AccessToken extends OAuth2Token { boolean confirmX509CertPrincipal(X509Certificate cert, final String cn) { if (ACCESS_TOKEN_CERT_OFFSET == 0) { LOG.error("confirmX509CertPrincipal: check disabled"); return false; } if (!cn.equals(clientId)) { LOG.error("confirmX509CertPrincipal: Principal mismatch {} vs {}", cn, clientId); return false; } if (ACCESS_TOKEN_CERT_OFFSET == -1) { return true; } long certIssueTime = Crypto.extractX509CertIssueTime(cert); if (certIssueTime < issueTime - 3600) { LOG.error("confirmX509CertPrincipal: Certificate: {} issued before token: {}", certIssueTime, issueTime); return false; } if (certIssueTime > issueTime + ACCESS_TOKEN_CERT_OFFSET - 3600) { LOG.error("confirmX509CertPrincipal: Certificate: {} past configured offset {} for token: {}", certIssueTime, ACCESS_TOKEN_CERT_OFFSET, issueTime); return false; } return true; } AccessToken();  AccessToken(final String token, JwtsSigningKeyResolver keyResolver);  AccessToken(final String token, PublicKey publicKey);  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert);  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert, final String x509CertHash); static void setAccessTokenCertOffset(long offset); static void setAccessTokenProxyPrincipals(Set<String> proxyPrincipals); String getClientId(); void setClientId(String clientId); String getProxyPrincipal(); void setProxyPrincipal(String proxyPrincipal); String getUserId(); void setUserId(String userId); List<String> getScope(); void setScope(List<String> scope); LinkedHashMap<String, Object> getConfirm(); void setConfirm(LinkedHashMap<String, Object> confirm); void setConfirmEntry(final String key, final Object value); void setConfirmX509CertHash(X509Certificate cert); boolean confirmMTLSBoundToken(X509Certificate x509Cert, final String x509CertHash); Object getConfirmEntry(final String key); String getSignedToken(final PrivateKey key, final String keyId,
            final SignatureAlgorithm keyAlg); static final String HDR_TOKEN_TYPE; static final String HDR_TOKEN_JWT; static final String CLAIM_SCOPE; static final String CLAIM_UID; static final String CLAIM_CLIENT_ID; static final String CLAIM_CONFIRM; static final String CLAIM_PROXY; static final String CLAIM_CONFIRM_X509_HASH; }
@Test public void testConfirmX509CertPrincipalNullCert() { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); assertFalse(accessToken.confirmX509CertPrincipal(null, "athenz.proxy")); }
@Test public void testConfirmX509CertPrincipalCertNoCN() throws IOException { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); Path path = Paths.get("src/test/resources/no_cn_x509.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); assertFalse(accessToken.confirmX509CertPrincipal(cert, "athenz.proxy")); }
@Test public void testConfirmX509CertPrincipalCertCNMismatch() throws IOException { long now = System.currentTimeMillis() / 1000; AccessToken accessToken = createAccessToken(now); Path path = Paths.get("src/test/resources/rsa_public_x509.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); assertFalse(accessToken.confirmX509CertPrincipal(cert, "athenz.proxy")); }
@Test public void testConfirmX509CertPrincipalCertStartTime() throws IOException { AccessToken accessToken = createAccessToken(1565245568 + 3600 + 100); Path path = Paths.get("src/test/resources/mtls_token2_spec.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); assertFalse(accessToken.confirmX509CertPrincipal(cert, "mtls")); }
@Test public void testConfirmX509CertPrincipalCertStartTimePassOffset() throws IOException { AccessToken accessToken = createAccessToken(1565245568 + 3600 - 3600 - 100); Path path = Paths.get("src/test/resources/mtls_token2_spec.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); assertFalse(accessToken.confirmX509CertPrincipal(cert, "mtls")); }
@Test public void testConfirmX509CertPrincipal() throws IOException { AccessToken accessToken = createAccessToken(1565245568 + 3600 - 100); Path path = Paths.get("src/test/resources/mtls_token2_spec.cert"); String certStr = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(certStr); assertTrue(accessToken.confirmX509CertPrincipal(cert, "mtls")); }