Feature/externalpdp

src/Authorization/Altinn.Platform.Authorization.csproj

@@ -11,6 +11,7 @@
     <PackageReference Include="Altinn.Common.AccessTokenClient" Version="1.1.5" />
     <PackageReference Include="Altinn.Common.PEP" Version="1.3.0" />
     <PackageReference Include="Altinn.Platform.Models" Version="1.2.0" />
+	<PackageReference Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="12.0.1" />
     <PackageReference Include="Azure.Identity" Version="1.10.4" />
     <PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.5.0" />
     <PackageReference Include="Azure.Storage.Blobs" Version="12.19.1" />

src/Authorization/Constants/XacmlRequestAttribute.cs

@@ -43,7 +43,7 @@ public static class XacmlRequestAttribute
         /// <summary>
         /// xacml string that represents organization number 
         /// </summary>
-        public const string OrganizationNumberAttribute = "urn:altinn:organizationnumber";
+        public const string OrganizationNumberAttribute = "urn:iso6523-actorid-upi:0192";
 
         /// <summary>
         /// xacml string that represents user
@@ -64,5 +64,10 @@ public static class XacmlRequestAttribute
         /// xacml string that represents resource
         /// </summary>
         public const string ResourceRegistryAttribute = "urn:altinn:resourceregistry";
+
+        /// <summary>
+        /// xacml string that represents ssn for 
+        /// </summary>
+        public const string SsnAttribute = "urn:person-no";
     }
 }

src/Authorization/Controllers/DecisionController.cs

@@ -1,23 +1,21 @@
 using System;
 using System.Collections.Generic;
-using System.Diagnostics;
 using System.IO;
 using System.Linq;
 using System.Text;
 using System.Threading.Tasks;
 using System.Xml;
-
 using Altinn.Authorization.ABAC;
-using Altinn.Authorization.ABAC.Interface;
 using Altinn.Authorization.ABAC.Utils;
 using Altinn.Authorization.ABAC.Xacml;
 using Altinn.Authorization.ABAC.Xacml.JsonProfile;
-using Altinn.Platform.Authorization.Helpers;
 using Altinn.Platform.Authorization.ModelBinding;
 using Altinn.Platform.Authorization.Models;
+using Altinn.Platform.Authorization.Models.External;
 using Altinn.Platform.Authorization.Repositories.Interface;
 using Altinn.Platform.Authorization.Services.Interface;
 using Altinn.Platform.Authorization.Services.Interfaces;
+using AutoMapper;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
@@ -43,6 +41,7 @@
         private readonly IMemoryCache _memoryCache;
         private readonly IEventLog _eventLog;
         private readonly IFeatureManager _featureManager;
+        private readonly IMapper _mapper;
 
         /// <summary>
         /// Initializes a new instance of the <see cref="DecisionController"/> class.
@@ -55,7 +54,7 @@
         /// <param name="memoryCache">memory cache</param>
         /// <param name="eventLog">the authorization event logger</param>
         /// <param name="featureManager">the feature manager</param>
-        public DecisionController(IContextHandler contextHandler, IDelegationContextHandler delegationContextHandler, IPolicyRetrievalPoint policyRetrievalPoint, IDelegationMetadataRepository delegationRepository, ILogger<DecisionController> logger, IMemoryCache memoryCache, IEventLog eventLog, IFeatureManager featureManager)
+        public DecisionController(IContextHandler contextHandler, IDelegationContextHandler delegationContextHandler, IPolicyRetrievalPoint policyRetrievalPoint, IDelegationMetadataRepository delegationRepository, ILogger<DecisionController> logger, IMemoryCache memoryCache, IEventLog eventLog, IFeatureManager featureManager, IMapper mapper)
         {
             _pdp = new PolicyDecisionPoint();
             _prp = policyRetrievalPoint;
@@ -66,6 +65,7 @@
             _memoryCache = memoryCache;
             _eventLog = eventLog;
             _featureManager = featureManager;
+            _mapper = mapper;
         }
 
