@Test @RunWithCustomExecutor public void whenNotEnableControlAndIngestExternalThenCheckEmptyContractOK() throws Exception { when(httpServletRequest.getAttribute("javax.servlet.request.X509Certificate")) .thenReturn(new X509Certificate[] {cert}); when(httpServletRequest.getHeader(GlobalDataRest.X_TENANT_ID)).thenReturn(TENANT_ID.toString()); when(internalSecurityClient.findIdentity(any())).thenReturn(getIdentityModel(cert)); when(uriInfo.getPath()).thenReturn("/ingest-external/"); when(adminManagementClient.findContextById(anyString())) .thenReturn(getTestContext(ContextStatus.ACTIVE, false, "notIngestContract", null)); internalSecurityFilter.filter(containerRequestContext); }
@Override public void filter(ContainerRequestContext requestContext) { X509Certificate[] clientCertChain = CertUtils.extractCert(httpServletRequest, true); if (clientCertChain == null || clientCertChain.length < 1) { throw new VitamSecurityException("Request do not contain any X509Certificate "); } int tenantId = Integer.parseInt(httpServletRequest.getHeader(GlobalDataRest.X_TENANT_ID)); String contractId = httpServletRequest.getHeader(GlobalDataRest.X_ACCESS_CONTRAT_ID); if (contractId != null) { contractId = contractId.split(",")[0]; } final String accessContract = contractId; final X509Certificate cert = clientCertChain[0]; try (InternalSecurityClient internalSecurityClient = internalSecurityClientFactory.getClient()) { Optional<IdentityModel> result = internalSecurityClient.findIdentity(cert.getEncoded()); IdentityModel identityModel = result .orElseThrow(() -> new VitamSecurityException("Certificate revoked or not found in database.")); final ContextModel contextModel = getContext(identityModel); String uri = requestContext.getUriInfo().getPath(); if (null == uri) { uri = ""; } if (contextModel.isEnablecontrol() != null && contextModel.isEnablecontrol() && !uri.endsWith(VitamConfiguration.STATUS_URL) && !uri.endsWith(VitamConfiguration.TENANTS_URL)) { if (uri.contains(ACCESS_EXTERNAL)) { verifyAccessContract(tenantId, accessContract, contextModel); } else if (uri.contains(INGEST_EXTERNAL)) { verifyIngestContract(tenantId, contextModel); } else { verifyTenant(tenantId, contextModel); } } VitamThreadUtils.getVitamSession().setContextId(contextModel.getIdentifier()); VitamThreadUtils.getVitamSession() .setSecurityProfileIdentifier(contextModel.getSecurityProfileIdentifier()); } catch (VitamClientInternalException | InternalSecurityException | CertificateEncodingException | VitamSecurityException e) { LOGGER.error("Security Error :", e); final VitamError vitamError = generateVitamError(e); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); } }
InternalSecurityFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) { X509Certificate[] clientCertChain = CertUtils.extractCert(httpServletRequest, true); if (clientCertChain == null || clientCertChain.length < 1) { throw new VitamSecurityException("Request do not contain any X509Certificate "); } int tenantId = Integer.parseInt(httpServletRequest.getHeader(GlobalDataRest.X_TENANT_ID)); String contractId = httpServletRequest.getHeader(GlobalDataRest.X_ACCESS_CONTRAT_ID); if (contractId != null) { contractId = contractId.split(",")[0]; } final String accessContract = contractId; final X509Certificate cert = clientCertChain[0]; try (InternalSecurityClient internalSecurityClient = internalSecurityClientFactory.getClient()) { Optional<IdentityModel> result = internalSecurityClient.findIdentity(cert.getEncoded()); IdentityModel identityModel = result .orElseThrow(() -> new VitamSecurityException("Certificate revoked or not found in database.")); final ContextModel contextModel = getContext(identityModel); String uri = requestContext.getUriInfo().getPath(); if (null == uri) { uri = ""; } if (contextModel.isEnablecontrol() != null && contextModel.isEnablecontrol() && !uri.endsWith(VitamConfiguration.STATUS_URL) && !uri.endsWith(VitamConfiguration.TENANTS_URL)) { if (uri.contains(ACCESS_EXTERNAL)) { verifyAccessContract(tenantId, accessContract, contextModel); } else if (uri.contains(INGEST_EXTERNAL)) { verifyIngestContract(tenantId, contextModel); } else { verifyTenant(tenantId, contextModel); } } VitamThreadUtils.getVitamSession().setContextId(contextModel.getIdentifier()); VitamThreadUtils.getVitamSession() .setSecurityProfileIdentifier(contextModel.getSecurityProfileIdentifier()); } catch (VitamClientInternalException | InternalSecurityException | CertificateEncodingException | VitamSecurityException e) { LOGGER.error("Security Error :", e); final VitamError vitamError = generateVitamError(e); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); } } }
InternalSecurityFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) { X509Certificate[] clientCertChain = CertUtils.extractCert(httpServletRequest, true); if (clientCertChain == null || clientCertChain.length < 1) { throw new VitamSecurityException("Request do not contain any X509Certificate "); } int tenantId = Integer.parseInt(httpServletRequest.getHeader(GlobalDataRest.X_TENANT_ID)); String contractId = httpServletRequest.getHeader(GlobalDataRest.X_ACCESS_CONTRAT_ID); if (contractId != null) { contractId = contractId.split(",")[0]; } final String accessContract = contractId; final X509Certificate cert = clientCertChain[0]; try (InternalSecurityClient internalSecurityClient = internalSecurityClientFactory.getClient()) { Optional<IdentityModel> result = internalSecurityClient.findIdentity(cert.getEncoded()); IdentityModel identityModel = result .orElseThrow(() -> new VitamSecurityException("Certificate revoked or not found in database.")); final ContextModel contextModel = getContext(identityModel); String uri = requestContext.getUriInfo().getPath(); if (null == uri) { uri = ""; } if (contextModel.isEnablecontrol() != null && contextModel.isEnablecontrol() && !uri.endsWith(VitamConfiguration.STATUS_URL) && !uri.endsWith(VitamConfiguration.TENANTS_URL)) { if (uri.contains(ACCESS_EXTERNAL)) { verifyAccessContract(tenantId, accessContract, contextModel); } else if (uri.contains(INGEST_EXTERNAL)) { verifyIngestContract(tenantId, contextModel); } else { verifyTenant(tenantId, contextModel); } } VitamThreadUtils.getVitamSession().setContextId(contextModel.getIdentifier()); VitamThreadUtils.getVitamSession() .setSecurityProfileIdentifier(contextModel.getSecurityProfileIdentifier()); } catch (VitamClientInternalException | InternalSecurityException | CertificateEncodingException | VitamSecurityException e) { LOGGER.error("Security Error :", e); final VitamError vitamError = generateVitamError(e); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); } } InternalSecurityFilter(); @VisibleForTesting  InternalSecurityFilter(HttpServletRequest httpServletRequest,
        InternalSecurityClientFactory internalSecurityClientFactory,
        AdminManagementClientFactory adminManagementClientFactory); }
InternalSecurityFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) { X509Certificate[] clientCertChain = CertUtils.extractCert(httpServletRequest, true); if (clientCertChain == null || clientCertChain.length < 1) { throw new VitamSecurityException("Request do not contain any X509Certificate "); } int tenantId = Integer.parseInt(httpServletRequest.getHeader(GlobalDataRest.X_TENANT_ID)); String contractId = httpServletRequest.getHeader(GlobalDataRest.X_ACCESS_CONTRAT_ID); if (contractId != null) { contractId = contractId.split(",")[0]; } final String accessContract = contractId; final X509Certificate cert = clientCertChain[0]; try (InternalSecurityClient internalSecurityClient = internalSecurityClientFactory.getClient()) { Optional<IdentityModel> result = internalSecurityClient.findIdentity(cert.getEncoded()); IdentityModel identityModel = result .orElseThrow(() -> new