REPOSITORY;
     protected SchemaContextFactory schemaContextFactory = DEFAULT_SCHEMA_CONTEXT_FACTORY;
+    protected String privateKeyPath;
+    protected String privateKeyPassphrase;
 
     protected final HashMap<NodeId, NetconfConnectorDTO> activeConnectors = new HashMap<>();
 
@@ -397,6 +399,20 @@ public abstract class AbstractNetconfTopology implements NetconfTopology {
                 new File(relativeSchemaCacheDirectory));
     }
 
+    /**
+     * Sets the private key path from location specified in configuration file using blueprint.
+     */
+    public void setPrivateKeyPath(String privateKeyPath) {
+        this.privateKeyPath = privateKeyPath;
+    }
+
+    /**
+     * Sets the private key passphrase from location specified in configuration file using blueprint.
+     */
+    public void setPrivateKeyPassphrase(String privateKeyPassphrase) {
+        this.privateKeyPassphrase = privateKeyPassphrase;
+    }
+
     public NetconfReconnectingClientConfiguration getClientConfig(final NetconfClientSessionListener listener,
                                                                   final NetconfNode node) {
 
@@ -419,11 +435,12 @@ public abstract class AbstractNetconfTopology implements NetconfTopology {
         final Credentials credentials = node.getCredentials();
         if (credentials instanceof org.opendaylight.yang.gen.v1.urn.opendaylight.netconf.node.topology.rev150114
                 .netconf.node.credentials.credentials.LoginPassword) {
-            authHandler = new LoginPassword(
+            authHandler = new PublicKeyAuth(
                     ((org.opendaylight.yang.gen.v1.urn.opendaylight.netconf.node.topology.rev150114
                             .netconf.node.credentials.credentials.LoginPassword) credentials).getUsername(),
                     ((org.opendaylight.yang.gen.v1.urn.opendaylight.netconf.node.topology.rev150114
-                            .netconf.node.credentials.credentials.LoginPassword) credentials).getPassword());
+                            .netconf.node.credentials.credentials.LoginPassword) credentials).getPassword(),
+                    privateKeyPath, privateKeyPassphrase);
         } else {
             throw new IllegalStateException("Only login/password authentification is supported");
         }