PAGE STATUS: UNDER CONSTRUCTION
STATUS: Project Approved (next step is Architecture ApprovalDraft (seeking PTL approval)
AAF (Application Authorization Framework):
...
draw.io Diagram | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
(If agreed the below figure is to be removed in order to align with a common look and feel for the functional archtiecture. The AAF internals are below)
The AAF functional entity provides AAF (Application Authentication Framework) provides the services for authentication, authorization and certificate management services for the ONAP components. It provides the capability to:
...
services to the ONAP components to manage the lifecycle of authentication and authorization elements such as Permissions, Roles and Credentials. It supports:
- Manage authentication and authorization elements such as: Perminssions, Roles, :
- Permissions
- Roles Credentials
- Access to organizational identities
- There is a default set of identities each ONAP component for use in ONAP Test Systems
- Store credentials for organizational identities
- Passwords
- AAF provides secure password storage for test/lab use only
- AAF has ability to delegate authentication to external authenticator
- Certificates
- These certificates have unique Authorized Identity embedded, which supports 2 way TLS Authentication
- These certificates can also be used as Server side certificates
- Passwords
- Manage fine grained permissions
- Provide ONAP components or other enforcement points with APP configured permissions
- Manage roles
- AAF provides roles for identities that include any granted permissions
- Validate and provide introspection of OAuth tokens
- Currently unused by ONAP
- Provide locator services through the AAF Locator
- AAF Components and ports can be found globally
- Locator facts
- Locator is not technically restricted to AAF. It can register (protected by Authentication/Authorization) any running process/port/interface
- Registrations include global coordinates, allowing clients to pick the "closest" one
- Locator is independent of any cluster or container mechanisms, which gives accessibility to any network accessible component
- Global - Components can reside anywhere in the world
- Scalable - A new instances can be started anywhere and instantly increase capacity and usage
- "For best results", use Cassandra scaling
- Resilient - VMs, clusters, data centers, K8S could go down, and AAF is still accessible.
- Provide a globally accessible file server to get public security information. For example,
- RCLs
- Root Certificates (any the Organization wants to publish)
- Organizational approved truststores
- Process approvals
- Authorize UI and API requests (REST interface)
- Authenticate users (human and application) (REST interface)
- Manage AAF components (REST interface)
- Auto-Generation of ONAP certificates
- For ONAP test/lab use, AAF Certman provides a local certificate authority (CA)
- AAF Certman can integrate with any certificate authority (CA) that supports the Simple Certificate Enrollment Protocol (SCEP). ONAP does not test this functionality
- Auto-configuration of ONAP certificates for ONAP clients
- as part of "Bare Metal"
- on Docker volumes
Additionally, AAF provides a Java client called CADI, which simplifies AAF use by an ONAP component. The CADI framework is a Java client that:
- Includes all AAF interactions: authentication, authorization, management
- Provides the following authentications: X509, BasicAuth and OAuth
- Provides adapter interfaces for external authenticators
- Includes a Shiro adapter to support ONAP use of ODL
- entities
- Manage the lifecycle of passwords and certificates
- Access to external credential authoriites (e.g. CA)
- Autogenerate ONAP certificates
2. API definitions
AAF provides the following interfaces:
Interface Name | Interface Definition | Interface Capabilities | Version | Status | Consumed Models |
---|---|---|---|---|---|
AAFE-1 | Application Authorization Framework Management Interface | A user interface for:
| |||
AAFE-2 | Application Authorization Framework Authentication and Authorization Interface | An interface for the ONAP components to:
|
Note: xxxI interface is a Component internal interface. xxxxE interface is a component external interface
...
Interface Name | Purpose Reason For Use |
---|---|
AAFE-3: AAF External Credential Interface | An interface to retrieve and authenticate using credentials from a credential supplier external to ONAP. |
The current API documents can be found at:
AAFE-1 (to be added)
- AAFE2 (to be added)
- AAFE3 (to be addedadded)
3. Component Description:
Link to read the docs
The AAF internal interfaces are:
...
The AAF data storage interface provices the following capabilities:
- Store Data
- Update Data
- Retrieve Data
Code Access Data Identity (CADI) is a client framework included in a web GUI or API that invokes AAF to provide AAF authentication and authorization services to containers and standalone services.
- Authenticate with one or more Authentication Protocols
- Authorize in a FINE-GRAINED manner using AAF Components
- CADI has three types of clients
- CADI AAF TAF (J2EE) - integrates with a web GUI
- CADI AAF TAF (J2EE Filter) - integrates with a REST API
- CADI AAF TAF (Java Client) - integrates with a database
AAF Service - TBD
AAF Cassandra Database - TBD
Certificate Manager (CertMan) - provides CA services (X.509 certificate generation/renewal, root and intermediate cert delivery), secure key pair generation, and keystore creation and delivery to applications. CertMan can also integrate with an external CA that supports the Simple Certificate Enrollment Protocol (SCEP).
...
4. known system limitations: (IN PROGRESS)
...