         /// <summary>
@@ -109,13 +109,31 @@
             }
         }
 
-        private async Task<XacmlJsonResponse> Authorize(XacmlJsonRequest decisionRequest)
+        /// <summary>
+        /// External endpoint for autorization 
+        /// </summary>
+        [HttpPost("authorize")]
+        public async Task<XacmlJsonResponseExternal> AuthorizeExternal([FromBody] XacmlJsonRequestRootExternal authorizationRequest)
+        {
+            try
+            {
+                XacmlJsonRequestRoot jsonRequest = _mapper.Map<XacmlJsonRequestRoot>(authorizationRequest);
+                XacmlJsonResponse xacmlResponse = await Authorize(jsonRequest.Request, true);
+                return _mapper.Map<XacmlJsonResponseExternal>(xacmlResponse);
+            }
+            catch (Exception ex)
+            {
+                throw;
+            }
+        }
+
+        private async Task<XacmlJsonResponse> Authorize(XacmlJsonRequest decisionRequest, bool isExternalRequest = false)
         {
             if (decisionRequest.MultiRequests == null || decisionRequest.MultiRequests.RequestReference == null
                 || decisionRequest.MultiRequests.RequestReference.Count < 2)
             {
                 XacmlContextRequest request = XacmlJsonXmlConverter.ConvertRequest(decisionRequest);
-                XacmlContextResponse xmlResponse = await Authorize(request);
+                XacmlContextResponse xmlResponse = await Authorize(request, isExternalRequest);
                 return XacmlJsonXmlConverter.ConvertResponse(xmlResponse);
             }
             else
@@ -164,7 +182,7 @@
                         }
                     }
 
-                    XacmlContextResponse partResponse = await Authorize(XacmlJsonXmlConverter.ConvertRequest(jsonMultiRequestPart));
+                    XacmlContextResponse partResponse = await Authorize(XacmlJsonXmlConverter.ConvertRequest(jsonMultiRequestPart), isExternalRequest);
                     XacmlJsonResponse xacmlJsonResponsePart = XacmlJsonXmlConverter.ConvertResponse(partResponse);
 
                     if (multiResponse.Response == null)
@@ -187,7 +205,7 @@
                 request = XacmlParser.ReadContextRequest(reader);
             }
 
-            XacmlContextResponse xacmlContextResponse = await Authorize(request);
+            XacmlContextResponse xacmlContextResponse = await Authorize(request, false);
             return CreateResponse(xacmlContextResponse);
         }
 
@@ -213,9 +231,9 @@
             return Content(xml);
         }
 
-        private async Task<XacmlContextResponse> Authorize(XacmlContextRequest decisionRequest)
+        private async Task<XacmlContextResponse> Authorize(XacmlContextRequest decisionRequest, bool isExernalRequest)
         {
-            decisionRequest = await this._contextHandler.Enrich(decisionRequest);
+            decisionRequest = await this._contextHandler.Enrich(decisionRequest, isExernalRequest);
 
             ////_logger.LogInformation($"// DecisionController // Authorize // Roles // Enriched request: {JsonConvert.SerializeObject(decisionRequest)}.");
             XacmlPolicy policy = await this._prp.GetPolicyAsync(decisionRequest);
@@ -232,7 +250,7 @@
                     XacmlContextResult delegationResult = delegationContextResponse.Results.First();
                     if (delegationResult.Decision.Equals(XacmlContextDecision.Permit))
                     {
                         _eventLog.CreateAuthorizationEvent(_featureManager, decisionRequest, HttpContext, delegationContextResponse);
                         return delegationContextResponse;
                     }
                 }
@@ -242,7 +260,7 @@
                 }
             }
 
             _eventLog.CreateAuthorizationEvent(_featureManager, decisionRequest, HttpContext, rolesContextResponse);
             return rolesContextResponse;
         }
 

