PrincipalToken extends Token { public boolean validateForAuthorizedService(String pubKey, StringBuilder errMsg) { errMsg = errMsg == null ? new StringBuilder(512) : errMsg; if (authorizedServiceSignature == null) { errMsg.append("PrincipalToken:validateForAuthorizedService: token="). append(unsignedToken). append(" : missing data/signature component: public key="). append(pubKey); LOG.error(errMsg.toString()); return false; } int idx = signedToken.indexOf(";bs="); if (idx == -1) { errMsg.append("PrincipalToken:validateForAuthorizedService: token="). append(unsignedToken).append(" : not signed by any authorized service"); LOG.error(errMsg.toString()); return false; } String unsignedAuthorizedServiceToken = signedToken.substring(0, idx); if (pubKey == null) { errMsg.append("PrincipalToken:validateForAuthorizedService: token="). append(unsignedToken).append(" : No public key provided"); LOG.error(errMsg.toString()); return false; } PublicKey pub; boolean verified = false; try { pub = Crypto.loadPublicKey(pubKey); verified = Crypto.verify(unsignedAuthorizedServiceToken, pub, authorizedServiceSignature); if (!verified) { errMsg.append("PrincipalToken:validateForAuthorizedService: token="). append(unsignedToken).append(" : authentication failed: public key="). append(pubKey); LOG.error(errMsg.toString()); } else if (LOG.isDebugEnabled()) { LOG.debug("validateForAuthorizedService: Token: " + unsignedToken + " - successfully authenticated"); } } catch (Exception e) { errMsg.append("PrincipalToken:validateForAuthorizedService: token="). append(unsignedToken). append(" : authentication failed verifying signature: exc="). append(e.getMessage()).append(" : public key=").append(pubKey); LOG.error(errMsg.toString()); } return verified; } private  PrincipalToken(Builder builder);  PrincipalToken(String signedToken); void signForAuthorizedService(String authorizedServiceName, String authorizedServiceKeyId,
            String privKey); void signForAuthorizedService(String authorizedServiceName, String authorizedServiceKeyId,
            PrivateKey key); boolean validateForAuthorizedService(String pubKey, StringBuilder errMsg); boolean isValidAuthorizedServiceToken(StringBuilder errMsg); String getName(); String getKeyService(); String getOriginalRequestor(); List<String> getAuthorizedServices(); String getAuthorizedServiceName(); String getAuthorizedServiceKeyId(); String getAuthorizedServiceSignature();  }
@Test public void testValidateForAuthorizedServiceNoSignature() throws CryptoException { long issueTime = System.currentTimeMillis() / 1000; List<String> authorizedServices = new ArrayList<>(); authorizedServices.add("coretech.storage"); PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) .authorizedServices(authorizedServices).build(); userTokenToSign.sign(servicePrivateKeyStringK0); PrincipalToken userTokenToValidate = new PrincipalToken(userTokenToSign.getSignedToken()); StringBuilder errMsg = new StringBuilder(); assertFalse(userTokenToValidate.validateForAuthorizedService(servicePublicKeyStringK1, errMsg)); assertTrue(!errMsg.toString().isEmpty()); }
@Test public void testValidateForAuthorizedServiceIllegal() { PrincipalToken token = new PrincipalToken("bs=signature;v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature;bk=0;bn=svc1"); assertFalse(token.validateForAuthorizedService(null, null)); token = new PrincipalToken("v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature;bk=1;bn=svc1;bs=signature"); assertFalse(token.validateForAuthorizedService(null, null)); assertFalse(token.validateForAuthorizedService(servicePublicKeyStringK1, null)); }