diff --git a/.gitignore b/.gitignore new file mode 100644 index 00000000000..52136798542 --- /dev/null +++ b/.gitignore @@ -0,0 +1,21 @@ +*~ +**/.classpath +**/.project +**/.settings +**/target/ +**/dependency-reduced-pom.xml +servers/zms/zms_logs/ +servers/zms/zms_root/ +servers/zts/zts_logs/ +servers/zts/zts_store/ +clients/go/zms/pkg/ +clients/go/zms/src/ +clients/go/zts/pkg/ +clients/go/zts/src/ +clients/java/sia/src/test/resources/svc.ntoken +clients/java/zpe/src/test/resources/upd_pol_dir/ +ui/build/ +ui/node_modules/ +utils/zms_cli/zms-cli +utils/zpe_policy_updater/tmp_metrics/ +utils/zpe_policy_updater/src/test/resources/sys.auth.new.pol diff --git a/LICENSE b/LICENSE new file mode 100644 index 00000000000..d6456956733 --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md new file mode 100644 index 00000000000..6f46a6d0c03 --- /dev/null +++ b/README.md @@ -0,0 +1,65 @@ + + +Athenz is a set of services and libraries supporting role-based +authorization (RBAC) for provisioning and configuration (centralized +authorization) use cases as well as serving/runtime (decentralized +authorization) use cases. Athenz authorization system utilizes two +types of tokens: Principal Tokens (N-Tokens) and RoleTokens (Z-Tokens). +The name "Athenz" is derived from "Auth" and the 'N' and 'Z' tokens. + +## Main features +---------------- + +Athenz provides both the functionality of a centralized system +and a certificate and IP-based distributed system to handle +on-box enforcement. + +You get the following advantages using Athenz: + +- **Service-based security profile:** Security definitions that + automatically trickle down to hosts within the service. +- **Dynamic provisioning:** Scale fast or move workloads around + without manual intervention (IP-less configuration). +- **Single source of truth:** Consolidated service profile serving + various downstream security implementations, including support for + non-user entities. +- **Self-Service:** Real-time configuration and enforcement of + resource-based access control (dynamic manageability). + +More importantly, we want engineers to use Athenz and **not** build +their own role-based access control systems that have no central store +and often rely on network ACLs and manual updating. + +## Documentation +---------------- + +* Getting Started + * [Development Enviornment](docs/dev_environment.md) + * [Setup ZMS](docs/setup_zms.md) + * [Setup ZTS](docs/setup_zts.md) +* Architecture + * [Data Model](docs/data_model.md) + * [System View](docs/system_view.md) + * [Authorization Flow](docs/auth_flow.md) +* Developer Guide + * [Centralized Access Control](docs/dev_centralized_access.md) + * [Decentralized Access Control](docs/dev_decentralized_access.md) + * [System Properties](docs/system_properties.md) +* User Guide + * [ZMS Client Utility](docs/zms_client.md) + * [Registering ZMS Service Identity](docs/reg_service_guide.md) + +## Contact +---------- + +* [Athenz-Dev](https://groups.google.com/d/forum/athenz-dev) for + development discussions +* [Athenz-Users](https://groups.google.com/d/forum/athenz-users) for + users questions + +## License +---------- + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/assembly/components/zms.xml b/assembly/components/zms.xml new file mode 100644 index 00000000000..ac0754b9566 --- /dev/null +++ b/assembly/components/zms.xml @@ -0,0 +1,87 @@ + + + + bin + + tar.gz + + true + + + ${basedir}/../servers/zms/conf + conf/zms_server + + + ${basedir}/../servers/zms/scripts + bin + 755 + + zms_start.sh + + + + ${basedir}/../servers/zms/target/dependency + lib/jars + + + . + logs/zms_server + + */** + + + + . + var/zms_server/keys + + */** + + + + . + var/zms_server/certs + + */** + + + + + + ${basedir}/../servers/zms/README.md + . + 644 + + + ${basedir}/../LICENSE + . + 644 + + + + + + com.yahoo.athenz:zms_server + + lib/jars + false + runtime + false + + + diff --git a/assembly/components/zpu.xml b/assembly/components/zpu.xml new file mode 100644 index 00000000000..62c4c8dc6f5 --- /dev/null +++ b/assembly/components/zpu.xml @@ -0,0 +1,90 @@ + + + + bin + + tar.gz + + true + + + ${basedir}/../utils/zpe_policy_updater/conf + conf/zpe_policy_updater + + + ${basedir}/../utils/zpe_policy_updater/scripts + bin + 755 + + zpu_run.sh + + + + . + logs/zpe_policy_updater + + */** + + + + . + var/zpe + + */** + + + + . + tmp/zpe + + */** + + + + . + var/zpe_policy_updater/certs + + */** + + + + + + ${basedir}/../utils/zpe_policy_updater/README.md + . + 644 + + + ${basedir}/../LICENSE + . + 644 + + + + + + com.yahoo.athenz:zpe_policy_updater + + lib/jars + false + runtime + false + + + diff --git a/assembly/components/zts.xml b/assembly/components/zts.xml new file mode 100644 index 00000000000..e65d5e54cb5 --- /dev/null +++ b/assembly/components/zts.xml @@ -0,0 +1,87 @@ + + + + bin + + tar.gz + + true + + + ${basedir}/../servers/zts/conf + conf/zts_server + + + ${basedir}/../servers/zts/scripts + bin + 755 + + zts_start.sh + + + + ${basedir}/../servers/zts/target/dependency + lib/jars + + + . + logs/zts_server + + */** + + + + . + var/zts_server/keys + + */** + + + + . + var/zts_server/certs + + */** + + + + + + ${basedir}/../servers/zts/README.md + . + 644 + + + ${basedir}/../LICENSE + . + 644 + + + + + + com.yahoo.athenz:zts_server + + lib/jars + false + runtime + false + + + diff --git a/assembly/pom.xml b/assembly/pom.xml new file mode 100644 index 00000000000..b92b2c522f3 --- /dev/null +++ b/assembly/pom.xml @@ -0,0 +1,99 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../pom.xml + + + assembly + assembly + pom + + + + com.yahoo.athenz + zms_server + ${project.parent.version} + + + com.yahoo.athenz + zts_server + ${project.parent.version} + + + com.yahoo.athenz + zpe_policy_updater + ${project.parent.version} + + + + + + + maven-assembly-plugin + 2.6 + + + package-zms-assembly + package + + single + + + posix + athenz-zms-${project.version} + + components/zms.xml + + + + + package-zts-assembly + package + + single + + + posix + athenz-zts-${project.version} + + components/zts.xml + + + + + package-zpu-assembly + package + + single + + + posix + athenz-zpu-${project.version} + + components/zpu.xml + + + + + + + + diff --git a/clients/go/zms/Makefile b/clients/go/zms/Makefile new file mode 100644 index 00000000000..6e6e2d4de6d --- /dev/null +++ b/clients/go/zms/Makefile @@ -0,0 +1,20 @@ +RDL_FILE=../../../core/zms/src/main/rdl/ZMS.rdl +RDL_LIB=github.com/ardielle/ardielle-go/rdl + +export GOPATH=$(PWD) + +all: model.go client.go build + +build: src/$(RDL_LIB) + +src/$(RDL_LIB): + go get $(RDL_LIB) + +model.go: $(RDL_FILE) + rdl -ps generate -t -o $@ go-model $(RDL_FILE) + +client.go: $(RDL_FILE) + rdl -ps generate -t -o $@ go-client $(RDL_FILE) + +clean:: + rm -rf model.go client.go zms_schema.go *~ ./src diff --git a/clients/go/zms/README.md b/clients/go/zms/README.md new file mode 100644 index 00000000000..5aad5912dd1 --- /dev/null +++ b/clients/go/zms/README.md @@ -0,0 +1,54 @@ +# zms-go-client + +A Go client library to talk to Athenz ZMS. + +The model.go and client.go files are generated from zms_core, and checked in so users of this library need not know that. + +Additionally, an implementation of rdl.Authorizer and rdl.Authenticator are provided that use this library to delegate that functionality to Athenz ZMS: + +Release Notes: +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Version 1.0 (2016-09-06) + - Initial opensource release + +## Usage + +To get it into your workspace: + + go get github.com/yahoo/athenz/clients/go/zms + +Then in your Go code: + + import ( + zms "github.com/yahoo/athenz/clients/go/zms" + ) + func main() { + var principal rdl.Principal /* init this from an actual user credential */ + ... + client := zms.NewClient() + client.AddCredentials(principal.GetHTTPHeaderName(), principal.GetCredentials()) + dmn, err := client.GetDomain("athenz") // + ... + } + +To use the ZMSAuthorizer from your RDL-generated server: + + import ( + zms "github.com/yahoo/athenz/clients/go/zms" + ) + ... + endpoint := "localhost:4080" + domain := "your.server.domain" + + zmsURL := "http://localhost:10080/zms/v1" //set this to "" for debug mode + authn := zms.Authenticator(zmsURL) + authz := zms.Authorizer(domain, zmsURL) + + handler := contacts.Init(impl, url, authz, authn) + http.ListenAndServe(endpoint, handler) + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/clients/go/zms/auth.go b/clients/go/zms/auth.go new file mode 100644 index 00000000000..49d640185f7 --- /dev/null +++ b/clients/go/zms/auth.go @@ -0,0 +1,112 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zms + +import ( + "fmt" + "github.com/ardielle/ardielle-go/rdl" + "log" + "strings" +) + +// +// Authenticator - an unoptimized authenticator that delegates to ZMS. +// The advantage is that there is no local state or config other than the +// url of ZMS (we don't need ZMS's public key to be local). +// +func Authenticator(url string) rdl.Authenticator { + return &zmsAuthenticator{url} +} + +type zmsAuthenticator struct { + url string //i.e. "http://localhost:10080/zms/v1" +} + +func (ath zmsAuthenticator) HTTPHeader() string { + return "Athenz-Principal-Auth" +} + +func (ath zmsAuthenticator) Authenticate(nToken string) rdl.Principal { + attrs := make(map[string]string) + for _, attr := range strings.Split(nToken, ";") { + kv := strings.Split(attr, "=") + attrs[kv[0]] = kv[1] + } + if name, ok := attrs["n"]; ok { + if domain, ok := attrs["d"]; ok { + //do not verify the token, because we will just pass it off in the authorizer, where ZMS will do that. + log.Printf("[Authenticate %s.%s]\n", domain, name) + return zmsPrincipal{domain, name, nToken, ath.HTTPHeader()} + } + } + return nil +} + +//zmsPrincipal implements rdl.Principal the interface +type zmsPrincipal struct { + domain string + name string + creds string + header string +} + +func (p zmsPrincipal) GetDomain() string { + return p.domain +} + +func (p zmsPrincipal) GetName() string { + return p.name +} + +func (p zmsPrincipal) GetYRN() string { + return p.domain + "." + p.name +} + +func (p zmsPrincipal) GetCredentials() string { + return p.creds +} + +func (p zmsPrincipal) GetHTTPHeaderName() string { + return p.header +} + +// +// Authorizer returns an authorizer that calls zms. If the url is set to +// "", then the access is logged, but always succeeds (for debug purposes) +// +func Authorizer(domain string, url string) rdl.Authorizer { + return &zmsAuthorizer{domain: domain, url: url} +} + +type zmsAuthorizer struct { + domain string + url string +} + +func (auth zmsAuthorizer) Authorize(action string, resource string, principal rdl.Principal) (bool, error) { + //this should be done before getting here! + if strings.Index(resource, ":") < 0 { + //the resource is relative to the service's domain + resource = auth.domain + ":" + resource + } + if auth.url == "" { + log.Printf("[DEBUG Authorize %s on %s for %s]\n", action, resource, principal.GetYRN()) + return true, nil + } else { + if principal.GetHTTPHeaderName() != "Athenz-Principal-Auth" { + return false, fmt.Errorf("Authorizer using" + principal.GetHTTPHeaderName() + " not supported") + } + zmsClient := NewClient(auth.url, nil) + zmsClient.AddCredentials(principal.GetHTTPHeaderName(), principal.GetCredentials()) + check, err := zmsClient.GetAccess(ActionName(action), YRN(resource), "", "") + if err != nil { + return false, err + } + log.Printf("[Authorize %s on %s for %s: %v]\n", action, resource, principal.GetYRN(), check.Granted) + if check.Granted { + return true, nil + } + return false, nil + } +} diff --git a/clients/go/zms/client.go b/clients/go/zms/client.go new file mode 100644 index 00000000000..5b7c211eab0 --- /dev/null +++ b/clients/go/zms/client.go @@ -0,0 +1,2377 @@ +// +// This file generated by rdl 1.4.8 +// + +package zms + +import ( + "bytes" + "encoding/json" + "fmt" + rdl "github.com/ardielle/ardielle-go/rdl" + "io" + "io/ioutil" + "net/http" + "net/url" + "strconv" + "strings" + "time" +) + +var _ = json.Marshal +var _ = fmt.Printf +var _ = rdl.BaseTypeAny +var _ = ioutil.NopCloser + +type ZMSClient struct { + URL string + Transport http.RoundTripper + CredsHeader *string + CredsToken *string + Timeout time.Duration +} + +// NewClient creates and returns a new HTTP client object for the ZMS service +func NewClient(url string, transport http.RoundTripper) ZMSClient { + return ZMSClient{url, transport, nil, nil, 0} +} + +// AddCredentials adds the credentials to the client for subsequent requests. +func (client *ZMSClient) AddCredentials(header string, token string) { + client.CredsHeader = &header + client.CredsToken = &token +} + +func (client ZMSClient) getClient() *http.Client { + var c *http.Client + if client.Transport != nil { + c = &http.Client{Transport: client.Transport} + } else { + c = &http.Client{} + } + if client.Timeout > 0 { + c.Timeout = client.Timeout + } + return c +} + +func (client ZMSClient) addAuthHeader(req *http.Request) { + if client.CredsHeader != nil && client.CredsToken != nil { + if strings.HasPrefix(*client.CredsHeader, "Cookie.") { + req.Header.Add("Cookie", (*client.CredsHeader)[7:]+"="+*client.CredsToken) + } else { + req.Header.Add(*client.CredsHeader, *client.CredsToken) + } + } +} + +func (client ZMSClient) httpGet(url string, headers map[string]string) (*http.Response, error) { + hclient := client.getClient() + req, err := http.NewRequest("GET", url, nil) + if err != nil { + return nil, err + } + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZMSClient) httpDelete(url string, headers map[string]string) (*http.Response, error) { + hclient := client.getClient() + req, err := http.NewRequest("DELETE", url, nil) + if err != nil { + return nil, err + } + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZMSClient) httpPut(url string, headers map[string]string, body []byte) (*http.Response, error) { + contentReader := bytes.NewReader(body) + hclient := client.getClient() + req, err := http.NewRequest("PUT", url, contentReader) + if err != nil { + return nil, err + } + req.Header.Add("Content-type", "application/json") + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZMSClient) httpPost(url string, headers map[string]string, body []byte) (*http.Response, error) { + contentReader := bytes.NewReader(body) + hclient := client.getClient() + req, err := http.NewRequest("POST", url, contentReader) + if err != nil { + return nil, err + } + req.Header.Add("Content-type", "application/json") + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZMSClient) httpPatch(url string, headers map[string]string, body []byte) (*http.Response, error) { + contentReader := bytes.NewReader(body) + hclient := client.getClient() + req, err := http.NewRequest("PATCH", url, contentReader) + if err != nil { + return nil, err + } + req.Header.Add("Content-type", "application/json") + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZMSClient) httpOptions(url string, headers map[string]string, body []byte) (*http.Response, error) { + var contentReader io.Reader = nil + if body != nil { + contentReader = bytes.NewReader(body) + } + hclient := client.getClient() + req, err := http.NewRequest("OPTIONS", url, contentReader) + if err != nil { + return nil, err + } + if contentReader != nil { + req.Header.Add("Content-type", "application/json") + } + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func encodeStringParam(name string, val string, def string) string { + if val == def { + return "" + } + return "&" + name + "=" + url.QueryEscape(val) +} +func encodeBoolParam(name string, b bool, def bool) string { + if b == def { + return "" + } + return fmt.Sprintf("&%s=%v", name, b) +} +func encodeInt8Param(name string, i int8, def int8) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(i)) +} +func encodeInt16Param(name string, i int16, def int16) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(i)) +} +func encodeInt32Param(name string, i int32, def int32) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(i)) +} +func encodeInt64Param(name string, i int64, def int64) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.FormatInt(i, 10) +} +func encodeFloat32Param(name string, i float32, def float32) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.FormatFloat(float64(i), 'g', -1, 32) +} +func encodeFloat64Param(name string, i float64, def float64) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.FormatFloat(i, 'g', -1, 64) +} +func encodeOptionalEnumParam(name string, e interface{}) string { + if e == nil { + return "\"\"" + } + return fmt.Sprintf("&%s=%v", name, e) +} +func encodeOptionalBoolParam(name string, b *bool) string { + if b == nil { + return "" + } + return fmt.Sprintf("&%s=%v", name, *b) +} +func encodeOptionalInt32Param(name string, i *int32) string { + if i == nil { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(*i)) +} +func encodeOptionalInt64Param(name string, i *int64) string { + if i == nil { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(*i)) +} +func encodeParams(objs ...string) string { + s := strings.Join(objs, "") + if s == "" { + return s + } + return "?" + s[1:] +} + +func (client ZMSClient) GetDomain(domain DomainName) (*Domain, error) { + var data *Domain + url := client.URL + "/domain/" + fmt.Sprint(domain) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetDomainList(limit *int32, skip string, prefix string, depth *int32, account string, productId *int32, roleMember ResourceName, roleName ResourceName, modifiedSince string) (*DomainList, error) { + var data *DomainList + headers := map[string]string{ + "If-Modified-Since": modifiedSince, + } + url := client.URL + "/domain" + encodeParams(encodeOptionalInt32Param("limit", limit), encodeStringParam("skip", string(skip), ""), encodeStringParam("prefix", string(prefix), ""), encodeOptionalInt32Param("depth", depth), encodeStringParam("account", string(account), ""), encodeOptionalInt32Param("ypmid", productId), encodeStringParam("member", string(roleMember), ""), encodeStringParam("role", string(roleName), "")) + resp, err := client.httpGet(url, headers) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PostTopLevelDomain(auditRef string, detail *TopLevelDomain) (*Domain, error) { + var data *Domain + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain" + contentBytes, err := json.Marshal(detail) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, headers, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PostSubDomain(parent DomainName, auditRef string, detail *SubDomain) (*Domain, error) { + var data *Domain + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/subdomain/" + fmt.Sprint(parent) + contentBytes, err := json.Marshal(detail) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, headers, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PostUserDomain(name SimpleName, auditRef string, detail *UserDomain) (*Domain, error) { + var data *Domain + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/userdomain/" + fmt.Sprint(name) + contentBytes, err := json.Marshal(detail) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, headers, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteTopLevelDomain(name DomainName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(name) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) DeleteSubDomain(parent DomainName, name DomainName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/subdomain/" + fmt.Sprint(parent) + "/" + fmt.Sprint(name) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) DeleteUserDomain(name SimpleName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/userdomain/" + fmt.Sprint(name) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutDomainMeta(name DomainName, auditRef string, detail *DomainMeta) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(name) + "/meta" + contentBytes, err := json.Marshal(detail) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutDomainTemplate(name DomainName, auditRef string, template *DomainTemplate) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(name) + "/template" + contentBytes, err := json.Marshal(template) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetDomainTemplateList(name DomainName) (*DomainTemplateList, error) { + var data *DomainTemplateList + url := client.URL + "/domain/" + fmt.Sprint(name) + "/template" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteDomainTemplate(name DomainName, template SimpleName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(name) + "/template/" + fmt.Sprint(template) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetDomainDataCheck(domainName DomainName) (*DomainDataCheck, error) { + var data *DomainDataCheck + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/check" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PutEntity(domainName DomainName, entityName EntityName, auditRef string, entity *Entity) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/entity/" + fmt.Sprint(entityName) + contentBytes, err := json.Marshal(entity) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetEntity(domainName DomainName, entityName EntityName) (*Entity, error) { + var data *Entity + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/entity/" + fmt.Sprint(entityName) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteEntity(domainName DomainName, entityName EntityName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/entity/" + fmt.Sprint(entityName) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetEntityList(domainName DomainName) (*EntityList, error) { + var data *EntityList + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/entity" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetRoleList(domainName DomainName, limit *int32, skip string) (*RoleList, error) { + var data *RoleList + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role" + encodeParams(encodeOptionalInt32Param("limit", limit), encodeStringParam("skip", string(skip), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetRoles(domainName DomainName, members *bool) (*Roles, error) { + var data *Roles + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/roles" + encodeParams(encodeOptionalBoolParam("members", members)) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetRole(domainName DomainName, roleName EntityName, auditLog *bool, expand *bool) (*Role, error) { + var data *Role + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(roleName) + encodeParams(encodeOptionalBoolParam("auditLog", auditLog), encodeOptionalBoolParam("expand", expand)) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PutRole(domainName DomainName, roleName EntityName, auditRef string, role *Role) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(roleName) + contentBytes, err := json.Marshal(role) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) DeleteRole(domainName DomainName, roleName EntityName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(roleName) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetMembership(domainName DomainName, roleName EntityName, memberName ResourceName) (*Membership, error) { + var data *Membership + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(roleName) + "/member/" + fmt.Sprint(memberName) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PutMembership(domainName DomainName, roleName EntityName, memberName ResourceName, auditRef string, membership *Membership) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(roleName) + "/member/" + fmt.Sprint(memberName) + contentBytes, err := json.Marshal(membership) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) DeleteMembership(domainName DomainName, roleName EntityName, memberName ResourceName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(roleName) + "/member/" + fmt.Sprint(memberName) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutDefaultAdmins(domainName DomainName, auditRef string, defaultAdmins *DefaultAdmins) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/admins" + contentBytes, err := json.Marshal(defaultAdmins) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetPolicyList(domainName DomainName, limit *int32, skip string) (*PolicyList, error) { + var data *PolicyList + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policy" + encodeParams(encodeOptionalInt32Param("limit", limit), encodeStringParam("skip", string(skip), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetPolicies(domainName DomainName, assertions *bool) (*Policies, error) { + var data *Policies + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policies" + encodeParams(encodeOptionalBoolParam("assertions", assertions)) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetPolicy(domainName DomainName, policyName EntityName) (*Policy, error) { + var data *Policy + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policy/" + fmt.Sprint(policyName) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PutPolicy(domainName DomainName, policyName EntityName, auditRef string, policy *Policy) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policy/" + fmt.Sprint(policyName) + contentBytes, err := json.Marshal(policy) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) DeletePolicy(domainName DomainName, policyName EntityName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policy/" + fmt.Sprint(policyName) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetAssertion(domainName DomainName, policyName EntityName, assertionId int64) (*Assertion, error) { + var data *Assertion + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policy/" + fmt.Sprint(policyName) + "/assertion/" + fmt.Sprint(assertionId) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PutAssertion(domainName DomainName, policyName EntityName, auditRef string, assertion *Assertion) (*Assertion, error) { + var data *Assertion + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policy/" + fmt.Sprint(policyName) + "/assertion" + contentBytes, err := json.Marshal(assertion) + if err != nil { + return data, err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200, 201: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteAssertion(domainName DomainName, policyName EntityName, assertionId int64, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/policy/" + fmt.Sprint(policyName) + "/assertion/" + fmt.Sprint(assertionId) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutServiceIdentity(domain DomainName, service SimpleName, auditRef string, detail *ServiceIdentity) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + contentBytes, err := json.Marshal(detail) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetServiceIdentity(domain DomainName, service SimpleName) (*ServiceIdentity, error) { + var data *ServiceIdentity + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteServiceIdentity(domain DomainName, service SimpleName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetServiceIdentities(domainName DomainName, publickeys *bool, hosts *bool) (*ServiceIdentities, error) { + var data *ServiceIdentities + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/services" + encodeParams(encodeOptionalBoolParam("publickeys", publickeys), encodeOptionalBoolParam("hosts", hosts)) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetServiceIdentityList(domainName DomainName, limit *int32, skip string) (*ServiceIdentityList, error) { + var data *ServiceIdentityList + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/service" + encodeParams(encodeOptionalInt32Param("limit", limit), encodeStringParam("skip", string(skip), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetPublicKeyEntry(domain DomainName, service SimpleName, id string) (*PublicKeyEntry, error) { + var data *PublicKeyEntry + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/publickey/" + id + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) PutPublicKeyEntry(domain DomainName, service SimpleName, id string, auditRef string, publicKeyEntry *PublicKeyEntry) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/publickey/" + id + contentBytes, err := json.Marshal(publicKeyEntry) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) DeletePublicKeyEntry(domain DomainName, service SimpleName, id string, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/publickey/" + id + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutTenancy(domain DomainName, service ServiceName, auditRef string, detail *Tenancy) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/tenancy/" + fmt.Sprint(service) + contentBytes, err := json.Marshal(detail) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetTenancy(domain DomainName, service ServiceName) (*Tenancy, error) { + var data *Tenancy + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/tenancy/" + fmt.Sprint(service) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteTenancy(domain DomainName, service ServiceName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/tenancy/" + fmt.Sprint(service) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutTenancyResourceGroup(domain DomainName, service ServiceName, resourceGroup EntityName, auditRef string, detail *TenancyResourceGroup) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/tenancy/" + fmt.Sprint(service) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + contentBytes, err := json.Marshal(detail) + if err != nil { + return err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) DeleteTenancyResourceGroup(domain DomainName, service ServiceName, resourceGroup EntityName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/tenancy/" + fmt.Sprint(service) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutTenantRoles(domain DomainName, service SimpleName, tenantDomain DomainName, auditRef string, detail *TenantRoles) (*TenantRoles, error) { + var data *TenantRoles + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/tenant/" + fmt.Sprint(tenantDomain) + contentBytes, err := json.Marshal(detail) + if err != nil { + return data, err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200, 201: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetTenantRoles(domain DomainName, service SimpleName, tenantDomain DomainName) (*TenantRoles, error) { + var data *TenantRoles + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/tenant/" + fmt.Sprint(tenantDomain) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteTenantRoles(domain DomainName, service SimpleName, tenantDomain DomainName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/tenant/" + fmt.Sprint(tenantDomain) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutTenantResourceGroupRoles(domain DomainName, service SimpleName, tenantDomain DomainName, resourceGroup EntityName, auditRef string, detail *TenantResourceGroupRoles) (*TenantResourceGroupRoles, error) { + var data *TenantResourceGroupRoles + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/tenant/" + fmt.Sprint(tenantDomain) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + contentBytes, err := json.Marshal(detail) + if err != nil { + return data, err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200, 201: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetTenantResourceGroupRoles(domain DomainName, service SimpleName, tenantDomain DomainName, resourceGroup EntityName) (*TenantResourceGroupRoles, error) { + var data *TenantResourceGroupRoles + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/tenant/" + fmt.Sprint(tenantDomain) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteTenantResourceGroupRoles(domain DomainName, service SimpleName, tenantDomain DomainName, resourceGroup EntityName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(domain) + "/service/" + fmt.Sprint(service) + "/tenant/" + fmt.Sprint(tenantDomain) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) PutProviderResourceGroupRoles(tenantDomain DomainName, provDomain DomainName, provService SimpleName, resourceGroup EntityName, auditRef string, detail *ProviderResourceGroupRoles) (*ProviderResourceGroupRoles, error) { + var data *ProviderResourceGroupRoles + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(tenantDomain) + "/provDomain/" + fmt.Sprint(provDomain) + "/provService/" + fmt.Sprint(provService) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + contentBytes, err := json.Marshal(detail) + if err != nil { + return data, err + } + resp, err := client.httpPut(url, headers, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200, 201: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetProviderResourceGroupRoles(tenantDomain DomainName, provDomain DomainName, provService SimpleName, resourceGroup EntityName) (*ProviderResourceGroupRoles, error) { + var data *ProviderResourceGroupRoles + url := client.URL + "/domain/" + fmt.Sprint(tenantDomain) + "/provDomain/" + fmt.Sprint(provDomain) + "/provService/" + fmt.Sprint(provService) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) DeleteProviderResourceGroupRoles(tenantDomain DomainName, provDomain DomainName, provService SimpleName, resourceGroup EntityName, auditRef string) error { + headers := map[string]string{ + "Y-Audit-Ref": auditRef, + } + url := client.URL + "/domain/" + fmt.Sprint(tenantDomain) + "/provDomain/" + fmt.Sprint(provDomain) + "/provService/" + fmt.Sprint(provService) + "/resourceGroup/" + fmt.Sprint(resourceGroup) + resp, err := client.httpDelete(url, headers) + if err != nil { + return err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return err + } + switch resp.StatusCode { + case 204: + return nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return errobj + } +} + +func (client ZMSClient) GetAccess(action ActionName, resource YRN, domain DomainName, checkPrincipal EntityName) (*Access, error) { + var data *Access + url := client.URL + "/access/" + fmt.Sprint(action) + "/" + fmt.Sprint(resource) + encodeParams(encodeStringParam("domain", string(domain), ""), encodeStringParam("principal", string(checkPrincipal), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetAccessExt(action ActionName, resource string, domain DomainName, checkPrincipal EntityName) (*Access, error) { + var data *Access + url := client.URL + "/access/" + fmt.Sprint(action) + encodeParams(encodeStringParam("resource", string(resource), ""), encodeStringParam("domain", string(domain), ""), encodeStringParam("principal", string(checkPrincipal), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetResourceAccessList(principal EntityName, action ActionName) (*ResourceAccessList, error) { + var data *ResourceAccessList + url := client.URL + "/resource" + encodeParams(encodeStringParam("principal", string(principal), ""), encodeStringParam("action", string(action), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetSignedDomains(domain DomainName, metaOnly string, matchingTag string) (*SignedDomains, string, error) { + var data *SignedDomains + headers := map[string]string{ + "If-None-Match": matchingTag, + } + url := client.URL + "/sys/modified_domains" + encodeParams(encodeStringParam("domain", string(domain), ""), encodeStringParam("metaonly", string(metaOnly), "")) + resp, err := client.httpGet(url, headers) + if err != nil { + return nil, "", err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return nil, "", err + } + switch resp.StatusCode { + case 200, 304: + if 304 != resp.StatusCode { + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return nil, "", err + } + } + tag := resp.Header.Get(rdl.FoldHttpHeaderName("ETag")) + return data, tag, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return nil, "", errobj + } +} + +func (client ZMSClient) GetUserToken(userName SimpleName, serviceNames string) (*UserToken, error) { + var data *UserToken + url := client.URL + "/user/" + fmt.Sprint(userName) + "/token" + encodeParams(encodeStringParam("services", string(serviceNames), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) OptionsUserToken(userName SimpleName, serviceNames string) (*UserToken, error) { + var data *UserToken + url := client.URL + "/user/" + fmt.Sprint(userName) + "/token" + encodeParams(encodeStringParam("services", string(serviceNames), "")) + resp, err := client.httpOptions(url, nil, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetServicePrincipal() (*ServicePrincipal, error) { + var data *ServicePrincipal + url := client.URL + "/principal" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetServerTemplateList() (*ServerTemplateList, error) { + var data *ServerTemplateList + url := client.URL + "/template" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZMSClient) GetTemplate(template SimpleName) (*Template, error) { + var data *Template + url := client.URL + "/template/" + fmt.Sprint(template) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} diff --git a/clients/go/zms/model.go b/clients/go/zms/model.go new file mode 100644 index 00000000000..d6c96612a8b --- /dev/null +++ b/clients/go/zms/model.go @@ -0,0 +1,3827 @@ +// +// This file generated by rdl 1.4.8 +// + +package zms + +import ( + "encoding/json" + "fmt" + rdl "github.com/ardielle/ardielle-go/rdl" +) + +var _ = rdl.Version +var _ = json.Marshal +var _ = fmt.Printf + +// +// SimpleName - Copyright 2016 Yahoo Inc. Licensed under the terms of the +// Apache version 2.0 license. See LICENSE file for terms. Common name types +// used by several API definitions A simple identifier, an element of compound +// name. +// +type SimpleName string + +// +// CompoundName - A compound name. Most names in this API are compound names. +// +type CompoundName string + +// +// DomainName - A domain name is the general qualifier prefix, as its +// uniqueness is managed. +// +type DomainName string + +// +// EntityName - An entity name is a short form of a resource name, including +// only the domain and entity. +// +type EntityName string + +// +// ServiceName - A service name will generally be a unique subdomain. +// +type ServiceName string + +// +// LocationName - A location name is not yet defined, but will be a dotted name +// like everything else. +// +type LocationName string + +// +// ActionName - An action (operation) name. +// +type ActionName string + +// +// ResourceName - A shorthand for a YRN with no service or location. The 'tail' +// of a YRN, just the domain:entity. Note that the EntityName part is optional, +// that is, a domain name followed by a colon is valid resource name. +// +type ResourceName string + +// +// YRN - A full Yahoo Resource name (YRN). +// +type YRN string + +// +// YBase64 - The Y-specific URL-safe Base64 variant. +// +type YBase64 string + +// +// YEncoded - YEncoded includes ybase64 chars, as well as = and %. This can +// represent a user cookie and URL-encoded values. +// +type YEncoded string + +// +// AuthorityName - Used as the prefix in a signed assertion. This uniquely +// identifies a signing authority. i.e. "user" +// +type AuthorityName string + +// +// SignedToken - A signed assertion if identity. i.e. the user cookie value. +// This token will only make sense to the authority that generated it, so it is +// beneficial to have something in the value that is cheaply recognized to +// quickly reject if it belongs to another authority. In addition to the +// YEncoded set our token includes ; to separate components and , to separate +// roles and : for IPv6 addresses +// +type SignedToken string + +// +// Domain - A domain is an independent partition of users, roles, and +// resources. Its name represents the definition of a namespace; the only way a +// new namespace can be created, from the top, is by creating Domains. +// Administration of a domain is governed by the parent domain (using +// reverse-DNS namespaces). The top level domains are governed by the special +// "sys.auth" domain. +// +type Domain struct { + + // + // the common name to be referred to, the symbolic id. It is immutable + // + Name DomainName `json:"name"` + + // + // the last modification timestamp of any object or attribute in this domain + // + Modified *rdl.Timestamp `json:"modified,omitempty" rdl:"optional"` + + // + // unique identifier of the domain. generated on create, never reused + // + Id *rdl.UUID `json:"id,omitempty" rdl:"optional"` + + // + // description of the domain + // + Description string `json:"description,omitempty" rdl:"optional"` + + // + // a reference to an Organization + // + Org ResourceName `json:"org,omitempty" rdl:"optional"` + + // + // Future use only, currently not used + // + Enabled *bool `json:"enabled,omitempty" rdl:"optional"` + + // + // Flag indicates whether or not domain modifications should be logged for + // SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for + // any API defining it. + // + AuditEnabled *bool `json:"auditEnabled,omitempty" rdl:"optional"` + + // + // associated cloud (i.e. aws) account id + // + Account string `json:"account,omitempty" rdl:"optional"` + + // + // associated product id + // + YpmId *int32 `json:"ypmId,omitempty" rdl:"optional"` +} + +// +// NewDomain - creates an initialized Domain instance, returns a pointer to it +// +func NewDomain(init ...*Domain) *Domain { + var o *Domain + if len(init) == 1 { + o = init[0] + } else { + o = new(Domain) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Domain) Init() *Domain { + if pTypeDef.Enabled == nil { + d := true + pTypeDef.Enabled = &d + } + if pTypeDef.AuditEnabled == nil { + d := false + pTypeDef.AuditEnabled = &d + } + return pTypeDef +} + +type rawDomain Domain + +// +// UnmarshalJSON is defined for proper JSON decoding of a Domain +// +func (pTypeDef *Domain) UnmarshalJSON(b []byte) error { + var r rawDomain + err := json.Unmarshal(b, &r) + if err == nil { + o := Domain(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Domain) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("Domain.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("Domain.name does not contain a valid DomainName (%v)", val.Error) + } + } + return nil +} + +// +// RoleList - The representation for an enumeration of roles in the namespace, +// with pagination. +// +type RoleList struct { + + // + // list of role names + // + Names []EntityName `json:"names"` + + // + // if the response is a paginated list, this attribute specifies the value to + // be used in the next role list request as the value for the skip query + // parameter. + // + Next string `json:"next,omitempty" rdl:"optional"` +} + +// +// NewRoleList - creates an initialized RoleList instance, returns a pointer to it +// +func NewRoleList(init ...*RoleList) *RoleList { + var o *RoleList + if len(init) == 1 { + o = init[0] + } else { + o = new(RoleList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *RoleList) Init() *RoleList { + if pTypeDef.Names == nil { + pTypeDef.Names = make([]EntityName, 0) + } + return pTypeDef +} + +type rawRoleList RoleList + +// +// UnmarshalJSON is defined for proper JSON decoding of a RoleList +// +func (pTypeDef *RoleList) UnmarshalJSON(b []byte) error { + var r rawRoleList + err := json.Unmarshal(b, &r) + if err == nil { + o := RoleList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *RoleList) Validate() error { + if pTypeDef.Names == nil { + return fmt.Errorf("RoleList: Missing required field: names") + } + return nil +} + +// +// RoleAuditLog - An audit log entry for role membership change. +// +type RoleAuditLog struct { + + // + // name of the role member + // + Member ResourceName `json:"member"` + + // + // name of the principal executing the change + // + Admin ResourceName `json:"admin"` + + // + // timestamp of the entry + // + Created rdl.Timestamp `json:"created"` + + // + // log action - either add or delete + // + Action string `json:"action"` + + // + // audit reference string for the change as supplied by admin + // + AuditRef string `json:"auditRef,omitempty" rdl:"optional"` +} + +// +// NewRoleAuditLog - creates an initialized RoleAuditLog instance, returns a pointer to it +// +func NewRoleAuditLog(init ...*RoleAuditLog) *RoleAuditLog { + var o *RoleAuditLog + if len(init) == 1 { + o = init[0] + } else { + o = new(RoleAuditLog) + } + return o +} + +type rawRoleAuditLog RoleAuditLog + +// +// UnmarshalJSON is defined for proper JSON decoding of a RoleAuditLog +// +func (pTypeDef *RoleAuditLog) UnmarshalJSON(b []byte) error { + var r rawRoleAuditLog + err := json.Unmarshal(b, &r) + if err == nil { + o := RoleAuditLog(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *RoleAuditLog) Validate() error { + if pTypeDef.Member == "" { + return fmt.Errorf("RoleAuditLog.member is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ResourceName", pTypeDef.Member) + if !val.Valid { + return fmt.Errorf("RoleAuditLog.member does not contain a valid ResourceName (%v)", val.Error) + } + } + if pTypeDef.Admin == "" { + return fmt.Errorf("RoleAuditLog.admin is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ResourceName", pTypeDef.Admin) + if !val.Valid { + return fmt.Errorf("RoleAuditLog.admin does not contain a valid ResourceName (%v)", val.Error) + } + } + if pTypeDef.Created.IsZero() { + return fmt.Errorf("RoleAuditLog: Missing required field: created") + } + if pTypeDef.Action == "" { + return fmt.Errorf("RoleAuditLog.action is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Action) + if !val.Valid { + return fmt.Errorf("RoleAuditLog.action does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// Role - The representation for a Role with set of members. +// +type Role struct { + + // + // name of the role + // + Name ResourceName `json:"name"` + + // + // last modification timestamp of the role + // + Modified *rdl.Timestamp `json:"modified,omitempty" rdl:"optional"` + + // + // an explicit list of members. Might be empty or null, if trust is set + // + Members []ResourceName `json:"members,omitempty" rdl:"optional"` + + // + // a trusted domain to delegate membership decisions to + // + Trust DomainName `json:"trust,omitempty" rdl:"optional"` + + // + // an audit log for role membership changes + // + AuditLog []*RoleAuditLog `json:"auditLog,omitempty" rdl:"optional"` +} + +// +// NewRole - creates an initialized Role instance, returns a pointer to it +// +func NewRole(init ...*Role) *Role { + var o *Role + if len(init) == 1 { + o = init[0] + } else { + o = new(Role) + } + return o +} + +type rawRole Role + +// +// UnmarshalJSON is defined for proper JSON decoding of a Role +// +func (pTypeDef *Role) UnmarshalJSON(b []byte) error { + var r rawRole + err := json.Unmarshal(b, &r) + if err == nil { + o := Role(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Role) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("Role.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ResourceName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("Role.name does not contain a valid ResourceName (%v)", val.Error) + } + } + return nil +} + +// +// Roles - The representation for a list of roles with full details +// +type Roles struct { + + // + // list of role objects + // + List []*Role `json:"list"` +} + +// +// NewRoles - creates an initialized Roles instance, returns a pointer to it +// +func NewRoles(init ...*Roles) *Roles { + var o *Roles + if len(init) == 1 { + o = init[0] + } else { + o = new(Roles) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Roles) Init() *Roles { + if pTypeDef.List == nil { + pTypeDef.List = make([]*Role, 0) + } + return pTypeDef +} + +type rawRoles Roles + +// +// UnmarshalJSON is defined for proper JSON decoding of a Roles +// +func (pTypeDef *Roles) UnmarshalJSON(b []byte) error { + var r rawRoles + err := json.Unmarshal(b, &r) + if err == nil { + o := Roles(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Roles) Validate() error { + if pTypeDef.List == nil { + return fmt.Errorf("Roles: Missing required field: list") + } + return nil +} + +// +// Membership - The representation for a role membership. +// +type Membership struct { + + // + // name of the member + // + MemberName ResourceName `json:"memberName"` + + // + // flag to indicate whether or the user is a member or not + // + IsMember *bool `json:"isMember,omitempty" rdl:"optional"` + + // + // name of the role + // + RoleName ResourceName `json:"roleName,omitempty" rdl:"optional"` +} + +// +// NewMembership - creates an initialized Membership instance, returns a pointer to it +// +func NewMembership(init ...*Membership) *Membership { + var o *Membership + if len(init) == 1 { + o = init[0] + } else { + o = new(Membership) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Membership) Init() *Membership { + if pTypeDef.IsMember == nil { + d := true + pTypeDef.IsMember = &d + } + return pTypeDef +} + +type rawMembership Membership + +// +// UnmarshalJSON is defined for proper JSON decoding of a Membership +// +func (pTypeDef *Membership) UnmarshalJSON(b []byte) error { + var r rawMembership + err := json.Unmarshal(b, &r) + if err == nil { + o := Membership(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Membership) Validate() error { + if pTypeDef.MemberName == "" { + return fmt.Errorf("Membership.memberName is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ResourceName", pTypeDef.MemberName) + if !val.Valid { + return fmt.Errorf("Membership.memberName does not contain a valid ResourceName (%v)", val.Error) + } + } + return nil +} + +// +// DefaultAdmins - The list of domain administrators. +// +type DefaultAdmins struct { + + // + // list of domain administrators + // + Admins []ResourceName `json:"admins"` +} + +// +// NewDefaultAdmins - creates an initialized DefaultAdmins instance, returns a pointer to it +// +func NewDefaultAdmins(init ...*DefaultAdmins) *DefaultAdmins { + var o *DefaultAdmins + if len(init) == 1 { + o = init[0] + } else { + o = new(DefaultAdmins) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DefaultAdmins) Init() *DefaultAdmins { + if pTypeDef.Admins == nil { + pTypeDef.Admins = make([]ResourceName, 0) + } + return pTypeDef +} + +type rawDefaultAdmins DefaultAdmins + +// +// UnmarshalJSON is defined for proper JSON decoding of a DefaultAdmins +// +func (pTypeDef *DefaultAdmins) UnmarshalJSON(b []byte) error { + var r rawDefaultAdmins + err := json.Unmarshal(b, &r) + if err == nil { + o := DefaultAdmins(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DefaultAdmins) Validate() error { + if pTypeDef.Admins == nil { + return fmt.Errorf("DefaultAdmins: Missing required field: admins") + } + return nil +} + +// +// AssertionEffect - Every assertion can have the effect of ALLOW or DENY. +// +type AssertionEffect int + +// +// AssertionEffect constants +// +const ( + _ AssertionEffect = iota + ALLOW + DENY +) + +var namesAssertionEffect = []string{ + ALLOW: "ALLOW", + DENY: "DENY", +} + +// +// NewAssertionEffect - return a string representation of the enum +// +func NewAssertionEffect(init ...interface{}) AssertionEffect { + if len(init) == 1 { + switch v := init[0].(type) { + case AssertionEffect: + return v + case int: + return AssertionEffect(v) + case int32: + return AssertionEffect(v) + case string: + for i, s := range namesAssertionEffect { + if s == v { + return AssertionEffect(i) + } + } + default: + panic("Bad init value for AssertionEffect enum") + } + } + return AssertionEffect(0) //default to the first enum value +} + +// +// String - return a string representation of the enum +// +func (e AssertionEffect) String() string { + return namesAssertionEffect[e] +} + +// +// SymbolSet - return an array of all valid string representations (symbols) of the enum +// +func (e AssertionEffect) SymbolSet() []string { + return namesAssertionEffect +} + +// +// MarshalJSON is defined for proper JSON encoding of a AssertionEffect +// +func (e AssertionEffect) MarshalJSON() ([]byte, error) { + return json.Marshal(e.String()) +} + +// +// UnmarshalJSON is defined for proper JSON decoding of a AssertionEffect +// +func (e *AssertionEffect) UnmarshalJSON(b []byte) error { + var j string + err := json.Unmarshal(b, &j) + if err == nil { + s := string(j) + for v, s2 := range namesAssertionEffect { + if s == s2 { + *e = AssertionEffect(v) + return nil + } + } + err = fmt.Errorf("Bad enum symbol for type AssertionEffect: %s", s) + } + return err +} + +// +// Assertion - A representation for the encapsulation of an action to be +// performed on a resource by a principal. +// +type Assertion struct { + + // + // the subject of the assertion - a role + // + Role string `json:"role"` + + // + // the object of the assertion. Must be in the local namespace. Can contain + // wildcards + // + Resource string `json:"resource"` + + // + // the predicate of the assertion. Can contain wildcards + // + Action string `json:"action"` + + // + // the effect of the assertion in the policy language + // + Effect *AssertionEffect `json:"effect,omitempty" rdl:"optional"` + + // + // assertion id - auto generated by server. Not required during put + // operations. + // + Id *int64 `json:"id,omitempty" rdl:"optional"` +} + +// +// NewAssertion - creates an initialized Assertion instance, returns a pointer to it +// +func NewAssertion(init ...*Assertion) *Assertion { + var o *Assertion + if len(init) == 1 { + o = init[0] + } else { + o = new(Assertion) + } + return o +} + +type rawAssertion Assertion + +// +// UnmarshalJSON is defined for proper JSON decoding of a Assertion +// +func (pTypeDef *Assertion) UnmarshalJSON(b []byte) error { + var r rawAssertion + err := json.Unmarshal(b, &r) + if err == nil { + o := Assertion(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Assertion) Validate() error { + if pTypeDef.Role == "" { + return fmt.Errorf("Assertion.role is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Role) + if !val.Valid { + return fmt.Errorf("Assertion.role does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Resource == "" { + return fmt.Errorf("Assertion.resource is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Resource) + if !val.Valid { + return fmt.Errorf("Assertion.resource does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Action == "" { + return fmt.Errorf("Assertion.action is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Action) + if !val.Valid { + return fmt.Errorf("Assertion.action does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// Policy - The representation for a Policy with set of assertions. +// +type Policy struct { + + // + // name of the policy + // + Name ResourceName `json:"name"` + + // + // last modification timestamp of this policy + // + Modified *rdl.Timestamp `json:"modified,omitempty" rdl:"optional"` + + // + // list of defined assertions for this policy + // + Assertions []*Assertion `json:"assertions"` +} + +// +// NewPolicy - creates an initialized Policy instance, returns a pointer to it +// +func NewPolicy(init ...*Policy) *Policy { + var o *Policy + if len(init) == 1 { + o = init[0] + } else { + o = new(Policy) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Policy) Init() *Policy { + if pTypeDef.Assertions == nil { + pTypeDef.Assertions = make([]*Assertion, 0) + } + return pTypeDef +} + +type rawPolicy Policy + +// +// UnmarshalJSON is defined for proper JSON decoding of a Policy +// +func (pTypeDef *Policy) UnmarshalJSON(b []byte) error { + var r rawPolicy + err := json.Unmarshal(b, &r) + if err == nil { + o := Policy(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Policy) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("Policy.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ResourceName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("Policy.name does not contain a valid ResourceName (%v)", val.Error) + } + } + if pTypeDef.Assertions == nil { + return fmt.Errorf("Policy: Missing required field: assertions") + } + return nil +} + +// +// Policies - The representation of list of policy objects +// +type Policies struct { + + // + // list of policy objects + // + List []*Policy `json:"list"` +} + +// +// NewPolicies - creates an initialized Policies instance, returns a pointer to it +// +func NewPolicies(init ...*Policies) *Policies { + var o *Policies + if len(init) == 1 { + o = init[0] + } else { + o = new(Policies) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Policies) Init() *Policies { + if pTypeDef.List == nil { + pTypeDef.List = make([]*Policy, 0) + } + return pTypeDef +} + +type rawPolicies Policies + +// +// UnmarshalJSON is defined for proper JSON decoding of a Policies +// +func (pTypeDef *Policies) UnmarshalJSON(b []byte) error { + var r rawPolicies + err := json.Unmarshal(b, &r) + if err == nil { + o := Policies(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Policies) Validate() error { + if pTypeDef.List == nil { + return fmt.Errorf("Policies: Missing required field: list") + } + return nil +} + +// +// Template - Solution Template object defined on the server +// +type Template struct { + + // + // list of roles in the template + // + Roles []*Role `json:"roles"` + + // + // list of policies defined in this template + // + Policies []*Policy `json:"policies"` +} + +// +// NewTemplate - creates an initialized Template instance, returns a pointer to it +// +func NewTemplate(init ...*Template) *Template { + var o *Template + if len(init) == 1 { + o = init[0] + } else { + o = new(Template) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Template) Init() *Template { + if pTypeDef.Roles == nil { + pTypeDef.Roles = make([]*Role, 0) + } + if pTypeDef.Policies == nil { + pTypeDef.Policies = make([]*Policy, 0) + } + return pTypeDef +} + +type rawTemplate Template + +// +// UnmarshalJSON is defined for proper JSON decoding of a Template +// +func (pTypeDef *Template) UnmarshalJSON(b []byte) error { + var r rawTemplate + err := json.Unmarshal(b, &r) + if err == nil { + o := Template(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Template) Validate() error { + if pTypeDef.Roles == nil { + return fmt.Errorf("Template: Missing required field: roles") + } + if pTypeDef.Policies == nil { + return fmt.Errorf("Template: Missing required field: policies") + } + return nil +} + +// +// TemplateList - List of template names that is the base struct for server and +// domain templates +// +type TemplateList struct { + + // + // list of template names + // + TemplateNames []SimpleName `json:"templateNames"` +} + +// +// NewTemplateList - creates an initialized TemplateList instance, returns a pointer to it +// +func NewTemplateList(init ...*TemplateList) *TemplateList { + var o *TemplateList + if len(init) == 1 { + o = init[0] + } else { + o = new(TemplateList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *TemplateList) Init() *TemplateList { + if pTypeDef.TemplateNames == nil { + pTypeDef.TemplateNames = make([]SimpleName, 0) + } + return pTypeDef +} + +type rawTemplateList TemplateList + +// +// UnmarshalJSON is defined for proper JSON decoding of a TemplateList +// +func (pTypeDef *TemplateList) UnmarshalJSON(b []byte) error { + var r rawTemplateList + err := json.Unmarshal(b, &r) + if err == nil { + o := TemplateList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *TemplateList) Validate() error { + if pTypeDef.TemplateNames == nil { + return fmt.Errorf("TemplateList: Missing required field: templateNames") + } + return nil +} + +// +// DomainTemplate - solution template(s) to be applied to a domain +// +type DomainTemplate struct { + + // + // list of template names + // + TemplateNames []SimpleName `json:"templateNames"` +} + +// +// NewDomainTemplate - creates an initialized DomainTemplate instance, returns a pointer to it +// +func NewDomainTemplate(init ...*DomainTemplate) *DomainTemplate { + var o *DomainTemplate + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainTemplate) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainTemplate) Init() *DomainTemplate { + if pTypeDef.TemplateNames == nil { + pTypeDef.TemplateNames = make([]SimpleName, 0) + } + return pTypeDef +} + +type rawDomainTemplate DomainTemplate + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainTemplate +// +func (pTypeDef *DomainTemplate) UnmarshalJSON(b []byte) error { + var r rawDomainTemplate + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainTemplate(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainTemplate) Validate() error { + if pTypeDef.TemplateNames == nil { + return fmt.Errorf("DomainTemplate: Missing required field: templateNames") + } + return nil +} + +// +// DomainTemplateList - List of solution templates to be applied to a domain +// +type DomainTemplateList struct { + + // + // list of template names + // + TemplateNames []SimpleName `json:"templateNames"` +} + +// +// NewDomainTemplateList - creates an initialized DomainTemplateList instance, returns a pointer to it +// +func NewDomainTemplateList(init ...*DomainTemplateList) *DomainTemplateList { + var o *DomainTemplateList + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainTemplateList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainTemplateList) Init() *DomainTemplateList { + if pTypeDef.TemplateNames == nil { + pTypeDef.TemplateNames = make([]SimpleName, 0) + } + return pTypeDef +} + +type rawDomainTemplateList DomainTemplateList + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainTemplateList +// +func (pTypeDef *DomainTemplateList) UnmarshalJSON(b []byte) error { + var r rawDomainTemplateList + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainTemplateList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainTemplateList) Validate() error { + if pTypeDef.TemplateNames == nil { + return fmt.Errorf("DomainTemplateList: Missing required field: templateNames") + } + return nil +} + +// +// ServerTemplateList - List of solution templates available in the server +// +type ServerTemplateList struct { + + // + // list of template names + // + TemplateNames []SimpleName `json:"templateNames"` +} + +// +// NewServerTemplateList - creates an initialized ServerTemplateList instance, returns a pointer to it +// +func NewServerTemplateList(init ...*ServerTemplateList) *ServerTemplateList { + var o *ServerTemplateList + if len(init) == 1 { + o = init[0] + } else { + o = new(ServerTemplateList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *ServerTemplateList) Init() *ServerTemplateList { + if pTypeDef.TemplateNames == nil { + pTypeDef.TemplateNames = make([]SimpleName, 0) + } + return pTypeDef +} + +type rawServerTemplateList ServerTemplateList + +// +// UnmarshalJSON is defined for proper JSON decoding of a ServerTemplateList +// +func (pTypeDef *ServerTemplateList) UnmarshalJSON(b []byte) error { + var r rawServerTemplateList + err := json.Unmarshal(b, &r) + if err == nil { + o := ServerTemplateList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ServerTemplateList) Validate() error { + if pTypeDef.TemplateNames == nil { + return fmt.Errorf("ServerTemplateList: Missing required field: templateNames") + } + return nil +} + +// +// DomainList - A paginated list of domains. +// +type DomainList struct { + + // + // list of domain names + // + Names []DomainName `json:"names"` + + // + // if the response is a paginated list, this attribute specifies the value to + // be used in the next domain list request as the value for the skip query + // parameter. + // + Next string `json:"next,omitempty" rdl:"optional"` +} + +// +// NewDomainList - creates an initialized DomainList instance, returns a pointer to it +// +func NewDomainList(init ...*DomainList) *DomainList { + var o *DomainList + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainList) Init() *DomainList { + if pTypeDef.Names == nil { + pTypeDef.Names = make([]DomainName, 0) + } + return pTypeDef +} + +type rawDomainList DomainList + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainList +// +func (pTypeDef *DomainList) UnmarshalJSON(b []byte) error { + var r rawDomainList + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainList) Validate() error { + if pTypeDef.Names == nil { + return fmt.Errorf("DomainList: Missing required field: names") + } + return nil +} + +// +// DomainMeta - Set of metadata attributes that all domains may have and can be +// changed. +// +type DomainMeta struct { + + // + // a description of the domain + // + Description string `json:"description,omitempty" rdl:"optional"` + + // + // a reference to an Organization. (i.e. org:media) + // + Org ResourceName `json:"org,omitempty" rdl:"optional"` + + // + // Future use only, currently not used + // + Enabled *bool `json:"enabled,omitempty" rdl:"optional"` + + // + // Flag indicates whether or not domain modifications should be logged for + // SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for + // any API defining it. + // + AuditEnabled *bool `json:"auditEnabled,omitempty" rdl:"optional"` + + // + // associated cloud (i.e. aws) account id + // + Account string `json:"account,omitempty" rdl:"optional"` + + // + // associated product id + // + YpmId *int32 `json:"ypmId,omitempty" rdl:"optional"` +} + +// +// NewDomainMeta - creates an initialized DomainMeta instance, returns a pointer to it +// +func NewDomainMeta(init ...*DomainMeta) *DomainMeta { + var o *DomainMeta + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainMeta) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainMeta) Init() *DomainMeta { + if pTypeDef.Enabled == nil { + d := true + pTypeDef.Enabled = &d + } + if pTypeDef.AuditEnabled == nil { + d := false + pTypeDef.AuditEnabled = &d + } + return pTypeDef +} + +type rawDomainMeta DomainMeta + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainMeta +// +func (pTypeDef *DomainMeta) UnmarshalJSON(b []byte) error { + var r rawDomainMeta + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainMeta(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainMeta) Validate() error { + return nil +} + +// +// TopLevelDomain - Top Level Domain object. The required attributes include +// the name of the domain and list of domain administrators. +// +type TopLevelDomain struct { + + // + // a description of the domain + // + Description string `json:"description,omitempty" rdl:"optional"` + + // + // a reference to an Organization. (i.e. org:media) + // + Org ResourceName `json:"org,omitempty" rdl:"optional"` + + // + // Future use only, currently not used + // + Enabled *bool `json:"enabled,omitempty" rdl:"optional"` + + // + // Flag indicates whether or not domain modifications should be logged for + // SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for + // any API defining it. + // + AuditEnabled *bool `json:"auditEnabled,omitempty" rdl:"optional"` + + // + // associated cloud (i.e. aws) account id + // + Account string `json:"account,omitempty" rdl:"optional"` + + // + // associated product id + // + YpmId *int32 `json:"ypmId,omitempty" rdl:"optional"` + + // + // name of the domain + // + Name SimpleName `json:"name"` + + // + // list of domain administrators + // + AdminUsers []ResourceName `json:"adminUsers"` + + // + // list of solution template names + // + Templates *DomainTemplateList `json:"templates,omitempty" rdl:"optional"` +} + +// +// NewTopLevelDomain - creates an initialized TopLevelDomain instance, returns a pointer to it +// +func NewTopLevelDomain(init ...*TopLevelDomain) *TopLevelDomain { + var o *TopLevelDomain + if len(init) == 1 { + o = init[0] + } else { + o = new(TopLevelDomain) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *TopLevelDomain) Init() *TopLevelDomain { + if pTypeDef.Enabled == nil { + d := true + pTypeDef.Enabled = &d + } + if pTypeDef.AuditEnabled == nil { + d := false + pTypeDef.AuditEnabled = &d + } + if pTypeDef.AdminUsers == nil { + pTypeDef.AdminUsers = make([]ResourceName, 0) + } + return pTypeDef +} + +type rawTopLevelDomain TopLevelDomain + +// +// UnmarshalJSON is defined for proper JSON decoding of a TopLevelDomain +// +func (pTypeDef *TopLevelDomain) UnmarshalJSON(b []byte) error { + var r rawTopLevelDomain + err := json.Unmarshal(b, &r) + if err == nil { + o := TopLevelDomain(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *TopLevelDomain) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("TopLevelDomain.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SimpleName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("TopLevelDomain.name does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.AdminUsers == nil { + return fmt.Errorf("TopLevelDomain: Missing required field: adminUsers") + } + return nil +} + +// +// SubDomain - A Subdomain is a TopLevelDomain, except it has a parent. +// +type SubDomain struct { + + // + // a description of the domain + // + Description string `json:"description,omitempty" rdl:"optional"` + + // + // a reference to an Organization. (i.e. org:media) + // + Org ResourceName `json:"org,omitempty" rdl:"optional"` + + // + // Future use only, currently not used + // + Enabled *bool `json:"enabled,omitempty" rdl:"optional"` + + // + // Flag indicates whether or not domain modifications should be logged for + // SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for + // any API defining it. + // + AuditEnabled *bool `json:"auditEnabled,omitempty" rdl:"optional"` + + // + // associated cloud (i.e. aws) account id + // + Account string `json:"account,omitempty" rdl:"optional"` + + // + // associated product id + // + YpmId *int32 `json:"ypmId,omitempty" rdl:"optional"` + + // + // name of the domain + // + Name SimpleName `json:"name"` + + // + // list of domain administrators + // + AdminUsers []ResourceName `json:"adminUsers"` + + // + // list of solution template names + // + Templates *DomainTemplateList `json:"templates,omitempty" rdl:"optional"` + + // + // name of the parent domain + // + Parent DomainName `json:"parent"` +} + +// +// NewSubDomain - creates an initialized SubDomain instance, returns a pointer to it +// +func NewSubDomain(init ...*SubDomain) *SubDomain { + var o *SubDomain + if len(init) == 1 { + o = init[0] + } else { + o = new(SubDomain) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *SubDomain) Init() *SubDomain { + if pTypeDef.Enabled == nil { + d := true + pTypeDef.Enabled = &d + } + if pTypeDef.AuditEnabled == nil { + d := false + pTypeDef.AuditEnabled = &d + } + if pTypeDef.AdminUsers == nil { + pTypeDef.AdminUsers = make([]ResourceName, 0) + } + return pTypeDef +} + +type rawSubDomain SubDomain + +// +// UnmarshalJSON is defined for proper JSON decoding of a SubDomain +// +func (pTypeDef *SubDomain) UnmarshalJSON(b []byte) error { + var r rawSubDomain + err := json.Unmarshal(b, &r) + if err == nil { + o := SubDomain(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *SubDomain) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("SubDomain.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SimpleName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("SubDomain.name does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.AdminUsers == nil { + return fmt.Errorf("SubDomain: Missing required field: adminUsers") + } + if pTypeDef.Parent == "" { + return fmt.Errorf("SubDomain.parent is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Parent) + if !val.Valid { + return fmt.Errorf("SubDomain.parent does not contain a valid DomainName (%v)", val.Error) + } + } + return nil +} + +// +// UserDomain - A UserDomain is the user's own top level domain in user - e.g. +// user.hga +// +type UserDomain struct { + + // + // a description of the domain + // + Description string `json:"description,omitempty" rdl:"optional"` + + // + // a reference to an Organization. (i.e. org:media) + // + Org ResourceName `json:"org,omitempty" rdl:"optional"` + + // + // Future use only, currently not used + // + Enabled *bool `json:"enabled,omitempty" rdl:"optional"` + + // + // Flag indicates whether or not domain modifications should be logged for + // SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for + // any API defining it. + // + AuditEnabled *bool `json:"auditEnabled,omitempty" rdl:"optional"` + + // + // associated cloud (i.e. aws) account id + // + Account string `json:"account,omitempty" rdl:"optional"` + + // + // associated product id + // + YpmId *int32 `json:"ypmId,omitempty" rdl:"optional"` + + // + // user id which will be the domain name + // + Name SimpleName `json:"name"` + + // + // list of solution template names + // + Templates *DomainTemplateList `json:"templates,omitempty" rdl:"optional"` +} + +// +// NewUserDomain - creates an initialized UserDomain instance, returns a pointer to it +// +func NewUserDomain(init ...*UserDomain) *UserDomain { + var o *UserDomain + if len(init) == 1 { + o = init[0] + } else { + o = new(UserDomain) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *UserDomain) Init() *UserDomain { + if pTypeDef.Enabled == nil { + d := true + pTypeDef.Enabled = &d + } + if pTypeDef.AuditEnabled == nil { + d := false + pTypeDef.AuditEnabled = &d + } + return pTypeDef +} + +type rawUserDomain UserDomain + +// +// UnmarshalJSON is defined for proper JSON decoding of a UserDomain +// +func (pTypeDef *UserDomain) UnmarshalJSON(b []byte) error { + var r rawUserDomain + err := json.Unmarshal(b, &r) + if err == nil { + o := UserDomain(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *UserDomain) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("UserDomain.