ZTSImpl implements KeyStore, ZTSHandler { @Override public RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames, Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal) { final String caller = ctx.getApiName(); final String principalDomain = logPrincipalAndGetDomain(ctx); validateRequest(ctx.request(), principalDomain, caller); validate(domainName, TYPE_DOMAIN_NAME, principalDomain, caller); if (roleNames != null && !roleNames.isEmpty()) { validate(roleNames, TYPE_ENTITY_LIST, principalDomain, caller); } if (proxyForPrincipal != null && !proxyForPrincipal.isEmpty()) { validate(proxyForPrincipal, TYPE_ENTITY_NAME, principalDomain, caller); } domainName = domainName.toLowerCase(); setRequestDomain(ctx, domainName); if (roleNames != null) { roleNames = roleNames.toLowerCase(); } if (proxyForPrincipal != null) { proxyForPrincipal = normalizeDomainAliasUser(proxyForPrincipal.toLowerCase()); } final Principal principal = ((RsrcCtxWrapper) ctx).principal(); String principalName = principal.getFullName(); if (LOGGER.isDebugEnabled()) { LOGGER.debug("getRoleToken(domain: {}, principal: {}, role-name: {}, proxy-for: {})", domainName, principalName, roleNames, proxyForPrincipal); } roleNames = convertEmptyStringToNull(roleNames); proxyForPrincipal = convertEmptyStringToNull(proxyForPrincipal); if (leastPrivilegePrincipal && roleNames == null) { throw requestError("getRoleToken: Client must specify a roleName to request a token for", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN, principalDomain); } if (proxyForPrincipal != null && !isAuthorizedProxyUser(authorizedProxyUsers, principalName)) { LOGGER.error("getRoleToken: Principal {} not authorized for proxy role token request", principalName); throw forbiddenError("getRoleToken: Principal: " + principalName + " not authorized for proxy role token request", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN, principalDomain); } DataCache data = dataStore.getDataCache(domainName); if (data == null) { setRequestDomain(ctx, ZTSConsts.ZTS_UNKNOWN_DOMAIN); throw notFoundError("getRoleToken: No such domain: " + domainName, caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN, principalDomain); } checkRoleTokenAuthorizedServiceRequest(principal, domainName, caller); String[] requestedRoleList = null; if (roleNames != null) { requestedRoleList = roleNames.split(","); } Set<String> roles = new HashSet<>(); dataStore.getAccessibleRoles(data, domainName, principalName, requestedRoleList, roles, false); if (roles.isEmpty()) { throw forbiddenError("getRoleToken: No access to any roles in domain: " + domainName, caller, domainName, principalDomain); } String proxyUser = null; if (proxyForPrincipal != null) { Set<String> rolesForProxy = new HashSet<>(); dataStore.getAccessibleRoles(data, domainName, proxyForPrincipal, requestedRoleList, rolesForProxy, false); roles.retainAll(rolesForProxy); if (roles.isEmpty()) { throw forbiddenError("getRoleToken: No access to any roles by User and Proxy Principals", caller, domainName, principalDomain); } proxyUser = principalName; principalName = proxyForPrincipal; } if (!isPrincipalRoleCertificateAccessValid(principal, domainName, roles)) { throw forbiddenError("getRoleToken: Role based Principal does not include all roles", caller, domainName, principalDomain); } long tokenTimeout = determineTokenTimeout(data, roles, minExpiryTime, maxExpiryTime); List<String> roleList = new ArrayList<>(roles); boolean domainCompleteRoleSet = (includeRoleCompleteFlag && roleNames == null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken.Builder(ZTS_ROLE_TOKEN_VERSION, domainName, roleList) .expirationWindow(tokenTimeout).host(serverHostName).keyId(privateKey.getId()) .principal(principalName).ip(ServletRequestUtil.getRemoteAddress(ctx.request())) .proxyUser(proxyUser).domainCompleteRoleSet(domainCompleteRoleSet).build(); token.sign(privateKey.getKey()); RoleToken roleToken = new RoleToken(); roleToken.setToken(token.getSignedToken()); roleToken.setExpiryTime(token.getExpiryTime()); return roleToken; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testGetRoleTokenAuthorizedService() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); signedDomain.domain.setApplicationId("application_id"); store.processDomain(signedDomain, false); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); principal.setApplicationId("coretech.api"); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech", null, 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); principal.setAuthorizedService("sports.hockey.api"); context = createResourceContext(principal); try { zts.getRoleToken(context, "coretech", null, 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); } }
