ZTSImpl implements KeyStore, ZTSHandler { public AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName, String roleName, Integer durationSeconds, String externalId) { final String caller = ctx.getApiName(); ctx.request().setAttribute(ZTS_REQUEST_LOG_SKIP_QUERY, Boolean.TRUE); final String principalDomain = logPrincipalAndGetDomain(ctx); validateRequest(ctx.request(), principalDomain, caller); validate(domainName, TYPE_DOMAIN_NAME, principalDomain, caller); final Principal principal = ((RsrcCtxWrapper) ctx).principal(); if (isAuthorizedServicePrincipal(principal)) { throw forbiddenError("Authorized Service Principals not allowed", caller, domainName, principalDomain); } validatePrincipalNotRoleIdentity(principal, caller); try { roleName = URLDecoder.decode(roleName, "UTF-8"); } catch (Exception ex) { LOGGER.error("Unable to decode {} - error {}", roleName, ex.getMessage()); } validate(roleName, TYPE_AWS_ARN_ROLE_NAME, principalDomain, caller); domainName = domainName.toLowerCase(); setRequestDomain(ctx, domainName); if (LOGGER.isDebugEnabled()) { LOGGER.debug("getAWSTemporaryCredentials(domain: {}, role: {}, duration {}", domainName, roleName, durationSeconds); } if (!cloudStore.isAwsEnabled()) { throw requestError("getAWSTemporaryCredentials: AWS support is not available", caller, domainName, principalDomain); } final String principalName = principal.getFullName(); final String roleResource = domainName + ":" + roleName.toLowerCase(); if (!verifyAWSAssumeRole(domainName, roleResource, principalName)) { throw forbiddenError("getAWSTemporaryCredentials: Forbidden (ASSUME_AWS_ROLE on " + roleResource + " for " + principalName + ")", caller, domainName, principalDomain); } String account = cloudStore.getCloudAccount(domainName); if (account == null) { throw requestError("getAWSTemporaryCredentials: unable to retrieve AWS account for: " + domainName, caller, domainName, principalDomain); } AWSTemporaryCredentials creds = cloudStore.assumeAWSRole(account, roleName, principalName, durationSeconds, externalId); if (creds == null) { throw requestError("getAWSTemporaryCredentials: unable to assume role " + roleName + " in domain " + domainName + " for principal " + principalName, caller, domainName, principalDomain); } return creds; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testGetAWSTemporaryCredentialsNoCloudStore() { SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); store.processDomain(signedDomain, false); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("hockey", "kings", "v=S1,d=hockey;n=kings;s=sig", 0, new PrincipalAuthority()); ResourceContext context = createResourceContext(principal); try { zts.getAWSTemporaryCredentials(context, "athenz.product", "aws_role_name", null, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testGetAWSTemporaryCredentialsInvalidEncoding() { Principal principal = SimplePrincipal.create("user_domain", "user102", "v=U1;d=user_domain;n=user102;s=signature", 0, null); CloudStore cloudStore = Mockito.mock(CloudStore.class); Mockito.when(cloudStore.isAwsEnabled()).thenReturn(true); store.setCloudStore(cloudStore); zts.cloudStore = cloudStore; SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); store.processDomain(signedDomain, false); try { zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name%", null, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testGetAWSTemporaryCredentialsForbidden() { Principal principal = SimplePrincipal.create("user_domain", "user102", "v=U1;d=user_domain;n=user102;s=signature", 0, null); CloudStore cloudStore = Mockito.mock(CloudStore.class); Mockito.when(cloudStore.isAwsEnabled()).thenReturn(true); store.setCloudStore(cloudStore); zts.cloudStore = cloudStore; SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); store.processDomain(signedDomain, false); try { zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name", null, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); } }
@Test public void testGetAWSTemporaryCredentialsNoAwsAccount() { Principal principal = SimplePrincipal.create("user_domain", "user101", "v=U1;d=user_domain;n=user101;s=signature", 0, null); CloudStore cloudStore = new MockCloudStore(); store.setCloudStore(cloudStore); zts.cloudStore = cloudStore; SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); store.processDomain(signedDomain, false); try { zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name", null, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testGetAWSTemporaryCredentials() { Principal principal = SimplePrincipal.create("user_domain", "user101", "v=U1;d=user_domain;n=user101;s=signature", 0, null); MockCloudStore cloudStore = new MockCloudStore(); cloudStore.setMockFields("1234", "aws_role_name", "user_domain.user101"); store.setCloudStore(cloudStore); zts.cloudStore = cloudStore; SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); store.processDomain(signedDomain, false); AWSTemporaryCredentials creds = zts.getAWSTemporaryCredentials( createResourceContext(principal), "athenz.product", "aws_role_name", null, null); assertNotNull(creds); try { cloudStore.setMockFields("1234", "aws_role2_name", "user_domain.user101"); zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name", null, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 400); } }
@Test public void testGetAWSTemporaryCredentialsAuthorizedPrincipal() { SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user101", "v=U1;d=user_domain;n=user101;s=signature", 0, null); principal.setAuthorizedService("athenz.service"); MockCloudStore cloudStore = new MockCloudStore(); cloudStore.setMockFields("1234", "aws_role_name", "user_domain.user101"); store.setCloudStore(cloudStore); zts.cloudStore = cloudStore; SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); store.processDomain(signedDomain, false); try { zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name", null, null); fail(); } catch (ResourceException ex) { assertEquals(ex.getCode(), 403); assertTrue(ex.getMessage().contains("Authorized Service Principals not allowed")); } }