RoleAuthority implements Authority, AuthorityKeyStore { public RoleAuthority() { allowedOffset = Integer.parseInt(System.getProperty(ATHENZ_PROP_TOKEN_OFFSET, "300")); userDomain = System.getProperty(ATHENZ_PROP_USER_DOMAIN, USER_DOMAIN); headerName = System.getProperty(ATHENZ_PROP_ROLE_HEADER, HTTP_HEADER); if (allowedOffset < 0) { allowedOffset = 300; } } RoleAuthority(); @Override String getID(); @Override void initialize(); @Override String getDomain(); @Override String getHeader(); @Override String getAuthenticateChallenge(); @Override Principal authenticate(String signedToken, String remoteAddr, String httpMethod, StringBuilder errMsg); @Override void setKeyStore(KeyStore keyStore); final static String SYS_AUTH_DOMAIN; final static String ZTS_SERVICE_NAME; static final String HTTP_HEADER; static final String ATHENZ_AUTH_CHALLENGE; static final String ATHENZ_PROP_ROLE_HEADER; }
@Test public void testRoleAuthority() throws IOException, CryptoException { RoleAuthority rollAuthority = new RoleAuthority(); KeyStore keyStore = new KeyStoreMock(); rollAuthority.setKeyStore(keyStore); assertEquals(rollAuthority.getDomain(), "sys.auth"); assertEquals(rollAuthority.getHeader(), "Athenz-Role-Auth"); List<String> roles = new ArrayList<>(); roles.add("storage.tenant.weather.updater"); roles.add("fantasy.tenant.sports.admin"); roles.add("fantasy.tenant.sports.reader"); roles.add("fantasy.tenant.sports.writer"); roles.add("fantasy.tenant.sports.scanner"); RoleToken rollToken = new RoleToken.Builder(rolVersion, svcDomain, roles) .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) .principal("coretech.storage").build(); rollToken.sign(ztsPrivateKeyStringK0); StringBuilder errMsg = new StringBuilder(); Principal principal = rollAuthority.authenticate(rollToken.getSignedToken(), "127.0.0.1", "GET", errMsg); assertNotNull(principal); assertNotNull(principal.getAuthority()); assertEquals(principal.getCredentials(), rollToken.getSignedToken()); assertEquals(principal.getDomain(), rollToken.getDomain()); principal = rollAuthority.authenticate(rollToken.getSignedToken(), "127.0.0.1", "GET", null); assertNotNull(principal); List<String> rolesToValidate = principal.getRoles(); assertEquals(rolesToValidate.size(), roles.size()); assertEquals(rolesToValidate, roles); rollToken = new RoleToken.Builder(rolVersion, svcDomain, roles) .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) .principal("coretech.storage").keyId(testKeyVersionK0).build(); rollToken.sign(ztsPrivateKeyStringK0); principal = rollAuthority.authenticate(rollToken.getSignedToken(), "127.0.0.1", "GET", errMsg); assertNotNull(principal); assertEquals(principal.getCredentials(), rollToken.getSignedToken()); rollToken = new RoleToken.Builder(rolVersion, svcDomain, roles) .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) .principal("coretech.storage").keyId(testKeyVersionK1).build(); rollToken.sign(ztsPrivateKeyStringK1); principal = rollAuthority.authenticate(rollToken.getSignedToken(), "127.0.0.1", "GET", errMsg); assertNotNull(principal); assertEquals(principal.getCredentials(), rollToken.getSignedToken()); }