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SimpleName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("UserDomain.name does not contain a valid SimpleName (%v)", val.Error) + } + } + return nil +} + +// +// DanglingPolicy - A dangling policy where the assertion is referencing a role +// name that doesn't exist in the domain +// +type DanglingPolicy struct { + PolicyName EntityName `json:"policyName"` + RoleName EntityName `json:"roleName"` +} + +// +// NewDanglingPolicy - creates an initialized DanglingPolicy instance, returns a pointer to it +// +func NewDanglingPolicy(init ...*DanglingPolicy) *DanglingPolicy { + var o *DanglingPolicy + if len(init) == 1 { + o = init[0] + } else { + o = new(DanglingPolicy) + } + return o +} + +type rawDanglingPolicy DanglingPolicy + +// +// UnmarshalJSON is defined for proper JSON decoding of a DanglingPolicy +// +func (pTypeDef *DanglingPolicy) UnmarshalJSON(b []byte) error { + var r rawDanglingPolicy + err := json.Unmarshal(b, &r) + if err == nil { + o := DanglingPolicy(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DanglingPolicy) Validate() error { + if pTypeDef.PolicyName == "" { + return fmt.Errorf("DanglingPolicy.policyName is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.PolicyName) + if !val.Valid { + return fmt.Errorf("DanglingPolicy.policyName does not contain a valid EntityName (%v)", val.Error) + } + } + if pTypeDef.RoleName == "" { + return fmt.Errorf("DanglingPolicy.roleName is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.RoleName) + if !val.Valid { + return fmt.Errorf("DanglingPolicy.roleName does not contain a valid EntityName (%v)", val.Error) + } + } + return nil +} + +// +// DomainDataCheck - Domain data object representing the results of a check +// operation looking for dangling roles, policies and trust relationships that +// are set either on tenant or provider side only +// +type DomainDataCheck struct { + + // + // Names of roles not specified in any assertion. Might be empty or null if no + // dangling roles. + // + DanglingRoles []EntityName `json:"danglingRoles,omitempty" rdl:"optional"` + + // + // Policy+role tuples where role doesnt exist. Might be empty or null if no + // dangling policies. + // + DanglingPolicies []*DanglingPolicy `json:"danglingPolicies,omitempty" rdl:"optional"` + + // + // total number of policies + // + PolicyCount int32 `json:"policyCount"` + + // + // total number of assertions + // + AssertionCount int32 `json:"assertionCount"` + + // + // total number of assertions containing roles as wildcards + // + RoleWildCardCount int32 `json:"roleWildCardCount"` + + // + // Service names (domain.service) that dont contain trust role if this is a + // tenant domain. Might be empty or null, if not a tenant or if all providers + // support this tenant. + // + ProvidersWithoutTrust []ServiceName `json:"providersWithoutTrust,omitempty" rdl:"optional"` + + // + // Names of Tenant domains that dont contain assume role assertions if this is + // a provider domain. Might be empty or null, if not a provider or if all + // tenants support use this provider. + // + TenantsWithoutAssumeRole []DomainName `json:"tenantsWithoutAssumeRole,omitempty" rdl:"optional"` +} + +// +// NewDomainDataCheck - creates an initialized DomainDataCheck instance, returns a pointer to it +// +func NewDomainDataCheck(init ...*DomainDataCheck) *DomainDataCheck { + var o *DomainDataCheck + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainDataCheck) + } + return o +} + +type rawDomainDataCheck DomainDataCheck + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainDataCheck +// +func (pTypeDef *DomainDataCheck) UnmarshalJSON(b []byte) error { + var r rawDomainDataCheck + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainDataCheck(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainDataCheck) Validate() error { + return nil +} + +// +// Entity - An entity is a name and a structured value. some entity +// names/prefixes are reserved (i.e. "role", "policy", "meta", "domain", +// "service") +// +type Entity struct { + + // + // name of the entity object + // + Name EntityName `json:"name"` + + // + // value of the entity + // + Value rdl.Struct `json:"value"` +} + +// +// NewEntity - creates an initialized Entity instance, returns a pointer to it +// +func NewEntity(init ...*Entity) *Entity { + var o *Entity + if len(init) == 1 { + o = init[0] + } else { + o = new(Entity) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Entity) Init() *Entity { + if pTypeDef.Value == nil { + pTypeDef.Value = make(rdl.Struct) + } + return pTypeDef +} + +type rawEntity Entity + +// +// UnmarshalJSON is defined for proper JSON decoding of a Entity +// +func (pTypeDef *Entity) UnmarshalJSON(b []byte) error { + var r rawEntity + err := json.Unmarshal(b, &r) + if err == nil { + o := Entity(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Entity) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("Entity.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("Entity.name does not contain a valid EntityName (%v)", val.Error) + } + } + if pTypeDef.Value == nil { + return fmt.Errorf("Entity: Missing required field: value") + } + return nil +} + +// +// EntityList - The representation for an enumeration of entities in the +// namespace +// +type EntityList struct { + + // + // list of entity names + // + Names []EntityName `json:"names"` +} + +// +// NewEntityList - creates an initialized EntityList instance, returns a pointer to it +// +func NewEntityList(init ...*EntityList) *EntityList { + var o *EntityList + if len(init) == 1 { + o = init[0] + } else { + o = new(EntityList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *EntityList) Init() *EntityList { + if pTypeDef.Names == nil { + pTypeDef.Names = make([]EntityName, 0) + } + return pTypeDef +} + +type rawEntityList EntityList + +// +// UnmarshalJSON is defined for proper JSON decoding of a EntityList +// +func (pTypeDef *EntityList) UnmarshalJSON(b []byte) error { + var r rawEntityList + err := json.Unmarshal(b, &r) + if err == nil { + o := EntityList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *EntityList) Validate() error { + if pTypeDef.Names == nil { + return fmt.Errorf("EntityList: Missing required field: names") + } + return nil +} + +// +// PolicyList - The representation for an enumeration of policies in the +// namespace, with pagination. +// +type PolicyList struct { + + // + // list of policy names + // + Names []EntityName `json:"names"` + + // + // if the response is a paginated list, this attribute specifies the value to + // be used in the next policy list request as the value for the skip query + // parameter. + // + Next string `json:"next,omitempty" rdl:"optional"` +} + +// +// NewPolicyList - creates an initialized PolicyList instance, returns a pointer to it +// +func NewPolicyList(init ...*PolicyList) *PolicyList { + var o *PolicyList + if len(init) == 1 { + o = init[0] + } else { + o = new(PolicyList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *PolicyList) Init() *PolicyList { + if pTypeDef.Names == nil { + pTypeDef.Names = make([]EntityName, 0) + } + return pTypeDef +} + +type rawPolicyList PolicyList + +// +// UnmarshalJSON is defined for proper JSON decoding of a PolicyList +// +func (pTypeDef *PolicyList) UnmarshalJSON(b []byte) error { + var r rawPolicyList + err := json.Unmarshal(b, &r) + if err == nil { + o := PolicyList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *PolicyList) Validate() error { + if pTypeDef.Names == nil { + return fmt.Errorf("PolicyList: Missing required field: names") + } + return nil +} + +// +// PublicKeyEntry - The representation of the public key in a service identity +// object. +// +type PublicKeyEntry struct { + + // + // the public key for the service + // + Key string `json:"key"` + + // + // the key identifier (version or zone name) + // + Id string `json:"id"` +} + +// +// NewPublicKeyEntry - creates an initialized PublicKeyEntry instance, returns a pointer to it +// +func NewPublicKeyEntry(init ...*PublicKeyEntry) *PublicKeyEntry { + var o *PublicKeyEntry + if len(init) == 1 { + o = init[0] + } else { + o = new(PublicKeyEntry) + } + return o +} + +type rawPublicKeyEntry PublicKeyEntry + +// +// UnmarshalJSON is defined for proper JSON decoding of a PublicKeyEntry +// +func (pTypeDef *PublicKeyEntry) UnmarshalJSON(b []byte) error { + var r rawPublicKeyEntry + err := json.Unmarshal(b, &r) + if err == nil { + o := PublicKeyEntry(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *PublicKeyEntry) Validate() error { + if pTypeDef.Key == "" { + return fmt.Errorf("PublicKeyEntry.key is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Key) + if !val.Valid { + return fmt.Errorf("PublicKeyEntry.key does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Id == "" { + return fmt.Errorf("PublicKeyEntry.id is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Id) + if !val.Valid { + return fmt.Errorf("PublicKeyEntry.id does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// ServiceIdentity - The representation of the service identity object. +// +type ServiceIdentity struct { + + // + // the full name of the service, i.e. "sports.storage" + // + Name ServiceName `json:"name"` + + // + // array of public keys for key rotation + // + PublicKeys []*PublicKeyEntry `json:"publicKeys,omitempty" rdl:"optional"` + + // + // if present, then this service can provision tenants via this endpoint. + // + ProviderEndpoint string `json:"providerEndpoint,omitempty" rdl:"optional"` + + // + // the timestamp when this entry was last modified + // + Modified *rdl.Timestamp `json:"modified,omitempty" rdl:"optional"` + + // + // the path of the executable that runs the service + // + Executable string `json:"executable,omitempty" rdl:"optional"` + + // + // list of host names that this service can run on + // + Hosts []string `json:"hosts,omitempty" rdl:"optional"` + + // + // local (unix) user name this service can run as + // + User string `json:"user,omitempty" rdl:"optional"` + + // + // local (unix) group name this service can run as + // + Group string `json:"group,omitempty" rdl:"optional"` +} + +// +// NewServiceIdentity - creates an initialized ServiceIdentity instance, returns a pointer to it +// +func NewServiceIdentity(init ...*ServiceIdentity) *ServiceIdentity { + var o *ServiceIdentity + if len(init) == 1 { + o = init[0] + } else { + o = new(ServiceIdentity) + } + return o +} + +type rawServiceIdentity ServiceIdentity + +// +// UnmarshalJSON is defined for proper JSON decoding of a ServiceIdentity +// +func (pTypeDef *ServiceIdentity) UnmarshalJSON(b []byte) error { + var r rawServiceIdentity + err := json.Unmarshal(b, &r) + if err == nil { + o := ServiceIdentity(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ServiceIdentity) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("ServiceIdentity.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ServiceName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("ServiceIdentity.name does not contain a valid ServiceName (%v)", val.Error) + } + } + return nil +} + +// +// ServiceIdentities - The representation of list of services +// +type ServiceIdentities struct { + + // + // list of services + // + List []*ServiceIdentity `json:"list"` +} + +// +// NewServiceIdentities - creates an initialized ServiceIdentities instance, returns a pointer to it +// +func NewServiceIdentities(init ...*ServiceIdentities) *ServiceIdentities { + var o *ServiceIdentities + if len(init) == 1 { + o = init[0] + } else { + o = new(ServiceIdentities) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *ServiceIdentities) Init() *ServiceIdentities { + if pTypeDef.List == nil { + pTypeDef.List = make([]*ServiceIdentity, 0) + } + return pTypeDef +} + +type rawServiceIdentities ServiceIdentities + +// +// UnmarshalJSON is defined for proper JSON decoding of a ServiceIdentities +// +func (pTypeDef *ServiceIdentities) UnmarshalJSON(b []byte) error { + var r rawServiceIdentities + err := json.Unmarshal(b, &r) + if err == nil { + o := ServiceIdentities(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ServiceIdentities) Validate() error { + if pTypeDef.List == nil { + return fmt.Errorf("ServiceIdentities: Missing required field: list") + } + return nil +} + +// +// ServiceIdentityList - The representation for an enumeration of services in +// the namespace, with pagination. +// +type ServiceIdentityList struct { + + // + // list of service names + // + Names []EntityName `json:"names"` + + // + // if the response is a paginated list, this attribute specifies the value to + // be used in the next service list request as the value for the skip query + // parameter. + // + Next string `json:"next,omitempty" rdl:"optional"` +} + +// +// NewServiceIdentityList - creates an initialized ServiceIdentityList instance, returns a pointer to it +// +func NewServiceIdentityList(init ...*ServiceIdentityList) *ServiceIdentityList { + var o *ServiceIdentityList + if len(init) == 1 { + o = init[0] + } else { + o = new(ServiceIdentityList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *ServiceIdentityList) Init() *ServiceIdentityList { + if pTypeDef.Names == nil { + pTypeDef.Names = make([]EntityName, 0) + } + return pTypeDef +} + +type rawServiceIdentityList ServiceIdentityList + +// +// UnmarshalJSON is defined for proper JSON decoding of a ServiceIdentityList +// +func (pTypeDef *ServiceIdentityList) UnmarshalJSON(b []byte) error { + var r rawServiceIdentityList + err := json.Unmarshal(b, &r) + if err == nil { + o := ServiceIdentityList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ServiceIdentityList) Validate() error { + if pTypeDef.Names == nil { + return fmt.Errorf("ServiceIdentityList: Missing required field: names") + } + return nil +} + +// +// Tenancy - A representation of tenant. +// +type Tenancy struct { + + // + // the domain that is to get a tenancy + // + Domain DomainName `json:"domain"` + + // + // the provider service on which the tenancy is to reside + // + Service ServiceName `json:"service"` + + // + // registered resource groups for this tenant + // + ResourceGroups []EntityName `json:"resourceGroups,omitempty" rdl:"optional"` +} + +// +// NewTenancy - creates an initialized Tenancy instance, returns a pointer to it +// +func NewTenancy(init ...*Tenancy) *Tenancy { + var o *Tenancy + if len(init) == 1 { + o = init[0] + } else { + o = new(Tenancy) + } + return o +} + +type rawTenancy Tenancy + +// +// UnmarshalJSON is defined for proper JSON decoding of a Tenancy +// +func (pTypeDef *Tenancy) UnmarshalJSON(b []byte) error { + var r rawTenancy + err := json.Unmarshal(b, &r) + if err == nil { + o := Tenancy(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Tenancy) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("Tenancy.domain is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("Tenancy.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("Tenancy.service is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ServiceName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("Tenancy.service does not contain a valid ServiceName (%v)", val.Error) + } + } + return nil +} + +// +// TenancyResourceGroup - +// +type TenancyResourceGroup struct { + + // + // the domain that is to get a tenancy + // + Domain DomainName `json:"domain"` + + // + // the provider service on which the tenancy is to reside + // + Service ServiceName `json:"service"` + + // + // registered resource group for this tenant + // + ResourceGroup EntityName `json:"resourceGroup"` +} + +// +// NewTenancyResourceGroup - creates an initialized TenancyResourceGroup instance, returns a pointer to it +// +func NewTenancyResourceGroup(init ...*TenancyResourceGroup) *TenancyResourceGroup { + var o *TenancyResourceGroup + if len(init) == 1 { + o = init[0] + } else { + o = new(TenancyResourceGroup) + } + return o +} + +type rawTenancyResourceGroup TenancyResourceGroup + +// +// UnmarshalJSON is defined for proper JSON decoding of a TenancyResourceGroup +// +func (pTypeDef *TenancyResourceGroup) UnmarshalJSON(b []byte) error { + var r rawTenancyResourceGroup + err := json.Unmarshal(b, &r) + if err == nil { + o := TenancyResourceGroup(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *TenancyResourceGroup) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("TenancyResourceGroup.domain is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("TenancyResourceGroup.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("TenancyResourceGroup.service is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "ServiceName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("TenancyResourceGroup.service does not contain a valid ServiceName (%v)", val.Error) + } + } + if pTypeDef.ResourceGroup == "" { + return fmt.Errorf("TenancyResourceGroup.resourceGroup is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.ResourceGroup) + if !val.Valid { + return fmt.Errorf("TenancyResourceGroup.resourceGroup does not contain a valid EntityName (%v)", val.Error) + } + } + return nil +} + +// +// TenantRoleAction - A representation of tenant role action. +// +type TenantRoleAction struct { + + // + // name of the role + // + Role SimpleName `json:"role"` + + // + // action value for the generated policy assertion + // + Action string `json:"action"` +} + +// +// NewTenantRoleAction - creates an initialized TenantRoleAction instance, returns a pointer to it +// +func NewTenantRoleAction(init ...*TenantRoleAction) *TenantRoleAction { + var o *TenantRoleAction + if len(init) == 1 { + o = init[0] + } else { + o = new(TenantRoleAction) + } + return o +} + +type rawTenantRoleAction TenantRoleAction + +// +// UnmarshalJSON is defined for proper JSON decoding of a TenantRoleAction +// +func (pTypeDef *TenantRoleAction) UnmarshalJSON(b []byte) error { + var r rawTenantRoleAction + err := json.Unmarshal(b, &r) + if err == nil { + o := TenantRoleAction(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *TenantRoleAction) Validate() error { + if pTypeDef.Role == "" { + return fmt.Errorf("TenantRoleAction.role is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SimpleName", pTypeDef.Role) + if !val.Valid { + return fmt.Errorf("TenantRoleAction.role does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Action == "" { + return fmt.Errorf("TenantRoleAction.action is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Action) + if !val.Valid { + return fmt.Errorf("TenantRoleAction.action does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// TenantRoles - A representation of tenant roles to be provisioned. +// +type TenantRoles struct { + + // + // name of the provider domain + // + Domain DomainName `json:"domain"` + + // + // name of the provider service + // + Service SimpleName `json:"service"` + + // + // name of the tenant domain + // + Tenant DomainName `json:"tenant"` + + // + // the role/action pairs to provision + // + Roles []*TenantRoleAction `json:"roles"` +} + +// +// NewTenantRoles - creates an initialized TenantRoles instance, returns a pointer to it +// +func NewTenantRoles(init ...*TenantRoles) *TenantRoles { + var o *TenantRoles + if len(init) == 1 { + o = init[0] + } else { + o = new(TenantRoles) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *TenantRoles) Init() *TenantRoles { + if pTypeDef.Roles == nil { + pTypeDef.Roles = make([]*TenantRoleAction, 0) + } + return pTypeDef +} + +type rawTenantRoles TenantRoles + +// +// UnmarshalJSON is defined for proper JSON decoding of a TenantRoles +// +func (pTypeDef *TenantRoles) UnmarshalJSON(b []byte) error { + var r rawTenantRoles + err := json.Unmarshal(b, &r) + if err == nil { + o := TenantRoles(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *TenantRoles) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("TenantRoles.domain is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("TenantRoles.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("TenantRoles.service is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SimpleName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("TenantRoles.service does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Tenant == "" { + return fmt.Errorf("TenantRoles.tenant is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Tenant) + if !val.Valid { + return fmt.Errorf("TenantRoles.tenant does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Roles == nil { + return fmt.Errorf("TenantRoles: Missing required field: roles") + } + return nil +} + +// +// TenantResourceGroupRoles - A representation of tenant roles for resource +// groups to be provisioned. +// +type TenantResourceGroupRoles struct { + + // + // name of the provider domain + // + Domain DomainName `json:"domain"` + + // + // name of the provider service + // + Service SimpleName `json:"service"` + + // + // name of the tenant domain + // + Tenant DomainName `json:"tenant"` + + // + // the role/action pairs to provision + // + Roles []*TenantRoleAction `json:"roles"` + + // + // tenant resource group + // + ResourceGroup EntityName `json:"resourceGroup"` +} + +// +// NewTenantResourceGroupRoles - creates an initialized TenantResourceGroupRoles instance, returns a pointer to it +// +func NewTenantResourceGroupRoles(init ...*TenantResourceGroupRoles) *TenantResourceGroupRoles { + var o *TenantResourceGroupRoles + if len(init) == 1 { + o = init[0] + } else { + o = new(TenantResourceGroupRoles) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *TenantResourceGroupRoles) Init() *TenantResourceGroupRoles { + if pTypeDef.Roles == nil { + pTypeDef.Roles = make([]*TenantRoleAction, 0) + } + return pTypeDef +} + +type rawTenantResourceGroupRoles TenantResourceGroupRoles + +// +// UnmarshalJSON is defined for proper JSON decoding of a TenantResourceGroupRoles +// +func (pTypeDef *TenantResourceGroupRoles) UnmarshalJSON(b []byte) error { + var r rawTenantResourceGroupRoles + err := json.Unmarshal(b, &r) + if err == nil { + o := TenantResourceGroupRoles(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *TenantResourceGroupRoles) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("TenantResourceGroupRoles.domain is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("TenantResourceGroupRoles.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("TenantResourceGroupRoles.service is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SimpleName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("TenantResourceGroupRoles.service does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Tenant == "" { + return fmt.Errorf("TenantResourceGroupRoles.tenant is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Tenant) + if !val.Valid { + return fmt.Errorf("TenantResourceGroupRoles.tenant does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Roles == nil { + return fmt.Errorf("TenantResourceGroupRoles: Missing required field: roles") + } + if pTypeDef.ResourceGroup == "" { + return fmt.Errorf("TenantResourceGroupRoles.resourceGroup is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.ResourceGroup) + if !val.Valid { + return fmt.Errorf("TenantResourceGroupRoles.resourceGroup does not contain a valid EntityName (%v)", val.Error) + } + } + return nil +} + +// +// ProviderResourceGroupRoles - A representation of provider roles to be +// provisioned. +// +type ProviderResourceGroupRoles struct { + + // + // name of the provider domain + // + Domain DomainName `json:"domain"` + + // + // name of the provider service + // + Service SimpleName `json:"service"` + + // + // name of the tenant domain + // + Tenant DomainName `json:"tenant"` + + // + // the role/action pairs to provision + // + Roles []*TenantRoleAction `json:"roles"` + + // + // tenant resource group + // + ResourceGroup EntityName `json:"resourceGroup"` +} + +// +// NewProviderResourceGroupRoles - creates an initialized ProviderResourceGroupRoles instance, returns a pointer to it +// +func NewProviderResourceGroupRoles(init ...*ProviderResourceGroupRoles) *ProviderResourceGroupRoles { + var o *ProviderResourceGroupRoles + if len(init) == 1 { + o = init[0] + } else { + o = new(ProviderResourceGroupRoles) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *ProviderResourceGroupRoles) Init() *ProviderResourceGroupRoles { + if pTypeDef.Roles == nil { + pTypeDef.Roles = make([]*TenantRoleAction, 0) + } + return pTypeDef +} + +type rawProviderResourceGroupRoles ProviderResourceGroupRoles + +// +// UnmarshalJSON is defined for proper JSON decoding of a ProviderResourceGroupRoles +// +func (pTypeDef *ProviderResourceGroupRoles) UnmarshalJSON(b []byte) error { + var r rawProviderResourceGroupRoles + err := json.Unmarshal(b, &r) + if err == nil { + o := ProviderResourceGroupRoles(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ProviderResourceGroupRoles) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("ProviderResourceGroupRoles.domain is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("ProviderResourceGroupRoles.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("ProviderResourceGroupRoles.service is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SimpleName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("ProviderResourceGroupRoles.service does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Tenant == "" { + return fmt.Errorf("ProviderResourceGroupRoles.tenant is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Tenant) + if !val.Valid { + return fmt.Errorf("ProviderResourceGroupRoles.tenant does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Roles == nil { + return fmt.Errorf("ProviderResourceGroupRoles: Missing required field: roles") + } + if pTypeDef.ResourceGroup == "" { + return fmt.Errorf("ProviderResourceGroupRoles.resourceGroup is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.ResourceGroup) + if !val.Valid { + return fmt.Errorf("ProviderResourceGroupRoles.resourceGroup does not contain a valid EntityName (%v)", val.Error) + } + } + return nil +} + +// +// Access - Access can be checked and returned as this resource. +// +type Access struct { + + // + // true (allowed) or false (denied) + // + Granted bool `json:"granted"` +} + +// +// NewAccess - creates an initialized Access instance, returns a pointer to it +// +func NewAccess(init ...*Access) *Access { + var o *Access + if len(init) == 1 { + o = init[0] + } else { + o = new(Access) + } + return o +} + +type rawAccess Access + +// +// UnmarshalJSON is defined for proper JSON decoding of a Access +// +func (pTypeDef *Access) UnmarshalJSON(b []byte) error { + var r rawAccess + err := json.Unmarshal(b, &r) + if err == nil { + o := Access(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Access) Validate() error { + return nil +} + +// +// ResourceAccess - +// +type ResourceAccess struct { + Principal EntityName `json:"principal"` + Assertions []*Assertion `json:"assertions"` +} + +// +// NewResourceAccess - creates an initialized ResourceAccess instance, returns a pointer to it +// +func NewResourceAccess(init ...*ResourceAccess) *ResourceAccess { + var o *ResourceAccess + if len(init) == 1 { + o = init[0] + } else { + o = new(ResourceAccess) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *ResourceAccess) Init() *ResourceAccess { + if pTypeDef.Assertions == nil { + pTypeDef.Assertions = make([]*Assertion, 0) + } + return pTypeDef +} + +type rawResourceAccess ResourceAccess + +// +// UnmarshalJSON is defined for proper JSON decoding of a ResourceAccess +// +func (pTypeDef *ResourceAccess) UnmarshalJSON(b []byte) error { + var r rawResourceAccess + err := json.Unmarshal(b, &r) + if err == nil { + o := ResourceAccess(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ResourceAccess) Validate() error { + if pTypeDef.Principal == "" { + return fmt.Errorf("ResourceAccess.principal is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.Principal) + if !val.Valid { + return fmt.Errorf("ResourceAccess.principal does not contain a valid EntityName (%v)", val.Error) + } + } + if pTypeDef.Assertions == nil { + return fmt.Errorf("ResourceAccess: Missing required field: assertions") + } + return nil +} + +// +// ResourceAccessList - +// +type ResourceAccessList struct { + Resources []*ResourceAccess `json:"resources"` +} + +// +// NewResourceAccessList - creates an initialized ResourceAccessList instance, returns a pointer to it +// +func NewResourceAccessList(init ...*ResourceAccessList) *ResourceAccessList { + var o *ResourceAccessList + if len(init) == 1 { + o = init[0] + } else { + o = new(ResourceAccessList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *ResourceAccessList) Init() *ResourceAccessList { + if pTypeDef.Resources == nil { + pTypeDef.Resources = make([]*ResourceAccess, 0) + } + return pTypeDef +} + +type rawResourceAccessList ResourceAccessList + +// +// UnmarshalJSON is defined for proper JSON decoding of a ResourceAccessList +// +func (pTypeDef *ResourceAccessList) UnmarshalJSON(b []byte) error { + var r rawResourceAccessList + err := json.Unmarshal(b, &r) + if err == nil { + o := ResourceAccessList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ResourceAccessList) Validate() error { + if pTypeDef.Resources == nil { + return fmt.Errorf("ResourceAccessList: Missing required field: resources") + } + return nil +} + +// +// DomainModified - Tuple of domain-name and modification time-stamps. This +// object is returned when the caller has requested list of domains modified +// since a specific timestamp. +// +type DomainModified struct { + + // + // name of the domain + // + Name DomainName `json:"name"` + + // + // last modified timestamp of the domain + // + Modified int64 `json:"modified"` +} + +// +// NewDomainModified - creates an initialized DomainModified instance, returns a pointer to it +// +func NewDomainModified(init ...*DomainModified) *DomainModified { + var o *DomainModified + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainModified) + } + return o +} + +type rawDomainModified DomainModified + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainModified +// +func (pTypeDef *DomainModified) UnmarshalJSON(b []byte) error { + var r rawDomainModified + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainModified(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainModified) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("DomainModified.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("DomainModified.name does not contain a valid DomainName (%v)", val.Error) + } + } + return nil +} + +// +// DomainModifiedList - A list of {domain, modified-timestamp} tuples. +// +type DomainModifiedList struct { + + // + // list of modified domains + // + NameModList []*DomainModified `json:"nameModList"` +} + +// +// NewDomainModifiedList - creates an initialized DomainModifiedList instance, returns a pointer to it +// +func NewDomainModifiedList(init ...*DomainModifiedList) *DomainModifiedList { + var o *DomainModifiedList + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainModifiedList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainModifiedList) Init() *DomainModifiedList { + if pTypeDef.NameModList == nil { + pTypeDef.NameModList = make([]*DomainModified, 0) + } + return pTypeDef +} + +type rawDomainModifiedList DomainModifiedList + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainModifiedList +// +func (pTypeDef *DomainModifiedList) UnmarshalJSON(b []byte) error { + var r rawDomainModifiedList + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainModifiedList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainModifiedList) Validate() error { + if pTypeDef.NameModList == nil { + return fmt.Errorf("DomainModifiedList: Missing required field: nameModList") + } + return nil +} + +// +// DomainPolicies - We need to include the name of the domain in this struct +// since this data will be passed back to ZPU through ZTS so we need to sign not +// only the list of policies but also the corresponding domain name that the +// policies belong to. +// +type DomainPolicies struct { + + // + // name of the domain + // + Domain DomainName `json:"domain"` + + // + // list of policies defined in this server + // + Policies []*Policy `json:"policies"` +} + +// +// NewDomainPolicies - creates an initialized DomainPolicies instance, returns a pointer to it +// +func NewDomainPolicies(init ...*DomainPolicies) *DomainPolicies { + var o *DomainPolicies + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainPolicies) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainPolicies) Init() *DomainPolicies { + if pTypeDef.Policies == nil { + pTypeDef.Policies = make([]*Policy, 0) + } + return pTypeDef +} + +type rawDomainPolicies DomainPolicies + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainPolicies +// +func (pTypeDef *DomainPolicies) UnmarshalJSON(b []byte) error { + var r rawDomainPolicies + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainPolicies(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainPolicies) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("DomainPolicies.domain is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("DomainPolicies.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Policies == nil { + return fmt.Errorf("DomainPolicies: Missing required field: policies") + } + return nil +} + +// +// SignedPolicies - A signed bulk transfer of policies. The data is signed with +// server's private key. +// +type SignedPolicies struct { + + // + // list of policies defined in a domain + // + Contents *DomainPolicies `json:"contents"` + + // + // signature generated based on the domain policies object + // + Signature string `json:"signature"` + + // + // the identifier of the key used to generate the signature + // + KeyId string `json:"keyId"` +} + +// +// NewSignedPolicies - creates an initialized SignedPolicies instance, returns a pointer to it +// +func NewSignedPolicies(init ...*SignedPolicies) *SignedPolicies { + var o *SignedPolicies + if len(init) == 1 { + o = init[0] + } else { + o = new(SignedPolicies) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *SignedPolicies) Init() *SignedPolicies { + if pTypeDef.Contents == nil { + pTypeDef.Contents = NewDomainPolicies() + } + return pTypeDef +} + +type rawSignedPolicies SignedPolicies + +// +// UnmarshalJSON is defined for proper JSON decoding of a SignedPolicies +// +func (pTypeDef *SignedPolicies) UnmarshalJSON(b []byte) error { + var r rawSignedPolicies + err := json.Unmarshal(b, &r) + if err == nil { + o := SignedPolicies(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *SignedPolicies) Validate() error { + if pTypeDef.Contents == nil { + return fmt.Errorf("SignedPolicies: Missing required field: contents") + } + if pTypeDef.Signature == "" { + return fmt.Errorf("SignedPolicies.signature is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Signature) + if !val.Valid { + return fmt.Errorf("SignedPolicies.signature does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.KeyId == "" { + return fmt.Errorf("SignedPolicies.keyId is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.KeyId) + if !val.Valid { + return fmt.Errorf("SignedPolicies.keyId does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// DomainData - A domain object that includes its roles, policies and services. +// +type DomainData struct { + + // + // name of the domain + // + Name DomainName `json:"name"` + + // + // associated cloud (i.e. aws) account id + // + Account string `json:"account,omitempty" rdl:"optional"` + + // + // associated product id + // + YpmId *int32 `json:"ypmId,omitempty" rdl:"optional"` + + // + // list of roles in the domain + // + Roles []*Role `json:"roles"` + + // + // list of policies in the domain signed with ZMS private key + // + Policies *SignedPolicies `json:"policies"` + + // + // list of services in the domain + // + Services []*ServiceIdentity `json:"services"` + + // + // list of entities in the domain + // + Entities []*Entity `json:"entities"` + + // + // last modification timestamp + // + Modified rdl.Timestamp `json:"modified"` +} + +// +// NewDomainData - creates an initialized DomainData instance, returns a pointer to it +// +func NewDomainData(init ...*DomainData) *DomainData { + var o *DomainData + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainData) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainData) Init() *DomainData { + if pTypeDef.Roles == nil { + pTypeDef.Roles = make([]*Role, 0) + } + if pTypeDef.Policies == nil { + pTypeDef.Policies = NewSignedPolicies() + } + if pTypeDef.Services == nil { + pTypeDef.Services = make([]*ServiceIdentity, 0) + } + if pTypeDef.Entities == nil { + pTypeDef.Entities = make([]*Entity, 0) + } + return pTypeDef +} + +type rawDomainData DomainData + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainData +// +func (pTypeDef *DomainData) UnmarshalJSON(b []byte) error { + var r rawDomainData + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainData(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainData) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("DomainData.name is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("DomainData.name does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Roles == nil { + return fmt.Errorf("DomainData: Missing required field: roles") + } + if pTypeDef.Policies == nil { + return fmt.Errorf("DomainData: Missing required field: policies") + } + if pTypeDef.Services == nil { + return fmt.Errorf("DomainData: Missing required field: services") + } + if pTypeDef.Entities == nil { + return fmt.Errorf("DomainData: Missing required field: entities") + } + if pTypeDef.Modified.IsZero() { + return fmt.Errorf("DomainData: Missing required field: modified") + } + return nil +} + +// +// SignedDomain - A domain object signed with server's private key +// +type SignedDomain struct { + + // + // domain object with its roles, policies and services + // + Domain *DomainData `json:"domain"` + + // + // signature generated based on the domain object + // + Signature string `json:"signature"` + + // + // the identifier of the key used to generate the signature + // + KeyId string `json:"keyId"` +} + +// +// NewSignedDomain - creates an initialized SignedDomain instance, returns a pointer to it +// +func NewSignedDomain(init ...*SignedDomain) *SignedDomain { + var o *SignedDomain + if len(init) == 1 { + o = init[0] + } else { + o = new(SignedDomain) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *SignedDomain) Init() *SignedDomain { + if pTypeDef.Domain == nil { + pTypeDef.Domain = NewDomainData() + } + return pTypeDef +} + +type rawSignedDomain SignedDomain + +// +// UnmarshalJSON is defined for proper JSON decoding of a SignedDomain +// +func (pTypeDef *SignedDomain) UnmarshalJSON(b []byte) error { + var r rawSignedDomain + err := json.Unmarshal(b, &r) + if err == nil { + o := SignedDomain(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *SignedDomain) Validate() error { + if pTypeDef.Domain == nil { + return fmt.Errorf("SignedDomain: Missing required field: domain") + } + if pTypeDef.Signature == "" { + return fmt.Errorf("SignedDomain.signature is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.Signature) + if !val.Valid { + return fmt.Errorf("SignedDomain.signature does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.KeyId == "" { + return fmt.Errorf("SignedDomain.keyId is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "String", pTypeDef.KeyId) + if !val.Valid { + return fmt.Errorf("SignedDomain.keyId does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// SignedDomains - A list of signed domain objects +// +type SignedDomains struct { + Domains []*SignedDomain `json:"domains"` +} + +// +// NewSignedDomains - creates an initialized SignedDomains instance, returns a pointer to it +// +func NewSignedDomains(init ...*SignedDomains) *SignedDomains { + var o *SignedDomains + if len(init) == 1 { + o = init[0] + } else { + o = new(SignedDomains) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *SignedDomains) Init() *SignedDomains { + if pTypeDef.Domains == nil { + pTypeDef.Domains = make([]*SignedDomain, 0) + } + return pTypeDef +} + +type rawSignedDomains SignedDomains + +// +// UnmarshalJSON is defined for proper JSON decoding of a SignedDomains +// +func (pTypeDef *SignedDomains) UnmarshalJSON(b []byte) error { + var r rawSignedDomains + err := json.Unmarshal(b, &r) + if err == nil { + o := SignedDomains(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *SignedDomains) Validate() error { + if pTypeDef.Domains == nil { + return fmt.Errorf("SignedDomains: Missing required field: domains") + } + return nil +} + +// +// UserToken - A user token generated based on user's credentials +// +type UserToken struct { + + // + // Signed user token identifying a specific authenticated user + // + Token SignedToken `json:"token"` +} + +// +// NewUserToken - creates an initialized UserToken instance, returns a pointer to it +// +func NewUserToken(init ...*UserToken) *UserToken { + var o *UserToken + if len(init) == 1 { + o = init[0] + } else { + o = new(UserToken) + } + return o +} + +type rawUserToken UserToken + +// +// UnmarshalJSON is defined for proper JSON decoding of a UserToken +// +func (pTypeDef *UserToken) UnmarshalJSON(b []byte) error { + var r rawUserToken + err := json.Unmarshal(b, &r) + if err == nil { + o := UserToken(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *UserToken) Validate() error { + if pTypeDef.Token == "" { + return fmt.Errorf("UserToken.token is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SignedToken", pTypeDef.Token) + if !val.Valid { + return fmt.Errorf("UserToken.token does not contain a valid SignedToken (%v)", val.Error) + } + } + return nil +} + +// +// ServicePrincipal - A service principal object identifying a given service. +// +type ServicePrincipal struct { + + // + // name of the domain + // + Domain DomainName `json:"domain"` + + // + // name of the service + // + Service EntityName `json:"service"` + + // + // service's signed token + // + Token SignedToken `json:"token"` +} + +// +// NewServicePrincipal - creates an initialized ServicePrincipal instance, returns a pointer to it +// +func NewServicePrincipal(init ...*ServicePrincipal) *ServicePrincipal { + var o *ServicePrincipal + if len(init) == 1 { + o = init[0] + } else { + o = new(ServicePrincipal) + } + return o +} + +type rawServicePrincipal ServicePrincipal + +// +// UnmarshalJSON is defined for proper JSON decoding of a ServicePrincipal +// +func (pTypeDef *ServicePrincipal) UnmarshalJSON(b []byte) error { + var r rawServicePrincipal + err := json.Unmarshal(b, &r) + if err == nil { + o := ServicePrincipal(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ServicePrincipal) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("ServicePrincipal.domain is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("ServicePrincipal.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("ServicePrincipal.service is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "EntityName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("ServicePrincipal.service does not contain a valid EntityName (%v)", val.Error) + } + } + if pTypeDef.Token == "" { + return fmt.Errorf("ServicePrincipal.token is missing but is a required field") + } else { + val := rdl.Validate(ZMSSchema(), "SignedToken", pTypeDef.Token) + if !val.Valid { + return fmt.Errorf("ServicePrincipal.token does not contain a valid SignedToken (%v)", val.Error) + } + } + return nil +} diff --git a/clients/go/zms/zms_schema.go b/clients/go/zms/zms_schema.go new file mode 100644 index 00000000000..6779d012123 --- /dev/null +++ b/clients/go/zms/zms_schema.go @@ -0,0 +1,1233 @@ +// +// This file generated by rdl 1.4.8 +// + +package zms + +import ( + rdl "github.com/ardielle/ardielle-go/rdl" +) + +var schema *rdl.Schema + +func init() { + sb := rdl.NewSchemaBuilder("ZMS") + sb.Version(1) + sb.Namespace("com.yahoo.athenz.zms") + sb.Comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. The Authorization Management Service (ZMS) Classes") + + tSimpleName := rdl.NewStringTypeBuilder("SimpleName") + tSimpleName.Comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. Common name types used by several API definitions A simple identifier, an element of compound name.") + tSimpleName.Pattern("[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tSimpleName.Build()) + + tCompoundName := rdl.NewStringTypeBuilder("CompoundName") + tCompoundName.Comment("A compound name. Most names in this API are compound names.") + tCompoundName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tCompoundName.Build()) + + tDomainName := rdl.NewStringTypeBuilder("DomainName") + tDomainName.Comment("A domain name is the general qualifier prefix, as its uniqueness is managed.") + tDomainName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tDomainName.Build()) + + tEntityName := rdl.NewStringTypeBuilder("EntityName") + tEntityName.Comment("An entity name is a short form of a resource name, including only the domain and entity.") + tEntityName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tEntityName.Build()) + + tServiceName := rdl.NewStringTypeBuilder("ServiceName") + tServiceName.Comment("A service name will generally be a unique subdomain.") + tServiceName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tServiceName.Build()) + + tLocationName := rdl.NewStringTypeBuilder("LocationName") + tLocationName.Comment("A location name is not yet defined, but will be a dotted name like everything else.") + tLocationName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tLocationName.Build()) + + tActionName := rdl.NewStringTypeBuilder("ActionName") + tActionName.Comment("An action (operation) name.") + tActionName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tActionName.Build()) + + tResourceName := rdl.NewStringTypeBuilder("ResourceName") + tResourceName.Comment("A shorthand for a YRN with no service or location. The 'tail' of a YRN, just the domain:entity. Note that the EntityName part is optional, that is, a domain name followed by a colon is valid resource name.") + tResourceName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?") + sb.AddType(tResourceName.Build()) + + tYRN := rdl.NewStringTypeBuilder("YRN") + tYRN.Comment("A full Yahoo Resource name (YRN).") + tYRN.Pattern("(yrn:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:)?([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?") + sb.AddType(tYRN.Build()) + + tYBase64 := rdl.NewStringTypeBuilder("YBase64") + tYBase64.Comment("The Y-specific URL-safe Base64 variant.") + tYBase64.Pattern("[a-zA-Z0-9\\._-]+") + sb.AddType(tYBase64.Build()) + + tYEncoded := rdl.NewStringTypeBuilder("YEncoded") + tYEncoded.Comment("YEncoded includes ybase64 chars, as well as = and %. This can represent a user cookie and URL-encoded values.") + tYEncoded.Pattern("[a-zA-Z0-9\\._%=-]*") + sb.AddType(tYEncoded.Build()) + + tAuthorityName := rdl.NewStringTypeBuilder("AuthorityName") + tAuthorityName.Comment("Used as the prefix in a signed assertion. This uniquely identifies a signing authority. i.e. \"user\"") + tAuthorityName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tAuthorityName.Build()) + + tSignedToken := rdl.NewStringTypeBuilder("SignedToken") + tSignedToken.Comment("A signed assertion if identity. i.e. the user cookie value. This token will only make sense to the authority that generated it, so it is beneficial to have something in the value that is cheaply recognized to quickly reject if it belongs to another authority. In addition to the YEncoded set our token includes ; to separate components and , to separate roles and : for IPv6 addresses") + tSignedToken.Pattern("[a-zA-Z0-9\\._%=:;,-]*") + sb.AddType(tSignedToken.Build()) + + tDomain := rdl.NewStructTypeBuilder("Struct", "Domain") + tDomain.Comment("A domain is an independent partition of users, roles, and resources. Its name represents the definition of a namespace; the only way a new namespace can be created, from the top, is by creating Domains. Administration of a domain is governed by the parent domain (using reverse-DNS namespaces). The top level domains are governed by the special \"sys.auth\" domain.") + tDomain.Field("name", "DomainName", false, nil, "the common name to be referred to, the symbolic id. It is immutable") + tDomain.Field("modified", "Timestamp", true, nil, "the last modification timestamp of any object or attribute in this domain") + tDomain.Field("id", "UUID", true, nil, "unique identifier of the domain. generated on create, never reused") + tDomain.Field("description", "String", true, nil, "description of the domain") + tDomain.Field("org", "ResourceName", true, nil, "a reference to an Organization") + tDomain.Field("enabled", "Bool", true, true, "Future use only, currently not used") + tDomain.Field("auditEnabled", "Bool", true, false, "Flag indicates whether or not domain modifications should be logged for SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for any API defining it.") + tDomain.Field("account", "String", true, nil, "associated cloud (i.e. aws) account id") + tDomain.Field("ypmId", "Int32", true, nil, "associated product id") + sb.AddType(tDomain.Build()) + + tRoleList := rdl.NewStructTypeBuilder("Struct", "RoleList") + tRoleList.Comment("The representation for an enumeration of roles in the namespace, with pagination.") + tRoleList.ArrayField("names", "EntityName", false, "list of role names") + tRoleList.Field("next", "String", true, nil, "if the response is a paginated list, this attribute specifies the value to be used in the next role list request as the value for the skip query parameter.") + sb.AddType(tRoleList.Build()) + + tRoleAuditLog := rdl.NewStructTypeBuilder("Struct", "RoleAuditLog") + tRoleAuditLog.Comment("An audit log entry for role membership change.") + tRoleAuditLog.Field("member", "ResourceName", false, nil, "name of the role member") + tRoleAuditLog.Field("admin", "ResourceName", false, nil, "name of the principal executing the change") + tRoleAuditLog.Field("created", "Timestamp", false, nil, "timestamp of the entry") + tRoleAuditLog.Field("action", "String", false, nil, "log action - either add or delete") + tRoleAuditLog.Field("auditRef", "String", true, nil, "audit reference string for the change as supplied by admin") + sb.AddType(tRoleAuditLog.Build()) + + tRole := rdl.NewStructTypeBuilder("Struct", "Role") + tRole.Comment("The representation for a Role with set of members.") + tRole.Field("name", "ResourceName", false, nil, "name of the role") + tRole.Field("modified", "Timestamp", true, nil, "last modification timestamp of the role") + tRole.ArrayField("members", "ResourceName", true, "an explicit list of members. Might be empty or null, if trust is set") + tRole.Field("trust", "DomainName", true, nil, "a trusted domain to delegate membership decisions to") + tRole.ArrayField("auditLog", "RoleAuditLog", true, "an audit log for role membership changes") + sb.AddType(tRole.Build()) + + tRoles := rdl.NewStructTypeBuilder("Struct", "Roles") + tRoles.Comment("The representation for a list of roles with full details") + tRoles.ArrayField("list", "Role", false, "list of role objects") + sb.AddType(tRoles.Build()) + + tMembership := rdl.NewStructTypeBuilder("Struct", "Membership") + tMembership.Comment("The representation for a role membership.") + tMembership.Field("memberName", "ResourceName", false, nil, "name of the member") + tMembership.Field("isMember", "Bool", true, true, "flag to indicate whether or the user is a member or not") + tMembership.Field("roleName", "ResourceName", true, nil, "name of the role") + sb.AddType(tMembership.Build()) + + tDefaultAdmins := rdl.NewStructTypeBuilder("Struct", "DefaultAdmins") + tDefaultAdmins.Comment("The list of domain administrators.") + tDefaultAdmins.ArrayField("admins", "ResourceName", false, "list of domain administrators") + sb.AddType(tDefaultAdmins.Build()) + + tAssertionEffect := rdl.NewEnumTypeBuilder("Enum", "AssertionEffect") + tAssertionEffect.Comment("Every assertion can have the effect of ALLOW or DENY.") + tAssertionEffect.Element("ALLOW", "Every assertion can have the effect of ALLOW or DENY.") + tAssertionEffect.Element("DENY", "") + sb.AddType(tAssertionEffect.Build()) + + tAssertion := rdl.NewStructTypeBuilder("Struct", "Assertion") + tAssertion.Comment("A representation for the encapsulation of an action to be performed on a resource by a principal.") + tAssertion.Field("role", "String", false, nil, "the subject of the assertion - a role") + tAssertion.Field("resource", "String", false, nil, "the object of the assertion. Must be in the local namespace. Can contain wildcards") + tAssertion.Field("action", "String", false, nil, "the predicate of the assertion. Can contain wildcards") + tAssertion.Field("effect", "AssertionEffect", true, ALLOW, "the effect of the assertion in the policy language") + tAssertion.Field("id", "Int64", true, nil, "assertion id - auto generated by server. Not required during put operations.") + sb.AddType(tAssertion.Build()) + + tPolicy := rdl.NewStructTypeBuilder("Struct", "Policy") + tPolicy.Comment("The representation for a Policy with set of assertions.") + tPolicy.Field("name", "ResourceName", false, nil, "name of the policy") + tPolicy.Field("modified", "Timestamp", true, nil, "last modification timestamp of this policy") + tPolicy.ArrayField("assertions", "Assertion", false, "list of defined assertions for this policy") + sb.AddType(tPolicy.Build()) + + tPolicies := rdl.NewStructTypeBuilder("Struct", "Policies") + tPolicies.Comment("The representation of list of policy objects") + tPolicies.ArrayField("list", "Policy", false, "list of policy objects") + sb.AddType(tPolicies.Build()) + + tTemplate := rdl.NewStructTypeBuilder("Struct", "Template") + tTemplate.Comment("Solution Template object defined on the server") + tTemplate.ArrayField("roles", "Role", false, "list of roles in the template") + tTemplate.ArrayField("policies", "Policy", false, "list of policies defined in this template") + sb.AddType(tTemplate.Build()) + + tTemplateList := rdl.NewStructTypeBuilder("Struct", "TemplateList") + tTemplateList.Comment("List of template names that is the base struct for server and domain templates") + tTemplateList.ArrayField("templateNames", "SimpleName", false, "list of template names") + sb.AddType(tTemplateList.Build()) + + tDomainTemplate := rdl.NewStructTypeBuilder("TemplateList", "DomainTemplate") + tDomainTemplate.Comment("solution template(s) to be applied to a domain") + sb.AddType(tDomainTemplate.Build()) + + tDomainTemplateList := rdl.NewStructTypeBuilder("TemplateList", "DomainTemplateList") + tDomainTemplateList.Comment("List of solution templates to be applied to a domain") + sb.AddType(tDomainTemplateList.Build()) + + tServerTemplateList := rdl.NewStructTypeBuilder("TemplateList", "ServerTemplateList") + tServerTemplateList.Comment("List of solution templates available in the server") + sb.AddType(tServerTemplateList.Build()) + + tDomainList := rdl.NewStructTypeBuilder("Struct", "DomainList") + tDomainList.Comment("A paginated list of domains.") + tDomainList.ArrayField("names", "DomainName", false, "list of domain names") + tDomainList.Field("next", "String", true, nil, "if the response is a paginated list, this attribute specifies the value to be used in the next domain list request as the value for the skip query parameter.") + sb.AddType(tDomainList.Build()) + + tDomainMeta := rdl.NewStructTypeBuilder("Struct", "DomainMeta") + tDomainMeta.Comment("Set of metadata attributes that all domains may have and can be changed.") + tDomainMeta.Field("description", "String", true, nil, "a description of the domain") + tDomainMeta.Field("org", "ResourceName", true, nil, "a reference to an Organization. (i.e. org:media)") + tDomainMeta.Field("enabled", "Bool", true, true, "Future use only, currently not used") + tDomainMeta.Field("auditEnabled", "Bool", true, false, "Flag indicates whether or not domain modifications should be logged for SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for any API defining it.") + tDomainMeta.Field("account", "String", true, nil, "associated cloud (i.e. aws) account id") + tDomainMeta.Field("ypmId", "Int32", true, nil, "associated product id") + sb.AddType(tDomainMeta.Build()) + + tTopLevelDomain := rdl.NewStructTypeBuilder("DomainMeta", "TopLevelDomain") + tTopLevelDomain.Comment("Top Level Domain object. The required attributes include the name of the domain and list of domain administrators.") + tTopLevelDomain.Field("name", "SimpleName", false, nil, "name of the domain") + tTopLevelDomain.ArrayField("adminUsers", "ResourceName", false, "list of domain administrators") + tTopLevelDomain.Field("templates", "DomainTemplateList", true, nil, "list of solution template names") + sb.AddType(tTopLevelDomain.Build()) + + tSubDomain := rdl.NewStructTypeBuilder("TopLevelDomain", "SubDomain") + tSubDomain.Comment("A Subdomain is a TopLevelDomain, except it has a parent.") + tSubDomain.Field("parent", "DomainName", false, nil, "name of the parent domain") + sb.AddType(tSubDomain.Build()) + + tUserDomain := rdl.NewStructTypeBuilder("DomainMeta", "UserDomain") + tUserDomain.Comment("A UserDomain is the user's own top level domain in user - e.g. user.hga") + tUserDomain.Field("name", "SimpleName", false, nil, "user id which will be the domain name") + tUserDomain.Field("templates", "DomainTemplateList", true, nil, "list of solution template names") + sb.AddType(tUserDomain.Build()) + + tDanglingPolicy := rdl.NewStructTypeBuilder("Struct", "DanglingPolicy") + tDanglingPolicy.Comment("A dangling policy where the assertion is referencing a role name that doesn't exist in the domain") + tDanglingPolicy.Field("policyName", "EntityName", false, nil, "") + tDanglingPolicy.Field("roleName", "EntityName", false, nil, "") + sb.AddType(tDanglingPolicy.Build()) + + tDomainDataCheck := rdl.NewStructTypeBuilder("Struct", "DomainDataCheck") + tDomainDataCheck.Comment("Domain data object representing the results of a check operation looking for dangling roles, policies and trust relationships that are set either on tenant or provider side only") + tDomainDataCheck.ArrayField("danglingRoles", "EntityName", true, "Names of roles not specified in any assertion. Might be empty or null if no dangling roles.") + tDomainDataCheck.ArrayField("danglingPolicies", "DanglingPolicy", true, "Policy+role tuples where role doesnt exist. Might be empty or null if no dangling policies.") + tDomainDataCheck.Field("policyCount", "Int32", false, nil, "total number of policies") + tDomainDataCheck.Field("assertionCount", "Int32", false, nil, "total number of assertions") + tDomainDataCheck.Field("roleWildCardCount", "Int32", false, nil, "total number of assertions containing roles as wildcards") + tDomainDataCheck.ArrayField("providersWithoutTrust", "ServiceName", true, "Service names (domain.service) that dont contain trust role if this is a tenant domain. Might be empty or null, if not a tenant or if all providers support this tenant.") + tDomainDataCheck.ArrayField("tenantsWithoutAssumeRole", "DomainName", true, "Names of Tenant domains that dont contain assume role assertions if this is a provider domain. Might be empty or null, if not a provider or if all tenants support use this provider.") + sb.AddType(tDomainDataCheck.Build()) + + tEntity := rdl.NewStructTypeBuilder("Struct", "Entity") + tEntity.Comment("An entity is a name and a structured value. some entity names/prefixes are reserved (i.e. \"role\", \"policy\", \"meta\", \"domain\", \"service\")") + tEntity.Field("name", "EntityName", false, nil, "name of the entity object") + tEntity.Field("value", "Struct", false, nil, "value of the entity") + sb.AddType(tEntity.Build()) + + tEntityList := rdl.NewStructTypeBuilder("Struct", "EntityList") + tEntityList.Comment("The representation for an enumeration of entities in the namespace") + tEntityList.ArrayField("names", "EntityName", false, "list of entity names") + sb.AddType(tEntityList.Build()) + + tPolicyList := rdl.NewStructTypeBuilder("Struct", "PolicyList") + tPolicyList.Comment("The representation for an enumeration of policies in the namespace, with pagination.") + tPolicyList.ArrayField("names", "EntityName", false, "list of policy names") + tPolicyList.Field("next", "String", true, nil, "if the response is a paginated list, this attribute specifies the value to be used in the next policy list request as the value for the skip query parameter.") + sb.AddType(tPolicyList.Build()) + + tPublicKeyEntry := rdl.NewStructTypeBuilder("Struct", "PublicKeyEntry") + tPublicKeyEntry.Comment("The representation of the public key in a service identity object.") + tPublicKeyEntry.Field("key", "String", false, nil, "the public key for the service") + tPublicKeyEntry.Field("id", "String", false, nil, "the key identifier (version or zone name)") + sb.AddType(tPublicKeyEntry.Build()) + + tServiceIdentity := rdl.NewStructTypeBuilder("Struct", "ServiceIdentity") + tServiceIdentity.Comment("The representation of the service identity object.") + tServiceIdentity.Field("name", "ServiceName", false, nil, "the full name of the service, i.e. \"sports.storage\"") + tServiceIdentity.ArrayField("publicKeys", "PublicKeyEntry", true, "array of public keys for key rotation") + tServiceIdentity.Field("providerEndpoint", "String", true, nil, "if present, then this service can provision tenants via this endpoint.") + tServiceIdentity.Field("modified", "Timestamp", true, nil, "the timestamp when this entry was last modified") + tServiceIdentity.Field("executable", "String", true, nil, "the path of the executable that runs the service") + tServiceIdentity.ArrayField("hosts", "String", true, "list of host names that this service can run on") + tServiceIdentity.Field("user", "String", true, nil, "local (unix) user name this service can run as") + tServiceIdentity.Field("group", "String", true, nil, "local (unix) group name this service can run as") + sb.AddType(tServiceIdentity.Build()) + + tServiceIdentities := rdl.NewStructTypeBuilder("Struct", "ServiceIdentities") + tServiceIdentities.Comment("The representation of list of services") + tServiceIdentities.ArrayField("list", "ServiceIdentity", false, "list of services") + sb.AddType(tServiceIdentities.Build()) + + tServiceIdentityList := rdl.NewStructTypeBuilder("Struct", "ServiceIdentityList") + tServiceIdentityList.Comment("The representation for an enumeration of services in the namespace, with pagination.") + tServiceIdentityList.ArrayField("names", "EntityName", false, "list of service names") + tServiceIdentityList.Field("next", "String", true, nil, "if the response is a paginated list, this attribute specifies the value to be used in the next service list request as the value for the skip query parameter.") + sb.AddType(tServiceIdentityList.Build()) + + tTenancy := rdl.NewStructTypeBuilder("Struct", "Tenancy") + tTenancy.Comment("A representation of tenant.") + tTenancy.Field("domain", "DomainName", false, nil, "the domain that is to get a tenancy") + tTenancy.Field("service", "ServiceName", false, nil, "the provider service on which the tenancy is to reside") + tTenancy.ArrayField("resourceGroups", "EntityName", true, "registered resource groups for this tenant") + sb.AddType(tTenancy.Build()) + + tTenancyResourceGroup := rdl.NewStructTypeBuilder("Struct", "TenancyResourceGroup") + tTenancyResourceGroup.Field("domain", "DomainName", false, nil, "the domain that is to get a tenancy") + tTenancyResourceGroup.Field("service", "ServiceName", false, nil, "the provider service on which the tenancy is to reside") + tTenancyResourceGroup.Field("resourceGroup", "EntityName", false, nil, "registered resource group for this tenant") + sb.AddType(tTenancyResourceGroup.Build()) + + tTenantRoleAction := rdl.NewStructTypeBuilder("Struct", "TenantRoleAction") + tTenantRoleAction.Comment("A representation of tenant role action.") + tTenantRoleAction.Field("role", "SimpleName", false, nil, "name of the role") + tTenantRoleAction.Field("action", "String", false, nil, "action value for the generated policy assertion") + sb.AddType(tTenantRoleAction.Build()) + + tTenantRoles := rdl.NewStructTypeBuilder("Struct", "TenantRoles") + tTenantRoles.Comment("A representation of tenant roles to be provisioned.") + tTenantRoles.Field("domain", "DomainName", false, nil, "name of the provider domain") + tTenantRoles.Field("service", "SimpleName", false, nil, "name of the provider service") + tTenantRoles.Field("tenant", "DomainName", false, nil, "name of the tenant domain") + tTenantRoles.ArrayField("roles", "TenantRoleAction", false, "the role/action pairs to provision") + sb.AddType(tTenantRoles.Build()) + + tTenantResourceGroupRoles := rdl.NewStructTypeBuilder("Struct", "TenantResourceGroupRoles") + tTenantResourceGroupRoles.Comment("A representation of tenant roles for resource groups to be provisioned.") + tTenantResourceGroupRoles.Field("domain", "DomainName", false, nil, "name of the provider domain") + tTenantResourceGroupRoles.Field("service", "SimpleName", false, nil, "name of the provider service") + tTenantResourceGroupRoles.Field("tenant", "DomainName", false, nil, "name of the tenant domain") + tTenantResourceGroupRoles.ArrayField("roles", "TenantRoleAction", false, "the role/action pairs to provision") + tTenantResourceGroupRoles.Field("resourceGroup", "EntityName", false, nil, "tenant resource group") + sb.AddType(tTenantResourceGroupRoles.Build()) + + tProviderResourceGroupRoles := rdl.NewStructTypeBuilder("Struct", "ProviderResourceGroupRoles") + tProviderResourceGroupRoles.Comment("A representation of provider roles to be provisioned.") + tProviderResourceGroupRoles.Field("domain", "DomainName", false, nil, "name of the provider domain") + tProviderResourceGroupRoles.Field("service", "SimpleName", false, nil, "name of the provider service") + tProviderResourceGroupRoles.Field("tenant", "DomainName", false, nil, "name of the tenant domain") + tProviderResourceGroupRoles.ArrayField("roles", "TenantRoleAction", false, "the role/action pairs to provision") + tProviderResourceGroupRoles.Field("resourceGroup", "EntityName", false, nil, "tenant resource group") + sb.AddType(tProviderResourceGroupRoles.Build()) + + tAccess := rdl.NewStructTypeBuilder("Struct", "Access") + tAccess.Comment("Access can be checked and returned as this resource.") + tAccess.Field("granted", "Bool", false, nil, "true (allowed) or false (denied)") + sb.AddType(tAccess.Build()) + + tResourceAccess := rdl.NewStructTypeBuilder("Struct", "ResourceAccess") + tResourceAccess.Field("principal", "EntityName", false, nil, "") + tResourceAccess.ArrayField("assertions", "Assertion", false, "") + sb.AddType(tResourceAccess.Build()) + + tResourceAccessList := rdl.NewStructTypeBuilder("Struct", "ResourceAccessList") + tResourceAccessList.ArrayField("resources", "ResourceAccess", false, "") + sb.AddType(tResourceAccessList.Build()) + + tDomainModified := rdl.NewStructTypeBuilder("Struct", "DomainModified") + tDomainModified.Comment("Tuple of domain-name and modification time-stamps. This object is returned when the caller has requested list of domains modified since a specific timestamp.") + tDomainModified.Field("name", "DomainName", false, nil, "name of the domain") + tDomainModified.Field("modified", "Int64", false, nil, "last modified timestamp of the domain") + sb.AddType(tDomainModified.Build()) + + tDomainModifiedList := rdl.NewStructTypeBuilder("Struct", "DomainModifiedList") + tDomainModifiedList.Comment("A list of {domain, modified-timestamp} tuples.") + tDomainModifiedList.ArrayField("nameModList", "DomainModified", false, "list of modified domains") + sb.AddType(tDomainModifiedList.Build()) + + tDomainPolicies := rdl.NewStructTypeBuilder("Struct", "DomainPolicies") + tDomainPolicies.Comment("We need to include the name of the domain in this struct since this data will be passed back to ZPU through ZTS so we need to sign not only the list of policies but also the corresponding domain name that the policies belong to.") + tDomainPolicies.Field("domain", "DomainName", false, nil, "name of the domain") + tDomainPolicies.ArrayField("policies", "Policy", false, "list of policies defined in this server") + sb.AddType(tDomainPolicies.Build()) + + tSignedPolicies := rdl.NewStructTypeBuilder("Struct", "SignedPolicies") + tSignedPolicies.Comment("A signed bulk transfer of policies. The data is signed with server's private key.") + tSignedPolicies.Field("contents", "DomainPolicies", false, nil, "list of policies defined in a domain") + tSignedPolicies.Field("signature", "String", false, nil, "signature generated based on the domain policies object") + tSignedPolicies.Field("keyId", "String", false, nil, "the identifier of the key used to generate the signature") + sb.AddType(tSignedPolicies.Build()) + + tDomainData := rdl.NewStructTypeBuilder("Struct", "DomainData") + tDomainData.Comment("A domain object that includes its roles, policies and services.") + tDomainData.Field("name", "DomainName", false, nil, "name of the domain") + tDomainData.Field("account", "String", true, nil, "associated cloud (i.e. aws) account id") + tDomainData.Field("ypmId", "Int32", true, nil, "associated product id") + tDomainData.ArrayField("roles", "Role", false, "list of roles in the domain") + tDomainData.Field("policies", "SignedPolicies", false, nil, "list of policies in the domain signed with ZMS private key") + tDomainData.ArrayField("services", "ServiceIdentity", false, "list of services in the domain") + tDomainData.ArrayField("entities", "Entity", false, "list of entities in the domain") + tDomainData.Field("modified", "Timestamp", false, nil, "last modification timestamp") + sb.AddType(tDomainData.Build()) + + tSignedDomain := rdl.NewStructTypeBuilder("Struct", "SignedDomain") + tSignedDomain.Comment("A domain object signed with server's private key") + tSignedDomain.Field("domain", "DomainData", false, nil, "domain object with its roles, policies and services") + tSignedDomain.Field("signature", "String", false, nil, "signature generated based on the domain object") + tSignedDomain.Field("keyId", "String", false, nil, "the identifier of the key used to generate the signature") + sb.AddType(tSignedDomain.Build()) + + tSignedDomains := rdl.NewStructTypeBuilder("Struct", "SignedDomains") + tSignedDomains.Comment("A list of signed domain objects") + tSignedDomains.ArrayField("domains", "SignedDomain", false, "") + sb.AddType(tSignedDomains.Build()) + + tUserToken := rdl.NewStructTypeBuilder("Struct", "UserToken") + tUserToken.Comment("A user token generated based on user's credentials") + tUserToken.Field("token", "SignedToken", false, nil, "Signed user token identifying a specific authenticated user") + sb.AddType(tUserToken.Build()) + + tServicePrincipal := rdl.NewStructTypeBuilder("Struct", "ServicePrincipal") + tServicePrincipal.Comment("A service principal object identifying a given service.") + tServicePrincipal.Field("domain", "DomainName", false, nil, "name of the domain") + tServicePrincipal.Field("service", "EntityName", false, nil, "name of the service") + tServicePrincipal.Field("token", "SignedToken", false, nil, "service's signed token") + sb.AddType(tServicePrincipal.Build()) + + rGetDomain := rdl.NewResourceBuilder("Domain", "GET", "/domain/{domain}") + rGetDomain.Comment("Get info for the specified domain, by name. This request only returns the configured domain attributes and not any domain objects like roles, policies or service identities.") + rGetDomain.Input("domain", "DomainName", true, "", "", false, nil, "name of the domain") + rGetDomain.Auth("", "", true, "") + rGetDomain.Exception("BAD_REQUEST", "ResourceError", "") + rGetDomain.Exception("FORBIDDEN", "ResourceError", "") + rGetDomain.Exception("NOT_FOUND", "ResourceError", "") + rGetDomain.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetDomain.Build()) + + rGetDomainList := rdl.NewResourceBuilder("DomainList", "GET", "/domain") + rGetDomainList.Comment("Enumerate domains. Can be filtered by prefix and depth, and paginated. This operation can be expensive, as it may span multiple domains.") + rGetDomainList.Input("limit", "Int32", false, "limit", "", true, nil, "restrict the number of results in this call") + rGetDomainList.Input("skip", "String", false, "skip", "", true, nil, "restrict the set to those after the specified \"next\" token returned from a previous call") + rGetDomainList.Input("prefix", "String", false, "prefix", "", true, nil, "restrict to names that start with the prefix") + rGetDomainList.Input("depth", "Int32", false, "depth", "", true, nil, "restrict the depth of the name, specifying the number of '.' characters that can appear") + rGetDomainList.Input("account", "String", false, "account", "", true, nil, "restrict to domain names that have specified account name") + rGetDomainList.Input("productId", "Int32", false, "ypmid", "", true, nil, "restrict the domain names that have specified product id") + rGetDomainList.Input("roleMember", "ResourceName", false, "member", "", true, nil, "restrict the domain names where the specified user is in a role - see roleName") + rGetDomainList.Input("roleName", "ResourceName", false, "role", "", true, nil, "restrict the domain names where the specified user is in this role - see roleMember") + rGetDomainList.Input("modifiedSince", "String", false, "", "If-Modified-Since", false, nil, "This header specifies to the server to return any domains modified since this HTTP date") + rGetDomainList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetDomainList.Build()) + + rPostTopLevelDomain := rdl.NewResourceBuilder("Domain", "POST", "/domain") + rPostTopLevelDomain.Comment("Create a new top level domain. This is a privileged action for the \"sys.auth\" administrators.") + rPostTopLevelDomain.