@Test public void unauthorized_client_noMatchingDN() throws Exception { Client client = mock(Client.class); HttpServerRequest httpServerRequest = mock(HttpServerRequest.class); SSLSession sslSession = mock(SSLSession.class); X509Certificate certificate = mock(X509Certificate.class); Principal subjectDN = mock(Principal.class); when(client.getTlsClientAuthSubjectDn()).thenReturn("CN=localhost, O=Invalid, C=US"); when(subjectDN.getName()).thenReturn("CN=localhost, O=GraviteeSource, C=FR"); when(certificate.getSubjectDN()).thenReturn(subjectDN); when(httpServerRequest.sslSession()).thenReturn(sslSession); when(sslSession.getPeerCertificates()).thenReturn(new Certificate[]{certificate}); RoutingContext context = mock(RoutingContext.class); when(context.request()).thenReturn(httpServerRequest); CountDownLatch latch = new CountDownLatch(1); authProvider.handle(client, context, clientAsyncResult -> { latch.countDown(); Assert.assertNotNull(clientAsyncResult); Assert.assertNotNull(clientAsyncResult.cause()); }); assertTrue(latch.await(10, TimeUnit.SECONDS)); }
@Override public void handle(Client client, RoutingContext context, Handler<AsyncResult<Client>> handler) { SSLSession sslSession = context.request().sslSession(); try { Certificate[] peerCertificates = sslSession.getPeerCertificates(); X509Certificate peerCertificate = (X509Certificate) peerCertificates[0]; if ((client.getTlsClientAuthSubjectDn() != null && validateSubjectDn(client, peerCertificate)) || (client.getTlsClientAuthSanDns() != null && validateSAN(peerCertificate, GeneralName.dNSName, client.getTlsClientAuthSanDns())) || (client.getTlsClientAuthSanEmail() != null && validateSAN(peerCertificate, GeneralName.rfc822Name, client.getTlsClientAuthSanEmail())) || (client.getTlsClientAuthSanIp() != null && validateSAN(peerCertificate, GeneralName.iPAddress, client.getTlsClientAuthSanIp())) || (client.getTlsClientAuthSanUri() != null && validateSAN(peerCertificate, GeneralName.uniformResourceIdentifier, client.getTlsClientAuthSanUri()))) { handler.handle(Future.succeededFuture(client)); } else { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing TLS configuration"))); } } catch (SSLPeerUnverifiedException | CertificateParsingException ce) { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing or unsupported certificate"))); } }
ClientCertificateAuthProvider implements ClientAuthProvider { @Override public void handle(Client client, RoutingContext context, Handler<AsyncResult<Client>> handler) { SSLSession sslSession = context.request().sslSession(); try { Certificate[] peerCertificates = sslSession.getPeerCertificates(); X509Certificate peerCertificate = (X509Certificate) peerCertificates[0]; if ((client.getTlsClientAuthSubjectDn() != null && validateSubjectDn(client, peerCertificate)) || (client.getTlsClientAuthSanDns() != null && validateSAN(peerCertificate, GeneralName.dNSName, client.getTlsClientAuthSanDns())) || (client.getTlsClientAuthSanEmail() != null && validateSAN(peerCertificate, GeneralName.rfc822Name, client.getTlsClientAuthSanEmail())) || (client.getTlsClientAuthSanIp() != null && validateSAN(peerCertificate, GeneralName.iPAddress, client.getTlsClientAuthSanIp())) || (client.getTlsClientAuthSanUri() != null && validateSAN(peerCertificate, GeneralName.uniformResourceIdentifier, client.getTlsClientAuthSanUri()))) { handler.handle(Future.succeededFuture(client)); } else { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing TLS configuration"))); } } catch (SSLPeerUnverifiedException | CertificateParsingException ce) { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing or unsupported certificate"))); } } }
