ZTSImpl implements KeyStore, ZTSHandler { int getConfiguredRoleListExpiryTimeMins(Map<String, String[]> requestedRoleList) { int maxAllowedExpiry = 0; for (String domainName : requestedRoleList.keySet()) { DataCache data = dataStore.getDataCache(domainName); if (data == null) { continue; } Set<String> roles = new HashSet<>(); Collections.addAll(roles, requestedRoleList.get(domainName)); int domainMaxAllowedExpiry = getConfiguredRoleCertExpiryTimeMins(data, roles); if (domainMaxAllowedExpiry > 0 && (maxAllowedExpiry == 0 || domainMaxAllowedExpiry < maxAllowedExpiry)) { maxAllowedExpiry = domainMaxAllowedExpiry; } } return maxAllowedExpiry; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testGetConfiguredRoleListExpiryTimeMinsNoList() { Map<String, String[]> requestedRoleList = new HashMap<>(); String[] roles = new String[1]; roles[0] = "readers"; requestedRoleList.put("athenz", roles); requestedRoleList.put("coretech", roles); DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.admin").setCertExpiryMins(60); data.processRole(role1); assertEquals(zts.getConfiguredRoleListExpiryTimeMins(requestedRoleList), 0); }
@Test public void testGetConfiguredRoleListExpiryTimeMinsRoleSetting() { Map<String, String[]> requestedRoleList = new HashMap<>(); String[] roles = new String[1]; roles[0] = "readers"; requestedRoleList.put("athenz", roles); requestedRoleList.put("coretech", roles); DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.readers").setCertExpiryMins(60); data.processRole(role1); DomainData domainData = new DomainData(); data.setDomainData(domainData); zts.dataStore.getCacheStore().put("athenz", data); assertEquals(zts.getConfiguredRoleListExpiryTimeMins(requestedRoleList), 60); }
@Test public void testGetConfiguredRoleListExpiryTimeMinsDomainSetting() { Map<String, String[]> requestedRoleList = new HashMap<>(); String[] roles = new String[1]; roles[0] = "readers"; requestedRoleList.put("athenz", roles); requestedRoleList.put("coretech", roles); DataCache data = new DataCache(); Role role1 = new Role().setName("athenz:role.readers"); data.processRole(role1); DomainData domainData = new DomainData().setRoleCertExpiryMins(90); data.setDomainData(domainData); zts.dataStore.getCacheStore().put("athenz", data); assertEquals(zts.getConfiguredRoleListExpiryTimeMins(requestedRoleList), 90); }
@Test public void testGetConfiguredRoleListExpiryTimeMinsMultipleMixedSetting() { Map<String, String[]> requestedRoleList = new HashMap<>(); String[] roles = new String[1]; roles[0] = "readers"; requestedRoleList.put("athenz", roles); requestedRoleList.put("coretech", roles); DataCache data1 = new DataCache(); Role role1 = new Role().setName("athenz:role.readers").setCertExpiryMins(60); data1.processRole(role1); DomainData domainData1 = new DomainData(); data1.setDomainData(domainData1); DataCache data2 = new DataCache(); Role role2 = new Role().setName("coretech:role.readers"); data2.processRole(role2); DomainData domainData2 = new DomainData().setRoleCertExpiryMins(120); data2.setDomainData(domainData2); zts.dataStore.getCacheStore().put("athenz", data1); zts.dataStore.getCacheStore().put("coretech", data2); assertEquals(zts.getConfiguredRoleListExpiryTimeMins(requestedRoleList), 60); }
@Test public void testGetConfiguredRoleListExpiryTimeMinsMultipleDomainSetting() { Map<String, String[]> requestedRoleList = new HashMap<>(); String[] roles = new String[1]; roles[0] = "readers"; requestedRoleList.put("athenz", roles); requestedRoleList.put("coretech", roles); DataCache data1 = new DataCache(); Role role1 = new Role().setName("athenz:role.readers"); data1.processRole(role1); DomainData domainData1 = new DomainData().setRoleCertExpiryMins(120); data1.setDomainData(domainData1); DataCache data2 = new DataCache(); Role role2 = new Role().setName("coretech:role.readers"); data2.processRole(role2); DomainData domainData2 = new DomainData().setRoleCertExpiryMins(90); data2.setDomainData(domainData2); zts.dataStore.getCacheStore().put("athenz", data1); zts.dataStore.getCacheStore().put("coretech", data2); assertEquals(zts.getConfiguredRoleListExpiryTimeMins(requestedRoleList), 90); }