X509RoleCertRequest extends X509CertRequest { public boolean validate(Set<String> roles, final String domainName, final String principal, final String proxyUser, Set<String> validCertSubjectOrgValues) { final String roleName = validateAndExtractRoleName(roles, domainName); if (roleName == null) { LOGGER.error("validateRoleCertificateRequest: unable to validate role name"); return false; } if (!validateEmail(principal)) { return false; } if (proxyUser != null && !validateProxyUserUri(proxyUser)) { return false; } if (!validateSubjectOField(validCertSubjectOrgValues)) { return false; } return validateSpiffeURI(domainName, "ra", roleName); } X509RoleCertRequest(String csr); Map<String, String[]> getRequestedRoleList(); boolean validate(Set<String> roles, final String domainName, final String principal,
            final String proxyUser, Set<String> validCertSubjectOrgValues); boolean validate(final String principal, final String proxyUser,
            Set<String> validCertSubjectOrgValues); boolean validateIPAddress(X509Certificate cert, final String ip);  }
@Test public void testValidateSpiffeRoleCert() throws IOException { Path path = Paths.get("src/test/resources/spiffe_role.csr"); String csr = new String(Files.readAllBytes(path)); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); Set<String> roles = new HashSet<>(); roles.add("api"); Set<String> orgValues = new HashSet<>(); orgValues.add("Athenz"); assertTrue(certReq.validate(roles, "coretech", "sports.api", null, orgValues)); }
@Test public void testRoleCertValidate() throws IOException { Path path = Paths.get("src/test/resources/athenz_role_uri.csr"); String csr = new String(Files.readAllBytes(path)); Set<String> orgValues = new HashSet<>(); orgValues.add("Athenz"); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); assertTrue(certReq.validate("athenz.production", "proxy.service", orgValues)); assertTrue(certReq.validate("athenz.production", "proxy.service", null)); assertFalse(certReq.validate("athenz.api", "proxy.service", orgValues)); assertFalse(certReq.validate("athenz.production", "proxy.api", orgValues)); Set<String> orgValues2 = new HashSet<>(); orgValues2.add("sports"); assertFalse(certReq.validate("athenz.production", "proxy.service", orgValues2)); }
@Test public void testValidateMissingProxyUserUri() throws IOException { Path path = Paths.get("src/test/resources/spiffe_role.csr"); String csr = new String(Files.readAllBytes(path)); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); Set<String> roles = new HashSet<>(); roles.add("api"); Set<String> orgValues = new HashSet<>(); orgValues.add("Athenz"); assertFalse(certReq.validate(roles, "coretech", "sports.api", "proxy.user", orgValues)); }
@Test public void testValidateNoProxyUserUri() throws IOException { Path path = Paths.get("src/test/resources/role_single_ip.csr"); String csr = new String(Files.readAllBytes(path)); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); Set<String> roles = new HashSet<>(); roles.add("writers"); Set<String> orgValues = new HashSet<>(); orgValues.add("Athenz"); assertFalse(certReq.validate(roles, "athenz", "athenz.production", "proxy.user", orgValues)); }
@Test public void testValidateMultipleProxyUserUri() throws IOException { Path path = Paths.get("src/test/resources/multiple_proxy_role.csr"); String csr = new String(Files.readAllBytes(path)); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); Set<String> roles = new HashSet<>(); roles.add("api"); Set<String> orgValues = new HashSet<>(); orgValues.add("Athenz"); assertFalse(certReq.validate(roles, "coretech", "sports.api", "proxy.user", orgValues)); }