X509CertRequest { public boolean validateSubjectOUField(final String provider, final String certSubjectOU, Set<String> validValues) { try { final String value = Crypto.extractX509CSRSubjectOUField(certReq); if (value == null) { return true; } if (value.equalsIgnoreCase(certSubjectOU)) { return true; } else if (value.equalsIgnoreCase(provider)) { return true; } else if (validValues != null && !validValues.isEmpty() && validValues.contains(value)) { return true; } else { LOGGER.error("Failed to validate Subject OU Field {}", value); } return false; } catch (CryptoException ex) { LOGGER.error("Unable to extract Subject OU Field: {}", ex.getMessage()); return false; } } X509CertRequest(String csr); PKCS10CertificationRequest getCertReq(); void setCertReq(PKCS10CertificationRequest certReq); boolean validateDnsNames(final String domainName, final String serviceName, final String provider,
            final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname,
            final List<String> instanceHostCnames, HostnameResolver hostnameResolver); boolean validateDnsNames(X509Certificate cert); boolean validateInstanceId(final String reqInstanceId, X509Certificate cert); boolean validateCommonName(String reqCommonName); boolean validateSubjectOField(Set<String> validValues); boolean validateSubjectOUField(final String provider, final String certSubjectOU,
            Set<String> validValues); boolean validatePublicKeys(final String publicKey); boolean validatePublicKeys(X509Certificate cert); boolean validateIPAddress(final String ip); void setNormCsrPublicKey(String normCsrPublicKey); String getCommonName(); String getInstanceId(); String getUriHostname(); List<String> getDnsNames(); List<String> getProviderDnsNames(); List<String> getUris(); List<String> getIpAddresses();  }
@Test public void testValidateOUFieldCheck() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); HashSet<String> validOrgUnits = new HashSet<>(); assertFalse(certReq.validateSubjectOUField(null, null, null)); assertFalse(certReq.validateSubjectOUField("Testing Domains", null, null)); assertFalse(certReq.validateSubjectOUField(null, "Testing Domains", null)); assertFalse(certReq.validateSubjectOUField("Bad1", "Bad2", null)); assertFalse(certReq.validateSubjectOUField(null, null, validOrgUnits)); assertFalse(certReq.validateSubjectOUField("Testing Domains", "None Test", validOrgUnits)); validOrgUnits.add("Testing Domains"); assertFalse(certReq.validateSubjectOUField("Testing Domains", "None Test", validOrgUnits)); assertTrue(certReq.validateSubjectOUField("Testing Domain", null, null)); assertTrue(certReq.validateSubjectOUField("Testing Domain", "Bad2", validOrgUnits)); assertTrue(certReq.validateSubjectOUField(null, "Testing Domain", null)); assertTrue(certReq.validateSubjectOUField("Bad1", "Testing Domain", validOrgUnits)); validOrgUnits.add("Testing Domain"); assertTrue(certReq.validateSubjectOUField(null, null, validOrgUnits)); assertTrue(certReq.validateSubjectOUField("Bad1", "Bad2", validOrgUnits)); }
@Test public void testValidateOUFieldCheckMissingOU() throws IOException { Path path = Paths.get("src/test/resources/athenz.single_ip.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); HashSet<String> validOrgUnits = new HashSet<>(); validOrgUnits.add("Athenz"); assertTrue(certReq.validateSubjectOUField(null, null, null)); assertTrue(certReq.validateSubjectOUField("Testing Domains", null, null)); assertTrue(certReq.validateSubjectOUField(null, "Testing Domains", null)); assertTrue(certReq.validateSubjectOUField("Bad1", "Bad2", null)); assertTrue(certReq.validateSubjectOUField(null, null, validOrgUnits)); assertTrue(certReq.validateSubjectOUField("Testing Domains", "None Test", validOrgUnits)); }
@Test public void testValidateOUFieldCheckInvalidOU() throws IOException { Path path = Paths.get("src/test/resources/athenz.multiple_ou.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); assertFalse(certReq.validateSubjectOUField("Athenz", null, null)); assertFalse(certReq.validateSubjectOUField("Yahoo", null, null)); }