X509CertRequest { boolean validateSpiffeURI(final String domain, final String name, final String value) { if (spiffeUri == null) { return true; } URI uri; try { uri = new URI(spiffeUri); } catch (URISyntaxException ex) { LOGGER.error("validateSpiffeURI: Unable to parse {}: {}", spiffeUri, ex.getMessage()); return false; } final String uriPath = uri.getPath(); final String uriHost = uri.getHost(); if (uriPath == null || uriPath.isEmpty() || uriHost == null || uriHost.isEmpty()) { LOGGER.error("validateSpiffeURI: invalid uri {}", spiffeUri); return false; } boolean uriVerified = false; if (uriPath.startsWith("/ns/")) { final String path = "/ns/" + domain + "/" + name + "/" + value; uriVerified = uriPath.equalsIgnoreCase(path); } else { final String path = "/" + name + "/" + value; uriVerified = uriHost.equalsIgnoreCase(domain) && uriPath.equalsIgnoreCase(path); } if (!uriVerified) { LOGGER.error("validateSpiffeURI: invalid uri path/host: {}", spiffeUri); } return uriVerified; } X509CertRequest(String csr); PKCS10CertificationRequest getCertReq(); void setCertReq(PKCS10CertificationRequest certReq); boolean validateDnsNames(final String domainName, final String serviceName, final String provider,
            final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname,
            final List<String> instanceHostCnames, HostnameResolver hostnameResolver); boolean validateDnsNames(X509Certificate cert); boolean validateInstanceId(final String reqInstanceId, X509Certificate cert); boolean validateCommonName(String reqCommonName); boolean validateSubjectOField(Set<String> validValues); boolean validateSubjectOUField(final String provider, final String certSubjectOU,
            Set<String> validValues); boolean validatePublicKeys(final String publicKey); boolean validatePublicKeys(X509Certificate cert); boolean validateIPAddress(final String ip); void setNormCsrPublicKey(String normCsrPublicKey); String getCommonName(); String getInstanceId(); String getUriHostname(); List<String> getDnsNames(); List<String> getProviderDnsNames(); List<String> getUris(); List<String> getIpAddresses();  }
@Test public void testValidateSpiffeURINoValues() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertTrue(certReq.validateSpiffeURI("domain", "sa", "api")); }
@Test public void testValidateSpiffeURI() throws IOException { Path path = Paths.get("src/test/resources/spiffe_role.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertTrue(certReq.validateSpiffeURI("coretech", "ra", "api")); assertFalse(certReq.validateSpiffeURI("coretech", "ra", "backend")); assertFalse(certReq.validateSpiffeURI("coretech", "sa", "api")); }