ZTSImpl implements KeyStore, ZTSHandler { @Override public Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest) { final String caller = ctx.getApiName(); final String principalDomain = logPrincipalAndGetDomain(ctx); if (readOnlyMode) { throw requestError("Server in Maintenance Read-Only mode. Please try your request later", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN, principalDomain); } validateRequest(ctx.request(), principalDomain, caller); validate(certRequest, TYPE_SSH_CERT_REQUEST, principalDomain, caller); AthenzObject.SSH_CERT_REQUEST.convertToLowerCase(certRequest); final Principal principal = ((RsrcCtxWrapper) ctx).principal(); final String domainName = principal.getDomain(); setRequestDomain(ctx, domainName); SSHCertificates certs; try { certs = instanceCertManager.generateSSHCertificates(principal, certRequest); } catch (com.yahoo.athenz.common.server.rest.ResourceException ex) { throw error(ex.getCode(), ex.getMessage(), caller, domainName, principalDomain); } return Response.status(ResourceException.CREATED).entity(certs).build(); } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testPostSSHRequestException() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); SSHCertRequestData data = new SSHCertRequestData(); data.setDestinations(Arrays.asList("dest1", "dest2")); data.setPrincipals(Arrays.asList("user1", "user2")); data.setSources(Collections.singletonList("src")); data.setTouchPublicKey("publickey"); SSHCertRequestMeta meta = new SSHCertRequestMeta(); meta.setRequestor("req"); meta.setOrigin("origin"); meta.setClientInfo("info"); meta.setSshClientVersion("1.2"); meta.setCertType("user"); SSHCertRequest certRequest = new SSHCertRequest(); certRequest.setCertRequestData(data); certRequest.setCertRequestMeta(meta); InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager); Mockito.when(instanceManager.generateSSHCertificates(Mockito.any(), eq(certRequest))) .thenThrow(new com.yahoo.athenz.common.server.rest.ResourceException(400, "Failed to get ssh certs")); ztsImpl.instanceCertManager = instanceManager; Path path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); X509Certificate cert = Crypto.loadX509Certificate(pem); principal.setX509Certificate(cert); ResourceContext context = createResourceContext(principal); try { ztsImpl.postSSHCertRequest(context, certRequest); fail(); } catch (ResourceException ex) { assertEquals(400, ex.getCode()); assertTrue(ex.getMessage().contains("Failed to get ssh certs")); } }