InstanceZTSProvider implements InstanceProvider { @Override public InstanceConfirmation confirmInstance(InstanceConfirmation confirmation) { final String instanceDomain = confirmation.getDomain(); final String instanceService = confirmation.getService(); final Map<String, String> instanceAttributes = confirmation.getAttributes(); final String csrPublicKey = InstanceUtils.getInstanceProperty(instanceAttributes, InstanceProvider.ZTS_INSTANCE_CSR_PUBLIC_KEY); if (principals != null && !principals.contains(instanceDomain + "." + instanceService)) { throw forbiddenError("Service not supported to be launched by ZTS Provider"); } StringBuilder errMsg = new StringBuilder(256); if (!validateToken(confirmation.getAttestationData(), instanceDomain, instanceService, csrPublicKey, errMsg)) { LOGGER.error(errMsg.toString()); throw forbiddenError("Unable to validate Certificate Request Auth Token"); } String clientIp = InstanceUtils.getInstanceProperty(instanceAttributes, InstanceProvider.ZTS_INSTANCE_CLIENT_IP); String sanIpStr = InstanceUtils.getInstanceProperty(instanceAttributes, InstanceProvider.ZTS_INSTANCE_SAN_IP); String hostname = InstanceUtils.getInstanceProperty(instanceAttributes, InstanceProvider.ZTS_INSTANCE_HOSTNAME); String sanUri = InstanceUtils.getInstanceProperty(instanceAttributes, InstanceProvider.ZTS_INSTANCE_SAN_URI); String[] sanIps = null; if (sanIpStr != null && !sanIpStr.isEmpty()) { sanIps = sanIpStr.split(","); } if (!validateSanIp(sanIps, clientIp)) { throw forbiddenError("Unable to validate request IP address"); } if (!validateHostname(hostname, sanIps)) { throw forbiddenError("Unable to validate certificate request hostname"); } if (!validateSanUri(sanUri, hostname)) { throw forbiddenError("Unable to validate certificate request URI hostname"); } StringBuilder instanceId = new StringBuilder(256); if (!InstanceUtils.validateCertRequestSanDnsNames(instanceAttributes, instanceDomain, instanceService, dnsSuffix, instanceId)) { throw forbiddenError("Unable to validate certificate request DNS"); } Map<String, String> attributes = new HashMap<>(); attributes.put(InstanceProvider.ZTS_CERT_REFRESH, "false"); confirmation.setAttributes(attributes); return confirmation; }  @Override Scheme getProviderScheme(); @Override void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore); @Override void setHostnameResolver(HostnameResolver hostnameResolver); @Override InstanceConfirmation confirmInstance(InstanceConfirmation confirmation); @Override InstanceConfirmation refreshInstance(InstanceConfirmation confirmation); boolean validatePublicKeys(final String athenzPublicKey, final String csrPublicKey);  }
@Test public void testConfirmInstance() { KeyStore keystore = Mockito.mock(KeyStore.class); Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0); System.setProperty(InstanceZTSProvider.ZTS_PRINCIPAL_LIST, "sports.api"); InstanceZTSProvider provider = new InstanceZTSProvider(); provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, keystore); PrincipalToken tokenToSign = new PrincipalToken.Builder("1", "sports", "api") .keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000) .expirationWindow(3600).build(); tokenToSign.sign(servicePrivateKeyStringK0); InstanceConfirmation confirmation = new InstanceConfirmation(); confirmation.setAttestationData(tokenToSign.getSignedToken()); confirmation.setDomain("sports"); confirmation.setService("api"); confirmation.setProvider("sys.auth.zts"); Map<String, String> attributes = new HashMap<>(); attributes.put(InstanceProvider.ZTS_INSTANCE_SAN_DNS, "api.sports.zts.athenz.cloud,inst1.instanceid.athenz.zts.athenz.cloud"); attributes.put(InstanceProvider.ZTS_INSTANCE_CSR_PUBLIC_KEY, servicePublicKeyStringK0); confirmation.setAttributes(attributes); assertNotNull(provider.confirmInstance(confirmation)); provider.close(); System.clearProperty(InstanceZTSProvider.ZTS_PRINCIPAL_LIST); }