ZTSImpl implements KeyStore, ZTSHandler { boolean validateRoleCertificateRequest(final String csr, final String domainName, Set<String> roles, final String principal, final String proxyUser, X509Certificate cert, final String ip) { X509RoleCertRequest certReq; try { certReq = new X509RoleCertRequest(csr); } catch (CryptoException ex) { LOGGER.error("unable to parse PKCS10 CSR: " + ex.getMessage()); return false; } if (!certReq.validate(roles, domainName, principal, proxyUser, validCertSubjectOrgValues)) { return false; } if (!validateRoleCertSubjectOU(certReq, cert)) { return false; } if (!validateUriHostname(certReq.getUriHostname(), cert)) { return false; } if (!validateInstanceId(certReq.getInstanceId(), cert)) { LOGGER.error("unable to match request id: {} with cert id: {}", certReq.getInstanceId(), X509CertUtils.extractRequestInstanceId(cert)); } return verifyCertRequestIP ? certReq.validateIPAddress(cert, ip) : true; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testValidateRoleCertificateRequestMismatchRole() throws IOException { Path path = Paths.get("src/test/resources/valid_email.csr"); String csr = new String(Files.readAllBytes(path)); Set<String> roles = new HashSet<>(); roles.add("writer"); zts.validCertSubjectOrgValues = null; assertFalse(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, null, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequestMismatchEmail() throws IOException { Path path = Paths.get("src/test/resources/valid_email.csr"); String csr = new String(Files.readAllBytes(path)); Set<String> roles = new HashSet<>(); roles.add("readers"); zts.validCertSubjectOrgValues = null; assertFalse(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.standings", null, null, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequestNoEmail() throws IOException { Path path = Paths.get("src/test/resources/valid_noemail.csr"); String csr = new String(Files.readAllBytes(path)); Set<String> roles = new HashSet<>(); roles.add("readers"); zts.validCertSubjectOrgValues = null; assertFalse(zts.validateRoleCertificateRequest(csr, "sports", roles, "no-email", null, null, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequestInvalidOField() throws IOException { Path path = Paths.get("src/test/resources/valid_email.csr"); String csr = new String(Files.readAllBytes(path)); Set<String> roles = new HashSet<>(); roles.add("readers"); Set<String> validOValues = new HashSet<>(); validOValues.add("InvalidCompany"); zts.validCertSubjectOrgValues = validOValues; assertFalse(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, null, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequest() throws IOException { Path path = Paths.get("src/test/resources/valid_email.csr"); String csr = new String(Files.readAllBytes(path)); Set<String> roles = new HashSet<>(); roles.add("readers"); zts.validCertSubjectOrgValues = null; assertTrue(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, null, "10.0.0.1")); Set<String> validOValues = new HashSet<>(); validOValues.add("Athenz"); zts.validCertSubjectOrgValues = validOValues; assertTrue(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, null, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequestOU() throws IOException { Path path = Paths.get("src/test/resources/valid_email.csr"); String csr = new String(Files.readAllBytes(path)); Set<String> roles = new HashSet<>(); roles.add("readers"); zts.validCertSubjectOrgValues = null; Set<String> ouValues = new HashSet<>(); ouValues.add("Testing Domain1"); zts.validCertSubjectOrgUnitValues = ouValues; zts.verifyCertSubjectOU = true; assertFalse(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, null, "10.0.0.1")); ouValues.add("Testing Domain"); assertTrue(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, null, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequestWithUriHostname() throws IOException { Path path = Paths.get("src/test/resources/athenz.examples.role-uri-hostname-only.csr"); String csr = new String(Files.readAllBytes(path)); path = Paths.get("src/test/resources/athenz.examples.no-uri.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); Set<String> roles = new HashSet<>(); roles.add("readers"); assertFalse(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd", null, cert, "10.0.0.1")); path = Paths.get("src/test/resources/athenz.examples.uri-hostname-only.pem"); pem = new String(Files.readAllBytes(path)); cert = Crypto.loadX509Certificate(pem); assertTrue(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd", null, cert, "10.0.0.1")); path = Paths.get("src/test/resources/athenz.examples.role-uri-instanceid-hostname.csr"); csr = new String(Files.readAllBytes(path)); assertTrue(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd", null, cert, "10.0.0.1")); path = Paths.get("src/test/resources/athenz.examples.uri-instanceid-hostname.pem"); pem = new String(Files.readAllBytes(path)); cert = Crypto.loadX509Certificate(pem); assertTrue(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd", null, cert, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequestOUWithCert() throws IOException { Path path = Paths.get("src/test/resources/valid_email.csr"); String csr = new String(Files.readAllBytes(path)); path = Paths.get("src/test/resources/valid_provider_refresh.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate validCert = Crypto.loadX509Certificate(pem); path = Paths.get("src/test/resources/svc_single_ip.pem"); pem = new String(Files.readAllBytes(path)); X509Certificate invalidCert = Crypto.loadX509Certificate(pem); Set<String> roles = new HashSet<>(); roles.add("readers"); zts.validCertSubjectOrgValues = null; Set<String> ouValues = new HashSet<>(); ouValues.add("Athenz"); zts.validCertSubjectOrgUnitValues = ouValues; zts.verifyCertSubjectOU = true; assertFalse(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, invalidCert, "10.0.0.1")); assertTrue(zts.validateRoleCertificateRequest(csr, "sports", roles, "sports.scores", null, validCert, "10.0.0.1")); }
@Test public void testValidateRoleCertificateRequestMismatchIP() throws IOException { Path path = Paths.get("src/test/resources/role_single_ip.csr"); String csr = new String(Files.readAllBytes(path)); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); Set<String> roles = new HashSet<>(); roles.add("writers"); zts.verifyCertRequestIP = false; zts.validCertSubjectOrgValues = null; assertTrue(zts.validateRoleCertificateRequest(csr, "athenz", roles, "athenz.production", null, cert, "10.11.12.13")); assertTrue(zts.validateRoleCertificateRequest(csr, "athenz", roles, "athenz.production", null, cert, "10.11.12.14")); zts.verifyCertRequestIP = true; assertTrue(zts.validateRoleCertificateRequest(csr, "athenz", roles, "athenz.production", null, cert, "10.11.12.13")); assertFalse(zts.validateRoleCertificateRequest(csr, "athenz", roles, "athenz.production", null, cert, "10.11.12.14")); }
@Test public void testValidateRoleCertificateRequestInvalidCSR() { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); ztsImpl.validCertSubjectOrgValues = null; assertFalse((ztsImpl.validateRoleCertificateRequest("invalid-csr", null, null, null, null, null, "10.0.0.1"))); }