Examples with RoleToken com.yahoo.athenz.auth.token.RoleToken used on opensource projects

Example 1 with RoleToken

use of com.yahoo.athenz.auth.token.RoleToken in project pulsar by yahoo.

the class AuthenticationProviderAthenz method authenticate.

@Override
public String authenticate(AuthenticationDataSource authData) throws AuthenticationException {
    SocketAddress clientAddress;
    String roleToken;
    if (authData.hasDataFromPeer()) {
        clientAddress = authData.getPeerAddress();
    } else {
        throw new AuthenticationException("Authentication data source does not have a client address");
    }
    if (authData.hasDataFromCommand()) {
        roleToken = authData.getCommandData();
    } else if (authData.hasDataFromHttp()) {
        roleToken = authData.getHttpHeader(AuthZpeClient.ZPE_TOKEN_HDR);
    } else {
        throw new AuthenticationException("Authentication data source does not have a role token");
    }
    if (roleToken == null) {
        throw new AuthenticationException("Athenz token is null, can't authenticate");
    }
    if (roleToken.isEmpty()) {
        throw new AuthenticationException("Athenz RoleToken is empty, Server is Using Athenz Authentication");
    }
    if (log.isDebugEnabled()) {
        log.debug("Athenz RoleToken : [{}] received from Client: {}", roleToken, clientAddress);
    }
    RoleToken token = new RoleToken(roleToken);
    if (!domainNameList.contains(token.getDomain())) {
        throw new AuthenticationException(String.format("Athenz RoleToken Domain mismatch, Expected: %s, Found: %s", domainNameList.toString(), token.getDomain()));
    }
    // Synchronize for non-thread safe static calls inside athenz library
    synchronized (this) {
        PublicKey ztsPublicKey = AuthZpeClient.getZtsPublicKey(token.getKeyId());
        int allowedOffset = 0;
        if (ztsPublicKey == null) {
            throw new AuthenticationException("Unable to retrieve ZTS Public Key");
        }
        if (token.validate(ztsPublicKey, allowedOffset, null)) {
            log.info("Athenz Role Token : {}, Authorized for Client: {}", roleToken, clientAddress);
            return token.getPrincipal();
        } else {
            throw new AuthenticationException(String.format("Athenz Role Token Not Authorized from Client: %s", clientAddress));
        }
    }
}