Examples with X509CertRecord com.yahoo.athenz.common.server.cert.X509CertRecord used on opensource projects

Example 26 with X509CertRecord

use of com.yahoo.athenz.common.server.cert.X509CertRecord in project athenz by yahoo.

the class CertFailedRefreshNotificationTask method getNotificationDetails.

private Map<String, String> getNotificationDetails(String domainName, List<X509CertRecord> certRecords) {
    Map<String, String> details = new HashMap<>();
    // each domain can have multiple certificates that failed to refresh.
    // we're going to collect them into one
    // string and separate with | between those. The format will be:
    // certificateRecords := <certificate-entry>[|<certificate-entry]*
    // certificate-entry := <Service Name>;<Provider>;<InstanceID>;<Last refresh time>;<Expiration time>;<Hostname>;
    StringBuilder certDetails = new StringBuilder(256);
    for (X509CertRecord certRecord : certRecords) {
        if (certDetails.length() != 0) {
            certDetails.append('|');
        }
        String expiryTime = getTimestampAsString(certRecord.getExpiryTime());
        String hostName = certRecord.getHostName();
        certDetails.append(AthenzUtils.extractPrincipalServiceName(certRecord.getService())).append(';').append(certRecord.getProvider()).append(';').append(certRecord.getInstanceId()).append(';').append(getTimestampAsString(certRecord.getCurrentTime())).append(';').append(expiryTime).append(';').append(hostName);
    }
    details.put(NOTIFICATION_DETAILS_UNREFRESHED_CERTS, certDetails.toString());
    details.put(NOTIFICATION_DETAILS_DOMAIN, domainName);
    return details;
}

Example 27 with X509CertRecord

use of com.yahoo.athenz.common.server.cert.X509CertRecord in project athenz by yahoo.

the class CertFailedRefreshNotificationTask method getDomainToCertRecordsMap.

private Map<String, List<X509CertRecord>> getDomainToCertRecordsMap(List<X509CertRecord> unrefreshedRecords) {
    Map<String, List<X509CertRecord>> domainToCertRecords = new HashMap<>();
    for (X509CertRecord x509CertRecord : unrefreshedRecords) {
        String domainName = AthenzUtils.extractPrincipalDomainName(x509CertRecord.getService());
        LOGGER.info("processing domain={}, hostName={}", domainName, x509CertRecord.getHostName());
        domainToCertRecords.putIfAbsent(domainName, new ArrayList<>());
        domainToCertRecords.get(domainName).add(x509CertRecord);
    }
    return domainToCertRecords;
}

Example 28 with X509CertRecord

use of com.yahoo.athenz.common.server.cert.X509CertRecord in project athenz by yahoo.

the class ZTSImplTest method testProcessCertRecordChange.

@Test
public void testProcessCertRecordChange() {
    X509CertRecord certRecord = new X509CertRecord();
    certRecord.setCurrentIP("10.10.11.12");
    certRecord.setHostName("host1.localhost");
    certRecord.setSvcDataUpdateTime(null);
    zts.processCertRecordChange(certRecord, "10.10.11.12", "host1.localhost");
    assertNull(certRecord.getSvcDataUpdateTime());
    zts.processCertRecordChange(certRecord, "10.10.11.13", "host1.localhost");
    assertNotNull(certRecord.getSvcDataUpdateTime());
    certRecord.setSvcDataUpdateTime(null);
    zts.processCertRecordChange(certRecord, "10.10.11.12", "host2.localhost");
    assertNotNull(certRecord.getSvcDataUpdateTime());
}

Example 29 with X509CertRecord

use of com.yahoo.athenz.common.server.cert.X509CertRecord in project athenz by yahoo.

the class ZTSImplTest method testPostInstanceRefreshInformationInvalidCSR.

@Test
public void testPostInstanceRefreshInformationInvalidCSR() {
    ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0");
    DataStore store = new DataStore(structStore, null, ztsMetric);
    ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store);
    SignedDomain providerDomain = signedAuthorizedProviderDomain();
    store.processSignedDomain(providerDomain, false);
    SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production");
    store.processSignedDomain(tenantDomain, false);
    InstanceCertManager instanceManager = Mockito.spy(ztsImpl.instanceCertManager);
    X509CertRecord certRecord = new X509CertRecord();
    certRecord.setInstanceId("1001");
    certRecord.setProvider("athenz.provider");
    certRecord.setService("athenz.production");
    certRecord.setCurrentSerial("16503746516960996918");
    certRecord.setPrevSerial("16503746516960996918");
    Mockito.when(instanceManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")).thenReturn(certRecord);
    ztsImpl.instanceCertManager = instanceManager;
    InstanceRefreshInformation info = new InstanceRefreshInformation().setCsr("csr");
    CertificateAuthority certAuthority = new CertificateAuthority();
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority);
    ResourceContext context = createResourceContext(principal);
    try {
        ztsImpl.postInstanceRefreshInformation(context, "athenz.provider", "athenz", "production", "1001", info);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains("unable to parse PKCS10 CSR"));
    }
}

Example 30 with X509CertRecord

use of com.yahoo.athenz.common.server.cert.X509CertRecord in project athenz by yahoo.

the class DynamoDBCertRecordStoreConnectionTest method testUpdateX509RecordNullableColumns.

@Test
public void testUpdateX509RecordNullableColumns() {
    DynamoDBCertRecordStoreConnection dbConn = getDBConnection();
    Date now = new Date();
    X509CertRecord certRecord = getRecordNonNullableColumns(now);
    certRecord.setLastNotifiedTime(null);
    certRecord.setLastNotifiedServer(null);
    certRecord.setExpiryTime(now);
    certRecord.setHostName(null);
    certRecord.setSvcDataUpdateTime(now);
    UpdateItemSpec item = new UpdateItemSpec().withPrimaryKey("primaryKey", "athenz.provider:cn:1234").withAttributeUpdate(new AttributeUpdate("instanceId").put(certRecord.getInstanceId()), new AttributeUpdate("provider").put(certRecord.getProvider()), new AttributeUpdate("service").put(certRecord.getService()), new AttributeUpdate("currentSerial").put(certRecord.getCurrentSerial()), new AttributeUpdate("currentIP").put(certRecord.getCurrentIP()), new AttributeUpdate("currentTime").put(certRecord.getCurrentTime().getTime()), new AttributeUpdate("currentDate").put(DynamoDBUtils.getIso8601FromDate(certRecord.getCurrentTime())), new AttributeUpdate("prevSerial").put(certRecord.getPrevSerial()), new AttributeUpdate("prevIP").put(certRecord.getPrevIP()), new AttributeUpdate("prevTime").put(certRecord.getPrevTime().getTime()), new AttributeUpdate("clientCert").put(certRecord.getClientCert()), new AttributeUpdate("ttl").put(certRecord.getCurrentTime().getTime() / 1000L + 3660 * 720), new AttributeUpdate("svcDataUpdateTime").put(certRecord.getSvcDataUpdateTime().getTime()), new AttributeUpdate("expiryTime").put(null));
    Mockito.doReturn(updateOutcome).when(table).updateItem(item);
    boolean requestSuccess = dbConn.updateX509CertRecord(certRecord);
    assertTrue(requestSuccess);
    dbConn.close();
}