ClientAuthFactory { public Client provide(ContainerRequest containerRequest, HttpServletRequest httpServletRequest) { int requestPort = httpServletRequest.getLocalPort(); Optional<XfccSourceConfig> possibleXfccConfig = getXfccConfigForPort(requestPort); List<String> xfccHeaderValues = Optional.ofNullable(containerRequest.getRequestHeader(XFCC_HEADER_NAME)).orElse(List.of()); if (possibleXfccConfig.isEmpty() != xfccHeaderValues.isEmpty()) { throw new NotAuthorizedException(format( "Port %d is configured to %s receive traffic with the %s header set", requestPort, possibleXfccConfig.isEmpty() ? "never" : "only", XFCC_HEADER_NAME)); } Principal requestPrincipal = getPrincipal(containerRequest).orElseThrow( () -> new NotAuthorizedException("Not authorized as Keywhiz client")); if (possibleXfccConfig.isEmpty()) { return authenticateClientFromCertificate(requestPrincipal); } else { return authorizeClientFromXfccHeader(possibleXfccConfig.get(), xfccHeaderValues, requestPrincipal); } } @Inject  ClientAuthFactory(ClientDAOFactory clientDAOFactory, KeywhizConfig keywhizConfig); @VisibleForTesting  ClientAuthFactory(ClientDAO clientDAO, ClientAuthConfig clientAuthConfig); Client provide(ContainerRequest containerRequest,
      HttpServletRequest httpServletRequest);  }
@Test public void returnsClientWhenClientPresent() { when(httpServletRequest.getLocalPort()).thenReturn(xfccDisallowedPort); when(securityContext.getUserPrincipal()).thenReturn(clientPrincipal); assertThat(factory.provide(request, httpServletRequest)).isEqualTo(client); }
@Test(expected = NotAuthorizedException.class) public void clientWhenPrincipalAbsentThrows() { when(httpServletRequest.getLocalPort()).thenReturn(xfccDisallowedPort); when(securityContext.getUserPrincipal()).thenReturn(null); factory.provide(request, httpServletRequest); }
@Test public void returnsClientWhenClientPresent_fromXfccHeader() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader)); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); assertThat(factory.provide(request, httpServletRequest)).isEqualTo(client); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_requesterAuthMissing() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader)); when(securityContext.getUserPrincipal()).thenReturn(null); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_requesterNameNotAllowed() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader)); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(xfccSourceConfig.allowedClientNames()).thenReturn(List.of()); when(xfccSourceConfig.allowedSpiffeIds()).thenReturn(List.of(xfccSpiffe)); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_requesterSpiffeNotAllowed() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader)); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(xfccSourceConfig.allowedClientNames()).thenReturn(List.of(xfccName)); when(xfccSourceConfig.allowedSpiffeIds()).thenReturn(List.of()); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_portConfigurationInvalid() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader)); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(clientAuthConfig.xfccConfigs()).thenReturn(List.of(xfccSourceConfig, xfccSourceConfig)); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_disallowedPortWithHeader() { when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader)); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(httpServletRequest.getLocalPort()).thenReturn(xfccDisallowedPort); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_allowedPortNoHeader() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn(List.of()); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_emptyHeader() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn(List.of("")); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_multipleHeaderValues() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader, xfccHeader)); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_multipleHeaderEntries() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(xfccHeader + "," + xfccHeader)); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_multipleCertKeysInHeader() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(format("Cert=\"%s\";cert=\"%s\"", UrlEncoded.encodeString(clientPem, UTF_8), UrlEncoded.encodeString(clientPem, UTF_8)))); factory.provide(request, httpServletRequest); }
@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_missingClientCert() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn( List.of(format("By=%s", xfccName))); factory.provide(request, httpServletRequest); }