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPostTopLevelDomain.Input("detail", "TopLevelDomain", false, "", "", false, nil, "TopLevelDomain object to be created") + rPostTopLevelDomain.Auth("create", "sys.auth:domain", false, "") + rPostTopLevelDomain.Exception("BAD_REQUEST", "ResourceError", "") + rPostTopLevelDomain.Exception("FORBIDDEN", "ResourceError", "") + rPostTopLevelDomain.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostTopLevelDomain.Build()) + + rPostSubDomain := rdl.NewResourceBuilder("Domain", "POST", "/subdomain/{parent}") + rPostSubDomain.Comment("Create a new subdomain. The domain administrators of the {parent} domain have the privilege to create subdomains.") + rPostSubDomain.Input("parent", "DomainName", true, "", "", false, nil, "name of the parent domain") + rPostSubDomain.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPostSubDomain.Input("detail", "SubDomain", false, "", "", false, nil, "Subdomain object to be created") + rPostSubDomain.Auth("create", "{parent}:domain", false, "") + rPostSubDomain.Exception("BAD_REQUEST", "ResourceError", "") + rPostSubDomain.Exception("FORBIDDEN", "ResourceError", "") + rPostSubDomain.Exception("NOT_FOUND", "ResourceError", "") + rPostSubDomain.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostSubDomain.Build()) + + rPostUserDomain := rdl.NewResourceBuilder("Domain", "POST", "/userdomain/{name}") + rPostUserDomain.Comment("Create a new user domain. The user domain will be created in the user top level domain and the user himself will be set as the administrator for this domain.") + rPostUserDomain.Input("name", "SimpleName", true, "", "", false, nil, "name of the domain which will be the user id") + rPostUserDomain.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPostUserDomain.Input("detail", "UserDomain", false, "", "", false, nil, "UserDomain object to be created") + rPostUserDomain.Auth("create", "user.{name}:domain", false, "") + rPostUserDomain.Exception("BAD_REQUEST", "ResourceError", "") + rPostUserDomain.Exception("FORBIDDEN", "ResourceError", "") + rPostUserDomain.Exception("NOT_FOUND", "ResourceError", "") + rPostUserDomain.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostUserDomain.Build()) + + rDeleteTopLevelDomain := rdl.NewResourceBuilder("TopLevelDomain", "DELETE", "/domain/{name}") + rDeleteTopLevelDomain.Comment("Delete the specified domain. This is a privileged action for the \"sys.auth\" administrators. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteTopLevelDomain.Input("name", "DomainName", true, "", "", false, nil, "name of the domain to be deleted") + rDeleteTopLevelDomain.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteTopLevelDomain.Auth("delete", "sys.auth:domain", false, "") + rDeleteTopLevelDomain.Expected("NO_CONTENT") + rDeleteTopLevelDomain.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteTopLevelDomain.Exception("FORBIDDEN", "ResourceError", "") + rDeleteTopLevelDomain.Exception("NOT_FOUND", "ResourceError", "") + rDeleteTopLevelDomain.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteTopLevelDomain.Build()) + + rDeleteSubDomain := rdl.NewResourceBuilder("SubDomain", "DELETE", "/subdomain/{parent}/{name}") + rDeleteSubDomain.Comment("Delete the specified subdomain. Caller must have domain delete permissions in parent. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteSubDomain.Input("parent", "DomainName", true, "", "", false, nil, "name of the parent domain") + rDeleteSubDomain.Input("name", "DomainName", true, "", "", false, nil, "name of the subdomain to be deleted") + rDeleteSubDomain.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteSubDomain.Auth("delete", "{parent}:domain", false, "") + rDeleteSubDomain.Expected("NO_CONTENT") + rDeleteSubDomain.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteSubDomain.Exception("FORBIDDEN", "ResourceError", "") + rDeleteSubDomain.Exception("NOT_FOUND", "ResourceError", "") + rDeleteSubDomain.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteSubDomain.Build()) + + rDeleteUserDomain := rdl.NewResourceBuilder("UserDomain", "DELETE", "/userdomain/{name}") + rDeleteUserDomain.Comment("Delete the specified userdomain. Caller must have domain delete permissions in the domain. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteUserDomain.Input("name", "SimpleName", true, "", "", false, nil, "name of the domain to be deleted which will be the user id") + rDeleteUserDomain.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteUserDomain.Auth("delete", "user.{name}:domain", false, "") + rDeleteUserDomain.Expected("NO_CONTENT") + rDeleteUserDomain.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteUserDomain.Exception("FORBIDDEN", "ResourceError", "") + rDeleteUserDomain.Exception("NOT_FOUND", "ResourceError", "") + rDeleteUserDomain.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteUserDomain.Build()) + + rPutDomainMeta := rdl.NewResourceBuilder("Domain", "PUT", "/domain/{name}/meta") + rPutDomainMeta.Comment("Update the specified top level domain metadata. Note that entities in the domain are not affected. Caller must have update privileges on the domain itself.") + rPutDomainMeta.Input("name", "DomainName", true, "", "", false, nil, "name of the domain to be updated") + rPutDomainMeta.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutDomainMeta.Input("detail", "DomainMeta", false, "", "", false, nil, "DomainMeta object with updated attribute values") + rPutDomainMeta.Auth("update", "{name}:", false, "") + rPutDomainMeta.Expected("NO_CONTENT") + rPutDomainMeta.Exception("BAD_REQUEST", "ResourceError", "") + rPutDomainMeta.Exception("CONFLICT", "ResourceError", "") + rPutDomainMeta.Exception("FORBIDDEN", "ResourceError", "") + rPutDomainMeta.Exception("NOT_FOUND", "ResourceError", "") + rPutDomainMeta.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutDomainMeta.Build()) + + rPutDomainTemplate := rdl.NewResourceBuilder("DomainTemplate", "PUT", "/domain/{name}/template") + rPutDomainTemplate.Comment("Update the given domain by applying the roles and policies defined in the specified solution template(s). Caller must have UPDATE privileges on the domain itself.") + rPutDomainTemplate.Input("name", "DomainName", true, "", "", false, nil, "name of the domain to be updated") + rPutDomainTemplate.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutDomainTemplate.Input("template", "DomainTemplate", false, "", "", false, nil, "DomainTemplate object with solution template name(s)") + rPutDomainTemplate.Auth("update", "{name}:", false, "") + rPutDomainTemplate.Expected("NO_CONTENT") + rPutDomainTemplate.Exception("BAD_REQUEST", "ResourceError", "") + rPutDomainTemplate.Exception("CONFLICT", "ResourceError", "") + rPutDomainTemplate.Exception("FORBIDDEN", "ResourceError", "") + rPutDomainTemplate.Exception("NOT_FOUND", "ResourceError", "") + rPutDomainTemplate.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutDomainTemplate.Build()) + + rGetDomainTemplateList := rdl.NewResourceBuilder("DomainTemplateList", "GET", "/domain/{name}/template") + rGetDomainTemplateList.Comment("Get the list of solution templates applied to a domain") + rGetDomainTemplateList.Input("name", "DomainName", true, "", "", false, nil, "name of the domain") + rGetDomainTemplateList.Auth("", "", true, "") + rGetDomainTemplateList.Exception("BAD_REQUEST", "ResourceError", "") + rGetDomainTemplateList.Exception("NOT_FOUND", "ResourceError", "") + rGetDomainTemplateList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetDomainTemplateList.Build()) + + rDeleteDomainTemplate := rdl.NewResourceBuilder("DomainTemplate", "DELETE", "/domain/{name}/template/{template}") + rDeleteDomainTemplate.Comment("Update the given domain by deleting the specified template from the domain template list. Cycles through the roles and policies defined in the template and deletes them. Caller must have delete privileges on the domain itself.") + rDeleteDomainTemplate.Input("name", "DomainName", true, "", "", false, nil, "name of the domain to be updated") + rDeleteDomainTemplate.Input("template", "SimpleName", true, "", "", false, nil, "name of the solution template") + rDeleteDomainTemplate.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteDomainTemplate.Auth("delete", "{name}:", false, "") + rDeleteDomainTemplate.Expected("NO_CONTENT") + rDeleteDomainTemplate.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteDomainTemplate.Exception("CONFLICT", "ResourceError", "") + rDeleteDomainTemplate.Exception("FORBIDDEN", "ResourceError", "") + rDeleteDomainTemplate.Exception("NOT_FOUND", "ResourceError", "") + rDeleteDomainTemplate.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteDomainTemplate.Build()) + + rGetDomainDataCheck := rdl.NewResourceBuilder("DomainDataCheck", "GET", "/domain/{domainName}/check") + rGetDomainDataCheck.Comment("Carry out data check operation for the specified domain.") + rGetDomainDataCheck.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetDomainDataCheck.Auth("", "", true, "") + rGetDomainDataCheck.Exception("FORBIDDEN", "ResourceError", "") + rGetDomainDataCheck.Exception("NOT_FOUND", "ResourceError", "") + rGetDomainDataCheck.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetDomainDataCheck.Build()) + + rPutEntity := rdl.NewResourceBuilder("Entity", "PUT", "/domain/{domainName}/entity/{entityName}") + rPutEntity.Comment("Put an entity into the domain.") + rPutEntity.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rPutEntity.Input("entityName", "EntityName", true, "", "", false, nil, "name of entity") + rPutEntity.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutEntity.Input("entity", "Entity", false, "", "", false, nil, "Entity object to be added to the domain") + rPutEntity.Auth("update", "{domainName}:{entityName}", false, "") + rPutEntity.Expected("NO_CONTENT") + rPutEntity.Exception("BAD_REQUEST", "ResourceError", "") + rPutEntity.Exception("CONFLICT", "ResourceError", "") + rPutEntity.Exception("FORBIDDEN", "ResourceError", "") + rPutEntity.Exception("NOT_FOUND", "ResourceError", "") + rPutEntity.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutEntity.Build()) + + rGetEntity := rdl.NewResourceBuilder("Entity", "GET", "/domain/{domainName}/entity/{entityName}") + rGetEntity.Comment("Get a entity from a domain. open for all authenticated users to read") + rGetEntity.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetEntity.Input("entityName", "EntityName", true, "", "", false, nil, "name of entity") + rGetEntity.Auth("", "", true, "") + rGetEntity.Exception("BAD_REQUEST", "ResourceError", "") + rGetEntity.Exception("FORBIDDEN", "ResourceError", "") + rGetEntity.Exception("NOT_FOUND", "ResourceError", "") + rGetEntity.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetEntity.Build()) + + rDeleteEntity := rdl.NewResourceBuilder("Entity", "DELETE", "/domain/{domainName}/entity/{entityName}") + rDeleteEntity.Comment("Delete the entity from the domain. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteEntity.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rDeleteEntity.Input("entityName", "EntityName", true, "", "", false, nil, "name of entity") + rDeleteEntity.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteEntity.Auth("delete", "{domainName}:{entityName}", false, "") + rDeleteEntity.Expected("NO_CONTENT") + rDeleteEntity.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteEntity.Exception("CONFLICT", "ResourceError", "") + rDeleteEntity.Exception("FORBIDDEN", "ResourceError", "") + rDeleteEntity.Exception("NOT_FOUND", "ResourceError", "") + rDeleteEntity.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteEntity.Build()) + + rGetEntityList := rdl.NewResourceBuilder("EntityList", "GET", "/domain/{domainName}/entity") + rGetEntityList.Comment("Enumerate entities provisioned in this domain.") + rGetEntityList.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetEntityList.Auth("", "", true, "") + rGetEntityList.Exception("BAD_REQUEST", "ResourceError", "") + rGetEntityList.Exception("NOT_FOUND", "ResourceError", "") + rGetEntityList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetEntityList.Build()) + + rGetRoleList := rdl.NewResourceBuilder("RoleList", "GET", "/domain/{domainName}/role") + rGetRoleList.Comment("Enumerate roles provisioned in this domain.") + rGetRoleList.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetRoleList.Input("limit", "Int32", false, "limit", "", true, nil, "restrict the number of results in this call") + rGetRoleList.Input("skip", "String", false, "skip", "", true, nil, "restrict the set to those after the specified \"next\" token returned from a previous call") + rGetRoleList.Auth("", "", true, "") + rGetRoleList.Exception("BAD_REQUEST", "ResourceError", "") + rGetRoleList.Exception("FORBIDDEN", "ResourceError", "") + rGetRoleList.Exception("NOT_FOUND", "ResourceError", "") + rGetRoleList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetRoleList.Build()) + + rGetRoles := rdl.NewResourceBuilder("Roles", "GET", "/domain/{domainName}/roles") + rGetRoles.Comment("Get the list of all roles in a domain with optional flag whether or not include members") + rGetRoles.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetRoles.Input("members", "Bool", false, "members", "", true, false, "return list of members in the role") + rGetRoles.Auth("", "", true, "") + rGetRoles.Exception("BAD_REQUEST", "ResourceError", "") + rGetRoles.Exception("NOT_FOUND", "ResourceError", "") + rGetRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetRoles.Build()) + + rGetRole := rdl.NewResourceBuilder("Role", "GET", "/domain/{domainName}/role/{roleName}") + rGetRole.Comment("Get the specified role in the domain.") + rGetRole.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetRole.Input("roleName", "EntityName", true, "", "", false, nil, "name of the role to be retrieved") + rGetRole.Input("auditLog", "Bool", false, "auditLog", "", true, false, "flag to indicate whether or not to return role audit log") + rGetRole.Input("expand", "Bool", false, "expand", "", true, false, "expand delegated trust roles and return trusted members") + rGetRole.Auth("", "", true, "") + rGetRole.Exception("BAD_REQUEST", "ResourceError", "") + rGetRole.Exception("FORBIDDEN", "ResourceError", "") + rGetRole.Exception("NOT_FOUND", "ResourceError", "") + rGetRole.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetRole.Build()) + + rPutRole := rdl.NewResourceBuilder("Role", "PUT", "/domain/{domainName}/role/{roleName}") + rPutRole.Comment("Create/update the specified role.") + rPutRole.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rPutRole.Input("roleName", "EntityName", true, "", "", false, nil, "name of the role to be added/updated") + rPutRole.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutRole.Input("role", "Role", false, "", "", false, nil, "Role object to be added/updated in the domain") + rPutRole.Auth("update", "{domainName}:role.{roleName}", false, "") + rPutRole.Expected("NO_CONTENT") + rPutRole.Exception("BAD_REQUEST", "ResourceError", "") + rPutRole.Exception("CONFLICT", "ResourceError", "") + rPutRole.Exception("FORBIDDEN", "ResourceError", "") + rPutRole.Exception("NOT_FOUND", "ResourceError", "") + rPutRole.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutRole.Build()) + + rDeleteRole := rdl.NewResourceBuilder("Role", "DELETE", "/domain/{domainName}/role/{roleName}") + rDeleteRole.Comment("Delete the specified role. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteRole.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rDeleteRole.Input("roleName", "EntityName", true, "", "", false, nil, "name of the role to be deleted") + rDeleteRole.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteRole.Auth("delete", "{domainName}:role.{roleName}", false, "") + rDeleteRole.Expected("NO_CONTENT") + rDeleteRole.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteRole.Exception("CONFLICT", "ResourceError", "") + rDeleteRole.Exception("FORBIDDEN", "ResourceError", "") + rDeleteRole.Exception("NOT_FOUND", "ResourceError", "") + rDeleteRole.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteRole.Build()) + + rGetMembership := rdl.NewResourceBuilder("Membership", "GET", "/domain/{domainName}/role/{roleName}/member/{memberName}") + rGetMembership.Comment("Get the membership status for a specified user in a role.") + rGetMembership.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetMembership.Input("roleName", "EntityName", true, "", "", false, nil, "name of the role") + rGetMembership.Input("memberName", "ResourceName", true, "", "", false, nil, "user name to be checked for membership") + rGetMembership.Auth("", "", true, "") + rGetMembership.Exception("BAD_REQUEST", "ResourceError", "") + rGetMembership.Exception("FORBIDDEN", "ResourceError", "") + rGetMembership.Exception("NOT_FOUND", "ResourceError", "") + rGetMembership.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetMembership.Build()) + + rPutMembership := rdl.NewResourceBuilder("Membership", "PUT", "/domain/{domainName}/role/{roleName}/member/{memberName}") + rPutMembership.Comment("Add the specified user to the role's member list.") + rPutMembership.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rPutMembership.Input("roleName", "EntityName", true, "", "", false, nil, "name of the role") + rPutMembership.Input("memberName", "ResourceName", true, "", "", false, nil, "name of the user to be added as a member") + rPutMembership.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutMembership.Input("membership", "Membership", false, "", "", false, nil, "Membership object (must contain role/member names as specified in the URI)") + rPutMembership.Auth("update", "{domainName}:role.{roleName}", false, "") + rPutMembership.Expected("NO_CONTENT") + rPutMembership.Exception("BAD_REQUEST", "ResourceError", "") + rPutMembership.Exception("CONFLICT", "ResourceError", "") + rPutMembership.Exception("FORBIDDEN", "ResourceError", "") + rPutMembership.Exception("NOT_FOUND", "ResourceError", "") + rPutMembership.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutMembership.Build()) + + rDeleteMembership := rdl.NewResourceBuilder("Membership", "DELETE", "/domain/{domainName}/role/{roleName}/member/{memberName}") + rDeleteMembership.Comment("Delete the specified role membership. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteMembership.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rDeleteMembership.Input("roleName", "EntityName", true, "", "", false, nil, "name of the role") + rDeleteMembership.Input("memberName", "ResourceName", true, "", "", false, nil, "name of the user to be removed as a member") + rDeleteMembership.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteMembership.Auth("update", "{domainName}:role.{roleName}", false, "") + rDeleteMembership.Expected("NO_CONTENT") + rDeleteMembership.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteMembership.Exception("CONFLICT", "ResourceError", "") + rDeleteMembership.Exception("FORBIDDEN", "ResourceError", "") + rDeleteMembership.Exception("NOT_FOUND", "ResourceError", "") + rDeleteMembership.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteMembership.Build()) + + rPutDefaultAdmins := rdl.NewResourceBuilder("DefaultAdmins", "PUT", "/domain/{domainName}/admins") + rPutDefaultAdmins.Comment("Verify and, if necessary, fix domain roles and policies to make sure the given set of users have administrative access to the domain. This request is only restricted to \"sys.auth\" domain administrators and can be used when the domain administrators incorrectly have blocked their own access to their domains.") + rPutDefaultAdmins.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rPutDefaultAdmins.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutDefaultAdmins.Input("defaultAdmins", "DefaultAdmins", false, "", "", false, nil, "list of domain administrators") + rPutDefaultAdmins.Auth("update", "sys.auth:domain", false, "") + rPutDefaultAdmins.Expected("NO_CONTENT") + rPutDefaultAdmins.Exception("BAD_REQUEST", "ResourceError", "") + rPutDefaultAdmins.Exception("FORBIDDEN", "ResourceError", "") + rPutDefaultAdmins.Exception("NOT_FOUND", "ResourceError", "") + rPutDefaultAdmins.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutDefaultAdmins.Build()) + + rGetPolicyList := rdl.NewResourceBuilder("PolicyList", "GET", "/domain/{domainName}/policy") + rGetPolicyList.Comment("List policies provisioned in this namespace.") + rGetPolicyList.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetPolicyList.Input("limit", "Int32", false, "limit", "", true, nil, "restrict the number of results in this call") + rGetPolicyList.Input("skip", "String", false, "skip", "", true, nil, "restrict the set to those after the specified \"next\" token returned from a previous call") + rGetPolicyList.Auth("", "", true, "") + rGetPolicyList.Exception("BAD_REQUEST", "ResourceError", "") + rGetPolicyList.Exception("FORBIDDEN", "ResourceError", "") + rGetPolicyList.Exception("NOT_FOUND", "ResourceError", "") + rGetPolicyList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetPolicyList.Build()) + + rGetPolicies := rdl.NewResourceBuilder("Policies", "GET", "/domain/{domainName}/policies") + rGetPolicies.Comment("List policies provisioned in this namespace.") + rGetPolicies.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetPolicies.Input("assertions", "Bool", false, "assertions", "", true, false, "return list of assertions in the policy") + rGetPolicies.Auth("", "", true, "") + rGetPolicies.Exception("BAD_REQUEST", "ResourceError", "") + rGetPolicies.Exception("NOT_FOUND", "ResourceError", "") + rGetPolicies.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetPolicies.Build()) + + rGetPolicy := rdl.NewResourceBuilder("Policy", "GET", "/domain/{domainName}/policy/{policyName}") + rGetPolicy.Comment("Read the specified policy.") + rGetPolicy.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetPolicy.Input("policyName", "EntityName", true, "", "", false, nil, "name of the policy to be retrieved") + rGetPolicy.Auth("", "", true, "") + rGetPolicy.Exception("BAD_REQUEST", "ResourceError", "") + rGetPolicy.Exception("FORBIDDEN", "ResourceError", "") + rGetPolicy.Exception("NOT_FOUND", "ResourceError", "") + rGetPolicy.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetPolicy.Build()) + + rPutPolicy := rdl.NewResourceBuilder("Policy", "PUT", "/domain/{domainName}/policy/{policyName}") + rPutPolicy.Comment("Create or update the specified policy.") + rPutPolicy.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rPutPolicy.Input("policyName", "EntityName", true, "", "", false, nil, "name of the policy to be added/updated") + rPutPolicy.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutPolicy.Input("policy", "Policy", false, "", "", false, nil, "Policy object to be added or updated in the domain") + rPutPolicy.Auth("update", "{domainName}:policy.{policyName}", false, "") + rPutPolicy.Expected("NO_CONTENT") + rPutPolicy.Exception("BAD_REQUEST", "ResourceError", "") + rPutPolicy.Exception("CONFLICT", "ResourceError", "") + rPutPolicy.Exception("FORBIDDEN", "ResourceError", "") + rPutPolicy.Exception("NOT_FOUND", "ResourceError", "") + rPutPolicy.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutPolicy.Build()) + + rDeletePolicy := rdl.NewResourceBuilder("Policy", "DELETE", "/domain/{domainName}/policy/{policyName}") + rDeletePolicy.Comment("Delete the specified policy. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeletePolicy.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rDeletePolicy.Input("policyName", "EntityName", true, "", "", false, nil, "name of the policy to be deleted") + rDeletePolicy.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeletePolicy.Auth("delete", "{domainName}:policy.{policyName}", false, "") + rDeletePolicy.Expected("NO_CONTENT") + rDeletePolicy.Exception("BAD_REQUEST", "ResourceError", "") + rDeletePolicy.Exception("CONFLICT", "ResourceError", "") + rDeletePolicy.Exception("FORBIDDEN", "ResourceError", "") + rDeletePolicy.Exception("NOT_FOUND", "ResourceError", "") + rDeletePolicy.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeletePolicy.Build()) + + rGetAssertion := rdl.NewResourceBuilder("Assertion", "GET", "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + rGetAssertion.Comment("Get the assertion details with specified id in the given policy") + rGetAssertion.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetAssertion.Input("policyName", "EntityName", true, "", "", false, nil, "name of the policy") + rGetAssertion.Input("assertionId", "Int64", true, "", "", false, nil, "assertion id") + rGetAssertion.Auth("", "", true, "") + rGetAssertion.Exception("BAD_REQUEST", "ResourceError", "") + rGetAssertion.Exception("FORBIDDEN", "ResourceError", "") + rGetAssertion.Exception("NOT_FOUND", "ResourceError", "") + rGetAssertion.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetAssertion.Build()) + + rPutAssertion := rdl.NewResourceBuilder("Assertion", "PUT", "/domain/{domainName}/policy/{policyName}/assertion") + rPutAssertion.Comment("Add the specified assertion to the given policy") + rPutAssertion.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rPutAssertion.Input("policyName", "EntityName", true, "", "", false, nil, "name of the policy") + rPutAssertion.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutAssertion.Input("assertion", "Assertion", false, "", "", false, nil, "Assertion object to be added to the given policy") + rPutAssertion.Auth("update", "{domainName}:policy.{policyName}", false, "") + rPutAssertion.Exception("BAD_REQUEST", "ResourceError", "") + rPutAssertion.Exception("CONFLICT", "ResourceError", "") + rPutAssertion.Exception("FORBIDDEN", "ResourceError", "") + rPutAssertion.Exception("NOT_FOUND", "ResourceError", "") + rPutAssertion.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutAssertion.Build()) + + rDeleteAssertion := rdl.NewResourceBuilder("Assertion", "DELETE", "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + rDeleteAssertion.Comment("Delete the specified policy assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteAssertion.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rDeleteAssertion.Input("policyName", "EntityName", true, "", "", false, nil, "name of the policy") + rDeleteAssertion.Input("assertionId", "Int64", true, "", "", false, nil, "assertion id") + rDeleteAssertion.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteAssertion.Auth("update", "{domainName}:policy.{policyName}", false, "") + rDeleteAssertion.Expected("NO_CONTENT") + rDeleteAssertion.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteAssertion.Exception("CONFLICT", "ResourceError", "") + rDeleteAssertion.Exception("FORBIDDEN", "ResourceError", "") + rDeleteAssertion.Exception("NOT_FOUND", "ResourceError", "") + rDeleteAssertion.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteAssertion.Build()) + + rPutServiceIdentity := rdl.NewResourceBuilder("ServiceIdentity", "PUT", "/domain/{domain}/service/{service}") + rPutServiceIdentity.Comment("Register the specified ServiceIdentity in the specified domain") + rPutServiceIdentity.Input("domain", "DomainName", true, "", "", false, nil, "name of the domain") + rPutServiceIdentity.Input("service", "SimpleName", true, "", "", false, nil, "name of the service") + rPutServiceIdentity.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutServiceIdentity.Input("detail", "ServiceIdentity", false, "", "", false, nil, "ServiceIdentity object to be added/updated in the domain") + rPutServiceIdentity.Auth("update", "{domain}:service", false, "") + rPutServiceIdentity.Expected("NO_CONTENT") + rPutServiceIdentity.Exception("BAD_REQUEST", "ResourceError", "") + rPutServiceIdentity.Exception("CONFLICT", "ResourceError", "") + rPutServiceIdentity.Exception("FORBIDDEN", "ResourceError", "") + rPutServiceIdentity.Exception("NOT_FOUND", "ResourceError", "") + rPutServiceIdentity.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutServiceIdentity.Build()) + + rGetServiceIdentity := rdl.NewResourceBuilder("ServiceIdentity", "GET", "/domain/{domain}/service/{service}") + rGetServiceIdentity.Comment("Get info for the specified ServiceIdentity.") + rGetServiceIdentity.Input("domain", "DomainName", true, "", "", false, nil, "name of the domain") + rGetServiceIdentity.Input("service", "SimpleName", true, "", "", false, nil, "name of the service to be retrieved") + rGetServiceIdentity.Auth("", "", true, "") + rGetServiceIdentity.Exception("BAD_REQUEST", "ResourceError", "") + rGetServiceIdentity.Exception("FORBIDDEN", "ResourceError", "") + rGetServiceIdentity.Exception("NOT_FOUND", "ResourceError", "") + rGetServiceIdentity.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetServiceIdentity.Build()) + + rDeleteServiceIdentity := rdl.NewResourceBuilder("ServiceIdentity", "DELETE", "/domain/{domain}/service/{service}") + rDeleteServiceIdentity.Comment("Delete the specified ServiceIdentity. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteServiceIdentity.Input("domain", "DomainName", true, "", "", false, nil, "name of the domain") + rDeleteServiceIdentity.Input("service", "SimpleName", true, "", "", false, nil, "name of the service to be deleted") + rDeleteServiceIdentity.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteServiceIdentity.Auth("delete", "{domain}:service", false, "") + rDeleteServiceIdentity.Expected("NO_CONTENT") + rDeleteServiceIdentity.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteServiceIdentity.Exception("CONFLICT", "ResourceError", "") + rDeleteServiceIdentity.Exception("FORBIDDEN", "ResourceError", "") + rDeleteServiceIdentity.Exception("NOT_FOUND", "ResourceError", "") + rDeleteServiceIdentity.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteServiceIdentity.Build()) + + rGetServiceIdentities := rdl.NewResourceBuilder("ServiceIdentities", "GET", "/domain/{domainName}/services") + rGetServiceIdentities.Comment("Retrieve list of service identities") + rGetServiceIdentities.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetServiceIdentities.Input("publickeys", "Bool", false, "publickeys", "", true, false, "return list of public keys in the service") + rGetServiceIdentities.Input("hosts", "Bool", false, "hosts", "", true, false, "return list of hosts in the service") + rGetServiceIdentities.Auth("", "", true, "") + rGetServiceIdentities.Exception("BAD_REQUEST", "ResourceError", "") + rGetServiceIdentities.Exception("NOT_FOUND", "ResourceError", "") + rGetServiceIdentities.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetServiceIdentities.Build()) + + rGetServiceIdentityList := rdl.NewResourceBuilder("ServiceIdentityList", "GET", "/domain/{domainName}/service") + rGetServiceIdentityList.Comment("Enumerate services provisioned in this domain.") + rGetServiceIdentityList.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetServiceIdentityList.Input("limit", "Int32", false, "limit", "", true, nil, "restrict the number of results in this call") + rGetServiceIdentityList.Input("skip", "String", false, "skip", "", true, nil, "restrict the set to those after the specified \"next\" token returned from a previous call") + rGetServiceIdentityList.Auth("", "", true, "") + rGetServiceIdentityList.Exception("BAD_REQUEST", "ResourceError", "") + rGetServiceIdentityList.Exception("FORBIDDEN", "ResourceError", "") + rGetServiceIdentityList.Exception("NOT_FOUND", "ResourceError", "") + rGetServiceIdentityList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetServiceIdentityList.Build()) + + rGetPublicKeyEntry := rdl.NewResourceBuilder("PublicKeyEntry", "GET", "/domain/{domain}/service/{service}/publickey/{id}") + rGetPublicKeyEntry.Comment("Retrieve the specified public key from the service.") + rGetPublicKeyEntry.Input("domain", "DomainName", true, "", "", false, nil, "name of the domain") + rGetPublicKeyEntry.Input("service", "SimpleName", true, "", "", false, nil, "name of the service") + rGetPublicKeyEntry.Input("id", "String", true, "", "", false, nil, "the identifier of the public key to be retrieved") + rGetPublicKeyEntry.Auth("", "", true, "") + rGetPublicKeyEntry.Exception("BAD_REQUEST", "ResourceError", "") + rGetPublicKeyEntry.Exception("FORBIDDEN", "ResourceError", "") + rGetPublicKeyEntry.Exception("NOT_FOUND", "ResourceError", "") + rGetPublicKeyEntry.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetPublicKeyEntry.Build()) + + rPutPublicKeyEntry := rdl.NewResourceBuilder("PublicKeyEntry", "PUT", "/domain/{domain}/service/{service}/publickey/{id}") + rPutPublicKeyEntry.Comment("Add the specified public key to the service.") + rPutPublicKeyEntry.Input("domain", "DomainName", true, "", "", false, nil, "name of the domain") + rPutPublicKeyEntry.Input("service", "SimpleName", true, "", "", false, nil, "name of the service") + rPutPublicKeyEntry.Input("id", "String", true, "", "", false, nil, "the identifier of the public key to be added") + rPutPublicKeyEntry.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutPublicKeyEntry.Input("publicKeyEntry", "PublicKeyEntry", false, "", "", false, nil, "PublicKeyEntry object to be added/updated in the service") + rPutPublicKeyEntry.Auth("update", "{domain}:service.{service}", false, "") + rPutPublicKeyEntry.Expected("NO_CONTENT") + rPutPublicKeyEntry.Exception("BAD_REQUEST", "ResourceError", "") + rPutPublicKeyEntry.Exception("CONFLICT", "ResourceError", "") + rPutPublicKeyEntry.Exception("FORBIDDEN", "ResourceError", "") + rPutPublicKeyEntry.Exception("NOT_FOUND", "ResourceError", "") + rPutPublicKeyEntry.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutPublicKeyEntry.Build()) + + rDeletePublicKeyEntry := rdl.NewResourceBuilder("PublicKeyEntry", "DELETE", "/domain/{domain}/service/{service}/publickey/{id}") + rDeletePublicKeyEntry.Comment("Remove the specified public key from the service. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeletePublicKeyEntry.Input("domain", "DomainName", true, "", "", false, nil, "name of the domain") + rDeletePublicKeyEntry.Input("service", "SimpleName", true, "", "", false, nil, "name of the service") + rDeletePublicKeyEntry.Input("id", "String", true, "", "", false, nil, "the identifier of the public key to be deleted") + rDeletePublicKeyEntry.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeletePublicKeyEntry.Auth("update", "{domain}:service.{service}", false, "") + rDeletePublicKeyEntry.Expected("NO_CONTENT") + rDeletePublicKeyEntry.Exception("BAD_REQUEST", "ResourceError", "") + rDeletePublicKeyEntry.Exception("CONFLICT", "ResourceError", "") + rDeletePublicKeyEntry.Exception("FORBIDDEN", "ResourceError", "") + rDeletePublicKeyEntry.Exception("NOT_FOUND", "ResourceError", "") + rDeletePublicKeyEntry.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeletePublicKeyEntry.Build()) + + rPutTenancy := rdl.NewResourceBuilder("Tenancy", "PUT", "/domain/{domain}/tenancy/{service}") + rPutTenancy.Comment("Add a tenant for the specified service.") + rPutTenancy.Input("domain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rPutTenancy.Input("service", "ServiceName", true, "", "", false, nil, "name of the provider service") + rPutTenancy.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutTenancy.Input("detail", "Tenancy", false, "", "", false, nil, "tenancy object") + rPutTenancy.Auth("update", "{domain}:tenancy", false, "") + rPutTenancy.Expected("NO_CONTENT") + rPutTenancy.Exception("BAD_REQUEST", "ResourceError", "") + rPutTenancy.Exception("CONFLICT", "ResourceError", "") + rPutTenancy.Exception("FORBIDDEN", "ResourceError", "") + rPutTenancy.Exception("NOT_FOUND", "ResourceError", "") + rPutTenancy.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutTenancy.Build()) + + rGetTenancy := rdl.NewResourceBuilder("Tenancy", "GET", "/domain/{domain}/tenancy/{service}") + rGetTenancy.Comment("Retrieve the specified tenant.") + rGetTenancy.Input("domain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rGetTenancy.Input("service", "ServiceName", true, "", "", false, nil, "name of the provider service") + rGetTenancy.Auth("", "", true, "") + rGetTenancy.Exception("BAD_REQUEST", "ResourceError", "") + rGetTenancy.Exception("FORBIDDEN", "ResourceError", "") + rGetTenancy.Exception("NOT_FOUND", "ResourceError", "") + rGetTenancy.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetTenancy.Build()) + + rDeleteTenancy := rdl.NewResourceBuilder("Tenancy", "DELETE", "/domain/{domain}/tenancy/{service}") + rDeleteTenancy.Comment("Delete the tenant from the specified service. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteTenancy.Input("domain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rDeleteTenancy.Input("service", "ServiceName", true, "", "", false, nil, "name of the provider service") + rDeleteTenancy.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteTenancy.Auth("delete", "{domain}:tenancy", false, "") + rDeleteTenancy.Expected("NO_CONTENT") + rDeleteTenancy.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteTenancy.Exception("CONFLICT", "ResourceError", "") + rDeleteTenancy.Exception("FORBIDDEN", "ResourceError", "") + rDeleteTenancy.Exception("NOT_FOUND", "ResourceError", "") + rDeleteTenancy.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteTenancy.Build()) + + rPutTenancyResourceGroup := rdl.NewResourceBuilder("TenancyResourceGroup", "PUT", "/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + rPutTenancyResourceGroup.Comment("Add a new resource group for the tenant for the specified service.") + rPutTenancyResourceGroup.Input("domain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rPutTenancyResourceGroup.Input("service", "ServiceName", true, "", "", false, nil, "name of the provider service") + rPutTenancyResourceGroup.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rPutTenancyResourceGroup.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutTenancyResourceGroup.Input("detail", "TenancyResourceGroup", false, "", "", false, nil, "tenancy resource group object") + rPutTenancyResourceGroup.Auth("update", "{domain}:tenancy.{service}", false, "") + rPutTenancyResourceGroup.Expected("NO_CONTENT") + rPutTenancyResourceGroup.Exception("BAD_REQUEST", "ResourceError", "") + rPutTenancyResourceGroup.Exception("CONFLICT", "ResourceError", "") + rPutTenancyResourceGroup.Exception("FORBIDDEN", "ResourceError", "") + rPutTenancyResourceGroup.Exception("NOT_FOUND", "ResourceError", "") + rPutTenancyResourceGroup.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutTenancyResourceGroup.Build()) + + rDeleteTenancyResourceGroup := rdl.NewResourceBuilder("TenancyResourceGroup", "DELETE", "/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + rDeleteTenancyResourceGroup.Comment("Delete the specified resource group for tenant from the specified service.") + rDeleteTenancyResourceGroup.Input("domain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rDeleteTenancyResourceGroup.Input("service", "ServiceName", true, "", "", false, nil, "name of the provider service") + rDeleteTenancyResourceGroup.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rDeleteTenancyResourceGroup.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteTenancyResourceGroup.Auth("update", "{domain}:tenancy.{service}", false, "") + rDeleteTenancyResourceGroup.Expected("NO_CONTENT") + rDeleteTenancyResourceGroup.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteTenancyResourceGroup.Exception("CONFLICT", "ResourceError", "") + rDeleteTenancyResourceGroup.Exception("FORBIDDEN", "ResourceError", "") + rDeleteTenancyResourceGroup.Exception("NOT_FOUND", "ResourceError", "") + rDeleteTenancyResourceGroup.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteTenancyResourceGroup.Build()) + + rPutTenantRoles := rdl.NewResourceBuilder("TenantRoles", "PUT", "/domain/{domain}/service/{service}/tenant/{tenantDomain}") + rPutTenantRoles.Comment("Create/update set of roles for a given tenant.") + rPutTenantRoles.Input("domain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rPutTenantRoles.Input("service", "SimpleName", true, "", "", false, nil, "name of the provider service") + rPutTenantRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rPutTenantRoles.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutTenantRoles.Input("detail", "TenantRoles", false, "", "", false, nil, "list of roles to be added/updated for the tenant") + rPutTenantRoles.Auth("update", "{domain}:tenant.{tenantDomain}", false, "") + rPutTenantRoles.Exception("BAD_REQUEST", "ResourceError", "") + rPutTenantRoles.Exception("CONFLICT", "ResourceError", "") + rPutTenantRoles.Exception("FORBIDDEN", "ResourceError", "") + rPutTenantRoles.Exception("NOT_FOUND", "ResourceError", "") + rPutTenantRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutTenantRoles.Build()) + + rGetTenantRoles := rdl.NewResourceBuilder("TenantRoles", "GET", "/domain/{domain}/service/{service}/tenant/{tenantDomain}") + rGetTenantRoles.Comment("Retrieve the configured set of roles for the tenant.") + rGetTenantRoles.Input("domain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rGetTenantRoles.Input("service", "SimpleName", true, "", "", false, nil, "name of the provider service") + rGetTenantRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rGetTenantRoles.Auth("", "", true, "") + rGetTenantRoles.Exception("BAD_REQUEST", "ResourceError", "") + rGetTenantRoles.Exception("FORBIDDEN", "ResourceError", "") + rGetTenantRoles.Exception("NOT_FOUND", "ResourceError", "") + rGetTenantRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetTenantRoles.Build()) + + rDeleteTenantRoles := rdl.NewResourceBuilder("TenantRoles", "DELETE", "/domain/{domain}/service/{service}/tenant/{tenantDomain}") + rDeleteTenantRoles.Comment("Delete the configured set of roles for the tenant. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + rDeleteTenantRoles.Input("domain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rDeleteTenantRoles.Input("service", "SimpleName", true, "", "", false, nil, "name of the provider service") + rDeleteTenantRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rDeleteTenantRoles.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteTenantRoles.Auth("delete", "{domain}:tenant.{tenantDomain}", false, "") + rDeleteTenantRoles.Expected("NO_CONTENT") + rDeleteTenantRoles.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteTenantRoles.Exception("CONFLICT", "ResourceError", "") + rDeleteTenantRoles.Exception("FORBIDDEN", "ResourceError", "") + rDeleteTenantRoles.Exception("NOT_FOUND", "ResourceError", "") + rDeleteTenantRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteTenantRoles.Build()) + + rPutTenantResourceGroupRoles := rdl.NewResourceBuilder("TenantResourceGroupRoles", "PUT", "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + rPutTenantResourceGroupRoles.Comment("Create/update set of roles for a given tenant and resource group") + rPutTenantResourceGroupRoles.Input("domain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rPutTenantResourceGroupRoles.Input("service", "SimpleName", true, "", "", false, nil, "name of the provider service") + rPutTenantResourceGroupRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rPutTenantResourceGroupRoles.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rPutTenantResourceGroupRoles.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutTenantResourceGroupRoles.Input("detail", "TenantResourceGroupRoles", false, "", "", false, nil, "list of roles to be added/updated for the tenant") + rPutTenantResourceGroupRoles.Auth("update", "{domain}:tenant.{tenantDomain}", false, "") + rPutTenantResourceGroupRoles.Exception("BAD_REQUEST", "ResourceError", "") + rPutTenantResourceGroupRoles.Exception("CONFLICT", "ResourceError", "") + rPutTenantResourceGroupRoles.Exception("FORBIDDEN", "ResourceError", "") + rPutTenantResourceGroupRoles.Exception("NOT_FOUND", "ResourceError", "") + rPutTenantResourceGroupRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutTenantResourceGroupRoles.Build()) + + rGetTenantResourceGroupRoles := rdl.NewResourceBuilder("TenantResourceGroupRoles", "GET", "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + rGetTenantResourceGroupRoles.Comment("Retrieve the configured set of roles for the tenant and resource group") + rGetTenantResourceGroupRoles.Input("domain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rGetTenantResourceGroupRoles.Input("service", "SimpleName", true, "", "", false, nil, "name of the provider service") + rGetTenantResourceGroupRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rGetTenantResourceGroupRoles.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rGetTenantResourceGroupRoles.Auth("", "", true, "") + rGetTenantResourceGroupRoles.Exception("BAD_REQUEST", "ResourceError", "") + rGetTenantResourceGroupRoles.Exception("FORBIDDEN", "ResourceError", "") + rGetTenantResourceGroupRoles.Exception("NOT_FOUND", "ResourceError", "") + rGetTenantResourceGroupRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetTenantResourceGroupRoles.Build()) + + rDeleteTenantResourceGroupRoles := rdl.NewResourceBuilder("TenantResourceGroupRoles", "DELETE", "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + rDeleteTenantResourceGroupRoles.Comment("Delete the configured set of roles for the tenant and resource group") + rDeleteTenantResourceGroupRoles.Input("domain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rDeleteTenantResourceGroupRoles.Input("service", "SimpleName", true, "", "", false, nil, "name of the provider service") + rDeleteTenantResourceGroupRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rDeleteTenantResourceGroupRoles.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rDeleteTenantResourceGroupRoles.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteTenantResourceGroupRoles.Auth("update", "{domain}:tenant.{tenantDomain}", false, "") + rDeleteTenantResourceGroupRoles.Expected("NO_CONTENT") + rDeleteTenantResourceGroupRoles.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteTenantResourceGroupRoles.Exception("CONFLICT", "ResourceError", "") + rDeleteTenantResourceGroupRoles.Exception("FORBIDDEN", "ResourceError", "") + rDeleteTenantResourceGroupRoles.Exception("NOT_FOUND", "ResourceError", "") + rDeleteTenantResourceGroupRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteTenantResourceGroupRoles.Build()) + + rPutProviderResourceGroupRoles := rdl.NewResourceBuilder("ProviderResourceGroupRoles", "PUT", "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + rPutProviderResourceGroupRoles.Comment("Create/update set of roles for a given provider and resource group") + rPutProviderResourceGroupRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rPutProviderResourceGroupRoles.Input("provDomain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rPutProviderResourceGroupRoles.Input("provService", "SimpleName", true, "", "", false, nil, "name of the provider service") + rPutProviderResourceGroupRoles.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rPutProviderResourceGroupRoles.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rPutProviderResourceGroupRoles.Input("detail", "ProviderResourceGroupRoles", false, "", "", false, nil, "list of roles to be added/updated for the provider") + rPutProviderResourceGroupRoles.Auth("update", "{tenantDomain}:tenancy.{provDomain}.{provService}", false, "") + rPutProviderResourceGroupRoles.Exception("BAD_REQUEST", "ResourceError", "") + rPutProviderResourceGroupRoles.Exception("CONFLICT", "ResourceError", "") + rPutProviderResourceGroupRoles.Exception("FORBIDDEN", "ResourceError", "") + rPutProviderResourceGroupRoles.Exception("NOT_FOUND", "ResourceError", "") + rPutProviderResourceGroupRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPutProviderResourceGroupRoles.Build()) + + rGetProviderResourceGroupRoles := rdl.NewResourceBuilder("ProviderResourceGroupRoles", "GET", "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + rGetProviderResourceGroupRoles.Comment("Retrieve the configured set of roles for the provider and resource group") + rGetProviderResourceGroupRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rGetProviderResourceGroupRoles.Input("provDomain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rGetProviderResourceGroupRoles.Input("provService", "SimpleName", true, "", "", false, nil, "name of the provider service") + rGetProviderResourceGroupRoles.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rGetProviderResourceGroupRoles.Auth("", "", true, "") + rGetProviderResourceGroupRoles.Exception("BAD_REQUEST", "ResourceError", "") + rGetProviderResourceGroupRoles.Exception("FORBIDDEN", "ResourceError", "") + rGetProviderResourceGroupRoles.Exception("NOT_FOUND", "ResourceError", "") + rGetProviderResourceGroupRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetProviderResourceGroupRoles.Build()) + + rDeleteProviderResourceGroupRoles := rdl.NewResourceBuilder("ProviderResourceGroupRoles", "DELETE", "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + rDeleteProviderResourceGroupRoles.Comment("Delete the configured set of roles for the provider and resource group") + rDeleteProviderResourceGroupRoles.Input("tenantDomain", "DomainName", true, "", "", false, nil, "name of the tenant domain") + rDeleteProviderResourceGroupRoles.Input("provDomain", "DomainName", true, "", "", false, nil, "name of the provider domain") + rDeleteProviderResourceGroupRoles.Input("provService", "SimpleName", true, "", "", false, nil, "name of the provider service") + rDeleteProviderResourceGroupRoles.Input("resourceGroup", "EntityName", true, "", "", false, nil, "tenant resource group") + rDeleteProviderResourceGroupRoles.Input("auditRef", "String", false, "", "Y-Audit-Ref", false, nil, "Audit param required(not empty) if domain auditEnabled is true.") + rDeleteProviderResourceGroupRoles.Auth("update", "{tenantDomain}:tenancy.{provDomain}.{provService}", false, "") + rDeleteProviderResourceGroupRoles.Expected("NO_CONTENT") + rDeleteProviderResourceGroupRoles.Exception("BAD_REQUEST", "ResourceError", "") + rDeleteProviderResourceGroupRoles.Exception("CONFLICT", "ResourceError", "") + rDeleteProviderResourceGroupRoles.Exception("FORBIDDEN", "ResourceError", "") + rDeleteProviderResourceGroupRoles.Exception("NOT_FOUND", "ResourceError", "") + rDeleteProviderResourceGroupRoles.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rDeleteProviderResourceGroupRoles.Build()) + + rGetAccess := rdl.NewResourceBuilder("Access", "GET", "/access/{action}/{resource}") + rGetAccess.Comment("Check access for the specified operation on the specified resource for the currently authenticated user. This is the slow centralized access for control-plane purposes. Use distributed mechanisms for decentralized (data-plane) access by fetching signed policies and role tokens for users.") + rGetAccess.Input("action", "ActionName", true, "", "", false, nil, "action as specified in the policy assertion, i.e. update or read") + rGetAccess.Input("resource", "YRN", true, "", "", false, nil, "the resource to check access against, i.e. \"media.news:articles\"") + rGetAccess.Input("domain", "DomainName", false, "domain", "", true, nil, "usually null. If present, it specifies an alternate domain for cross-domain trust relation") + rGetAccess.Input("checkPrincipal", "EntityName", false, "principal", "", true, nil, "usually null. If present, carry out the access check for this principal") + rGetAccess.Auth("", "", true, "") + rGetAccess.Exception("BAD_REQUEST", "ResourceError", "") + rGetAccess.Exception("FORBIDDEN", "ResourceError", "") + rGetAccess.Exception("NOT_FOUND", "ResourceError", "") + rGetAccess.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetAccess.Build()) + + rGetAccessExt := rdl.NewResourceBuilder("Access", "GET", "/access/{action}") + rGetAccessExt.Name("GetAccessExt") + rGetAccessExt.Input("action", "ActionName", true, "", "", false, nil, "action as specified in the policy assertion, i.e. update or read") + rGetAccessExt.Input("resource", "String", false, "resource", "", false, nil, "the resource to check access against, i.e. \"media.news:articles\"") + rGetAccessExt.Input("domain", "DomainName", false, "domain", "", true, nil, "usually null. If present, it specifies an alternate domain for cross-domain trust relation") + rGetAccessExt.Input("checkPrincipal", "EntityName", false, "principal", "", true, nil, "usually null. If present, carry out the access check for this principal") + rGetAccessExt.Auth("", "", true, "") + rGetAccessExt.Exception("BAD_REQUEST", "ResourceError", "") + rGetAccessExt.Exception("FORBIDDEN", "ResourceError", "") + rGetAccessExt.Exception("NOT_FOUND", "ResourceError", "") + rGetAccessExt.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetAccessExt.Build()) + + rGetResourceAccessList := rdl.NewResourceBuilder("ResourceAccessList", "GET", "/resource") + rGetResourceAccessList.Comment("Return list of resources that the given principal has access to. Even though the principal is marked as optional, it must be specified unless the caller has authorization from sys.auth domain to check access for all user principals. (action: access, resource: resource-lookup-all)") + rGetResourceAccessList.Input("principal", "EntityName", false, "principal", "", true, nil, "specifies principal to query the resource list for") + rGetResourceAccessList.Input("action", "ActionName", false, "action", "", true, nil, "action as specified in the policy assertion") + rGetResourceAccessList.Auth("", "", true, "") + rGetResourceAccessList.Exception("BAD_REQUEST", "ResourceError", "") + rGetResourceAccessList.Exception("FORBIDDEN", "ResourceError", "") + rGetResourceAccessList.Exception("NOT_FOUND", "ResourceError", "") + rGetResourceAccessList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetResourceAccessList.Build()) + + rGetSignedDomains := rdl.NewResourceBuilder("SignedDomains", "GET", "/sys/modified_domains") + rGetSignedDomains.Comment("Retrieve the list of modified domains since the specified timestamp. The server will return the list of all modified domains and the latest modification timestamp as the value of the ETag header. The client will need to use this value during its next call to request the changes since the previous request. When metaonly set to true, dont add roles, policies or services, dont sign") + rGetSignedDomains.Input("domain", "DomainName", false, "domain", "", true, nil, "filter the domain list only to the specified name") + rGetSignedDomains.Input("metaOnly", "String", false, "metaonly", "", true, nil, "valid values are \"true\" or \"false\"") + rGetSignedDomains.Input("matchingTag", "String", false, "", "If-None-Match", false, nil, "Retrieved from the previous request, this timestamp specifies to the server to return any domains modified since this time") + rGetSignedDomains.Output("tag", "String", "ETag", false, "") + rGetSignedDomains.Auth("", "", true, "") + rGetSignedDomains.Exception("FORBIDDEN", "ResourceError", "") + rGetSignedDomains.Exception("NOT_FOUND", "ResourceError", "") + rGetSignedDomains.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetSignedDomains.Build()) + + rGetUserToken := rdl.NewResourceBuilder("UserToken", "GET", "/user/{userName}/token") + rGetUserToken.Comment("Return a user/principal token for the specified authenticated user. Typical authenticated users with their native credentials are not allowed to update their domain data. They must first obtain a UserToken and then use that token for authentication and authorization of their update requests.") + rGetUserToken.Input("userName", "SimpleName", true, "", "", false, nil, "name of the user") + rGetUserToken.Input("serviceNames", "String", false, "services", "", true, nil, "comma separated list of on-behalf-of service names") + rGetUserToken.Auth("", "", true, "") + rGetUserToken.Exception("FORBIDDEN", "ResourceError", "") + rGetUserToken.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetUserToken.Build()) + + rOptionsUserToken := rdl.NewResourceBuilder("UserToken", "OPTIONS", "/user/{userName}/token") + rOptionsUserToken.Comment("CORS (Cross-Origin Resource Sharing) support to allow Provider Services to obtain AuthorizedService Tokens on behalf of Tenant administrators") + rOptionsUserToken.Input("userName", "SimpleName", true, "", "", false, nil, "name of the user") + rOptionsUserToken.Input("serviceNames", "String", false, "services", "", true, nil, "comma separated list of on-behalf-of service names") + rOptionsUserToken.Exception("BAD_REQUEST", "ResourceError", "") + sb.AddResource(rOptionsUserToken.Build()) + + rGetServicePrincipal := rdl.NewResourceBuilder("ServicePrincipal", "GET", "/principal") + rGetServicePrincipal.Comment("Return a ServicePrincipal object if the serviceToken is valid. This request provides a simple operation that an external application can execute to validate a service token.") + rGetServicePrincipal.Auth("", "", true, "") + rGetServicePrincipal.Exception("BAD_REQUEST", "ResourceError", "") + rGetServicePrincipal.Exception("FORBIDDEN", "ResourceError", "") + rGetServicePrincipal.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetServicePrincipal.Build()) + + rGetServerTemplateList := rdl.NewResourceBuilder("ServerTemplateList", "GET", "/template") + rGetServerTemplateList.Comment("Get the list of solution templates defined in the server") + rGetServerTemplateList.Auth("", "", true, "") + rGetServerTemplateList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetServerTemplateList.Build()) + + rGetTemplate := rdl.NewResourceBuilder("Template", "GET", "/template/{template}") + rGetTemplate.Comment("Get solution template details. Includes the roles and policies that will be automatically provisioned when the template is applied to a domain") + rGetTemplate.Input("template", "SimpleName", true, "", "", false, nil, "name of the solution template") + rGetTemplate.Auth("", "", true, "") + rGetTemplate.Exception("BAD_REQUEST", "ResourceError", "") + rGetTemplate.Exception("NOT_FOUND", "ResourceError", "") + rGetTemplate.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetTemplate.Build()) + + schema = sb.Build() +} + +func ZMSSchema() *rdl.Schema { + return schema +} diff --git a/clients/go/zts/Makefile b/clients/go/zts/Makefile new file mode 100644 index 00000000000..c3a2e703703 --- /dev/null +++ b/clients/go/zts/Makefile @@ -0,0 +1,20 @@ +RDL_FILE=../../../core/zts/src/main/rdl/ZTS.rdl +RDL_LIB=github.com/ardielle/ardielle-go/rdl + +export GOPATH=$(PWD) + +all: model.go client.go build + +build: src/$(RDL_LIB) + +src/$(RDL_LIB): + go get $(RDL_LIB) + +model.go: $(RDL_FILE) + rdl -ps generate -t -o $@ go-model $(RDL_FILE) + +client.go: $(RDL_FILE) + rdl -ps generate -t -o $@ go-client $(RDL_FILE) + +clean:: + rm -rf model.go client.go zts_schema.go *~ ./src diff --git a/clients/go/zts/README.md b/clients/go/zts/README.md new file mode 100644 index 00000000000..d55f6c12f2d --- /dev/null +++ b/clients/go/zts/README.md @@ -0,0 +1,36 @@ +# zts-go-client + +A Go client library to talk to Athenz ZTS. + +The model.go and client.go files are generated from zts_core, and checked in so users of this library need not know that. + +Release Notes: +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Version 1.0 (2016-09-06) + - Initial opensource release + +## Usage + +To get it into your workspace: + + go get github.com/yahoo/athenz/clients/go/zts + +Then in your Go code: + + import ( + zts "github.com/yahoo/athenz/clients/go/zts" + ) + func main() { + var principal rdl.Principal /* NToken */ + ... + client := zts.NewClient() + client.AddCredentials(principal.GetHTTPHeaderName(), principal.GetCredentials()) + svc, err := client.GetServiceIdentity("athenz", "storage") + ... + } + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/clients/go/zts/client.go b/clients/go/zts/client.go new file mode 100644 index 00000000000..c00142a6a68 --- /dev/null +++ b/clients/go/zts/client.go @@ -0,0 +1,755 @@ +// +// This file generated by rdl 1.4.8 +// + +package zts + +import ( + "bytes" + "encoding/json" + "fmt" + rdl "github.com/ardielle/ardielle-go/rdl" + "io" + "io/ioutil" + "net/http" + "net/url" + "strconv" + "strings" + "time" +) + +var _ = json.Marshal +var _ = fmt.Printf +var _ = rdl.BaseTypeAny +var _ = ioutil.NopCloser + +type ZTSClient struct { + URL string + Transport http.RoundTripper + CredsHeader *string + CredsToken *string + Timeout time.Duration +} + +// NewClient creates and returns a new HTTP client object for the ZTS service +func NewClient(url string, transport http.RoundTripper) ZTSClient { + return ZTSClient{url, transport, nil, nil, 0} +} + +// AddCredentials adds the credentials to the client for subsequent requests. +func (client *ZTSClient) AddCredentials(header string, token string) { + client.CredsHeader = &header + client.CredsToken = &token +} + +func (client ZTSClient) getClient() *http.Client { + var c *http.Client + if client.Transport != nil { + c = &http.Client{Transport: client.Transport} + } else { + c = &http.Client{} + } + if client.Timeout > 0 { + c.Timeout = client.Timeout + } + return c +} + +func (client ZTSClient) addAuthHeader(req *http.Request) { + if client.CredsHeader != nil && client.CredsToken != nil { + if strings.HasPrefix(*client.CredsHeader, "Cookie.") { + req.Header.Add("Cookie", (*client.CredsHeader)[7:]+"="+*client.CredsToken) + } else { + req.Header.Add(*client.CredsHeader, *client.CredsToken) + } + } +} + +func (client ZTSClient) httpGet(url string, headers map[string]string) (*http.Response, error) { + hclient := client.getClient() + req, err := http.NewRequest("GET", url, nil) + if err != nil { + return nil, err + } + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZTSClient) httpDelete(url string, headers map[string]string) (*http.Response, error) { + hclient := client.getClient() + req, err := http.NewRequest("DELETE", url, nil) + if err != nil { + return nil, err + } + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZTSClient) httpPut(url string, headers map[string]string, body []byte) (*http.Response, error) { + contentReader := bytes.NewReader(body) + hclient := client.getClient() + req, err := http.NewRequest("PUT", url, contentReader) + if err != nil { + return nil, err + } + req.Header.Add("Content-type", "application/json") + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZTSClient) httpPost(url string, headers map[string]string, body []byte) (*http.Response, error) { + contentReader := bytes.NewReader(body) + hclient := client.getClient() + req, err := http.NewRequest("POST", url, contentReader) + if err != nil { + return nil, err + } + req.Header.Add("Content-type", "application/json") + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZTSClient) httpPatch(url string, headers map[string]string, body []byte) (*http.Response, error) { + contentReader := bytes.NewReader(body) + hclient := client.getClient() + req, err := http.NewRequest("PATCH", url, contentReader) + if err != nil { + return nil, err + } + req.Header.Add("Content-type", "application/json") + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func (client ZTSClient) httpOptions(url string, headers map[string]string, body []byte) (*http.Response, error) { + var contentReader io.Reader = nil + if body != nil { + contentReader = bytes.NewReader(body) + } + hclient := client.getClient() + req, err := http.NewRequest("OPTIONS", url, contentReader) + if err != nil { + return nil, err + } + if contentReader != nil { + req.Header.Add("Content-type", "application/json") + } + client.addAuthHeader(req) + if headers != nil { + for k, v := range headers { + req.Header.Add(k, v) + } + } + return hclient.Do(req) +} + +func encodeStringParam(name string, val string, def string) string { + if val == def { + return "" + } + return "&" + name + "=" + url.QueryEscape(val) +} +func encodeBoolParam(name string, b bool, def bool) string { + if b == def { + return "" + } + return fmt.Sprintf("&%s=%v", name, b) +} +func encodeInt8Param(name string, i int8, def int8) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(i)) +} +func encodeInt16Param(name string, i int16, def int16) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(i)) +} +func encodeInt32Param(name string, i int32, def int32) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(i)) +} +func encodeInt64Param(name string, i int64, def int64) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.FormatInt(i, 10) +} +func encodeFloat32Param(name string, i float32, def float32) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.FormatFloat(float64(i), 'g', -1, 32) +} +func encodeFloat64Param(name string, i float64, def float64) string { + if i == def { + return "" + } + return "&" + name + "=" + strconv.FormatFloat(i, 'g', -1, 64) +} +func encodeOptionalEnumParam(name string, e interface{}) string { + if e == nil { + return "\"\"" + } + return fmt.Sprintf("&%s=%v", name, e) +} +func encodeOptionalBoolParam(name string, b *bool) string { + if b == nil { + return "" + } + return fmt.Sprintf("&%s=%v", name, *b) +} +func encodeOptionalInt32Param(name string, i *int32) string { + if i == nil { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(*i)) +} +func encodeOptionalInt64Param(name string, i *int64) string { + if i == nil { + return "" + } + return "&" + name + "=" + strconv.Itoa(int(*i)) +} +func encodeParams(objs ...string) string { + s := strings.Join(objs, "") + if s == "" { + return s + } + return "?" + s[1:] +} + +func (client ZTSClient) GetServiceIdentity(domainName DomainName, serviceName ServiceName) (*ServiceIdentity, error) { + var data *ServiceIdentity + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/service/" + fmt.Sprint(serviceName) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetServiceIdentityList(domainName DomainName) (*ServiceIdentityList, error) { + var data *ServiceIdentityList + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/service" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetPublicKeyEntry(domainName DomainName, serviceName SimpleName, keyId string) (*PublicKeyEntry, error) { + var data *PublicKeyEntry + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/service/" + fmt.Sprint(serviceName) + "/publickey/" + keyId + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetHostServices(host string) (*HostServices, error) { + var data *HostServices + url := client.URL + "/host/" + host + "/services" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetDomainSignedPolicyData(domainName DomainName, matchingTag string) (*DomainSignedPolicyData, string, error) { + var data *DomainSignedPolicyData + headers := map[string]string{ + "If-None-Match": matchingTag, + } + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/signed_policy_data" + resp, err := client.httpGet(url, headers) + if err != nil { + return nil, "", err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return nil, "", err + } + switch resp.StatusCode { + case 200, 304: + if 304 != resp.StatusCode { + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return nil, "", err + } + } + tag := resp.Header.Get(rdl.FoldHttpHeaderName("ETag")) + return data, tag, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return nil, "", errobj + } +} + +func (client ZTSClient) GetRoleToken(domainName DomainName, role EntityName, minExpiryTime *int32, maxExpiryTime *int32, proxyForPrincipal EntityName) (*RoleToken, error) { + var data *RoleToken + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/token" + encodeParams(encodeStringParam("role", string(role), ""), encodeOptionalInt32Param("minExpiryTime", minExpiryTime), encodeOptionalInt32Param("maxExpiryTime", maxExpiryTime), encodeStringParam("proxyForPrincipal", string(proxyForPrincipal), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetAccess(domainName DomainName, roleName EntityName, principal EntityName) (*Access, error) { + var data *Access + url := client.URL + "/access/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(roleName) + "/principal/" + fmt.Sprint(principal) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetRoleAccess(domainName DomainName, principal EntityName) (*RoleAccess, error) { + var data *RoleAccess + url := client.URL + "/access/domain/" + fmt.Sprint(domainName) + "/principal/" + fmt.Sprint(principal) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetTenantDomains(providerDomainName DomainName, userName EntityName, roleName EntityName, serviceName ServiceName) (*TenantDomains, error) { + var data *TenantDomains + url := client.URL + "/providerdomain/" + fmt.Sprint(providerDomainName) + "/user/" + fmt.Sprint(userName) + encodeParams(encodeStringParam("roleName", string(roleName), ""), encodeStringParam("serviceName", string(serviceName), "")) + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) PostInstanceInformation(info *InstanceInformation) (*Identity, error) { + var data *Identity + url := client.URL + "/instance" + contentBytes, err := json.Marshal(info) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, nil, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) PostInstanceRefreshRequest(domain CompoundName, service SimpleName, req *InstanceRefreshRequest) (*Identity, error) { + var data *Identity + url := client.URL + "/instance/" + fmt.Sprint(domain) + "/" + fmt.Sprint(service) + "/refresh" + contentBytes, err := json.Marshal(req) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, nil, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) PostAWSInstanceInformation(info *AWSInstanceInformation) (*Identity, error) { + var data *Identity + url := client.URL + "/aws/instance" + contentBytes, err := json.Marshal(info) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, nil, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) PostAWSCertificateRequest(domain CompoundName, service SimpleName, req *AWSCertificateRequest) (*Identity, error) { + var data *Identity + url := client.URL + "/aws/instance/" + fmt.Sprint(domain) + "/" + fmt.Sprint(service) + "/refresh" + contentBytes, err := json.Marshal(req) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, nil, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) GetAWSTemporaryCredentials(domainName DomainName, role CompoundName) (*AWSTemporaryCredentials, error) { + var data *AWSTemporaryCredentials + url := client.URL + "/domain/" + fmt.Sprint(domainName) + "/role/" + fmt.Sprint(role) + "/creds" + resp, err := client.httpGet(url, nil) + if err != nil { + return data, err + } + contentBytes, err := ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} + +func (client ZTSClient) PostDomainMetrics(domainName DomainName, req *DomainMetrics) (*DomainMetrics, error) { + var data *DomainMetrics + url := client.URL + "/metrics/" + fmt.Sprint(domainName) + contentBytes, err := json.Marshal(req) + if err != nil { + return data, err + } + resp, err := client.httpPost(url, nil, contentBytes) + if err != nil { + return data, err + } + contentBytes, err = ioutil.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + return data, err + } + switch resp.StatusCode { + case 200: + err = json.Unmarshal(contentBytes, &data) + if err != nil { + return data, err + } + return data, nil + default: + var errobj rdl.ResourceError + json.Unmarshal(contentBytes, &errobj) + if errobj.Code == 0 { + errobj.Code = resp.StatusCode + } + if errobj.Message == "" { + errobj.Message = string(contentBytes) + } + return data, errobj + } +} diff --git a/clients/go/zts/model.go b/clients/go/zts/model.go new file mode 100644 index 00000000000..efd20bca288 --- /dev/null +++ b/clients/go/zts/model.go @@ -0,0 +1,1966 @@ +// +// This file generated by rdl 1.4.8 +// + +package zts + +import ( + "encoding/json" + "fmt" + rdl "github.com/ardielle/ardielle-go/rdl" +) + +var _ = rdl.Version +var _ = json.Marshal +var _ = fmt.Printf + +// +// SimpleName - Copyright 2016 Yahoo Inc. Licensed under the terms of the +// Apache version 2.0 license. See LICENSE file for terms. Common name types +// used by several API definitions A simple identifier, an element of compound +// name. +// +type SimpleName string + +// +// CompoundName - A compound name. Most names in this API are compound names. +// +type CompoundName string + +// +// DomainName - A domain name is the general qualifier prefix, as its +// uniqueness is managed. +// +type DomainName string + +// +// EntityName - An entity name is a short form of a resource name, including +// only the domain and entity. +// +type EntityName string + +// +// ServiceName - A service name will generally be a unique subdomain. +// +type ServiceName string + +// +// LocationName - A location name is not yet defined, but will be a dotted name +// like everything else. +// +type LocationName string + +// +// ActionName - An action (operation) name. +// +type ActionName string + +// +// ResourceName - A shorthand for a YRN with no service or location. The 'tail' +// of a YRN, just the domain:entity. Note that the EntityName part is optional, +// that is, a domain name followed by a colon is valid resource name. +// +type ResourceName string + +// +// YRN - A full Yahoo Resource name (YRN). +// +type YRN string + +// +// YBase64 - The Y-specific URL-safe Base64 variant. +// +type YBase64 string + +// +// YEncoded - YEncoded includes ybase64 chars, as well as = and %. This can +// represent a user cookie and URL-encoded values. +// +type YEncoded string + +// +// AuthorityName - Used as the prefix in a signed assertion. This uniquely +// identifies a signing authority. +// +type AuthorityName string + +// +// SignedToken - A signed assertion if identity. i.e. the user cookie value. +// This token will only make sense to the authority that generated it, so it is +// beneficial to have something in the value that is cheaply recognized to +// quickly reject if it belongs to another authority. In addition to the +// YEncoded set our token includes ; to separate components and , to separate +// roles +// +type SignedToken string + +// +// PublicKeyEntry - The representation of the public key in a service identity +// object. +// +type PublicKeyEntry struct { + + // + // the public key for the service + // + Key string `json:"key"` + + // + // the key identifier (version or zone name) + // + Id string `json:"id"` +} + +// +// NewPublicKeyEntry - creates an initialized PublicKeyEntry instance, returns a pointer to it +// +func NewPublicKeyEntry(init ...