TicketSignatureService { public void signTicket(Ticket ticket) throws IllegalStateException { byte[] serialized = TicketUtil.serialize(ticket); byte[] claimBytes = TicketUtil.deserialize(ByteBuffer.wrap(serialized)).getRight(); RSAPrivateCrtKeyParameters signingKey = keyManager.getPrivateSigningKey(); if (signingKey == null) throw new IllegalStateException("Cannot sign ticket because there is no private signing key available."); RSADigestSigner signer = new RSADigestSigner(new SHA256Digest()); signer.init(true, signingKey); signer.update(claimBytes, 0, claimBytes.length); try { byte[] signature = signer.generateSignature(); ticket.setSignature(signature); } catch (DataLengthException | CryptoException e) { throw new IllegalStateException("Cannot sign ticket", e); } }  boolean isValidTicketSignature(Pair<Ticket, byte[]> deserializedTicket); void signTicket(Ticket ticket);  }
@Test public void simpleSignAndValidateEncryptedKey() { synchronized (TestTicketRsaKeyFileProvider.class) { TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PRIVATE_ENCRYPTED); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = true; startNewContext(); Ticket t = new Ticket(); t.setClaim(new TicketClaim()); t.getClaim().setTicketId(RUuidUtil.toRUuid(UUID.randomUUID())); t.getClaim().setUsername("abc"); t.getClaim().setValidUntil(123); t.getClaim().setIsSuperUser(false); ticketSignatureService.signTicket(t); boolean isValid = isValid(t); Assert.assertTrue(isValid, "Ticket should be valid."); } }
@Test public void simpleSignAndValidatePlainKey() { synchronized (TestTicketRsaKeyFileProvider.class) { TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PRIVATE_PLAIN); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = true; startNewContext(); Ticket t = new Ticket(); t.setClaim(new TicketClaim()); t.getClaim().setTicketId(RUuidUtil.toRUuid(UUID.randomUUID())); t.getClaim().setUsername("abc"); t.getClaim().setValidUntil(123); t.getClaim().setIsSuperUser(false); ticketSignatureService.signTicket(t); boolean isValid = isValid(t); Assert.assertTrue(isValid, "Ticket should be valid."); } }
@Test public void signAndValidatePublicPlainKey() { synchronized (TestTicketRsaKeyFileProvider.class) { TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PRIVATE_PLAIN); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = true; startNewContext(); Ticket t = new Ticket(); t.setClaim(new TicketClaim()); t.getClaim().setTicketId(RUuidUtil.toRUuid(UUID.randomUUID())); t.getClaim().setUsername("abc"); t.getClaim().setValidUntil(123); t.getClaim().setIsSuperUser(false); ticketSignatureService.signTicket(t); TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PUBLIC_PLAIN); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = false; startNewContext(); boolean isValid = isValid(t); Assert.assertTrue(isValid, "Ticket should be valid."); } }
@Test public void signAndValidatePublicEncryptedKey() { synchronized (TestTicketRsaKeyFileProvider.class) { TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PRIVATE_ENCRYPTED); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = true; startNewContext(); Ticket t = new Ticket(); t.setClaim(new TicketClaim()); t.getClaim().setTicketId(RUuidUtil.toRUuid(UUID.randomUUID())); t.getClaim().setUsername("abc"); t.getClaim().setValidUntil(123); t.getClaim().setIsSuperUser(false); ticketSignatureService.signTicket(t); TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PUBLIC_ENCRYPTED); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = false; startNewContext(); boolean isValid = isValid(t); Assert.assertTrue(isValid, "Ticket should be valid."); } }
@Test public void signAndValidateEncryptedKeyTampered() { synchronized (TestTicketRsaKeyFileProvider.class) { TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PRIVATE_ENCRYPTED); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = true; startNewContext(); Ticket t = new Ticket(); t.setClaim(new TicketClaim()); t.getClaim().setTicketId(RUuidUtil.toRUuid(UUID.randomUUID())); t.getClaim().setUsername("abc"); t.getClaim().setValidUntil(123); t.getClaim().setIsSuperUser(false); ticketSignatureService.signTicket(t); byte[] sig = t.getSignature(); sig[0] = (byte) (sig[0] + 1); t.setSignature(sig); boolean isValid = isValid(t); Assert.assertFalse(isValid, "Ticket should NOT be valid."); } }
@Test public void signAndValidateEncryptedKeyTampered2() { synchronized (TestTicketRsaKeyFileProvider.class) { TestTicketRsaKeyFileProvider.clean(); TestTicketRsaKeyFileProvider.files.add(PRIVATE_ENCRYPTED); TestTicketRsaKeyFileProvider.isFilesWithPrivateKeyAreRequired = true; startNewContext(); Ticket t = new Ticket(); t.setClaim(new TicketClaim()); t.getClaim().setTicketId(RUuidUtil.toRUuid(UUID.randomUUID())); t.getClaim().setUsername("abc"); t.getClaim().setValidUntil(123); t.getClaim().setIsSuperUser(false); ticketSignatureService.signTicket(t); t.getClaim().setUsername("xyz"); boolean isValid = isValid(t); Assert.assertFalse(isValid, "Ticket should NOT be valid."); } }