Examples with CloudStore com.yahoo.athenz.zts.store.CloudStore used on opensource projects

Example 1 with CloudStore

use of com.yahoo.athenz.zts.store.CloudStore in project athenz by yahoo.

the class ZTSImplTest method testGetAWSTemporaryCredentials.

@Test
public void testGetAWSTemporaryCredentials() {
    Principal principal = SimplePrincipal.create("user_domain", "user101", "v=U1;d=user_domain;n=user101;s=signature", 0, null);
    CloudStore cloudStore = new MockCloudStore();
    ((MockCloudStore) cloudStore).setMockFields("1234", "aws_role_name", "user_domain.user101");
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234");
    store.processDomain(signedDomain, false);
    AWSTemporaryCredentials creds = zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name");
    assertNotNull(creds);
    try {
        ((MockCloudStore) cloudStore).setMockFields("1234", "aws_role2_name", "user_domain.user101");
        zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
    }
}

Example 2 with CloudStore

use of com.yahoo.athenz.zts.store.CloudStore in project athenz by yahoo.

the class ZTSImplTest method setup.

@BeforeMethod
public void setup() {
    // we want to make sure we start we clean dir structure
    ZMSFileChangeLogStore.deleteDirectory(new File(ZTS_DATA_STORE_PATH));
    String privKeyName = System.getProperty(FilePrivateKeyStore.ATHENZ_PROP_PRIVATE_KEY);
    File privKeyFile = new File(privKeyName);
    String privKey = Crypto.encodedFile(privKeyFile);
    privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey));
    /* create our data store */
    roleTokenDefaultTimeout = 2400;
    System.setProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_DEFAULT_TIMEOUT, Integer.toString(roleTokenDefaultTimeout));
    roleTokenMaxTimeout = 96000;
    System.setProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_MAX_TIMEOUT, Integer.toString(roleTokenMaxTimeout));
    System.setProperty(ZTSConsts.ZTS_PROP_AUTHORIZED_PROXY_USERS, "user_domain.proxy-user1,user_domain.proxy-user2");
    ChangeLogStore structStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0");
    CloudStore cloudStore = new CloudStore(null);
    cloudStore.setHttpClient(null);
    System.setProperty(ZTSConsts.ZTS_PROP_SELF_SIGNER_PRIVATE_KEY_FNAME, "src/test/resources/private_encrypted.key");
    System.setProperty(ZTSConsts.ZTS_PROP_SELF_SIGNER_PRIVATE_KEY_PASSWORD, "athenz");
    ZMSFileChangeLogStore.deleteDirectory(new File("/tmp/zts_server_cert_store"));
    System.setProperty(ZTSConsts.ZTS_PROP_CERT_FILE_STORE_PATH, "/tmp/zts_server_cert_store");
    store = new DataStore(structStore, cloudStore);
    zts = new ZTSImpl(cloudStore, store);
    ZTSImpl.serverHostName = "localhost";
    authorizer = new ZTSAuthorizer(store);
}

Example 3 with CloudStore

use of com.yahoo.athenz.zts.store.CloudStore in project athenz by yahoo.

the class ZTSImplTest method testGetAWSTemporaryCredentialsNoAwsAccount.

@Test
public void testGetAWSTemporaryCredentialsNoAwsAccount() {
    Principal principal = SimplePrincipal.create("user_domain", "user101", "v=U1;d=user_domain;n=user101;s=signature", 0, null);
    CloudStore cloudStore = new MockCloudStore();
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null);
    store.processDomain(signedDomain, false);
    try {
        zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
    }
}

Example 4 with CloudStore

use of com.yahoo.athenz.zts.store.CloudStore in project athenz by yahoo.

the class ZTSImplTest method testPostDomainMetrics.

@Test
public void testPostDomainMetrics() {
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", false);
    store.processDomain(signedDomain, false);
    Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    // create zts with a metric we can verify
    CloudStore cloudStore = new CloudStore(null);
    cloudStore.setHttpClient(null);
    ZtsMetricTester metric = new ZtsMetricTester();
    ZTSImpl ztsImpl = new ZTSImpl(cloudStore, store);
    ZTSImpl.serverHostName = "localhost";
    ztsImpl.metric = metric;
    String testDomain = "coretech";
    // create some metrics
    List<DomainMetric> metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(99));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(27));
    DomainMetrics req = new DomainMetrics().setDomainName(testDomain).setMetricList(metricList);
    // send the metrics
    ztsImpl.postDomainMetrics(context, testDomain, req);
    // verify metrics were recorded
    Map<String, Integer> metrixMap = metric.getMap();
    String key = "dom_metric_" + DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH.toString().toLowerCase() + testDomain;
    Integer val = metrixMap.get(key);
    assertNotNull(val);
    assertEquals(val.intValue(), 99);
    key = "dom_metric_" + DomainMetricType.ACCESS_ALLOWED.toString().toLowerCase() + testDomain;
    val = metrixMap.get(key);
    assertNotNull(val);
    assertEquals(val.intValue(), 27);
    // test - failure case - invalid domain
    testDomain = "not_coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setDomainName(testDomain).setMetricList(metricList);
    // send the metrics
    metrixMap.clear();
    String errMsg = "No such domain";
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 404);
        assertTrue(ex.getMessage().contains(errMsg));
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - missing domain name in metric data
    testDomain = "coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setMetricList(metricList);
    errMsg = "Missing required field: domainName";
    // send the metrics
    metrixMap.clear();
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains(errMsg), ex.getMessage());
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - mismatch domain in uri and metric data
    testDomain = "coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setDomainName("not_coretech").setMetricList(metricList);
    errMsg = "mismatched domain names";
    // send the metrics
    metrixMap.clear();
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains(errMsg), ex.getMessage());
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - empty metric list
    testDomain = "coretech";
    // create some metrics
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(999));
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED).setMetricVal(277));
    req = new DomainMetrics().setDomainName(testDomain);
    errMsg = "Missing required field: metricList";
    // send the metrics
    metrixMap.clear();
    try {
        ztsImpl.postDomainMetrics(context, testDomain, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
        assertTrue(ex.getMessage().contains(errMsg), ex.getMessage());
    }
    // verify no metrics were recorded
    assertEquals(metrixMap.size(), 0);
    // test - failure case - metric count is missing
    testDomain = "coretech";
    // create a single metric without a count
    metricList = new ArrayList<>();
    metricList.add(new DomainMetric().setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH).setMetricVal(-1));
    req = new DomainMetrics().setDomainName(testDomain).setMetricList(metricList);
    // verify no metrics were recorded
    metrixMap.clear();
    ztsImpl.postDomainMetrics(context, testDomain, req);
    assertEquals(metrixMap.size(), 0);
}

Example 5 with CloudStore

use of com.yahoo.athenz.zts.store.CloudStore in project athenz by yahoo.

the class ZTSImplTest method testGetAWSTemporaryCredentialsForbidden.

@Test
public void testGetAWSTemporaryCredentialsForbidden() {
    Principal principal = SimplePrincipal.create("user_domain", "user102", "v=U1;d=user_domain;n=user102;s=signature", 0, null);
    CloudStore cloudStore = Mockito.mock(CloudStore.class);
    Mockito.when(cloudStore.isAwsEnabled()).thenReturn(true);
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234");
    store.processDomain(signedDomain, false);
    try {
        zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
}