Examples with PrincipalAuthority com.yahoo.athenz.auth.impl.PrincipalAuthority used on opensource projects

Example 66 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZTSImplTest method testPostInstanceRefreshRequestByUser.

@Test
public void testPostInstanceRefreshRequestByUser() throws IOException {
    ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0");
    DataStore store = new DataStore(structStore, null);
    ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store);
    Path path = Paths.get("src/test/resources/valid_provider_refresh.csr");
    String certCsr = new String(Files.readAllBytes(path));
    InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr).setKeyId("v0");
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user", "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority());
    principal.setKeyId("0");
    String publicKeyName = "athenz.syncer_v0";
    final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n" + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n" + "-----END PUBLIC KEY-----";
    ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey);
    ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class);
    Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true);
    ztsImpl.authorizer = authorizer;
    HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class);
    Mockito.when(servletRequest.isSecure()).thenReturn(true);
    ResourceContext context = createResourceContext(principal, servletRequest);
    Identity identity = ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req);
    assertNotNull(identity);
    assertNotNull(identity.getCertificate());
}

Example 67 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testGetResourceAccessList.

@Test
public void testGetResourceAccessList() {
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx1 = createResourceContext(principal1);
    try {
        zms.getResourceAccessList(rsrcCtx1, "principal", "UPDATE");
    } catch (Exception ex) {
        assertTrue(true);
    }
}

Example 68 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testGetAccess.

@Test
public void testGetAccess() {
    TopLevelDomain dom1 = createTopLevelDomainObject("AccessDom1", "Test Domain1", "testOrg", adminUser);
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    Role role1 = createRoleObject("AccessDom1", "Role1", null, "user.user1", "user.user3");
    zms.putRole(mockDomRsrcCtx, "AccessDom1", "Role1", auditRef, role1);
    Role role2 = createRoleObject("AccessDom1", "Role2", null, "user.user2", "user.user3");
    zms.putRole(mockDomRsrcCtx, "AccessDom1", "Role2", auditRef, role2);
    Policy policy1 = createPolicyObject("AccessDom1", "Policy1", "Role1", "UPDATE", "AccessDom1:resource1", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy1", auditRef, policy1);
    Policy policy2 = createPolicyObject("AccessDom1", "Policy2", "Role2", "CREATE", "AccessDom1:resource2", AssertionEffect.DENY);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy2", auditRef, policy2);
    Policy policy3 = createPolicyObject("AccessDom1", "Policy3", "Role2", "*", "AccessDom1:resource3", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy3", auditRef, policy3);
    Policy policy4 = createPolicyObject("AccessDom1", "Policy4", "Role2", "DELETE", "accessdom1:*", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy4", auditRef, policy4);
    Policy policy5 = createPolicyObject("AccessDom1", "Policy5", "Role1", "READ", "accessdom1:*", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy5", auditRef, policy5);
    Policy policy6 = createPolicyObject("AccessDom1", "Policy6", "Role1", "READ", "AccessDom1:resource6", AssertionEffect.DENY);
    zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy6", auditRef, policy6);
    // user1 and user3 have access to UPDATE/resource1
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx1 = createResourceContext(principal1);
    Principal principal2 = principalAuthority.authenticate("v=U1;d=user;n=user2;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx2 = createResourceContext(principal2);
    Principal principal3 = principalAuthority.authenticate("v=U1;d=user;n=user3;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx3 = createResourceContext(principal3);
    Access access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource1", "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource1", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource1", "AccessDom1", null);
    assertTrue(access.getGranted());
    // same set as before with no trust domain field
    access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource1", null, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource1", null, null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource1", null, null);
    assertTrue(access.getGranted());
    // all three have no access to CREATE action on resource1
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1", "AccessDom1", null);
    assertFalse(access.getGranted());
    // all three have no access to invalid domain name on resource 1
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1", "AccessDom2", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1", "AccessDom2", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1", "AccessDom2", null);
    assertFalse(access.getGranted());
    // same as before with no trust domain field
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1", null, null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1", null, null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1", null, null);
    assertFalse(access.getGranted());
    // all three should have deny access to resource 2
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource2", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource2", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource2", "AccessDom1", null);
    assertFalse(access.getGranted());
    // user2 and user3 have access to CREATE(*)/resource 3
    access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource3", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource3", "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource3", "AccessDom1", null);
    assertTrue(access.getGranted());
    // user2 and user3 have access to UPDATE(*)/resource 3
    access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource3", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource3", "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource3", "AccessDom1", null);
    assertTrue(access.getGranted());
    // user2 and user3 have access to DELETE/resource 4 (*)
    access = zms.getAccess(rsrcCtx1, "DELETE", "AccessDom1:resource4", "AccessDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "DELETE", "AccessDom1:resource4", "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "DELETE", "AccessDom1:resource4", "AccessDom1", null);
    assertTrue(access.getGranted());
    // user1 should be able to read resource 5(*) but not resource 6
    // (explicit DENY)
    access = zms.getAccess(rsrcCtx1, "READ", "AccessDom1:resource5", "AccessDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "READ", "AccessDom1:resource6", "AccessDom1", null);
    assertFalse(access.getGranted());
    try {
        zms.access("READ", "AccessDom1:resource5", principal1, "AccessDom1");
    } catch (ResourceException ex) {
        assertTrue(ex.getCode() == 400);
    }
    zms.deleteTopLevelDomain(mockDomRsrcCtx, "AccessDom1", auditRef);
}