src/Authorization/Models/External/RequestMapper.cs

@@ -0,0 +1,44 @@
+using Altinn.Authorization.ABAC.Xacml.JsonProfile;
+
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// A class that hold access managment mapping
+    /// </summary>
+    public class RequestMapper : AutoMapper.Profile
+    {
+        /// <summary>
+        /// Initializes a new instance of the <see cref="RequestMapper"/> class.
+        /// </summary>
+        public RequestMapper()
+        {
+            AllowNullCollections = true;
+            CreateMap<XacmlJsonAttributeExternal, XacmlJsonAttribute>();
+
+            CreateMap<XacmlJsonIdReferenceExternal, XacmlJsonIdReference>();
+            CreateMap<XacmlJsonMultiRequestsExternal, XacmlJsonMultiRequests>();
+
+            CreateMap<XacmlJsonPolicyIdentifierListExternal, XacmlJsonPolicyIdentifierList>();
+            CreateMap<XacmlJsonRequestExternal, XacmlJsonRequest>();
+            CreateMap<XacmlJsonRequestReferenceExternal, XacmlJsonRequestReference>();
+            CreateMap<XacmlJsonRequestRootExternal, XacmlJsonRequestRoot>();
+            CreateMap<XacmlJsonRequestExternal, XacmlJsonRequest>();
+            CreateMap<XacmlJsonObligationOrAdviceExternal, XacmlJsonObligationOrAdvice>();
+            CreateMap<XacmlJsonCategoryExternal, XacmlJsonCategory>();
+            CreateMap<XacmlJsonStatusCodeExternal, XacmlJsonStatusCode>();
+            CreateMap<XacmlJsonStatusExternal, XacmlJsonStatus>();
+
+            CreateMap<XacmlJsonResponse, XacmlJsonResponseExternal>();
+            CreateMap<XacmlJsonResult, XacmlJsonResultExternal>();
+
+            CreateMap<XacmlJsonObligationOrAdvice, XacmlJsonObligationOrAdviceExternal>();
+            CreateMap<XacmlJsonCategory, XacmlJsonCategoryExternal>();
+            CreateMap<XacmlJsonStatus, XacmlJsonStatusExternal>();
+            CreateMap<XacmlJsonStatusCode, XacmlJsonStatusCodeExternal>();
+            CreateMap<XacmlJsonPolicyIdentifierList, XacmlJsonPolicyIdentifierListExternal>();
+            CreateMap<XacmlJsonAttribute, XacmlJsonAttributeExternal>();
+            CreateMap<XacmlJsonIdReference, XacmlJsonIdReferenceExternal>();
+            CreateMap<XacmlJsonAttributeAssignment, XacmlJsonAttributeAssignmentExternal>();
+        }
+    }
+}

src/Authorization/Models/External/XacmlJsonAttributeAssignmentExternal.cs

@@ -0,0 +1,33 @@
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// Json reprentation of Attribute assignment returned.
+    /// </summary>
+    public class XacmlJsonAttributeAssignmentExternal
+    {
+        /// <summary>
+        /// Gets or sets a string containing a XACML attribute URI. Mandatory.
+        /// </summary>
+        public string AttributeId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the value. Mandatory.
+        /// </summary>
+        public string Value { get; set; }
+
+        /// <summary>
+        /// Gets or sets a string containing a XACML category URI or the shorthand notation defined in section 4.2.2.1.
+        /// </summary>
+        public string Category { get; set; }
+
+        /// <summary>
+        /// Gets or sets the datattype of the attribute.
+        /// </summary>
+        public string DataType { get; set; }
+
+        /// <summary>
+        ///  Gets or sets the issuer of the attribute. Optional.
+        /// </summary>
+        public string Issuer { get; set; }
+    }
+}

src/Authorization/Models/External/XacmlJsonAttributeExternal.cs

@@ -0,0 +1,33 @@
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// Defines the Attribute Json object.
+    /// </summary>
+    public class XacmlJsonAttributeExternal
+    {
+        /// <summary>
+        /// Gets or sets the AttributeId. Required.
+        /// </summary>
+        public string AttributeId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the value for the Attribute. Required.
+        /// </summary>
+        public string Value { get; set; }
+
+        /// <summary>
+        /// Gets or sets the issuer of the attribute. Optional.
+        /// </summary>
+        public string Issuer { get; set; }
+
+        /// <summary>
+        /// Gets or sets the datatype of the attribute. Optional in some cases.
+        /// </summary>
+        public string DataType { get; set; }
+
+        /// <summary>
+        /// Gets or sets a value indicating whether the attribute should be returned in the result.
+        /// </summary>
+        public bool IncludeInResult { get; set; }
+    }
+}

