Examples with Principal com.yahoo.athenz.auth.Principal used on opensource projects

Example 61 with Principal

use of com.yahoo.athenz.auth.Principal in project athenz by yahoo.

the class ZTSImplTest method testGetRoleTokenProxyUser.

@Test
public void testGetRoleTokenProxyUser() {
    List<RoleMember> writers = new ArrayList<>();
    writers.add(new RoleMember().setMemberName("user_domain.proxy-user1"));
    writers.add(new RoleMember().setMemberName("user_domain.joe"));
    List<RoleMember> readers = new ArrayList<>();
    readers.add(new RoleMember().setMemberName("user_domain.proxy-user2"));
    readers.add(new RoleMember().setMemberName("user_domain.jane"));
    SignedDomain signedDomain = createSignedDomain("coretech-proxy2", "weather-proxy2", "storage", writers, readers, true);
    store.processDomain(signedDomain, false);
    Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null);
    ResourceContext context = createResourceContext(principal);
    RoleToken roleToken = zts.getRoleToken(context, "coretech-proxy2", null, Integer.valueOf(600), Integer.valueOf(1200), "user_domain.joe");
    com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken());
    assertEquals(token.getRoles().size(), 1);
    assertTrue(token.getRoles().contains("writers"));
    assertTrue(roleToken.getToken().contains(";h=localhost;"));
    assertTrue(roleToken.getToken().contains(";i=10.11.12.13"));
    assertTrue(roleToken.getToken().contains(";p=user_domain.joe;"));
    assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user1;"));
    assertEquals(roleToken.getExpiryTime(), token.getExpiryTime());
    principal = SimplePrincipal.create("user_domain", "proxy-user2", "v=U1;d=user_domain;n=proxy-user2;s=sig", 0, null);
    context = createResourceContext(principal);
    roleToken = zts.getRoleToken(context, "coretech-proxy2", null, Integer.valueOf(600), Integer.valueOf(1200), "user_domain.jane");
    token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken());
    assertEquals(token.getRoles().size(), 1);
    assertTrue(token.getRoles().contains("readers"));
    assertTrue(roleToken.getToken().contains(";h=localhost;"));
    assertTrue(roleToken.getToken().contains(";i=10.11.12.13"));
    assertTrue(roleToken.getToken().contains(";p=user_domain.jane;"));
    assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user2;"));
    assertEquals(roleToken.getExpiryTime(), token.getExpiryTime());
}

Example 62 with Principal

use of com.yahoo.athenz.auth.Principal in project athenz by yahoo.

the class ZTSImplTest method testGetRoleTokenProxyUserSpecificRole.

@Test
public void testGetRoleTokenProxyUserSpecificRole() {
    List<RoleMember> writers = new ArrayList<>();
    writers.add(new RoleMember().setMemberName("user_domain.proxy-user1"));
    writers.add(new RoleMember().setMemberName("user_domain.joe"));
    List<RoleMember> readers = new ArrayList<>();
    readers.add(new RoleMember().setMemberName("user_domain.proxy-user2"));
    readers.add(new RoleMember().setMemberName("user_domain.jane"));
    readers.add(new RoleMember().setMemberName("user_domain.proxy-user1"));
    SignedDomain signedDomain = createSignedDomain("coretech-proxy4", "weather-proxy4", "storage", writers, readers, true);
    store.processDomain(signedDomain, false);
    Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null);
    ResourceContext context = createResourceContext(principal);
    RoleToken roleToken = zts.getRoleToken(context, "coretech-proxy4", "writers", Integer.valueOf(600), Integer.valueOf(1200), "user_domain.joe");
    com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken());
    assertEquals(token.getRoles().size(), 1);
    assertTrue(token.getRoles().contains("writers"));
    assertTrue(roleToken.getToken().contains(";h=localhost;"));
    assertTrue(roleToken.getToken().contains(";i=10.11.12.13"));
    assertTrue(roleToken.getToken().contains(";p=user_domain.joe;"));
    assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user1;"));
    assertEquals(roleToken.getExpiryTime(), token.getExpiryTime());
}

Example 63 with Principal

use of com.yahoo.athenz.auth.Principal in project athenz by yahoo.

the class ZTSImplTest method testGetAWSTemporaryCredentialsNoAwsAccount.

