X509RoleCertRequest extends X509CertRequest { boolean validateProxyUserUri(final String proxyUser) { if (uris == null || uris.isEmpty()) { LOGGER.error("No URI fields available in the CSR"); return false; } String proxyUserUri = null; for (String uri : uris) { if (!uri.toLowerCase().startsWith(ZTSConsts.ZTS_CERT_PROXY_USER_URI)) { continue; } if (proxyUserUri != null) { LOGGER.error("Multiple ProxyUser URIs in the CSR: {}/{}", uri, proxyUserUri); return false; } proxyUserUri = uri; } if (proxyUserUri == null) { LOGGER.error("No ProxyUserURI fields available in the CSR"); return false; } final String uriCheck = ZTSConsts.ZTS_CERT_PROXY_USER_URI + proxyUser; if (!proxyUserUri.equals(uriCheck)) { LOGGER.error("ProxyUserURI mismatch: {} vs {}", proxyUserUri, uriCheck); return false; } return true; } X509RoleCertRequest(String csr); Map<String, String[]> getRequestedRoleList(); boolean validate(Set<String> roles, final String domainName, final String principal,
            final String proxyUser, Set<String> validCertSubjectOrgValues); boolean validate(final String principal, final String proxyUser,
            Set<String> validCertSubjectOrgValues); boolean validateIPAddress(X509Certificate cert, final String ip);  }
@Test public void testValidateProxyUserUri() throws IOException { Path path = Paths.get("src/test/resources/proxy_role.csr"); String csr = new String(Files.readAllBytes(path)); X509RoleCertRequest certReq = new X509RoleCertRequest(csr); Set<String> roles = new HashSet<>(); roles.add("api"); Set<String> orgValues = new HashSet<>(); orgValues.add("Athenz"); assertTrue(certReq.validate(roles, "coretech", "sports.api", "proxy.user", orgValues)); assertFalse(certReq.validate(roles, "coretech", "sports.api", "proxy2.user", orgValues)); }