InstanceZTSProvider implements InstanceProvider { PrincipalToken authenticate(final String signedToken, KeyStore keyStore, final String csrPublicKey, StringBuilder errMsg) { PrincipalToken serviceToken; try { serviceToken = new PrincipalToken(signedToken); } catch (IllegalArgumentException ex) { errMsg.append("authenticate failed: Invalid token: exc="). append(ex.getMessage()).append(" : credential="). append(Token.getUnsignedToken(signedToken)); LOGGER.error(errMsg.toString()); return null; } if (serviceToken.getAuthorizedServices() != null) { errMsg.append("authenticate failed: authorized service token") .append(" : credential=").append(Token.getUnsignedToken(signedToken)); LOGGER.error(errMsg.toString()); return null; } final String tokenDomain = serviceToken.getDomain().toLowerCase(); final String tokenName = serviceToken.getName().toLowerCase(); final String publicKey = keyStore.getPublicKey(tokenDomain, tokenName, serviceToken.getKeyId()); if (!serviceToken.validate(publicKey, 300, false, errMsg)) { return null; } if (!validatePublicKeys(publicKey, csrPublicKey)) { errMsg.append("CSR and Athenz public key mismatch"); LOGGER.error(errMsg.toString()); return null; } return serviceToken; }  @Override Scheme getProviderScheme(); @Override void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore); @Override void setHostnameResolver(HostnameResolver hostnameResolver); @Override InstanceConfirmation confirmInstance(InstanceConfirmation confirmation); @Override InstanceConfirmation refreshInstance(InstanceConfirmation confirmation); boolean validatePublicKeys(final String athenzPublicKey, final String csrPublicKey);  }
@Test public void testAuthenticate() { InstanceZTSProvider provider = new InstanceZTSProvider(); provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, null); StringBuilder errMsg = new StringBuilder(256); KeyStore keystore = Mockito.mock(KeyStore.class); Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0); String token = "invalidtoken"; assertNull(provider.authenticate(token, null, servicePublicKeyStringK0, errMsg)); assertTrue(errMsg.toString().contains("Invalid token")); errMsg.setLength(0); token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1,svc2;s=signature;bk=0;bn=svc1;bs=signature"; assertNull(provider.authenticate(token, null, servicePublicKeyStringK0, errMsg)); assertTrue(errMsg.toString().contains("authorized service token")); PrincipalToken tokenToSign = new PrincipalToken.Builder("1", "sports", "api") .keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000) .expirationWindow(3600).build(); tokenToSign.sign(servicePrivateKeyStringK0); errMsg.setLength(0); assertNotNull(provider.authenticate(tokenToSign.getSignedToken(), keystore, servicePublicKeyStringK0, errMsg)); assertNull(provider.authenticate(tokenToSign.getSignedToken(), keystore, "publicKey", errMsg)); errMsg.setLength(0); assertNull(provider.authenticate(tokenToSign.getSignedToken().replace(";s=", ";s=abc"), keystore, servicePublicKeyStringK0, errMsg)); provider.close(); }