Examples with NToken com.yahoo.vespa.athenz.api.NToken used on opensource projects

Example 1 with NToken

use of com.yahoo.vespa.athenz.api.NToken in project vespa by vespa-engine.

the class NTokenValidatorTest method failing_to_find_key_should_throw_exception.

@Test
public void failing_to_find_key_should_throw_exception() throws InvalidTokenException {
    ZmsKeystore keystore = (athensService, keyId) -> {
        throw new RuntimeException();
    };
    NTokenValidator validator = new NTokenValidator(keystore);
    NToken token = createNToken(IDENTITY, Instant.now(), TRUSTED_KEY.getPrivate(), "0");
    exceptionRule.expect(InvalidTokenException.class);
    exceptionRule.expectMessage("Failed to retrieve public key");
    validator.validate(token);
}

Example 2 with NToken

use of com.yahoo.vespa.athenz.api.NToken in project vespa by vespa-engine.

the class ControllerTest method testPullRequestDeployment.

@Test
public void testPullRequestDeployment() {
    // Setup system
    ControllerTester tester = new ControllerTester();
    ApplicationController applications = tester.controller().applications();
    // staging deployment
    long app1ProjectId = 22;
    ApplicationId app1 = tester.createAndDeploy("tenant1", "domain1", "application1", Environment.staging, app1ProjectId).id();
    // pull-request deployment - uses different instance id
    ApplicationId app1pr = tester.createAndDeploy("tenant1", "domain1", "application1", "1", Environment.staging, app1ProjectId, null).id();
    assertTrue(applications.get(app1).isPresent());
    assertEquals(app1, applications.get(app1).get().id());
    assertTrue(applications.get(app1pr).isPresent());
    assertEquals(app1pr, applications.get(app1pr).get().id());
    // Simulate restart
    tester.createNewController();
    applications = tester.controller().applications();
    assertTrue(applications.get(app1).isPresent());
    assertEquals(app1, applications.get(app1).get().id());
    assertTrue(applications.get(app1pr).isPresent());
    assertEquals(app1pr, applications.get(app1pr).get().id());
    // Deleting application also removes PR instance
    ApplicationId app2 = tester.createAndDeploy("tenant1", "domain1", "application2", Environment.staging, 33).id();
    tester.controller().applications().deleteApplication(app1, Optional.of(new NToken("ntoken")));
    assertEquals("All instances deleted", 0, tester.controller().applications().asList(app1.tenant()).stream().filter(app -> app.id().application().equals(app1.application())).count());
    assertEquals("Other application survives", 1, tester.controller().applications().asList(app1.tenant()).stream().filter(app -> app.id().application().equals(app2.application())).count());
}

Example 3 with NToken

use of com.yahoo.vespa.athenz.api.NToken in project vespa by vespa-engine.

the class ApplicationApiHandler method createTenant.

private HttpResponse createTenant(String tenantName, HttpRequest request) {
    if (new TenantId(tenantName).isUser())
        return ErrorResponse.badRequest("Use User API to create user tenants.");
    Inspector requestData = toSlime(request.getData()).get();
    Tenant tenant = new Tenant(new TenantId(tenantName), optional("property", requestData).map(Property::new), optional("athensDomain", requestData).map(AthenzDomain::new), optional("propertyId", requestData).map(PropertyId::new));
    if (tenant.isAthensTenant())
        throwIfNotAthenzDomainAdmin(new AthenzDomain(mandatory("athensDomain", requestData).asString()), request);
    NToken token = getUserPrincipal(request).getNToken().orElseThrow(() -> new IllegalArgumentException("Could not create " + tenant + ": No NToken provided"));
    controller.tenants().createAthenzTenant(tenant, token);
    return tenant(tenant, request, true);
}

Example 4 with NToken

use of com.yahoo.vespa.athenz.api.NToken in project vespa by vespa-engine.

the class ApplicationController method deleteApplication.

/**
 * Deletes the the given application. All known instances of the applications will be deleted,
 * including PR instances.
 *
 * @throws IllegalArgumentException if the application has deployments or the caller is not authorized
 * @throws NotExistsException if no instances of the application exist
 */
public void deleteApplication(ApplicationId applicationId, Optional<NToken> token) {
    // Find all instances of the application
    List<ApplicationId> instances = controller.applications().asList(applicationId.tenant()).stream().map(Application::id).filter(id -> id.application().equals(applicationId.application()) && id.tenant().equals(applicationId.tenant())).collect(Collectors.toList());
    if (instances.isEmpty()) {
        throw new NotExistsException("Could not delete application '" + applicationId + "': Application not found");
    }
    // TODO: Make this one transaction when database is moved to ZooKeeper
    instances.forEach(id -> lockOrThrow(id, application -> {
        if (!application.deployments().isEmpty())
            throw new IllegalArgumentException("Could not delete '" + application + "': It has active deployments");
        Tenant tenant = controller.tenants().tenant(new TenantId(id.tenant().value())).get();
        if (tenant.isAthensTenant() && !token.isPresent())
            throw new IllegalArgumentException("Could not delete '" + application + "': No NToken provided");
        // Only delete in Athenz once
        if (id.instance().isDefault() && tenant.isAthensTenant()) {
            zmsClientFactory.createZmsClientWithAuthorizedServiceToken(token.get()).deleteApplication(tenant.getAthensDomain().get(), new com.yahoo.vespa.hosted.controller.api.identifiers.ApplicationId(id.application().value()));
        }
        db.deleteApplication(id);
        log.info("Deleted " + application);
    }));
}

Example 5 with NToken

use of com.yahoo.vespa.athenz.api.NToken in project vespa by vespa-engine.

the class AthenzFilterMock method filter.

@Override
public void filter(DiscFilterRequest request, ResponseHandler handler) {
    if (request.getMethod().equalsIgnoreCase("OPTIONS"))
        return;
    String identityName = request.getHeader(IDENTITY_HEADER_NAME);
    String nToken = request.getHeader(ATHENZ_NTOKEN_HEADER_NAME);
    if (identityName == null) {
        sendErrorResponse(handler, HttpResponse.Status.UNAUTHORIZED, "Not authenticated");
    } else {
        AthenzIdentity identity = AthenzIdentities.from(identityName);
        AthenzPrincipal principal = nToken == null ? new AthenzPrincipal(identity) : new AthenzPrincipal(identity, new NToken(nToken));
        request.setUserPrincipal(principal);
    }
}