@Test public void testGetRoleToken() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech", null, 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("writers")); assertTrue(roleToken.getToken().contains(";h=localhost;")); assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); assertTrue(roleToken.getToken().contains(";p=user_domain.user;")); assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); Principal principal1 = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user1;s=signature", 0, null); ResourceContext context1 = createResourceContext(principal1); roleToken = zts.getRoleToken(context1, "coretech", null, null, 1200, null); token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 2); assertTrue(token.getRoles().contains("readers")); assertTrue(token.getRoles().contains("writers")); Principal principal4 = SimplePrincipal.create("user_domain", "user4", "v=U1;d=user_domain;n=user4;s=signature", 0, null); ResourceContext context4 = createResourceContext(principal4); roleToken = zts.getRoleToken(context4, "coretech", null, 600, null, null); token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("readers")); assertTrue(roleToken.getToken().contains(";p=user_domain.user4;")); assertTrue(roleToken.getToken().contains(";c=1;")); zts.includeRoleCompleteFlag = false; roleToken = zts.getRoleToken(context4, "coretech", null, 600, null, null); token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("readers")); assertTrue(roleToken.getToken().contains(";p=user_domain.user4;")); assertFalse(roleToken.getToken().contains(";c=1;")); zts.includeRoleCompleteFlag = true; }
@Test public void testGetRoleTokenWithRoleAuthority() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, new CertificateAuthority()); ResourceContext context = createResourceContext(principal); List<String> principalRoles = new ArrayList<>(); principalRoles.add("coretech:role.readers"); principal.setRoles(principalRoles); try { zts.getRoleToken(context, "coretech", null, 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(403, ex.getCode()); } principalRoles.add("coretech:role.writers"); RoleToken roleToken = zts.getRoleToken(context, "coretech", null, 600, 1200, null); assertNotNull(roleToken); }
@Test public void testGetRoleTokenDisabledDomain() { SignedDomain signedDomain = createSignedDomainExpiration("coretech-disabled", "weather", Boolean.FALSE); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user1;s=signature", 0, null); ResourceContext context = createResourceContext(principal); try { zts.getRoleToken(context, "coretech-disabled", null, 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 404); } }
@Test public void testGetRoleTokenExpire() { SignedDomain signedDomain = createSignedDomainExpiration("coretech-expire", "weather"); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user1;s=signature", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech-expire", null, 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertTrue(token.getRoles().contains("role2")); assertFalse(token.getRoles().contains("role1")); }
@Test public void testGetRoleTokenEmptyArguments() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech", "", null, null, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("writers")); }
@Test public void testGetRoleTokenNoRoleMatch() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "invalidUser", "v=U1;d=user_domain;n=invalidUuser;s=signature", 0, null); ResourceContext context = createResourceContext(principal); try { zts.getRoleToken(context, "coretech", null, 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); } }
@Test public void testGetRoleTokenInvalidDomain() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal); try { zts.getRoleToken(context, "invalidDomain", null, 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 404); } }
@Test public void testGetRoleTokenSpecifiedRoleValid() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech", "writers", 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("writers")); Principal principal1 = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user1;s=signature", 0, null); ResourceContext context1 = createResourceContext(principal1); roleToken = zts.getRoleToken(context1, "coretech", "writers", null, 1200, null); token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("writers")); Principal principal4 = SimplePrincipal.create("user_domain", "user4", "v=U1;d=user_domain;n=user4;s=signature", 0, null); ResourceContext context4 = createResourceContext(principal4); roleToken = zts.getRoleToken(context4, "coretech", "readers", 600, null, null); token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("readers")); assertFalse(token.getRoles().contains(";c=1;")); }
