Examples with Authority com.yahoo.athenz.auth.Authority used on opensource projects

Example 91 with Authority

use of com.yahoo.athenz.auth.Authority in project athenz by yahoo.

the class HttpTest method testAuthenticateHeaderFailureMultipleAuth.

@Test
public void testAuthenticateHeaderFailureMultipleAuth() {
    HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class);
    Http.AuthorityList authorities = new Http.AuthorityList();
    Authority authority1 = Mockito.mock(Authority.class);
    Mockito.when(authority1.getCredSource()).thenReturn(CredSource.HEADER);
    Mockito.when(authority1.getHeader()).thenReturn("Cookie.hogehoge");
    Mockito.when(authority1.getAuthenticateChallenge()).thenReturn("Basic realm=\"athenz\"");
    authorities.add(authority1);
    Authority authority2 = Mockito.mock(Authority.class);
    Mockito.when(authority2.getCredSource()).thenReturn(CredSource.REQUEST);
    Mockito.when(authority2.getAuthenticateChallenge()).thenReturn("AthenzRequest realm=\"athenz\"");
    authorities.add(authority2);
    try {
        Http.authenticate(httpServletRequest, authorities);
    } catch (ResourceException expected) {
        assertEquals(expected.getCode(), 401);
    }
    Set<String> challenges = new HashSet<>();
    challenges.add("Basic realm=\"athenz\"");
    challenges.add("AthenzRequest realm=\"athenz\"");
    Mockito.verify(httpServletRequest, times(1)).setAttribute("com.yahoo.athenz.auth.credential.challenges", challenges);
}

Example 92 with Authority

use of com.yahoo.athenz.auth.Authority in project athenz by yahoo.

the class HttpTest method testAuthorizedUser.

@Test
public void testAuthorizedUser() {
    HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class);
    Principal principal = Mockito.mock(Principal.class);
    Mockito.when(principal.getFullName()).thenReturn("athenz.api");
    Authorizer authorizer = Mockito.mock(Authorizer.class);
    Mockito.when(authorizer.access(ArgumentMatchers.any(), ArgumentMatchers.any(), ArgumentMatchers.any(Principal.class), ArgumentMatchers.any())).thenReturn(true);
    Authority authority = Mockito.mock(Authority.class);
    Mockito.when(authority.getCredSource()).thenReturn(Authority.CredSource.HEADER);
    Mockito.when(authority.getHeader()).thenReturn("Athenz-Principal-Auth");
    Mockito.when(httpServletRequest.getHeader("Athenz-Principal-Auth")).thenReturn("Creds");
    Mockito.when(authority.authenticate(ArgumentMatchers.any(), ArgumentMatchers.any(), ArgumentMatchers.any(), ArgumentMatchers.any())).thenReturn(principal);
    Http.AuthorityList authorities = new Http.AuthorityList();
    authorities.add(authority);
    assertEquals("athenz.api", Http.authorizedUser(httpServletRequest, authorities, authorizer, "action", "resource", null));
}

Example 93 with Authority

use of com.yahoo.athenz.auth.Authority in project athenz by yahoo.

the class ZTSImplTest method getResourceAccessWithDelegatedGroups.