*PublicKeyEntry) *PublicKeyEntry { + var o *PublicKeyEntry + if len(init) == 1 { + o = init[0] + } else { + o = new(PublicKeyEntry) + } + return o +} + +type rawPublicKeyEntry PublicKeyEntry + +// +// UnmarshalJSON is defined for proper JSON decoding of a PublicKeyEntry +// +func (pTypeDef *PublicKeyEntry) UnmarshalJSON(b []byte) error { + var r rawPublicKeyEntry + err := json.Unmarshal(b, &r) + if err == nil { + o := PublicKeyEntry(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *PublicKeyEntry) Validate() error { + if pTypeDef.Key == "" { + return fmt.Errorf("PublicKeyEntry.key is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Key) + if !val.Valid { + return fmt.Errorf("PublicKeyEntry.key does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Id == "" { + return fmt.Errorf("PublicKeyEntry.id is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Id) + if !val.Valid { + return fmt.Errorf("PublicKeyEntry.id does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// ServiceIdentity - The representation of the service identity object. +// +type ServiceIdentity struct { + + // + // the full name of the service, i.e. "sports.storage" + // + Name ServiceName `json:"name"` + + // + // array of public keys for key rotation + // + PublicKeys []*PublicKeyEntry `json:"publicKeys,omitempty" rdl:"optional"` + + // + // if present, then this service can provision tenants via this endpoint. + // + ProviderEndpoint string `json:"providerEndpoint,omitempty" rdl:"optional"` + + // + // the timestamp when this entry was last modified + // + Modified *rdl.Timestamp `json:"modified,omitempty" rdl:"optional"` + + // + // the path of the executable that runs the service + // + Executable string `json:"executable,omitempty" rdl:"optional"` + + // + // list of host names that this service can run on + // + Hosts []string `json:"hosts,omitempty" rdl:"optional"` + + // + // local (unix) user name this service can run as + // + User string `json:"user,omitempty" rdl:"optional"` + + // + // local (unix) group name this service can run as + // + Group string `json:"group,omitempty" rdl:"optional"` +} + +// +// NewServiceIdentity - creates an initialized ServiceIdentity instance, returns a pointer to it +// +func NewServiceIdentity(init ...*ServiceIdentity) *ServiceIdentity { + var o *ServiceIdentity + if len(init) == 1 { + o = init[0] + } else { + o = new(ServiceIdentity) + } + return o +} + +type rawServiceIdentity ServiceIdentity + +// +// UnmarshalJSON is defined for proper JSON decoding of a ServiceIdentity +// +func (pTypeDef *ServiceIdentity) UnmarshalJSON(b []byte) error { + var r rawServiceIdentity + err := json.Unmarshal(b, &r) + if err == nil { + o := ServiceIdentity(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ServiceIdentity) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("ServiceIdentity.name is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "ServiceName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("ServiceIdentity.name does not contain a valid ServiceName (%v)", val.Error) + } + } + return nil +} + +// +// ServiceIdentityList - The representation for an enumeration of services in +// the namespace. +// +type ServiceIdentityList struct { + + // + // list of service names + // + Names []EntityName `json:"names"` +} + +// +// NewServiceIdentityList - creates an initialized ServiceIdentityList instance, returns a pointer to it +// +func NewServiceIdentityList(init ...*ServiceIdentityList) *ServiceIdentityList { + var o *ServiceIdentityList + if len(init) == 1 { + o = init[0] + } else { + o = new(ServiceIdentityList) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *ServiceIdentityList) Init() *ServiceIdentityList { + if pTypeDef.Names == nil { + pTypeDef.Names = make([]EntityName, 0) + } + return pTypeDef +} + +type rawServiceIdentityList ServiceIdentityList + +// +// UnmarshalJSON is defined for proper JSON decoding of a ServiceIdentityList +// +func (pTypeDef *ServiceIdentityList) UnmarshalJSON(b []byte) error { + var r rawServiceIdentityList + err := json.Unmarshal(b, &r) + if err == nil { + o := ServiceIdentityList(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *ServiceIdentityList) Validate() error { + if pTypeDef.Names == nil { + return fmt.Errorf("ServiceIdentityList: Missing required field: names") + } + return nil +} + +// +// HostServices - The representation for an enumeration of services authorized +// to run on a specific host. +// +type HostServices struct { + + // + // name of the host + // + Host string `json:"host"` + + // + // list of service names authorized to run on this host + // + Names []EntityName `json:"names"` +} + +// +// NewHostServices - creates an initialized HostServices instance, returns a pointer to it +// +func NewHostServices(init ...*HostServices) *HostServices { + var o *HostServices + if len(init) == 1 { + o = init[0] + } else { + o = new(HostServices) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *HostServices) Init() *HostServices { + if pTypeDef.Names == nil { + pTypeDef.Names = make([]EntityName, 0) + } + return pTypeDef +} + +type rawHostServices HostServices + +// +// UnmarshalJSON is defined for proper JSON decoding of a HostServices +// +func (pTypeDef *HostServices) UnmarshalJSON(b []byte) error { + var r rawHostServices + err := json.Unmarshal(b, &r) + if err == nil { + o := HostServices(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *HostServices) Validate() error { + if pTypeDef.Host == "" { + return fmt.Errorf("HostServices.host is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Host) + if !val.Valid { + return fmt.Errorf("HostServices.host does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Names == nil { + return fmt.Errorf("HostServices: Missing required field: names") + } + return nil +} + +// +// AssertionEffect - Every assertion can have the effect of ALLOW or DENY. +// +type AssertionEffect int + +// +// AssertionEffect constants +// +const ( + _ AssertionEffect = iota + ALLOW + DENY +) + +var namesAssertionEffect = []string{ + ALLOW: "ALLOW", + DENY: "DENY", +} + +// +// NewAssertionEffect - return a string representation of the enum +// +func NewAssertionEffect(init ...interface{}) AssertionEffect { + if len(init) == 1 { + switch v := init[0].(type) { + case AssertionEffect: + return v + case int: + return AssertionEffect(v) + case int32: + return AssertionEffect(v) + case string: + for i, s := range namesAssertionEffect { + if s == v { + return AssertionEffect(i) + } + } + default: + panic("Bad init value for AssertionEffect enum") + } + } + return AssertionEffect(0) //default to the first enum value +} + +// +// String - return a string representation of the enum +// +func (e AssertionEffect) String() string { + return namesAssertionEffect[e] +} + +// +// SymbolSet - return an array of all valid string representations (symbols) of the enum +// +func (e AssertionEffect) SymbolSet() []string { + return namesAssertionEffect +} + +// +// MarshalJSON is defined for proper JSON encoding of a AssertionEffect +// +func (e AssertionEffect) MarshalJSON() ([]byte, error) { + return json.Marshal(e.String()) +} + +// +// UnmarshalJSON is defined for proper JSON decoding of a AssertionEffect +// +func (e *AssertionEffect) UnmarshalJSON(b []byte) error { + var j string + err := json.Unmarshal(b, &j) + if err == nil { + s := string(j) + for v, s2 := range namesAssertionEffect { + if s == s2 { + *e = AssertionEffect(v) + return nil + } + } + err = fmt.Errorf("Bad enum symbol for type AssertionEffect: %s", s) + } + return err +} + +// +// Assertion - A representation for the encapsulation of an action to be +// performed on a resource by a principal. +// +type Assertion struct { + + // + // the subject of the assertion, a role + // + Role string `json:"role"` + + // + // the object of the assertion. Must be in the local namespace. Can contain + // wildcards + // + Resource string `json:"resource"` + + // + // the predicate of the assertion. Can contain wildcards + // + Action string `json:"action"` + + // + // the effect of the assertion in the policy language + // + Effect *AssertionEffect `json:"effect,omitempty" rdl:"optional"` + + // + // assertion id - auto generated by server + // + Id *int64 `json:"id,omitempty" rdl:"optional"` +} + +// +// NewAssertion - creates an initialized Assertion instance, returns a pointer to it +// +func NewAssertion(init ...*Assertion) *Assertion { + var o *Assertion + if len(init) == 1 { + o = init[0] + } else { + o = new(Assertion) + } + return o +} + +type rawAssertion Assertion + +// +// UnmarshalJSON is defined for proper JSON decoding of a Assertion +// +func (pTypeDef *Assertion) UnmarshalJSON(b []byte) error { + var r rawAssertion + err := json.Unmarshal(b, &r) + if err == nil { + o := Assertion(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Assertion) Validate() error { + if pTypeDef.Role == "" { + return fmt.Errorf("Assertion.role is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Role) + if !val.Valid { + return fmt.Errorf("Assertion.role does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Resource == "" { + return fmt.Errorf("Assertion.resource is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Resource) + if !val.Valid { + return fmt.Errorf("Assertion.resource does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Action == "" { + return fmt.Errorf("Assertion.action is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Action) + if !val.Valid { + return fmt.Errorf("Assertion.action does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// Policy - The representation for a Policy with set of assertions. +// +type Policy struct { + + // + // name of the policy + // + Name ResourceName `json:"name"` + + // + // last modification timestamp of this policy + // + Modified *rdl.Timestamp `json:"modified,omitempty" rdl:"optional"` + + // + // list of defined assertions for this policy + // + Assertions []*Assertion `json:"assertions"` +} + +// +// NewPolicy - creates an initialized Policy instance, returns a pointer to it +// +func NewPolicy(init ...*Policy) *Policy { + var o *Policy + if len(init) == 1 { + o = init[0] + } else { + o = new(Policy) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *Policy) Init() *Policy { + if pTypeDef.Assertions == nil { + pTypeDef.Assertions = make([]*Assertion, 0) + } + return pTypeDef +} + +type rawPolicy Policy + +// +// UnmarshalJSON is defined for proper JSON decoding of a Policy +// +func (pTypeDef *Policy) UnmarshalJSON(b []byte) error { + var r rawPolicy + err := json.Unmarshal(b, &r) + if err == nil { + o := Policy(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Policy) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("Policy.name is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "ResourceName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("Policy.name does not contain a valid ResourceName (%v)", val.Error) + } + } + if pTypeDef.Assertions == nil { + return fmt.Errorf("Policy: Missing required field: assertions") + } + return nil +} + +// +// PolicyData - +// +type PolicyData struct { + + // + // name of the domain + // + Domain DomainName `json:"domain"` + + // + // list of policies defined in this server + // + Policies []*Policy `json:"policies"` +} + +// +// NewPolicyData - creates an initialized PolicyData instance, returns a pointer to it +// +func NewPolicyData(init ...*PolicyData) *PolicyData { + var o *PolicyData + if len(init) == 1 { + o = init[0] + } else { + o = new(PolicyData) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *PolicyData) Init() *PolicyData { + if pTypeDef.Policies == nil { + pTypeDef.Policies = make([]*Policy, 0) + } + return pTypeDef +} + +type rawPolicyData PolicyData + +// +// UnmarshalJSON is defined for proper JSON decoding of a PolicyData +// +func (pTypeDef *PolicyData) UnmarshalJSON(b []byte) error { + var r rawPolicyData + err := json.Unmarshal(b, &r) + if err == nil { + o := PolicyData(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *PolicyData) Validate() error { + if pTypeDef.Domain == "" { + return fmt.Errorf("PolicyData.domain is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "DomainName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("PolicyData.domain does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.Policies == nil { + return fmt.Errorf("PolicyData: Missing required field: policies") + } + return nil +} + +// +// SignedPolicyData - A representation of policies object defined in a given +// server. +// +type SignedPolicyData struct { + + // + // list of policies defined in a domain + // + PolicyData *PolicyData `json:"policyData"` + + // + // zms signature generated based on the domain policies object + // + ZmsSignature string `json:"zmsSignature"` + + // + // the identifier of the zms key used to generate the signature + // + ZmsKeyId string `json:"zmsKeyId"` + + // + // when the domain itself was last modified + // + Modified rdl.Timestamp `json:"modified"` + + // + // timestamp specifying the expiration time for using this set of policies + // + Expires rdl.Timestamp `json:"expires"` +} + +// +// NewSignedPolicyData - creates an initialized SignedPolicyData instance, returns a pointer to it +// +func NewSignedPolicyData(init ...*SignedPolicyData) *SignedPolicyData { + var o *SignedPolicyData + if len(init) == 1 { + o = init[0] + } else { + o = new(SignedPolicyData) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *SignedPolicyData) Init() *SignedPolicyData { + if pTypeDef.PolicyData == nil { + pTypeDef.PolicyData = NewPolicyData() + } + return pTypeDef +} + +type rawSignedPolicyData SignedPolicyData + +// +// UnmarshalJSON is defined for proper JSON decoding of a SignedPolicyData +// +func (pTypeDef *SignedPolicyData) UnmarshalJSON(b []byte) error { + var r rawSignedPolicyData + err := json.Unmarshal(b, &r) + if err == nil { + o := SignedPolicyData(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *SignedPolicyData) Validate() error { + if pTypeDef.PolicyData == nil { + return fmt.Errorf("SignedPolicyData: Missing required field: policyData") + } + if pTypeDef.ZmsSignature == "" { + return fmt.Errorf("SignedPolicyData.zmsSignature is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.ZmsSignature) + if !val.Valid { + return fmt.Errorf("SignedPolicyData.zmsSignature does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.ZmsKeyId == "" { + return fmt.Errorf("SignedPolicyData.zmsKeyId is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.ZmsKeyId) + if !val.Valid { + return fmt.Errorf("SignedPolicyData.zmsKeyId does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Modified.IsZero() { + return fmt.Errorf("SignedPolicyData: Missing required field: modified") + } + if pTypeDef.Expires.IsZero() { + return fmt.Errorf("SignedPolicyData: Missing required field: expires") + } + return nil +} + +// +// DomainSignedPolicyData - A signed bulk transfer of policies. The data is +// signed with server's private key. +// +type DomainSignedPolicyData struct { + + // + // policy data signed by ZMS + // + SignedPolicyData *SignedPolicyData `json:"signedPolicyData"` + + // + // signature generated based on the domain policies object + // + Signature string `json:"signature"` + + // + // the identifier of the key used to generate the signature + // + KeyId string `json:"keyId"` +} + +// +// NewDomainSignedPolicyData - creates an initialized DomainSignedPolicyData instance, returns a pointer to it +// +func NewDomainSignedPolicyData(init ...*DomainSignedPolicyData) *DomainSignedPolicyData { + var o *DomainSignedPolicyData + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainSignedPolicyData) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainSignedPolicyData) Init() *DomainSignedPolicyData { + if pTypeDef.SignedPolicyData == nil { + pTypeDef.SignedPolicyData = NewSignedPolicyData() + } + return pTypeDef +} + +type rawDomainSignedPolicyData DomainSignedPolicyData + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainSignedPolicyData +// +func (pTypeDef *DomainSignedPolicyData) UnmarshalJSON(b []byte) error { + var r rawDomainSignedPolicyData + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainSignedPolicyData(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainSignedPolicyData) Validate() error { + if pTypeDef.SignedPolicyData == nil { + return fmt.Errorf("DomainSignedPolicyData: Missing required field: signedPolicyData") + } + if pTypeDef.Signature == "" { + return fmt.Errorf("DomainSignedPolicyData.signature is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Signature) + if !val.Valid { + return fmt.Errorf("DomainSignedPolicyData.signature does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.KeyId == "" { + return fmt.Errorf("DomainSignedPolicyData.keyId is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.KeyId) + if !val.Valid { + return fmt.Errorf("DomainSignedPolicyData.keyId does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// RoleToken - A representation of a signed RoleToken +// +type RoleToken struct { + Token string `json:"token"` + ExpiryTime int64 `json:"expiryTime"` +} + +// +// NewRoleToken - creates an initialized RoleToken instance, returns a pointer to it +// +func NewRoleToken(init ...*RoleToken) *RoleToken { + var o *RoleToken + if len(init) == 1 { + o = init[0] + } else { + o = new(RoleToken) + } + return o +} + +type rawRoleToken RoleToken + +// +// UnmarshalJSON is defined for proper JSON decoding of a RoleToken +// +func (pTypeDef *RoleToken) UnmarshalJSON(b []byte) error { + var r rawRoleToken + err := json.Unmarshal(b, &r) + if err == nil { + o := RoleToken(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *RoleToken) Validate() error { + if pTypeDef.Token == "" { + return fmt.Errorf("RoleToken.token is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Token) + if !val.Valid { + return fmt.Errorf("RoleToken.token does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// Access - Access can be checked and returned as this resource. +// +type Access struct { + + // + // true (allowed) or false (denied) + // + Granted bool `json:"granted"` +} + +// +// NewAccess - creates an initialized Access instance, returns a pointer to it +// +func NewAccess(init ...*Access) *Access { + var o *Access + if len(init) == 1 { + o = init[0] + } else { + o = new(Access) + } + return o +} + +type rawAccess Access + +// +// UnmarshalJSON is defined for proper JSON decoding of a Access +// +func (pTypeDef *Access) UnmarshalJSON(b []byte) error { + var r rawAccess + err := json.Unmarshal(b, &r) + if err == nil { + o := Access(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Access) Validate() error { + return nil +} + +// +// RoleAccess - +// +type RoleAccess struct { + Roles []EntityName `json:"roles"` +} + +// +// NewRoleAccess - creates an initialized RoleAccess instance, returns a pointer to it +// +func NewRoleAccess(init ...*RoleAccess) *RoleAccess { + var o *RoleAccess + if len(init) == 1 { + o = init[0] + } else { + o = new(RoleAccess) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *RoleAccess) Init() *RoleAccess { + if pTypeDef.Roles == nil { + pTypeDef.Roles = make([]EntityName, 0) + } + return pTypeDef +} + +type rawRoleAccess RoleAccess + +// +// UnmarshalJSON is defined for proper JSON decoding of a RoleAccess +// +func (pTypeDef *RoleAccess) UnmarshalJSON(b []byte) error { + var r rawRoleAccess + err := json.Unmarshal(b, &r) + if err == nil { + o := RoleAccess(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *RoleAccess) Validate() error { + if pTypeDef.Roles == nil { + return fmt.Errorf("RoleAccess: Missing required field: roles") + } + return nil +} + +// +// TenantDomains - +// +type TenantDomains struct { + TenantDomainNames []DomainName `json:"tenantDomainNames"` +} + +// +// NewTenantDomains - creates an initialized TenantDomains instance, returns a pointer to it +// +func NewTenantDomains(init ...*TenantDomains) *TenantDomains { + var o *TenantDomains + if len(init) == 1 { + o = init[0] + } else { + o = new(TenantDomains) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *TenantDomains) Init() *TenantDomains { + if pTypeDef.TenantDomainNames == nil { + pTypeDef.TenantDomainNames = make([]DomainName, 0) + } + return pTypeDef +} + +type rawTenantDomains TenantDomains + +// +// UnmarshalJSON is defined for proper JSON decoding of a TenantDomains +// +func (pTypeDef *TenantDomains) UnmarshalJSON(b []byte) error { + var r rawTenantDomains + err := json.Unmarshal(b, &r) + if err == nil { + o := TenantDomains(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *TenantDomains) Validate() error { + if pTypeDef.TenantDomainNames == nil { + return fmt.Errorf("TenantDomains: Missing required field: tenantDomainNames") + } + return nil +} + +// +// Identity - Identity - a signed assertion of service or human identity, the +// response could be either a client certificate or just a regular NToken +// (depending if the request contained a csr or not). +// +type Identity struct { + + // + // name of the identity, fully qualified, i.e. my.domain.service1, or + // aws.1232321321312.myusername + // + Name CompoundName `json:"name"` + + // + // a certificate usable for both client and server in TLS connections + // + Certificate string `json:"certificate,omitempty" rdl:"optional"` + + // + // the CA certificate chain to use with all IMS-generated certs + // + CaCertBundle string `json:"caCertBundle,omitempty" rdl:"optional"` + + // + // the SSH server cert, signed by the CA + // + SshServerCert string `json:"sshServerCert,omitempty" rdl:"optional"` + + // + // service token instead of TLS certificate + // + ServiceToken SignedToken `json:"serviceToken,omitempty" rdl:"optional"` + + // + // other config-like attributes determined at boot time + // + Attributes map[string]string `json:"attributes,omitempty" rdl:"optional"` +} + +// +// NewIdentity - creates an initialized Identity instance, returns a pointer to it +// +func NewIdentity(init ...*Identity) *Identity { + var o *Identity + if len(init) == 1 { + o = init[0] + } else { + o = new(Identity) + } + return o +} + +type rawIdentity Identity + +// +// UnmarshalJSON is defined for proper JSON decoding of a Identity +// +func (pTypeDef *Identity) UnmarshalJSON(b []byte) error { + var r rawIdentity + err := json.Unmarshal(b, &r) + if err == nil { + o := Identity(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *Identity) Validate() error { + if pTypeDef.Name == "" { + return fmt.Errorf("Identity.name is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "CompoundName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("Identity.name does not contain a valid CompoundName (%v)", val.Error) + } + } + return nil +} + +// +// InstanceInformation - Instance object that includes requested service +// details plus host document that is signed by provider as part of the host +// bootstrap process +// +type InstanceInformation struct { + + // + // signed document containing attributes like IP address, instance-id, + // account#, etc. + // + Document string `json:"document"` + + // + // the signature for the document + // + Signature string `json:"signature"` + + // + // the keyid used to sign the document + // + KeyId string `json:"keyId"` + + // + // the domain of the instance + // + Domain CompoundName `json:"domain"` + + // + // the service this instance is supposed to run + // + Service SimpleName `json:"service"` + + // + // return a certificate in the response + // + Csr string `json:"csr"` +} + +// +// NewInstanceInformation - creates an initialized InstanceInformation instance, returns a pointer to it +// +func NewInstanceInformation(init ...*InstanceInformation) *InstanceInformation { + var o *InstanceInformation + if len(init) == 1 { + o = init[0] + } else { + o = new(InstanceInformation) + } + return o +} + +type rawInstanceInformation InstanceInformation + +// +// UnmarshalJSON is defined for proper JSON decoding of a InstanceInformation +// +func (pTypeDef *InstanceInformation) UnmarshalJSON(b []byte) error { + var r rawInstanceInformation + err := json.Unmarshal(b, &r) + if err == nil { + o := InstanceInformation(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *InstanceInformation) Validate() error { + if pTypeDef.Document == "" { + return fmt.Errorf("InstanceInformation.document is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Document) + if !val.Valid { + return fmt.Errorf("InstanceInformation.document does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Signature == "" { + return fmt.Errorf("InstanceInformation.signature is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Signature) + if !val.Valid { + return fmt.Errorf("InstanceInformation.signature does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.KeyId == "" { + return fmt.Errorf("InstanceInformation.keyId is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.KeyId) + if !val.Valid { + return fmt.Errorf("InstanceInformation.keyId does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Domain == "" { + return fmt.Errorf("InstanceInformation.domain is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "CompoundName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("InstanceInformation.domain does not contain a valid CompoundName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("InstanceInformation.service is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "SimpleName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("InstanceInformation.service does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Csr == "" { + return fmt.Errorf("InstanceInformation.csr is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Csr) + if !val.Valid { + return fmt.Errorf("InstanceInformation.csr does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// InstanceRefreshRequest - InstanceRefreshRequest - a certificate refresh +// request +// +type InstanceRefreshRequest struct { + + // + // Cert CSR if requesting TLS certificate + // + Csr string `json:"csr"` + + // + // in seconds how long token should be valid for + // + ExpiryTime *int32 `json:"expiryTime,omitempty" rdl:"optional"` +} + +// +// NewInstanceRefreshRequest - creates an initialized InstanceRefreshRequest instance, returns a pointer to it +// +func NewInstanceRefreshRequest(init ...*InstanceRefreshRequest) *InstanceRefreshRequest { + var o *InstanceRefreshRequest + if len(init) == 1 { + o = init[0] + } else { + o = new(InstanceRefreshRequest) + } + return o +} + +type rawInstanceRefreshRequest InstanceRefreshRequest + +// +// UnmarshalJSON is defined for proper JSON decoding of a InstanceRefreshRequest +// +func (pTypeDef *InstanceRefreshRequest) UnmarshalJSON(b []byte) error { + var r rawInstanceRefreshRequest + err := json.Unmarshal(b, &r) + if err == nil { + o := InstanceRefreshRequest(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *InstanceRefreshRequest) Validate() error { + if pTypeDef.Csr == "" { + return fmt.Errorf("InstanceRefreshRequest.csr is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Csr) + if !val.Valid { + return fmt.Errorf("InstanceRefreshRequest.csr does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// AWSInstanceInformation - AWSInstanceInformation - the information a booting +// EC2 instance must provide to ZTS to authenticate. +// +type AWSInstanceInformation struct { + + // + // signed document containing attributes like IP address, instance-id, + // account#, etc. + // + Document string `json:"document"` + + // + // the signature for the document + // + Signature string `json:"signature"` + + // + // the domain of the instance + // + Domain CompoundName `json:"domain"` + + // + // the service this instance is supposed to run + // + Service SimpleName `json:"service"` + + // + // return a certificate in the response + // + Csr string `json:"csr"` + + // + // the full service identity name (same as the EC2 instance profile name) + // + Name CompoundName `json:"name"` + + // + // the account id (as a string) for the instance. parsed from the instance + // profile ARN + // + Account SimpleName `json:"account"` + + // + // the name of the cloud (namespace) within the account, parsed from the name + // + Cloud SimpleName `json:"cloud,omitempty" rdl:"optional"` + + // + // the name of the subnet this instance is expected to be running in, parsed + // from the name + // + Subnet SimpleName `json:"subnet"` + + // + // the AWS Access Key Id for the role + // + Access string `json:"access"` + + // + // the AWS Secret Access Key for the role + // + Secret string `json:"secret"` + + // + // the AWS STS Token for the role + // + Token string `json:"token"` + + // + // the expiration time of the access keys + // + Expires rdl.Timestamp `json:"expires"` + + // + // the modified time of the access keys + // + Modified rdl.Timestamp `json:"modified"` + + // + // the 'flavor' of the access keys, i.e. "AWS-HMAC" + // + Flavor string `json:"flavor"` +} + +// +// NewAWSInstanceInformation - creates an initialized AWSInstanceInformation instance, returns a pointer to it +// +func NewAWSInstanceInformation(init ...*AWSInstanceInformation) *AWSInstanceInformation { + var o *AWSInstanceInformation + if len(init) == 1 { + o = init[0] + } else { + o = new(AWSInstanceInformation) + } + return o +} + +type rawAWSInstanceInformation AWSInstanceInformation + +// +// UnmarshalJSON is defined for proper JSON decoding of a AWSInstanceInformation +// +func (pTypeDef *AWSInstanceInformation) UnmarshalJSON(b []byte) error { + var r rawAWSInstanceInformation + err := json.Unmarshal(b, &r) + if err == nil { + o := AWSInstanceInformation(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *AWSInstanceInformation) Validate() error { + if pTypeDef.Document == "" { + return fmt.Errorf("AWSInstanceInformation.document is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Document) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.document does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Signature == "" { + return fmt.Errorf("AWSInstanceInformation.signature is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Signature) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.signature does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Domain == "" { + return fmt.Errorf("AWSInstanceInformation.domain is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "CompoundName", pTypeDef.Domain) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.domain does not contain a valid CompoundName (%v)", val.Error) + } + } + if pTypeDef.Service == "" { + return fmt.Errorf("AWSInstanceInformation.service is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "SimpleName", pTypeDef.Service) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.service does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Csr == "" { + return fmt.Errorf("AWSInstanceInformation.csr is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Csr) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.csr does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Name == "" { + return fmt.Errorf("AWSInstanceInformation.name is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "CompoundName", pTypeDef.Name) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.name does not contain a valid CompoundName (%v)", val.Error) + } + } + if pTypeDef.Account == "" { + return fmt.Errorf("AWSInstanceInformation.account is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "SimpleName", pTypeDef.Account) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.account does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Subnet == "" { + return fmt.Errorf("AWSInstanceInformation.subnet is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "SimpleName", pTypeDef.Subnet) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.subnet does not contain a valid SimpleName (%v)", val.Error) + } + } + if pTypeDef.Access == "" { + return fmt.Errorf("AWSInstanceInformation.access is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Access) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.access does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Secret == "" { + return fmt.Errorf("AWSInstanceInformation.secret is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Secret) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.secret does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Token == "" { + return fmt.Errorf("AWSInstanceInformation.token is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Token) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.token does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Expires.IsZero() { + return fmt.Errorf("AWSInstanceInformation: Missing required field: expires") + } + if pTypeDef.Modified.IsZero() { + return fmt.Errorf("AWSInstanceInformation: Missing required field: modified") + } + if pTypeDef.Flavor == "" { + return fmt.Errorf("AWSInstanceInformation.flavor is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Flavor) + if !val.Valid { + return fmt.Errorf("AWSInstanceInformation.flavor does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// AWSCertificateRequest - AWSCertificateRequest - a certificate signing +// request +// +type AWSCertificateRequest struct { + Csr string `json:"csr"` +} + +// +// NewAWSCertificateRequest - creates an initialized AWSCertificateRequest instance, returns a pointer to it +// +func NewAWSCertificateRequest(init ...*AWSCertificateRequest) *AWSCertificateRequest { + var o *AWSCertificateRequest + if len(init) == 1 { + o = init[0] + } else { + o = new(AWSCertificateRequest) + } + return o +} + +type rawAWSCertificateRequest AWSCertificateRequest + +// +// UnmarshalJSON is defined for proper JSON decoding of a AWSCertificateRequest +// +func (pTypeDef *AWSCertificateRequest) UnmarshalJSON(b []byte) error { + var r rawAWSCertificateRequest + err := json.Unmarshal(b, &r) + if err == nil { + o := AWSCertificateRequest(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *AWSCertificateRequest) Validate() error { + if pTypeDef.Csr == "" { + return fmt.Errorf("AWSCertificateRequest.csr is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.Csr) + if !val.Valid { + return fmt.Errorf("AWSCertificateRequest.csr does not contain a valid String (%v)", val.Error) + } + } + return nil +} + +// +// AWSTemporaryCredentials - +// +type AWSTemporaryCredentials struct { + AccessKeyId string `json:"accessKeyId"` + SecretAccessKey string `json:"secretAccessKey"` + SessionToken string `json:"sessionToken"` + Expiration rdl.Timestamp `json:"expiration"` +} + +// +// NewAWSTemporaryCredentials - creates an initialized AWSTemporaryCredentials instance, returns a pointer to it +// +func NewAWSTemporaryCredentials(init ...*AWSTemporaryCredentials) *AWSTemporaryCredentials { + var o *AWSTemporaryCredentials + if len(init) == 1 { + o = init[0] + } else { + o = new(AWSTemporaryCredentials) + } + return o +} + +type rawAWSTemporaryCredentials AWSTemporaryCredentials + +// +// UnmarshalJSON is defined for proper JSON decoding of a AWSTemporaryCredentials +// +func (pTypeDef *AWSTemporaryCredentials) UnmarshalJSON(b []byte) error { + var r rawAWSTemporaryCredentials + err := json.Unmarshal(b, &r) + if err == nil { + o := AWSTemporaryCredentials(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *AWSTemporaryCredentials) Validate() error { + if pTypeDef.AccessKeyId == "" { + return fmt.Errorf("AWSTemporaryCredentials.accessKeyId is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.AccessKeyId) + if !val.Valid { + return fmt.Errorf("AWSTemporaryCredentials.accessKeyId does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.SecretAccessKey == "" { + return fmt.Errorf("AWSTemporaryCredentials.secretAccessKey is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.SecretAccessKey) + if !val.Valid { + return fmt.Errorf("AWSTemporaryCredentials.secretAccessKey does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.SessionToken == "" { + return fmt.Errorf("AWSTemporaryCredentials.sessionToken is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "String", pTypeDef.SessionToken) + if !val.Valid { + return fmt.Errorf("AWSTemporaryCredentials.sessionToken does not contain a valid String (%v)", val.Error) + } + } + if pTypeDef.Expiration.IsZero() { + return fmt.Errorf("AWSTemporaryCredentials: Missing required field: expiration") + } + return nil +} + +// +// DomainMetricType - zpe metric attributes +// +type DomainMetricType int + +// +// DomainMetricType constants +// +const ( + _ DomainMetricType = iota + ACCESS_ALLOWED + ACCESS_ALLOWED_DENY + ACCESS_ALLOWED_DENY_NO_MATCH + ACCESS_ALLOWED_ALLOW + ACCESS_ALLOWED_ERROR + ACCESS_ALLOWED_TOKEN_INVALID + ACCESS_Allowed_TOKEN_EXPIRED + ACCESS_ALLOWED_DOMAIN_NOT_FOUND + ACCESS_ALLOWED_DOMAIN_MISMATCH + ACCESS_ALLOWED_DOMAIN_EXPIRED + ACCESS_ALLOWED_DOMAIN_EMPTY + ACCESS_ALLOWED_TOKEN_CACHE_FAILURE + ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND + ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS + ACCESS_ALLOWED_TOKEN_VALIDATE + LOAD_FILE_FAIL + LOAD_FILE_GOOD + LOAD_DOMAIN_GOOD +) + +var namesDomainMetricType = []string{ + ACCESS_ALLOWED: "ACCESS_ALLOWED", + ACCESS_ALLOWED_DENY: "ACCESS_ALLOWED_DENY", + ACCESS_ALLOWED_DENY_NO_MATCH: "ACCESS_ALLOWED_DENY_NO_MATCH", + ACCESS_ALLOWED_ALLOW: "ACCESS_ALLOWED_ALLOW", + ACCESS_ALLOWED_ERROR: "ACCESS_ALLOWED_ERROR", + ACCESS_ALLOWED_TOKEN_INVALID: "ACCESS_ALLOWED_TOKEN_INVALID", + ACCESS_Allowed_TOKEN_EXPIRED: "ACCESS_Allowed_TOKEN_EXPIRED", + ACCESS_ALLOWED_DOMAIN_NOT_FOUND: "ACCESS_ALLOWED_DOMAIN_NOT_FOUND", + ACCESS_ALLOWED_DOMAIN_MISMATCH: "ACCESS_ALLOWED_DOMAIN_MISMATCH", + ACCESS_ALLOWED_DOMAIN_EXPIRED: "ACCESS_ALLOWED_DOMAIN_EXPIRED", + ACCESS_ALLOWED_DOMAIN_EMPTY: "ACCESS_ALLOWED_DOMAIN_EMPTY", + ACCESS_ALLOWED_TOKEN_CACHE_FAILURE: "ACCESS_ALLOWED_TOKEN_CACHE_FAILURE", + ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND: "ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND", + ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS: "ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS", + ACCESS_ALLOWED_TOKEN_VALIDATE: "ACCESS_ALLOWED_TOKEN_VALIDATE", + LOAD_FILE_FAIL: "LOAD_FILE_FAIL", + LOAD_FILE_GOOD: "LOAD_FILE_GOOD", + LOAD_DOMAIN_GOOD: "LOAD_DOMAIN_GOOD", +} + +// +// NewDomainMetricType - return a string representation of the enum +// +func NewDomainMetricType(init ...interface{}) DomainMetricType { + if len(init) == 1 { + switch v := init[0].(type) { + case DomainMetricType: + return v + case int: + return DomainMetricType(v) + case int32: + return DomainMetricType(v) + case string: + for i, s := range namesDomainMetricType { + if s == v { + return DomainMetricType(i) + } + } + default: + panic("Bad init value for DomainMetricType enum") + } + } + return DomainMetricType(0) //default to the first enum value +} + +// +// String - return a string representation of the enum +// +func (e DomainMetricType) String() string { + return namesDomainMetricType[e] +} + +// +// SymbolSet - return an array of all valid string representations (symbols) of the enum +// +func (e DomainMetricType) SymbolSet() []string { + return namesDomainMetricType +} + +// +// MarshalJSON is defined for proper JSON encoding of a DomainMetricType +// +func (e DomainMetricType) MarshalJSON() ([]byte, error) { + return json.Marshal(e.String()) +} + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainMetricType +// +func (e *DomainMetricType) UnmarshalJSON(b []byte) error { + var j string + err := json.Unmarshal(b, &j) + if err == nil { + s := string(j) + for v, s2 := range namesDomainMetricType { + if s == s2 { + *e = DomainMetricType(v) + return nil + } + } + err = fmt.Errorf("Bad enum symbol for type DomainMetricType: %s", s) + } + return err +} + +// +// DomainMetric - +// +type DomainMetric struct { + MetricType DomainMetricType `json:"metricType"` + MetricVal int32 `json:"metricVal"` +} + +// +// NewDomainMetric - creates an initialized DomainMetric instance, returns a pointer to it +// +func NewDomainMetric(init ...*DomainMetric) *DomainMetric { + var o *DomainMetric + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainMetric) + } + return o +} + +type rawDomainMetric DomainMetric + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainMetric +// +func (pTypeDef *DomainMetric) UnmarshalJSON(b []byte) error { + var r rawDomainMetric + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainMetric(r) + *pTypeDef = o + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainMetric) Validate() error { + return nil +} + +// +// DomainMetrics - +// +type DomainMetrics struct { + + // + // name of the domain the metrics pertain to + // + DomainName DomainName `json:"domainName"` + + // + // list of the domains metrics + // + MetricList []*DomainMetric `json:"metricList"` +} + +// +// NewDomainMetrics - creates an initialized DomainMetrics instance, returns a pointer to it +// +func NewDomainMetrics(init ...*DomainMetrics) *DomainMetrics { + var o *DomainMetrics + if len(init) == 1 { + o = init[0] + } else { + o = new(DomainMetrics) + } + return o.Init() +} + +// +// Init - sets up the instance according to its default field values, if any +// +func (pTypeDef *DomainMetrics) Init() *DomainMetrics { + if pTypeDef.MetricList == nil { + pTypeDef.MetricList = make([]*DomainMetric, 0) + } + return pTypeDef +} + +type rawDomainMetrics DomainMetrics + +// +// UnmarshalJSON is defined for proper JSON decoding of a DomainMetrics +// +func (pTypeDef *DomainMetrics) UnmarshalJSON(b []byte) error { + var r rawDomainMetrics + err := json.Unmarshal(b, &r) + if err == nil { + o := DomainMetrics(r) + *pTypeDef = *((&o).Init()) + err = pTypeDef.Validate() + } + return err +} + +// +// Validate - checks for missing required fields, etc +// +func (pTypeDef *DomainMetrics) Validate() error { + if pTypeDef.DomainName == "" { + return fmt.Errorf("DomainMetrics.domainName is missing but is a required field") + } else { + val := rdl.Validate(ZTSSchema(), "DomainName", pTypeDef.DomainName) + if !val.Valid { + return fmt.Errorf("DomainMetrics.domainName does not contain a valid DomainName (%v)", val.Error) + } + } + if pTypeDef.MetricList == nil { + return fmt.Errorf("DomainMetrics: Missing required field: metricList") + } + return nil +} diff --git a/clients/go/zts/zts_schema.go b/clients/go/zts/zts_schema.go new file mode 100644 index 00000000000..8d1648ba866 --- /dev/null +++ b/clients/go/zts/zts_schema.go @@ -0,0 +1,418 @@ +// +// This file generated by rdl 1.4.8 +// + +package zts + +import ( + rdl "github.com/ardielle/ardielle-go/rdl" +) + +var schema *rdl.Schema + +func init() { + sb := rdl.NewSchemaBuilder("ZTS") + sb.Version(1) + sb.Namespace("com.yahoo.athenz.zts") + sb.Comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. The Authorization Management Service (ZTS) API") + + tSimpleName := rdl.NewStringTypeBuilder("SimpleName") + tSimpleName.Comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. Common name types used by several API definitions A simple identifier, an element of compound name.") + tSimpleName.Pattern("[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tSimpleName.Build()) + + tCompoundName := rdl.NewStringTypeBuilder("CompoundName") + tCompoundName.Comment("A compound name. Most names in this API are compound names.") + tCompoundName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tCompoundName.Build()) + + tDomainName := rdl.NewStringTypeBuilder("DomainName") + tDomainName.Comment("A domain name is the general qualifier prefix, as its uniqueness is managed.") + tDomainName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tDomainName.Build()) + + tEntityName := rdl.NewStringTypeBuilder("EntityName") + tEntityName.Comment("An entity name is a short form of a resource name, including only the domain and entity.") + tEntityName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tEntityName.Build()) + + tServiceName := rdl.NewStringTypeBuilder("ServiceName") + tServiceName.Comment("A service name will generally be a unique subdomain.") + tServiceName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tServiceName.Build()) + + tLocationName := rdl.NewStringTypeBuilder("LocationName") + tLocationName.Comment("A location name is not yet defined, but will be a dotted name like everything else.") + tLocationName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tLocationName.Build()) + + tActionName := rdl.NewStringTypeBuilder("ActionName") + tActionName.Comment("An action (operation) name.") + tActionName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tActionName.Build()) + + tResourceName := rdl.NewStringTypeBuilder("ResourceName") + tResourceName.Comment("A shorthand for a YRN with no service or location. The 'tail' of a YRN, just the domain:entity. Note that the EntityName part is optional, that is, a domain name followed by a colon is valid resource name.") + tResourceName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?") + sb.AddType(tResourceName.Build()) + + tYRN := rdl.NewStringTypeBuilder("YRN") + tYRN.Comment("A full Yahoo Resource name (YRN).") + tYRN.Pattern("(yrn:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:)?([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?") + sb.AddType(tYRN.Build()) + + tYBase64 := rdl.NewStringTypeBuilder("YBase64") + tYBase64.Comment("The Y-specific URL-safe Base64 variant.") + tYBase64.Pattern("[a-zA-Z0-9\\._-]+") + sb.AddType(tYBase64.Build()) + + tYEncoded := rdl.NewStringTypeBuilder("YEncoded") + tYEncoded.Comment("YEncoded includes ybase64 chars, as well as = and %. This can represent a user cookie and URL-encoded values.") + tYEncoded.Pattern("[a-zA-Z0-9\\._%=-]*") + sb.AddType(tYEncoded.Build()) + + tAuthorityName := rdl.NewStringTypeBuilder("AuthorityName") + tAuthorityName.Comment("Used as the prefix in a signed assertion. This uniquely identifies a signing authority.") + tAuthorityName.Pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*") + sb.AddType(tAuthorityName.Build()) + + tSignedToken := rdl.NewStringTypeBuilder("SignedToken") + tSignedToken.Comment("A signed assertion if identity. i.e. the user cookie value. This token will only make sense to the authority that generated it, so it is beneficial to have something in the value that is cheaply recognized to quickly reject if it belongs to another authority. In addition to the YEncoded set our token includes ; to separate components and , to separate roles") + tSignedToken.Pattern("[a-zA-Z0-9\\._%=;,-]*") + sb.AddType(tSignedToken.Build()) + + tPublicKeyEntry := rdl.NewStructTypeBuilder("Struct", "PublicKeyEntry") + tPublicKeyEntry.Comment("The representation of the public key in a service identity object.") + tPublicKeyEntry.Field("key", "String", false, nil, "the public key for the service") + tPublicKeyEntry.Field("id", "String", false, nil, "the key identifier (version or zone name)") + sb.AddType(tPublicKeyEntry.Build()) + + tServiceIdentity := rdl.NewStructTypeBuilder("Struct", "ServiceIdentity") + tServiceIdentity.Comment("The representation of the service identity object.") + tServiceIdentity.Field("name", "ServiceName", false, nil, "the full name of the service, i.e. \"sports.storage\"") + tServiceIdentity.ArrayField("publicKeys", "PublicKeyEntry", true, "array of public keys for key rotation") + tServiceIdentity.Field("providerEndpoint", "String", true, nil, "if present, then this service can provision tenants via this endpoint.") + tServiceIdentity.Field("modified", "Timestamp", true, nil, "the timestamp when this entry was last modified") + tServiceIdentity.Field("executable", "String", true, nil, "the path of the executable that runs the service") + tServiceIdentity.ArrayField("hosts", "String", true, "list of host names that this service can run on") + tServiceIdentity.Field("user", "String", true, nil, "local (unix) user name this service can run as") + tServiceIdentity.Field("group", "String", true, nil, "local (unix) group name this service can run as") + sb.AddType(tServiceIdentity.Build()) + + tServiceIdentityList := rdl.NewStructTypeBuilder("Struct", "ServiceIdentityList") + tServiceIdentityList.Comment("The representation for an enumeration of services in the namespace.") + tServiceIdentityList.ArrayField("names", "EntityName", false, "list of service names") + sb.AddType(tServiceIdentityList.Build()) + + tHostServices := rdl.NewStructTypeBuilder("Struct", "HostServices") + tHostServices.Comment("The representation for an enumeration of services authorized to run on a specific host.") + tHostServices.Field("host", "String", false, nil, "name of the host") + tHostServices.ArrayField("names", "EntityName", false, "list of service names authorized to run on this host") + sb.AddType(tHostServices.Build()) + + tAssertionEffect := rdl.NewEnumTypeBuilder("Enum", "AssertionEffect") + tAssertionEffect.Comment("Every assertion can have the effect of ALLOW or DENY.") + tAssertionEffect.Element("ALLOW", "Every assertion can have the effect of ALLOW or DENY.") + tAssertionEffect.Element("DENY", "") + sb.AddType(tAssertionEffect.Build()) + + tAssertion := rdl.NewStructTypeBuilder("Struct", "Assertion") + tAssertion.Comment("A representation for the encapsulation of an action to be performed on a resource by a principal.") + tAssertion.Field("role", "String", false, nil, "the subject of the assertion, a role") + tAssertion.Field("resource", "String", false, nil, "the object of the assertion. Must be in the local namespace. Can contain wildcards") + tAssertion.Field("action", "String", false, nil, "the predicate of the assertion. Can contain wildcards") + tAssertion.Field("effect", "AssertionEffect", true, ALLOW, "the effect of the assertion in the policy language") + tAssertion.Field("id", "Int64", true, nil, "assertion id - auto generated by server") + sb.AddType(tAssertion.Build()) + + tPolicy := rdl.NewStructTypeBuilder("Struct", "Policy") + tPolicy.Comment("The representation for a Policy with set of assertions.") + tPolicy.Field("name", "ResourceName", false, nil, "name of the policy") + tPolicy.Field("modified", "Timestamp", true, nil, "last modification timestamp of this policy") + tPolicy.ArrayField("assertions", "Assertion", false, "list of defined assertions for this policy") + sb.AddType(tPolicy.Build()) + + tPolicyData := rdl.NewStructTypeBuilder("Struct", "PolicyData") + tPolicyData.Field("domain", "DomainName", false, nil, "name of the domain") + tPolicyData.ArrayField("policies", "Policy", false, "list of policies defined in this server") + sb.AddType(tPolicyData.Build()) + + tSignedPolicyData := rdl.NewStructTypeBuilder("Struct", "SignedPolicyData") + tSignedPolicyData.Comment("A representation of policies object defined in a given server.") + tSignedPolicyData.Field("policyData", "PolicyData", false, nil, "list of policies defined in a domain") + tSignedPolicyData.Field("zmsSignature", "String", false, nil, "zms signature generated based on the domain policies object") + tSignedPolicyData.Field("zmsKeyId", "String", false, nil, "the identifier of the zms key used to generate the signature") + tSignedPolicyData.Field("modified", "Timestamp", false, nil, "when the domain itself was last modified") + tSignedPolicyData.Field("expires", "Timestamp", false, nil, "timestamp specifying the expiration time for using this set of policies") + sb.AddType(tSignedPolicyData.Build()) + + tDomainSignedPolicyData := rdl.NewStructTypeBuilder("Struct", "DomainSignedPolicyData") + tDomainSignedPolicyData.Comment("A signed bulk transfer of policies. The data is signed with server's private key.") + tDomainSignedPolicyData.Field("signedPolicyData", "SignedPolicyData", false, nil, "policy data signed by ZMS") + tDomainSignedPolicyData.Field("signature", "String", false, nil, "signature generated based on the domain policies object") + tDomainSignedPolicyData.Field("keyId", "String", false, nil, "the identifier of the key used to generate the signature") + sb.AddType(tDomainSignedPolicyData.Build()) + + tRoleToken := rdl.NewStructTypeBuilder("Struct", "RoleToken") + tRoleToken.Comment("A representation of a signed RoleToken") + tRoleToken.Field("token", "String", false, nil, "") + tRoleToken.Field("expiryTime", "Int64", false, nil, "") + sb.AddType(tRoleToken.Build()) + + tAccess := rdl.NewStructTypeBuilder("Struct", "Access") + tAccess.Comment("Access can be checked and returned as this resource.") + tAccess.Field("granted", "Bool", false, nil, "true (allowed) or false (denied)") + sb.AddType(tAccess.Build()) + + tRoleAccess := rdl.NewStructTypeBuilder("Struct", "RoleAccess") + tRoleAccess.ArrayField("roles", "EntityName", false, "") + sb.AddType(tRoleAccess.Build()) + + tTenantDomains := rdl.NewStructTypeBuilder("Struct", "TenantDomains") + tTenantDomains.ArrayField("tenantDomainNames", "DomainName", false, "") + sb.AddType(tTenantDomains.Build()) + + tIdentity := rdl.NewStructTypeBuilder("Struct", "Identity") + tIdentity.Comment("Identity - a signed assertion of service or human identity, the response could be either a client certificate or just a regular NToken (depending if the request contained a csr or not).") + tIdentity.Field("name", "CompoundName", false, nil, "name of the identity, fully qualified, i.e. my.domain.service1, or aws.1232321321312.myusername") + tIdentity.Field("certificate", "String", true, nil, "a certificate usable for both client and server in TLS connections") + tIdentity.Field("caCertBundle", "String", true, nil, "the CA certificate chain to use with all IMS-generated certs") + tIdentity.Field("sshServerCert", "String", true, nil, "the SSH server cert, signed by the CA") + tIdentity.Field("serviceToken", "SignedToken", true, nil, "service token instead of TLS certificate") + tIdentity.MapField("attributes", "String", "String", true, "other config-like attributes determined at boot time") + sb.AddType(tIdentity.Build()) + + tInstanceInformation := rdl.NewStructTypeBuilder("Struct", "InstanceInformation") + tInstanceInformation.Comment("Instance object that includes requested service details plus host document that is signed by provider as part of the host bootstrap process") + tInstanceInformation.Field("document", "String", false, nil, "signed document containing attributes like IP address, instance-id, account#, etc.") + tInstanceInformation.Field("signature", "String", false, nil, "the signature for the document") + tInstanceInformation.Field("keyId", "String", false, nil, "the keyid used to sign the document") + tInstanceInformation.Field("domain", "CompoundName", false, nil, "the domain of the instance") + tInstanceInformation.Field("service", "SimpleName", false, nil, "the service this instance is supposed to run") + tInstanceInformation.Field("csr", "String", false, nil, "return a certificate in the response") + sb.AddType(tInstanceInformation.Build()) + + tInstanceRefreshRequest := rdl.NewStructTypeBuilder("Struct", "InstanceRefreshRequest") + tInstanceRefreshRequest.Comment("InstanceRefreshRequest - a certificate refresh request") + tInstanceRefreshRequest.Field("csr", "String", false, nil, "Cert CSR if requesting TLS certificate") + tInstanceRefreshRequest.Field("expiryTime", "Int32", true, nil, "in seconds how long token should be valid for") + sb.AddType(tInstanceRefreshRequest.Build()) + + tAWSInstanceInformation := rdl.NewStructTypeBuilder("Struct", "AWSInstanceInformation") + tAWSInstanceInformation.Comment("AWSInstanceInformation - the information a booting EC2 instance must provide to ZTS to authenticate.") + tAWSInstanceInformation.Field("document", "String", false, nil, "signed document containing attributes like IP address, instance-id, account#, etc.") + tAWSInstanceInformation.Field("signature", "String", false, nil, "the signature for the document") + tAWSInstanceInformation.Field("domain", "CompoundName", false, nil, "the domain of the instance") + tAWSInstanceInformation.Field("service", "SimpleName", false, nil, "the service this instance is supposed to run") + tAWSInstanceInformation.Field("csr", "String", false, nil, "return a certificate in the response") + tAWSInstanceInformation.Field("name", "CompoundName", false, nil, "the full service identity name (same as the EC2 instance profile name)") + tAWSInstanceInformation.Field("account", "SimpleName", false, nil, "the account id (as a string) for the instance. parsed from the instance profile ARN") + tAWSInstanceInformation.Field("cloud", "SimpleName", true, nil, "the name of the cloud (namespace) within the account, parsed from the name") + tAWSInstanceInformation.Field("subnet", "SimpleName", false, nil, "the name of the subnet this instance is expected to be running in, parsed from the name") + tAWSInstanceInformation.Field("access", "String", false, nil, "the AWS Access Key Id for the role") + tAWSInstanceInformation.Field("secret", "String", false, nil, "the AWS Secret Access Key for the role") + tAWSInstanceInformation.Field("token", "String", false, nil, "the AWS STS Token for the role") + tAWSInstanceInformation.Field("expires", "Timestamp", false, nil, "the expiration time of the access keys") + tAWSInstanceInformation.Field("modified", "Timestamp", false, nil, "the modified time of the access keys") + tAWSInstanceInformation.Field("flavor", "String", false, nil, "the 'flavor' of the access keys, i.e. \"AWS-HMAC\"") + sb.AddType(tAWSInstanceInformation.Build()) + + tAWSCertificateRequest := rdl.NewStructTypeBuilder("Struct", "AWSCertificateRequest") + tAWSCertificateRequest.Comment("AWSCertificateRequest - a certificate signing request") + tAWSCertificateRequest.Field("csr", "String", false, nil, "") + sb.AddType(tAWSCertificateRequest.Build()) + + tAWSTemporaryCredentials := rdl.NewStructTypeBuilder("Struct", "AWSTemporaryCredentials") + tAWSTemporaryCredentials.Field("accessKeyId", "String", false, nil, "") + tAWSTemporaryCredentials.Field("secretAccessKey", "String", false, nil, "") + tAWSTemporaryCredentials.Field("sessionToken", "String", false, nil, "") + tAWSTemporaryCredentials.Field("expiration", "Timestamp", false, nil, "") + sb.AddType(tAWSTemporaryCredentials.Build()) + + tDomainMetricType := rdl.NewEnumTypeBuilder("Enum", "DomainMetricType") + tDomainMetricType.Comment("zpe metric attributes") + tDomainMetricType.Element("ACCESS_ALLOWED", "zpe metric attributes") + tDomainMetricType.Element("ACCESS_ALLOWED_DENY", "") + tDomainMetricType.Element("ACCESS_ALLOWED_DENY_NO_MATCH", "") + tDomainMetricType.Element("ACCESS_ALLOWED_ALLOW", "") + tDomainMetricType.Element("ACCESS_ALLOWED_ERROR", "") + tDomainMetricType.Element("ACCESS_ALLOWED_TOKEN_INVALID", "") + tDomainMetricType.Element("ACCESS_Allowed_TOKEN_EXPIRED", "") + tDomainMetricType.Element("ACCESS_ALLOWED_DOMAIN_NOT_FOUND", "") + tDomainMetricType.Element("ACCESS_ALLOWED_DOMAIN_MISMATCH", "") + tDomainMetricType.Element("ACCESS_ALLOWED_DOMAIN_EXPIRED", "") + tDomainMetricType.Element("ACCESS_ALLOWED_DOMAIN_EMPTY", "") + tDomainMetricType.Element("ACCESS_ALLOWED_TOKEN_CACHE_FAILURE", "") + tDomainMetricType.Element("ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND", "") + tDomainMetricType.Element("ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS", "") + tDomainMetricType.Element("ACCESS_ALLOWED_TOKEN_VALIDATE", "") + tDomainMetricType.Element("LOAD_FILE_FAIL", "") + tDomainMetricType.Element("LOAD_FILE_GOOD", "") + tDomainMetricType.Element("LOAD_DOMAIN_GOOD", "") + sb.AddType(tDomainMetricType.Build()) + + tDomainMetric := rdl.NewStructTypeBuilder("Struct", "DomainMetric") + tDomainMetric.Field("metricType", "DomainMetricType", false, nil, "") + tDomainMetric.Field("metricVal", "Int32", false, nil, "") + sb.AddType(tDomainMetric.Build()) + + tDomainMetrics := rdl.NewStructTypeBuilder("Struct", "DomainMetrics") + tDomainMetrics.Field("domainName", "DomainName", false, nil, "name of the domain the metrics pertain to") + tDomainMetrics.ArrayField("metricList", "DomainMetric", false, "list of the domains metrics") + sb.AddType(tDomainMetrics.Build()) + + rGetServiceIdentity := rdl.NewResourceBuilder("ServiceIdentity", "GET", "/domain/{domainName}/service/{serviceName}") + rGetServiceIdentity.Comment("Get info for the specified ServiceIdentity.") + rGetServiceIdentity.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetServiceIdentity.Input("serviceName", "ServiceName", true, "", "", false, nil, "name of the service to be retrieved") + rGetServiceIdentity.Auth("", "", true, "") + rGetServiceIdentity.Exception("BAD_REQUEST", "ResourceError", "") + rGetServiceIdentity.Exception("NOT_FOUND", "ResourceError", "") + rGetServiceIdentity.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetServiceIdentity.Build()) + + rGetServiceIdentityList := rdl.NewResourceBuilder("ServiceIdentityList", "GET", "/domain/{domainName}/service") + rGetServiceIdentityList.Comment("Enumerate services provisioned in this domain.") + rGetServiceIdentityList.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetServiceIdentityList.Auth("", "", true, "") + rGetServiceIdentityList.Exception("BAD_REQUEST", "ResourceError", "") + rGetServiceIdentityList.Exception("NOT_FOUND", "ResourceError", "") + rGetServiceIdentityList.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetServiceIdentityList.Build()) + + rGetPublicKeyEntry := rdl.NewResourceBuilder("PublicKeyEntry", "GET", "/domain/{domainName}/service/{serviceName}/publickey/{keyId}") + rGetPublicKeyEntry.Comment("Retrieve the specified public key from the service.") + rGetPublicKeyEntry.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetPublicKeyEntry.Input("serviceName", "SimpleName", true, "", "", false, nil, "name of the service") + rGetPublicKeyEntry.Input("keyId", "String", true, "", "", false, nil, "the identifier of the public key to be retrieved") + rGetPublicKeyEntry.Exception("BAD_REQUEST", "ResourceError", "") + rGetPublicKeyEntry.Exception("NOT_FOUND", "ResourceError", "") + sb.AddResource(rGetPublicKeyEntry.Build()) + + rGetHostServices := rdl.NewResourceBuilder("HostServices", "GET", "/host/{host}/services") + rGetHostServices.Comment("Enumerate services provisioned on a specific host") + rGetHostServices.Input("host", "String", true, "", "", false, nil, "name of the host") + rGetHostServices.Exception("BAD_REQUEST", "ResourceError", "") + sb.AddResource(rGetHostServices.Build()) + + rGetDomainSignedPolicyData := rdl.NewResourceBuilder("DomainSignedPolicyData", "GET", "/domain/{domainName}/signed_policy_data") + rGetDomainSignedPolicyData.Comment("Get a signed policy enumeration from the service, to transfer to a local store. An ETag is generated for the PolicyList that changes when any item in the list changes. If the If-None-Match header is provided, and it matches the ETag that would be returned, then a NOT_MODIFIED response is returned instead of the list.") + rGetDomainSignedPolicyData.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetDomainSignedPolicyData.Input("matchingTag", "String", false, "", "If-None-Match", false, nil, "Retrieved from the previous request, this timestamp specifies to the server to return any policies modified since this time") + rGetDomainSignedPolicyData.Output("tag", "String", "ETag", false, "") + rGetDomainSignedPolicyData.Exception("BAD_REQUEST", "ResourceError", "") + rGetDomainSignedPolicyData.Exception("NOT_FOUND", "ResourceError", "") + sb.AddResource(rGetDomainSignedPolicyData.Build()) + + rGetRoleToken := rdl.NewResourceBuilder("RoleToken", "GET", "/domain/{domainName}/token") + rGetRoleToken.Comment("Return a security token for the specific role in the namespace that the user can assume. If the role is omitted, then all roles in the namespace that the authenticated user can assume are returned. the caller can specify how long the RoleToken should be valid for by specifying the minExpiryTime and maxExpiryTime parameters. The minExpiryTime specifies that the returned RoleToken must be at least valid (min/lower bound) for specified number of seconds, while maxExpiryTime specifies that the RoleToken must be at most valid (max/upper bound) for specified number of seconds. If both values are the same, the server must return a RoleToken for that many seconds. If no values are specified, the server's default RoleToken Timeout value is used.") + rGetRoleToken.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetRoleToken.Input("role", "EntityName", false, "role", "", true, nil, "only interested for a token for this role") + rGetRoleToken.Input("minExpiryTime", "Int32", false, "minExpiryTime", "", true, nil, "in seconds min expiry time") + rGetRoleToken.Input("maxExpiryTime", "Int32", false, "maxExpiryTime", "", true, nil, "in seconds max expiry time") + rGetRoleToken.Input("proxyForPrincipal", "EntityName", false, "proxyForPrincipal", "", true, nil, "optional this request is proxy for this principal") + rGetRoleToken.Auth("", "", true, "") + rGetRoleToken.Exception("BAD_REQUEST", "ResourceError", "") + rGetRoleToken.Exception("FORBIDDEN", "ResourceError", "") + rGetRoleToken.Exception("NOT_FOUND", "ResourceError", "") + rGetRoleToken.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetRoleToken.Build()) + + rGetAccess := rdl.NewResourceBuilder("Access", "GET", "/access/domain/{domainName}/role/{roleName}/principal/{principal}") + rGetAccess.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetAccess.Input("roleName", "EntityName", true, "", "", false, nil, "name of the role to check access for") + rGetAccess.Input("principal", "EntityName", true, "", "", false, nil, "carry out the access check for this principal") + rGetAccess.Auth("", "", true, "") + rGetAccess.Exception("BAD_REQUEST", "ResourceError", "") + rGetAccess.Exception("FORBIDDEN", "ResourceError", "") + rGetAccess.Exception("NOT_FOUND", "ResourceError", "") + rGetAccess.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetAccess.Build()) + + rGetRoleAccess := rdl.NewResourceBuilder("RoleAccess", "GET", "/access/domain/{domainName}/principal/{principal}") + rGetRoleAccess.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain") + rGetRoleAccess.Input("principal", "EntityName", true, "", "", false, nil, "carry out the role access lookup for this principal") + rGetRoleAccess.Auth("", "", true, "") + rGetRoleAccess.Exception("BAD_REQUEST", "ResourceError", "") + rGetRoleAccess.Exception("NOT_FOUND", "ResourceError", "") + rGetRoleAccess.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetRoleAccess.Build()) + + rGetTenantDomains := rdl.NewResourceBuilder("TenantDomains", "GET", "/providerdomain/{providerDomainName}/user/{userName}") + rGetTenantDomains.Comment("Get list of tenant domains user has access to for specified provider domain and service") + rGetTenantDomains.Input("providerDomainName", "DomainName", true, "", "", false, nil, "name of the provider domain") + rGetTenantDomains.Input("userName", "EntityName", true, "", "", false, nil, "name of the user to retrieve tenant domain access for") + rGetTenantDomains.Input("roleName", "EntityName", false, "roleName", "", true, nil, "role name to filter on when looking for the tenants in provider") + rGetTenantDomains.Input("serviceName", "ServiceName", false, "serviceName", "", true, nil, "service name to filter on when looking for the tenants in provider") + rGetTenantDomains.Auth("", "", true, "") + rGetTenantDomains.Exception("BAD_REQUEST", "ResourceError", "") + rGetTenantDomains.Exception("NOT_FOUND", "ResourceError", "") + rGetTenantDomains.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetTenantDomains.Build()) + + rPostInstanceInformation := rdl.NewResourceBuilder("Identity", "POST", "/instance") + rPostInstanceInformation.Comment("Get a cert for service being bootstrapped by supported service") + rPostInstanceInformation.Input("info", "InstanceInformation", false, "", "", false, nil, "") + rPostInstanceInformation.Exception("BAD_REQUEST", "ResourceError", "") + rPostInstanceInformation.Exception("FORBIDDEN", "ResourceError", "") + rPostInstanceInformation.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostInstanceInformation.Build()) + + rPostInstanceRefreshRequest := rdl.NewResourceBuilder("Identity", "POST", "/instance/{domain}/{service}/refresh") + rPostInstanceRefreshRequest.Comment("Refresh self identity if the original identity was issued by ZTS") + rPostInstanceRefreshRequest.Input("domain", "CompoundName", true, "", "", false, nil, "name of the domain requesting the refresh") + rPostInstanceRefreshRequest.Input("service", "SimpleName", true, "", "", false, nil, "name of the service requesting the refresh") + rPostInstanceRefreshRequest.Input("req", "InstanceRefreshRequest", false, "", "", false, nil, "the refresh request") + rPostInstanceRefreshRequest.Auth("", "", true, "") + rPostInstanceRefreshRequest.Exception("BAD_REQUEST", "ResourceError", "") + rPostInstanceRefreshRequest.Exception("FORBIDDEN", "ResourceError", "") + rPostInstanceRefreshRequest.Exception("NOT_FOUND", "ResourceError", "") + rPostInstanceRefreshRequest.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostInstanceRefreshRequest.Build()) + + rPostAWSInstanceInformation := rdl.NewResourceBuilder("Identity", "POST", "/aws/instance") + rPostAWSInstanceInformation.Comment("Register an instance in AWS ZTS. Whether this succeeds or not depends on the contents of the request (the request itself is not authenticated or authorized in the normal way). If successful, the Identity is returned as a x.509 client certificate (to be used in TLS operations)") + rPostAWSInstanceInformation.Input("info", "AWSInstanceInformation", false, "", "", false, nil, "") + rPostAWSInstanceInformation.Exception("BAD_REQUEST", "ResourceError", "") + rPostAWSInstanceInformation.Exception("FORBIDDEN", "ResourceError", "") + rPostAWSInstanceInformation.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostAWSInstanceInformation.Build()) + + rPostAWSCertificateRequest := rdl.NewResourceBuilder("Identity", "POST", "/aws/instance/{domain}/{service}/refresh") + rPostAWSCertificateRequest.Comment("Rotate certs. Make this request with previous cert, the result is new cert for the same identity.") + rPostAWSCertificateRequest.Input("domain", "CompoundName", true, "", "", false, nil, "name of the domain requesting the refresh") + rPostAWSCertificateRequest.Input("service", "SimpleName", true, "", "", false, nil, "name of the service requesting the refresh") + rPostAWSCertificateRequest.Input("req", "AWSCertificateRequest", false, "", "", false, nil, "the refresh request") + rPostAWSCertificateRequest.Auth("", "", true, "") + rPostAWSCertificateRequest.Exception("BAD_REQUEST", "ResourceError", "") + rPostAWSCertificateRequest.Exception("FORBIDDEN", "ResourceError", "") + rPostAWSCertificateRequest.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostAWSCertificateRequest.Build()) + + rGetAWSTemporaryCredentials := rdl.NewResourceBuilder("AWSTemporaryCredentials", "GET", "/domain/{domainName}/role/{role}/creds") + rGetAWSTemporaryCredentials.Comment("perform an AWS AssumeRole of the target role and return the credentials. ZTS must have been granted the ability to assume the role in IAM, and granted the ability to ASSUME_AWS_ROLE in Athenz for this to succeed.") + rGetAWSTemporaryCredentials.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain containing the role, which implies the target account") + rGetAWSTemporaryCredentials.Input("role", "CompoundName", true, "", "", false, nil, "the target AWS role name in the domain account, in Athenz terms, i.e. \"the.role\"") + rGetAWSTemporaryCredentials.Auth("", "", true, "") + rGetAWSTemporaryCredentials.Exception("BAD_REQUEST", "ResourceError", "") + rGetAWSTemporaryCredentials.Exception("FORBIDDEN", "ResourceError", "") + rGetAWSTemporaryCredentials.Exception("NOT_FOUND", "ResourceError", "") + rGetAWSTemporaryCredentials.