@Test public void testGetRoleTokenSpecifiedRoleInValid() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal); try { zts.getRoleToken(context, "coretech", "coretech:role.readers", 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testGetRoleTokenLeastPrivilegedEnabled() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal); zts.leastPrivilegePrincipal = true; try { zts.getRoleToken(context, "coretech", null, 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); assertTrue(ex.getMessage().contains("must specify a roleName")); } }
@Test public void testGetRoleTokenSpecifiedRoleNoMatch() { SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal); try { zts.getRoleToken(context, "coretech", "updaters", 600, 1200, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); } }
@Test public void testGetRoleTokenTrustDomainWildCard() { SignedDomain signedDomain = createSignedDomainWildCard("weather", "netops"); store.processDomain(signedDomain, false); signedDomain = createTenantSignedDomainWildCard("netops"); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "siteops_user_1", "v=U1;d=user_domain;n=siteops_user_1;s=signature", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "weather", null, null, null, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("netops_superusers")); }
@Test public void testGetRoleTokenTrustDomainWildCardGivenRole() { SignedDomain signedDomain = createSignedDomainWildCard("weather", "netops"); store.processDomain(signedDomain, false); signedDomain = createTenantSignedDomainWildCard("netops"); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "siteops_user_1", "v=U1;d=user_domain;n=siteops_user_1;s=signature", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "weather", "netops_superusers", null, null, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("netops_superusers")); }
@Test public void testGetRoleTokenUnauthorizedProxy() { SignedDomain signedDomain = createSignedDomain("coretech-proxy1", "weather-proxy1", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=sig", 0, null); ResourceContext context = createResourceContext(principal); try { zts.getRoleToken(context, "coretech-proxy1", null, 600, 1200, "user_domain.unknown-proxy-user"); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); assertTrue(ex.getMessage().contains("not authorized for proxy role token request")); } }
@Test public void testGetRoleTokenProxyUser() { List<RoleMember> writers = new ArrayList<>(); writers.add(new RoleMember().setMemberName("user_domain.proxy-user1")); writers.add(new RoleMember().setMemberName("user_domain.joe")); List<RoleMember> readers = new ArrayList<>(); readers.add(new RoleMember().setMemberName("user_domain.proxy-user2")); readers.add(new RoleMember().setMemberName("user_domain.jane")); SignedDomain signedDomain = createSignedDomain("coretech-proxy2", "weather-proxy2", "storage", writers, readers, true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech-proxy2", null, 600, 1200, "user_domain.joe"); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("writers")); assertTrue(roleToken.getToken().contains(";h=localhost;")); assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); assertTrue(roleToken.getToken().contains(";p=user_domain.joe;")); assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user1;")); assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); principal = SimplePrincipal.create("user_domain", "proxy-user2", "v=U1;d=user_domain;n=proxy-user2;s=sig", 0, null); context = createResourceContext(principal); roleToken = zts.getRoleToken(context, "coretech-proxy2", null, 600, 1200, "user_domain.jane"); token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("readers")); assertTrue(roleToken.getToken().contains(";h=localhost;")); assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); assertTrue(roleToken.getToken().contains(";p=user_domain.jane;")); assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user2;")); assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); }
@Test public void testGetRoleTokenProxyUserMismatchRolesIntersection() { List<RoleMember> writers = new ArrayList<>(); writers.add(new RoleMember().setMemberName("user_domain.proxy-user1")); writers.add(new RoleMember().setMemberName("user_domain.joe")); List<RoleMember> readers = new ArrayList<>(); readers.add(new RoleMember().setMemberName("user_domain.proxy-user2")); readers.add(new RoleMember().setMemberName("user_domain.jane")); readers.add(new RoleMember().setMemberName("user_domain.proxy-user1")); SignedDomain signedDomain = createSignedDomain("coretech-proxy3", "weather-proxy3", "storage", writers, readers, true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech-proxy3", null, 600, 1200, "user_domain.joe"); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("writers")); }