private void getResourceAccessWithDelegatedGroups(boolean wildCardRole, boolean wildCardDomain) {
    final String domainName1 = "access-domain-delegated-group1";
    final String domainName2 = "access-domain-delegated-group2";
    final String groupName1 = "group1";
    final String groupName2 = "group2";
    final String roleName1 = "role1";
    final String policyName1 = "policy1";
    List<Role> roles1 = new ArrayList<>();
    Role role1 = ZTSTestUtils.createRoleObject(domainName1, roleName1, "user.jane", "user.joey");
    role1.getRoleMembers().add(new RoleMember().setMemberName(ResourceUtils.groupResourceName(domainName1, groupName1)));
    role1.getRoleMembers().add(new RoleMember().setMemberName(ResourceUtils.groupResourceName(domainName1, groupName2)).setExpiration(Timestamp.fromMillis(100000)));
    roles1.add(role1);
    List<Group> groups1 = new ArrayList<>();
    Group group1 = ZTSTestUtils.createGroupObject(domainName1, groupName1, "user.john");
    groups1.add(group1);
    Group group2 = ZTSTestUtils.createGroupObject(domainName1, groupName2, "user.joe");
    groups1.add(group2);
    List<Policy> policies1 = new ArrayList<>();
    final String assumeRoleResource = ZTSTestUtils.getAssumeRoleResource(domainName2, roleName1, wildCardRole, wildCardDomain);
    Policy policy1 = ZTSTestUtils.createPolicyObject(domainName1, policyName1, roleName1, true, "assume_role", assumeRoleResource, AssertionEffect.ALLOW);
    policies1.add(policy1);
    List<Role> roles2 = new ArrayList<>();
    Role role2 = ZTSTestUtils.createRoleObject(domainName2, roleName1, domainName1, null);
    roles2.add(role2);
    List<Policy> policies2 = new ArrayList<>();
    Policy policy2 = ZTSTestUtils.createPolicyObject(domainName2, policyName1, roleName1, true, "update", domainName2 + ":resource1", AssertionEffect.ALLOW);
    policies2.add(policy2);
    SignedDomain signedDomain1 = ZTSTestUtils.createSignedDomain(domainName1, roles1, policies1, null, groups1, privateKey);
    store.processSignedDomain(signedDomain1, false);
    SignedDomain signedDomain2 = ZTSTestUtils.createSignedDomain(domainName2, roles2, policies2, null, null, privateKey);
    store.processSignedDomain(signedDomain2, false);
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", 0, principalAuthority);
    ResourceContext context = createResourceContext(principal, null);
    // role1 - jane & joey have regular role access, john (grp1), joe (grp2 but expired).
    ResourceAccess access = zts.getResourceAccess(context, "update", domainName2 + ":resource1", null, "user.jane");
    assertTrue(access.getGranted());
    access = zts.getResourceAccess(context, "update", domainName2 + ":resource1", null, "user.joey");
    assertTrue(access.getGranted());
    access = zts.getResourceAccess(context, "update", domainName2 + ":resource1", null, "user.john");
    assertTrue(access.getGranted());
    access = zts.getResourceAccess(context, "update", domainName2 + ":resource1", null, "user.joe");
    assertFalse(access.getGranted());
    // role access against the trusted domain
    RoleAccess roleAccess = zts.getRoleAccess(context, domainName2, "user.jane");
    assertEquals(roleAccess.getRoles().size(), 1);
    assertTrue(roleAccess.getRoles().contains("role1"));
    roleAccess = zts.getRoleAccess(context, domainName2, "user.joey");
    assertEquals(roleAccess.getRoles().size(), 1);
    assertTrue(roleAccess.getRoles().contains("role1"));
    roleAccess = zts.getRoleAccess(context, domainName2, "user.john");
    assertEquals(roleAccess.getRoles().size(), 1);
    assertTrue(roleAccess.getRoles().contains("role1"));
    roleAccess = zts.getRoleAccess(context, domainName2, "user.joe");
    assertTrue(roleAccess.getRoles().isEmpty());
    // role access against the domain itself
    roleAccess = zts.getRoleAccess(context, domainName1, "user.jane");
    assertEquals(roleAccess.getRoles().size(), 1);
    assertTrue(roleAccess.getRoles().contains("role1"));
    roleAccess = zts.getRoleAccess(context, domainName1, "user.joey");
    assertEquals(roleAccess.getRoles().size(), 1);
    assertTrue(roleAccess.getRoles().contains("role1"));
    roleAccess = zts.getRoleAccess(context, domainName1, "user.john");
    assertEquals(roleAccess.getRoles().size(), 1);
    assertTrue(roleAccess.getRoles().contains("role1"));
    roleAccess = zts.getRoleAccess(context, domainName1, "user.joe");
    assertTrue(roleAccess.getRoles().isEmpty());
    store.getCacheStore().invalidate(domainName1);
    store.getCacheStore().invalidate(domainName2);
}

Example 94 with Authority

use of com.yahoo.athenz.auth.Authority in project athenz by yahoo.

the class RsrcCtxWrapperTest method testAuthorizeMtlsRestricted.

