use of com.yahoo.athenz.zms.Assertion in project athenz by yahoo.
the class ZTSImplTest method signedBootstrapTenantDomain.
private SignedDomain signedBootstrapTenantDomain(String provider, String domainName, String serviceName, String awsAccount) {
SignedDomain signedDomain = new SignedDomain();
List<Role> roles = new ArrayList<>();
Role role = new Role();
role.setName(generateRoleName(domainName, "providers"));
List<RoleMember> members = new ArrayList<>();
members.add(new RoleMember().setMemberName(provider));
role.setRoleMembers(members);
roles.add(role);
List<com.yahoo.athenz.zms.Policy> policies = new ArrayList<>();
com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy();
com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion();
assertion.setResource(domainName + ":service." + serviceName);
assertion.setAction("launch");
assertion.setRole(generateRoleName(domainName, "providers"));
List<com.yahoo.athenz.zms.Assertion> assertions = new ArrayList<>();
assertions.add(assertion);
policy.setAssertions(assertions);
policy.setName(generatePolicyName(domainName, "providers"));
policies.add(policy);
com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies();
domainPolicies.setDomain(domainName);
domainPolicies.setPolicies(policies);
com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies();
signedPolicies.setContents(domainPolicies);
signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey));
signedPolicies.setKeyId("0");
DomainData domain = new DomainData();
domain.setName(domainName);
domain.setRoles(roles);
domain.setAccount(awsAccount);
domain.setPolicies(signedPolicies);
domain.setModified(Timestamp.fromCurrentTime());
signedDomain.setDomain(domain);
signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey));
signedDomain.setKeyId("0");
return signedDomain;
}
use of com.yahoo.athenz.zms.Assertion in project athenz by yahoo.
the class ZTSImplTest method testEvaluateAccessAssertionDeny.
@Test
public void testEvaluateAccessAssertionDeny() {
DataCache domain = new DataCache();
DomainData domainData = new DomainData();
domainData.setName("coretech");
domain.setDomainData(domainData);
domainData.setRoles(new ArrayList<Role>());
Role role = createRoleObject("coretech", "role1", null, "user_domain.user1", null);
domainData.getRoles().add(role);
Policy policy = new Policy().setName("coretech:policy.policy1");
Assertion assertion = new Assertion();
assertion.setAction("read");
assertion.setEffect(AssertionEffect.DENY);
assertion.setResource("coretech:*");
assertion.setRole("coretech:role.role1");
policy.setAssertions(new ArrayList<Assertion>());
policy.getAssertions().add(assertion);
domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies());
domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies());
domainData.getPolicies().getContents().setPolicies(new ArrayList<Policy>());
domainData.getPolicies().getContents().getPolicies().add(policy);
assertEquals(authorizer.evaluateAccess(domain, "user_domain.user1", "read", "coretech:resource1", null), AccessStatus.DENIED);
}
use of com.yahoo.athenz.zms.Assertion in project athenz by yahoo.
the class DataCacheTest method testPolicyWithInvalidDomainNoRoles.
@Test
public void testPolicyWithInvalidDomainNoRoles() {
Domain domain = new Domain();
domain.setName("testDomain");
Policy policy = new Policy();
policy.setName("testDomain.policy.policy1");
Assertion assertion = new Assertion();
assertion.setAction("assume_role");
assertion.setEffect(AssertionEffect.ALLOW);
assertion.setResource("testDomain.role");
assertion.setRole("testDomain.role.role1");
List<Assertion> assertList = new ArrayList<Assertion>();
assertList.add(assertion);
policy.setAssertions(assertList);
HashMap<String, Role> roleList = new HashMap<>();
DataCache cache = new DataCache();
cache.processPolicy(domain.getName(), policy, roleList);
Set<MemberRole> set1 = cache.getMemberRoleSet("user_domain.user1");
assertNull(set1);
}
use of com.yahoo.athenz.zms.Assertion in project athenz by yahoo.
the class ZTSImplTest method testMatchDelegatedTrustAssertionNoMemberMatch.
@Test
public void testMatchDelegatedTrustAssertionNoMemberMatch() {
Assertion assertion = new Assertion();
assertion.setAction("ASSUME_ROLE");
assertion.setEffect(AssertionEffect.ALLOW);
assertion.setResource("*:role.Role");
assertion.setRole("weather:role.Role");
Role role = null;
List<Role> roles = new ArrayList<>();
role = createRoleObject("weather", "Role1", null, "user_domain.user1", null);
roles.add(role);
role = createRoleObject("weather", "Role", null, "user_domain.user2", null);
roles.add(role);
assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user_domain.user1", roles));
}
use of com.yahoo.athenz.zms.Assertion in project athenz by yahoo.
the class SignUtils method asStruct.
private static Struct asStruct(Policy policy) {
// all of our fields are in canonical order based
// on their attribute name
Struct struct = new Struct();
List<Assertion> assertions = policy.getAssertions();
if (assertions != null && !assertions.isEmpty()) {
Array assertionsArray = new Array();
for (Assertion assertion : assertions) {
Struct structAssertion = new Struct();
appendObject(structAssertion, ATTR_ACTION, assertion.getAction());
appendObject(structAssertion, ATTR_EFFECT, assertion.getEffect());
appendObject(structAssertion, ATTR_RESOURCE, assertion.getResource());
appendObject(structAssertion, ATTR_ROLE, assertion.getRole());
assertionsArray.add(structAssertion);
}
appendArray(struct, ATTR_ASSERTIONS, assertionsArray);
}
appendObject(struct, ATTR_MODIFIED, policy.getModified());
appendObject(struct, ATTR_NAME, policy.getName());
return struct;
}
Aggregations