src/Authorization/Models/External/XacmlJsonCategoryExternal.cs

@@ -0,0 +1,33 @@
+using System.Collections.Generic;
+
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// The Category object corresponds to the XML <Attributes /> element. Just like the <Attributes /> element is specific to a given XACML
+    /// attribute category, the Category object in JSON is specific to a given XACML attribute category.
+    /// http://docs.oasis-open.org/xacml/xacml-json-http/v1.1/csprd01/xacml-json-http-v1.1-csprd01.html.
+    /// </summary>
+    public class XacmlJsonCategoryExternal
+    {
+        /// <summary>
+        /// Gets or sets CategoryId.
+        /// Mandatory for a Category object in the "Category" member array; otherwise, optional. See section 4.2.2.2.
+        /// </summary>
+        public string CategoryId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the Id of the category, mappes to attributeId in xml version of ContextRequest.
+        /// </summary>
+        public string Id { get; set; }
+
+        /// <summary>
+        /// Gets or sets optional XML content.
+        /// </summary>
+        public string Content { get; set; }
+
+        /// <summary>
+        /// Gets or sets a list over all attributes for a given attribute Id mappes to the.
+        /// </summary>
+        public List<XacmlJsonAttributeExternal> Attribute { get; set; }
+    }
+}

src/Authorization/Models/External/XacmlJsonIdReferenceExternal.cs

@@ -0,0 +1,19 @@
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// A JSON object for policy refernces.
+    /// </summary>
+    public class XacmlJsonIdReferenceExternal
+    {
+        /// <summary>
+        /// Gets or sets a string containing a XACML policy or policy set URI.
+        /// Represents the value stored inside the XACML XML<PolicyIdReference /> or<PolicySetIdReference/> element.
+        /// </summary>
+        public string Id { get; set; }
+
+        /// <summary>
+        /// Gets or sets the version.
+        /// </summary>
+        public string Version { get; set; }
+    }
+}

src/Authorization/Models/External/XacmlJsonMissingAttributeDetailExternal.cs

@@ -0,0 +1,35 @@
+using System.Collections.Generic;
+
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// A JSON object for information about missing attributes in the Context Request.
+    /// </summary>
+    public class XacmlJsonMissingAttributeDetailExternal
+    {
+        /// <summary>
+        /// Gets or sets a string containing a XACML attribute URI.
+        /// </summary>
+        public string AttributeId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the value.
+        /// </summary>
+        public List<string> Value { get; set; }
+
+        /// <summary>
+        /// Gets or sets the issuer.
+        /// </summary>
+        public string Issuer { get; set; }
+
+        /// <summary>
+        /// Gets or sets the datatype.
+        /// </summary>
+        public string DataType { get; set; }
+
+        /// <summary>
+        ///  Gets or sets the category of the missing attribute.
+        /// </summary>
+        public string Category { get; set; }
+    }
+}

src/Authorization/Models/External/XacmlJsonMultiRequestsExternal.cs

@@ -0,0 +1,15 @@
+using System.Collections.Generic;
+
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// A JSON object that defines references to multiple requests.
+    /// </summary>
+    public class XacmlJsonMultiRequestsExternal
+    {
+        /// <summary>
+        /// Gets or sets the request reference.
+        /// </summary>
+        public List<XacmlJsonRequestReferenceExternal> RequestReference { get; set; }
+    }
+}

src/Authorization/Models/External/XacmlJsonObligationOrAdviceExternal.cs

@@ -0,0 +1,20 @@
+using System.Collections.Generic;
+
+namespace Altinn.Platform.Authorization.Models.External
+{
+    /// <summary>
+    /// Defines a Json object for ObligationOrAdvice.
+    /// </summary>
+    public class XacmlJsonObligationOrAdviceExternal
+    {
+        /// <summary>
+        /// Gets or sets a string containing a XACML obligation or advice URI.
+        /// </summary>
+        public string Id { get; set; }
+
+        /// <summary>
+        /// Gets or sets an array of AttributeAssignment objects.
+        /// </summary>
+        public List<XacmlJsonAttributeAssignmentExternal> AttributeAssignment { get; set; }
+    }
+}