PrincipalAuthority implements Authority, AuthorityKeyStore { @Override public Principal authenticate(String signedToken, String remoteAddr, String httpMethod, StringBuilder errMsg) { errMsg = errMsg == null ? new StringBuilder(512) : errMsg; if (LOG.isDebugEnabled()) { LOG.debug("Authenticating PrincipalToken: " + signedToken); } PrincipalToken serviceToken; try { serviceToken = new PrincipalToken(signedToken); } catch (IllegalArgumentException ex) { errMsg.append("PrincipalAuthority:authenticate: Invalid token: exc="). append(ex.getMessage()).append(" : credential="). append(Token.getUnsignedToken(signedToken)); LOG.error(errMsg.toString()); return null; } StringBuilder errDetail = new StringBuilder(512); if (!serviceToken.isValidAuthorizedServiceToken(errDetail)) { errMsg.append("PrincipalAuthority:authenticate: Invalid authorized service token: "); errMsg.append(errDetail).append(" : credential="). append(Token.getUnsignedToken(signedToken)); return null; } String tokenDomain = serviceToken.getDomain().toLowerCase(); String tokenName = serviceToken.getName().toLowerCase(); String keyService = serviceToken.getKeyService(); boolean userToken = tokenDomain.equals(userDomain); String publicKey = getPublicKey(tokenDomain, tokenName, keyService, serviceToken.getKeyId(), userToken); boolean writeOp = isWriteOperation(httpMethod); if (!serviceToken.validate(publicKey, allowedOffset, !writeOp, errDetail)) { errMsg.append("PrincipalAuthority:authenticate: service token validation failure: "); errMsg.append(errDetail).append(" : credential="). append(Token.getUnsignedToken(signedToken)); return null; } String authorizedServiceName = null; if (serviceToken.getAuthorizedServiceSignature() != null) { authorizedServiceName = validateAuthorizeService(serviceToken, errDetail); if (authorizedServiceName == null) { errMsg.append("PrincipalAuthority:authenticate: validation of authorized service failure: "). append(errDetail).append(" : credential="). append(Token.getUnsignedToken(signedToken)); return null; } } if (userToken && !remoteIpCheck(remoteAddr, writeOp, serviceToken, authorizedServiceName)) { errMsg.append("PrincipalAuthority:authenticate: IP Mismatch - token ("). append(serviceToken.getIP()).append(") request ("). append(remoteAddr).append(")"); LOG.error(errMsg.toString()); return null; } SimplePrincipal princ = (SimplePrincipal) SimplePrincipal.create(tokenDomain, tokenName, signedToken, serviceToken.getTimestamp(), this); princ.setUnsignedCreds(serviceToken.getUnsignedToken()); princ.setAuthorizedService(authorizedServiceName); princ.setOriginalRequestor(serviceToken.getOriginalRequestor()); princ.setKeyService(keyService); princ.setIP(serviceToken.getIP()); princ.setKeyId(serviceToken.getKeyId()); return princ; } PrincipalAuthority(); @Override String getID(); @Override void initialize(); @Override String getDomain(); @Override String getHeader(); @Override String getAuthenticateChallenge(); @Override Principal authenticate(String signedToken, String remoteAddr, String httpMethod,
            StringBuilder errMsg); @Override void setKeyStore(KeyStore keyStore); static final String HTTP_HEADER; static final String ATHENZ_AUTH_CHALLENGE; static final String ATHENZ_PROP_PRINCIPAL_HEADER; }
@Test public void testAuthenticateIllegal() { PrincipalAuthority serviceAuthority = new PrincipalAuthority(); Principal principal = serviceAuthority.authenticate("aaaa", null, "GET", null); assertNull(principal); }