AthenzPrincipalFilter extends JsonSecurityRequestFilterBase { @Override public Optional<ErrorResponse> filter(DiscFilterRequest request) { try { Optional<AthenzPrincipal> certificatePrincipal = getClientCertificate(request) .map(AthenzIdentities::from) .map(AthenzPrincipal::new); if (certificatePrincipal.isEmpty()) { String errorMessage = "Unable to authenticate Athenz identity. " + "Either client certificate or principal token is required."; return createResponse(request, Response.Status.UNAUTHORIZED, errorMessage); } AthenzPrincipal principal = certificatePrincipal.get(); request.setUserPrincipal(principal); request.setRemoteUser(principal.getName()); request.setAttribute(RESULT_PRINCIPAL, principal); return Optional.empty(); } catch (Exception e) { return createResponse(request, Response.Status.UNAUTHORIZED, e.getMessage()); } } @Inject  AthenzPrincipalFilter(AthenzPrincipalFilterConfig athenzPrincipalFilterConfig);   AthenzPrincipalFilter(boolean passthroughMode); @Override Optional<ErrorResponse> filter(DiscFilterRequest request); static final String RESULT_ERROR_CODE_ATTRIBUTE; static final String RESULT_ERROR_MESSAGE_ATTRIBUTE; static final String RESULT_PRINCIPAL; }
@Test public void missing_certificate_is_unauthorized() { DiscFilterRequest request = createRequestMock(); when(request.getClientCertificateChain()).thenReturn(emptyList()); ResponseHandlerMock responseHandler = new ResponseHandlerMock(); AthenzPrincipalFilter filter = createFilter(false); filter.filter(request, responseHandler); assertUnauthorized(request, responseHandler, "Unable to authenticate Athenz identity"); }
@Test public void certificate_is_accepted() { DiscFilterRequest request = createRequestMock(); when(request.getClientCertificateChain()).thenReturn(singletonList(CERTIFICATE)); ResponseHandlerMock responseHandler = new ResponseHandlerMock(); AthenzPrincipalFilter filter = createFilter(false); filter.filter(request, responseHandler); AthenzPrincipal expectedPrincipal = new AthenzPrincipal(IDENTITY); assertAuthenticated(request, expectedPrincipal); }
@Test public void no_response_produced_when_passthrough_mode_is_enabled() { DiscFilterRequest request = createRequestMock(); when(request.getClientCertificateChain()).thenReturn(emptyList()); ResponseHandlerMock responseHandler = new ResponseHandlerMock(); AthenzPrincipalFilter filter = createFilter(true); filter.filter(request, responseHandler); assertThat(responseHandler.response, nullValue()); }