@Test(expected = NotAuthorizedException.class) public void rejectsXfcc_emptyHeader() { when(httpServletRequest.getLocalPort()).thenReturn(xfccAllowedPort); when(securityContext.getUserPrincipal()).thenReturn(xfccPrincipal); when(request.getRequestHeader(ClientAuthFactory.XFCC_HEADER_NAME)).thenReturn(List.of("")); factory.provide(request, httpServletRequest); }
public Client provide(ContainerRequest containerRequest, HttpServletRequest httpServletRequest) { int requestPort = httpServletRequest.getLocalPort(); Optional<XfccSourceConfig> possibleXfccConfig = getXfccConfigForPort(requestPort); List<String> xfccHeaderValues = Optional.ofNullable(containerRequest.getRequestHeader(XFCC_HEADER_NAME)).orElse(List.of()); if (possibleXfccConfig.isEmpty() != xfccHeaderValues.isEmpty()) { throw new NotAuthorizedException(format( "Port %d is configured to %s receive traffic with the %s header set", requestPort, possibleXfccConfig.isEmpty() ? "never" : "only", XFCC_HEADER_NAME)); } Principal requestPrincipal = getPrincipal(containerRequest).orElseThrow( () -> new NotAuthorizedException("Not authorized as Keywhiz client")); if (possibleXfccConfig.isEmpty()) { return authenticateClientFromCertificate(requestPrincipal); } else { return authorizeClientFromXfccHeader(possibleXfccConfig.get(), xfccHeaderValues, requestPrincipal); } }
ClientAuthFactory { public Client provide(ContainerRequest containerRequest, HttpServletRequest httpServletRequest) { int requestPort = httpServletRequest.getLocalPort(); Optional<XfccSourceConfig> possibleXfccConfig = getXfccConfigForPort(requestPort); List<String> xfccHeaderValues = Optional.ofNullable(containerRequest.getRequestHeader(XFCC_HEADER_NAME)).orElse(List.of()); if (possibleXfccConfig.isEmpty() != xfccHeaderValues.isEmpty()) { throw new NotAuthorizedException(format( "Port %d is configured to %s receive traffic with the %s header set", requestPort, possibleXfccConfig.isEmpty() ? "never" : "only", XFCC_HEADER_NAME)); } Principal requestPrincipal = getPrincipal(containerRequest).orElseThrow( () -> new NotAuthorizedException("Not authorized as Keywhiz client")); if (possibleXfccConfig.isEmpty()) { return authenticateClientFromCertificate(requestPrincipal); } else { return authorizeClientFromXfccHeader(possibleXfccConfig.get(), xfccHeaderValues, requestPrincipal); } } }
ClientAuthFactory { public Client provide(ContainerRequest containerRequest, HttpServletRequest httpServletRequest) { int requestPort = httpServletRequest.getLocalPort(); Optional<XfccSourceConfig> possibleXfccConfig = getXfccConfigForPort(requestPort); List<String> xfccHeaderValues = Optional.ofNullable(containerRequest.getRequestHeader(XFCC_HEADER_NAME)).orElse(List.of()); if (possibleXfccConfig.isEmpty() != xfccHeaderValues.isEmpty()) { throw new NotAuthorizedException(format( "Port %d is configured to %s receive traffic with the %s header set", requestPort, possibleXfccConfig.isEmpty() ? "never" : "only", XFCC_HEADER_NAME)); } Principal requestPrincipal = getPrincipal(containerRequest).orElseThrow( () -> new NotAuthorizedException("Not authorized as Keywhiz client")); if (possibleXfccConfig.isEmpty()) { return authenticateClientFromCertificate(requestPrincipal); } else { return authorizeClientFromXfccHeader(possibleXfccConfig.get(), xfccHeaderValues, requestPrincipal); } } @Inject  ClientAuthFactory(ClientDAOFactory clientDAOFactory, KeywhizConfig keywhizConfig); @VisibleForTesting  ClientAuthFactory(ClientDAO clientDAO, ClientAuthConfig clientAuthConfig); }
ClientAuthFactory { public Client provide(ContainerRequest containerRequest, HttpServletRequest httpServletRequest) { int requestPort = httpServletRequest.getLocalPort(); Optional<XfccSourceConfig> possibleXfccConfig = getXfccConfigForPort(requestPort); List<String> xfccHeaderValues = Optional.ofNullable(containerRequest.getRequestHeader(XFCC_HEADER_NAME)).orElse(List.of()); if (possibleXfccConfig.isEmpty() != xfccHeaderValues.isEmpty()) { throw new NotAuthorizedException(format( "Port %d is configured to %s receive traffic with the %s header set", requestPort, possibleXfccConfig.isEmpty() ? "never" : "only", XFCC_HEADER_NAME)); } Principal requestPrincipal = getPrincipal(containerRequest).orElseThrow( () -> new NotAuthorizedException("Not authorized as Keywhiz client")); if (possibleXfccConfig.isEmpty()) { return authenticateClientFromCertificate(requestPrincipal); } else { return authorizeClientFromXfccHeader(possibleXfccConfig.get(), xfccHeaderValues, requestPrincipal); } } @Inject  ClientAuthFactory(ClientDAOFactory clientDAOFactory, KeywhizConfig keywhizConfig); @VisibleForTesting  ClientAuthFactory(ClientDAO clientDAO, ClientAuthConfig clientAuthConfig); Client provide(ContainerRequest containerRequest,
      HttpServletRequest httpServletRequest); }
ClientAuthFactory { public Client provide(ContainerRequest containerRequest, HttpServletRequest httpServletRequest) { int requestPort = httpServletRequest.getLocalPort(); Optional<XfccSourceConfig> possibleXfccConfig = getXfccConfigForPort(requestPort); List<String> xfccHeaderValues = Optional.ofNullable(containerRequest.getRequestHeader(XFCC_HEADER_NAME)).orElse(List.of()); if (possibleXfccConfig.isEmpty() != xfccHeaderValues.isEmpty()) { throw new NotAuthorizedException(format( "Port %d is configured to %s receive traffic with the %s header set", requestPort, possibleXfccConfig.isEmpty() ? "never" : "only", XFCC_HEADER_NAME)); } Principal requestPrincipal = getPrincipal(containerRequest).orElseThrow( () -> new NotAuthorizedException("Not authorized as Keywhiz client")); if (possibleXfccConfig.isEmpty()) { return authenticateClientFromCertificate(requestPrincipal); } else { return authorizeClientFromXfccHeader(possibleXfccConfig.get(), xfccHeaderValues, requestPrincipal); } } @Inject  ClientAuthFactory(ClientDAOFactory clientDAOFactory, KeywhizConfig keywhizConfig); @VisibleForTesting  ClientAuthFactory(ClientDAO clientDAO, ClientAuthConfig clientAuthConfig); Client provide(ContainerRequest containerRequest,
      HttpServletRequest httpServletRequest);  }