@Test
public void testAuthorizeMtlsRestricted() {
    HttpServletRequest reqMock = Mockito.mock(HttpServletRequest.class);
    HttpServletResponse resMock = Mockito.mock(HttpServletResponse.class);
    AuthorityList authListMock = new AuthorityList();
    Authorizer authorizerMock = Mockito.mock(Authorizer.class);
    Authority authMock = Mockito.mock(Authority.class);
    Metric metricMock = Mockito.mock(Metric.class);
    Object timerMetricMock = Mockito.mock(Object.class);
    Principal prin = Mockito.mock(Principal.class);
    Mockito.when(prin.getMtlsRestricted()).thenReturn(true);
    Mockito.when(authMock.getHeader()).thenReturn("testheader");
    Mockito.when(reqMock.getHeader("testheader")).thenReturn("testcred");
    Mockito.when(authMock.getCredSource()).thenReturn(com.yahoo.athenz.auth.Authority.CredSource.HEADER);
    Mockito.when(authMock.authenticate(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any())).thenReturn(prin);
    Mockito.when(reqMock.getRemoteAddr()).thenReturn("1.1.1.1");
    Mockito.when(reqMock.getMethod()).thenReturn("POST");
    authListMock.add(authMock);
    // force true access right
    Mockito.when(authorizerMock.access(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any())).thenReturn(true);
    RsrcCtxWrapper wrapper = new RsrcCtxWrapper(reqMock, resMock, authListMock, false, authorizerMock, metricMock, timerMetricMock, "apiName");
    try {
        wrapper.authorize("add-domain", "test", "test");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getMessage(), "ResourceException (403): {code: 403, message: \"mTLS Restricted\"}");
        assertEquals(ex.getCode(), 403);
    }
}

Example 95 with Authority

use of com.yahoo.athenz.auth.Authority in project athenz by yahoo.

the class RsrcCtxWrapperTest method testRsrcCtxWrapperSimpleAssertionMtlsRestricted.

@Test
public void testRsrcCtxWrapperSimpleAssertionMtlsRestricted() {
    HttpServletRequest reqMock = Mockito.mock(HttpServletRequest.class);
    HttpServletResponse resMock = Mockito.mock(HttpServletResponse.class);
    AuthorityList authListMock = new AuthorityList();
    Authorizer authorizerMock = Mockito.mock(Authorizer.class);
    Authority authMock = Mockito.mock(Authority.class);
    Metric metricMock = Mockito.mock(Metric.class);
    Object timerMetricMock = Mockito.mock(Object.class);
    Principal prin = Mockito.mock(Principal.class);
    Mockito.when(prin.getMtlsRestricted()).thenReturn(true);
    Mockito.when(authMock.getHeader()).thenReturn("testheader");
    Mockito.when(reqMock.getHeader("testheader")).thenReturn("testcred");
    Mockito.when(authMock.getCredSource()).thenReturn(com.yahoo.athenz.auth.Authority.CredSource.HEADER);
    Mockito.when(authMock.authenticate(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any())).thenReturn(prin);
    Mockito.when(reqMock.getRemoteAddr()).thenReturn("1.1.1.1");
    Mockito.when(reqMock.getMethod()).thenReturn("POST");
    authListMock.add(authMock);
    RsrcCtxWrapper wrapper = new RsrcCtxWrapper(reqMock, resMock, authListMock, false, authorizerMock, metricMock, timerMetricMock, "apiName");
    assertNotNull(wrapper.context());
    // default principal should be null
    assertNull(wrapper.principal());
    assertEquals(wrapper.request(), reqMock);
    assertEquals(wrapper.response(), resMock);
    assertEquals(wrapper.getApiName(), "apiname");
    assertEquals(wrapper.getHttpMethod(), "POST");
    try {
        wrapper.authenticate();
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getMessage(), "ResourceException (401): {code: 401, message: \"certificate is mTLS restricted\"}");
        assertEquals(ex.getCode(), 401);
    }
}