Examples with CertificatePrincipal keywhiz.auth.mutualssl.CertificatePrincipal used on opensource projects

Example 1 with CertificatePrincipal

use of keywhiz.auth.mutualssl.CertificatePrincipal in project keywhiz by square.

the class ClientAuthFactoryTest method setUp.

@Before
public void setUp() throws Exception {
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    X509Certificate clientCert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(clientPem.getBytes(UTF_8)));
    clientPrincipal = new CertificatePrincipal(clientCert.getSubjectDN().toString(), new X509Certificate[] { clientCert });
    X509Certificate xfccCert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(xfccPem.getBytes(UTF_8)));
    xfccPrincipal = new CertificatePrincipal(xfccCert.getSubjectDN().toString(), new X509Certificate[] { xfccCert });
    factory = new ClientAuthFactory(clientDAO, clientAuthConfig);
    when(request.getSecurityContext()).thenReturn(securityContext);
    when(clientDAO.getClientByName(clientName)).thenReturn(Optional.of(client));
    when(clientDAO.getClientBySpiffeId(new URI(clientSpiffe))).thenReturn(Optional.of(client));
    when(clientAuthConfig.xfccConfigs()).thenReturn(List.of(xfccSourceConfig));
    when(clientAuthConfig.typeConfig()).thenReturn(clientAuthTypeConfig);
    when(clientAuthConfig.createMissingClients()).thenReturn(false);
    when(xfccSourceConfig.port()).thenReturn(xfccAllowedPort);
    when(xfccSourceConfig.allowedClientNames()).thenReturn(List.of(xfccName));
    when(xfccSourceConfig.allowedSpiffeIds()).thenReturn(List.of(xfccSpiffe));
    when(clientAuthTypeConfig.useCommonName()).thenReturn(true);
    when(clientAuthTypeConfig.useSpiffeId()).thenReturn(true);
}

Example 2 with CertificatePrincipal

use of keywhiz.auth.mutualssl.CertificatePrincipal in project keywhiz by square.

the class ClientAuthenticatorTest method ignoresMultipleUris.

@Test
public void ignoresMultipleUris() throws Exception {
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    X509Certificate multipleUriClientCert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(multipleUriPem.getBytes(UTF_8)));
    Principal multipleUriPrincipal = new CertificatePrincipal(multipleUriClientCert.getSubjectDN().toString(), new X509Certificate[] { multipleUriClientCert });
    // Use only the (malformatted) URIs to retrieve a client (which should fail)
    when(clientAuthTypeConfig.useCommonName()).thenReturn(false);
    when(clientAuthTypeConfig.useSpiffeId()).thenReturn(true);
    assertThat(authenticator.authenticate(multipleUriPrincipal, false)).isEmpty();
    verifyNoInteractions(clientDAO);
}

Example 3 with CertificatePrincipal

use of keywhiz.auth.mutualssl.CertificatePrincipal in project keywhiz by square.

the class ClientDAOTest method sawClientTest.

@Test
public void sawClientTest() {
    assertThat(client1.getLastSeen()).isNull();
    assertThat(client2.getLastSeen()).isNull();
    Instant expiration = Instant.now();
    // Remove nanos because database drops it on storage, and we want
    // to compare later to make sure the proper expiration was set in DB.
    expiration = expiration.minusNanos(expiration.get(NANO_OF_SECOND));
    CertificatePrincipal principal = mock(CertificatePrincipal.class);
    when(principal.getCertificateExpiration()).thenReturn(expiration);
    ApiDate now = ApiDate.now();
    clientDAO.sawClient(client1, principal);
    // reload clients from db, as sawClient doesn't update in-memory object
    Client client1v2 = clientDAO.getClientByName(client1.getName()).get();
    Client client2v2 = clientDAO.getClientByName(client2.getName()).get();
    // verify client1 from db has updated lastSeen, and client2 hasn't changed
    assertThat(client1v2.getLastSeen()).isNotNull();
    assertTrue(client1v2.getLastSeen().toEpochSecond() >= now.toEpochSecond());
    assertThat(client2v2.getLastSeen()).isNull();
    assertThat(client1v2.getExpiration()).isNotNull();
    assertThat(client1v2.getExpiration().toInstant()).isEqualTo(expiration);
    assertThat(client2v2.getExpiration()).isNull();
}

Example 4 with CertificatePrincipal

use of keywhiz.auth.mutualssl.CertificatePrincipal in project keywhiz by square.

the class ClientDAO method sawClient.

public void sawClient(Client client, @Nullable Principal principal) {
    Instant now = Instant.now();
    Instant lastSeen = Optional.ofNullable(client.getLastSeen()).map(ls -> Instant.ofEpochSecond(ls.toEpochSecond())).orElse(EPOCH);
    final Instant expiration;
    if (principal instanceof CertificatePrincipal) {
        expiration = ((CertificatePrincipal) principal).getCertificateExpiration();
    } else {
        expiration = EPOCH;
    }
    // this way we can have less granularity on lastSeen and save DB writes
    if (now.isAfter(lastSeen.plus(LAST_SEEN_THRESHOLD))) {
        dslContext.transaction(configuration -> {
            Param<Long> lastSeenValue = DSL.val(now.getEpochSecond(), CLIENTS.LASTSEEN);
            Param<Long> expirationValue = DSL.val(expiration.getEpochSecond(), CLIENTS.EXPIRATION);
            DSL.using(configuration).update(CLIENTS).set(CLIENTS.LASTSEEN, when(CLIENTS.LASTSEEN.isNull(), lastSeenValue).otherwise(greatest(CLIENTS.LASTSEEN, lastSeenValue))).set(CLIENTS.EXPIRATION, expirationValue).where(CLIENTS.ID.eq(client.getId())).execute();
        });
    }
}

Example 5 with CertificatePrincipal

use of keywhiz.auth.mutualssl.CertificatePrincipal in project keywhiz by square.

the class ClientAuthFactory method authenticateClientFromXfccHeader.

/**
 * Extracts client information from the XFCC header and retrieves the client if present, throwing
 * exceptions if the header is malformatted or the client is absent.
 */
private Client authenticateClientFromXfccHeader(List<String> xfccHeaderValues) {
    X509Certificate clientCert = getClientCertFromXfccHeaderEnvoyFormatted(xfccHeaderValues).orElseThrow(() -> new NotAuthorizedException(format("unable to parse client certificate from %s header", XFCC_HEADER_NAME)));
    CertificatePrincipal certificatePrincipal = new CertificatePrincipal(clientCert.getSubjectDN().toString(), new X509Certificate[] { clientCert });
    return authenticateClientFromPrincipal(certificatePrincipal);
}