InstanceZTSProvider implements InstanceProvider { boolean validateToken(final String signedToken, final String domainName, final String serviceName, final String csrPublicKey, StringBuilder errMsg) { final PrincipalToken serviceToken = authenticate(signedToken, keyStore, csrPublicKey, errMsg); if (serviceToken == null) { return false; } if (!serviceToken.getDomain().equalsIgnoreCase(domainName)) { errMsg.append("validate failed: domain mismatch: "). append(serviceToken.getDomain()).append(" vs. ").append(domainName); return false; } if (!serviceToken.getName().equalsIgnoreCase(serviceName)) { errMsg.append("validate failed: service mismatch: "). append(serviceToken.getName()).append(" vs. ").append(serviceName); return false; } return true; }  @Override Scheme getProviderScheme(); @Override void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore); @Override void setHostnameResolver(HostnameResolver hostnameResolver); @Override InstanceConfirmation confirmInstance(InstanceConfirmation confirmation); @Override InstanceConfirmation refreshInstance(InstanceConfirmation confirmation); boolean validatePublicKeys(final String athenzPublicKey, final String csrPublicKey);  }
@Test public void testValidateToken() { KeyStore keystore = Mockito.mock(KeyStore.class); Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0); InstanceZTSProvider provider = new InstanceZTSProvider(); provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, keystore); StringBuilder errMsg = new StringBuilder(256); String token = "invalidtoken"; assertFalse(provider.validateToken(token, "sports", "api", servicePublicKeyStringK0, errMsg)); assertTrue(errMsg.toString().contains("Invalid token")); errMsg.setLength(0); PrincipalToken tokenToSign = new PrincipalToken.Builder("1", "sports", "api") .keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000) .expirationWindow(3600).build(); tokenToSign.sign(servicePrivateKeyStringK0); errMsg.setLength(0); assertTrue(provider.validateToken(tokenToSign.getSignedToken(), "sports", "api", servicePublicKeyStringK0, errMsg)); errMsg.setLength(0); assertFalse(provider.validateToken(tokenToSign.getSignedToken(), "sports", "ui", servicePublicKeyStringK0, errMsg)); assertTrue(errMsg.toString().contains("service mismatch")); errMsg.setLength(0); assertFalse(provider.validateToken(tokenToSign.getSignedToken(), "weather", "api", servicePublicKeyStringK0, errMsg)); assertTrue(errMsg.toString().contains("domain mismatch")); provider.close(); }