AthenzAuthorizationFilter extends JsonSecurityRequestFilterBase { @Override public Optional<ErrorResponse> filter(DiscFilterRequest request) { try { Optional<ResourceNameAndAction> resourceMapping = requestResourceMapper.getResourceNameAndAction(request.getMethod(), request.getRequestURI(), request.getQueryString()); log.log(Level.FINE, () -> String.format("Resource mapping for '%s': %s", request, resourceMapping)); if (resourceMapping.isEmpty()) { incrementAcceptedMetrics(request, false); return Optional.empty(); } Result result = checkAccessAllowed(request, resourceMapping.get()); AuthorizationResult.Type resultType = result.zpeResult.type(); setAttribute(request, RESULT_ATTRIBUTE, resultType.name()); if (resultType == AuthorizationResult.Type.ALLOW) { populateRequestWithResult(request, result); incrementAcceptedMetrics(request, true); return Optional.empty(); } log.log(Level.FINE, () -> String.format("Forbidden (403) for '%s': %s", request, resultType.name())); incrementRejectedMetrics(request, FORBIDDEN, resultType.name()); return Optional.of(new ErrorResponse(FORBIDDEN, "Access forbidden: " + resultType.getDescription())); } catch (IllegalArgumentException e) { log.log(Level.FINE, () -> String.format("Unauthorized (401) for '%s': %s", request, e.getMessage())); incrementRejectedMetrics(request, UNAUTHORIZED, "Unauthorized"); return Optional.of(new ErrorResponse(UNAUTHORIZED, e.getMessage())); } } @Inject  AthenzAuthorizationFilter(AthenzAuthorizationFilterConfig config, RequestResourceMapper resourceMapper, Metric metric);  AthenzAuthorizationFilter(AthenzAuthorizationFilterConfig config,
                                     RequestResourceMapper resourceMapper,
                                     Zpe zpe,
                                     Metric metric); @Override Optional<ErrorResponse> filter(DiscFilterRequest request); static final String RESULT_ATTRIBUTE; static final String MATCHED_ROLE_ATTRIBUTE; static final String IDENTITY_NAME_ATTRIBUTE; static final String MATCHED_CREDENTIAL_TYPE_ATTRIBUTE; }
@Test public void accepts_request_with_access_token() { AthenzAuthorizationFilter filter = createFilter(new AllowingZpe(), List.of()); MockResponseHandler responseHandler = new MockResponseHandler(); DiscFilterRequest request = createRequest(null, ACCESS_TOKEN, IDENTITY_CERTIFICATE); filter.filter(request, responseHandler); assertAuthorizationResult(request, Type.ALLOW); assertRequestNotFiltered(responseHandler); assertMatchedCredentialType(request, EnabledCredentials.ACCESS_TOKEN); assertMatchedRole(request, ROLE); }
@Test public void accepts_request_with_role_certificate() { AthenzAuthorizationFilter filter = createFilter(new AllowingZpe(), List.of()); MockResponseHandler responseHandler = new MockResponseHandler(); DiscFilterRequest request = createRequest(null, null, ROLE_CERTIFICATE); filter.filter(request, responseHandler); assertAuthorizationResult(request, Type.ALLOW); assertRequestNotFiltered(responseHandler); assertMatchedCredentialType(request, EnabledCredentials.ROLE_CERTIFICATE); assertMatchedRole(request, ROLE); }
@Test public void accepts_request_with_role_token() { AthenzAuthorizationFilter filter = createFilter(new AllowingZpe(), List.of()); MockResponseHandler responseHandler = new MockResponseHandler(); DiscFilterRequest request = createRequest(ROLE_TOKEN, null, null); filter.filter(request, responseHandler); assertAuthorizationResult(request, Type.ALLOW); assertRequestNotFiltered(responseHandler); assertMatchedCredentialType(request, EnabledCredentials.ROLE_TOKEN); assertMatchedRole(request, ROLE); }
@Test public void returns_unauthorized_for_request_with_disabled_credential_type() { AthenzAuthorizationFilter filter = createFilter(new AllowingZpe(), List.of(EnabledCredentials.ROLE_CERTIFICATE, EnabledCredentials.ACCESS_TOKEN)); MockResponseHandler responseHandler = new MockResponseHandler(); DiscFilterRequest request = createRequest(ROLE_TOKEN, null, null); filter.filter(request, responseHandler); assertStatusCode(responseHandler, 401); assertErrorMessage(responseHandler, "Not authorized - request did not contain any of the allowed credentials: " + "[Athenz X.509 role certificate, Athenz access token with X.509 identity certificate]"); }
@Test public void returns_forbidden_for_credentials_rejected_by_zpe() { AthenzAuthorizationFilter filter = createFilter(new DenyingZpe(), List.of()); MockResponseHandler responseHandler = new MockResponseHandler(); DiscFilterRequest request = createRequest(ROLE_TOKEN, null, null); filter.filter(request, responseHandler); assertStatusCode(responseHandler, 403); assertAuthorizationResult(request, Type.DENY); }
@Test public void reports_metrics_for_rejected_requests() { MetricMock metric = new MetricMock(); AthenzAuthorizationFilter filter = createFilter(new DenyingZpe(), List.of(), metric); MockResponseHandler responseHandler = new MockResponseHandler(); DiscFilterRequest request = createRequest(null, ACCESS_TOKEN, IDENTITY_CERTIFICATE); filter.filter(request, responseHandler); assertMetrics(metric, REJECTED_METRIC_NAME, Map.of("zpe-status", "DENY", "status-code", "403")); }
@Test public void reports_metrics_for_accepted_requests() { MetricMock metric = new MetricMock(); AthenzAuthorizationFilter filter = createFilter(new AllowingZpe(), List.of(EnabledCredentials.ACCESS_TOKEN), metric); MockResponseHandler responseHandler = new MockResponseHandler(); DiscFilterRequest request = createRequest(null, ACCESS_TOKEN, IDENTITY_CERTIFICATE); filter.filter(request, responseHandler); assertMetrics(metric, ACCEPTED_METRIC_NAME, Map.of("authz-required", "true")); }