Examples with PrincipalAuthority com.yahoo.athenz.auth.impl.PrincipalAuthority used on opensource projects

Example 71 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testGetAccessWildcard.

@Test
public void testGetAccessWildcard() {
    final String domainName = "WildcardAccessDomain1";
    TopLevelDomain dom1 = createTopLevelDomainObject(domainName, "Test Domain1", "testOrg", adminUser);
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    Role role1 = createRoleObject(domainName, "Role1", null, "user.user1", "user.user3");
    zms.putRole(mockDomRsrcCtx, domainName, "Role1", auditRef, role1);
    Role role2 = createRoleObject(domainName, "Role2", null, "user.*", null);
    zms.putRole(mockDomRsrcCtx, domainName, "Role2", auditRef, role2);
    Role role3 = createRoleObject(domainName, "Role3", null, "*", null);
    zms.putRole(mockDomRsrcCtx, domainName, "Role3", auditRef, role3);
    Policy policy1 = createPolicyObject(domainName, "Policy1", "Role1", "UPDATE", domainName + ":resource1", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, domainName, "Policy1", auditRef, policy1);
    Policy policy2 = createPolicyObject(domainName, "Policy2", "Role2", "CREATE", domainName + ":resource2", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, domainName, "Policy2", auditRef, policy2);
    Policy policy3 = createPolicyObject(domainName, "Policy3", "Role3", "DELETE", domainName + ":resource3", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, domainName, "Policy3", auditRef, policy3);
    // user1 and user3 have access to UPDATE/resource1
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx1 = createResourceContext(principal1);
    Principal principal2 = principalAuthority.authenticate("v=U1;d=user;n=user2;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx2 = createResourceContext(principal2);
    Principal principal3 = principalAuthority.authenticate("v=U1;d=user;n=user3;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx3 = createResourceContext(principal3);
    Principal principal4 = principalAuthority.authenticate("v=U1;d=user1;n=user4;s=signature", "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx4 = createResourceContext(principal4);
    Access access = zms.getAccess(rsrcCtx1, "UPDATE", domainName + ":resource1", domainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "UPDATE", domainName + ":resource1", domainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "UPDATE", domainName + ":resource1", domainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx4, "UPDATE", domainName + ":resource1", domainName, null);
    assertFalse(access.getGranted());
    // all users have access to CREATE/resource2 but not user1 domain user
    access = zms.getAccess(rsrcCtx1, "CREATE", domainName + ":resource2", null, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "CREATE", domainName + ":resource2", null, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "CREATE", domainName + ":resource2", null, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx4, "CREATE", domainName + ":resource2", null, null);
    assertFalse(access.getGranted());
    // everyone has access to DELETE/resource3
    access = zms.getAccess(rsrcCtx1, "DELETE", domainName + ":resource3", domainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx2, "DELETE", domainName + ":resource3", domainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx3, "DELETE", domainName + ":resource3", domainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccess(rsrcCtx4, "DELETE", domainName + ":resource3", domainName, null);
    assertTrue(access.getGranted());
    zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef);
}

Example 72 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testGetProviderClient.

@Test
public void testGetProviderClient() {
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null);
    try {
        zms.setProviderClientClass(null);
        zms.getProviderClient("localhost/zms", principal1);
    } catch (Exception ex) {
        assertTrue(true);
    }
}

Example 73 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testRetrieveAccessDomainMismatch.

@Test
public void testRetrieveAccessDomainMismatch() {
    System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "true");
    ZMSImpl zmsTest = zmsInit();
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal = SimplePrincipal.create("user", "user2", "v=U1;d=user;n=user2;s=signature", 0, principalAuthority);
    AthenzDomain athenzDomain = zmsTest.retrieveAccessDomain("user.user1", principal);
    assertNull(athenzDomain);
    System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN);
}

Example 74 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testGetUserTokenBadAuthority.

@Test
public void testGetUserTokenBadAuthority() {
    int code = 401;
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", 0, principalAuthority);
    ResourceContext rsrcCtx1 = createResourceContext(principal);
    try {
        zms.getUserToken(rsrcCtx1, "user1", null, null);
        fail("unauthorizederror not thrown.");
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), code);
    }
}

Example 75 with PrincipalAuthority

use of com.yahoo.athenz.auth.impl.PrincipalAuthority in project athenz by yahoo.

the class ZMSImplTest method testProviderResourceGroupRolesWithAuthorizedServiceNoAccess.

@Test
public void testProviderResourceGroupRolesWithAuthorizedServiceNoAccess() {
    TestAuditLogger alogger = new TestAuditLogger();
    String storeFile = ZMS_DATA_STORE_FILE + "_putprovrsrcdomnoaccess";
    ZMSImpl zmsImpl = getZmsImpl(storeFile, alogger);
    String tenantDomain = "provrscgrprolesauthorizedservicenoaccess";
    String providerService = "index";
    String providerDomain = "coretech";
    String resourceGroup = "hockey";
    setupTenantDomainProviderService(zmsImpl, tenantDomain, providerDomain, providerService, "http://localhost:8090/tableprovider");
    // tenant is setup so let's setup up policy to authorize access to tenants
    // without this role/policy we won't be authorized to add tenant roles
    // to the provider domain even with authorized service details
    Role role = createRoleObject(providerDomain, "self_serve", null, providerDomain + "." + providerService, null);
    zmsImpl.putRole(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, role);
    Policy policy = createPolicyObject(providerDomain, "self_serve", "self_serve", "update", providerDomain + ":tenant.*", AssertionEffect.ALLOW);
    zmsImpl.putPolicy(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, policy);
    // now we're going to setup our provider role call
    List<TenantRoleAction> roleActions = new ArrayList<TenantRoleAction>();
    for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) {
        roleActions.add(new TenantRoleAction().setRole(f.name()).setAction((String) f.value()));
    }
    ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles().setDomain(providerDomain).setService(providerService).setTenant(tenantDomain).setRoles(roleActions).setResourceGroup(resourceGroup);
    // we are going to create a principal object with authorized service
    // set to coretech.index
    String userId = "user1";
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    String unsignedCreds = "v=U1;d=user;n=" + userId;
    Principal principal = SimplePrincipal.create("user", userId, unsignedCreds + ";s=signature", 0, principalAuthority);
    ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds);
    ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds);
    ((SimplePrincipal) principal).setAuthorizedService("coretech.index");
    ResourceContext ctx = createResourceContext(principal);
    try {
        zmsImpl.putProviderResourceGroupRoles(ctx, tenantDomain, providerDomain, providerService, resourceGroup, auditRef, providerRoles);
        fail();
    } catch (ResourceException ex) {
        assertEquals(403, ex.getCode());
    }
    // clean up our domains
    zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef);
    zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef);
    FileConnection.deleteDirectory(new File("/tmp/zms_core_unit_tests/" + storeFile));
}