CertificateIdentityParser { public CertificateIdentity parse(HttpServletRequest request) throws CertificateIdentityException { X509Certificate[] certs = (X509Certificate[]) request.getAttribute(JAVAX_CERT_ATTR); return this.parse(certs); } CertificateIdentityParser(Set<String> excludedPrincipalSet, boolean excludeRoleCertificates); CertificateIdentity parse(HttpServletRequest request); CertificateIdentity parse(X509Certificate[] certs); static final String JAVAX_CERT_ATTR; static final String ZTS_CERT_ROLE_URI; static final String EMPTY_CERT_ERR_MSG; }
@Test public void testParseFromHttpServletRequest() throws Exception { X509Certificate[] certs = new X509Certificate[]{ this.readCert("valid_cn_x509.cert") }; HttpServletRequest request = Mockito.mock(HttpServletRequest.class); Mockito.when(request.getAttribute(CertificateIdentityParser.JAVAX_CERT_ATTR)).thenReturn(certs); CertificateIdentityParser mock = Mockito.spy(new CertificateIdentityParser(null, false)); ArgumentCaptor<X509Certificate[]> argument = ArgumentCaptor.forClass(X509Certificate[].class); mock.parse(request); Mockito.verify(mock, Mockito.times(1)).parse(argument.capture()); assertSame(argument.getValue(), certs); }
@Test public void testParseCertificate() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("valid_cn_x509.cert") }; CertificateIdentity certId = parser.parse(certs); assertNotNull(certId); assertEquals(certId.getDomain(), "athenz"); assertEquals(certId.getService(), "syncer"); assertNull(certId.getRoles()); }
@Test public void testParseRoleCertificate() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("valid_email_x509.cert") }; CertificateIdentity certId = parser.parse(certs); assertNotNull(certId); assertEquals(certId.getDomain(), "athens"); assertEquals(certId.getService(), "zts"); assertEquals(certId.getRoles().get(0), "sports:role.readers"); }
@Test public void testParseInvalidArray() { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); CertificateIdentity certId = null; try { certId = parser.parse((X509Certificate[]) null); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "No certificate available in request"); } finally { assertNull(certId); } try { certId = parser.parse(new X509Certificate[]{ null }); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "No certificate available in request"); } finally { assertNull(certId); } }
@Test public void testParseRoleCertificateExcluded() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, true); X509Certificate[] certs = new X509Certificate[]{ this.readCert("valid_email_x509.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Role Certificates not allowed"); } finally { assertNull(certId); } }
@Test public void testParseCertificateExcluded() throws Exception { Set<String> excludedPrincipalSet = new HashSet<>(Arrays.asList("athenz.syncer", "sports.api")); CertificateIdentityParser parser = new CertificateIdentityParser(excludedPrincipalSet, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("valid_cn_x509.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Principal is excluded"); } finally { assertNull(certId); } }
@Test public void testParseCertificateInvalidEmail() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("invalid_email_x509.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Invalid role cert, invalid email SAN entry"); } finally { assertNull(certId); } }
@Test public void testParseCertificateNoEmail() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("no_email_x509.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Invalid role cert, no email SAN entry"); } finally { assertNull(certId); } }
@Test public void testParseCertificateNoPrincipal() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("no_cn_x509.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Certificate principal is empty"); } finally { assertNull(certId); } }
@Test public void testParseCertificateInvalidPrincipal() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("invalid_principal_x509.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Principal is not a valid service identity"); } finally { assertNull(certId); } }
@Test public void testParseCertificateRoleURIs() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, false); X509Certificate[] certs = new X509Certificate[]{ this.readCert("role_cert_multiple_uri.cert") }; CertificateIdentity certId = parser.parse(certs); assertNotNull(certId); assertEquals(certId.getRoles(), Arrays.asList("coretech:role.readers", "coretech:role.writers")); }
@Test public void testParseCertificateRoleURIsExcluded() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, true); X509Certificate[] certs = new X509Certificate[]{ this.readCert("role_cert_multiple_uri.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Role Certificates not allowed"); } finally { assertNull(certId); } }
@Test public void testParseCertificateInvalidRoleURI() throws Exception { CertificateIdentityParser parser = new CertificateIdentityParser(null, true); X509Certificate[] certs = new X509Certificate[]{ this.readCert("role_cert_invalid_uri.cert") }; CertificateIdentity certId = null; try { certId = parser.parse(certs); } catch (CertificateIdentityException e) { assertEquals(e.getMessage(), "Invalid role cert, invalid uri SAN entry"); } finally { assertNull(certId); } }