@Test
public void testGetAWSTemporaryCredentialsNoAwsAccount() {
    Principal principal = SimplePrincipal.create("user_domain", "user101", "v=U1;d=user_domain;n=user101;s=signature", 0, null);
    CloudStore cloudStore = new MockCloudStore();
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null);
    store.processDomain(signedDomain, false);
    try {
        zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
    }
}

Example 64 with Principal

use of com.yahoo.athenz.auth.Principal in project athenz by yahoo.

the class ZTSImplTest method testPostDomainMetrics.

@Test
public void testPostDomainMetrics() {
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", false);
    store.processDomain(signedDomain, false);
    Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    // create zts with a metric we can verify
    CloudStore cloudStore = new CloudStore(null);
    cloudStore.setHttpClient(null);
    ZtsMetricTester metric = new ZtsMetricTester();
    ZTSImpl ztsImpl = new ZTSImpl(cloudStore, store);
    ZTSImpl.serverHostName = "localhost";
    ztsImpl.metric = metric;
    String testDomain = "coretech";
    // create some metrics
    List<DomainMetric> metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(99));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(27));
    DomainMetrics req = new DomainMetrics().setDomainName(testDomain).setMetricList(metricList);
    // send the metrics
    ztsImpl.postDomainMetrics(context, testDomain, req);
    // verify metrics were recorded
    Map<String, Integer> metrixMap = metric.getMap();
    String key = "dom_metric_" + DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH.toString().toLowerCase() + testDomain;
    Integer val = metrixMap.get(key);
    assertNotNull(val);
    assertEquals(val.intValue(), 99);
    key = "dom_metric_" + DomainMetricType.ACCESS_ALLOWED.toString().toLowerCase() + testDomain;
    val = metrixMap.get(key);
    assertNotNull(val);
    assertEquals(val.intValue(), 27);
    // test - failure case - invalid domain
    testDomain = "not_coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setDomainName(testDomain).setMetricList(metricList);
    // send the metrics
    metrixMap.clear();
    String errMsg = "No such domain";
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 404);
        assertTrue(ex.getMessage().contains(errMsg));
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - missing domain name in metric data
    testDomain = "coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setMetricList(metricList);
    errMsg = "Missing required field: domainName";
    // send the metrics
    metrixMap.clear();
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains(errMsg), ex.getMessage());
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - mismatch domain in uri and metric data
    testDomain = "coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setDomainName("not_coretech").setMetricList(metricList);
    errMsg = "mismatched domain names";
    // send the metrics
    metrixMap.clear();
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains(errMsg), ex.getMessage());
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - empty metric list
    testDomain = "coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setDomainName(testDomain);
    errMsg = "Missing required field: metricList";
    // send the metrics
    metrixMap.clear();
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains(errMsg), ex.getMessage());
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - metric count is missing
    testDomain = "coretech";
    // create a single metric without a count
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(-1));
    req = new DomainMetrics().setDomainName(testDomain).setMetricList(metricList);
    // verify no metrics were recorded
    metrixMap.clear();
    ztsImpl.postDomainMetrics(context, testDomain, req);
    assertEquals(metrixMap.size(), 0);
}

Example 65 with Principal

use of com.yahoo.athenz.auth.Principal in project athenz by yahoo.

the class ZTSImplTest method testGetRoleTokenSpecifiedRoleNoMatch.

@Test
public void testGetRoleTokenSpecifiedRoleNoMatch() {
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processDomain(signedDomain, false);
    Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    try {
        zts.getRoleToken(context, "coretech", "updaters", Integer.valueOf(600), Integer.valueOf(1200), null);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
}