VitamSecurityException("Certificate revoked or not found in database.")); final ContextModel contextModel = getContext(identityModel); String uri = requestContext.getUriInfo().getPath(); if (null == uri) { uri = ""; } if (contextModel.isEnablecontrol() != null && contextModel.isEnablecontrol() && !uri.endsWith(VitamConfiguration.STATUS_URL) && !uri.endsWith(VitamConfiguration.TENANTS_URL)) { if (uri.contains(ACCESS_EXTERNAL)) { verifyAccessContract(tenantId, accessContract, contextModel); } else if (uri.contains(INGEST_EXTERNAL)) { verifyIngestContract(tenantId, contextModel); } else { verifyTenant(tenantId, contextModel); } } VitamThreadUtils.getVitamSession().setContextId(contextModel.getIdentifier()); VitamThreadUtils.getVitamSession() .setSecurityProfileIdentifier(contextModel.getSecurityProfileIdentifier()); } catch (VitamClientInternalException | InternalSecurityException | CertificateEncodingException | VitamSecurityException e) { LOGGER.error("Security Error :", e); final VitamError vitamError = generateVitamError(e); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); } } InternalSecurityFilter(); @VisibleForTesting  InternalSecurityFilter(HttpServletRequest httpServletRequest,
        InternalSecurityClientFactory internalSecurityClientFactory,
        AdminManagementClientFactory adminManagementClientFactory); @Override void filter(ContainerRequestContext requestContext); void destroy(); }
InternalSecurityFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) { X509Certificate[] clientCertChain = CertUtils.extractCert(httpServletRequest, true); if (clientCertChain == null || clientCertChain.length < 1) { throw new VitamSecurityException("Request do not contain any X509Certificate "); } int tenantId = Integer.parseInt(httpServletRequest.getHeader(GlobalDataRest.X_TENANT_ID)); String contractId = httpServletRequest.getHeader(GlobalDataRest.X_ACCESS_CONTRAT_ID); if (contractId != null) { contractId = contractId.split(",")[0]; } final String accessContract = contractId; final X509Certificate cert = clientCertChain[0]; try (InternalSecurityClient internalSecurityClient = internalSecurityClientFactory.getClient()) { Optional<IdentityModel> result = internalSecurityClient.findIdentity(cert.getEncoded()); IdentityModel identityModel = result .orElseThrow(() -> new VitamSecurityException("Certificate revoked or not found in database.")); final ContextModel contextModel = getContext(identityModel); String uri = requestContext.getUriInfo().getPath(); if (null == uri) { uri = ""; } if (contextModel.isEnablecontrol() != null && contextModel.isEnablecontrol() && !uri.endsWith(VitamConfiguration.STATUS_URL) && !uri.endsWith(VitamConfiguration.TENANTS_URL)) { if (uri.contains(ACCESS_EXTERNAL)) { verifyAccessContract(tenantId, accessContract, contextModel); } else if (uri.contains(INGEST_EXTERNAL)) { verifyIngestContract(tenantId, contextModel); } else { verifyTenant(tenantId, contextModel); } } VitamThreadUtils.getVitamSession().setContextId(contextModel.getIdentifier()); VitamThreadUtils.getVitamSession() .setSecurityProfileIdentifier(contextModel.getSecurityProfileIdentifier()); } catch (VitamClientInternalException | InternalSecurityException | CertificateEncodingException | VitamSecurityException e) { LOGGER.error("Security Error :", e); final VitamError vitamError = generateVitamError(e); requestContext.abortWith( Response.status(vitamError.getHttpCode()).entity(vitamError).type(MediaType.APPLICATION_JSON_TYPE) .build()); } } InternalSecurityFilter(); @VisibleForTesting  InternalSecurityFilter(HttpServletRequest httpServletRequest,
        InternalSecurityClientFactory internalSecurityClientFactory,
        AdminManagementClientFactory adminManagementClientFactory); @Override void filter(ContainerRequestContext requestContext); void destroy(); static final String ACCESS_EXTERNAL; static final String INGEST_EXTERNAL; }