OPAMediator.java
/*
* Copyright (c) 2022, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
*
* WSO2 Inc. licenses this file to you under the Apache License,
* Version 2.0 (the "License"); you may not use this file except
* in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.synapse.mediators.opa;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.synapse.ManagedLifecycle;
import org.apache.synapse.MessageContext;
import org.apache.synapse.SynapseException;
import org.apache.synapse.core.SynapseEnvironment;
import org.apache.synapse.mediators.AbstractMediator;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.util.HashMap;
import java.util.Map;
public class OPAMediator extends AbstractMediator implements ManagedLifecycle {
private static final Log log = LogFactory.getLog(OPAMediator.class);
private static final String defaultRequestGenerator = "org.apache.synapse.mediators.opa.OPASynapseRequestGenerator";
private String serverUrl = null;
private String accessKey = null;
private String policy = null;
private String rule = null;
private String requestGeneratorClassName = null;
private Map<String, String> additionalParameters = new HashMap<String, String>();
private OPARequestGenerator requestGenerator = null;
private OPAClient opaClient;
private String opaPolicyFailuretHandler = "_opa_policy_failure_handler_";
@Override
public boolean mediate(MessageContext messageContext) {
try {
String opaPayload = requestGenerator.generateRequest(policy, rule, additionalParameters, messageContext);
String evaluatingPolicyUrl = serverUrl + "/" + policy;
if (rule != null) {
evaluatingPolicyUrl += "/" + rule;
}
String opaResponseString = opaClient.publish(evaluatingPolicyUrl, opaPayload, accessKey);
if (requestGenerator
.handleResponse(policy, rule, opaResponseString, additionalParameters, messageContext)) {
return true;
} else {
if (log.isDebugEnabled()) {
log.debug("Access revoked for the API request by the OPA policy.OPA response " + opaResponseString);
}
log.warn("Access revoked for the API request by the OPA policy.");
throw new OPASecurityException(OPASecurityException.ACCESS_REVOKED,
OPASecurityException.ACCESS_REVOKED_MESSAGE);
}
} catch (OPASecurityException e) {
OPAUtils.handlePolicyFailure(messageContext, e, opaPolicyFailuretHandler);
}
return false;
}
/**
* Initialize the request generator object based on the className provided. If class name is not provided, default
* policy generator object will be created
*
* @param className Request generator implementation
* @return OPA request generator object
* @throws OPASecurityException
*/
private OPARequestGenerator getRequestGenerator(String className) throws OPASecurityException {
try {
if (className == null) {
className = defaultRequestGenerator;
if (log.isDebugEnabled()) {
log.debug("Request generator class not found. Default generator used.");
}
}
Class<?> requestGeneratorClassObject = Class.forName(className);
Constructor<?> constructor = requestGeneratorClassObject.getConstructor();
return (OPARequestGenerator) constructor.newInstance();
} catch (NoSuchMethodException | ClassNotFoundException | InstantiationException | IllegalAccessException
| InvocationTargetException e) {
log.error("An error occurred while creating the request generator for " + className, e);
throw new OPASecurityException(OPASecurityException.INTERNAL_ERROR,
OPASecurityException.INTERNAL_ERROR_MESSAGE);
}
}
public String getServerUrl() {
return serverUrl;
}
public void setServerUrl(String serverUrl) {
this.serverUrl = serverUrl;
}
public String getAccessKey() {
return accessKey;
}
public void setAccessKey(String accessKey) {
this.accessKey = accessKey;
}
public String getRequestGeneratorClassName() {
return requestGeneratorClassName;
}
public void setRequestGeneratorClassName(String requestGeneratorClassName) {
this.requestGeneratorClassName = requestGeneratorClassName;
}
public String getPolicy() {
return policy;
}
public void setPolicy(String policy) {
this.policy = policy;
}
public String getRule() {
return rule;
}
public void setRule(String rule) {
this.rule = rule;
}
public Map<String, String> getAdditionalParameters() {
return additionalParameters;
}
public void setAdditionalParameters(Map<String, String> additionalParameters) {
this.additionalParameters = additionalParameters;
}
public void addAdditionalParameter(String parameter, String value) {
this.additionalParameters.put(parameter, value);
}
@Override
public void init(SynapseEnvironment se) {
try {
requestGenerator = getRequestGenerator(requestGeneratorClassName);
opaClient = new OPAClient(serverUrl, additionalParameters);
if (additionalParameters.get(OPAConstants.OPA_POLICY_FAILURE_HANDLER_PARAMETER) != null) {
opaPolicyFailuretHandler = additionalParameters.get(OPAConstants.OPA_POLICY_FAILURE_HANDLER_PARAMETER);
}
} catch (OPASecurityException e) {
throw new SynapseException("Error when initializing the OPA Mediator", e);
}
}
@Override
public void destroy() {
}
}