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rGetAWSTemporaryCredentials.Build()) + + rPostDomainMetrics := rdl.NewResourceBuilder("DomainMetrics", "POST", "/metrics/{domainName}") + rPostDomainMetrics.Comment("called to post multiple zpe related metric attributes") + rPostDomainMetrics.Input("domainName", "DomainName", true, "", "", false, nil, "name of the domain the metrics pertain to") + rPostDomainMetrics.Input("req", "DomainMetrics", false, "", "", false, nil, "") + rPostDomainMetrics.Exception("BAD_REQUEST", "ResourceError", "") + rPostDomainMetrics.Exception("FORBIDDEN", "ResourceError", "") + rPostDomainMetrics.Exception("NOT_FOUND", "ResourceError", "") + rPostDomainMetrics.Exception("UNAUTHORIZED", "ResourceError", "") + sb.AddResource(rPostDomainMetrics.Build()) + + schema = sb.Build() +} + +func ZTSSchema() *rdl.Schema { + return schema +} diff --git a/clients/java/sia/README.md b/clients/java/sia/README.md new file mode 100644 index 00000000000..89bb17098d2 --- /dev/null +++ b/clients/java/sia/README.md @@ -0,0 +1,27 @@ +Service Identity Agent Client Java Library + +System properties: + + athenz.sia.client.ntoken_path + When used in athenz enabled environment, this setting specifies + the path of the file that contains the ntoken generated by the framework. + This setting requires that ntoken_domain and ntoken_service settings + to be configured as well. + + athenz.sia.client.ntoken_domain + This setting specifies the domain name of the service that is identified + by the ntoken generated by the framework(see ntoken_path above). + This setting requires that ntoken_path and ntoken_service settings + to be configured as well. + + athenz.sia.client.ntoken_service + This setting specifies the service name that is identified + by the ntoken generated by the framework(see ntoken_path above). + This setting requires that ntoken_path and ntoken_domain settings + to be configured as well. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/clients/java/sia/pom.xml b/clients/java/sia/pom.xml new file mode 100644 index 00000000000..c379b49c3a9 --- /dev/null +++ b/clients/java/sia/pom.xml @@ -0,0 +1,62 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../../pom.xml + + + sia_java_client + jar + sia_java_client + SIA Java Client Library + + + + ${project.groupId} + auth_core + ${project.parent.version} + + + com.kohlschutter.junixsocket + junixsocket-common + 2.0.4 + + + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 2.10.4 + + + prepare-package + + jar + + + + + + + + + diff --git a/clients/java/sia/src/main/java/com/yahoo/athenz/sia/SIA.java b/clients/java/sia/src/main/java/com/yahoo/athenz/sia/SIA.java new file mode 100644 index 00000000000..d6279277d26 --- /dev/null +++ b/clients/java/sia/src/main/java/com/yahoo/athenz/sia/SIA.java @@ -0,0 +1,47 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.sia; + +import java.io.IOException; +import java.util.ArrayList; + +import com.yahoo.athenz.auth.Principal; + +public interface SIA { + + /** + * For the specified domain/service return the corresponding Service Principal that + * includes the SIA generated PrincipalToken (NToken) + * @param domainName name of the domain + * @param serviceName name of the service + * @param minExpiryTime (optional) specifies that the returned PrincipalToken must be + * at least valid (min/lower bound) for specified number of seconds, + * @param maxExpiryTime (optional) specifies that the returned PrincipalToken must be + * at most valid (max/upper bound) for specified number of seconds. + * @param ignoreCache ignore the cache and retrieve the token from SIA Server + * @return SIA generated Principal object with PrincipalToken + * @throws IOException for any IO errors + */ + public Principal getServicePrincipal(String domainName, String serviceName, + Integer minExpiryTime, Integer maxExpiryTime, boolean ignoreCache) throws IOException; + + /** + * Returns the list of domains that have private keys registered on this host + * @return List of domain names + * @throws IOException for any IO errors + */ + public ArrayList getDomainList() throws IOException; +} diff --git a/clients/java/sia/src/main/java/com/yahoo/athenz/sia/impl/SIAClient.java b/clients/java/sia/src/main/java/com/yahoo/athenz/sia/impl/SIAClient.java new file mode 100644 index 00000000000..598bd5f646c --- /dev/null +++ b/clients/java/sia/src/main/java/com/yahoo/athenz/sia/impl/SIAClient.java @@ -0,0 +1,526 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.sia.impl; + +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.net.Socket; +import java.nio.ByteBuffer; +import java.nio.ByteOrder; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.StringTokenizer; +import java.util.concurrent.ConcurrentHashMap; + +import org.newsclub.net.unix.AFUNIXSocket; +import org.newsclub.net.unix.AFUNIXSocketAddress; +import org.newsclub.net.unix.AFUNIXSocketException; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.sia.SIA; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Struct; + +/** + * SIA Client Library to retrieve Service Principal and the list of ZMS Domains + * provisioned to run on this host. + */ +public class SIAClient implements SIA { + + private static final Logger LOG = LoggerFactory.getLogger(SIAClient.class); + + public static final int OP_GET_NTOKEN = 1; + public static final int OP_LIST_DOMAINS = 2; + + private static int tokenMinExpiryTime = 1800; + private static final String UNIX_SOCKET_FNAME = "/var/run/sia/sia.ds"; + private static final String ROOT_DIR = "/home/athenz"; + private static final Authority PRINCIPAL_AUTHORITY = new PrincipalAuthority(); + + // Used for testing: if set, should point to the config file containing vars specifying + // the ntoken is in a file. + static final String SIA_PROP_CFG_FILE = "athenz.sia.client.config_path"; + + // vars used to set the config file + static final String SIACLT_NTOKEN_PATH = "ntoken_path"; + static final String SIACLT_NTOKEN_DOMAIN = "ntoken_domain"; + static final String SIACLT_NTOKEN_SERVICE = "ntoken_service"; + + // system property vars + static final String SIA_PROP_NTOKEN_PATH = "athenz.sia.client.ntoken_path"; + static final String SIA_PROP_NTOKEN_DOMAIN = "athenz.sia.client.ntoken_domain"; + static final String SIA_PROP_NTOKEN_SERVICE = "athenz.sia.client.ntoken_service"; + + static ConcurrentHashMap principalTokenCache = new ConcurrentHashMap<>(); + + // values obtained from the system properties and config file + // + static String cfgNtokenPath = null; + static String cfgNtokenDomain = null; + static String cfgNtokenService = null; + + final static String CONF_PATH = "/conf/sia_java_client/sia_client.conf"; + + static { + initConfigVars(); + } + + static void initConfigVars() { + String ntokenPath = null; + String ntokenDomain = null; + String ntokenSvc = null; + + // load the config vars. in case of any exceptions + // we'll just set our config variables to null and default to using + // SIA Server for principal tokens + + Struct configVars = null; + try { + String confFile = System.getProperty(SIA_PROP_CFG_FILE); + if (confFile == null) { + String rootDir = System.getenv("ROOT"); + if (null == rootDir) { + rootDir = File.separator + "home" + File.separator + "athenz"; + } + confFile = rootDir + CONF_PATH; + } + + Path path = Paths.get(confFile); + configVars = JSON.fromBytes(Files.readAllBytes(path), Struct.class); + + setupConfigVars(configVars.getString(SIACLT_NTOKEN_PATH), + configVars.getString(SIACLT_NTOKEN_DOMAIN), + configVars.getString(SIACLT_NTOKEN_SERVICE)); + } catch (Exception exc) { + LOG.error("SIACLT: config variable initialization failure. Will use SIA Server for Principal Tokens", exc); + cfgNtokenPath = null; + cfgNtokenDomain = null; + cfgNtokenService = null; + return; + } + + // load the System properties + // if set, they over-ride the config variables. in case of any exceptions + // we'll just set our config variables to null and default to using + // SIA Server for principal tokens + + try { + ntokenPath = System.getProperty(SIA_PROP_NTOKEN_PATH); + ntokenDomain = System.getProperty(SIA_PROP_NTOKEN_DOMAIN); + ntokenSvc = System.getProperty(SIA_PROP_NTOKEN_SERVICE); + } catch (Exception exc) { + LOG.error("SIACLT: system property initialization failure. Will use SIA Server for Principal Tokens", exc); + cfgNtokenPath = null; + cfgNtokenDomain = null; + cfgNtokenService = null; + return; + } + + if (ntokenPath == null || ntokenPath.isEmpty()) { + ntokenPath = cfgNtokenPath; + } + if (ntokenDomain == null || ntokenDomain.isEmpty()) { + ntokenDomain = cfgNtokenDomain; + } + if (ntokenSvc == null || ntokenSvc.isEmpty()) { + ntokenSvc = cfgNtokenService; + } + setupConfigVars(ntokenPath, ntokenDomain, ntokenSvc); + } + + static void setupConfigVars(String ntokenPath, String ntokenDomain, String ntokenSvc) throws IllegalArgumentException { + + if (LOG.isDebugEnabled()) { + LOG.debug("SIACLT:setupConfigVars: ntoken path=" + ntokenPath + + " domain=" + ntokenDomain + " service=" + ntokenSvc); + } + + // make sure no empty strings(ie. "") were specified + // + if (ntokenPath != null && ntokenPath.isEmpty()) { + cfgNtokenPath = null; + } else { + cfgNtokenPath = ntokenPath; + } + + if (ntokenDomain != null) { + if (ntokenDomain.isEmpty()) { + cfgNtokenDomain = null; + } else { + cfgNtokenDomain = ntokenDomain.toLowerCase(); + } + } + + if (ntokenSvc != null) { + if (ntokenSvc.isEmpty()) { + cfgNtokenService = null; + } else { + cfgNtokenService = ntokenSvc.toLowerCase(); + } + } + + if (!((cfgNtokenPath == null && cfgNtokenDomain == null && cfgNtokenService == null) || + (cfgNtokenPath != null && cfgNtokenDomain != null && cfgNtokenService != null))) { + String errMsg = "SIACLT: invalid ntoken configuration settings: " + + "ntoken_path, ntoken_domain, ntoken_service must all be set " + + "to use the client in a managed Athenz enabled environment"; + LOG.error(errMsg); + throw new IllegalArgumentException(errMsg); + } + + // build the service only if we have configured valid values + + if (cfgNtokenDomain != null) { + StringBuilder sb = new StringBuilder(512); + sb.append(cfgNtokenDomain).append(".").append(cfgNtokenService); + cfgNtokenService = sb.toString(); + } + } + + public SIAClient() { + } + + String siaSocketFile() { + + String root = System.getenv("ROOT"); + if (root == null) { + root = ROOT_DIR; + } + + return root + UNIX_SOCKET_FNAME; + } + + String getPrincipalTokenCacheKey(String domainName, String serviceName) { + + StringBuilder cacheKey = new StringBuilder(512); + cacheKey.append(domainName); + cacheKey.append("."); + cacheKey.append(serviceName); + return cacheKey.toString(); + } + + boolean isExpiredToken(long expiryTime, Integer minExpiryTime, Integer maxExpiryTime) { + + // we'll first make sure if we're given both min and max expiry + // times then both conditions are satisfied + + if (minExpiryTime != null && expiryTime < minExpiryTime) { + return true; + } + + if (maxExpiryTime != null && expiryTime > maxExpiryTime) { + return true; + } + + // if both limits were null then we need to make sure + // that our token is valid for our min configured value + + if (minExpiryTime == null && maxExpiryTime == null && expiryTime < tokenMinExpiryTime) { + return true; + } + + return false; + } + + PrincipalToken lookupPrincipalTokenInCache(String cacheKey, Integer minExpiryTime, Integer maxExpiryTime) { + + PrincipalToken principalToken = principalTokenCache.get(cacheKey); + if (principalToken == null) { + return null; + } + + // before returning our cache hit we need to make sure it + // satisfies the time requirements as specified by the client + + long expiryTime = principalToken.getExpiryTime() - (System.currentTimeMillis() / 1000); + + if (isExpiredToken(expiryTime, minExpiryTime, maxExpiryTime)) { + principalTokenCache.remove(cacheKey); + return null; + } + + return principalToken; + } + + int readResponseData(InputStream is, byte[] data) throws IOException { + + int read; + int offset = 0; + int length = data.length; + + while (true) { + read = is.read(data, offset, length); + if (read == -1) { + break; + } + + offset += read; + length -= read; + + if (length == 0) { + break; + } + } + + return offset; + } + + Socket getSIADomainSocket() throws IOException { + File socketFile = new File(siaSocketFile()); + AFUNIXSocket sock = AFUNIXSocket.newInstance(); + try { + sock.connect(new AFUNIXSocketAddress(socketFile)); + } catch (AFUNIXSocketException e) { + throw e; + } + return sock; + } + + String processRequest(Socket sock, int sia_op, byte[] data) throws IOException { + + String response = null; + try (InputStream is = sock.getInputStream(); + OutputStream os = sock.getOutputStream()) { + + // first we are going to write our magic number + + ByteBuffer dsBytes = ByteBuffer.allocate(4); + dsBytes.order(ByteOrder.LITTLE_ENDIAN); + dsBytes.putInt(0x534941); + os.write(dsBytes.array()); + + // next we are going to write our operation code + + dsBytes.clear(); + dsBytes.putInt(sia_op); + os.write(dsBytes.array()); + + // next write the length of our data which should be 4 bytes + + dsBytes.clear(); + dsBytes.putInt(data != null ? data.length : 0); + os.write(dsBytes.array()); + + // now write our data + + if (data != null) { + os.write(data); + } + + os.flush(); + + // first read the response status + + byte[] retCodeBytes = new byte[4]; + int read = readResponseData(is, retCodeBytes); + if (read != 4) { + throw new IOException("Unable to read response return code"); + } + + ByteBuffer retBytes = ByteBuffer.wrap(retCodeBytes); + retBytes.order(ByteOrder.LITTLE_ENDIAN); + int retCode = retBytes.getInt(); + + if (retCode != 0) { + throw new IOException("Server failed to process request - error: " + retCode); + } + + // next read the response length + + byte[] dataSize = new byte[4]; + read = readResponseData(is, dataSize); + if (read != 4) { + throw new IOException("Unable to read response length"); + } + + ByteBuffer dataBytes = ByteBuffer.wrap(dataSize); + dataBytes.order(ByteOrder.LITTLE_ENDIAN); + int dataLen = dataBytes.getInt(); + + // now read the rest of the data + + byte[] buf = new byte[dataLen]; + read = readResponseData(is, buf); + if (read != dataLen) { + throw new IOException("Read partial data: " + read + " vs. " + dataLen); + } + + response = new String(buf, "UTF-8"); + } + + return response; + } + + byte[] tokenRequestBuilder(String domainName, String serviceName, Integer maxExpiryTime) { + + StringBuilder reqBuilder = new StringBuilder(512); + reqBuilder.append("d="); + reqBuilder.append(domainName); + reqBuilder.append(",s="); + reqBuilder.append(serviceName); + if (maxExpiryTime != null) { + reqBuilder.append(",e="); + reqBuilder.append(maxExpiryTime); + } + return reqBuilder.toString().getBytes(StandardCharsets.UTF_8); + } + + String getSIAPrincipalToken(String domainName, String serviceName, Integer maxExpiryTime) throws IOException { + + byte[] req = tokenRequestBuilder(domainName, serviceName, maxExpiryTime); + + String token = null; + Socket sock = null; + try { + sock = getSIADomainSocket(); + token = processRequest(sock, OP_GET_NTOKEN, req); + } finally { + if (sock != null) { + sock.close(); + } + } + + return token; + } + + /** + * For the specified domain/service return the corresponding Service Principal that + * includes the SIA generated PrincipalToken (NToken) + * @param domainName name of the domain + * @param serviceName name of the service + * @param minExpiryTime (optional) specifies that the returned PrincipalToken must be + * at least valid (min/lower bound) for specified number of seconds, + * @param maxExpiryTime (optional) specifies that the returned PrincipalToken must be + * at most valid (max/upper bound) for specified number of seconds. + * @param ignoreCache ignore the cache and retrieve the token from SIA Server + * @return SIA generated Principal object with PrincipalToken + * @throws IOException for IO errors + */ + public Principal getServicePrincipal(String domainName, String serviceName, + Integer minExpiryTime, Integer maxExpiryTime, boolean ignoreCache) + throws IOException { + + if (domainName == null || domainName.isEmpty() || + serviceName == null || serviceName.isEmpty()) { + + String errMsg = "get service principal: both domain and service names are required"; + LOG.error("SIACLT: " + errMsg); + throw new IOException(errMsg); + } + + // normalize our domain and service names to lower case + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + + // first lookup in our cache to see if it can be satisfied + // only if we're not asked to ignore the cache + + String nToken = null; + String cacheKey = getPrincipalTokenCacheKey(domainName, serviceName); + if (!ignoreCache) { + PrincipalToken principalToken = lookupPrincipalTokenInCache(cacheKey, minExpiryTime, maxExpiryTime); + if (principalToken != null) { + nToken = principalToken.getSignedToken(); + } + } + + if (nToken == null) { + + // get ntoken from file path if configured, else retrieve from SIA server + // + if (cfgNtokenPath != null) { + nToken = getFilePrincipalToken(domainName, serviceName); + } else { + + // retrieve a new PrincipalToken from SIA Server if we didn't + // satisfy the request from our cache + // + nToken = getSIAPrincipalToken(domainName, serviceName, maxExpiryTime); + + // create and put a new PrincipalToken object in the cache and + // return a newly created principal object + + PrincipalToken principalToken = new PrincipalToken(nToken); + principalTokenCache.put(cacheKey, principalToken); + } + } + + return SimplePrincipal.create(domainName, serviceName, nToken, PRINCIPAL_AUTHORITY); + } + + String getFilePrincipalToken(String domainName, String serviceName) throws IOException { + StringBuilder sb = new StringBuilder(512); + sb.append(domainName).append("."). append(serviceName); + String svc = sb.toString().toLowerCase(); + if (!svc.equals(cfgNtokenService)) { + String errMsg = "SIACLT: get ntoken from file: Unknown service=" + + svc + " Configured service=" + cfgNtokenService; + LOG.error(errMsg); + throw new IOException(errMsg); + } + + Path path = Paths.get(cfgNtokenPath); + String token = new String(Files.readAllBytes(path)); + if (token != null && !token.isEmpty()) { + token = token.trim(); + int index = token.indexOf('\n'); + if (index != -1) { + token = token.substring(0, index); + } + } + return token; + } + + /** + * Returns the list of domains that have private keys registered on this host + * @return List of domain names + * @throws IOException for any IO errors + */ + public ArrayList getDomainList() throws IOException { + + String domains = null; + Socket sock = null; + try { + sock = getSIADomainSocket(); + domains = processRequest(sock, OP_LIST_DOMAINS, null); + } finally { + if (sock != null) { + sock.close(); + } + } + + StringTokenizer st = new StringTokenizer(domains, ";"); + ArrayList domainList = new ArrayList(); + while (st.hasMoreTokens()) { + domainList.add(st.nextToken()); + } + + return domainList; + } +} diff --git a/clients/java/sia/src/test/java/com/yahoo/athenz/sia/impl/SIAClientTest.java b/clients/java/sia/src/test/java/com/yahoo/athenz/sia/impl/SIAClientTest.java new file mode 100644 index 00000000000..8eebf8c2caf --- /dev/null +++ b/clients/java/sia/src/test/java/com/yahoo/athenz/sia/impl/SIAClientTest.java @@ -0,0 +1,528 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.sia.impl; + +import java.io.File; +import java.io.Writer; +import java.io.OutputStreamWriter; +import java.io.FileOutputStream; +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.net.Socket; +import java.nio.ByteBuffer; +import java.nio.ByteOrder; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; + +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +import static org.testng.Assert.*; + +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.sia.impl.SIAClient; + +public class SIAClientTest { + + @Mock Socket mockSocket; + + @BeforeClass + public void setUp() throws Exception { + System.setProperty(SIAClient.SIA_PROP_NTOKEN_PATH, "src/test/resources/svc.ntoken"); + System.setProperty(SIAClient.SIA_PROP_NTOKEN_SERVICE, "storage"); + System.setProperty(SIAClient.SIA_PROP_CFG_FILE, "src/test/resources/testcfg.conf"); + + MockitoAnnotations.initMocks(this); + prepareNtokenFile("_test"); + } + + // writes an ntoken to the configured ntoken path + void prepareNtokenFile(String pathSuffix) throws Exception { + + // prepare the ntoken file + // ex: ntoken = "v=S1;d=athenz;n=storage;t=55555;e=57955;s=fake"; + String ntoken_path = System.getProperty(SIAClient.SIA_PROP_NTOKEN_PATH); + ntoken_path = ntoken_path + pathSuffix; + Path path = Paths.get(ntoken_path); + String token = new String(Files.readAllBytes(path)); + long curTimeSecs = System.currentTimeMillis() / 1000; + String curTime = Long.toString(curTimeSecs); + token = token.replaceFirst("55555", curTime); + curTimeSecs += 2400; + curTime = Long.toString(curTimeSecs); + token = token.replaceFirst("55555", curTime); + + // write it to the configured ntoken file + ntoken_path = System.getProperty(SIAClient.SIA_PROP_NTOKEN_PATH); + File file = new File(ntoken_path); + file.createNewFile(); + Writer fw = new OutputStreamWriter(new FileOutputStream(file)); + fw.write(token + "\n"); + fw.close(); + } + + @AfterMethod + public void cleanup() { + } + + @Test + public void testIsExpiredTokenSmallerThanMin() { + SIAClient client = new SIAClient(); + assertTrue(client.isExpiredToken(100, 200, null)); + } + + @Test + public void testIsExpiredTokenBiggerThanMax() { + SIAClient client = new SIAClient(); + assertTrue(client.isExpiredToken(500, null, 300)); + assertTrue(client.isExpiredToken(500, 200, 300)); + } + + @Test + public void testIsExpiredTokenAtLeastOneLimitIsNotNull() { + SIAClient client = new SIAClient(); + assertFalse(client.isExpiredToken(500, null, 600)); + assertFalse(client.isExpiredToken(500, 200, null)); + assertFalse(client.isExpiredToken(500, 200, 501)); + } + + @Test + public void testIsExpiredTokenAtLeastBothLimitsNullSmallerThanMin() { + // the min is 1800 + SIAClient client = new SIAClient(); + assertTrue(client.isExpiredToken(1700, null, null)); + } + + @Test + public void testIsExpiredTokenAtLeastBothLimitsNullBiggerThanMin() { + // the min is 1800 + SIAClient client = new SIAClient(); + assertFalse(client.isExpiredToken(2100, null, null)); + } + + @Test + public void testGetPrincipalTokenCacheKey() { + SIAClient client = new SIAClient(); + assertEquals(client.getPrincipalTokenCacheKey("coretech", "service"), "coretech.service"); + assertEquals(client.getPrincipalTokenCacheKey(null, "service"), "null.service"); + assertEquals(client.getPrincipalTokenCacheKey("coretech", null), "coretech.null"); + } + + @Test + public void testSiaSocketFile() { + SIAClient client = new SIAClient(); + assertEquals(client.siaSocketFile(), "/home/athenz/var/run/sia/sia.ds"); + } + + @Test + public void testLookupPrincipalTokenInCacheNotPresent() { + SIAClient client = new SIAClient(); + + String cacheKey = "coretech.notpresent"; + assertNull(client.lookupPrincipalTokenInCache(cacheKey, null, null)); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupPrincipalTokenInCacheExpired() { + + SIAClient client = new SIAClient(); + + String cacheKey = "coretech.storage"; + PrincipalToken token = new PrincipalToken.Builder("S1", "coretech", "storage") + .issueTime((System.currentTimeMillis() / 1000)).expirationWindow(1000).build(); + client.principalTokenCache.put(cacheKey, token); + + assertNull(client.lookupPrincipalTokenInCache(cacheKey, 3000, 4000)); + assertNull(client.lookupPrincipalTokenInCache(cacheKey, 500, 800)); + + client.principalTokenCache.clear(); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupPrincipalTokenInCache() { + + SIAClient client = new SIAClient(); + + String cacheKey = "coretech.storage"; + PrincipalToken token = new PrincipalToken.Builder("S1", "coretech", "storage") + .issueTime((System.currentTimeMillis() / 1000)).expirationWindow(3500).build(); + client.principalTokenCache.put(cacheKey, token); + + assertNotNull(client.lookupPrincipalTokenInCache(cacheKey, 3000, 4000)); + + client.principalTokenCache.clear(); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupPrincipalTokenInCacheSecondClient() { + + SIAClient client = new SIAClient(); + + String cacheKey = "coretech.storage"; + PrincipalToken token = new PrincipalToken.Builder("S1", "coretech", "storage") + .issueTime((System.currentTimeMillis() / 1000)).expirationWindow(3500).build(); + client.principalTokenCache.put(cacheKey, token); + + assertNotNull(client.lookupPrincipalTokenInCache(cacheKey, 3000, 4000)); + + // now let's get another client + + SIAClient client1 = new SIAClient(); + assertNotNull(client1.lookupPrincipalTokenInCache(cacheKey, 3000, 4000)); + + client.principalTokenCache.clear(); + } + + @Test + public void testProcessRequestDomainList() throws IOException { + + ByteBuffer statusBuf = ByteBuffer.allocate(4); + statusBuf.order(ByteOrder.LITTLE_ENDIAN); + statusBuf.putInt(0); + byte[] status = statusBuf.array(); + + ByteBuffer sizeBuf = ByteBuffer.allocate(4); + sizeBuf.order(ByteOrder.LITTLE_ENDIAN); + sizeBuf.putInt(15); + byte[] size = sizeBuf.array(); + + byte[] list = "domain1,domain2".getBytes(); + + byte[] data = new byte[status.length + size.length + list.length]; + + System.arraycopy(status, 0, data, 0, status.length); + System.arraycopy(size, 0, data, status.length, size.length); + System.arraycopy(list, 0, data, status.length + size.length, list.length); + + InputStream inputStream = new ByteArrayInputStream(data); + OutputStream outputStream = new ByteArrayOutputStream(); + + SIAClient mockSIAClient = Mockito.mock(SIAClient.class); + Mockito.when(mockSIAClient.getSIADomainSocket()).thenReturn(mockSocket); + Mockito.when(mockSocket.getInputStream()).thenReturn(inputStream); + Mockito.when(mockSocket.getOutputStream()).thenReturn(outputStream); + + SIAClient siaClient = new SIAClient(); + String domains = null; + try { + domains = siaClient.processRequest(mockSocket, SIAClient.OP_LIST_DOMAINS, null); + } catch (IOException e) { + e.printStackTrace(); + fail(); + } + assertEquals(domains, "domain1,domain2"); + } + + @Test + public void testProcessRequestPrincipalToken() throws IOException { + + ByteBuffer statusBuf = ByteBuffer.allocate(4); + statusBuf.order(ByteOrder.LITTLE_ENDIAN); + statusBuf.putInt(0); + byte[] status = statusBuf.array(); + + ByteBuffer sizeBuf = ByteBuffer.allocate(4); + sizeBuf.order(ByteOrder.LITTLE_ENDIAN); + sizeBuf.putInt(36); + byte[] size = sizeBuf.array(); + + byte[] token = "v=S1;d=coretech;n=storage;k=0;s=fake".getBytes(); + + byte[] data = new byte[status.length + size.length + token.length]; + + System.arraycopy(status, 0, data, 0, status.length); + System.arraycopy(size, 0, data, status.length, size.length); + System.arraycopy(token, 0, data, status.length + size.length, token.length); + + InputStream inputStream = new ByteArrayInputStream(data); + OutputStream outputStream = new ByteArrayOutputStream(); + + SIAClient mockSIAClient = Mockito.mock(SIAClient.class); + Mockito.when(mockSIAClient.getSIADomainSocket()).thenReturn(mockSocket); + Mockito.when(mockSocket.getInputStream()).thenReturn(inputStream); + Mockito.when(mockSocket.getOutputStream()).thenReturn(outputStream); + + SIAClient siaClient = new SIAClient(); + String ntoken = null; + try { + ntoken = siaClient.processRequest(mockSocket, SIAClient.OP_GET_NTOKEN, "d=coretech,n=storage,e=1800".getBytes()); + } catch (IOException e) { + e.printStackTrace(); + fail(); + } + assertEquals(ntoken, "v=S1;d=coretech;n=storage;k=0;s=fake"); + } + + @SuppressWarnings("static-access") + @Test + public void testGetServicePrincipal() throws IOException { + + SIAClient client = new SIAClient(); + + String cacheKey = "coretech.storage"; + String nToken = "v=S1;d=coretech;n=storage;t=" + (System.currentTimeMillis() / 1000) + + ";e=" + ((System.currentTimeMillis() / 1000) + 3500) + ";k=0;s=fake"; + PrincipalToken token = new PrincipalToken(nToken); + client.principalTokenCache.put(cacheKey, token); + + Principal principal = client.getServicePrincipal("coretech", "storage", null, null, false); + assertNotNull(principal); + assertEquals(principal.getDomain(), "coretech"); + assertEquals(principal.getName(), "storage"); + + client.principalTokenCache.clear(); + } + + @SuppressWarnings("static-access") + @Test + public void testGetServicePrincipalMixedCase() throws IOException { + + SIAClient client = new SIAClient(); + + String cacheKey = "coretech.storage"; + String nToken = "v=S1;d=coretech;n=storage;t=" + (System.currentTimeMillis() / 1000) + + ";e=" + ((System.currentTimeMillis() / 1000) + 3500) + ";k=0;s=fake"; + PrincipalToken token = new PrincipalToken(nToken); + client.principalTokenCache.put(cacheKey, token); + + Principal principal = client.getServicePrincipal("CoreTech", "Storage", null, null, false); + assertNotNull(principal); + assertEquals(principal.getDomain(), "coretech"); + assertEquals(principal.getName(), "storage"); + + client.principalTokenCache.clear(); + } + + @Test (groups = "tokenfileA") + public void testGetServicePrincipalTokenFile() { + SIAClient client = new SIAClient(); + String domain = "athenz"; + String service = "storage"; + // Configured service=athenz.storage + try { + client.getServicePrincipal(domain, service, 500, 3600, false); + } catch (java.io.IOException exc) { + fail("getServicePrincipal"); + } + } + + @Test (groups = "tokenfileA") + public void testGetServicePrincipalTokenFileWrongDomain() { + SIAClient client = new SIAClient(); + String domain = "test.aaa"; + String service = "storage"; + String fullSvc = domain + "." + service; + // Configured service=athenz.storage + try { + client.getServicePrincipal(domain, service, 500, 3600, false); + fail("getServicePrincipal"); + } catch (java.io.IOException exc) { + assertTrue(exc.getMessage().contains("get ntoken from file: Unknown service=" + fullSvc), exc.getMessage()); + } + } + + @Test (groups = "tokenfileA") + public void testGetServicePrincipalTokenFileWrongService() { + SIAClient client = new SIAClient(); + String domain = "athenz"; + String service = "destroyage"; + String fullSvc = domain + "." + service; + // Configured service=athenz.storage + try { + client.getServicePrincipal(domain, service, 500, 3600, false); + fail("getServicePrincipal"); + } catch (java.io.IOException exc) { + assertTrue(exc.getMessage().contains("get ntoken from file: Unknown service=" + fullSvc), exc.getMessage()); + } + } + + @Test (dependsOnGroups = "tokenfileA") + public void testGetServicePrincipalTokenFileEmptyConfigMissingDomainProperty() throws java.io.IOException { + System.setProperty(SIAClient.SIA_PROP_CFG_FILE, "src/test/resources/testcfg_empty.conf"); + try { + SIAClient.initConfigVars(); + SIAClient client = new SIAClient(); + String domain = "athenz"; + String service = "storage"; + // Configured service=athenz.storage + client.getServicePrincipal(domain, service, 500, 3600, false); + fail("getServicePrincipal"); + } catch (java.lang.IllegalArgumentException exc) { + assertTrue(exc.getMessage().contains("SIACLT: invalid ntoken configuration settings"), exc.getMessage()); + } + } + + @Test (dependsOnMethods={"testGetServicePrincipalTokenFileEmptyConfigMissingDomainProperty"}) + public void testGetServicePrincipalTokenFileEmptyConfig() { + System.setProperty(SIAClient.SIA_PROP_NTOKEN_DOMAIN, "athenz"); + System.setProperty(SIAClient.SIA_PROP_CFG_FILE, "src/test/resources/testcfg_empty.conf"); + SIAClient.initConfigVars(); + SIAClient client = new SIAClient(); + String domain = "athenz"; + String service = "storage"; + // Configured service=athenz.storage + try { + client.getServicePrincipal(domain, service, 500, 3600, false); + } catch (java.io.IOException exc) { + fail("getServicePrincipal"); + } + } + + @Test + public void testTokenRequestBuilder() { + SIAClient client = new SIAClient(); + assertEquals("d=test,s=db".getBytes(StandardCharsets.UTF_8), client.tokenRequestBuilder("test", "db", null)); + assertEquals("d=test,s=db,e=100".getBytes(StandardCharsets.UTF_8), client.tokenRequestBuilder("test", "db", new Integer(100))); + assertEquals("d=null,s=db,e=100".getBytes(StandardCharsets.UTF_8), client.tokenRequestBuilder(null, "db", new Integer(100))); + assertEquals("d=test,s=null,e=100".getBytes(StandardCharsets.UTF_8), client.tokenRequestBuilder("test", null, new Integer(100))); + assertEquals("d=null,s=null,e=100".getBytes(StandardCharsets.UTF_8), client.tokenRequestBuilder(null, null, new Integer(100))); + } + + private class SIATestClient extends SIAClient { + + @Override + Socket getSIADomainSocket() throws IOException { + return null; + } + + @Override + String processRequest(Socket sock, int sia_op, byte[] data) throws IOException { + String result = null; + switch (sia_op) { + case SIAClient.OP_LIST_DOMAINS: + result = "test;hoge;athenz"; + break; + case SIAClient.OP_GET_NTOKEN: + result = "v=S1;d=coretech;n=storage;k=0;s=fake"; + break; + } + return result; + } + } + + @Test + public void testGetServicePrincipalNullExpiry() throws IOException { + + // we need to make sure not to use our ntoken path which doesn't + // call the expected get service principal api. so we're going + // to save the value and and then restore it after the test case + + String ntoken_path = SIAClient.cfgNtokenPath; + SIAClient.cfgNtokenPath = null; + + SIAClient client = new SIATestClient(); + + Principal principal = client.getServicePrincipal("coretech", "storage", 500, null, false); + assertNotNull(principal); + assertEquals(principal.getDomain(), "coretech"); + assertEquals(principal.getName(), "storage"); + + // restore the property + + SIAClient.cfgNtokenPath = ntoken_path; + } + + @Test + public void testGetDomainList() throws IOException { + SIAClient client = new SIATestClient(); + ArrayList result = client.getDomainList(); + assertNotNull(result); + assertEquals(result.toString(), "[test, hoge, athenz]"); + } + + @Test + public void testGetServicePrincipalException() throws Exception { + SIAClient client = new SIATestClient(); + + try { + client.getServicePrincipal(null, null, 0, 3600, true); + fail(); + } catch (IOException e) { + } + + SIATestClient.cfgNtokenPath = null; + Principal p = client.getServicePrincipal("test", "hoge", 0, 3600, true); + + assertNotNull(p); + assertEquals(p.getDomain(), "test"); + assertEquals(p.getName(), "hoge"); + + SIATestClient.cfgNtokenPath = "src/test/resources/svc.ntoken"; + } + + @Test + public void testGetFilePrincipalTokenIlligalFile() throws IOException{ + SIAClient client = new SIATestClient(); + + SIATestClient.cfgNtokenPath = "src/test/resources/dummy.ntoken"; + String s = client.getFilePrincipalToken("athenz", "storage"); + + assertEquals(s, ""); + } + + @Test + public void testReadResponseData() throws IOException { + SIAClient client = new SIATestClient(); + + byte[] dummy = { (byte) 0x47, (byte) 0x4e, (byte) 0x54, (byte) 0x2d, (byte) 0x30, (byte) 0x30, (byte) 0x30, + (byte) 0x30 }; + InputStream is = Mockito.mock(InputStream.class); + + Mockito.when(is.read(dummy, 0, dummy.length)).thenReturn(1); + Mockito.when(is.read(dummy, 1, dummy.length - 1)).thenReturn(-1); + + int check = client.readResponseData(is, dummy); + assertEquals(check, 1); + + Mockito.when(is.read(dummy, 0, dummy.length)).thenReturn(-1); + + check = client.readResponseData(is, dummy); + assertEquals(check, 0); + } + + @Test + public void testInitConfigVarsIlligalCFGflag() throws Exception { + + System.clearProperty(SIAClient.SIA_PROP_CFG_FILE); + + SIAClient.initConfigVars(); + assertNull(SIATestClient.cfgNtokenPath); + assertNull(SIATestClient.cfgNtokenDomain); + assertNull(SIATestClient.cfgNtokenService); + } + + @Test + public void testSetConfigVarsIlligal() throws Exception { + + SIAClient.setupConfigVars(null, null, null); + assertNull(SIATestClient.cfgNtokenDomain); + assertNull(SIATestClient.cfgNtokenService); + } +} diff --git a/clients/java/sia/src/test/resources/dummy.ntoken b/clients/java/sia/src/test/resources/dummy.ntoken new file mode 100644 index 00000000000..e69de29bb2d diff --git a/clients/java/sia/src/test/resources/logback.xml b/clients/java/sia/src/test/resources/logback.xml new file mode 100644 index 00000000000..2ce05abfc06 --- /dev/null +++ b/clients/java/sia/src/test/resources/logback.xml @@ -0,0 +1,17 @@ + + + + + System.out + + %d{HH:mm:ss.SSS} [%thread] %-5level %class - %msg%n + + + + + + + + + + diff --git a/clients/java/sia/src/test/resources/svc.ntoken_test b/clients/java/sia/src/test/resources/svc.ntoken_test new file mode 100644 index 00000000000..fae27937dd9 --- /dev/null +++ b/clients/java/sia/src/test/resources/svc.ntoken_test @@ -0,0 +1 @@ +v=S1;d=athenz;n=storage;t=55555;e=55555;s=fake diff --git a/clients/java/sia/src/test/resources/testcfg.conf b/clients/java/sia/src/test/resources/testcfg.conf new file mode 100644 index 00000000000..e2f1d311202 --- /dev/null +++ b/clients/java/sia/src/test/resources/testcfg.conf @@ -0,0 +1,6 @@ +{ + "ntoken_path": "/map/to/the/stars", + "ntoken_domain": "athenz", + "ntoken_service": "how_much_to_tip" +} + diff --git a/clients/java/sia/src/test/resources/testcfg_empty.conf b/clients/java/sia/src/test/resources/testcfg_empty.conf new file mode 100644 index 00000000000..b23ba173dfd --- /dev/null +++ b/clients/java/sia/src/test/resources/testcfg_empty.conf @@ -0,0 +1,6 @@ +{ + "ntoken_path": "", + "ntoken_domain": "", + "ntoken_service": "" +} + diff --git a/clients/java/zms/README.md b/clients/java/zms/README.md new file mode 100644 index 00000000000..7f438730bc9 --- /dev/null +++ b/clients/java/zms/README.md @@ -0,0 +1,23 @@ +zms-java-client +=============== + +A Java client library to access the ZMS server. +The client library encapsulates the stub generated from the ZMS RDL. +It includes zms-core and all other dependencies. + +--- Connection Timeouts --- + +Default read and connect timeout values for ZMS Client connections +are 30000ms (30sec). The application can change these values by using +the following system properties: + + * athenz.zms.client.read_timeout + * athenz.zms.client.connect_timeout + +The values specified for timeouts must be in milliseconds. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/clients/java/zms/pom.xml b/clients/java/zms/pom.xml new file mode 100644 index 00000000000..fe6730a43c2 --- /dev/null +++ b/clients/java/zms/pom.xml @@ -0,0 +1,227 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../../pom.xml + + + zms_java_client + jar + zms-java-client + ZMS Java Client Library + + + + ${project.groupId} + zms_core + ${project.parent.version} + + + ${project.groupId} + client_common + ${project.parent.version} + + + ${project.groupId} + auth_core + ${project.parent.version} + + + org.glassfish.jersey.media + jersey-media-json-jackson + ${jersey.version} + + + com.fasterxml.jackson.core + jackson-annotations + + + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + org.glassfish.jersey.core + jersey-client + ${jersey.version} + + + + + + + org.codehaus.mojo + exec-maven-plugin + 1.1.1 + + + + exec + + generate-sources + + + + bash + + scripts/make_stubs.sh + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 2.10.4 + + + prepare-package + + jar + + + + + + + org.apache.maven.plugins + maven-shade-plugin + 2.3 + + + package + + shade + + + + + + + org.glassfish.hk2 + org.glassfish.hk2.external + org.glassfish.jersey + org.glassfish.jersey.ext + org.glassfish.jersey.core + org.glassfish.jersey.media + org.glassfish.jersey.bundles.repackaged + com.fasterxml.jackson.core + com.fasterxml.jackson.jaxrs + com.fasterxml.jackson.module + javax.ws.rs + javax.annotation + javax.inject + jersey.repackaged.com.google.common + org.aopalliance + + + + + javax.inject + athenz.shade.zms.javax.inject + + + org.aopalliance + athenz.shade.zms.org.aopalliance + + + jersey.repackaged.com.google.common + athenz.shade.zms.jersey.repackaged.com.google.common + + + javax.ws.rs + athenz.shade.zms.javax.ws.rs + + + javax.annotation + athenz.shade.zms.javax.annotation + + + org.glassfish.jersey + athenz.shade.zms.org.glassfish.jersey + + + org.glassfish.hk2 + athenz.shade.zms.org.glassfish.hk2 + + + org.glassfish.hk2.external + athenz.shade.zms.org.glassfish.hk2.external + + + org.jvnet.hk2 + athenz.shade.zms.org.jvnet.hk2 + + + org.jvnet.tiger_types + athenz.shade.zms.org.jvnet.tiger_types + + + com.fasterxml.jackson + athenz.shade.zms.com.fasterxml.jackson + + + + + *:* + + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + + + + + + + + + + coverage + + + coverage + + + + + + com.atlassian.maven.plugins + maven-clover2-plugin + 4.0.4 + + 1.8 + ${HOME}/license/clover.license + + + **/ZMSRDLGeneratedClient.java + + + + + + + + + diff --git a/clients/java/zms/scripts/make_stubs.sh b/clients/java/zms/scripts/make_stubs.sh new file mode 100755 index 00000000000..969f6049a07 --- /dev/null +++ b/clients/java/zms/scripts/make_stubs.sh @@ -0,0 +1,24 @@ +#!/bin/bash + +# If the zms_core dependency has been updated, then this script should be run +# manually to pick up the latest rdl to generate the appropriate client library + +# Note this script is dependent on the rdl utility. +# go get github.com/ardielle/ardielle-tools/... + +command -v rdl >/dev/null 2>&1 || { + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "SOURCE WARNING"; + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "Please install rdl utility: go get github.com/ardielle/ardielle-tools/..."; + echo >&2 "Skipping source generation..."; + exit 0; +} + +RDL_FILE=../../../core/zms/src/main/rdl/ZMS.rdl + +echo "Generate the client library..." +rdl -s generate -o src/main/java -x clientclass=ZMSRDLGenerated java-client $RDL_FILE + +# Copyright 2016 Yahoo Inc. +# Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. diff --git a/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ResourceError.java b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ResourceError.java new file mode 100644 index 00000000000..231c7abdf9d --- /dev/null +++ b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ResourceError.java @@ -0,0 +1,24 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +public class ResourceError { + + public int code; + public String message; + + public ResourceError code(int code) { + this.code = code; + return this; + } + public ResourceError message(String message) { + this.message = message; + return this; + } + + public String toString() { + return "{code: " + code + ", message: \"" + message + "\"}"; + } + +} diff --git a/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ResourceException.java b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ResourceException.java new file mode 100644 index 00000000000..a76e476ac22 --- /dev/null +++ b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ResourceException.java @@ -0,0 +1,79 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +public class ResourceException extends RuntimeException { + public final static int OK = 200; + public final static int CREATED = 201; + public final static int ACCEPTED = 202; + public final static int NO_CONTENT = 204; + public final static int MOVED_PERMANENTLY = 301; + public final static int FOUND = 302; + public final static int SEE_OTHER = 303; + public final static int NOT_MODIFIED = 304; + public final static int TEMPORARY_REDIRECT = 307; + public final static int BAD_REQUEST = 400; + public final static int UNAUTHORIZED = 401; + public final static int FORBIDDEN = 403; + public final static int NOT_FOUND = 404; + public final static int CONFLICT = 409; + public final static int GONE = 410; + public final static int PRECONDITION_FAILED = 412; + public final static int UNSUPPORTED_MEDIA_TYPE = 415; + public final static int INTERNAL_SERVER_ERROR = 500; + public final static int NOT_IMPLEMENTED = 501; + + public final static int SERVICE_UNAVAILABLE = 503; + + public static String codeToString(int code) { + switch (code) { + case OK: return "OK"; + case CREATED: return "Created"; + case ACCEPTED: return "Accepted"; + case NO_CONTENT: return "No Content"; + case MOVED_PERMANENTLY: return "Moved Permanently"; + case FOUND: return "Found"; + case SEE_OTHER: return "See Other"; + case NOT_MODIFIED: return "Not Modified"; + case TEMPORARY_REDIRECT: return "Temporary Redirect"; + case BAD_REQUEST: return "Bad Request"; + case UNAUTHORIZED: return "Unauthorized"; + case FORBIDDEN: return "Forbidden"; + case NOT_FOUND: return "Not Found"; + case CONFLICT: return "Conflict"; + case GONE: return "Gone"; + case PRECONDITION_FAILED: return "Precondition Failed"; + case UNSUPPORTED_MEDIA_TYPE: return "Unsupported Media Type"; + case INTERNAL_SERVER_ERROR: return "Internal Server Error"; + case NOT_IMPLEMENTED: return "Not Implemented"; + default: return "" + code; + } + } + + int code; + Object data; + + public ResourceException(int code) { + this(code, new ResourceError().code(code).message(codeToString(code))); + } + + public ResourceException(int code, Object data) { + super("ResourceException (" + code + "): " + data); + this.code = code; + this.data = data; + } + + public int getCode() { + return code; + } + + public Object getData() { + return data; + } + + public T getData(Class cl) { + return cl.cast(data); + } + +} diff --git a/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSAuthorizer.java b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSAuthorizer.java new file mode 100644 index 00000000000..c503167f969 --- /dev/null +++ b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSAuthorizer.java @@ -0,0 +1,139 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.io.Closeable; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.token.PrincipalToken; + +public class ZMSAuthorizer implements Authorizer, Closeable { + + String endpoint = null; + String serviceDomain = null; + protected ZMSClient client = null; + private static final Logger LOGGER = LoggerFactory.getLogger(ZMSAuthorizer.class); + private static final PrincipalAuthority PRINCIPAL_AUTHORITY = new PrincipalAuthority(); + + /** + * Constructs a new ZMSAuthorizer object with the given resource service domain + * name. The url for ZMS Server is automatically retrieved from the athenz + * configuration file (zms_url field). + * @param serviceDomain resource service domain name + */ + public ZMSAuthorizer(String serviceDomain) { + this(null, serviceDomain); + } + + /** + * Constructs a new ZMSAuthorizer object with the given ZMS Server endpoint and + * given resource service domain name + * @param endpoint ZMS Server url (e.g. http://server.athenzcompany.com:4443/zms/v1) + * @param serviceDomain resource service domain name + */ + public ZMSAuthorizer(String endpoint, String serviceDomain) { + this.endpoint = endpoint; + this.serviceDomain = serviceDomain; + client = new ZMSClient(this.endpoint); + } + + /** + * Close the ZMS Client object + */ + public void close() { + if (client != null) { + client.close(); + client = null; + } + } + + /** + * Set the authorizer to use the specified zms client object + * @param client ZMSClient object to use for authorization checks + */ + public void setZMSClient(ZMSClient client) { + // if we already have a client then we need to close it + close(); + this.client = client; + } + + /** + * Requests the ZMS to indicate whether or not the specific request for the + * specified resource with authentication details will be granted or not. + * @param action value of the action to be carried out (e.g. "UPDATE", "DELETE") + * @param resource resource value + * @param principalToken principal token (NToken) that will be authenticated and checked for + * requested access + * @param trustDomain (optional - usually null) if the access checks involves cross + * domain check only check the specified trusted domain and ignore all others + * @return boolean indicating whether or not the request will be granted or not + */ + public boolean access(String action, String resource, String principalToken, String trustDomain) { + PrincipalToken token = new PrincipalToken(principalToken); + Principal principal = SimplePrincipal.create(token.getDomain(), token.getName(), + token.getSignedToken(), 0, PRINCIPAL_AUTHORITY); + return access(action, resource, principal, trustDomain); + } + + /** + * Requests the ZMS to indicate whether or not the specific request for the + * specified resource with authentication details will be granted or not. + * @param action value of the action to be carried out (e.g. "UPDATE", "DELETE") + * @param resource resource value + * @param principal principal object that will be authenticated and checked for + * requested access + * @param trustDomain (optional - usually null) if the access checks involves cross + * domain check only check the specified trusted domain and ignore all others + * @return boolean indicating whether or not the request will be granted or not + */ + public boolean access(String action, String resource, Principal principal, String trustDomain) { + + //the "resource" may be an entity name here, we need a full resource name + + String rn = (resource.contains(":")) ? resource : serviceDomain + ":" + resource; + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("ZMSAuthorizer.access(" + action + ", " + rn + ", " + principal.getYRN() + + ", " + trustDomain + ")"); + } + + try { + client.addCredentials(principal); + return client.getAccess(action, rn, trustDomain).getGranted(); + } catch (ZMSClientException e) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("ZMSAuthorizer.access: " + e); + } + + switch (e.getCode()) { + case ZMSClientException.NOT_FOUND: + throw new ZMSClientException(ZMSClientException.FORBIDDEN, "Not found: " + rn); + default: + throw e; + } + } catch (Throwable th) { + th.printStackTrace(); + throw new ZMSClientException(ZMSClientException.FORBIDDEN, "Cannot contact ZMS"); + } + } +} diff --git a/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSClient.java b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSClient.java new file mode 100644 index 00000000000..18c29015e0c --- /dev/null +++ b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSClient.java @@ -0,0 +1,1691 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.io.Closeable; +import java.text.DateFormat; +import java.text.SimpleDateFormat; +import java.util.Map; +import java.util.List; +import java.util.Date; + +import org.glassfish.jersey.client.ClientProperties; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.common.config.AthenzConfig; +import com.yahoo.rdl.JSON; + +public class ZMSClient implements Closeable { + + private String zmsUrl = null; + private Principal principal = null; + private boolean principalCheckDone = false; + protected ZMSRDLGeneratedClient client = null; + + private static final String STR_ENV_ROOT = "ROOT"; + private static final String STR_DEF_ROOT = "/home/athenz"; + private static final String HTTP_RFC1123_DATE_FORMAT = "EEE, d MMM yyyy HH:mm:ss zzz"; + + public static final String ZMS_CLIENT_PROP_ATHENZ_CONF = "athenz.athenz_conf"; + public static final String ZMS_CLIENT_PROP_READ_TIMEOUT = "athenz.zms.client.read_timeout"; + public static final String ZMS_CLIENT_PROP_CONNECT_TIMEOUT = "athenz.zms.client.connect_timeout"; + + private static final Logger LOGGER = LoggerFactory.getLogger(ZMSClient.class); + private static final Authority PRINCIPAL_AUTHORITY = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + + /** + * Constructs a new ZMSClient object with media type set to application/json. + * The url for ZMS Server is automatically retrieved from the athenz_config + * package's configuration file (zms_url field). The client can only be used + * to retrieve objects from ZMS that do not require any authentication + * otherwise addCredentials method must be used to set the principal identity. + * Default read and connect timeout values are 30000ms (30sec). The application can + * change these values by using the yahoo.zms_java_client.read_timeout and + * yahoo.zms_java_client.connect_timeout system properties. The values specified + * for timeouts must be in milliseconds. + */ + public ZMSClient() { + initClient(null); + } + + /** + * Constructs a new ZMSClient object with the given ZMS Server url and + * media type set to application/json. The client can only be used + * to retrieve objects from ZMS that do not require any authentication + * otherwise addCredentials method must be used to set the principal identity. + * Default read and connect timeout values are 30000ms (30sec). The application can + * change these values by using the yahoo.zms_java_client.read_timeout and + * yahoo.zms_java_client.connect_timeout system properties. The values specified + * for timeouts must be in milliseconds. + * @param url ZMS Server url (e.g. https://server1.athenzcompany.com:4443/zms/v1) + */ + public ZMSClient(String url) { + initClient(url); + } + + /** + * Close the ZMSClient object and release any allocated resources. + */ + public void close() { + client.close(); + } + + public void setZMSRDLGeneratedClient(ZMSRDLGeneratedClient client) { + this.client = client; + } + + /** + * Sets or overrides the current principal identity set in the client. + * @param identity Principal identity for authenticating requests + * @return self ZMSClient object + */ + public ZMSClient addCredentials(Principal identity) { + + // make sure the principal has proper authority assigned + + if (identity == null || identity.getAuthority() == null) { + throw new IllegalArgumentException("Principal must be valid object with authority field"); + } + + // if we already have a principal set, we're going to + // clear our credentials first + + if (principal != null) { + client.addCredentials(principal.getAuthority().getHeader(), null); + } + + // now we're going to update our principal and set credentials + + principal = identity; + principalCheckDone = false; + + final Authority authority = principal.getAuthority(); + if (authority != null) { + client.addCredentials(authority.getHeader(), principal.getCredentials()); + + // finally check if we this is a principal token required by ZMS + + principalCheckDone = (authority instanceof PrincipalAuthority); + } + + return this; + } + + /** + * Clear the principal identity set for the client. Unless a new principal is set + * using the addCredentials method, the client can only be used to requests data + * from the ZMS Server that doesn't require any authentication. + * @return self ZMSClient object + */ + public ZMSClient clearCredentials() { + if (principal != null) { + client.addCredentials(principal.getAuthority().getHeader(), null); + principal = null; + principalCheckDone = true; + } + return this; + } + + /** + * If the current principal is the user principal then request + * a UserToken from ZMS and set the UserToken as the principal + * identity for authentication. + */ + private void updatePrincipal() { + + /* if the check has already been done then we have nothing to do */ + + if (principalCheckDone) { + return; + } + + /* make sure we have a principal specified */ + + if (principal == null) { + principalCheckDone = true; + return; + } + + /* so at this point we have some credentials specified + * but it's not the principal authority so we're going + * to ask ZMS to return a UserToken for us. + */ + + String userName = principal.getName(); + long issueTime = principal.getIssueTime(); + UserToken userToken = getUserToken(userName); + + PrincipalToken principalToken = new PrincipalToken(userToken.getToken()); + Principal identity = SimplePrincipal.create(principalToken.getDomain(), + principalToken.getName(), userToken.getToken(), issueTime, + PRINCIPAL_AUTHORITY); + clearCredentials(); + addCredentials(identity); + } + + String lookupZMSUrl() { + + String rootDir = System.getenv(STR_ENV_ROOT); + if (rootDir == null) { + rootDir = STR_DEF_ROOT; + } + + String confFileName = System.getProperty(ZMS_CLIENT_PROP_ATHENZ_CONF, + rootDir + "/conf/athenz/athenz.conf"); + String url = null; + try { + Path path = Paths.get(confFileName); + AthenzConfig conf = JSON.fromBytes(Files.readAllBytes(path), AthenzConfig.class); + url = conf.getZmsUrl(); + } catch (Exception ex) { + LOGGER.error("Unable to extract ZMS Url from {} exc: {}", + confFileName, ex.getMessage()); + } + + return url; + } + /** + * Initialize the client for class constructors + * @param url ZMS Server url + * @param identity Principal identity for authentication + * @param mediaType media type for http content type + */ + private void initClient(String url) { + + /* if we have no url specified then we're going to retrieve + * the value from our configuration package */ + + if (url == null) { + zmsUrl = lookupZMSUrl(); + } else { + zmsUrl = url; + } + + /* verify if the url is ending with /zms/v1 and if it's + * not we'll automatically append it */ + + if (zmsUrl != null && !zmsUrl.isEmpty()) { + if (!zmsUrl.endsWith("/zms/v1")) { + if (zmsUrl.charAt(zmsUrl.length() - 1) != '/') { + zmsUrl += '/'; + } + zmsUrl += "zms/v1"; + } + } + + /* determine our read and connect timeouts */ + + int readTimeout = Integer.parseInt(System.getProperty(ZMS_CLIENT_PROP_READ_TIMEOUT, "30000")); + int connectTimeout = Integer.parseInt(System.getProperty(ZMS_CLIENT_PROP_CONNECT_TIMEOUT, "30000")); + + /* if we are not given a url then use the default value */ + + client = new ZMSRDLGeneratedClient(zmsUrl) + .setProperty(ClientProperties.CONNECT_TIMEOUT, connectTimeout) + .setProperty(ClientProperties.READ_TIMEOUT, readTimeout); + } + + public String getZmsUrl() { + return zmsUrl; + } + + /** + * Generate a role name as expected by ZMS Server can be used to + * set the role object's name field (e.g. role.setName(name)) + * @param domain name of the domain + * @param role name of the role + * @return full role name + */ + public String generateRoleName(String domain, String role) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append(":role."); + str.append(role); + return str.toString(); + } + + /** + * Generate a policy name as expected by ZMS Server can be used to + * set the policy object's name field (e.g. policy.setName(name)) + * @param domain name of the domain + * @param policy name of the policy + * @return full policy name + */ + public String generatePolicyName(String domain, String policy) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append(":policy."); + str.append(policy); + return str.toString(); + } + + /** + * Generate a service name as expected by ZMS Server can be used to + * set the service identity object's name field + * (e.g. serviceIdentity.setName(name)) + * @param domain name of the domain + * @param service name of the service + * @return full service identity name + */ + public String generateServiceIdentityName(String domain, String service) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append("."); + str.append(service); + return str.toString(); + } + + /** + * Retrieve the specified domain object + * @param domain name of the domain to be retrieved + * @return Domain object or ZMSClientException will be thrown in case of failure + */ + public Domain getDomain(String domain) { + updatePrincipal(); + try { + return client.getDomain(domain); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of domains provisioned on the ZMS Server + * @return list of Domains or ZMSClientException will be thrown in case of failure + */ + public DomainList getDomainList() { + return getDomainList(null, null, null, null, null, null, null); + } + + /** + * Retrieve the list of domains provisioned on the ZMS Server + * filters based on the specified arguments + * @param limit number of domain objects to return + * @param skip exclude all the domains including the specified one from the return set + * @param prefix return domains starting with this value + * @param depth maximum depth of the domain (0 - top level domains only) + * @param account return domain that has the specified account name. If account name + * is specified all other optional attributes are ignored since there must be + * only one domain matching the specified account name. + * @param productId return domain that has the specified product id. If product id + * is specified all other optional attributes are ignored since there must be + * only one domain matching the specified product id. + * @param modifiedSince return domains only modified since this date + * @return list of domain names or ZMSClientException will be thrown in case of failure + */ + public DomainList getDomainList(Integer limit, String skip, String prefix, Integer depth, + String account, Integer productId, Date modifiedSince) { + updatePrincipal(); + String modSinceStr = null; + if (modifiedSince != null) { + DateFormat df = new SimpleDateFormat(HTTP_RFC1123_DATE_FORMAT); + modSinceStr = df.format(modifiedSince); + } + try { + return client.getDomainList(limit, skip, prefix, depth, account, productId, null, null, modSinceStr); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of domains provisioned on the ZMS Server + * filters based on the specified arguments + * @param roleMember name of the principal + * @param roleName name of the role where the principal is a member of + * @return list of domain names or ZMSClientException will be thrown in case of failure + */ + public DomainList getDomainList(String roleMember, String roleName) { + updatePrincipal(); + try { + return client.getDomainList(null, null, null, null, null, null, roleMember, roleName, null); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create/Update Top level domain. If updating a domain the provided + * object must contain all attributes as it will replace the full domain + * object configured on the server (not just some of the attributes). + * @param auditRef string containing audit specification or ticket number + * @param detail TopLevelDomain object to be created in ZMS + * @return created Domain object or ZMSClientException will be thrown in case of failure + */ + public Domain postTopLevelDomain(String auditRef, TopLevelDomain detail) { + updatePrincipal(); + try { + return client.postTopLevelDomain(auditRef, detail); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create/Update a sub-domain in the specified domain. If updating a + * subdomain the provided object must contain all attributes as it will + * replace the full domain object configured on the server (not just some + * of the attributes). + * @param parent name of the parent domain + * @param auditRef string containing audit specification or ticket number + * @param detail SubDomain object to be created in ZMS + * @return created Domain object or ZMSClientException will be thrown in case of failure + */ + public Domain postSubDomain(String parent, String auditRef, SubDomain detail) { + updatePrincipal(); + try { + return client.postSubDomain(parent, auditRef, detail); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create a top-level user-domain - this is user.<userid> domain. + * @param name domain to be created, this is the <userid> + * @param auditRef string containing audit specification or ticket number + * @param detail UserDomain object to be created in ZMS + * @return created Domain object or ZMSClientException will be thrown in case of failure + */ + public Domain postUserDomain(String name, String auditRef, UserDomain detail) { + updatePrincipal(); + try { + return client.postUserDomain(name, auditRef, detail); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete a top level domain + * @param name domain name to be deleted from ZMS + * @param auditRef string containing audit specification or ticket number + */ + public void deleteTopLevelDomain(String name, String auditRef) { + updatePrincipal(); + try { + client.deleteTopLevelDomain(name, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete a sub-domain + * @param parent name of the parent domain + * @param name sub-domain to be deleted + * @param auditRef string containing audit specification or ticket number + */ + public void deleteSubDomain(String parent, String name, String auditRef) { + updatePrincipal(); + try { + client.deleteSubDomain(parent, name, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete a top-level user-domain (user.