ZTSImpl implements KeyStore, ZTSHandler { long determineTokenTimeout(DataCache data, Set<String> roles, Integer minExpiryTime, Integer maxExpiryTime) { long tokenTimeout = roleTokenDefaultTimeout; if (maxExpiryTime != null && maxExpiryTime > 0) { tokenTimeout = maxExpiryTime; } else if (minExpiryTime != null && minExpiryTime > roleTokenDefaultTimeout) { tokenTimeout = minExpiryTime; } if (tokenTimeout > roleTokenMaxTimeout) { tokenTimeout = roleTokenMaxTimeout; } int maxAllowedExpirySecs = getConfiguredTokenExpiryTimeMins(data, roles) * 60; if (maxAllowedExpirySecs > 0 && maxAllowedExpirySecs < tokenTimeout) { tokenTimeout = maxAllowedExpirySecs; } return tokenTimeout; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testDetermineTokenTimeoutWithRoleExpiry() { DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.readers").setTokenExpiryMins(10); data.processRole(role1); DomainData domainData = new DomainData(); data.setDomainData(domainData); Set<String> roles = new HashSet<>(); roles.add("readers"); assertEquals(zts.determineTokenTimeout(data, roles, null, 1200), 600); }
@Test public void testDetermineTokenTimeoutWithDomainExpiry() { DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.readers"); data.processRole(role1); DomainData domainData = new DomainData().setTokenExpiryMins(5); data.setDomainData(domainData); Set<String> roles = new HashSet<>(); roles.add("readers"); assertEquals(zts.determineTokenTimeout(data, roles, null, 1200), 300); }
@Test public void testDetermineTokenTimeoutWithRoleExpiryBigger() { DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.readers").setTokenExpiryMins(30); data.processRole(role1); DomainData domainData = new DomainData(); data.setDomainData(domainData); Set<String> roles = new HashSet<>(); roles.add("readers"); assertEquals(zts.determineTokenTimeout(data, roles, null, 1200), 1200); assertEquals(zts.determineTokenTimeout(data, roles, null, null), 1800); }
@Test public void testDetermineTokenTimeoutWithDomainExpiryBigger() { DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.readers"); data.processRole(role1); DomainData domainData = new DomainData().setTokenExpiryMins(25); data.setDomainData(domainData); Set<String> roles = new HashSet<>(); roles.add("readers"); assertEquals(zts.determineTokenTimeout(data, roles, null, 1200), 1200); assertEquals(zts.determineTokenTimeout(data, roles, null, null), 1500); }
@Test public void testDetermineTokenTimeoutWithNoRoleMeta() { DataCache data = new DataCache(); DomainData domainData = new DomainData(); data.setDomainData(domainData); Set<String> roles = new HashSet<>(); roles.add("readers"); assertEquals(zts.determineTokenTimeout(data, roles, null, 1200), 1200); assertEquals(zts.determineTokenTimeout(data, roles, null, null), roleTokenDefaultTimeout); }
@Test public void testDetermineTokenTimeoutWithMultipleRoles() { DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.readers").setTokenExpiryMins(9); Role role2 = new Role().setName("athenz:role.writers").setTokenExpiryMins(10); data.processRole(role1); data.processRole(role2); DomainData domainData = new DomainData().setTokenExpiryMins(25); data.setDomainData(domainData); Set<String> roles = new HashSet<>(); roles.add("readers"); roles.add("writers"); assertEquals(zts.determineTokenTimeout(data, roles, null, 1200), 540); assertEquals(zts.determineTokenTimeout(data, roles, null, 500), 500); assertEquals(zts.determineTokenTimeout(data, roles, null, null), 540); }
@Test public void testDetermineTokenTimeoutBothNull() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), null, null), roleTokenDefaultTimeout); }
@Test public void testDetermineTokenTimeoutMinNull() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), null, 100), 100); }
@Test public void testDetermineTokenTimeoutMaxNull() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), 100, null), roleTokenDefaultTimeout); }
@Test public void testDetermineTokenTimeoutMinInvalid() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), -10, null), roleTokenDefaultTimeout); }
@Test public void testDetermineTokenTimeoutMaxInvalid() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), null, -10), roleTokenDefaultTimeout); }
@Test public void testDetermineTokenTimeoutDefaultBigger() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), 3200, null), 3200); }
@Test public void testDetermineTokeTimeoutDefaultSmaller() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), 1200, null), roleTokenDefaultTimeout); }
@Test public void testDetermineTokeTimeoutMaxValueMaxExceeded() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), null, 120000), roleTokenMaxTimeout); }
@Test public void testDetermineTokeTimeoutMinValueMaxExceeded() { DataCache dataCache = new DataCache(); dataCache.setDomainData(new DomainData()); assertEquals(zts.determineTokenTimeout(dataCache, Collections.emptySet(), 120000, null), roleTokenMaxTimeout); }