@Test public void testGetRoleTokenProxyUserMismatchRolesEmptySet() { List<RoleMember> writers = new ArrayList<>(); writers.add(new RoleMember().setMemberName("user_domain.joe")); List<RoleMember> readers = new ArrayList<>(); readers.add(new RoleMember().setMemberName("user_domain.proxy-user2")); readers.add(new RoleMember().setMemberName("user_domain.jane")); readers.add(new RoleMember().setMemberName("user_domain.proxy-user1")); SignedDomain signedDomain = createSignedDomain("coretech-proxy4", "weather-proxy4", "storage", writers, readers, true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null); ResourceContext context = createResourceContext(principal); try { zts.getRoleToken(context, "coretech-proxy4", null, 600, 1200, "user_domain.joe"); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); } }
@Test public void testGetRoleTokenProxyUserSpecificRole() { List<RoleMember> writers = new ArrayList<>(); writers.add(new RoleMember().setMemberName("user_domain.proxy-user1")); writers.add(new RoleMember().setMemberName("user_domain.joe")); List<RoleMember> readers = new ArrayList<>(); readers.add(new RoleMember().setMemberName("user_domain.proxy-user2")); readers.add(new RoleMember().setMemberName("user_domain.jane")); readers.add(new RoleMember().setMemberName("user_domain.proxy-user1")); SignedDomain signedDomain = createSignedDomain("coretech-proxy4", "weather-proxy4", "storage", writers, readers, true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null); ResourceContext context = createResourceContext(principal); RoleToken roleToken = zts.getRoleToken(context, "coretech-proxy4", "writers", 600, 1200, "user_domain.joe"); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertEquals(token.getRoles().size(), 1); assertTrue(token.getRoles().contains("writers")); assertTrue(roleToken.getToken().contains(";h=localhost;")); assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); assertTrue(roleToken.getToken().contains(";p=user_domain.joe;")); assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user1;")); assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); }
@Test public void testRoleTokenAddrNoLoopback() { HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("10.10.10.11"); Mockito.when(servletRequest.isSecure()).thenReturn(true); ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); ZTSImpl.serverHostName = "localhost"; SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal, servletRequest); RoleToken roleToken = ztsImpl.getRoleToken(context, "coretech", null, 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertNotNull(token); }
@Test public void testGetRoleTokenAddrLoopbackNoXFF() { HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); Mockito.when(servletRequest.isSecure()).thenReturn(true); ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); ZTSImpl.serverHostName = "localhost"; SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal, servletRequest); RoleToken roleToken = ztsImpl.getRoleToken(context, "coretech", null, 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertNotNull(token); assertNotNull(token.getUnsignedToken()); }
@Test public void testGetRoleTokenAddrLoopbackXFFSingeValue() { HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); Mockito.when(servletRequest.getHeader("X-Forwarded-For")).thenReturn("10.10.10.12"); Mockito.when(servletRequest.isSecure()).thenReturn(true); ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); ZTSImpl.serverHostName = "localhost"; SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal, servletRequest); RoleToken roleToken = ztsImpl.getRoleToken(context, "coretech", null, 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertNotNull(token); }
@Test public void testGetRoleTokenAddrLoopbackXFFMultipleValues() { HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); Mockito.when(servletRequest.getHeader("X-Forwarded-For")).thenReturn("10.10.10.11, 10.11.11.11, 10.12.12.12"); Mockito.when(servletRequest.isSecure()).thenReturn(true); ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); ZTSImpl.serverHostName = "localhost"; SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); store.processDomain(signedDomain, false); Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null); ResourceContext context = createResourceContext(principal, servletRequest); RoleToken roleToken = ztsImpl.getRoleToken(context, "coretech", null, 600, 1200, null); com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); assertNotNull(token); }