Example 69 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testIsAllowedResourceLookForAllUsers.

@Test
public void testIsAllowedResourceLookForAllUsers() {
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null);
    try {
        zms.isAllowedResourceLookForAllUsers(principal1);
    } catch (Exception ex) {
        assertTrue(true);
    }
}

Example 70 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testGetAccessCrossUser.

@Test
public void testGetAccessCrossUser() {
    TopLevelDomain dom1 = createTopLevelDomainObject("CrossAllowDom1", "Test Domain1", "testOrg", adminUser);
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    Role role1 = createRoleObject("CrossAllowDom1", "Role1", null, "user.user1", "user.user3");
    zms.putRole(mockDomRsrcCtx, "CrossAllowDom1", "Role1", auditRef, role1);
    Role role2 = createRoleObject("CrossAllowDom1", "Role2", null, "user.user2", "user.user3");
    zms.putRole(mockDomRsrcCtx, "CrossAllowDom1", "Role2", auditRef, role2);
    Role role3 = createRoleObject("CrossAllowDom1", "Role3", null, "user.user1", null);
    zms.putRole(mockDomRsrcCtx, "CrossAllowDom1", "Role3", auditRef, role3);
    Policy policy1 = createPolicyObject("CrossAllowDom1", "Policy1", "Role1", "UPDATE", "CrossAllowDom1:resource1", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy1", auditRef, policy1);
    Policy policy2 = createPolicyObject("CrossAllowDom1", "Policy2", "Role2", "CREATE", "CrossAllowDom1:resource2", AssertionEffect.DENY);
    zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy2", auditRef, policy2);
    Policy policy3 = createPolicyObject("CrossAllowDom1", "Policy3", "Role2", "*", "CrossAllowDom1:resource3", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy3", auditRef, policy3);
    Policy policy4 = createPolicyObject("CrossAllowDom1", "Policy4", "Role2", "DELETE", "CrossAllowDom1:*", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy4", auditRef, policy4);
    // verify we have allow access for access resource
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx1 = createResourceContext(principal1);
    Principal principal2 = principalAuthority.authenticate("v=U1;d=user;n=user2;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx2 = createResourceContext(principal2);
    Principal principal3 = principalAuthority.authenticate("v=U1;d=user;n=user3;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx3 = createResourceContext(principal3);
    // user1 and user3 have access to UPDATE/resource1
    Access access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user1");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user1");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user2");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user2");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user3");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user3");
    assertTrue(access.getGranted());
    // all three have no access to CREATE action on resource1
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user1");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user1");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user2");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user2");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user3");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user3");
    assertFalse(access.getGranted());
    // all three have no access to invalid domain name on resource 1
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom2", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom2", "user1");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom2", "user.user1");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "CrossAllowDom1:resource1", "CrossAllowDom2", null);
    assertFalse(access.getGranted());
    // user2 and user3 have access to CREATE(*)/resource 3
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", "user1");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", "user.user1");
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", "user2");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", "user.user2");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", "user3");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", "CrossAllowDom1", "user.user3");
    assertTrue(access.getGranted());
    // user2 and user3 are allowed to check each other's access
    access = zms.getAccess(rsrcCtx2, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user1");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user1");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user1");
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", "CrossAllowDom1:resource1", "CrossAllowDom1", "user.user1");
    assertTrue(access.getGranted());
    zms.deleteTopLevelDomain(mockDomRsrcCtx, "CrossAllowDom1", auditRef);
}