PrincipalAuthority implements Authority, AuthorityKeyStore { boolean remoteIpCheck(String remoteAddr, boolean writeOp, PrincipalToken serviceToken, String authorizedServiceName) { boolean checkResult = true; switch (ipCheckMode) { case OPS_ALL: if (!remoteAddr.equals(serviceToken.getIP())) { checkResult = false; } break; case OPS_WRITE: if (writeOp && !remoteAddr.equals(serviceToken.getIP())) { if (authorizedServiceName == null) { checkResult = false; } } break; default: break; } return checkResult; } PrincipalAuthority(); @Override String getID(); @Override void initialize(); @Override String getDomain(); @Override String getHeader(); @Override String getAuthenticateChallenge(); @Override Principal authenticate(String signedToken, String remoteAddr, String httpMethod,
            StringBuilder errMsg); @Override void setKeyStore(KeyStore keyStore); static final String HTTP_HEADER; static final String ATHENZ_AUTH_CHALLENGE; static final String ATHENZ_PROP_PRINCIPAL_HEADER; }
@Test public void testRemoteIpCheckAll() { PrincipalAuthority serviceAuthority = new PrincipalAuthority(); serviceAuthority.ipCheckMode = IpCheckMode.OPS_ALL; PrincipalToken serviceToken = new PrincipalToken("v=S1;d=domain;n=service;i=10.11.12.23;s=sig"); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", false, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", true, serviceToken, null)); assertFalse(serviceAuthority.remoteIpCheck("10.11.12.22", false, serviceToken, null)); assertFalse(serviceAuthority.remoteIpCheck("10.11.12.22", true, serviceToken, null)); }
@Test public void testRemoteIpCheckWrite() { PrincipalAuthority serviceAuthority = new PrincipalAuthority(); serviceAuthority.ipCheckMode = IpCheckMode.OPS_WRITE; PrincipalToken serviceToken = new PrincipalToken("v=S1;d=user;n=user1;i=10.11.12.23;s=sig"); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", false, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", false, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", true, serviceToken, null)); assertFalse(serviceAuthority.remoteIpCheck("10.11.12.22", true, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", true, serviceToken, "authz_service")); }
@Test public void testRemoteIpCheckNone() { PrincipalAuthority serviceAuthority = new PrincipalAuthority(); serviceAuthority.ipCheckMode = IpCheckMode.OPS_NONE; PrincipalToken serviceToken = new PrincipalToken("v=S1;d=user;n=user1;i=10.11.12.23;s=sig"); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", false, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", false, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", true, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", true, serviceToken, null)); assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", true, serviceToken, "authz_service")); }