Examples with EncryptionKeyCanary org.cloudfoundry.credhub.entity.EncryptionKeyCanary used on opensource projects

Example 16 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapperTest method assertCanaryValueWasEncryptedAndSavedToDatabase.

private void assertCanaryValueWasEncryptedAndSavedToDatabase() throws Exception {
    ArgumentCaptor<EncryptionKeyCanary> argumentCaptor = ArgumentCaptor.forClass(EncryptionKeyCanary.class);
    verify(encryptionKeyCanaryDataService).save(argumentCaptor.capture());
    EncryptionKeyCanary encryptionKeyCanary = argumentCaptor.getValue();
    assertThat(encryptionKeyCanary.getEncryptedCanaryValue(), equalTo("fake-encrypted-value".getBytes()));
    assertThat(encryptionKeyCanary.getNonce(), equalTo("fake-nonce".getBytes()));
    verify(encryptionService, times(1)).encrypt(null, activeKey, CANARY_VALUE);
}

Example 17 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapperTest method createEncryptionCanary.

private EncryptionKeyCanary createEncryptionCanary(UUID canaryUuid, String encryptedValue, String nonce, Key encryptionKey) throws Exception {
    EncryptionKeyCanary encryptionKeyCanary = new EncryptionKeyCanary();
    encryptionKeyCanary.setUuid(canaryUuid);
    encryptionKeyCanary.setEncryptedCanaryValue(encryptedValue.getBytes());
    encryptionKeyCanary.setNonce(nonce.getBytes());
    when(encryptionService.decrypt(encryptionKey, encryptedValue.getBytes(), nonce.getBytes())).thenReturn(CANARY_VALUE);
    return encryptionKeyCanary;
}

Example 18 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapperTest method mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnHSMException_itShouldCreateACanaryForTheKey.

@Test
public void mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnHSMException_itShouldCreateACanaryForTheKey() throws Exception {
    when(encryptionKeysConfiguration.isKeyCreationEnabled()).thenReturn(true);
    when(encryptionKeysConfiguration.getKeys()).thenReturn(asList(activeKeyData));
    EncryptionKeyCanary nonMatchingCanary = new EncryptionKeyCanary();
    nonMatchingCanary.setUuid(UUID.randomUUID());
    nonMatchingCanary.setEncryptedCanaryValue("fake-non-matching-encrypted-value".getBytes());
    nonMatchingCanary.setNonce("fake-non-matching-nonce".getBytes());
    when(encryptionKeyCanaryDataService.findAll()).thenReturn(asArrayList(nonMatchingCanary));
    when(encryptionService.decrypt(activeKey, nonMatchingCanary.getEncryptedCanaryValue(), nonMatchingCanary.getNonce())).thenThrow(new IllegalBlockSizeException("Could not process input data: function 'C_Decrypt' returns 0x40"));
    when(encryptionKeyCanaryDataService.save(any(EncryptionKeyCanary.class))).thenReturn(activeKeyCanary);
    subject = new EncryptionKeyCanaryMapper(encryptionKeyCanaryDataService, encryptionKeysConfiguration, timedRetry, providerFactory);
    subject.mapUuidsToKeys(keySet);
    assertCanaryValueWasEncryptedAndSavedToDatabase();
}

Example 19 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class EncryptionKeyCanaryMapperTest method mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyReturnsAnIncorrectCanaryValue_createsACanaryForTheKey.

@Test
public void mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyReturnsAnIncorrectCanaryValue_createsACanaryForTheKey() throws Exception {
    when(encryptionKeysConfiguration.isKeyCreationEnabled()).thenReturn(true);
    when(encryptionKeysConfiguration.getKeys()).thenReturn(asList(activeKeyData));
    EncryptionKeyCanary nonMatchingCanary = new EncryptionKeyCanary();
    nonMatchingCanary.setUuid(UUID.randomUUID());
    nonMatchingCanary.setEncryptedCanaryValue("fake-non-matching-encrypted-value".getBytes());
    nonMatchingCanary.setNonce("fake-non-matching-nonce".getBytes());
    when(encryptionKeyCanaryDataService.findAll()).thenReturn(asArrayList(nonMatchingCanary));
    when(encryptionService.decrypt(activeKey, nonMatchingCanary.getEncryptedCanaryValue(), nonMatchingCanary.getNonce())).thenReturn("different-canary-value");
    when(encryptionKeyCanaryDataService.save(any(EncryptionKeyCanary.class))).thenReturn(activeKeyCanary);
    subject = new EncryptionKeyCanaryMapper(encryptionKeyCanaryDataService, encryptionKeysConfiguration, timedRetry, providerFactory);
    subject.mapUuidsToKeys(keySet);
    assertCanaryValueWasEncryptedAndSavedToDatabase();
}

Example 20 with EncryptionKeyCanary

use of org.cloudfoundry.credhub.entity.EncryptionKeyCanary in project credhub by cloudfoundry-incubator.

the class CredentialRegenerateTest method regeneratingAPasswordWithParametersThatCannotBeDecrypted_returnsAnError.

@Test
public void regeneratingAPasswordWithParametersThatCannotBeDecrypted_returnsAnError() throws Exception {
    EncryptionKeyCanary encryptionKeyCanary = new EncryptionKeyCanary();
    canaryDataService.save(encryptionKeyCanary);
    PasswordCredentialVersionData passwordCredentialData = new PasswordCredentialVersionData("/my-password");
    PasswordCredentialVersion originalCredential = new PasswordCredentialVersion(passwordCredentialData);
    originalCredential.setEncryptor(encryptor);
    originalCredential.setPasswordAndGenerationParameters("abcde", new StringGenerationParameters());
    passwordCredentialData.getEncryptedValueData().setEncryptionKeyUuid(encryptionKeyCanary.getUuid());
    credentialVersionDataService.save(originalCredential);
    // language=JSON
    String cannotRegenerate = "{\n" + "  \"error\": \"The credential could not be accessed with the provided encryption keys. You must update your deployment configuration to continue" + ".\"\n" + "}";
    MockHttpServletRequestBuilder request = post("/api/v1/data").header("Authorization", "Bearer " + AuthConstants.UAA_OAUTH2_PASSWORD_GRANT_TOKEN).accept(APPLICATION_JSON).contentType(APPLICATION_JSON).content("{\"regenerate\":true,\"name\":\"my-password\"}");
    mockMvc.perform(request).andDo(print()).andExpect(status().isInternalServerError()).andExpect(content().json(cannotRegenerate));
}