<userid>) + * @param name domain to be deleted, this is the <userid> + * @param auditRef string containing audit specification or ticket number + */ + public void deleteUserDomain(String name, String auditRef) { + updatePrincipal(); + try { + client.deleteUserDomain(name, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Set the domain meta parameters + * @param name domain name to be modified + * @param auditRef string containing audit specification or ticket number + * @param detail meta parameters to be set on the domain + */ + public void putDomainMeta(String name, String auditRef, DomainMeta detail) { + updatePrincipal(); + try { + client.putDomainMeta(name, auditRef, detail); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of roles defined for the specified domain + * @param domainName name of the domain + * @return list of role names or ZMSClientException will be thrown in case of failure + */ + public RoleList getRoleList(String domainName) { + updatePrincipal(); + try { + return client.getRoleList(domainName, null, null); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of roles defined for the specified domain + * filtered based on the parameters specified + * @param domainName name of the domain + * @param limit number of roles to return + * @param skip exclude all the roles including the specified one from the return set + * @return list of role names or ZMSClientException will be thrown in case of failure + */ + public RoleList getRoleList(String domainName, Integer limit, String skip) { + updatePrincipal(); + try { + return client.getRoleList(domainName, limit, skip); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of roles defined for the specified domain. The roles + * will contain their attributes and, if specified, the list of members. + * @param domainName name of the domain + * @param members include all members for group roles as well + * @return list of roles or ZMSClientException will be thrown in case of failure + */ + public Roles getRoles(String domainName, Boolean members) { + updatePrincipal(); + try { + return client.getRoles(domainName, members); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the specified role + * @param domainName name of the domain + * @param roleName name of the role + * @return role object or ZMSClientException will be thrown in case of failure + */ + public Role getRole(String domainName, String roleName) { + return getRole(domainName, roleName, false, false); + } + + /** + * Retrieve the specified role + * @param domainName name of the domain + * @param roleName name of the role + * @param auditLog include audit log for the role changes in the response + * @return role object or ZMSClientException will be thrown in case of failure + */ + public Role getRole(String domainName, String roleName, boolean auditLog) { + return getRole(domainName, roleName, auditLog, false); + } + + + /** + * Retrieve the specified role + * @param domainName name of the domain + * @param roleName name of the role + * @param auditLog include audit log for the role changes in the response + * @param expand if the requested role is a delegated/trust role, this flag + * will instruct the ZMS server to automatically retrieve the members of the + * role from the delegated domain and return as part of the role object + * @return role object or ZMSClientException will be thrown in case of failure + */ + public Role getRole(String domainName, String roleName, boolean auditLog, boolean expand) { + updatePrincipal(); + try { + return client.getRole(domainName, roleName, auditLog, expand); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create/Update a new role in the specified domain. If updating a role + * the provided object must contain all attributes as it will replace + * the full role object configured on the server (not just some of the attributes). + * @param domainName name of the domain + * @param roleName name of the role + * @param auditRef string containing audit specification or ticket number + * @param role role object to be added to the domain + */ + public void putRole(String domainName, String roleName, String auditRef, Role role) { + updatePrincipal(); + try { + client.putRole(domainName, roleName, auditRef, role); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the specified role from domain + * @param domainName name of the domain + * @param roleName name of the role + * @param auditRef string containing audit specification or ticket number + */ + public void deleteRole(String domainName, String roleName, String auditRef) { + updatePrincipal(); + try { + client.deleteRole(domainName, roleName, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Get membership details for the specified member in the given role + * in a specified domain + * @param domainName name of the domain + * @param roleName name of the role + * @param memberName name of the member + * @return Membership object or ZMSClientException will be thrown in case of failure + */ + public Membership getMembership(String domainName, String roleName, String memberName) { + updatePrincipal(); + try { + return client.getMembership(domainName, roleName, memberName); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Add a new member in the specified role. + * @param domainName name of the domain + * @param roleName name of the role + * @param memberName name of the member to be added + * @param auditRef string containing audit specification or ticket number + */ + public void putMembership(String domainName, String roleName, String memberName, String auditRef) { + updatePrincipal(); + Membership mbr = new Membership(); + mbr.setRoleName(roleName); + mbr.setMemberName(memberName); + mbr.setIsMember(true); + try { + client.putMembership(domainName, roleName, memberName, auditRef, mbr); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Remove the specified member from the role + * @param domainName name of the domain + * @param roleName name of the role + * @param memberName name of the member to be removed + * @param auditRef string containing audit specification or ticket number + */ + public void deleteMembership(String domainName, String roleName, String memberName, String auditRef) { + updatePrincipal(); + try { + client.deleteMembership(domainName, roleName, memberName, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of policies defined for the specified domain. The policies + * will contain their attributes and, if specified, the list of assertions. + * @param domainName name of the domain + * @param assertions include all assertion for policies as well + * @return list of policies or ZMSClientException will be thrown in case of failure + */ + public Policies getPolicies(String domainName, Boolean assertions) { + updatePrincipal(); + try { + return client.getPolicies(domainName, assertions); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Get list of policies defined in the specified domain + * @param domainName name of the domain + * @return list of policy names or ZMSClientException will be thrown in case of failure + */ + public PolicyList getPolicyList(String domainName) { + updatePrincipal(); + try { + return client.getPolicyList(domainName, null, null); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Get list of policies defined in the specified domain filtered + * based on the specified arguments + * @param domainName name of the domain + * @param limit number of policies to return + * @param skip exclude all the policies including the specified one from the return set + * @return list of policy names or ZMSClientException will be thrown in case of failure + */ + public PolicyList getPolicyList(String domainName, Integer limit, String skip) { + updatePrincipal(); + try { + return client.getPolicyList(domainName, limit, skip); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Return the specified policy object assertion + * @param domainName name of the domain + * @param policyName name of the policy + * @param assertionId the id of the assertion to be retrieved + * @return Assertion object or ZMSClientException will be thrown in case of failure + */ + public Assertion getAssertion(String domainName, String policyName, Long assertionId) { + updatePrincipal(); + try { + return client.getAssertion(domainName, policyName, assertionId); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Add the specified assertion to the specified policy + * @param domainName name of the domain + * @param policyName name of the policy + * @param auditRef string containing audit specification or ticket number + * @param assertion Assertion object to be added to the policy + * @return updated assertion object that includes the server assigned id + */ + public Assertion putAssertion(String domainName, String policyName, String auditRef, Assertion assertion) { + updatePrincipal(); + try { + return client.putAssertion(domainName, policyName, auditRef, assertion); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete specified assertion from the given policy + * @param domainName name of the domain + * @param policyName name of the policy + * @param assertionId the id of the assertion to be deleted + * @param auditRef string containing audit specification or ticket number + */ + public void deleteAssertion(String domainName, String policyName, Long assertionId, String auditRef) { + updatePrincipal(); + try { + client.deleteAssertion(domainName, policyName, assertionId, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Return the specified policy object + * @param domainName name of the domain + * @param policyName name of the policy to be retrieved + * @return Policy object or ZMSClientException will be thrown in case of failure + */ + public Policy getPolicy(String domainName, String policyName) { + updatePrincipal(); + try { + return client.getPolicy(domainName, policyName); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create/Update a new policy in the specified domain. If updating a policy + * the provided object must contain all attributes as it will replace the + * full policy object configured on the server (not just some of the attributes). + * @param domainName name of the domain + * @param policyName name of the policy + * @param auditRef string containing audit specification or ticket number + * @param policy Policy object with details + */ + public void putPolicy(String domainName, String policyName, String auditRef, Policy policy) { + updatePrincipal(); + try { + client.putPolicy(domainName, policyName, auditRef, policy); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete specified policy from a domain + * @param domainName name of the domain + * @param policyName name of the policy to be deleted + * @param auditRef string containing audit specification or ticket number + */ + public void deletePolicy(String domainName, String policyName, String auditRef) { + updatePrincipal(); + try { + client.deletePolicy(domainName, policyName, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create/Update a new service in the specified domain. If updating a service + * the provided object must contain all attributes as it will replace the + * full service object configured on the server (not just some of the attributes). + * @param domainName name of the domain + * @param serviceName name of the service + * @param auditRef string containing audit specification or ticket number + * @param service ServiceIdentity object with all service details + */ + public void putServiceIdentity(String domainName, String serviceName, + String auditRef, ServiceIdentity service) { + updatePrincipal(); + try { + client.putServiceIdentity(domainName, serviceName, auditRef, service); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the specified service object from a domain + * @param domainName name of the domain + * @param serviceName name of the service to be retrieved + * @return ServiceIdentity object or ZMSClientException will be thrown in case of failure + */ + public ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + updatePrincipal(); + try { + return client.getServiceIdentity(domainName, serviceName); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the specified service from a domain + * @param domainName name of the domain + * @param serviceName name of the service to be deleted + * @param auditRef string containing audit specification or ticket number + */ + public void deleteServiceIdentity(String domainName, String serviceName, String auditRef) { + updatePrincipal(); + try { + client.deleteServiceIdentity(domainName, serviceName, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of services defined for the specified domain. The services + * will contain their attributes and, if specified, the list of publickeys and hosts. + * @param domainName name of the domain + * @param publicKeys include all public keys for services as well + * @param hosts include all configured hosts for services as well + * @return list of services or ZMSClientException will be thrown in case of failure + */ + public ServiceIdentities getServiceIdentities(String domainName, Boolean publicKeys, Boolean hosts) { + updatePrincipal(); + try { + return client.getServiceIdentities(domainName, publicKeys, hosts); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the full list of services defined in a domain + * @param domainName name of the domain + * @return list of all service names or ZMSClientException will be thrown in case of failure + */ + public ServiceIdentityList getServiceIdentityList(String domainName) { + updatePrincipal(); + try { + return client.getServiceIdentityList(domainName, null, null); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of services defined in a domain filtered + * based on the specified arguments + * @param domainName name of the domain + * @param limit number of services to return + * @param skip exclude all the services including the specified one from the return set + * @return list of service names or ZMSClientException will be thrown in case of failure + */ + public ServiceIdentityList getServiceIdentityList(String domainName, Integer limit, String skip) { + updatePrincipal(); + try { + return client.getServiceIdentityList(domainName, limit, skip); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the specified public key from the given service object + * @param domainName name of the domain + * @param serviceName name of the service + * @param keyId the identifier of the public key to be retrieved + * @return PublicKeyEntry object or ZMSClientException will be thrown in case of failure + */ + public PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, String keyId) { + updatePrincipal(); + try { + return client.getPublicKeyEntry(domainName, serviceName, keyId); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Update or add (if doesn't already exist) the specified public key in the service object + * @param domainName name of the domain + * @param serviceName name of the service + * @param keyId the identifier of the public key to be updated + * @param auditRef string containing audit specification or ticket number + * @param publicKeyEntry that contains the public key details + */ + public void putPublicKeyEntry(String domainName, String serviceName, String keyId, String auditRef, + PublicKeyEntry publicKeyEntry) { + updatePrincipal(); + try { + client.putPublicKeyEntry(domainName, serviceName, keyId, auditRef, publicKeyEntry); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the specified public key from the service object. If the key doesn't exist then + * it is treated as a successful operation and no exception will be thrown. + * @param domainName name of the domain + * @param serviceName name of the service + * @param keyId the identifier of the public key to be deleted + * @param auditRef string containing audit specification or ticket number + */ + public void deletePublicKeyEntry(String domainName, String serviceName, String keyId, String auditRef) { + updatePrincipal(); + try { + client.deletePublicKeyEntry(domainName, serviceName, keyId, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create/update an entity object in ZMS + * @param domainName name of the domain + * @param entityName name of the entity + * @param auditRef string containing audit specification or ticket number + * @param entity entity object with details + */ + public void putEntity(String domainName, String entityName, String auditRef, Entity entity) { + updatePrincipal(); + try { + client.putEntity(domainName, entityName, auditRef, entity); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the specified entity from the ZMS Server + * @param domainName name of the domain + * @param entityName name of the entity + * @return Entity object with details or ZMSClientException will be thrown in case of failure + */ + public Entity getEntity(String domainName, String entityName) { + updatePrincipal(); + try { + return client.getEntity(domainName, entityName); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the specified entity from the ZMS Server + * @param domainName name of the domain + * @param entityName name of the entity + * @param auditRef string containing audit specification or ticket number + */ + public void deleteEntity(String domainName, String entityName, String auditRef) { + updatePrincipal(); + try { + client.deleteEntity(domainName, entityName, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of entities defined for the specified domain + * @param domainName name of the domain + * @return list of entity names or ZMSClientException will be thrown in case of failure + */ + public EntityList getEntityList(String domainName) { + updatePrincipal(); + try { + return client.getEntityList(domainName); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create a new tenant for the specified domain. The service specifies the + * provider. + * @param tenantDomain name of the tenant domain + * @param providerService name of the provider service + * format: provider-domain-name.provider-service-name, ex: "sports.storage" + * @param auditRef string containing audit specification or ticket number + * @param tenant Tenancy object with tenant details + */ + public void putTenancy(String tenantDomain, String providerService, String auditRef, Tenancy tenant) { + updatePrincipal(); + try { + client.putTenancy(tenantDomain, providerService, auditRef, tenant); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the specified tenant from a domain + * @param tenantDomain name of the tenant domain + * @param providerService name of the provider service, + * format: provider-domain-name.provider-service-name, ex: "sports.storage" + * @return Tenancy object or ZMSClientException will be thrown in case of failure + */ + public Tenancy getTenancy(String tenantDomain, String providerService) { + updatePrincipal(); + try { + return client.getTenancy(tenantDomain, providerService); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the specified tenant from a domain + * @param tenantDomain name of the tenant domain + * @param providerService name of the provider service, + * format: provider-domain-name.provider-service-name, ex: "sports.storage" + * @param auditRef string containing audit specification or ticket number + */ + public void deleteTenancy(String tenantDomain, String providerService, String auditRef) { + updatePrincipal(); + try { + client.deleteTenancy(tenantDomain, providerService, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create a new resource group for the specified tenant. The service specifies the + * provider. The tenant must have on-boarded already using the putTenancy call. + * @param tenantDomain name of the tenant domain + * @param providerService name of the provider service, + * format: provider-domain-name.provider-service-name, ex: "sports.storage" + * @param resourceGroup name of the resource group + * @param auditRef string containing audit specification or ticket number + * @param resourceGroupData TenancyResourceGroup object with tenant's resource group details + */ + public void putTenancyResourceGroup(String tenantDomain, String providerService, + String resourceGroup, String auditRef, TenancyResourceGroup resourceGroupData) { + updatePrincipal(); + try { + client.putTenancyResourceGroup(tenantDomain, providerService, resourceGroup, auditRef, resourceGroupData); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the specified resource group for the tenant. + * @param tenantDomain name of the tenant domain + * @param providerService name of the provider service, format: + * provider-domain-name.provider-service-name, ex: "sports.storage" + * @param resourceGroup name of the resource group + * @param auditRef string containing audit specification or ticket number + */ + public void deleteTenancyResourceGroup(String tenantDomain, String providerService, + String resourceGroup, String auditRef) { + updatePrincipal(); + try { + client.deleteTenancyResourceGroup(tenantDomain, providerService, resourceGroup, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create tenant roles for the specified tenant + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param tenantDomain name of the tenant's domain + * @param auditRef string containing audit specification or ticket number + * @param tenantRoles Tenant roles + */ + public void putTenantRoles(String providerDomain, String providerServiceName, + String tenantDomain, String auditRef, TenantRoles tenantRoles) { + updatePrincipal(); + try { + client.putTenantRoles(providerDomain, providerServiceName, tenantDomain, auditRef, tenantRoles); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Create tenant roles for the specified tenant resource group. + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param tenantDomain name of the tenant's domain + * @param resourceGroup name of the resource group + * @param auditRef string containing audit specification or ticket number + * @param tenantRoles Tenant roles + */ + public void putTenantResourceGroupRoles(String providerDomain, String providerServiceName, String tenantDomain, + String resourceGroup, String auditRef, TenantResourceGroupRoles tenantRoles) { + updatePrincipal(); + try { + client.putTenantResourceGroupRoles(providerDomain, providerServiceName, tenantDomain, + resourceGroup, auditRef, tenantRoles); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of tenant roles defined for a tenant in a domain + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param tenantDomain name of the tenant's domain + * @return list of tenant roles or ZMSClientException will be thrown in case of failure + */ + public TenantRoles getTenantRoles(String providerDomain, String providerServiceName, String tenantDomain) { + updatePrincipal(); + try { + return client.getTenantRoles(providerDomain, providerServiceName, tenantDomain); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of tenant roles defined for a tenant resource group in a domain + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param tenantDomain name of the tenant's domain + * @param resourceGroup name of the resource group + * @return list of tenant roles or ZMSClientException will be thrown in case of failure + */ + public TenantResourceGroupRoles getTenantResourceGroupRoles(String providerDomain, String providerServiceName, + String tenantDomain, String resourceGroup) { + updatePrincipal(); + try { + return client.getTenantResourceGroupRoles(providerDomain, providerServiceName, + tenantDomain, resourceGroup); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete tenant roles for the specified tenant in a domain + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param tenantDomain name of tenant's domain + * @param auditRef string containing audit specification or ticket number + */ + public void deleteTenantRoles(String providerDomain, String providerServiceName, String tenantDomain, + String auditRef) { + updatePrincipal(); + try { + client.deleteTenantRoles(providerDomain, providerServiceName, tenantDomain, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete tenant roles for the specified tenant resource group in a domain + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param tenantDomain name of tenant's domain + * @param resourceGroup name of the resource group + * @param auditRef string containing audit specification or ticket number + */ + public void deleteTenantResourceGroupRoles(String providerDomain, String providerServiceName, String tenantDomain, + String resourceGroup, String auditRef) { + updatePrincipal(); + try { + client.deleteTenantResourceGroupRoles(providerDomain, providerServiceName, tenantDomain, + resourceGroup, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Requests the ZMS to indicate whether or not the specific request for the + * specified resource with authentication details will be granted or not. + * @param action value of the action to be carried out (e.g. "UPDATE", "DELETE") + * @param resource resource YRN. YRN is defined as {ServiceName})?:({LocationName})?:)?{ResourceName}" + * @param trustDomain (optional) if the access checks involves cross domain check only + * check the specified trusted domain and ignore all others + * @return Access object indicating whether or not the request will be granted or not + */ + public Access getAccess(String action, String resource, String trustDomain) { + return getAccess(action, resource, trustDomain, null); + } + + /** + * Requests the ZMS to indicate whether or not the specific request for the + * specified resource with authentication details will be granted or not. + * @param action value of the action to be carried out (e.g. "UPDATE", "DELETE") + * @param resource resource YRN. YRN is defined as {ServiceName})?:({LocationName})?:)?{ResourceName}" + * @param trustDomain (optional) if the access checks involves cross domain check only + * check the specified trusted domain and ignore all others + * @param principal (optional) carry out the access check for specified principal + * @return Access object indicating whether or not the request will be granted or not + */ + public Access getAccess(String action, String resource, String trustDomain, String principal) { + try { + return client.getAccess(action, resource, trustDomain, principal); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + + /** + * Requests the ZMS to indicate whether or not the specific request for the + * specified resource with authentication details will be granted or not. + * @param action value of the action to be carried out (e.g. "UPDATE", "DELETE") + * @param resource resource string. + * @param trustDomain (optional) if the access checks involves cross domain check only + * check the specified trusted domain and ignore all others + * @param principal (optional) carry out the access check for specified principal + * @return Access object indicating whether or not the request will be granted or not + */ + public Access getAccessExt(String action, String resource, String trustDomain, String principal) { + try { + return client.getAccessExt(action, resource, trustDomain, principal); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of all domain data from the ZMS Server that + * is signed with ZMS's private key. It will pass an optional matchingTag + * so that ZMS can skip returning domains if no changes have taken + * place since that tag was issued. + * @param domainName name of the domain. if specified, the server will + * only return this domain in the result set + * @param metaOnly (can be null) must have value of true or false (default). + * if set to true, zms server will only return meta information + * about each domain (description, last modified timestamp, etc) and + * no role/policy/service details will be returned. + * @param matchingTag (can be null) contains modified timestamp received + * with last request. If null, then return all domains. + * @param responseHeaders contains the "tag" returned for modification + * time of the domains, map key = "tag", List should + * contain a single value timestamp String to be used + * with subsequent call as matchingTag to this API + * @return list of domains signed by ZMS Server + */ + public SignedDomains getSignedDomains(String domainName, String metaOnly, String matchingTag, + Map> responseHeaders) { + updatePrincipal(); + try { + SignedDomains sd = client.getSignedDomains(domainName, metaOnly, matchingTag, responseHeaders); + return sd; + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * For the specified user credentials return the corresponding User Token that + * can be used for authenticating other ZMS operations. The client internally + * automatically calls this method and uses the UserToken if the ZMSClient + * object was initialized with a user principal. + * @param userName name of the user. This is only used to verify that it matches + * the user name from the credentials and is optional. The caller can just pass + * the string "_self_" as the userName to bypass this optional check. + * @return ZMS generated User Token + */ + public UserToken getUserToken(String userName) { + return getUserToken(userName, null); + } + + /** + * For the specified user credentials return the corresponding User Token that + * can be used for authenticating other ZMS operations by any of the specified + * authorized services. + * @param userName name of the user + * @param serviceNames comma separated list of authorized service names + * @return ZMS generated User Token + */ + public UserToken getUserToken(String userName, String serviceNames) { + try { + return client.getUserToken(userName, serviceNames); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * For the specified domain in domainName, a list of default administrators + * can be passed to this method and will be added to the domain's admin role + * In addition this method will ensure that the admin role and policy exist and + * are properly set up + * @param domainName - name of the domain to add default administrators to + * @param auditRef - string containing audit specification or ticket number + * @param defaultAdmins - list of names to be added as default administrators + */ + public void putDefaultAdmins(String domainName, String auditRef, DefaultAdmins defaultAdmins) { + updatePrincipal(); + try { + client.putDefaultAdmins(domainName, auditRef, defaultAdmins); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * The client will validate the given serviceToken against the ZMS Server + * and if the token is valid, it will return a Principal object. + * @param serviceToken token to be validated. + * @return Principal object if the token is successfully validated or + * ZMSClientException will be thrown in case of failure + */ + public Principal getPrincipal(String serviceToken) { + + if (serviceToken == null) { + throw new ZMSClientException(401, "Null service token provided"); + } + + PrincipalToken token = null; + try { + token = new PrincipalToken(serviceToken); + } catch (IllegalArgumentException ex) { + throw new ZMSClientException(ZMSClientException.UNAUTHORIZED, "Invalid service token provided: " + ex.getMessage()); + } + + Principal servicePrincipal = null; + try { + servicePrincipal = SimplePrincipal.create(token.getDomain(), token.getName(), + serviceToken, 0, PRINCIPAL_AUTHORITY); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.UNAUTHORIZED, "Invalid service token provided"); + } + + addCredentials(servicePrincipal); + + ServicePrincipal validatedPrincipal = null; + try { + validatedPrincipal = client.getServicePrincipal(); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + + if (validatedPrincipal == null) { + throw new ZMSClientException(ZMSClientException.UNAUTHORIZED, "Invalid service token provided"); + } + + // before returning let's validate that domain, name and + // credentials match to what was passed to + + if (!servicePrincipal.getDomain().equalsIgnoreCase(validatedPrincipal.getDomain())) { + throw new ZMSClientException(ZMSClientException.UNAUTHORIZED, "Validated principal domain name mismatch"); + } + + if (!servicePrincipal.getName().equalsIgnoreCase(validatedPrincipal.getService())) { + throw new ZMSClientException(ZMSClientException.UNAUTHORIZED, "Validated principal service name mismatch"); + } + + return servicePrincipal; + } + + /** + * Create provider roles for the specified tenant resource group in the tenant domain. + * If the principal requesting this operation has been authorized by the provider + * service itself, then the corresponding tenant roles will be created in the provider + * domain as well thus completing the tenancy on-boarding process in one call. + * @param tenantDomain name of the tenant's domain + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param resourceGroup name of the resource group + * @param auditRef string containing audit specification or ticket number + * @param providerRoles Provider roles + */ + public void putProviderResourceGroupRoles(String tenantDomain, String providerDomain, + String providerServiceName, String resourceGroup, String auditRef, + ProviderResourceGroupRoles providerRoles) { + updatePrincipal(); + try { + client.putProviderResourceGroupRoles(tenantDomain, providerDomain, providerServiceName, + resourceGroup, auditRef, providerRoles); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the provider roles for the specified tenant resource group from the tenant domain. + * If the principal requesting this operation has been authorized by the provider + * service itself, then the corresponding tenant roles will be deleted from the provider + * domain as well thus completing the process in one call. + * @param tenantDomain name of tenant's domain + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param resourceGroup name of the resource group + * @param auditRef string containing audit specification or ticket number + */ + public void deleteProviderResourceGroupRoles(String tenantDomain, String providerDomain, + String providerServiceName, String resourceGroup, String auditRef) { + updatePrincipal(); + try { + client.deleteProviderResourceGroupRoles(tenantDomain, providerDomain, providerServiceName, + resourceGroup, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of provider roles defined for a tenant resource group in a domain + * @param tenantDomain name of the tenant's domain + * @param providerDomain name of the provider domain + * @param providerServiceName name of the provider service + * @param resourceGroup name of the resource group + * @return list of provider roles or ZMSClientException will be thrown in case of failure + */ + public ProviderResourceGroupRoles getProviderResourceGroupRoles(String tenantDomain, + String providerDomain, String providerServiceName, String resourceGroup) { + updatePrincipal(); + try { + return client.getProviderResourceGroupRoles(tenantDomain, providerDomain, providerServiceName, + resourceGroup); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Check the data for the specified domain object + * @param domain name of the domain to be checked + * @return DomainDataCheck object or ZMSClientException will be thrown in case of failure + */ + public DomainDataCheck getDomainDataCheck(String domain) { + updatePrincipal(); + try { + return client.getDomainDataCheck(domain); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the the specified solution template provisioned on the ZMS Server. + * The template object will include the list of roles and policies that will + * be provisioned in the domain when the template is applied. + * @param template name of the solution template to be retrieved + * @return template object or ZMSClientException will be thrown in case of failure + */ + public Template getTemplate(String template) { + updatePrincipal(); + try { + return client.getTemplate(template); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of solution templates provisioned on the ZMS Server + * @return list of template names or ZMSClientException will be thrown in case of failure + */ + public ServerTemplateList getServerTemplateList() { + updatePrincipal(); + try { + return client.getServerTemplateList(); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Provision the specified solution template roles and policies in the domain + * @param domain name of the domain to be updated + * @param auditRef string containing audit specification or ticket number + * @param templates contains list of template names to be provisioned in the domain + */ + public void putDomainTemplate(String domain, String auditRef, DomainTemplate templates) { + updatePrincipal(); + try { + client.putDomainTemplate(domain, auditRef, templates); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Delete the specified solution template roles and policies from the domain + * @param domain name of the domain to be updated + * @param template is the name of the provisioned template to be deleted + * @param auditRef string containing audit specification or ticket number + */ + public void deleteDomainTemplate(String domain, String template, String auditRef) { + updatePrincipal(); + try { + client.deleteDomainTemplate(domain, template, auditRef); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of solution template provisioned for a domain + * @param domain name of the domain + * @return TemplateList object that includes the list of provisioned solution template names + */ + public DomainTemplateList getDomainTemplateList(String domain) { + updatePrincipal(); + try { + return client.getDomainTemplateList(domain); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the list of resources as defined in their respective assertions + * that the given principal has access to through their role membership + * @param principal the principal name (e.g. user.joe). Must have special + * privileges to execute this query without specifying the principal. + * Check with Athenz Service Administrators if you have a use case to + * request all principals from Athenz Service + * @param action optional field specifying what action to filter assertions on + * @return ResourceAccessList object that lists the set of assertions per principal + */ + public ResourceAccessList getResourceAccessList(String principal, String action) { + updatePrincipal(); + try { + return client.getResourceAccessList(principal, action); + } catch (ResourceException ex) { + throw new ZMSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZMSClientException(ZMSClientException.BAD_REQUEST, ex.getMessage()); + } + } +} diff --git a/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSClientException.java b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSClientException.java new file mode 100644 index 00000000000..331acf66a58 --- /dev/null +++ b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSClientException.java @@ -0,0 +1,25 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +public class ZMSClientException extends ResourceException { + + private static final long serialVersionUID = -8084410672948347342L; + + public ZMSClientException(int code, Object data) { + super(code, data); + } +} diff --git a/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSRDLGeneratedClient.java b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSRDLGeneratedClient.java new file mode 100644 index 00000000000..39d13d70a64 --- /dev/null +++ b/clients/java/zms/src/main/java/com/yahoo/athenz/zms/ZMSRDLGeneratedClient.java @@ -0,0 +1,1478 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +import com.yahoo.rdl.*; +import javax.ws.rs.client.*; +import javax.ws.rs.*; +import javax.ws.rs.core.*; +import javax.net.ssl.HostnameVerifier; + +public class ZMSRDLGeneratedClient { + Client client; + WebTarget base; + String credsHeader; + String credsToken; + + public ZMSRDLGeneratedClient(String url) { + client = ClientBuilder.newClient(); + base = client.target(url); + } + + public ZMSRDLGeneratedClient(String url, HostnameVerifier hostnameVerifier) { + client = ClientBuilder.newBuilder() + .hostnameVerifier(hostnameVerifier) + .build(); + base = client.target(url); + } + + public void close() { + client.close(); + } + + public ZMSRDLGeneratedClient setProperty(String name, Object value) { + client = client.property(name, value); + return this; + } + + public ZMSRDLGeneratedClient addCredentials(String header, String token) { + credsHeader = header; + credsToken = token; + return this; + } + + public Domain getDomain(String domain) { + WebTarget target = base.path("/domain/{domain}") + .resolveTemplate("domain", domain); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Domain.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DomainList getDomainList(Integer limit, String skip, String prefix, Integer depth, String account, Integer productId, String roleMember, String roleName, String modifiedSince) { + WebTarget target = base.path("/domain"); + if (limit != null) { + target = target.queryParam("limit", limit); + } + if (skip != null) { + target = target.queryParam("skip", skip); + } + if (prefix != null) { + target = target.queryParam("prefix", prefix); + } + if (depth != null) { + target = target.queryParam("depth", depth); + } + if (account != null) { + target = target.queryParam("account", account); + } + if (productId != null) { + target = target.queryParam("ypmid", productId); + } + if (roleMember != null) { + target = target.queryParam("member", roleMember); + } + if (roleName != null) { + target = target.queryParam("role", roleName); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (modifiedSince != null) { + invocationBuilder = invocationBuilder.header("If-Modified-Since", modifiedSince); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(DomainList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Domain postTopLevelDomain(String auditRef, TopLevelDomain detail) { + WebTarget target = base.path("/domain"); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Domain.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Domain postSubDomain(String parent, String auditRef, SubDomain detail) { + WebTarget target = base.path("/subdomain/{parent}") + .resolveTemplate("parent", parent); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Domain.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Domain postUserDomain(String name, String auditRef, UserDomain detail) { + WebTarget target = base.path("/userdomain/{name}") + .resolveTemplate("name", name); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Domain.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TopLevelDomain deleteTopLevelDomain(String name, String auditRef) { + WebTarget target = base.path("/domain/{name}") + .resolveTemplate("name", name); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public SubDomain deleteSubDomain(String parent, String name, String auditRef) { + WebTarget target = base.path("/subdomain/{parent}/{name}") + .resolveTemplate("parent", parent) + .resolveTemplate("name", name); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public UserDomain deleteUserDomain(String name, String auditRef) { + WebTarget target = base.path("/userdomain/{name}") + .resolveTemplate("name", name); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Domain putDomainMeta(String name, String auditRef, DomainMeta detail) { + WebTarget target = base.path("/domain/{name}/meta") + .resolveTemplate("name", name); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DomainTemplate putDomainTemplate(String name, String auditRef, DomainTemplate template) { + WebTarget target = base.path("/domain/{name}/template") + .resolveTemplate("name", name); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(template, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DomainTemplateList getDomainTemplateList(String name) { + WebTarget target = base.path("/domain/{name}/template") + .resolveTemplate("name", name); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(DomainTemplateList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DomainTemplate deleteDomainTemplate(String name, String template, String auditRef) { + WebTarget target = base.path("/domain/{name}/template/{template}") + .resolveTemplate("name", name) + .resolveTemplate("template", template); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DomainDataCheck getDomainDataCheck(String domainName) { + WebTarget target = base.path("/domain/{domainName}/check") + .resolveTemplate("domainName", domainName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(DomainDataCheck.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Entity putEntity(String domainName, String entityName, String auditRef, Entity entity) { + WebTarget target = base.path("/domain/{domainName}/entity/{entityName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("entityName", entityName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(entity, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Entity getEntity(String domainName, String entityName) { + WebTarget target = base.path("/domain/{domainName}/entity/{entityName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("entityName", entityName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Entity.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Entity deleteEntity(String domainName, String entityName, String auditRef) { + WebTarget target = base.path("/domain/{domainName}/entity/{entityName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("entityName", entityName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public EntityList getEntityList(String domainName) { + WebTarget target = base.path("/domain/{domainName}/entity") + .resolveTemplate("domainName", domainName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(EntityList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public RoleList getRoleList(String domainName, Integer limit, String skip) { + WebTarget target = base.path("/domain/{domainName}/role") + .resolveTemplate("domainName", domainName); + if (limit != null) { + target = target.queryParam("limit", limit); + } + if (skip != null) { + target = target.queryParam("skip", skip); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(RoleList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Roles getRoles(String domainName, Boolean members) { + WebTarget target = base.path("/domain/{domainName}/roles") + .resolveTemplate("domainName", domainName); + if (members != null) { + target = target.queryParam("members", members); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Roles.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Role getRole(String domainName, String roleName, Boolean auditLog, Boolean expand) { + WebTarget target = base.path("/domain/{domainName}/role/{roleName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("roleName", roleName); + if (auditLog != null) { + target = target.queryParam("auditLog", auditLog); + } + if (expand != null) { + target = target.queryParam("expand", expand); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Role.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Role putRole(String domainName, String roleName, String auditRef, Role role) { + WebTarget target = base.path("/domain/{domainName}/role/{roleName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("roleName", roleName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(role, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Role deleteRole(String domainName, String roleName, String auditRef) { + WebTarget target = base.path("/domain/{domainName}/role/{roleName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("roleName", roleName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Membership getMembership(String domainName, String roleName, String memberName) { + WebTarget target = base.path("/domain/{domainName}/role/{roleName}/member/{memberName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("roleName", roleName) + .resolveTemplate("memberName", memberName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Membership.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Membership putMembership(String domainName, String roleName, String memberName, String auditRef, Membership membership) { + WebTarget target = base.path("/domain/{domainName}/role/{roleName}/member/{memberName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("roleName", roleName) + .resolveTemplate("memberName", memberName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(membership, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Membership deleteMembership(String domainName, String roleName, String memberName, String auditRef) { + WebTarget target = base.path("/domain/{domainName}/role/{roleName}/member/{memberName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("roleName", roleName) + .resolveTemplate("memberName", memberName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DefaultAdmins putDefaultAdmins(String domainName, String auditRef, DefaultAdmins defaultAdmins) { + WebTarget target = base.path("/domain/{domainName}/admins") + .resolveTemplate("domainName", domainName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(defaultAdmins, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public PolicyList getPolicyList(String domainName, Integer limit, String skip) { + WebTarget target = base.path("/domain/{domainName}/policy") + .resolveTemplate("domainName", domainName); + if (limit != null) { + target = target.queryParam("limit", limit); + } + if (skip != null) { + target = target.queryParam("skip", skip); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(PolicyList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Policies getPolicies(String domainName, Boolean assertions) { + WebTarget target = base.path("/domain/{domainName}/policies") + .resolveTemplate("domainName", domainName); + if (assertions != null) { + target = target.queryParam("assertions", assertions); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Policies.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Policy getPolicy(String domainName, String policyName) { + WebTarget target = base.path("/domain/{domainName}/policy/{policyName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("policyName", policyName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Policy.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Policy putPolicy(String domainName, String policyName, String auditRef, Policy policy) { + WebTarget target = base.path("/domain/{domainName}/policy/{policyName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("policyName", policyName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(policy, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Policy deletePolicy(String domainName, String policyName, String auditRef) { + WebTarget target = base.path("/domain/{domainName}/policy/{policyName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("policyName", policyName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Assertion getAssertion(String domainName, String policyName, Long assertionId) { + WebTarget target = base.path("/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("policyName", policyName) + .resolveTemplate("assertionId", assertionId); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Assertion.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Assertion putAssertion(String domainName, String policyName, String auditRef, Assertion assertion) { + WebTarget target = base.path("/domain/{domainName}/policy/{policyName}/assertion") + .resolveTemplate("domainName", domainName) + .resolveTemplate("policyName", policyName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(assertion, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + case 201: + return response.readEntity(Assertion.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Assertion deleteAssertion(String domainName, String policyName, Long assertionId, String auditRef) { + WebTarget target = base.path("/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("policyName", policyName) + .resolveTemplate("assertionId", assertionId); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServiceIdentity putServiceIdentity(String domain, String service, String auditRef, ServiceIdentity detail) { + WebTarget target = base.path("/domain/{domain}/service/{service}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServiceIdentity getServiceIdentity(String domain, String service) { + WebTarget target = base.path("/domain/{domain}/service/{service}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ServiceIdentity.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServiceIdentity deleteServiceIdentity(String domain, String service, String auditRef) { + WebTarget target = base.path("/domain/{domain}/service/{service}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServiceIdentities getServiceIdentities(String domainName, Boolean publickeys, Boolean hosts) { + WebTarget target = base.path("/domain/{domainName}/services") + .resolveTemplate("domainName", domainName); + if (publickeys != null) { + target = target.queryParam("publickeys", publickeys); + } + if (hosts != null) { + target = target.queryParam("hosts", hosts); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ServiceIdentities.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServiceIdentityList getServiceIdentityList(String domainName, Integer limit, String skip) { + WebTarget target = base.path("/domain/{domainName}/service") + .resolveTemplate("domainName", domainName); + if (limit != null) { + target = target.queryParam("limit", limit); + } + if (skip != null) { + target = target.queryParam("skip", skip); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ServiceIdentityList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public PublicKeyEntry getPublicKeyEntry(String domain, String service, String id) { + WebTarget target = base.path("/domain/{domain}/service/{service}/publickey/{id}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("id", id); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(PublicKeyEntry.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public PublicKeyEntry putPublicKeyEntry(String domain, String service, String id, String auditRef, PublicKeyEntry publicKeyEntry) { + WebTarget target = base.path("/domain/{domain}/service/{service}/publickey/{id}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("id", id); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(publicKeyEntry, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public PublicKeyEntry deletePublicKeyEntry(String domain, String service, String id, String auditRef) { + WebTarget target = base.path("/domain/{domain}/service/{service}/publickey/{id}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("id", id); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Tenancy putTenancy(String domain, String service, String auditRef, Tenancy detail) { + WebTarget target = base.path("/domain/{domain}/tenancy/{service}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Tenancy getTenancy(String domain, String service) { + WebTarget target = base.path("/domain/{domain}/tenancy/{service}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Tenancy.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Tenancy deleteTenancy(String domain, String service, String auditRef) { + WebTarget target = base.path("/domain/{domain}/tenancy/{service}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenancyResourceGroup putTenancyResourceGroup(String domain, String service, String resourceGroup, String auditRef, TenancyResourceGroup detail) { + WebTarget target = base.path("/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenancyResourceGroup deleteTenancyResourceGroup(String domain, String service, String resourceGroup, String auditRef) { + WebTarget target = base.path("/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantRoles putTenantRoles(String domain, String service, String tenantDomain, String auditRef, TenantRoles detail) { + WebTarget target = base.path("/domain/{domain}/service/{service}/tenant/{tenantDomain}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("tenantDomain", tenantDomain); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + case 201: + return response.readEntity(TenantRoles.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantRoles getTenantRoles(String domain, String service, String tenantDomain) { + WebTarget target = base.path("/domain/{domain}/service/{service}/tenant/{tenantDomain}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("tenantDomain", tenantDomain); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(TenantRoles.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantRoles deleteTenantRoles(String domain, String service, String tenantDomain, String auditRef) { + WebTarget target = base.path("/domain/{domain}/service/{service}/tenant/{tenantDomain}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("tenantDomain", tenantDomain); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantResourceGroupRoles putTenantResourceGroupRoles(String domain, String service, String tenantDomain, String resourceGroup, String auditRef, TenantResourceGroupRoles detail) { + WebTarget target = base.path("/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("tenantDomain", tenantDomain) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + case 201: + return response.readEntity(TenantResourceGroupRoles.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantResourceGroupRoles getTenantResourceGroupRoles(String domain, String service, String tenantDomain, String resourceGroup) { + WebTarget target = base.path("/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("tenantDomain", tenantDomain) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(TenantResourceGroupRoles.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantResourceGroupRoles deleteTenantResourceGroupRoles(String domain, String service, String tenantDomain, String resourceGroup, String auditRef) { + WebTarget target = base.path("/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service) + .resolveTemplate("tenantDomain", tenantDomain) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ProviderResourceGroupRoles putProviderResourceGroupRoles(String tenantDomain, String provDomain, String provService, String resourceGroup, String auditRef, ProviderResourceGroupRoles detail) { + WebTarget target = base.path("/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + .resolveTemplate("tenantDomain", tenantDomain) + .resolveTemplate("provDomain", provDomain) + .resolveTemplate("provService", provService) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(detail, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + case 201: + return response.readEntity(ProviderResourceGroupRoles.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ProviderResourceGroupRoles getProviderResourceGroupRoles(String tenantDomain, String provDomain, String provService, String resourceGroup) { + WebTarget target = base.path("/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + .resolveTemplate("tenantDomain", tenantDomain) + .resolveTemplate("provDomain", provDomain) + .resolveTemplate("provService", provService) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ProviderResourceGroupRoles.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ProviderResourceGroupRoles deleteProviderResourceGroupRoles(String tenantDomain, String provDomain, String provService, String resourceGroup, String auditRef) { + WebTarget target = base.path("/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + .resolveTemplate("tenantDomain", tenantDomain) + .resolveTemplate("provDomain", provDomain) + .resolveTemplate("provService", provService) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Access getAccess(String action, String resource, String domain, String checkPrincipal) { + WebTarget target = base.path("/access/{action}/{resource}") + .resolveTemplate("action", action) + .resolveTemplate("resource", resource); + if (domain != null) { + target = target.queryParam("domain", domain); + } + if (checkPrincipal != null) { + target = target.queryParam("principal", checkPrincipal); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Access.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Access getAccessExt(String action, String resource, String domain, String checkPrincipal) { + WebTarget target = base.path("/access/{action}") + .resolveTemplate("action", action); + if (resource != null) { + target = target.queryParam("resource", resource); + } + if (domain != null) { + target = target.queryParam("domain", domain); + } + if (checkPrincipal != null) { + target = target.queryParam("principal", checkPrincipal); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Access.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ResourceAccessList getResourceAccessList(String principal, String action) { + WebTarget target = base.path("/resource"); + if (principal != null) { + target = target.queryParam("principal", principal); + } + if (action != null) { + target = target.queryParam("action", action); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ResourceAccessList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public SignedDomains getSignedDomains(String domain, String metaOnly, String matchingTag, java.util.Map> headers) { + WebTarget target = base.path("/sys/modified_domains"); + if (domain != null) { + target = target.queryParam("domain", domain); + } + if (metaOnly != null) { + target = target.queryParam("metaonly", metaOnly); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (matchingTag != null) { + invocationBuilder = invocationBuilder.header("If-None-Match", matchingTag); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + case 304: + if (headers != null) { + headers.put("tag", java.util.Arrays.asList((String)response.getHeaders().getFirst("ETag"))); + } + if (code == 304) { + return null; + } + return response.readEntity(SignedDomains.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public UserToken getUserToken(String userName, String serviceNames) { + WebTarget target = base.path("/user/{userName}/token") + .resolveTemplate("userName", userName); + if (serviceNames != null) { + target = target.queryParam("services", serviceNames); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(UserToken.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public UserToken optionsUserToken(String userName, String serviceNames) { + WebTarget target = base.path("/user/{userName}/token") + .resolveTemplate("userName", userName); + if (serviceNames != null) { + target = target.queryParam("services", serviceNames); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + Response response = invocationBuilder.options(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(UserToken.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServicePrincipal getServicePrincipal() { + WebTarget target = base.path("/principal"); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ServicePrincipal.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServerTemplateList getServerTemplateList() { + WebTarget target = base.path("/template"); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ServerTemplateList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Template getTemplate(String template) { + WebTarget target = base.path("/template/{template}") + .resolveTemplate("template", template); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Template.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + +} diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.core.JsonFactory b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.core.JsonFactory new file mode 100644 index 00000000000..d1ec3d025c3 --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.core.JsonFactory @@ -0,0 +1 @@ +athenz.shade.zms.com.fasterxml.jackson.core.JsonFactory diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.core.ObjectCodec b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.core.ObjectCodec new file mode 100644 index 00000000000..9d360420066 --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.core.ObjectCodec @@ -0,0 +1 @@ +athenz.shade.zms.com.fasterxml.jackson.databind.ObjectMapper diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.databind.Module b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.databind.Module new file mode 100644 index 00000000000..da39184c36f --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.com.fasterxml.jackson.databind.Module @@ -0,0 +1 @@ +athenz.shade.zms.com.fasterxml.jackson.module.jaxb.JaxbAnnotationModule diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.client.ClientBuilder b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.client.ClientBuilder new file mode 100644 index 00000000000..781eadbf366 --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.client.ClientBuilder @@ -0,0 +1 @@ +athenz.shade.zms.org.glassfish.jersey.client.JerseyClientBuilder diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.MessageBodyReader b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.MessageBodyReader new file mode 100644 index 00000000000..195261405f6 --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.MessageBodyReader @@ -0,0 +1 @@ +athenz.shade.zms.com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.MessageBodyWriter b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.MessageBodyWriter new file mode 100644 index 00000000000..195261405f6 --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.MessageBodyWriter @@ -0,0 +1 @@ +athenz.shade.zms.com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.RuntimeDelegate b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.RuntimeDelegate new file mode 100644 index 00000000000..2cddd883218 --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.javax.ws.rs.ext.RuntimeDelegate @@ -0,0 +1 @@ +athenz.shade.zms.org.glassfish.jersey.internal.RuntimeDelegateImpl diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.org.glassfish.hk2.extension.ServiceLocatorGenerator b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.org.glassfish.hk2.extension.ServiceLocatorGenerator new file mode 100644 index 00000000000..b5ccd1a122f --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.org.glassfish.hk2.extension.ServiceLocatorGenerator @@ -0,0 +1 @@ +athenz.shade.zms.org.jvnet.hk2.external.generator.ServiceLocatorGeneratorImpl diff --git a/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.org.glassfish.jersey.internal.spi.AutoDiscoverable b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.org.glassfish.jersey.internal.spi.AutoDiscoverable new file mode 100644 index 00000000000..842e2b62138 --- /dev/null +++ b/clients/java/zms/src/main/resources/META-INF/services/athenz.shade.zms.org.glassfish.jersey.internal.spi.AutoDiscoverable @@ -0,0 +1,2 @@ +athenz.shade.zms.org.glassfish.jersey.jackson.internal.JacksonAutoDiscoverable +athenz.shade.zms.org.glassfish.jersey.logging.LoggingFeatureAutoDiscoverable diff --git a/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ResourceExceptionTest.java b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ResourceExceptionTest.java new file mode 100644 index 00000000000..489c3dda0c1 --- /dev/null +++ b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ResourceExceptionTest.java @@ -0,0 +1,88 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +public class ResourceExceptionTest { + public final static int OK = 200; + public final static int CREATED = 201; + public final static int ACCEPTED = 202; + public final static int NO_CONTENT = 204; + public final static int MOVED_PERMANENTLY = 301; + public final static int FOUND = 302; + public final static int SEE_OTHER = 303; + public final static int NOT_MODIFIED = 304; + public final static int TEMPORARY_REDIRECT = 307; + public final static int BAD_REQUEST = 400; + public final static int UNAUTHORIZED = 401; + public final static int FORBIDDEN = 403; + public final static int NOT_FOUND = 404; + public final static int CONFLICT = 409; + public final static int GONE = 410; + public final static int PRECONDITION_FAILED = 412; + public final static int UNSUPPORTED_MEDIA_TYPE = 415; + public final static int INTERNAL_SERVER_ERROR = 500; + public final static int NOT_IMPLEMENTED = 501; + public final static int SERVICE_UNAVAILABLE = 503; + + @Test + public void testCodeToString() { + + assertEquals("OK", ResourceException.codeToString(200)); + assertEquals("Created", ResourceException.codeToString(201)); + assertEquals("Accepted", ResourceException.codeToString(202)); + assertEquals("No Content", ResourceException.codeToString(204)); + assertEquals("Moved Permanently", ResourceException.codeToString(301)); + assertEquals("Found", ResourceException.codeToString(302)); + assertEquals("See Other", ResourceException.codeToString(303)); + assertEquals("Not Modified", ResourceException.codeToString(304)); + assertEquals("Temporary Redirect", ResourceException.codeToString(307)); + assertEquals("Bad Request", ResourceException.codeToString(400)); + assertEquals("Unauthorized", ResourceException.codeToString(401)); + assertEquals("Forbidden", ResourceException.codeToString(403)); + assertEquals("Not Found", ResourceException.codeToString(404)); + assertEquals("Conflict", ResourceException.codeToString(409)); + assertEquals("Gone", ResourceException.codeToString(410)); + assertEquals("Precondition Failed", ResourceException.codeToString(412)); + assertEquals("Unsupported Media Type", ResourceException.codeToString(415)); + assertEquals("Internal Server Error", ResourceException.codeToString(500)); + assertEquals("Not Implemented", ResourceException.codeToString(501)); + assertEquals("1001", ResourceException.codeToString(1001)); + } + + @Test + public void testCodeOnly() { + + ResourceException exc = new ResourceException(400); + assertEquals(exc.getData().toString(), "{code: 400, message: \"Bad Request\"}"); + } + + @Test + public void testGetData() { + + ResourceException exc = new ResourceException(400, "Invalid domain name"); + assertEquals(exc.getData(), "Invalid domain name"); + } + + @Test + public void testGetDataCast() { + + ResourceException exc = new ResourceException(400, new Integer(5000)); + assertEquals(exc.getData(Integer.class), new Integer(5000)); + } +} diff --git a/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSAuthorizerTest.java b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSAuthorizerTest.java new file mode 100644 index 00000000000..a3a327d4675 --- /dev/null +++ b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSAuthorizerTest.java @@ -0,0 +1,349 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.zms.ZMSAuthorizer; + +import static org.testng.Assert.*; + +import java.util.ArrayList; +import java.util.List; + +import org.mockito.Mockito; + +public class ZMSAuthorizerTest { + + private static String ZMS_CLIENT_PROP_TEST_ADMIN = "athenz.zms.client.test_admin"; + private static final String AUDIT_REF = "zmsjcltauthtest"; + + private String systemAdminUser = null; + private String systemAdminFullUser = null; + private final String zmsUrl = "http://localhost:10080/"; + + @BeforeClass + public void setup() { + systemAdminUser = System.getProperty(ZMS_CLIENT_PROP_TEST_ADMIN, "user_admin"); + systemAdminFullUser = "user." + systemAdminUser; + System.setProperty(ZMSClient.ZMS_CLIENT_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + } + + @Test + public void testAuthorizer() { + + ZMSClient client = getClient(systemAdminUser); + String domain = "AuthorizerDom1"; + ZMSAuthorizer authorizer = new ZMSAuthorizer(zmsUrl, domain); + assertNotNull(authorizer); + + // create 3 user client objects + + Principal p1 = createPrincipal("user1"); + Principal p2 = createPrincipal("user2"); + Principal p3 = createPrincipal("user3"); + + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(Mockito.anyString(), Mockito.any(TopLevelDomain.class))) + .thenReturn(domainMock); + + setupAccess(client, domain); + + // only user1 and user3 have access to UPDATE/resource1 + ZMSClient mockZMSClient = Mockito.mock(ZMSClient.class); + authorizer.setZMSClient(mockZMSClient); + Access accessMock = Mockito.mock(Access.class); + Mockito.when(mockZMSClient.getAccess("UPDATE", "AuthorizerDom1:resource1", "AuthorizerDom1")) + .thenReturn(accessMock, accessMock, accessMock); + Mockito.when(accessMock.getGranted()).thenReturn(true, true, false, false, true, true); + Mockito.when(c.getAccess("UPDATE", "AuthorizerDom1:resource1", "AuthorizerDom1", null)).thenReturn(accessMock); + + boolean access = authorizer.access("UPDATE", "resource1", p1, domain); + assertTrue(access); + + // we're going to use a principal token as well to test this access + + String principalToken1 = "v=U1;d=user;n=user1;s=signature"; + access = authorizer.access("UPDATE", "resource1", principalToken1, domain); + assertTrue(access); + + access = authorizer.access("UPDATE", "resource1", p2, domain); + assertFalse(access); + + String principalToken2 = "v=U1;d=user;n=user2;s=signature"; + access = authorizer.access("UPDATE", "resource1", principalToken2, domain); + assertFalse(access); + + access = authorizer.access("UPDATE", "resource1", p3, domain); + assertTrue(access); + + String principalToken3 = "v=U1;d=user;n=user3;s=signature"; + access = authorizer.access("UPDATE", "resource1", principalToken3, domain); + assertTrue(access); + + // we should get exception with no principal + try { + authorizer.access("UPDATE", "resource1", (Principal) null, domain); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + // we should get exception with no principal token + + try { + authorizer.access("UPDATE", "resource1", (String) null, domain); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + TopLevelDomain topLevelDomainMock = Mockito.mock(TopLevelDomain.class); + Mockito.when(c.deleteTopLevelDomain(domain, AUDIT_REF)).thenReturn(topLevelDomainMock); + cleanUpAccess(domain); + } + + @Test + public void testAuthorizerNoEndpoint() { + String domain = "AuthorizerDom2"; + ZMSAuthorizer authorizer = new ZMSAuthorizer(domain); + assertNotNull(authorizer); + } + + @Test + public void TestAddCredentials() { + ZMSClient client = getClient(systemAdminUser); + String domain = "AuthorizerDom5"; + ZMSAuthorizer authorizer = new ZMSAuthorizer(zmsUrl, null); + + Principal p1 = createPrincipal("user1"); + Principal p2 = createPrincipal("user2"); + Principal p3 = createPrincipal("user3"); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(Mockito.anyString(), Mockito.any(TopLevelDomain.class))) + .thenReturn(domainMock); + + setupAccess(client, domain); + ZMSClient mockZMSClient = Mockito.mock(ZMSClient.class); + authorizer.setZMSClient(mockZMSClient); + + Access accessMock = Mockito.mock(Access.class); + Mockito.when(mockZMSClient.getAccess("UPDATE", "AuthorizerDom3:resource1", "AuthorizerDom3")) + .thenReturn(accessMock); + Mockito.when(accessMock.getGranted()).thenReturn(true, false, true); + Mockito.when(c.getAccess("UPDATE", "AuthorizerDom3:resource1", "AuthorizerDom3", null)).thenReturn(accessMock); + try { + Mockito.when(mockZMSClient.addCredentials(p1)).thenThrow(new ResourceException(204)); + authorizer.access("UPDATE", domain + ":resource1", p1, domain); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + try { + Mockito.when(mockZMSClient.addCredentials(p2)).thenThrow(new ZMSClientException(204, "No Content")); + authorizer.access("UPDATE", domain + ":resource1", p2, domain); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + + try { + Mockito.when(mockZMSClient.addCredentials(p3)).thenThrow(new ZMSClientException(404, "Not Found")); + authorizer.access("UPDATE", domain + ":resource1", p3, domain); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + authorizer.close(); + } + + @Test + public void TestAuthorizerNoDomain() { + ZMSClient client = getClient(systemAdminUser); + String domain = "AuthorizerDom3"; + ZMSAuthorizer authorizer = new ZMSAuthorizer(zmsUrl, null); + assertNotNull(authorizer); + + // create 3 user client objects + + Principal p1 = createPrincipal("user1"); + Principal p2 = createPrincipal("user2"); + Principal p3 = createPrincipal("user3"); + + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(Mockito.anyString(), Mockito.any(TopLevelDomain.class))) + .thenReturn(domainMock); + + setupAccess(client, domain); + ZMSClient mockZMSClient = Mockito.mock(ZMSClient.class); + authorizer.setZMSClient(mockZMSClient); + + // only user1 and user3 have access to UPDATE/resource1 + Access accessMock = Mockito.mock(Access.class); + Mockito.when(mockZMSClient.getAccess("UPDATE", "AuthorizerDom3:resource1", "AuthorizerDom3")) + .thenReturn(accessMock); + Mockito.when(accessMock.getGranted()).thenReturn(true, false, true); + Mockito.when(c.getAccess("UPDATE", "AuthorizerDom3:resource1", "AuthorizerDom3", null)).thenReturn(accessMock); + boolean access = authorizer.access("UPDATE", domain + ":resource1", p1, domain); + assertTrue(access); + + access = authorizer.access("UPDATE", domain + ":resource1", p2, domain); + assertFalse(access); + + access = authorizer.access("UPDATE", domain + ":resource1", p3, domain); + assertTrue(access); + TopLevelDomain topLevelDomainMock = Mockito.mock(TopLevelDomain.class); + Mockito.when(c.deleteTopLevelDomain(domain, AUDIT_REF)).thenReturn(topLevelDomainMock); + authorizer.close(); + cleanUpAccess(domain); + } + + @Test + public void TestAuthorizerResourceWithDomain() { + ZMSClient client = getClient(systemAdminUser); + String domain = "AuthorizerDom4"; + ZMSAuthorizer authorizer = new ZMSAuthorizer(zmsUrl, domain); + assertNotNull(authorizer); + + // create 3 user client objects + + Principal p1 = createPrincipal("user1"); + Principal p2 = createPrincipal("user2"); + Principal p3 = createPrincipal("user3"); + + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(Mockito.anyString(), Mockito.any(TopLevelDomain.class))) + .thenReturn(domainMock); + setupAccess(client, domain); + + // only user1 and user3 have access to UPDATE/resource1 + ZMSClient mockZMSClient = Mockito.mock(ZMSClient.class); + authorizer.setZMSClient(mockZMSClient); + Access accessMock = Mockito.mock(Access.class); + Mockito.when(mockZMSClient.getAccess("UPDATE", "AuthorizerDom4:resource1", "AuthorizerDom4")) + .thenReturn(accessMock); + Mockito.when(accessMock.getGranted()).thenReturn(true, false, true); + Mockito.when(c.getAccess("UPDATE", "AuthorizerDom4:resource1", "AuthorizerDom4", null)).thenReturn(accessMock); + boolean access = authorizer.access("UPDATE", domain + ":resource1", p1, domain); + assertTrue(access); + + access = authorizer.access("UPDATE", domain + ":resource1", p2, domain); + assertFalse(access); + + access = authorizer.access("UPDATE", domain + ":resource1", p3, domain); + assertTrue(access); + + TopLevelDomain topLevelDomainMock = Mockito.mock(TopLevelDomain.class); + Mockito.when(c.deleteTopLevelDomain(domain, AUDIT_REF)).thenReturn(topLevelDomainMock); + cleanUpAccess(domain); + + } + + private Role createRoleObject(ZMSClient client, String domainName, String roleName, String trust, String member1, + String member2) { + + Role role = new Role(); + role.setName(client.generateRoleName(domainName, roleName)); + role.setTrust(trust); + + List members = new ArrayList(); + members.add(member1); + if (member2 != null) { + members.add(member2); + } + role.setMembers(members); + return role; + } + + private Policy createPolicyObject(ZMSClient client, String domainName, String policyName, String roleName, + String action, String resource, AssertionEffect effect) { + + Policy policy = new Policy(); + policy.setName(client.generatePolicyName(domainName, policyName)); + + Assertion assertion = new Assertion(); + assertion.setAction(action); + assertion.setEffect(effect); + assertion.setResource(resource); + assertion.setRole(client.generateRoleName(domainName, roleName)); + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + return policy; + } + + private TopLevelDomain createTopLevelDomainObject(String name, String description, String org, String admin) { + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setEnabled(true); + dom.setYpmId(2000); + + List admins = new ArrayList(); + admins.add(admin); + dom.setAdminUsers(admins); + return dom; + } + + private Principal createPrincipal(String userName) { + Authority authority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Principal p = SimplePrincipal.create("user", userName, "v=U1;d=user;n=" + userName + ";s=signature", 0, + authority); + return p; + } + + private ZMSClient getClient(String userName) { + ZMSClient client = new ZMSClient(zmsUrl); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + client.addCredentials(createPrincipal(userName)); + return client; + } + + private void setupAccess(ZMSClient client, String domain) { + TopLevelDomain dom1 = createTopLevelDomainObject(domain, "Test Domain1", "testOrg", systemAdminFullUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Role role1 = createRoleObject(client, domain, "Role1", null, "user.user1", "user.user3"); + client.putRole(domain, "Role1", AUDIT_REF, role1); + + Policy policy1 = createPolicyObject(client, domain, "Policy1", "Role1", "UPDATE", domain + ":resource1", + AssertionEffect.ALLOW); + client.putPolicy(domain, "Policy1", AUDIT_REF, policy1); + } + + private void cleanUpAccess(String domain) { + ZMSClient client = getClient(systemAdminUser); + client.deleteTopLevelDomain(domain, AUDIT_REF); + } +} diff --git a/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSClientMockTest.java b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSClientMockTest.java new file mode 100644 index 00000000000..a67b26484a4 --- /dev/null +++ b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSClientMockTest.java @@ -0,0 +1,1100 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.util.List; + +import java.text.DateFormat; +import java.text.SimpleDateFormat; +import java.util.ArrayList; +import java.util.Date; + +import com.yahoo.athenz.auth.Principal; +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.Timestamp; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.assertNull; +import static org.testng.Assert.assertTrue; +import static org.testng.Assert.fail; +import org.testng.annotations.BeforeMethod; + +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.mockito.Matchers; +import org.testng.annotations.Test; + +public class ZMSClientMockTest { + + @Mock ZMSRDLGeneratedClient mockZMS; + + ZMSClient