...
- The request is authenticated in AAFTODO: the request should be authorized in the
- futureThe request is authorized through a permission in AAF (see section: A&AI permissions)
- If the request passes all the checks (authentication and in the future authorization), it is forwarded to the A&AI servlet which handles the web services.
...
Users have roles assigned and each role has permissions.
A&AI permissions
...
There will be a separate permission for traversal and resources web services. Let's call these permissions org.onap.aai.resources and org.onap.aai.traversal. For now we will not distinguish between different objects we could affect, so the instance will always be "*" meaning everything. Actions will be mapped to HTTP verbs - GET, PUT, POST, DELETE, PATCH.
...
| Role org.onap.aai.traversal_basic | ||||||
|---|---|---|---|---|---|---|
|
...
A&AI webservice AAF role and permission
...
script
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
#resources read-write role role create org.onap.aai.resources_all perm create org.onap.aai.resources * get org.onap.aai.resources_all perm create org.onap.aai.resources * put org.onap.aai.resources_all perm create org.onap.aai.resources * post org.onap.aai.resources_all perm create org.onap.aai.resources * patch org.onap.aai.resources_all perm create org.onap.aai.resources * delete org.onap.aai.resources_all user #resources read-only role role addcreate demo@peopleorg.onap.osaaf.org aai.resources_readonly perm create org.onap.aai.resources * get org.onap.aai.resources_all #just an example, add role to the correct userreadonly #traversal basic role role create org.onap.aai.traversal_basic perm create org.onap.aai.traversal * basic org.onap.aai.traversal_basic #traversal advanced role role create org.onap.aai.resourcestraversal_readonlyadvanced perm create org.onap.aai.resources * gettraversal * advanced org.onap.aai.traversal_advanced #adding users to roles user role add aai@aai.onap.org org.onap.aai.traversal_advanced user role add so@so.onap.org org.onap.aai.resourcestraversal_readonly role createadvanced user role add sdnc@sdnc.onap.org org.onap.aai.traversal_advanced user role add dcae@dcae.onap.org org.onap.aai.traversal_basic perm createadvanced user role add policy@policy.onap.org org.onap.aai.traversal * basic_advanced user role add sdc@sdc.onap.org org.onap.aai.traversal_basicadvanced user role createadd vid@vid.onap.org org.onap.aai.traversal_advanced perm createuser role add appc@appc.onap.org org.onap.aai.traversal * advanced org_advanced user role add oof@oof.onap.org org.onap.aai.traversal_advanced user role add pomba@pomba.onap.org org.onap.aai.traversal_advanced user role add vfc@vfc.onap.org org.onap.aai.traversal_advanced user role add demo@people.osaaf.org org.onap.aai.traversal_advanced #just an example, add role to the correct user_basic user role add aai@aai.onap.org org.onap.aai.resources_all user role add so@so.onap.org org.onap.aai.resources_all user role add sdnc@sdnc.onap.org org.onap.aai.resources_all user role add dcae@dcae.onap.org org.onap.aai.resources_all user role add policy@policy.onap.org org.onap.aai.resources_all user role add sdc@sdc.onap.org org.onap.aai.resources_all user role add vid@vid.onap.org org.onap.aai.resources_all user role add appc@appc.onap.org org.onap.aai.resources_all user role add oof@oof.onap.org org.onap.aai.resources_all user role add pomba@pomba.onap.org org.onap.aai.resources_all user role add vfc@vfc.onap.org org.onap.aai.resources_all user role add demo@people.osaaf.org org.onap.aai.resources_readonly |