ClientCertificateAuthProvider implements ClientAuthProvider { @Override public void handle(Client client, RoutingContext context, Handler<AsyncResult<Client>> handler) { SSLSession sslSession = context.request().sslSession(); try { Certificate[] peerCertificates = sslSession.getPeerCertificates(); X509Certificate peerCertificate = (X509Certificate) peerCertificates[0]; if ((client.getTlsClientAuthSubjectDn() != null && validateSubjectDn(client, peerCertificate)) || (client.getTlsClientAuthSanDns() != null && validateSAN(peerCertificate, GeneralName.dNSName, client.getTlsClientAuthSanDns())) || (client.getTlsClientAuthSanEmail() != null && validateSAN(peerCertificate, GeneralName.rfc822Name, client.getTlsClientAuthSanEmail())) || (client.getTlsClientAuthSanIp() != null && validateSAN(peerCertificate, GeneralName.iPAddress, client.getTlsClientAuthSanIp())) || (client.getTlsClientAuthSanUri() != null && validateSAN(peerCertificate, GeneralName.uniformResourceIdentifier, client.getTlsClientAuthSanUri()))) { handler.handle(Future.succeededFuture(client)); } else { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing TLS configuration"))); } } catch (SSLPeerUnverifiedException | CertificateParsingException ce) { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing or unsupported certificate"))); } }  }
ClientCertificateAuthProvider implements ClientAuthProvider { @Override public void handle(Client client, RoutingContext context, Handler<AsyncResult<Client>> handler) { SSLSession sslSession = context.request().sslSession(); try { Certificate[] peerCertificates = sslSession.getPeerCertificates(); X509Certificate peerCertificate = (X509Certificate) peerCertificates[0]; if ((client.getTlsClientAuthSubjectDn() != null && validateSubjectDn(client, peerCertificate)) || (client.getTlsClientAuthSanDns() != null && validateSAN(peerCertificate, GeneralName.dNSName, client.getTlsClientAuthSanDns())) || (client.getTlsClientAuthSanEmail() != null && validateSAN(peerCertificate, GeneralName.rfc822Name, client.getTlsClientAuthSanEmail())) || (client.getTlsClientAuthSanIp() != null && validateSAN(peerCertificate, GeneralName.iPAddress, client.getTlsClientAuthSanIp())) || (client.getTlsClientAuthSanUri() != null && validateSAN(peerCertificate, GeneralName.uniformResourceIdentifier, client.getTlsClientAuthSanUri()))) { handler.handle(Future.succeededFuture(client)); } else { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing TLS configuration"))); } } catch (SSLPeerUnverifiedException | CertificateParsingException ce) { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing or unsupported certificate"))); } }  @Override boolean canHandle(Client client, RoutingContext context); @Override void handle(Client client, RoutingContext context, Handler<AsyncResult<Client>> handler); }
ClientCertificateAuthProvider implements ClientAuthProvider { @Override public void handle(Client client, RoutingContext context, Handler<AsyncResult<Client>> handler) { SSLSession sslSession = context.request().sslSession(); try { Certificate[] peerCertificates = sslSession.getPeerCertificates(); X509Certificate peerCertificate = (X509Certificate) peerCertificates[0]; if ((client.getTlsClientAuthSubjectDn() != null && validateSubjectDn(client, peerCertificate)) || (client.getTlsClientAuthSanDns() != null && validateSAN(peerCertificate, GeneralName.dNSName, client.getTlsClientAuthSanDns())) || (client.getTlsClientAuthSanEmail() != null && validateSAN(peerCertificate, GeneralName.rfc822Name, client.getTlsClientAuthSanEmail())) || (client.getTlsClientAuthSanIp() != null && validateSAN(peerCertificate, GeneralName.iPAddress, client.getTlsClientAuthSanIp())) || (client.getTlsClientAuthSanUri() != null && validateSAN(peerCertificate, GeneralName.uniformResourceIdentifier, client.getTlsClientAuthSanUri()))) { handler.handle(Future.succeededFuture(client)); } else { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing TLS configuration"))); } } catch (SSLPeerUnverifiedException | CertificateParsingException ce) { handler.handle(Future.failedFuture(new InvalidClientException("Invalid client: missing or unsupported certificate"))); } }  @Override boolean canHandle(Client client, RoutingContext context); @Override void handle(Client client, RoutingContext context, Handler<AsyncResult<Client>> handler);  }