zclt; + String zmsUrl = ""; + List userList; + String auditRef = "zmsjcltmktest"; + + static final Struct TABLE_PROVIDER_ROLE_ACTIONS = new Struct() + .with("admin", "*").with("writer", "WRITE").with("reader", "READ"); + + @BeforeMethod + public void setUp() throws Exception { + MockitoAnnotations.initMocks(this); + Mockito.doReturn(new DomainList()).when(mockZMS).getDomainList(Matchers.isA(Integer.class), + Matchers.isA(String.class), Matchers.isA(String.class), Matchers.isA(Integer.class), + Matchers.isA(String.class), Matchers.isA(Integer.class), Matchers.isA(String.class), + Matchers.isA(String.class), Matchers.isA(String.class)); + userList = new ArrayList(); + userList.add("user.johnny"); + zclt = new ZMSClient(zmsUrl); + zclt.client = mockZMS; + } + + @Test + public void testDomain() throws Exception { + + String domName = "testdom"; + Mockito.doReturn(new Domain()).when(mockZMS).getDomain(domName); + Mockito.doReturn(new DomainList()).when(mockZMS).getDomainList(null, null, null, + null, null, null, null, null, null); + + DomainList domList = zclt.getDomainList(); + assertNotNull(domList); + + Domain dom = zclt.getDomain(domName); + assertNotNull(dom); + + try { + TopLevelDomain tld = new TopLevelDomain().setName(domName).setOrg("testOrg") + .setDescription("test domain").setAdminUsers(userList); + dom = zclt.postTopLevelDomain(auditRef, tld); + + DomainMeta meta = new DomainMeta(); + zclt.putDomainMeta(domName, auditRef, meta); + + zclt.deleteTopLevelDomain(domName, auditRef); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testDomainListModifiedSince() throws Exception { + + DomainList domList = new DomainList(); + List domains = new ArrayList<>(); + domains.add("dom1"); + domList.setNames(domains); + + Date now = new Date(); + DateFormat df = new SimpleDateFormat("EEE, d MMM yyyy HH:mm:ss zzz"); + String modifiedSince = df.format(now); + Mockito.doReturn(domList).when(mockZMS).getDomainList(null, null, null, + null, null, null, null, null, modifiedSince); + + DomainList domainList = zclt.getDomainList(null, null, null, + null, null, null, now); + assertNotNull(domainList); + assertTrue(domainList.getNames().contains("dom1")); + } + + @Test + public void testSubDomain() throws Exception { + + String parentName = "parentdom"; + String subDomName = "childdom"; + + try { + SubDomain subDom = new SubDomain(); + zclt.postSubDomain(parentName, auditRef, subDom); + zclt.deleteSubDomain(parentName, subDomName, auditRef); + + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testUserDomain() throws Exception { + + String userDomName = "userid"; + + try { + UserDomain userDom = new UserDomain(); + userDom.setName(userDomName); + + zclt.postUserDomain(userDomName, auditRef, userDom); + zclt.deleteUserDomain(userDomName, auditRef); + + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testGetUserToken() throws Exception { + + String uname = "johnny"; + Mockito.doReturn(new UserToken()).when(mockZMS).getUserToken(uname, null); + Mockito.doReturn(new UserToken()).when(mockZMS).getUserToken(uname, "coretech.storage"); + + UserToken utok = zclt.getUserToken(uname); + assertNotNull(utok); + + utok = zclt.getUserToken(uname, "coretech.storage"); + assertNotNull(utok); + + utok = zclt.getUserToken(uname, "sports.hockey"); + assertNull(utok); + } + + @Test + public void testPolicy() throws Exception { + + String domName = "johnnies-place"; + String polName = "chefs"; + Mockito.doReturn(new Policy()).when(mockZMS).getPolicy(domName, polName); + Mockito.doReturn(new PolicyList()).when(mockZMS).getPolicyList(domName, null, null); + + ZMSClient zmsclt2 = new ZMSClient(zmsUrl); + zmsclt2.client = mockZMS; + + PolicyList polList = zmsclt2.getPolicyList(domName); + assertNotNull(polList); + + Policy pol = zmsclt2.getPolicy(domName, polName); + assertNotNull(pol); + + try { + zmsclt2.putPolicy(domName, polName, auditRef, pol); + zmsclt2.deletePolicy(domName, polName, auditRef); + } catch (Exception exc) { + fail(); + } + zmsclt2.close(); + } + + @Test + public void testRole() throws Exception { + + String domName = "johnnies-place"; + String roleName = "manager"; + Mockito.doReturn(new Role()).when(mockZMS).getRole(domName, roleName, false, false); + Mockito.doReturn(new RoleList()).when(mockZMS).getRoleList(domName, null, null); + + RoleList roleList = zclt.getRoleList(domName); + assertNotNull(roleList); + + Role role = zclt.getRole(domName, roleName); + assertNotNull(role); + + try { + zclt.putRole(domName, roleName, auditRef, role); + zclt.deletePolicy(domName, roleName, auditRef); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testRoleChangeLog() throws Exception { + + String domName = "johnnies-place"; + String roleName = "manager"; + Role retRole = new Role(); + retRole.setName(domName + ":role." + roleName); + + List auditLogList = new ArrayList<>(); + RoleAuditLog logEntry = new RoleAuditLog(); + logEntry.setAction("ADD").setAdmin("user.admin").setMember("user.user1") + .setAuditRef("").setCreated(Timestamp.fromCurrentTime()); + auditLogList.add(logEntry); + + logEntry = new RoleAuditLog(); + logEntry.setAction("DELETE").setAdmin("user.admin").setMember("user.user2") + .setAuditRef("audit-ref").setCreated(Timestamp.fromCurrentTime()); + auditLogList.add(logEntry); + + retRole.setAuditLog(auditLogList); + Mockito.doReturn(retRole).when(mockZMS).getRole(domName, roleName, true, false); + + Role role = zclt.getRole(domName, roleName, true); + assertNotNull(role); + List logList = role.getAuditLog(); + assertNotNull(logList); + assertEquals(logList.size(), 2); + } + + @Test + public void testRoleExpand() throws Exception { + + String domName = "role-expand"; + String roleName = "manager"; + + Role retRoleExpand = new Role(); + retRoleExpand.setName(domName + ":role." + roleName); + retRoleExpand.setTrust("trusted-domain"); + List members = new ArrayList<>(); + members.add("user.user1"); + members.add("coretech.service"); + retRoleExpand.setMembers(members); + + Role retRoleNoExpand = new Role(); + retRoleNoExpand.setName(domName + ":role." + roleName); + retRoleNoExpand.setTrust("trusted-domain"); + + Mockito.doReturn(retRoleExpand).when(mockZMS).getRole(domName, roleName, false, true); + Mockito.doReturn(retRoleNoExpand).when(mockZMS).getRole(domName, roleName, false, false); + + // first request with expand option set + + Role role = zclt.getRole(domName, roleName, false, true); + assertNotNull(role); + assertEquals(role.getTrust(), "trusted-domain"); + assertNotNull(role.getMembers()); + assertEquals(role.getMembers().size(), 2); + assertTrue(role.getMembers().contains("user.user1")); + assertTrue(role.getMembers().contains("coretech.service")); + + // next without expand option + + role = zclt.getRole(domName, roleName, false, false); + assertNotNull(role); + assertEquals(role.getTrust(), "trusted-domain"); + assertNull(role.getMembers()); + } + + @Test + public void testGetRoles() throws Exception { + + String domName = "roles-members"; + + Role trustRole = new Role(); + trustRole.setName(domName + ":role.trust-role"); + trustRole.setTrust("trusted-domain"); + + Role groupRoleWithMembers = new Role(); + groupRoleWithMembers.setName(domName + ":role.group-role"); + List members = new ArrayList<>(); + members.add("user.user1"); + members.add("coretech.service"); + groupRoleWithMembers.setMembers(members); + + Role groupRoleWithoutMembers = new Role(); + groupRoleWithoutMembers.setName(domName + ":role.group-role"); + + List retListWithMembers = new ArrayList<>(); + retListWithMembers.add(groupRoleWithMembers); + retListWithMembers.add(trustRole); + Roles retRolesWithMembers = new Roles().setList(retListWithMembers); + + List retListWithoutMembers = new ArrayList<>(); + retListWithoutMembers.add(groupRoleWithoutMembers); + retListWithoutMembers.add(trustRole); + Roles retRolesWithoutMembers = new Roles().setList(retListWithoutMembers); + + Mockito.doReturn(retRolesWithMembers).when(mockZMS).getRoles(domName, true); + Mockito.doReturn(retRolesWithoutMembers).when(mockZMS).getRoles(domName, false); + + // first request with members option set + + Roles roles = zclt.getRoles(domName, true); + assertNotNull(roles); + assertNotNull(roles.getList()); + + boolean groupRoleCheck = false; + boolean trustRoleCheck = false; + for (Role role : roles.getList()) { + switch (role.getName()) { + case "roles-members:role.trust-role": + assertEquals(role.getTrust(), "trusted-domain"); + assertNull(role.getMembers()); + trustRoleCheck = true; + break; + case "roles-members:role.group-role": + assertNull(role.getTrust()); + assertNotNull(role.getMembers()); + assertEquals(role.getMembers().size(), 2); + assertTrue(role.getMembers().contains("user.user1")); + assertTrue(role.getMembers().contains("coretech.service")); + groupRoleCheck = true; + break; + } + } + assertTrue(groupRoleCheck); + assertTrue(trustRoleCheck); + + // next without members option + + roles = zclt.getRoles(domName, false); + assertNotNull(roles); + assertNotNull(roles.getList()); + + groupRoleCheck = false; + trustRoleCheck = false; + for (Role role : roles.getList()) { + switch (role.getName()) { + case "roles-members:role.trust-role": + assertEquals(role.getTrust(), "trusted-domain"); + assertNull(role.getMembers()); + trustRoleCheck = true; + break; + case "roles-members:role.group-role": + assertNull(role.getTrust()); + assertNull(role.getMembers()); + groupRoleCheck = true; + break; + } + } + assertTrue(groupRoleCheck); + assertTrue(trustRoleCheck); + } + + @Test + public void testPutTenancyResourceGroup() throws Exception { + + String tenantDomain = "tenant"; + String providerService = "coretech.storage"; + String resourceGroup = "hockey"; + TenancyResourceGroup tenantResourceGroup = new TenancyResourceGroup(); + tenantResourceGroup.setDomain(tenantDomain).setService(providerService).setResourceGroup(resourceGroup); + Mockito.doReturn(null) + .when(mockZMS).putTenancyResourceGroup(tenantDomain, providerService, resourceGroup, + auditRef, tenantResourceGroup); + + try { + zclt.putTenancyResourceGroup(tenantDomain, providerService, + resourceGroup, auditRef, tenantResourceGroup); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testDeleteTenancyResourceGroup() throws Exception { + + String tenantDomain = "tenant"; + String providerService = "coretech.storage"; + String resourceGroup = "hockey"; + Mockito.doReturn(null) + .when(mockZMS).deleteTenancyResourceGroup(tenantDomain, providerService, resourceGroup, auditRef); + + try { + zclt.deleteTenancyResourceGroup(tenantDomain, providerService, + resourceGroup, auditRef); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testPutTenantResourceGroupRoles() throws Exception { + + String tenantDomain = "tenant"; + String providerDomain = "coretech"; + String providerService = "storage"; + String resourceGroup = "hockey"; + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles(); + tenantRoles.setTenant(tenantDomain).setDomain(providerDomain).setService(providerService) + .setResourceGroup(resourceGroup); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + tenantRoles.setRoles(roleActions); + Mockito.doReturn(null) + .when(mockZMS).putTenantResourceGroupRoles(providerDomain, providerService, tenantDomain, + resourceGroup, auditRef, tenantRoles); + + try { + zclt.putTenantResourceGroupRoles(providerDomain, providerService, + tenantDomain, resourceGroup, auditRef, tenantRoles); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testDeleteTenantResourceGroupRoles() throws Exception { + + String tenantDomain = "tenant"; + String providerDomain = "coretech"; + String providerService = "storage"; + String resourceGroup = "hockey"; + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles(); + tenantRoles.setTenant(tenantDomain).setDomain(providerDomain).setService(providerService) + .setResourceGroup(resourceGroup); + + Mockito.doReturn(null) + .when(mockZMS).deleteTenantResourceGroupRoles(providerDomain, providerService, tenantDomain, + resourceGroup, auditRef); + + try { + zclt.deleteTenantResourceGroupRoles(providerDomain, providerService, tenantDomain, + resourceGroup, auditRef); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testGetTenantResourceGroupRoles() throws Exception { + + String tenantDomain = "tenant"; + String providerDomain = "coretech"; + String providerService = "storage"; + String resourceGroup = "hockey"; + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles(); + tenantRoles.setTenant(tenantDomain).setDomain(providerDomain).setService(providerService) + .setResourceGroup(resourceGroup); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + tenantRoles.setRoles(roleActions); + Mockito.doReturn(tenantRoles) + .when(mockZMS).getTenantResourceGroupRoles(providerDomain, + providerService, tenantDomain, resourceGroup); + + TenantResourceGroupRoles retRoles = null; + try { + retRoles = zclt.getTenantResourceGroupRoles(providerDomain, + providerService, tenantDomain, resourceGroup); + } catch (Exception exc) { + fail(); + } + + assertNotNull(retRoles); + assertEquals(tenantDomain, retRoles.getTenant()); + assertEquals(providerDomain, retRoles.getDomain()); + assertEquals(providerService, retRoles.getService()); + assertEquals(resourceGroup, retRoles.getResourceGroup()); + + // try to get unknown resource group that would return null + + try { + retRoles = zclt.getTenantResourceGroupRoles(providerDomain, + providerService, tenantDomain, "baseball"); + } catch (Exception exc) { + fail(); + } + + assertNull(retRoles); + } + + @Test + public void testPutProviderResourceGroupRoles() throws Exception { + + String tenantDomain = "tenant"; + String providerDomain = "coretech"; + String providerService = "storage"; + String resourceGroup = "hockey"; + ProviderResourceGroupRoles provRoles = new ProviderResourceGroupRoles(); + provRoles.setTenant(tenantDomain).setDomain(providerDomain) + .setService(providerService).setResourceGroup(resourceGroup); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + provRoles.setRoles(roleActions); + Mockito.doReturn(null) + .when(mockZMS).putProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, + resourceGroup, auditRef, provRoles); + + try { + zclt.putProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, + resourceGroup, auditRef, provRoles); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testDeleteProviderResourceGroupRoles() throws Exception { + + String tenantDomain = "tenant"; + String providerDomain = "coretech"; + String providerService = "storage"; + String resourceGroup = "hockey"; + ProviderResourceGroupRoles provRoles = new ProviderResourceGroupRoles(); + provRoles.setTenant(tenantDomain).setDomain(providerDomain) + .setService(providerService).setResourceGroup(resourceGroup); + + Mockito.doReturn(null) + .when(mockZMS).deleteProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, + resourceGroup, auditRef); + + try { + zclt.deleteProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, + resourceGroup, auditRef); + } catch (Exception exc) { + fail(); + } + } + + @Test + public void testGetProviderResourceGroupRoles() throws Exception { + + String tenantDomain = "tenant"; + String providerDomain = "coretech"; + String providerService = "storage"; + String resourceGroup = "hockey"; + ProviderResourceGroupRoles provRoles = new ProviderResourceGroupRoles(); + provRoles.setTenant(tenantDomain).setDomain(providerDomain) + .setService(providerService).setResourceGroup(resourceGroup); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + provRoles.setRoles(roleActions); + Mockito.doReturn(provRoles) + .when(mockZMS).getProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, resourceGroup); + + ProviderResourceGroupRoles retRoles = null; + try { + retRoles = zclt.getProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, resourceGroup); + } catch (Exception exc) { + fail(); + } + + assertNotNull(retRoles); + assertEquals(tenantDomain, retRoles.getTenant()); + assertEquals(providerDomain, retRoles.getDomain()); + assertEquals(providerService, retRoles.getService()); + assertEquals(resourceGroup, retRoles.getResourceGroup()); + + // try to get unknown resource group that would return null + + try { + retRoles = zclt.getProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, "baseball"); + } catch (Exception exc) { + fail(); + } + + assertNull(retRoles); + } + + @Test + public void testGetTemplate() throws Exception { + + Template template = new Template(); + Role role = new Role().setName("role1").setTrust("trust-domain"); + List roleList = new ArrayList<>(); + roleList.add(role); + template.setRoles(roleList); + Policy policy = new Policy().setName("policy1"); + List policyList = new ArrayList<>(); + policyList.add(policy); + template.setPolicies(policyList); + + Mockito.doReturn(template).when(mockZMS).getTemplate("vipng"); + + Template solTemplate = zclt.getTemplate("vipng"); + assertNotNull(solTemplate); + List solRoles = solTemplate.getRoles(); + assertNotNull(solRoles); + assertEquals(1, solRoles.size()); + assertEquals("role1", solRoles.get(0).getName()); + assertEquals("trust-domain", solRoles.get(0).getTrust()); + + List solPolicies = solTemplate.getPolicies(); + assertNotNull(solPolicies); + assertEquals(1, solPolicies.size()); + assertEquals("policy1", solPolicies.get(0).getName()); + } + + @Test + public void testGetServerTemplateList() throws Exception { + ServerTemplateList templateList = new ServerTemplateList(); + List names = new ArrayList<>(); + names.add("vipng"); + names.add("mh2"); + templateList.setTemplateNames(names); + + Mockito.doReturn(templateList).when(mockZMS).getServerTemplateList(); + + ServerTemplateList solTemplateList = zclt.getServerTemplateList(); + assertNotNull(solTemplateList); + assertEquals(2, solTemplateList.getTemplateNames().size()); + assertTrue(solTemplateList.getTemplateNames().contains("mh2")); + assertTrue(solTemplateList.getTemplateNames().contains("vipng")); + } + + @Test + public void testGetDomainTemplateList() throws Exception { + DomainTemplateList templateList = new DomainTemplateList(); + List names = new ArrayList<>(); + names.add("vipng"); + names.add("mh2"); + templateList.setTemplateNames(names); + + Mockito.doReturn(templateList).when(mockZMS).getDomainTemplateList("iaas.athenz"); + + DomainTemplateList domTemplateList = zclt.getDomainTemplateList("iaas.athenz"); + assertNotNull(domTemplateList); + assertEquals(2, domTemplateList.getTemplateNames().size()); + assertTrue(domTemplateList.getTemplateNames().contains("mh2")); + assertTrue(domTemplateList.getTemplateNames().contains("vipng")); + } + + @Test + public void testGetPrincipal() { + + ServicePrincipal svcPrincipal = new ServicePrincipal().setDomain("coretech").setService("storage"); + Mockito.doReturn(svcPrincipal).when(mockZMS).getServicePrincipal(); + + Principal principal = zclt.getPrincipal("v=U1;d=coretech;n=storage;s=signature"); + assertNotNull(principal); + assertTrue(principal.getName().equals("storage")); + assertTrue(principal.getDomain().equals("coretech")); + } + + @Test + public void testDomainListByAccount() throws Exception { + + DomainList domList = new DomainList(); + List domains = new ArrayList<>(); + domains.add("dom1"); + domList.setNames(domains); + + DomainList domEmptyList = new DomainList(); + + Mockito.doReturn(domList).when(mockZMS).getDomainList(null, null, null, null, + "1234", null, null, null, null); + Mockito.doReturn(domEmptyList).when(mockZMS).getDomainList(null, null, null, null, + "1235", null, null, null, null); + + DomainList domainList = zclt.getDomainList(null, null, null, null, "1234", null, null); + assertNotNull(domainList); + assertTrue(domainList.getNames().contains("dom1")); + + domainList = zclt.getDomainList(null, null, null, null, "1235", null, null); + assertNotNull(domainList); + assertNull(domainList.getNames()); + } + + @Test + public void testDomainListByProductId() throws Exception { + + DomainList domList = new DomainList(); + List domains = new ArrayList<>(); + domains.add("dom1"); + domList.setNames(domains); + + DomainList domEmptyList = new DomainList(); + + Mockito.doReturn(domList).when(mockZMS).getDomainList(null, null, null, null, null, + Integer.valueOf(101), null, null, null); + Mockito.doReturn(domEmptyList).when(mockZMS).getDomainList(null, null, null, null, null, + Integer.valueOf(102), null, null, null); + + DomainList domainList = zclt.getDomainList(null, null, null, null, null, Integer.valueOf(101), null); + assertNotNull(domainList); + assertTrue(domainList.getNames().contains("dom1")); + + domainList = zclt.getDomainList(null, null, null, null, null, Integer.valueOf(102), null); + assertNotNull(domainList); + assertNull(domainList.getNames()); + } + + @Test + public void testDomainListByRole() throws Exception { + + DomainList domList = new DomainList(); + List domains = new ArrayList<>(); + domains.add("dom1"); + domList.setNames(domains); + + DomainList domEmptyList = new DomainList(); + + Mockito.doReturn(domList).when(mockZMS).getDomainList(null, null, null, null, null, + null, "user.user1", "admin", null); + Mockito.doReturn(domEmptyList).when(mockZMS).getDomainList(null, null, null, null, null, + null, "user.user2", "admin", null); + + DomainList domainList = zclt.getDomainList("user.user1", "admin"); + assertNotNull(domainList); + assertTrue(domainList.getNames().contains("dom1")); + + domainList = zclt.getDomainList("user.user2", "admin"); + assertNotNull(domainList); + assertNull(domainList.getNames()); + } + + @Test + public void testEntityList() { + + String domName = "johnnies-place"; + List names = new ArrayList<>(); + names.add("entity1"); + names.add("entity2"); + EntityList entList = new EntityList().setNames(names); + + Mockito.doReturn(entList).when(mockZMS).getEntityList(domName); + + EntityList list = zclt.getEntityList(domName); + assertNotNull(list); + List ents = list.getNames(); + assertEquals(ents.size(), 2); + assertTrue(ents.contains("entity1")); + assertTrue(ents.contains("entity2")); + } + + @Test + public void testGetResourceAccessList() throws Exception { + + ResourceAccessList rsrcEmptyList = new ResourceAccessList(); + + ResourceAccessList rsrcList = new ResourceAccessList(); + + ResourceAccess rsrcAccess = new ResourceAccess(); + rsrcAccess.setPrincipal("user.user"); + Assertion assertion = new Assertion().setAction("update").setRole("athenz:role.role1").setResource("athenz:resource1"); + List assertions = new ArrayList<>(); + assertions.add(assertion); + rsrcAccess.setAssertions(assertions); + + List resources = new ArrayList<>(); + resources.add(rsrcAccess); + + rsrcList.setResources(resources); + + Mockito.doReturn(rsrcList).when(mockZMS).getResourceAccessList("user.user", "update"); + Mockito.doReturn(rsrcEmptyList).when(mockZMS).getResourceAccessList("user.user1", "create"); + + ResourceAccessList rsrcAccessList = zclt.getResourceAccessList("user.user", "update"); + assertNotNull(rsrcAccessList); + assertEquals(rsrcAccessList.getResources().size(), 1); + + rsrcAccess = rsrcAccessList.getResources().get(0); + assertEquals(rsrcAccess.getPrincipal(), "user.user"); + + rsrcAccessList = zclt.getResourceAccessList("user.user1", "create"); + assertNotNull(rsrcAccessList); + assertNull(rsrcAccessList.getResources()); + } + + @Test + public void testGetPolicies() throws Exception { + + final String domName = "get-policies"; + + Policy policyWithAssertions = new Policy(); + policyWithAssertions.setName(domName + ":policy.assert-policy"); + policyWithAssertions.setModified(Timestamp.fromCurrentTime()); + List assertions = new ArrayList<>(); + Assertion assertion = new Assertion() + .setAction("update") + .setEffect(AssertionEffect.ALLOW) + .setId((long) 101) + .setResource(domName + ":*") + .setRole("admin"); + assertions.add(assertion); + policyWithAssertions.setAssertions(assertions); + + Policy policyWithOutAssertions = new Policy(); + policyWithOutAssertions.setName(domName + ":policy.no-assert-policy"); + policyWithOutAssertions.setModified(Timestamp.fromCurrentTime()); + + List retListWithAssertions = new ArrayList<>(); + retListWithAssertions.add(policyWithAssertions); + Policies retPoliciesWithAssertions = new Policies().setList(retListWithAssertions); + + List retListWithOutAssertions = new ArrayList<>(); + retListWithOutAssertions.add(policyWithOutAssertions); + Policies retPoliciesWithOutAssertions = new Policies().setList(retListWithOutAssertions); + + Mockito.doReturn(retPoliciesWithAssertions).when(mockZMS).getPolicies(domName, true); + Mockito.doReturn(retPoliciesWithOutAssertions).when(mockZMS).getPolicies(domName, false); + + // first request with assertions option set + + Policies policies = zclt.getPolicies(domName, true); + assertNotNull(policies); + assertNotNull(policies.getList()); + + boolean policyCheck = false; + for (Policy policy : policies.getList()) { + switch (policy.getName()) { + case "get-policies:policy.assert-policy": + assertNotNull(policy.getModified()); + List testAssertions = policy.getAssertions(); + assertNotNull(testAssertions); + assertEquals(testAssertions.size(), 1); + assertEquals(testAssertions.get(0).getAction(), "update"); + policyCheck = true; + break; + } + } + assertTrue(policyCheck); + + // next without assertions option + + policies = zclt.getPolicies(domName, false); + assertNotNull(policies); + assertNotNull(policies.getList()); + + policyCheck = false; + for (Policy policy : policies.getList()) { + switch (policy.getName()) { + case "get-policies:policy.no-assert-policy": + assertNotNull(policy.getModified()); + assertNull(policy.getAssertions()); + policyCheck = true; + break; + } + } + assertTrue(policyCheck); + } + + @Test + public void testGetServices() throws Exception { + + final String domName = "get-services"; + + ServiceIdentity serviceWithKeysHosts = new ServiceIdentity(); + serviceWithKeysHosts.setName(domName + ".service-key-host") + .setGroup("users") + .setExecutable("/usr/bin/jetty") + .setModified(Timestamp.fromCurrentTime()) + .setUser("root"); + List publicKeys = new ArrayList<>(); + PublicKeyEntry publicKey = new PublicKeyEntry().setId("0").setKey("key"); + publicKeys.add(publicKey); + serviceWithKeysHosts.setPublicKeys(publicKeys); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + serviceWithKeysHosts.setHosts(hosts); + + ServiceIdentity serviceWithKeysOnly = new ServiceIdentity(); + serviceWithKeysOnly.setName(domName + ".service-key-only") + .setGroup("users") + .setExecutable("/usr/bin/jetty") + .setModified(Timestamp.fromCurrentTime()) + .setUser("root") + .setPublicKeys(publicKeys); + + ServiceIdentity serviceWithHostsOnly = new ServiceIdentity(); + serviceWithHostsOnly.setName(domName + ".service-host-only") + .setGroup("users") + .setExecutable("/usr/bin/jetty") + .setModified(Timestamp.fromCurrentTime()) + .setUser("root") + .setHosts(hosts); + + List retListWithKeysHosts = new ArrayList<>(); + retListWithKeysHosts.add(serviceWithKeysHosts); + ServiceIdentities retServicesWithKeysHosts = new ServiceIdentities().setList(retListWithKeysHosts); + + List retListWithKeysOnly = new ArrayList<>(); + retListWithKeysOnly.add(serviceWithKeysOnly); + ServiceIdentities retServicesWithKeysOnly = new ServiceIdentities().setList(retListWithKeysOnly); + + List retListWithHostsOnly = new ArrayList<>(); + retListWithHostsOnly.add(serviceWithHostsOnly); + ServiceIdentities retServicesWithHostsOnly = new ServiceIdentities().setList(retListWithHostsOnly); + + Mockito.doReturn(retServicesWithKeysHosts).when(mockZMS).getServiceIdentities(domName, true, true); + Mockito.doReturn(retServicesWithKeysOnly).when(mockZMS).getServiceIdentities(domName, true, false); + Mockito.doReturn(retServicesWithHostsOnly).when(mockZMS).getServiceIdentities(domName, false, true); + + // first request with keys and hosts option set + + ServiceIdentities services = zclt.getServiceIdentities(domName, true, true); + assertNotNull(services); + assertNotNull(services.getList()); + + boolean serviceCheck = false; + for (ServiceIdentity service : services.getList()) { + switch (service.getName()) { + case "get-services.service-key-host": + assertNotNull(service.getModified()); + List testPublicKeys = service.getPublicKeys(); + assertNotNull(testPublicKeys); + assertEquals(testPublicKeys.size(), 1); + assertEquals(testPublicKeys.get(0).getId(), "0"); + assertEquals(testPublicKeys.get(0).getKey(), "key"); + List testHosts = service.getHosts(); + assertNotNull(testHosts); + assertEquals(testHosts.size(), 1); + assertEquals(testHosts.get(0), "host1"); + serviceCheck = true; + break; + } + } + assertTrue(serviceCheck); + + // next with only key option + + services = zclt.getServiceIdentities(domName, true, false); + assertNotNull(services); + assertNotNull(services.getList()); + + serviceCheck = false; + for (ServiceIdentity service : services.getList()) { + switch (service.getName()) { + case "get-services.service-key-only": + assertNotNull(service.getModified()); + List testPublicKeys = service.getPublicKeys(); + assertNotNull(testPublicKeys); + assertEquals(testPublicKeys.size(), 1); + assertEquals(testPublicKeys.get(0).getId(), "0"); + assertEquals(testPublicKeys.get(0).getKey(), "key"); + assertNull(service.getHosts()); + serviceCheck = true; + break; + } + } + assertTrue(serviceCheck); + + // next with only host option + + services = zclt.getServiceIdentities(domName, false, true); + assertNotNull(services); + assertNotNull(services.getList()); + + serviceCheck = false; + for (ServiceIdentity service : services.getList()) { + switch (service.getName()) { + case "get-services.service-host-only": + assertNotNull(service.getModified()); + assertNull(service.getPublicKeys()); + List testHosts = service.getHosts(); + assertNotNull(testHosts); + assertEquals(testHosts.size(), 1); + assertEquals(testHosts.get(0), "host1"); + serviceCheck = true; + break; + } + } + assertTrue(serviceCheck); + } + + @Test + public void testGetAssertion() throws Exception { + + final String domName = "get-assertion"; + Assertion assertion = new Assertion() + .setAction("update") + .setEffect(AssertionEffect.ALLOW) + .setId((long) 101) + .setResource(domName + ":*") + .setRole("admin"); + + Mockito.doReturn(assertion).when(mockZMS).getAssertion(domName, "policy1", new Long(101)); + Mockito.doThrow(new ResourceException(404)).when(mockZMS).getAssertion(domName, "policy1", new Long(202)); + + // first invalid test cases + + // unknown policy name + Assertion testAssertion = zclt.getAssertion(domName, "policy2", new Long(101)); + assertNull(testAssertion); + + // unknown domain name + + testAssertion = zclt.getAssertion("unknown", "policy1", new Long(101)); + assertNull(testAssertion); + + // unknown assertion id + + testAssertion = zclt.getAssertion(domName, "policy1", new Long(102)); + assertNull(testAssertion); + + // exception unit test + + try { + zclt.getAssertion(domName, "policy1", new Long(202)); + fail(); + } catch (ZMSClientException ex) { + assertEquals(ex.getCode(), 404); + } + + // now valid case + + testAssertion = zclt.getAssertion(domName, "policy1", new Long(101)); + assertNotNull(testAssertion); + assertEquals(assertion.getAction(), "update"); + assertEquals((long) assertion.getId(), (long) 101); + } + + @Test + public void testDeleteAssertion() throws Exception { + + final String domName = "delete-assertion"; + + Mockito.doReturn(null).when(mockZMS).deleteAssertion(domName, "policy1", new Long(101), auditRef); + Mockito.doThrow(new ResourceException(403)).when(mockZMS).deleteAssertion(domName, "policy1", new Long(202), auditRef); + + // first valid case should complete successfully + + zclt.deleteAssertion(domName, "policy1", new Long(101), auditRef); + + // now this should throw an exception + + try { + zclt.deleteAssertion(domName, "policy1", new Long(202), auditRef); + fail(); + } catch (ZMSClientException ex) { + assertEquals(ex.getCode(), 403); + } + } + + @Test + public void testPutAssertion() throws Exception { + + final String domName = "put-assertion"; + Assertion assertion = new Assertion() + .setAction("update") + .setEffect(AssertionEffect.ALLOW) + .setResource(domName + ":*") + .setRole("admin"); + + Assertion retAssertion = new Assertion() + .setAction("update") + .setEffect(AssertionEffect.ALLOW) + .setId((long) 101) + .setResource(domName + ":*") + .setRole("admin"); + + Mockito.doReturn(retAssertion).when(mockZMS).putAssertion(domName, "policy1", auditRef, assertion); + Mockito.doThrow(new ResourceException(403)).when(mockZMS).putAssertion(domName, "policy2", auditRef, assertion); + + // first valid case should complete successfully + + Assertion checkAssertion = zclt.putAssertion(domName, "policy1", auditRef, assertion); + assertEquals(checkAssertion.getId(), Long.valueOf(101)); + + // now this should throw an exception + + try { + zclt.putAssertion(domName, "policy2", auditRef, assertion); + fail(); + } catch (ZMSClientException ex) { + assertEquals(ex.getCode(), 403); + } + } +} + diff --git a/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSClientTest.java b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSClientTest.java new file mode 100644 index 00000000000..338fa823211 --- /dev/null +++ b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSClientTest.java @@ -0,0 +1,2076 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.rdl.Array; +import com.yahoo.rdl.Struct; + +import static org.testng.Assert.*; + +import org.mockito.Mockito; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +public class ZMSClientTest { + + private String systemAdminUser = null; + private String systemAdminFullUser = null; + private static String ZMS_CLIENT_PROP_ZMS_URL = "athenz.zms.client.zms_url"; + private static String ZMS_CLIENT_PROP_TEST_ADMIN = "athenz.zms.client.test_admin"; + + private static final String PUB_KEY_ZONE1 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BM" + + "EdDU3FHU0liM0RRRUJBUVVBQTRHTkFEQ0JpUUtCZ1FDMXRHU1ZDQTh3bDVldzVZNzZXajJySkFVRA" + + "pZYW5FSmZLbUFseDVjUS84aEtFVWZTU2dwWHIzQ3pkaDFhMjZkbGI3bW1LMjlxbVhKWGg2dW1XOUF" + + "5ZlRPS1ZvCis2QVNsb1ZVM2F2dnVmbEdVT0VnMmpzbWRha1IyNEtjTGpBdTZRclVlNDE3bEczdDhx" + + "U1BJR2pTNUMrQ3NKVXcKaDA0aEh4NWYrUEV3eFY0cmJRSURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLR" + + "VktLS0tLQo-"; + private static final String PUB_KEY_ZONE2 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRW" + + "UpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTDRnNlF1bGVRcG42bytpSmorK09nenNZM3hXekhHUw" + + "p4ZW1xZzZhdkkvbHhvT3Jzd2h4YW93MjMrR3AxZXhOWEdzQlNsTkFQSXh5N3RHTXZaRnY0Q3ZrQ0F" + + "3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + + private boolean printURL = true; + + static final Struct TABLE_PROVIDER_ROLE_ACTIONS = new Struct() + .with("admin", "*").with("writer", "WRITE").with("reader", "READ"); + + private static String AUDIT_REF = "zmsjcltest"; + + static final int BASE_PRODUCT_ID = 100000000; // these product id's will lie in 100 million range + static java.util.Random domainProductId = new java.security.SecureRandom(); + + static synchronized int getRandomProductId() { + return BASE_PRODUCT_ID + domainProductId.nextInt(99999999); + } + + @BeforeClass + public void setup() { + System.setProperty(ZMS_CLIENT_PROP_ZMS_URL, "http://localhost:10080/"); + + systemAdminUser = System.getProperty(ZMS_CLIENT_PROP_TEST_ADMIN, "user_admin"); + systemAdminFullUser = "user." + systemAdminUser; + } + + private Principal createPrincipal(String userName) { + Authority authority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Principal p = SimplePrincipal.create("user", userName, + "v=U1;d=user;n=" + userName + ";s=signature", 0, authority); + return p; + } + + private DomainMeta createDomainMetaObject(String description, String org, boolean auditEnabled) { + + DomainMeta meta = new DomainMeta(); + meta.setDescription(description); + meta.setOrg(org); + meta.setAuditEnabled(auditEnabled); + + return meta; + } + + private ZMSClient createClient(String userName) { + ZMSClient client = new ZMSClient(getZMSUrl()); + client.addCredentials(createPrincipal(userName)); + + if (printURL) { + System.out.println("ZMS Url set to: " + client.getZmsUrl()); + printURL = false; + } + + return client; + } + + private String getZMSUrl() { + + // if we're given a config setting then use that + + String zmsUrl = System.getProperty(ZMS_CLIENT_PROP_ZMS_URL); + + // if the value is not available then check the env setting + + if (zmsUrl == null) { + zmsUrl = System.getenv("ZMS_URL"); + } + + return zmsUrl; + } + + private TopLevelDomain createTopLevelDomainObject(String name, + String description, String org, String admin) { + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setEnabled(true); + dom.setYpmId(getRandomProductId()); + + List admins = new ArrayList(); + admins.add(admin); + dom.setAdminUsers(admins); + + return dom; + } + + private SubDomain createSubDomainObject(String name, String parent, + String description, String org, String admin) { + + SubDomain dom = new SubDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setParent(parent); + dom.setEnabled(true); + + List admins = new ArrayList(); + admins.add(admin); + dom.setAdminUsers(admins); + + return dom; + } + + private Role createRoleObject(ZMSClient client, String domainName, String roleName, + String trust, String member1, String member2) { + + Role role = new Role(); + role.setName(client.generateRoleName(domainName, roleName)); + role.setTrust(trust); + + List members = new ArrayList(); + members.add(member1); + if (member2 != null) { + members.add(member2); + } + role.setMembers(members); + return role; + } + + private Policy createPolicyObject(ZMSClient client, String domainName, String policyName, + String roleName, String action, String resource, AssertionEffect effect) { + + Policy policy = new Policy(); + policy.setName(client.generatePolicyName(domainName, policyName)); + + Assertion assertion = new Assertion(); + assertion.setAction(action); + assertion.setEffect(effect); + assertion.setResource(resource); + assertion.setRole(client.generateRoleName(domainName, roleName)); + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + return policy; + } + + private Policy createPolicyObject(ZMSClient client, String domainName, String policyName) { + return createPolicyObject(client, domainName, policyName, "Role1", "*", domainName + ":*", AssertionEffect.ALLOW); + } + + private ServiceIdentity createServiceObject(ZMSClient client, String domainName, + String serviceName, String endPoint, String executable, String user, + String group, String host) { + + ServiceIdentity service = new ServiceIdentity(); + service.setExecutable(executable); + service.setName(client.generateServiceIdentityName(domainName, serviceName)); + + List pubKeys = new ArrayList<>(); + pubKeys.add(new PublicKeyEntry().setId("0") + .setKey("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTk" + + "FEQ0JpUUtCZ1FDMXRHU1ZDQTh3bDVldzVZNzZXajJySkFVRApZYW5FSmZLbUFseDVjUS84aEtFVWZTU2dwWHI" + + "zQ3pkaDFhMjZkbGI3bW1LMjlxbVhKWGg2dW1XOUF5ZlRPS1ZvCis2QVNsb1ZVM2F2dnVmbEdVT0VnMmpzbWRh" + + "a1IyNEtjTGpBdTZRclVlNDE3bEczdDhxU1BJR2pTNUMrQ3NKVXcKaDA0aEh4NWYrUEV3eFY0cmJRSURBUUFCC" + + "i0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-")); + + service.setPublicKeys(pubKeys); + + service.setUser(user); + service.setGroup(group); + + service.setProviderEndpoint(endPoint); + + List hosts = new ArrayList(); + hosts.add(host); + service.setHosts(hosts); + + return service; + } + + private ServiceIdentity createServiceObjectWithZoneKeys(ZMSClient client, String domainName, + String serviceName, String endPoint, String executable, String user, + String group, String host) { + + ServiceIdentity service = new ServiceIdentity(); + service.setExecutable(executable); + service.setGroup(group); + service.setName(client.generateServiceIdentityName(domainName, serviceName)); + service.setUser(user); + + List pubKeys = new ArrayList<>(); + + PublicKeyEntry key1 = new PublicKeyEntry(); + key1.setId("zone1"); + key1.setKey(PUB_KEY_ZONE1); + + PublicKeyEntry key2 = new PublicKeyEntry(); + key2.setId("zone2"); + key2.setKey(PUB_KEY_ZONE2); + + pubKeys.add(key1); + pubKeys.add(key2); + service.setPublicKeys(pubKeys); + + service.setProviderEndpoint(endPoint); + + List hosts = new ArrayList(); + hosts.add(host); + service.setHosts(hosts); + + return service; + } + + private Entity createEntityObject(ZMSClient client, String entityName) { + + Entity entity = new Entity(); + entity.setName(entityName); + + Struct value = new Struct(); + value.put("Key1", "Value1"); + entity.setValue(value); + + return entity; + } + + private Tenancy createTenantObject(String domain, String service) { + + Tenancy tenant = new Tenancy(); + tenant.setDomain(domain); + tenant.setService(service); + + return tenant; + } + + private void testCreateTopLevelDomain(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddTopDom1", + "Test Domain1", "testOrg", adminUser); + Domain resDom1 = client.postTopLevelDomain(AUDIT_REF, dom1); + assertNotNull(resDom1); + + Domain resDom2 = client.getDomain("AddTopDom1"); + assertNotNull(resDom2); + + try { + client.getDomain("AddTopDom3"); + fail(); + } catch(ResourceException ex) { + assertTrue(true); + } + + try { + client.getDomain("AddTopDom3"); + fail(); + } catch(ResourceException ex) { + assertTrue(true); + } + + client.deleteTopLevelDomain("AddTopDom1", AUDIT_REF); + } + + private void testCreateTopLevelDomainOnceOnly(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddOnceTopDom1", + "Test Domain1", "testOrg", adminUser); + Domain resDom1 = client.postTopLevelDomain(AUDIT_REF, dom1); + assertNotNull(resDom1); + + // we should get an exception for the second call + + try { + client.postTopLevelDomain(AUDIT_REF, dom1); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + client.deleteTopLevelDomain("AddOnceTopDom1", AUDIT_REF); + } + + private void testCreateSubDomain(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddSubDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + SubDomain dom2 = createSubDomainObject("AddSubDom2", "AddSubDom1", + "Test Domain2", "testOrg", adminUser); + Domain resDom1 = client.postSubDomain("AddSubDom1", AUDIT_REF, dom2); + assertNotNull(resDom1); + try { + client.postSubDomain("AddSubDom3", AUDIT_REF, dom2); + fail(); + } catch(ResourceException ex) { + assertTrue(true); + } + + Domain resDom2 = client.getDomain("AddSubDom1.AddSubDom2"); + assertNotNull(resDom2); + + client.deleteSubDomain("AddSubDom1", "AddSubDom2", AUDIT_REF); + + client.deleteTopLevelDomain("AddSubDom1", AUDIT_REF); + } + + private void testCreateSubdomainOnceOnly(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddOnceSubDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + SubDomain dom2 = createSubDomainObject("AddOnceSubDom2", "AddOnceSubDom1", + "Test Domain2", "testOrg", adminUser); + Domain resDom1 = client.postSubDomain("AddOnceSubDom1", AUDIT_REF, dom2); + assertNotNull(resDom1); + + // we should get an exception for the second call + + try { + client.postSubDomain("AddOnceSubDom1", AUDIT_REF, dom2); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + client.deleteSubDomain("AddOnceSubDom1", "AddOnceSubDom2", AUDIT_REF); + client.deleteTopLevelDomain("AddOnceSubDom1", AUDIT_REF); + } + + private void testCreateRole(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateRoleDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Role role1 = createRoleObject(client, "CreateRoleDom1", "Role1", null, "user.joe", "user.jane"); + client.putRole("CreateRoleDom1", "Role1", AUDIT_REF, role1); + + Role role3 = client.getRole("CreateRoleDom1", "Role1"); + assertNotNull(role3); + assertEquals(role3.getName(), "CreateRoleDom1:role.Role1".toLowerCase()); + assertNull(role3.getTrust()); + + try { + client.putRole("CreateRoleDom1", "Role2", AUDIT_REF, role1); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + client.putRole("CreateRoleDom1", "Role3", AUDIT_REF, role1); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + + try { + client.getRole("CreateRoleDom1", "Role2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + client.getRole("CreateRoleDom1", "Role3"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + + client.deleteTopLevelDomain("CreateRoleDom1", AUDIT_REF); + } + + private void testAddMembership(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Role role1 = createRoleObject(client, "MbrAddDom1", "Role1", null, "user.joe", "user.jane"); + client.putRole("MbrAddDom1", "Role1", AUDIT_REF, role1); + client.putMembership("MbrAddDom1", "Role1", "user.doe", AUDIT_REF); + Role role = client.getRole("MbrAddDom1", "Role1"); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 3); + + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.doe")); + + client.deleteTopLevelDomain("MbrAddDom1", AUDIT_REF); + } + + private void testDeleteMembership(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrDelDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Role role1 = createRoleObject(client, "MbrDelDom1", "Role1", null, "user.joe", "user.jane"); + client.putRole("MbrDelDom1", "Role1", AUDIT_REF, role1); + client.deleteMembership("MbrDelDom1", "Role1", "user.joe", AUDIT_REF); + + Role role = client.getRole("MbrDelDom1", "Role1"); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + + assertFalse(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + + client.deleteTopLevelDomain("MbrDelDom1", AUDIT_REF); + } + + private void testCreatePolicy(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyAddDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Policy policy1 = createPolicyObject(client, "PolicyAddDom1", "Policy1"); + client.putPolicy("PolicyAddDom1", "Policy1", AUDIT_REF, policy1); + + Policy policyRes2 = client.getPolicy("PolicyAddDom1", "Policy1"); + assertNotNull(policyRes2); + assertEquals(policyRes2.getName(), "PolicyAddDom1:policy.Policy1".toLowerCase()); + + client.deleteTopLevelDomain("PolicyAddDom1", AUDIT_REF); + } + + private void testDeletePolicy(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyDelDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Policy policy1 = createPolicyObject(client, "PolicyDelDom1", "Policy1"); + client.putPolicy("PolicyDelDom1", "Policy1", AUDIT_REF, policy1); + + Policy policy2 = createPolicyObject(client, "PolicyDelDom1", "Policy2"); + client.putPolicy("PolicyDelDom1", "Policy2", AUDIT_REF, policy2); + + Policy policyRes1 = client.getPolicy("PolicyDelDom1", "Policy1"); + assertNotNull(policyRes1); + + Policy policyRes2 = client.getPolicy("PolicyDelDom1", "Policy2"); + assertNotNull(policyRes2); + + client.deletePolicy("PolicyDelDom1", "Policy1", AUDIT_REF); + + // we need to get an exception here + try { + client.getPolicy("PolicyDelDom1", "Policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + policyRes2 = client.getPolicy("PolicyDelDom1", "Policy2"); + assertNotNull(policyRes2); + + client.deletePolicy("PolicyDelDom1", "Policy2", AUDIT_REF); + + // we need to get an exception here + try { + client.getPolicy("PolicyDelDom1", "Policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + // we need to get an exception here + try { + client.getPolicy("PolicyDelDom1", "Policy2"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + client.deleteTopLevelDomain("PolicyDelDom1", AUDIT_REF); + } + + private void testCreateServiceIdentity(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + ServiceIdentity service = createServiceObject(client, "ServiceAddDom1", "Service1", + "http://localhost", "/usr/bin/java", "root", "users", "host1"); + + client.putServiceIdentity("ServiceAddDom1", "Service1", AUDIT_REF, service); + + ServiceIdentity serviceRes2 = client.getServiceIdentity("ServiceAddDom1", "Service1"); + assertNotNull(serviceRes2); + assertEquals(serviceRes2.getName(), "ServiceAddDom1.Service1".toLowerCase()); + + client.deleteTopLevelDomain("ServiceAddDom1", AUDIT_REF); + } + + private void testDeletePublicKeyEntry(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("DelPublicKeyDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + ServiceIdentity service = createServiceObjectWithZoneKeys(client, "DelPublicKeyDom1", "Service1", + "http://localhost", "/usr/bin/java", "root", "users", "host1"); + + client.putServiceIdentity("DelPublicKeyDom1", "Service1", AUDIT_REF, service); + + client.deletePublicKeyEntry("DelPublicKeyDom1", "Service1", "zone1", AUDIT_REF); + + try { + client.getPublicKeyEntry("DelPublicKeyDom1", "Service1", "zone1"); + fail(); + } catch (ZMSClientException ex) { + assertEquals(ex.getCode(), 404); + } + + PublicKeyEntry entry = client.getPublicKeyEntry("DelPublicKeyDom1", "Service1", "zone2"); + assertNotNull(entry); + assertEquals(entry.getKey(), PUB_KEY_ZONE2); + + // we are not allowed to delete the last public key + + try { + client.deletePublicKeyEntry("DelPublicKeyDom1", "Service1", "zone2", AUDIT_REF); + fail(); + } catch (ZMSClientException ex) { + assertEquals(ex.getCode(), 400); + } + + client.deleteTopLevelDomain("DelPublicKeyDom1", AUDIT_REF); + } + + private void testCreateEntity(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateEntityDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Entity entity1 = createEntityObject(client, "Entity1"); + client.putEntity("CreateEntityDom1", "Entity1", AUDIT_REF, entity1); + + Entity entity2 = client.getEntity("CreateEntityDom1", "Entity1"); + assertNotNull(entity2); + assertEquals(entity2.getName(), "Entity1".toLowerCase()); + + client.deleteTopLevelDomain("CreateEntityDom1", AUDIT_REF); + } + + private void testDeleteEntity(ZMSClient client, String adminUser) { + + TopLevelDomain dom1 = createTopLevelDomainObject("DelEntityDom1", + "Test Domain1", "testOrg", adminUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + Entity entity1 = createEntityObject(client, "Entity1"); + client.putEntity("DelEntityDom1", "Entity1", AUDIT_REF, entity1); + + Entity entity2 = createEntityObject(client, "Entity2"); + client.putEntity("DelEntityDom1", "Entity2", AUDIT_REF, entity2); + + Entity entityRes = client.getEntity("DelEntityDom1", "Entity1"); + assertNotNull(entityRes); + + entityRes = client.getEntity("DelEntityDom1", "Entity2"); + assertNotNull(entityRes); + + client.deleteEntity("DelEntityDom1", "Entity1", AUDIT_REF); + + try { + entityRes = client.getEntity("DelEntityDom1", "Entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + entityRes = client.getEntity("DelEntityDom1", "Entity2"); + assertNotNull(entityRes); + + client.deleteEntity("DelEntityDom1", "Entity2", AUDIT_REF); + + try { + entityRes = client.getEntity("DelEntityDom1", "Entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + try { + entityRes = client.getEntity("DelEntityDom1", "Entity2"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + client.deleteTopLevelDomain("DelEntityDom1", AUDIT_REF); + } + + // Unit Tests for ZMS Java Client + + @Test + public void testClientNoAuth() { + ZMSClient client = new ZMSClient("http://localhost:10080/zms/v1"); + assertNotNull(client); + } + + @Test + public void testClientOnlyUrl() { + String zmsUrl = getZMSUrl(); + ZMSClient client = new ZMSClient(zmsUrl); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + assertNotNull(client); + + // verify we can get domain list + DomainList domainListMock = Mockito.mock(DomainList.class); + Mockito.when(client.getDomainList()).thenReturn(domainListMock).thenThrow(new ResourceException(400)); + DomainList domList = client.getDomainList(); + assertNotNull(domList); + try { + client.getDomainList(); + fail(); + } catch(ResourceException ex) { + assertTrue(true); + } + + // verify we can't add a domain + + TopLevelDomain dom1 = createTopLevelDomainObject("OnlyUrlDomain", + "Test Domain1", "testOrg", systemAdminFullUser); + try { + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1)).thenThrow(new ResourceException(400)); + client.postTopLevelDomain(AUDIT_REF, dom1); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + } + + @Test + public void testClientInvalidPort() { + String zmsUrl = "http://localhost:11080/zms/v1"; + ZMSClient client = new ZMSClient(zmsUrl); + assertNotNull(client); + + // verify we can't get domain list and try some + // other operations which should all return + // zms client exceptions + + try { + client.getDomainList(); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + + try { + TopLevelDomain dom1 = createTopLevelDomainObject("OnlyUrlDomain", + "Test Domain1", "testOrg", systemAdminFullUser); + + client.postTopLevelDomain(AUDIT_REF, dom1); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + + try { + client.getAccess("UPDATE", "AccessDom1:resource1", "AccessDom1"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + } + + @Test + public void testClientUrlPrincipal() { + + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + assertNotNull(client); + + // verify we can get domain list + DomainList domainListMock = Mockito.mock(DomainList.class); + Mockito.when(client.getDomainList()).thenReturn(domainListMock); + DomainList domList = client.getDomainList(); + assertNotNull(domList); + + // verify we can add a domain + + TopLevelDomain dom1 = createTopLevelDomainObject("UrlPrincipalDomain", + "Test Domain1", "testOrg", systemAdminFullUser); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1)).thenReturn(domainMock); + Domain resDom1 = client.postTopLevelDomain(AUDIT_REF, dom1); + assertNotNull(resDom1); + + client.deleteTopLevelDomain("UrlPrincipalDomain", AUDIT_REF); + } + + @Test + public void testClientClearPrincipal() { + String zmsUrl = getZMSUrl(); + ZMSClient client = new ZMSClient(zmsUrl); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + assertNotNull(client); + + // add credentials + + Authority authority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Principal p = SimplePrincipal.create("user", systemAdminUser, + "v=U1;d=user;n=" + systemAdminUser + ";s=signature", 0, authority); + + client.addCredentials(p); + + // add credentials again + + client.addCredentials(p); + + // verify we can add a domain + + TopLevelDomain dom1 = createTopLevelDomainObject("ClearPrincipalDomain", + "Test Domain1", "testOrg", systemAdminFullUser); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1)).thenReturn(domainMock); + Domain resDom1 = client.postTopLevelDomain(AUDIT_REF, dom1); + assertNotNull(resDom1); + + client.deleteTopLevelDomain("ClearPrincipalDomain", AUDIT_REF); + + // clear the credentials + + client.clearCredentials(); + + // verify we can no longer add a new domain + + try { + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1)).thenThrow(new ResourceException(400)); + client.postTopLevelDomain(AUDIT_REF, dom1); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + + // but we should be able to read the domain list + DomainList domainListMock = Mockito.mock(DomainList.class); + Mockito.when(client.getDomainList()).thenReturn(domainListMock); + DomainList domList = client.getDomainList(); + assertNotNull(domList); + } + + @Test + public void testClientWithoutEndingSlash() { + String zmsUrl = getZMSUrl(); + if (zmsUrl == null) { + zmsUrl = "http://localhost:10080"; + } else { + if (zmsUrl.charAt(zmsUrl.length() - 1) == '/') { + zmsUrl = zmsUrl.substring(0, zmsUrl.length() - 1); + } + } + + ZMSClient client = new ZMSClient(zmsUrl); + assertNotNull(client); + + // verify we should be able to read the domain list + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + DomainList domainListMock = Mockito.mock(DomainList.class); + Mockito.when(c.getDomainList(null, null, null, null, null, null, null, null, null)).thenReturn(domainListMock); + DomainList domList = client.getDomainList(); + assertNotNull(domList); + } + + @Test + public void testGetDomainList() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.getDomainList(null, null, null, null, null, null, "MemberRole1", "RoleName1", null)) + .thenThrow(new NullPointerException()); + client.getDomainList("MemberRole1", "RoleName1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getDomainList(null, null, null, null, null, null, "MemberRole2", "RoleName2", null)) + .thenThrow(new ResourceException(400)); + client.getDomainList("MemberRole2", "RoleName2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteSubDomain() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.deleteSubDomain("parent", "domain1", AUDIT_REF)).thenThrow(new NullPointerException()); + client.deleteSubDomain("parent", "domain1", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteSubDomain("parent", "domain2", AUDIT_REF)).thenThrow(new ResourceException(400)); + client.deleteSubDomain("parent", "domain2", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPutTenancyResourceGroup() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TenancyResourceGroup trg = new TenancyResourceGroup().setDomain("test.domain").setService("test-service") + .setResourceGroup("test.group"); + try { + Mockito.when( + c.putTenancyResourceGroup("TenantDom1", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF, trg)) + .thenThrow(new NullPointerException()); + client.putTenancyResourceGroup("TenantDom1", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF, trg); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when( + c.putTenancyResourceGroup("TenantDom2", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF, trg)) + .thenThrow(new ResourceException(400)); + client.putTenancyResourceGroup("TenantDom2", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF, trg); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPutTenantResourceGroupRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles(); + try { + Mockito.when(c.putTenantResourceGroupRoles("ProvidorDomain1", "ProvidorService1", "TenantDom1", + "ResourceGroup1", AUDIT_REF, tenantRoles)).thenThrow(new NullPointerException()); + client.putTenantResourceGroupRoles("ProvidorDomain1", "ProvidorService1", "TenantDom1", "ResourceGroup1", + AUDIT_REF, tenantRoles); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.putTenantResourceGroupRoles("ProvidorDomain2", "ProvidorService1", "TenantDom1", + "ResourceGroup1", AUDIT_REF, tenantRoles)).thenThrow(new ResourceException(400)); + client.putTenantResourceGroupRoles("ProvidorDomain2", "ProvidorService1", "TenantDom1", "ResourceGroup1", + AUDIT_REF, tenantRoles); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetTenantResourceGroupRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.getTenantResourceGroupRoles("ProvidorDomain1", "ProvidorService1", "TenantDom1", + "ResourceGroup1")).thenThrow(new NullPointerException()); + client.getTenantResourceGroupRoles("ProvidorDomain1", "ProvidorService1", "TenantDom1", "ResourceGroup1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getTenantResourceGroupRoles("ProvidorDomain2", "ProvidorService1", "TenantDom1", + "ResourceGroup1")).thenThrow(new ResourceException(400)); + client.getTenantResourceGroupRoles("ProvidorDomain2", "ProvidorService1", "TenantDom1", "ResourceGroup1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteTenancyResourceGroup() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.deleteTenancyResourceGroup("TenantDom1", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF)) + .thenThrow(new NullPointerException()); + client.deleteTenancyResourceGroup("TenantDom1", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteTenancyResourceGroup("TenantDom2", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF)) + .thenThrow(new ResourceException(400)); + client.deleteTenancyResourceGroup("TenantDom2", "DelTenantRolesDom1", "ResourceGroup1", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.getRoles("domain1", true)).thenThrow(new NullPointerException()); + client.getRoles("domain1", true); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getRoles("domain2", true)).thenThrow(new ResourceException(400)); + client.getRoles("domain2", true); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetPolicies() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.getPolicies("domain1", true)).thenThrow(new NullPointerException()); + client.getPolicies("domain1", true); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getPolicies("domain2", true)).thenThrow(new ResourceException(400)); + client.getPolicies("domain2", true); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteUserDomain() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.deleteUserDomain("domain1", AUDIT_REF)).thenThrow(new NullPointerException()); + client.deleteUserDomain("domain1", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteUserDomain("domain2", AUDIT_REF)).thenThrow(new ResourceException(400)); + client.deleteUserDomain("domain2", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPutDomainMeta() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + DomainMeta meta = createDomainMetaObject("Test2 Domain", "NewOrg", false); + try { + Mockito.when(c.putDomainMeta("domain1", AUDIT_REF, meta)).thenThrow(new NullPointerException()); + client.putDomainMeta("domain1", AUDIT_REF, meta); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.putDomainMeta("domain2", AUDIT_REF, meta)).thenThrow(new ResourceException(400)); + client.putDomainMeta("domain2", AUDIT_REF, meta); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPutDomainTemplate() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + List tempNames = new ArrayList(); + DomainTemplate domTempl = new DomainTemplate().setTemplateNames(tempNames); + try { + Mockito.when(c.putDomainTemplate("name1", AUDIT_REF, domTempl)).thenThrow(new NullPointerException()); + client.putDomainTemplate("name1", AUDIT_REF, domTempl); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.putDomainTemplate("name2", AUDIT_REF, domTempl)) + .thenThrow(new ResourceException(404, "Domain not found")); + client.putDomainTemplate("name2", AUDIT_REF, domTempl); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetResourceAccessList() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.getResourceAccessList("principal1", "action1")).thenThrow(new NullPointerException()); + client.getResourceAccessList("principal1", "action1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getResourceAccessList("principal2", "action2")).thenThrow(new ResourceException(400)); + client.getResourceAccessList("principal2", "action2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testAssertion() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Assertion assertion = new Assertion(); + Long assertionId = 18000305032230531L; + try { + Mockito.when(c.putAssertion("domain1", "policy1", AUDIT_REF, assertion)) + .thenThrow(new NullPointerException()); + client.putAssertion("domain1", "policy1", AUDIT_REF, assertion); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getAssertion("principal2", "action2", assertionId)).thenThrow(new NullPointerException()); + client.getAssertion("principal2", "action2", assertionId); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteAssertion("principal2", "action2", assertionId, AUDIT_REF)) + .thenThrow(new NullPointerException()); + client.deleteAssertion("principal2", "action2", assertionId, AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetTemplate() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.getTemplate("template")).thenThrow(new NullPointerException()); + client.getTemplate("template"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getTemplate("template2")).thenThrow(new ResourceException(400)); + client.getTemplate("template2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetProviderResourceGroupRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.getProviderResourceGroupRoles("tenantDomain", "providerDomain", "providerServiceName", + "resourceGroup")).thenThrow(new NullPointerException()); + client.getProviderResourceGroupRoles("tenantDomain", "providerDomain", "providerServiceName", + "resourceGroup"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getProviderResourceGroupRoles("tenantDomain2", "providerDomain2", "providerServiceName2", + "resourceGroup2")).thenThrow(new ResourceException(400)); + client.getProviderResourceGroupRoles("tenantDomain2", "providerDomain2", "providerServiceName2", + "resourceGroup2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteProviderResourceGroupRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + try { + Mockito.when(c.deleteProviderResourceGroupRoles("tenantDomain", "providerDomain", "providerServiceName", + "resourceGroup", AUDIT_REF)).thenThrow(new NullPointerException()); + client.deleteProviderResourceGroupRoles("tenantDomain", "providerDomain", "providerServiceName", + "resourceGroup", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteProviderResourceGroupRoles("tenantDomain2", "providerDomain2", "providerServiceName2", + "resourceGroup2", AUDIT_REF)).thenThrow(new ResourceException(400)); + client.deleteProviderResourceGroupRoles("tenantDomain2", "providerDomain2", "providerServiceName2", + "resourceGroup2", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPutProviderResourceGroupRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + ProviderResourceGroupRoles provRoles = new ProviderResourceGroupRoles(); + try { + Mockito.when(c.putProviderResourceGroupRoles("tenantDomain", "providerDomain", "providerServiceName", + "resourceGroup", AUDIT_REF, provRoles)).thenThrow(new NullPointerException()); + client.putProviderResourceGroupRoles("tenantDomain", "providerDomain", "providerServiceName", + "resourceGroup", AUDIT_REF, provRoles); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.putProviderResourceGroupRoles("tenantDomain2", "providerDomain2", "providerServiceName2", + "resourceGroup2", AUDIT_REF, provRoles)).thenThrow(new ResourceException(400)); + client.putProviderResourceGroupRoles("tenantDomain2", "providerDomain2", "providerServiceName2", + "resourceGroup2", AUDIT_REF, provRoles); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPostUserDomain() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + UserDomain ud = new UserDomain().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test").setYpmId(10).setName("testuser") + .setTemplates(new DomainTemplateList().setTemplateNames(Arrays.asList("template"))); + try { + Mockito.when(c.postUserDomain("domain1", AUDIT_REF, ud)).thenThrow(new NullPointerException()); + client.postUserDomain("domain1", AUDIT_REF, ud); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.postUserDomain("domain2", AUDIT_REF, ud)).thenThrow(new ResourceException(400)); + client.postUserDomain("domain2", AUDIT_REF, ud); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testUserTokenWithAuthority() { + ZMSClient client = createClient(systemAdminUser); + assertNotNull(client); + } + + @Test + public void testCreateTopLevelDomainUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1 = createTopLevelDomainObject("AddTopDom1", + "Test Domain1", "testOrg", systemAdminFullUser); + Domain domainMock = Mockito.mock(Domain.class); + dom1.setAuditEnabled(true); + Mockito.when(c.postTopLevelDomain(Mockito.anyString(), Mockito.any(TopLevelDomain.class))).thenReturn(domainMock); + Mockito.when(c.getDomain("AddTopDom1")).thenReturn(domainMock); + Mockito.when(c.getDomain("AddTopDom3")).thenThrow(new NullPointerException()).thenThrow(new ResourceException(204));; + testCreateTopLevelDomain(client, systemAdminFullUser); + } + + @Test + public void testCreateTopLevelDomainOnceOnlyUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1 = createTopLevelDomainObject("AddTopDom1", + "Test Domain1", "testOrg", systemAdminFullUser); + Domain domainMock = Mockito.mock(Domain.class); + dom1.setAuditEnabled(true); + Mockito.when(c.postTopLevelDomain(Mockito.anyString(), Mockito.any(TopLevelDomain.class))).thenReturn(domainMock).thenThrow(new ResourceException(204)); + testCreateTopLevelDomainOnceOnly(client, systemAdminFullUser); + } + + @Test + public void testCreateSubDomainUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + SubDomain dom2 = createSubDomainObject("AddSubDom2", "AddSubDom1", + "Test Domain2", "testOrg", systemAdminFullUser); + Mockito.when(c.postSubDomain("AddSubDom1", AUDIT_REF, dom2)).thenReturn(domainMock); + Mockito.when(c.getDomain("AddSubDom1.AddSubDom2")).thenReturn(domainMock); + Mockito.when(c.postSubDomain("AddSubDom3", AUDIT_REF, dom2)).thenThrow(new NullPointerException()); + testCreateSubDomain(client, systemAdminFullUser); + } + + @Test + public void testCreateSubdomainOnceOnlyUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + SubDomain dom2 = createSubDomainObject("AddOnceSubDom2", "AddOnceSubDom1", + "Test Domain2", "testOrg", systemAdminFullUser); + Mockito.when(c.postSubDomain("AddOnceSubDom1", AUDIT_REF, dom2)).thenReturn(domainMock).thenThrow(new ResourceException(204)); + testCreateSubdomainOnceOnly(client, systemAdminFullUser); + } + + @Test + public void testCreateRoleUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + Role role1Mock = Mockito.mock(Role.class); + Role role1 = createRoleObject(client, "CreateRoleDom1", "Role1", null, "user.joe", "user.jane"); + Mockito.when(c.putRole("CreateRoleDom1", "Role1", AUDIT_REF, role1Mock)).thenReturn(role1Mock); + Mockito.when(c.getRole("CreateRoleDom1", "Role1", false, false)).thenReturn(role1Mock); + Mockito.when(role1Mock.getName()).thenReturn("CreateRoleDom1:role.Role1".toLowerCase()); + Mockito.when(role1Mock.getTrust()).thenReturn(null); + Mockito.when(c.putRole("CreateRoleDom1", "Role2", AUDIT_REF, role1)).thenThrow(new NullPointerException()); + Mockito.when(c.putRole("CreateRoleDom1", "Role3", AUDIT_REF, role1)).thenThrow(new ResourceException(400)); + Mockito.when(c.getRole("CreateRoleDom1", "Role2", false, false)).thenThrow(new NullPointerException()); + Mockito.when(c.getRole("CreateRoleDom1", "Role3", false, false)).thenThrow(new ResourceException(400)); + testCreateRole(client, systemAdminFullUser); + } + + @Test + public void testGetRoleList() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + RoleList roleListMock = Mockito.mock(RoleList.class); + Mockito.when(c.getRoleList("RoleListParamDom1", null, "Role1")).thenReturn(roleListMock); + RoleList roleList = client.getRoleList("RoleListParamDom1", null, "Role1"); + assertNotNull(roleList); + try { + Mockito.when(c.getRoleList("RoleListParamDom1", null, "Role2")).thenThrow(new ResourceException(204)); + client.getRoleList("RoleListParamDom1", null, "Role2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getRoleList("RoleListParamDom2", null, "Role2")).thenThrow(new NullPointerException()); + client.getRoleList("RoleListParamDom2", null, "Role2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getRoleList("RoleListParamDom1", null, null)).thenThrow(new ResourceException(204)); + client.getRoleList("RoleListParamDom1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getRoleList("RoleListParamDom2", null, null)).thenThrow(new NullPointerException()); + client.getRoleList("RoleListParamDom2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteRole() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Role roleMock = Mockito.mock(Role.class); + Mockito.when(c.deleteRole("DelRoleDom1", "Role1", AUDIT_REF)).thenReturn(roleMock); + client.deleteRole("DelRoleDom1", "Role1", AUDIT_REF); + try { + Mockito.when(c.deleteRole("DelRoleDom1", "Role2", AUDIT_REF)).thenThrow(new ResourceException(204)); + client.deleteRole("DelRoleDom1", "Role2", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteRole("DelRoleDom2", "Role2", AUDIT_REF)).thenThrow(new NullPointerException()); + client.deleteRole("DelRoleDom2", "Role2", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetMembership() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Membership member1Mock = Mockito.mock(Membership.class); + Mockito.when(c.getMembership("MbrGetRoleDom1", "Role1", "user.joe")).thenReturn(member1Mock); + client.getMembership("MbrGetRoleDom1", "Role1", "user.doe"); + try { + Mockito.when(c.getMembership("MbrGetRoleDom1", "Role2", "user.joe")).thenThrow(new ResourceException(204)); + client.getMembership("MbrGetRoleDom1", "Role2", "user.joe"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + + try { + Mockito.when(c.getMembership("MbrGetRoleDom1", "Role3", "user.joe")).thenThrow(new NullPointerException()); + client.getMembership("MbrGetRoleDom1", "Role3", "user.joe"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetPolicyList() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + PolicyList policyListMock = Mockito.mock(PolicyList.class); + Mockito.when(c.getPolicyList("PolicyListDom1", null, null)).thenReturn(policyListMock); + client.getPolicyList("PolicyListDom1", null, null); + try { + Mockito.when(c.getPolicyList("PolicyListDom2", null, null)).thenThrow(new ResourceException(204)); + client.getPolicyList("PolicyListDom2", null, null); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getPolicyList("PolicyListDom3", null, null)).thenThrow(new ResourceException(204)); + client.getPolicyList("PolicyListDom3"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + + try { + Mockito.when(c.getPolicyList("PolicyListDom4", null, null)).thenThrow(new NullPointerException()); + client.getPolicyList("PolicyListDom4"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getPolicyList("PolicyListDom5", null, null)).thenThrow(new NullPointerException()); + client.getPolicyList("PolicyListDom5", null, null); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteServiceIdentity() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + ServiceIdentity serviceMock = Mockito.mock(ServiceIdentity.class); + Mockito.when(c.deleteServiceIdentity("ServiceDelDom1", "Service1", AUDIT_REF)).thenReturn(serviceMock); + client.deleteServiceIdentity("ServiceDelDom1", "Service1", AUDIT_REF); + try { + Mockito.when(c.deleteServiceIdentity("ServiceDelDom1", "Service2", AUDIT_REF)).thenThrow(new ResourceException(204)); + client.deleteServiceIdentity("ServiceDelDom1", "Service2", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteServiceIdentity("ServiceDelDom2", "Service2", AUDIT_REF)) + .thenThrow(new NullPointerException()); + client.deleteServiceIdentity("ServiceDelDom2", "Service2", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetServiceIdentityList() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + ServiceIdentityList serviceListMock = Mockito.mock(ServiceIdentityList.class); + Mockito.when(c.getServiceIdentityList("ServiceListParamsDom1", null, "Service1")).thenReturn(serviceListMock); + client.getServiceIdentityList("ServiceListParamsDom1", null, "Service1"); + try { + Mockito.when(c.getServiceIdentityList("ServiceListParamsDom2", null, "Service1")).thenThrow(new ResourceException(204)); + client.getServiceIdentityList("ServiceListParamsDom2", null, "Service1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + + Mockito.when(c.getServiceIdentityList("ServiceListParamsDom3", null, null)).thenReturn(serviceListMock); + client.getServiceIdentityList("ServiceListParamsDom3"); + try { + Mockito.when(c.getServiceIdentityList("ServiceListParamsDom4", null, null)).thenThrow(new ResourceException(204)); + client.getServiceIdentityList("ServiceListParamsDom4"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPutPublicKeyEntry() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + PublicKeyEntry keyEntry = new PublicKeyEntry(); + PublicKeyEntry keyEntryMock = Mockito.mock(PublicKeyEntry.class); + Mockito.when(c.putPublicKeyEntry("PutPublicKeyDom2", "Service1", "zone2", AUDIT_REF, keyEntry)).thenReturn(keyEntryMock); + client.putPublicKeyEntry("PutPublicKeyDom2", "Service1", "zone2", AUDIT_REF, keyEntry); + + try { + Mockito.when(c.putPublicKeyEntry("PutPublicKeyDom3", "Service2", "zone2", AUDIT_REF, keyEntry)).thenThrow(new ResourceException(204)); + client.putPublicKeyEntry("PutPublicKeyDom3", "Service2", "zone2", AUDIT_REF, keyEntry); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetTenancy() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Tenancy tenancyMock = Mockito.mock(Tenancy.class); + Mockito.when(c.getTenancy("tenantDom1", "providerService1")).thenReturn(tenancyMock).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.getTenancy("tenantDom1", "providerService1"); + try { + client.getTenancy("tenantDom1", "providerService1"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getTenancy("tenantDom2", "providerService1")).thenThrow(new NullPointerException()); + client.getTenancy("tenantDom2", "providerService1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteTenancy() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Tenancy tenancyMock = Mockito.mock(Tenancy.class); + Mockito.when(c.deleteTenancy("tenantDom1", "providerService1", AUDIT_REF)).thenReturn(tenancyMock).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.deleteTenancy("tenantDom1", "providerService1", AUDIT_REF); + try { + client.deleteTenancy("tenantDom1", "providerService1", AUDIT_REF); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + try { + Mockito.when(c.deleteTenancy("tenantDom2", "providerService1", AUDIT_REF)) + .thenThrow(new NullPointerException()); + client.deleteTenancy("tenantDom2", "providerService1", AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testPutTenantRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TenantRoles tenantRoleMock = Mockito.mock(TenantRoles.class); + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()) + .setAction((String) f.value())); + } + TenantRoles tenantRoles = new TenantRoles().setDomain("ProviderDomain1").setService("storage").setTenant("TenantDomain1").setRoles(roleActions); + Mockito.when(c.putTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1", AUDIT_REF, tenantRoles)).thenReturn(tenantRoleMock).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.putTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1", AUDIT_REF, tenantRoles); + try { + client.putTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1", AUDIT_REF, tenantRoles); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + try { + Mockito.when( + c.putTenantRoles("ProviderDomain2", "ProviderService1", "TenantDomain1", AUDIT_REF, tenantRoles)) + .thenThrow(new NullPointerException()); + client.putTenantRoles("ProviderDomain2", "ProviderService1", "TenantDomain1", AUDIT_REF, tenantRoles); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetTenantRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TenantRoles tenantRoleMock = Mockito.mock(TenantRoles.class); + Mockito.when(c.getTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1")).thenReturn(tenantRoleMock).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.getTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1"); + try { + client.getTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getTenantRoles("ProviderDomain2", "ProviderService1", "TenantDomain1")) + .thenThrow(new NullPointerException()); + client.getTenantRoles("ProviderDomain2", "ProviderService1", "TenantDomain1"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteTenantRoles() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TenantRoles tenantRoleMock = Mockito.mock(TenantRoles.class); + Mockito.when(c.deleteTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1", AUDIT_REF)).thenReturn(tenantRoleMock).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.deleteTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1", AUDIT_REF); + try { + client.deleteTenantRoles("ProviderDomain1", "ProviderService1", "TenantDomain1", AUDIT_REF); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + } + + @Test + public void testGetSignedDomains() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Map> respHdrs = new HashMap>(); + SignedDomains signedDomain1 = Mockito.mock(SignedDomains.class); + Mockito.when(c.getSignedDomains("dom1", "meta1", "tag1", respHdrs)).thenReturn(signedDomain1).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.getSignedDomains("dom1", "meta1", "tag1", respHdrs); + try { + client.getSignedDomains("dom1", "meta1", "tag1", respHdrs); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + } + + @Test + public void testPutDefaultAdmins() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + DefaultAdmins adminsMock = Mockito.mock(DefaultAdmins.class); + Mockito.when(c.putDefaultAdmins("sports", AUDIT_REF, adminsMock)).thenReturn(adminsMock); + client.putDefaultAdmins("sports", AUDIT_REF, adminsMock); + try { + Mockito.when(c.putDefaultAdmins("media", AUDIT_REF, adminsMock)).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.putDefaultAdmins("media", AUDIT_REF, adminsMock); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + } + + @Test + public void testGetDomainDataCheck() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + DomainDataCheck checkdom1 = Mockito.mock(DomainDataCheck.class); + Mockito.when(c.getDomainDataCheck("domain1")).thenReturn(checkdom1).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.getDomainDataCheck("domain1"); + try { + client.getDomainDataCheck("domain1"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + try { + Mockito.when(c.getDomainDataCheck("domain2")).thenThrow(new NullPointerException()); + client.getDomainDataCheck("domain2"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + } + + @Test + public void testPutTenancy() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Tenancy tenancyMock = Mockito.mock(Tenancy.class); + Tenancy tenant = createTenantObject("tenantDom1", "providerDom1" + "." + "providerService1"); + Mockito.when(c.putTenancy("tenantDom1", "providerService1", AUDIT_REF, tenant)).thenReturn(tenancyMock).thenThrow(new ZMSClientException(400,"Audit reference required")); + client.putTenancy("tenantDom1", "providerService1", AUDIT_REF, tenant); + try { + client.putTenancy("tenantDom1", "providerService1", AUDIT_REF, tenant); + fail(); + } catch (ZMSClientException ex) { + assertTrue(true); + } + try { + Mockito.when(c.putTenancy("tenantDom2", "providerService1", AUDIT_REF, tenant)) + .thenThrow(new NullPointerException()); + client.putTenancy("tenantDom2", "providerService1", AUDIT_REF, tenant); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testAddMembershipUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + Role role1Mock = Mockito.mock(Role.class); + Role roleMock = Mockito.mock(Role.class); + Mockito.when(c.putRole("MbrAddDom1", "Role1", AUDIT_REF, role1Mock)).thenReturn(roleMock); + Membership mbr = new Membership(); + mbr.setRoleName("Role1"); + mbr.setMemberName("user.doe"); + mbr.setIsMember(true); + Membership membershipMock = Mockito.mock(Membership.class); + Mockito.when(c.putMembership("MbrAddDom1", "Role1", "user.doe", AUDIT_REF, mbr)).thenReturn(membershipMock); + Mockito.when(c.getRole("MbrAddDom1", "Role1", false, false)).thenReturn(roleMock); + @SuppressWarnings("unchecked") + List membersMock = Mockito.mock(List.class); + Mockito.when(roleMock.getMembers()).thenReturn(membersMock); + Mockito.when(membersMock.size()).thenReturn(3); + Mockito.when(membersMock.contains(Mockito.anyString())).thenReturn(true); + testAddMembership(client, systemAdminFullUser); + Mockito.when(c.deleteTopLevelDomain("MbrGetRoleDom1", AUDIT_REF)).thenReturn(dom1Mock); + } + + @Test + public void testDeleteMembershipUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + Role role1Mock = Mockito.mock(Role.class); + Mockito.when(c.putRole("MbrDelDom1", "Role1", AUDIT_REF, role1Mock)).thenReturn(role1Mock); + Mockito.when(c.getRole("MbrDelDom1", "Role1", false, false)).thenReturn(role1Mock); + @SuppressWarnings("unchecked") + List membersMock = Mockito.mock(List.class); + Mockito.when(role1Mock.getMembers()).thenReturn(membersMock); + Mockito.when(membersMock.size()).thenReturn(1); + Mockito.when(membersMock.contains("user.joe")).thenReturn(false); + Mockito.when(membersMock.contains("user.jane")).thenReturn(true); + testDeleteMembership(client, systemAdminFullUser); + } + + @Test + public void testCreatePolicyUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + Policy policy1Mock = Mockito.mock(Policy.class); + Mockito.when(c.putPolicy("PolicyAddDom1", "Policy1", AUDIT_REF, policy1Mock)).thenReturn(policy1Mock); + Mockito.when(c.getPolicy("PolicyAddDom1", "Policy1")).thenReturn(policy1Mock); + Mockito.when(policy1Mock.getName()).thenReturn("PolicyAddDom1:policy.Policy1".toLowerCase()); + testCreatePolicy(client, systemAdminFullUser); + } + + @Test + public void testDeletePolicyUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + Policy policy1Mock = Mockito.mock(Policy.class); + Mockito.when(c.putPolicy("PolicyDelDom1", "Policy1", AUDIT_REF, policy1Mock)).thenReturn(policy1Mock); + Mockito.when(c.putPolicy("PolicyDelDom1", "Policy2", AUDIT_REF, policy1Mock)).thenReturn(policy1Mock); + Mockito.when(c.getPolicy("PolicyDelDom1", "Policy1")).thenReturn(policy1Mock).thenThrow(new ResourceException(204)); + Mockito.when(c.getPolicy("PolicyDelDom1", "Policy2")).thenReturn(policy1Mock,policy1Mock).thenThrow(new ResourceException(204)); + testDeletePolicy(client, systemAdminFullUser); + } + + @Test + public void testDeletePublicKeyEntryUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(Mockito.anyString(), Mockito.any(TopLevelDomain.class))).thenReturn(domainMock); + ServiceIdentity serviceMock = Mockito.mock(ServiceIdentity.class); + Mockito.when(c.putServiceIdentity("DelPublicKeyDom1", "Service1", AUDIT_REF, serviceMock)).thenReturn(serviceMock); + PublicKeyEntry entoryMock = Mockito.mock(PublicKeyEntry.class); + Mockito.when(c.deletePublicKeyEntry("DelPublicKeyDom1", "Service1", "zone1", AUDIT_REF)).thenReturn(entoryMock); + Mockito.when(c.getPublicKeyEntry("DelPublicKeyDom1", "Service1", "zone1")).thenThrow(new ResourceException(404)); + Mockito.when(c.getPublicKeyEntry("DelPublicKeyDom1", "Service1", "zone2")).thenReturn(entoryMock); + Mockito.when(entoryMock.getKey()).thenReturn(PUB_KEY_ZONE2); + Mockito.when(c.deletePublicKeyEntry("DelPublicKeyDom1", "Service1", "zone2", AUDIT_REF)).thenThrow(new ResourceException(400)); + testDeletePublicKeyEntry(client, systemAdminFullUser); + } + + @Test + public void testCreateServiceIdentityUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + ServiceIdentity serviceMock = Mockito.mock(ServiceIdentity.class); + Mockito.when(c.putServiceIdentity("ServiceAddDom1", "Service1", AUDIT_REF, serviceMock)).thenReturn(serviceMock); + Mockito.when(c.getServiceIdentity("ServiceAddDom1", "Service1")).thenReturn(serviceMock); + Mockito.when(serviceMock.getName()).thenReturn("ServiceAddDom1.Service1".toLowerCase()); + testCreateServiceIdentity(client, systemAdminFullUser); + } + + @Test + public void testCreateEntityUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + Entity entityMock = Mockito.mock(Entity.class); + Mockito.when(c.putEntity("CreateEntityDom1", "Entity1", AUDIT_REF, entityMock)).thenReturn(entityMock); + Mockito.when(c.getEntity("CreateEntityDom1", "Entity1")).thenReturn(entityMock); + Mockito.when(entityMock.getName()).thenReturn("Entity1".toLowerCase()); + testCreateEntity(client, systemAdminFullUser); + } + + @Test + public void testDeleteEntityUserToken() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + TopLevelDomain dom1Mock = Mockito.mock(TopLevelDomain.class); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1Mock)).thenReturn(domainMock); + Entity entityMock = Mockito.mock(Entity.class); + Mockito.when(c.getEntity("DelEntityDom1", "Entity1")).thenReturn(entityMock).thenThrow(new ResourceException(204)); + Mockito.when(c.getEntity("DelEntityDom1", "Entity2")).thenReturn(entityMock,entityMock).thenThrow(new ResourceException(204)); + testDeleteEntity(client, systemAdminFullUser); + } + + @Test + public void testGetPrincipalNull() { + + ZMSClient client = new ZMSClient(getZMSUrl()); + try { + client.getPrincipal(null); + fail(); + } catch (ZMSClientException ex) { + assertTrue(ex.getCode() == 401); + } + client.close(); + } + + @Test + public void testGetPrincipalInvalid() { + + ZMSClient client = new ZMSClient(getZMSUrl()); + try { + client.getPrincipal("abcdefg"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(ex.getCode() == 401); + } + + try { + client.getPrincipal("v=U1;d=coretech;t=12345678;s=signature"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(ex.getCode() == 401); + } + + try { + client.getPrincipal("v=U1;n=storage;t=12345678;s=signature"); + fail(); + } catch (ZMSClientException ex) { + assertTrue(ex.getCode() == 401); + } + client.close(); + } + + Struct setupRespHdrsStruct() { + + Struct respHdrs = new Struct(); + Array values = new Array(); + values.add("Value1A"); + values.add("Value1B"); + respHdrs.put("tag1", values); + + values = new Array(); + values.add("Value2A"); + values.add("Value2B"); + respHdrs.put("tag2", values); + + return respHdrs; + } + + @Test + public void testLookupZMSUrl() { + + System.setProperty(ZMSClient.ZMS_CLIENT_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + ZMSClient client = new ZMSClient(getZMSUrl()); + assertEquals(client.lookupZMSUrl(), "https://server-zms.athenzcompany.com:4443/"); + System.clearProperty(ZMSClient.ZMS_CLIENT_PROP_ATHENZ_CONF); + client.close(); + } + + @Test + public void testLookupZMSUrlInvalidFile() { + System.setProperty(ZMSClient.ZMS_CLIENT_PROP_ATHENZ_CONF, "src/test/resources/athenz_invaild.conf"); + ZMSClient client = new ZMSClient(getZMSUrl()); + assertNull(client.lookupZMSUrl()); + System.clearProperty(ZMSClient.ZMS_CLIENT_PROP_ATHENZ_CONF); + client.close(); + } + + @Test + public void testDeleteDomainTemplate() { + ZMSClient client = createClient(systemAdminUser); + String domName = "templesofold"; + String domName2 = "templesofold2"; + + try { + client.deleteTopLevelDomain(domName, AUDIT_REF); + } catch (ZMSClientException ex) { + // ignore cleanup errors - e.g. not found + } + + TopLevelDomain dom1 = createTopLevelDomainObject(domName, + "Test Domain", "testOrg", systemAdminFullUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + Domain domainMock = Mockito.mock(Domain.class); + Mockito.when(c.postTopLevelDomain(AUDIT_REF, dom1)).thenReturn(domainMock); + client.postTopLevelDomain(AUDIT_REF, dom1); + ServerTemplateList svrTemplListMock = Mockito.mock(ServerTemplateList.class); + @SuppressWarnings("unchecked") + List svrTemplNamesMock = Mockito.mock(List.class); + Mockito.when(c.getServerTemplateList()).thenReturn(svrTemplListMock); + ServerTemplateList svrTemplList = client.getServerTemplateList(); + Mockito.when(svrTemplListMock.getTemplateNames()).thenReturn(svrTemplNamesMock); + List svrTemplNames = svrTemplList.getTemplateNames(); + DomainTemplate domTempl = new DomainTemplate().setTemplateNames(svrTemplNames); + client.putDomainTemplate(domName, AUDIT_REF, domTempl); + DomainTemplateList domTemplListMock = Mockito.mock(DomainTemplateList.class); + Mockito.when(c.getDomainTemplateList(domName)).thenReturn(domTemplListMock); + DomainTemplateList domTemplList = client.getDomainTemplateList(domName); + assertNotNull(domTemplList); + try { + Mockito.when(c.getDomainTemplateList(domName2)).thenThrow(new NullPointerException()) + .thenThrow(new ResourceException(404)); + client.getDomainTemplateList(domName2); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + client.getDomainTemplateList(domName2); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + List templNames = domTemplList.getTemplateNames(); + assertNotNull(templNames); + assertTrue(templNames.size() == svrTemplNames.size()); + // HAVE: domain has all the templates + + // domain has multiple templates: deleting 1 at a time + for (int cnt = 0; cnt < svrTemplNames.size(); ++cnt) { + client.deleteDomainTemplate(domName, svrTemplNames.get(cnt), AUDIT_REF); + domTemplList = client.getDomainTemplateList(domName); + assertNotNull(domTemplList); + templNames = domTemplList.getTemplateNames(); + assertNotNull(templNames); + int templCnt = svrTemplNames.size() - (cnt + 1); + assertTrue(templNames.size() == templCnt, "template should be count=" + templCnt); + for (int cnt2 = cnt + 1; cnt2 < svrTemplNames.size(); ++cnt2) { + assertTrue(templNames.contains(svrTemplNames.get(cnt2)), "should contain=" + svrTemplNames.get(cnt2)); + } + } + + client.deleteTopLevelDomain(domName, AUDIT_REF); + } + + @Test + public void testDeleteDomainTemplateErrorCases() { + ZMSClient client = createClient(systemAdminUser); + ZMSRDLGeneratedClient c = Mockito.mock(ZMSRDLGeneratedClient.class); + client.setZMSRDLGeneratedClient(c); + ServerTemplateList svrTemplListMock = Mockito.mock(ServerTemplateList.class); + Mockito.when(c.getServerTemplateList()).thenReturn(svrTemplListMock).thenThrow(new NullPointerException()).thenThrow(new ResourceException(404,"Domain not found")); + ServerTemplateList svrTemplList = client.getServerTemplateList(); + try { + client.getServerTemplateList(); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + try { + client.getServerTemplateList(); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + @SuppressWarnings("unchecked") + List svrTemplNamesMock = Mockito.mock(List.class); + Mockito.when(svrTemplListMock.getTemplateNames()).thenReturn(svrTemplNamesMock); + List svrTemplNames = svrTemplList.getTemplateNames(); + Mockito.when(c.deleteDomainTemplate("nonexistantdomain", svrTemplNames.get(1), AUDIT_REF)).thenThrow(new ResourceException(404, "Domain not found")); + // test: no such domain + try { + client.deleteDomainTemplate("nonexistantdomain", svrTemplNames.get(1), AUDIT_REF); + fail("requesterror not thrown by deleteDomainTemplate"); + } catch (ZMSClientException ex) { + assertEquals(ex.getCode(), 404); + assertTrue(ex.getMessage().contains("Domain not found"), ex.getMessage()); + } + + try { + Mockito.when(c.deleteDomainTemplate("nonexistantdomain2", svrTemplNames.get(1), AUDIT_REF)) + .thenThrow(new NullPointerException()); + client.deleteDomainTemplate("nonexistantdomain2", svrTemplNames.get(1), AUDIT_REF); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + + // test: no such template + String domName = "simontemplar"; + + try { + client.deleteTopLevelDomain(domName, AUDIT_REF); + } catch (ZMSClientException ex) { + // ignore cleanup errors - e.g. not found + } + + TopLevelDomain dom1 = createTopLevelDomainObject(domName, + "Test Domain", "testOrg", systemAdminFullUser); + client.postTopLevelDomain(AUDIT_REF, dom1); + + client.deleteDomainTemplate(domName, svrTemplNames.get(1), AUDIT_REF); + client.deleteTopLevelDomain(domName, AUDIT_REF); + } +} diff --git a/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSLoadData.java b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSLoadData.java new file mode 100644 index 00000000000..9a8ed6ecfb2 --- /dev/null +++ b/clients/java/zms/src/test/java/com/yahoo/athenz/zms/ZMSLoadData.java @@ -0,0 +1,202 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.util.ArrayList; +import java.util.List; +import java.util.Random; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; + +public class ZMSLoadData { + + private static String AUDIT_REF = "zmsjcltloadtest"; + + private Principal createPrincipal(String userName) { + Authority authority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Principal p = SimplePrincipal.create("user", userName, + "v=U1;d=user;n=" + userName + ";s=signature", 0, authority); + return p; + } + + private ZMSClient getClient(String userName) { + ZMSClient client = new ZMSClient(getZMSUrl()); + client.addCredentials(createPrincipal(userName)); + return client; + } + + private String getZMSUrl() { + + // if we're given a config setting then use that + + String zmsUrl = System.getProperty("yahoo.zms_java_client.zms_url"); + + // if the value is not available then check the env setting + + if (zmsUrl == null) { + zmsUrl = System.getenv("ZMS_URL"); + } + + return zmsUrl; + } + + private TopLevelDomain createTopLevelDomainObject(String name, + String description, String org) { + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setEnabled(true); + + List admins = new ArrayList(); + admins.add("sys.auth.zts"); + admins.add("sys.auth.zpu"); + admins.add("user.zms_admin"); + admins.add("user.user_admin"); + admins.add("user.hga"); + dom.setAdminUsers(admins); + + return dom; + } + + private ServiceIdentity createServiceObject(ZMSClient client, String domainName, + String serviceName, String endPoint, String executable, String user, + String group) { + + ServiceIdentity service = new ServiceIdentity(); + service.setExecutable(executable); + if (group != null) { + service.setGroup(group); + } + if (user!= null) { + service.setUser(user); + } + service.setName(client.generateServiceIdentityName(domainName, serviceName)); + + List pubKeys = new ArrayList<>(); + pubKeys.add(new PublicKeyEntry().setId("0") + .setKey("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTk" + + "FEQ0JpUUtCZ1FDMXRHU1ZDQTh3bDVldzVZNzZXajJySkFVRApZYW5FSmZLbUFseDVjUS84aEtFVWZTU2dwWHI" + + "zQ3pkaDFhMjZkbGI3bW1LMjlxbVhKWGg2dW1XOUF5ZlRPS1ZvCis2QVNsb1ZVM2F2dnVmbEdVT0VnMmpzbWRh" + + "a1IyNEtjTGpBdTZRclVlNDE3bEczdDhxU1BJR2pTNUMrQ3NKVXcKaDA0aEh4NWYrUEV3eFY0cmJRSURBUUFCC" + + "i0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-")); + + service.setPublicKeys(pubKeys); + + service.setProviderEndpoint(endPoint); + return service; + } + + private Role createRoleObject(ZMSClient client, String domainName, String roleName, + String trust, int memberStart, int memberEnd) { + + Role role = new Role(); + role.setName(client.generateRoleName(domainName, roleName)); + if (trust != null) { + role.setTrust(trust); + } + + List members = new ArrayList(); + if (memberStart != -1) { + for (int i = memberStart; i < memberEnd; i++) { + members.add("user.user" + i); + } + } else { + Random userRandomizer = new Random(); + for (int i = 0; i < 25; i++) { + members.add("user.user" + Math.abs(userRandomizer.nextInt() % 1000)); + } + } + role.setMembers(members); + return role; + } + + private Policy createPolicyObject(ZMSClient client, String domainName, String policyName, + String roleName, String action, String resource, AssertionEffect effect) { + + Policy policy = new Policy(); + policy.setName(client.generatePolicyName(domainName, policyName)); + + Assertion assertion = new Assertion(); + assertion.setAction(action); + assertion.setEffect(effect); + assertion.setResource(resource); + assertion.setRole(client.generateRoleName(domainName, roleName)); + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + return policy; + } + + public static void main(String [] args) { + + if (args.length != 3) { + System.out.println("ZMSLoadData "); + System.exit(1); + } + + String admin = args[0]; + int startIndex = Integer.parseInt(args[1]); + int endIndex = Integer.parseInt(args[2]); + ZMSLoadData data = new ZMSLoadData(); + + for (int i = startIndex; i < endIndex; i++) { + + ZMSClient client = data.getClient(admin); + + String domainName = "TestDomain" + i; + TopLevelDomain domain = data.createTopLevelDomainObject(domainName, "Test Domain: " + domainName, "CoreTech"); + client.postTopLevelDomain(AUDIT_REF, domain); + + for (int j = 0; j < 10; j++) { + + String serviceName = "Service" + j; + ServiceIdentity service = data.createServiceObject(client, domainName, serviceName, + "http://localhost:9080/", "/usr/bin/java", null, null); + + client.putServiceIdentity(domainName, serviceName, AUDIT_REF, service); + } + + for (int j = 0; j < 40; j++) { + + String roleName = "Role" + j; + Role role = data.createRoleObject(client, domainName, roleName, null, j * 25, (j + 1) * 25); + client.putRole(domainName, roleName, AUDIT_REF, role); + } + + for (int j = 40; j < 100; j++) { + + String roleName = "Role" + j; + Role role = data.createRoleObject(client, domainName, roleName, null, -1, 1000); + client.putRole(domainName, roleName, AUDIT_REF, role); + } + + for (int j = 0; j < 100; j++) { + + String policyName = "Policy" + j; + String roleName = "Role" + j; + Policy policy = data.createPolicyObject(client, domainName, policyName, roleName, + "*", "*", AssertionEffect.ALLOW); + client.putPolicy(domainName, policyName, AUDIT_REF, policy); + } + } + } +} diff --git a/clients/java/zms/src/test/resources/athenz.conf b/clients/java/zms/src/test/resources/athenz.conf new file mode 100644 index 00000000000..d6983863df3 --- /dev/null +++ b/clients/java/zms/src/test/resources/athenz.conf @@ -0,0 +1,16 @@ +{ + "zmsUrl": "https://server-zms.athenzcompany.com:4443/", + "ztsUrl": "https://server-zts.athenzcompany.com:4443/", + "ztsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ], + "zmsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ] +} diff --git a/clients/java/zms/src/test/resources/logback.xml b/clients/java/zms/src/test/resources/logback.xml new file mode 100644 index 00000000000..c4a0357b8d5 --- /dev/null +++ b/clients/java/zms/src/test/resources/logback.xml @@ -0,0 +1,17 @@ + + + + + System.out + + %-4relative [%thread] %-5level %class - %msg%n + + + + + + + + + + diff --git a/clients/java/zpe/README.md b/clients/java/zpe/README.md new file mode 100644 index 00000000000..03f6da37d2e --- /dev/null +++ b/clients/java/zpe/README.md @@ -0,0 +1,71 @@ +# zpe_java_client + +AuthNG ZPE client lib to perform data plane authorization for client requests + +## Contents + +* [Summary](#summary) +* [Details](#details) + + +## Summary + +This is the ZPE(AuthZ Policy Engine) front-end API to perform client +access authorization to resources. + +The implementation is thread safe. + +## Details + +This library will be used by service components to check client access +authorization to resources supplied by the service component. + +The library will read the authorization policies from the file system. +These policy files will be in JSON format as returned by the ZMS REST API: +getSignedPolicies(). +The directory containing these policy files is by default /home/athenz/var/zpe +but will be configurable. + +These authorization policies can be for several domains. + +ZPE will monitor the directory for updates to the files or new files added. +As new files are deposited to the policy file directory, ZPE will read +in the new policies to replace the old ones or add them for a new domain. +Each policy file will be validated against its signature to ensure +validity of the policy data. + +It is expected that each file contains all the policies for a domain. + +The policy files can be deposited there in several ways: +1. Athenz Policy Updater +2. Manually deposited + + +System properties: + + athenz.zpe.policy_dir + Default value: ROOT + /var/zpe + Should contain a valid directory path. + + athenz.zpe.monitor_timeout_secs + Default value: 300 + This time interval is used to check for changes to the policy files. + + athenz.zpe.cleanup_tokens_secs + Default value: 600 (10 minutes) + This time interval is used to check for expired tokens in the cache. + It is dependent on the athenz.zpe.monitor_timeout_secs. + For intervals less than monitor_timeout_secs, the enforcement check + will take place every monitor_timeout_secs seconds. + For intervals greater than monitor_timeout_secs, enforcement checks (ec) + will take place every: + ec * monitor_timeout_secs >= cleanup_tokens_secs + where ec is the smallest integer such that ec * monitor_timeout_secs >= cleanup_tokens_secs + Ex: monitor_timeout_secs=300, cleanup_tokens_secs=500, ec = 600 seconds + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() + diff --git a/clients/java/zpe/pom.xml b/clients/java/zpe/pom.xml new file mode 100644 index 00000000000..b58824720f5 --- /dev/null +++ b/clients/java/zpe/pom.xml @@ -0,0 +1,205 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../../pom.xml + + + zpe_java_client + jar + zpe_java_client + ZPE Client Library (Java) + + + 1.9.1 + benchmarks + + + + + ${project.groupId} + zts_core + ${project.parent.version} + + + ${project.groupId} + auth_core + ${project.parent.version} + + + ${project.groupId} + client_common + ${project.parent.version} + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + com.fasterxml.jackson.core + jackson-databind + ${jackson.version} + + + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 2.10.4 + + + prepare-package + + jar + + + + + + org.apache.maven.plugins + maven-shade-plugin + 2.3 + + + package + + shade + + + + + + + + com.fasterxml.jackson.core + + + + + com.fasterxml.jackson + athenz.shade.zpe.com.fasterxml.jackson + + + + + *:* + + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + + + + + + org.apache.maven.plugins + maven-surefire-plugin + 2.16 + + + default-test + + test + + + alphabetical + + 1 + 1 + src/test/resources/pol_dir + src/test/resources/athenz.conf + src/test/resources/logback.xml + + + + + + + + + + + + + jmh-performance-test + + + src/main/java/com/yahoo/athenz/zpe/Performance.java + + + + + org.openjdk.jmh + jmh-core + ${jmh.version} + + + org.openjdk.jmh + jmh-generator-annprocess + ${jmh.version} + + + + + + + org.apache.maven.plugins + maven-shade-plugin + 2.3 + + + package + + shade + + + ${uberjar.name} + + + org.openjdk.jmh.Main + + + + + *:* + + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + + + + + + + + + + diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/AuthZpeClient.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/AuthZpeClient.java new file mode 100644 index 00000000000..349825f5a08 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/AuthZpeClient.java @@ -0,0 +1,797 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import com.yahoo.athenz.auth.impl.RoleAuthority; +import com.yahoo.athenz.auth.token.RoleToken; +import com.yahoo.athenz.zpe.match.ZpeMatch; +import com.yahoo.athenz.zpe.pkey.PublicKeyStore; +import com.yahoo.athenz.zpe.pkey.PublicKeyStoreFactory; +import com.yahoo.rdl.Struct; + +import java.security.PublicKey; +import java.util.List; +import java.util.Map; +import java.util.Set; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class AuthZpeClient { + + private static final Logger LOG = LoggerFactory.getLogger(AuthZpeClient.class); + + public static final String ZPE_UPDATER_CLASS = "com.yahoo.athenz.zpe.ZpeUpdater"; + public static final String ZPE_PKEY_CLASS = "com.yahoo.athenz.zpe.pkey.file.FilePublicKeyStoreFactory"; + + public static final String ZPE_TOKEN_HDR = System.getProperty(RoleAuthority.ATHENZ_PROP_ROLE_HEADER, RoleAuthority.HTTP_HEADER);; + + public static final String ZTS_PUBLIC_KEY = "zts_public_key"; + public static final String ZMS_PUBLIC_KEY = "zms_public_key"; + + public static final String ZTS_PUBLIC_KEY_PREFIX = "zts.public_key."; + public static final String ZMS_PUBLIC_KEY_PREFIX = "zms.public_key."; + + public static final String SYS_AUTH_DOMAIN = "sys.auth"; + public static final String ZTS_SERVICE_NAME = "zts"; + public static final String ZMS_SERVICE_NAME = "zms"; + + public static final String DEFAULT_DOMAIN = "sys.auth"; + public static final String UNKNOWN_DOMAIN = "unknown"; + + public static ZpeMetric zpeMetric = new ZpeMetric(); + + private static String zpeClientImplName; + private static int allowedOffset = 300; + + private static ZpeClient zpeClt = null; + private static PublicKeyStore publicKeyStore = null; + + public enum AccessCheckStatus { + ALLOW { + public String toString() { + return "Access Check was explicitly allowed"; + } + }, + DENY { + public String toString() { + return "Access Check was explicitly denied"; + } + }, + DENY_NO_MATCH { + public String toString() { + return "Access denied due to no match to any of the assertions defined in domain policy file"; + } + }, + DENY_ROLETOKEN_EXPIRED { + public String toString() { + return "Access denied due to expired RoleToken"; + } + }, + DENY_ROLETOKEN_INVALID { + public String toString() { + return "Access denied due to invalid RoleToken"; + } + }, + DENY_DOMAIN_MISMATCH { + public String toString() { + return "Access denied due to domain mismatch between Resource and RoleToken"; + } + }, + DENY_DOMAIN_NOT_FOUND { + public String toString() { + return "Access denied due to domain not found in library cache"; + } + }, + DENY_DOMAIN_EXPIRED { + public String toString() { + return "Access denied due to expired domain policy file"; + } + }, + DENY_DOMAIN_EMPTY { + public String toString() { + return "Access denied due to no policies in the domain file"; + } + }, + DENY_INVALID_PARAMETERS { + public String toString() { + return "Access denied due to invalid/empty action/resource values"; + }; + } + } + + static { + + // instantiate implementation classes + + zpeClientImplName = System.getProperty(ZpeConsts.ZPE_PROP_CLIENT_IMPL, ZPE_UPDATER_CLASS); + try { + zpeClt = getZpeClient(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException ex) { + LOG.error("Unable to instantiate zpe class: " + zpeClientImplName, ex); + throw new RuntimeException(ex); + } + zpeClt.init(null); + + allowedOffset = Integer.parseInt(System.getProperty(ZpeConsts.ZPE_PROP_TOKEN_OFFSET, "300")); + + // case of invalid value, we'll default back to 5 minutes + + if (allowedOffset < 0) { + allowedOffset = 300; + } + + String pkeyFactoryClass = System.getProperty(ZpeConsts.ZPE_PROP_PUBLIC_KEY_CLASS, ZPE_PKEY_CLASS); + + PublicKeyStoreFactory publicKeyStoreFactory = null; + try { + publicKeyStoreFactory = (PublicKeyStoreFactory) Class.forName(pkeyFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException ex) { + LOG.error("Invalid PublicKeyStore class: " + pkeyFactoryClass, ex); + throw new RuntimeException(ex); + } + publicKeyStore = publicKeyStoreFactory.create(); + } + + public static void init() { + if (LOG.isDebugEnabled()) { + LOG.debug("Init: load the ZPE"); + } + } + + public static PublicKey getZtsPublicKey(String keyId) { + return publicKeyStore.getZtsKey(keyId); + } + + public static PublicKey getZmsPublicKey(String keyId) { + return publicKeyStore.getZmsKey(keyId); + } + + /** + * Determine if access(action) is allowed against the specified resource by + * a user represented by the user (cltToken, cltTokenName). + * @param roleToken - value for the REST header: Athenz-Role-Auth + * ex: "v=Z1;d=angler;r=admin;a=aAkjbbDMhnLX;t=1431974053;e=1431974153;k=0" + * @param angResource is a domain qualified resource the calling service + * will check access for. ex: my_domain:my_resource + * ex: "angler:pondsKernCounty" + * ex: "sports:service.storage.tenant.Activator.ActionMap" + * @param action is the type of access attempted by a client + * ex: "read" + * ex: "scan" + * @return AccessCheckStatus if the user can access the resource via the specified action + * the result is ALLOW otherwise one of the DENY_* values specifies the exact + * reason why the access was denied + */ + public static AccessCheckStatus allowAccess(String roleToken, String angResource, String action) { + StringBuilder matchRoleName = new StringBuilder(256); + return allowAccess(roleToken, angResource, action, matchRoleName); + } + + /** + * Determine if access(action) is allowed against the specified resource by + * a user represented by the user (cltToken, cltTokenName). + * @param roleToken - value for the REST header: Athenz-Role-Auth + * ex: "v=Z1;d=angler;r=admin;a=aAkjbbDMhnLX;t=1431974053;e=1431974153;k=0" + * @param angResource is a domain qualified resource the calling service + * will check access for. ex: my_domain:my_resource + * ex: "angler:pondsKernCounty" + * ex: "sports:service.storage.tenant.Activator.ActionMap" + * @param action is the type of access attempted by a client + * ex: "read" + * ex: "scan" + * @param matchRoleName - [out] will include the role name that the result was based on + * it will be not be set if the failure is due to expired/invalid tokens or + * there were no matches thus a default value of DENY_NO_MATCH is returned + * @return AccessCheckStatus if the user can access the resource via the specified action + * the result is ALLOW otherwise one of the DENY_* values specifies the exact + * reason why the access was denied + */ + public static AccessCheckStatus allowAccess(String roleToken, String angResource, String action, + StringBuilder matchRoleName) { + + if (LOG.isDebugEnabled()) { + LOG.debug("allowAccess: action=" + action + " resource=" + angResource); + } + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME, DEFAULT_DOMAIN); + + RoleToken rToken = null; + Map tokenCache = null; + try { + ZpeClient zpeclt = getZpeClient(); + tokenCache = zpeclt.getRoleTokenCacheMap(); + rToken = tokenCache.get(roleToken); + } catch (Exception exc) { + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_CACHE_FAILURE, DEFAULT_DOMAIN); + LOG.error("allowAccess: token cache failure, exc: ", exc); + } + + if (rToken == null) { + + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_CACHE_NOT_FOUND, DEFAULT_DOMAIN); + rToken = new RoleToken(roleToken); + + // validate the token + if (rToken.validate(getZtsPublicKey(rToken.getKeyId()), allowedOffset, null) == false) { + LOG.error("allowAccess: Authorization denied. Authentication of token failed for token=" + + rToken.getSignedToken()); + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_INVALID_TOKEN, rToken.getDomain()); + return AccessCheckStatus.DENY_ROLETOKEN_INVALID; + } + + if (tokenCache != null) { + tokenCache.put(roleToken, rToken); + } + } else { + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_CACHE_SUCCESS, rToken.getDomain()); + } + + AccessCheckStatus status = allowAccess(rToken, angResource, action, matchRoleName); + return status; + } + + /** + * Determine if access(action) is allowed against the specified resource by + * a user represented by the RoleToken. + * @param rToken represents the role token sent by the client that wants access to the resource + * @param angResource is a domain qualified resource the calling service + * will check access for. ex: my_domain:my_resource + * ex: "angler:pondsKernCounty" + * ex: "sports:service.storage.tenant.Activator.ActionMap" + * @param action is the type of access attempted by a client + * ex: "read" + * ex: "scan" + * @param matchRoleName - [out] will include the role name that the result was based on + * it will be not be set if the failure is due to expired/invalid tokens or + * there were no matches thus a default value of DENY_NO_MATCH is returned + * @return AccessCheckStatus if the user can access the resource via the specified action + * the result is ALLOW otherwise one of the DENY_* values specifies the exact + * reason why the access was denied + **/ + public static AccessCheckStatus allowAccess(RoleToken rToken, String angResource, String action, + StringBuilder matchRoleName) { + + // check the token expiration + if (rToken == null) { + LOG.error("allowAccess: Authorization denied. Token is null"); + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_INVALID_TOKEN, UNKNOWN_DOMAIN); + return AccessCheckStatus.DENY_ROLETOKEN_INVALID; + } + long now = System.currentTimeMillis() / 1000; + long expiry = rToken.getExpiryTime(); + if (expiry != 0 && expiry < now) { + String signedToken = rToken.getSignedToken(); + LOG.error("allowAccess: Authorization denied. Token expired. now=" + + now + " expiry=" + expiry + " token=" + signedToken); + Map tokenCache = null; + try { + ZpeClient zpeclt = getZpeClient(); + tokenCache = zpeclt.getRoleTokenCacheMap(); + tokenCache.remove(signedToken); + } catch (Exception exc) { + LOG.error("allowAccess: token cache failure, exc: ", exc); + } + + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_EXPIRED_TOKEN, rToken.getDomain()); + return AccessCheckStatus.DENY_ROLETOKEN_EXPIRED; + } + + String tokenDomain = rToken.getDomain(); // ZToken contains the domain + List roles = rToken.getRoles(); // ZToken contains roles + + if (LOG.isDebugEnabled()) { + if (roles != null) { + for (String role: roles) { + LOG.debug("allowAccess: token role=" + role); + } + } + } + + return allowActionZPE(action, tokenDomain, angResource, roles, matchRoleName); + } + + /** + * Determine if access(action) is allowed against the specified resource by + * a user represented by the list of role tokens. + * @param roleTokenList - values from the REST header(s): Athenz-Role-Auth + * ex: "v=Z1;d=angler;r=admin;a=aAkjbbDMhnLX;t=1431974053;e=1431974153;k=0" + * @param angResource is a domain qualified resource the calling service + * will check access for. ex: my_domain:my_resource + * ex: "angler:pondsKernCounty" + * ex: "sports:service.storage.tenant.Activator.ActionMap" + * @param action is the type of access attempted by a client + * ex: "read" + * ex: "scan" + * @param matchRoleName - [out] will include the role name that the result was based on + * it will be not be set if the failure is due to expired/invalid tokens or + * there were no matches thus a default value of DENY_NO_MATCH is returned + * @return AccessCheckStatus if the user can access the resource via the specified action + * the result is ALLOW otherwise one of the DENY_* values specifies the exact + * reason why the access was denied + */ + public static AccessCheckStatus allowAccess(List roleTokenList, + String angResource, String action, StringBuilder matchRoleName) { + + AccessCheckStatus retStatus = AccessCheckStatus.DENY_NO_MATCH; + StringBuilder roleName = null; + for (String roleToken: roleTokenList) { + StringBuilder rName = new StringBuilder(64); + AccessCheckStatus status = allowAccess(roleToken, angResource, action, rName); + if (status == AccessCheckStatus.DENY) { + matchRoleName.append(rName); + return status; + } else if (retStatus != AccessCheckStatus.ALLOW) { // only DENY over-rides ALLOW + retStatus = status; + roleName = rName; + } + } + + if (roleName != null) { + matchRoleName.append(roleName.toString()); + } + + return retStatus; + } + + /** + * Validate the RoleToken and return the parsed token object that + * could be used to extract all fields from the role token. If the role + * token is invalid, then null object is returned. + * @param roleToken - value for the REST header: Athenz-Role-Auth + * ex: "v=Z1;d=angler;r=admin;a=aAkjbbDMhnLX;t=1431974053;e=1431974153;k=0" + * @return RoleToken if the token is validated successfully otherwise null + */ + public static RoleToken validateRoleToken(String roleToken) { + + RoleToken rToken = null; + + // first check in our cache in case we have already seen and successfully + // validated this role token (signature validation is expensive) + + Map tokenCache = null; + try { + ZpeClient zpeclt = getZpeClient(); + tokenCache = zpeclt.getRoleTokenCacheMap(); + rToken = tokenCache.get(roleToken); + } catch (Exception exc) { + } + + // if the token is not in the cache then we need to + // validate the token now + + if (rToken == null) { + rToken = new RoleToken(roleToken); + + // validate the token + + if (rToken.validate(getZtsPublicKey(rToken.getKeyId()), allowedOffset, null) == false) { + return null; + } + + if (tokenCache != null) { + tokenCache.put(roleToken, rToken); + } + } + + return rToken; + } + + static ZpeClient getZpeClient() throws InstantiationException, IllegalAccessException, ClassNotFoundException { + + if (zpeClt != null) { + return zpeClt; + } + + return (ZpeClient) Class.forName(zpeClientImplName).newInstance(); + } + + /* + * Peel off domain name from the assertion string if it matches + * domain and return the string without the domain prefix. + * Else, return default value + */ + static String stripDomainPrefix(String assertString, String domain, String defaultValue) { + int index = assertString.indexOf(':'); + if (index == -1) { + return assertString; + } + + if (assertString.substring(0, index).equals(domain) == false) { + return defaultValue; + } + + return assertString.substring(index + 1); + } + + static boolean isRegexMetaCharacter(char regexChar) { + switch (regexChar) { + case '^': + case '$': + case '.': + case '|': + case '[': + case '+': + case '\\': + case '(': + case ')': + case '{': + return true; + default: + return false; + } + } + + public static String patternFromGlob(String glob) { + StringBuilder sb = new StringBuilder("^"); + int len = glob.length(); + for (int i = 0; i < len; i++) { + char c = glob.charAt(i); + if (c == '*') { + sb.append(".*"); + } else if (c == '?') { + sb.append('.'); + } else { + if (isRegexMetaCharacter(c)) { + sb.append('\\'); + } + sb.append(c); + } + } + sb.append("$"); + return sb.toString(); + } + + // check action access in the domain to the resource with the given roles + // + static AccessCheckStatus allowActionZPE(String action, String tokenDomain, String angResource, + List roles, StringBuilder matchRoleName) { + + StringBuilder sb = new StringBuilder("allowActionZPE: domain("); + sb.append(tokenDomain).append(") action(").append(action). + append(") resource(").append(angResource).append(")"); + String msgPrefix = sb.toString(); + + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + " STARTING"); + } + + if (roles == null || roles.size() == 0) { + LOG.error(msgPrefix + " ERROR: No roles so access denied"); + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_INVALID_TOKEN, tokenDomain); + return AccessCheckStatus.DENY_ROLETOKEN_INVALID; + } + + if (tokenDomain == null || tokenDomain.isEmpty() == true) { + LOG.error(msgPrefix + " ERROR: No domain so access denied"); + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_INVALID_TOKEN, DEFAULT_DOMAIN); + return AccessCheckStatus.DENY_ROLETOKEN_INVALID; + } + + if (action == null || action.isEmpty() == true) { + LOG.error(msgPrefix + " ERROR: No action so access denied"); + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_ERROR, tokenDomain); + return AccessCheckStatus.DENY_INVALID_PARAMETERS; + } + action = action.toLowerCase(); + + if (angResource == null || angResource.isEmpty() == true) { + LOG.error(msgPrefix + " ERROR: No resource so access denied"); + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_ERROR, tokenDomain); + return AccessCheckStatus.DENY_INVALID_PARAMETERS; + } + angResource = angResource.toLowerCase(); + angResource = stripDomainPrefix(angResource, tokenDomain, null); + + // Note: if domain in token doesn't match domain in resource then there + // will be no match of any resource in the assertions - so deny immediately + + if (angResource == null) { + StringBuilder sbErr = new StringBuilder(512); + sbErr.append(msgPrefix).append(" ERROR: Domain mismatch in token("). + append(tokenDomain).append(") and resource so access denied"); + LOG.error(sbErr.toString()); + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_DOMAIN_MISMATCH, tokenDomain); + return AccessCheckStatus.DENY_DOMAIN_MISMATCH; + } + + // first hunt by role for deny assertions since deny takes precedence + // over allow assertions + + AccessCheckStatus status = AccessCheckStatus.DENY_DOMAIN_NOT_FOUND; + Map> roleMap = getRoleSpecificDenyPolicies(tokenDomain); + if (roleMap != null && !roleMap.isEmpty()) { + if (actionByRole(action, tokenDomain, angResource, roles, roleMap, matchRoleName)) { + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_DENY, tokenDomain); + return AccessCheckStatus.DENY; + } else { + status = AccessCheckStatus.DENY_NO_MATCH; + } + } else if (roleMap != null) { + status = AccessCheckStatus.DENY_DOMAIN_EMPTY; + } + + // if the check was not explicitly denied by a standard role, then + // let's process our wildcard roles for deny assertions + + roleMap = getWildCardDenyPolicies(tokenDomain); + if (roleMap != null && !roleMap.isEmpty()) { + if (actionByWildCardRole(action, tokenDomain, angResource, roles, roleMap, matchRoleName)) { + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_DENY, tokenDomain); + return AccessCheckStatus.DENY; + } else { + status = AccessCheckStatus.DENY_NO_MATCH; + } + } else if (status != AccessCheckStatus.DENY_NO_MATCH && roleMap != null) { + status = AccessCheckStatus.DENY_DOMAIN_EMPTY; + } + + // so far it did not match any deny assertions so now let's + // process our allow assertions + + roleMap = getRoleSpecificAllowPolicies(tokenDomain); + if (roleMap != null && !roleMap.isEmpty()) { + if (actionByRole(action, tokenDomain, angResource, roles, roleMap, matchRoleName)) { + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_ALLOW, tokenDomain); + return AccessCheckStatus.ALLOW; + } else { + status = AccessCheckStatus.DENY_NO_MATCH; + } + } else if (status != AccessCheckStatus.DENY_NO_MATCH && roleMap != null) { + status = AccessCheckStatus.DENY_DOMAIN_EMPTY; + } + + // at this point we either got an allow or didn't match anything so we're + // going to try the wildcard roles + + roleMap = getWildCardAllowPolicies(tokenDomain); + if (roleMap != null && !roleMap.isEmpty()) { + if (actionByWildCardRole(action, tokenDomain, angResource, roles, roleMap, matchRoleName)) { + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_ALLOW, tokenDomain); + return AccessCheckStatus.ALLOW; + } else { + status = AccessCheckStatus.DENY_NO_MATCH; + } + } else if (status != AccessCheckStatus.DENY_NO_MATCH && roleMap != null) { + status = AccessCheckStatus.DENY_DOMAIN_EMPTY; + } + + if (status == AccessCheckStatus.DENY_DOMAIN_NOT_FOUND) { + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": No role map found for domain=" + tokenDomain + + " so access denied"); + } + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_DOMAIN_NOT_FOUND, tokenDomain); + } else if (status == AccessCheckStatus.DENY_DOMAIN_EMPTY) { + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": No policy assertions for domain=" + tokenDomain + + " so access denied"); + } + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_DOMAIN_EMPTY, tokenDomain); + } else { + zpeMetric.increment(ZpeConsts.ZPE_METRIC_NAME_DENY_NO_MATCH, tokenDomain); + } + + return status; + } + + static boolean matchAssertions(List asserts, String role, String action, + String resource, StringBuilder matchRoleName, String msgPrefix) { + + ZpeMatch matchStruct = null; + String passertAction = null; + String passertResource = null; + String passertRole = null; + String polName = null; + + for (Struct strAssert: asserts) { + + if (LOG.isDebugEnabled()) { + + // this strings are only used for debug statements so we'll + // only retrieve them if debug option is enabled + + passertAction = strAssert.getString(ZpeConsts.ZPE_FIELD_ACTION); + passertResource = strAssert.getString(ZpeConsts.ZPE_FIELD_RESOURCE); + passertRole = strAssert.getString(ZpeConsts.ZPE_FIELD_ROLE); + polName = strAssert.getString(ZpeConsts.ZPE_FIELD_POLICY_NAME); + + LOG.debug(msgPrefix + ": Process Assertion: policy(" + polName + + ") assert-action=" + passertAction + + " assert-resource=" + passertResource + " assert-role=" + passertRole); + } + + // ex: "mod* + + matchStruct = (ZpeMatch) strAssert.get(ZpeConsts.ZPE_ACTION_MATCH_STRUCT); + if (!matchStruct.matches(action)) { + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": policy(" + polName + ") regexpr-match: FAILed: assert-action(" + + passertAction + ") doesn't match action(" + action + ")"); + } + continue; + } + + // ex: "weather:service.storage.tenant.sports.*" + matchStruct = (ZpeMatch) strAssert.get(ZpeConsts.ZPE_RESOURCE_MATCH_STRUCT); + if (!matchStruct.matches(resource)) { + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": policy(" + polName + ") regexpr-match: FAILed: assert-resource(" + + passertResource + ") doesn't match resource(" + resource + ")"); + } + continue; + } + + // update the match role name + + matchRoleName.setLength(0); + matchRoleName.append(role); + + return true; + } + + return false; + } + + static boolean actionByRole(String action, String domain, String angResource, + List roles, Map> roleMap, StringBuilder matchRoleName) { + + // msgPrefix is only used in our debug statements so we're only + // going to generate the value if debug is enabled + + String msgPrefix = null; + if (LOG.isDebugEnabled()) { + StringBuilder sb = new StringBuilder("allowActionByRole: domain("); + sb.append(domain).append(") action(").append(action). + append(") resource(").append(angResource).append(")"); + msgPrefix = sb.toString(); + } + + for (String role : roles) { + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": Process role (" + role + ")"); + } + + List asserts = roleMap.get(role); + if (asserts == null || asserts.isEmpty()) { + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": No policy assertions in domain=" + domain + + " for role=" + role + " so access denied"); + } + continue; + } + + // see if any of its assertions match the action and resource + // the assert action value does not have the domain prefix + // ex: "Modify" + // the assert resource value has the domain prefix + // ex: "angler:angler.stuff" + + if (matchAssertions(asserts, role, action, angResource, matchRoleName, msgPrefix)) { + return true; + } + } + + return false; + } + + static boolean actionByWildCardRole(String action, String domain, String angResource, + List roles, Map> roleMap, StringBuilder matchRoleName) { + + String msgPrefix = null; + if (LOG.isDebugEnabled()) { + StringBuilder sb = new StringBuilder("allowActionByWildCardRole: domain("); + sb.append(domain).append(") action(").append(action). + append(") resource(").append(angResource).append(")"); + msgPrefix = sb.toString(); + } + + // find policy matching resource and action + // get assertions for given domain+role + // then cycle thru those assertions looking for matching action and resource + + // we will visit each of the wildcard roles + // + Set keys = roleMap.keySet(); + + for (String role: roles) { + + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": Process role (" + role + ")"); + } + + for (String roleName : keys) { + List asserts = roleMap.get(roleName); + if (asserts == null || asserts.isEmpty()) { + if (LOG.isDebugEnabled()) { + LOG.debug(msgPrefix + ": No policy assertions in domain=" + domain + + " for role=" + role + " so access denied"); + } + continue; + } + + Struct structAssert = asserts.get(0); + ZpeMatch matchStruct = (ZpeMatch) structAssert.get(ZpeConsts.ZPE_ROLE_MATCH_STRUCT); + if (!matchStruct.matches(role)) { + if (LOG.isDebugEnabled()) { + String polName = structAssert.getString(ZpeConsts.ZPE_FIELD_POLICY_NAME); + LOG.debug(msgPrefix + ": policy(" + polName + + ") regexpr-match: FAILed: assert-role(" + roleName + + ") doesnt match role(" + role + ")"); + } + continue; + } + + // HAVE: matched the role with the wildcard + + // see if any of its assertions match the action and resource + // the assert action value does not have the domain prefix + // ex: "Modify" + // the assert resource value has the domain prefix + // ex: "angler:angler.stuff" + + if (matchAssertions(asserts, roleName, action, angResource, matchRoleName, msgPrefix)) { + return true; + } + } + } + + return false; + } + + static Map> getWildCardAllowPolicies(String domain) { + try { + ZpeClient zpeclt = getZpeClient(); + Map> roleAsserts = zpeclt.getWildcardAllowAssertions(domain); + return roleAsserts; + } catch (Exception exc) { + LOG.error("getWildCardAllowPolicies: exc: ", exc); + } + return null; + } + + static Map> getRoleSpecificAllowPolicies(String domain) { + try { + ZpeClient zpeclt = getZpeClient(); + Map> roleAsserts = zpeclt.getRoleAllowAssertions(domain); + return roleAsserts; + } catch (Exception exc) { + LOG.error("getRoleSpecificAllowPolicies: exc: ", exc); + } + return null; + } + + static Map> getWildCardDenyPolicies(String domain) { + try { + ZpeClient zpeclt = getZpeClient(); + Map> roleAsserts = zpeclt.getWildcardDenyAssertions(domain); + return roleAsserts; + } catch (Exception exc) { + LOG.error("getWildCardDenyPolicies: exc: ", exc); + } + return null; + } + + static Map> getRoleSpecificDenyPolicies(String domain) { + try { + ZpeClient zpeclt = getZpeClient(); + Map> roleAsserts = zpeclt.getRoleDenyAssertions(domain); + return roleAsserts; + } catch (Exception exc) { + LOG.error("getRoleSpecificDenyPolicies: exc: ", exc); + } + return null; + } +} + diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeClient.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeClient.java new file mode 100644 index 00000000000..a869bab4213 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeClient.java @@ -0,0 +1,49 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import java.util.List; +import java.util.Map; + +import com.yahoo.athenz.auth.token.RoleToken; +import com.yahoo.rdl.Struct; + + +public interface ZpeClient { + + // @param domain can be null + public void init(String domain); + + // return current cache of role tokens + public Map getRoleTokenCacheMap(); + + // return the role assertion map for the specified domain with allow effect + // key is role name, value is List of assertions for that role + public Map> getRoleAllowAssertions(String domain); + + // return the wildcard role assertion map for the specified domain with allow effect + // key is role name, value is List of assertions for that role + public Map> getWildcardAllowAssertions(String domain); + + // return the role assertion map for the specified domain with deny effect + // key is role name, value is List of assertions for that role + public Map> getRoleDenyAssertions(String domain); + + // return the wildcard role assertion map for the specified domain with deny effect + // key is role name, value is List of assertions for that role + public Map> getWildcardDenyAssertions(String domain); +} + diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeConsts.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeConsts.java new file mode 100644 index 00000000000..6f962357ba5 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeConsts.java @@ -0,0 +1,68 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import com.yahoo.athenz.zts.DomainMetricType; + +public final class ZpeConsts { + + public static final String ZPE_ACTION_MATCH_STRUCT = "actionMatchStruct"; + public static final String ZPE_RESOURCE_MATCH_STRUCT = "resourceMatchStruct"; + public static final String ZPE_ROLE_MATCH_STRUCT = "roleMatchStruct"; + + public static final String ZPE_FIELD_ACTION = "action"; + public static final String ZPE_FIELD_RESOURCE = "resource"; + public static final String ZPE_FIELD_ROLE = "role"; + public static final String ZPE_FIELD_EFFECT = "effect"; + public static final String ZPE_FIELD_POLICY_NAME = "polname"; + + public static final String ZPE_METRIC_SCOREBOARD_NAME = "athenz_zpe_java_client"; + public static final String ZPE_METRIC_NAME = DomainMetricType.ACCESS_ALLOWED.toString(); + public static final String ZPE_METRIC_NAME_DENY = DomainMetricType.ACCESS_ALLOWED_DENY.toString(); + public static final String ZPE_METRIC_NAME_DENY_NO_MATCH = DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH.toString(); + public static final String ZPE_METRIC_NAME_ALLOW = DomainMetricType.ACCESS_ALLOWED_ALLOW.toString(); + public static final String ZPE_METRIC_NAME_ERROR = DomainMetricType.ACCESS_ALLOWED_ERROR.toString(); + public static final String ZPE_METRIC_NAME_INVALID_TOKEN = DomainMetricType.ACCESS_ALLOWED_TOKEN_INVALID.toString(); + public static final String ZPE_METRIC_NAME_EXPIRED_TOKEN = DomainMetricType.ACCESS_Allowed_TOKEN_EXPIRED.toString(); + public static final String ZPE_METRIC_NAME_DOMAIN_NOT_FOUND = DomainMetricType.ACCESS_ALLOWED_DOMAIN_NOT_FOUND.toString(); + public static final String ZPE_METRIC_NAME_DOMAIN_MISMATCH = DomainMetricType.ACCESS_ALLOWED_DOMAIN_MISMATCH.toString(); + public static final String ZPE_METRIC_NAME_DOMAIN_EXPIRED = DomainMetricType.ACCESS_ALLOWED_DOMAIN_EXPIRED.toString(); + public static final String ZPE_METRIC_NAME_DOMAIN_EMPTY = DomainMetricType.ACCESS_ALLOWED_DOMAIN_EMPTY.toString(); + public static final String ZPE_METRIC_NAME_CACHE_FAILURE = DomainMetricType.ACCESS_ALLOWED_TOKEN_CACHE_FAILURE.toString(); + public static final String ZPE_METRIC_NAME_CACHE_NOT_FOUND = DomainMetricType.ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND.toString(); + public static final String ZPE_METRIC_NAME_CACHE_SUCCESS = DomainMetricType.ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS.toString(); + public static final String ZPE_METRIC_NAME_TOKEN_VALIDATE = DomainMetricType.ACCESS_ALLOWED_TOKEN_VALIDATE.toString(); + public static final String ZPE_METRIC_LOAD_FILE_FAIL = DomainMetricType.LOAD_FILE_FAIL.toString(); + public static final String ZPE_METRIC_LOAD_FILE_GOOD = DomainMetricType.LOAD_FILE_GOOD.toString(); + public static final String ZPE_METRIC_LOAD_DOM_GOOD = DomainMetricType.LOAD_DOMAIN_GOOD.toString(); + + // properties + public static final String ZPE_PROP_ATHENZ_CONF = "athenz.athenz_conf"; + + public static final String ZPE_PROP_STATS_ENABLED = "athenz.zpe.enable_stats"; + public static final String ZPE_PROP_METRIC_CLASS = "athenz.zpe.metric_factory_class"; + public static final String ZPE_PROP_PUBLIC_KEY_CLASS = "athenz.zpe.public_key_class"; + public static final String ZPE_PROP_CLIENT_IMPL = "athenz.zpe.updater_class"; + public static final String ZPE_PROP_TOKEN_OFFSET = "athenz.zpe.token_allowed_offset"; + public static final String ZPE_PROP_METRIC_WRITE_INTERVAL = "athenz.zpe.metric_write_interval"; + public static final String ZPE_PROP_METRIC_FILE_PATH = "athenz.zpe.metric_file_path"; + public static final String ZPE_PROP_MON_TIMEOUT = "athenz.zpe.monitor_timeout_secs"; + public static final String ZPE_PROP_MON_CLEANUP_TOKENS = "athenz.zpe.cleanup_tokens_secs"; + public static final String ZPE_PROP_POLICY_DIR = "athenz.zpe.policy_dir"; + + static final String ZPE_METRIC_FACTORY_CLASS = "com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory"; + +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeMetric.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeMetric.java new file mode 100644 index 00000000000..35717ccf339 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeMetric.java @@ -0,0 +1,128 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import com.yahoo.athenz.zts.DomainMetric; +import com.yahoo.athenz.zts.DomainMetricType; +import com.yahoo.athenz.zts.DomainMetrics; +import com.yahoo.rdl.JSON; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.TimerTask; +import java.util.concurrent.ConcurrentHashMap; +import java.util.concurrent.atomic.AtomicIntegerArray; +import java.util.ArrayList; +import java.util.Timer; + +public class ZpeMetric { + + public static final String ZPE_METRIC_FILE_PATH = "/var/zpe_stat/"; + public static final String ZPE_WRITE_INTERVAL = "3600000"; + + public ConcurrentHashMap counter = new ConcurrentHashMap<>(); + private static Timer FETCH_TIMER; + private static final Object TIMER_LOCK = new Object(); + static boolean statsEnabled = Boolean.parseBoolean(System.getProperty(ZpeConsts.ZPE_PROP_STATS_ENABLED, "false")); + + //constructor + ZpeMetric() { + File directory = new File(String.valueOf(getFilePath())); + directory.mkdir(); + //setting the timer to the interval specified in the system property + if (statsEnabled) { + Integer interval = Integer.parseInt(System.getProperty(ZpeConsts.ZPE_PROP_METRIC_WRITE_INTERVAL, ZPE_WRITE_INTERVAL)); + if (FETCH_TIMER == null) { + synchronized (TIMER_LOCK) { + if (FETCH_TIMER == null) { + FETCH_TIMER = new Timer(); + FETCH_TIMER.schedule(new SchedulerService(), interval, interval); + } + } + } + } + } + + //scheduler service + class SchedulerService extends TimerTask { + @Override + public void run() { + writeToFile(); + } + } + + String getFilePath() { + String rootDir = System.getenv("ROOT"); + if (rootDir == null) { + rootDir = "/home/athenz"; + } + final String defaultPath = rootDir + ZPE_METRIC_FILE_PATH; + String filePath = System.getProperty(ZpeConsts.ZPE_PROP_METRIC_FILE_PATH, defaultPath); + + // verify it ends with / and handle accordingly + + if (!filePath.endsWith(File.separator)) { + filePath = filePath.concat(File.separator); + } + return filePath; + } + + //to increment a metric counter by 1 + public void increment(String metricName, String domainName) { + if (statsEnabled) { + if (!counter.contains(domainName)) { + counter.putIfAbsent(domainName, new AtomicIntegerArray(DomainMetricType.LOAD_DOMAIN_GOOD.ordinal() + 1)); + } + Integer index = com.yahoo.athenz.zts.DomainMetricType.valueOf(metricName).ordinal(); + counter.get(domainName).incrementAndGet(index); + } + } + + //to convert the atomicIntegerArray to JSON object + public DomainMetrics getMetrics(String domainName) { + ArrayList metricList = new ArrayList<>(); + for (DomainMetricType label : DomainMetricType.values()) { + DomainMetric domainMetric = new DomainMetric(); + domainMetric.setMetricType(label); + domainMetric.setMetricVal(counter.get(domainName).getAndSet(label.ordinal(), 0)); + metricList.add(domainMetric); + } + DomainMetrics domainMetrics = new DomainMetrics() + .setDomainName(domainName) + .setMetricList(metricList); + return domainMetrics; + } + + //to write the JSON to file + public void writeToFile() { + final String dirPath = getFilePath(); + for (String domainName : counter.keySet()) { + DomainMetrics domainMetrics = getMetrics(domainName); + Long epoch = System.currentTimeMillis(); + String filepath = dirPath + domainName + "_" + Long.toString(epoch) + ".json"; + try { + Path path = Paths.get(filepath); + Files.write(path, JSON.bytes(domainMetrics)); + } catch (IOException e) { + e.printStackTrace(); + counter.remove(domainName); + } + } + } +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeThreadFactory.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeThreadFactory.java new file mode 100644 index 00000000000..9e9f1c7d4e5 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeThreadFactory.java @@ -0,0 +1,45 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import java.util.concurrent.ThreadFactory; +import java.util.concurrent.atomic.AtomicInteger; + +class ZpeThreadFactory implements ThreadFactory { + private static final AtomicInteger POOLNUMBER = new AtomicInteger(1); + private final ThreadGroup group; + private final AtomicInteger threadNumber = new AtomicInteger(1); + private final String namePrefix; + + public ZpeThreadFactory(String name) { + SecurityManager s = System.getSecurityManager(); + group = (s != null) ? s.getThreadGroup() : Thread.currentThread() + .getThreadGroup(); + namePrefix = name + "-pool-" + POOLNUMBER.getAndIncrement() + + "-thread-"; + } + + public Thread newThread(Runnable target) { + Thread thrd = new Thread(group, target, namePrefix + + threadNumber.getAndIncrement(), 0); + thrd.setDaemon(true); + if (thrd.getPriority() != Thread.NORM_PRIORITY) { + thrd.setPriority(Thread.NORM_PRIORITY); + } + return thrd; + } +} + diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdMonitor.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdMonitor.java new file mode 100644 index 00000000000..570b2c5afe5 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdMonitor.java @@ -0,0 +1,112 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import java.io.File; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + + +/** + * Used in monitoring the policy directory for file changes. + */ +public class ZpeUpdMonitor implements Runnable { + private static final Logger LOG = LoggerFactory.getLogger(ZpeUpdMonitor.class); + + private final ZpeUpdPolLoader updLoader; + private volatile boolean shutdownThread = false; + private String dirName = null; + private boolean firstRun = true; + + private java.io.FilenameFilter polFileNameFilter = new java.io.FilenameFilter() { + public boolean accept(File dir, String name) { + if (name.endsWith(".pol")) { + return true; + } + return false; + } + }; + + ZpeUpdMonitor(final ZpeUpdPolLoader zpeUpdLoader) { + updLoader = zpeUpdLoader; + dirName = updLoader.getDirName(); + } + + public void cancel() { + shutdownThread = true; + } + + public File[] loadFileStatus() { + // read all the file names in the policy directory and add to the list + File pdir = new File(dirName); + File [] files = pdir.listFiles(polFileNameFilter); + if (files == null || files.length == 0) { + if (pdir.exists()) { + LOG.error("loadFileStatus: the directory=" + dirName + " exists, but there are no policy files in it"); + } else { + LOG.error("loadFileStatus: the directory=" + dirName + " does NOT exist"); + } + } + return files; + } + + private void logRunMsg(Exception exc) { + dirName = dirName == null ? "MISSING-POL-DIR-NAME" : dirName; + String msg = "Reload directory=" + dirName; + + if (exc == null) { + LOG.debug(msg); + } else { + LOG.error(msg, exc); + } + } + + @Override + public void run() { + if (updLoader == null) { + LOG.error("run: No ZpeUpdPolLoader to monitor"); + return; + } + + if (shutdownThread) { + LOG.warn("run: monitor told to shutdown"); + return; + } + + // perform cleanup of RoleTokens - expired ones will be removed + ZpeUpdPolLoader.cleanupRoleTokenCache(); + + try { + updLoader.loadDb(loadFileStatus()); + if (firstRun) { + firstRun = false; + synchronized (updLoader) { + updLoader.notify(); + } + } + } catch (Exception exc) { + logRunMsg(exc); + return; + } + + if (LOG.isDebugEnabled()) { + logRunMsg(null); + } + } + +} + diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdPolLoader.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdPolLoader.java new file mode 100644 index 00000000000..8ee0a92bbbf --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdPolLoader.java @@ -0,0 +1,486 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import java.io.Closeable; +import java.io.File; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.List; +import java.util.ArrayList; +import java.util.Map; +import java.util.TreeMap; +import java.util.concurrent.ConcurrentHashMap; +import java.util.concurrent.ScheduledThreadPoolExecutor; +import java.util.concurrent.TimeUnit; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Struct; +import com.yahoo.athenz.auth.token.RoleToken; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zpe.match.ZpeMatch; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchAll; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchEqual; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchRegex; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchStartsWith; +import com.yahoo.athenz.zts.Assertion; +import com.yahoo.athenz.zts.AssertionEffect; +import com.yahoo.athenz.zts.DomainSignedPolicyData; +import com.yahoo.athenz.zts.Policy; +import com.yahoo.athenz.zts.PolicyData; +import com.yahoo.athenz.zts.SignedPolicyData; + +public class ZpeUpdPolLoader implements Closeable { + + private static final Logger LOG = LoggerFactory.getLogger(ZpeUpdPolLoader.class); + + static long _sleepTimeMillis = -1; + static long _cleanupTokenInterval = 600000; // 600 secs = 10 minutes + static long _lastTokenCleanup = System.currentTimeMillis(); + + static { + + String timeoutSecs = System.getProperty(ZpeConsts.ZPE_PROP_MON_TIMEOUT, null); + if (timeoutSecs == null) { + // default to 5 minutes + _sleepTimeMillis = TimeUnit.MILLISECONDS.convert(5, TimeUnit.MINUTES); + } else { + try { + long secs = Long.parseLong(timeoutSecs); + _sleepTimeMillis = TimeUnit.MILLISECONDS.convert(secs, TimeUnit.SECONDS); + } catch (NumberFormatException exc) { + String errMsg = "start: WARNING: Failed using system property(" + + ZpeConsts.ZPE_PROP_MON_TIMEOUT + + ") Got property value=" + timeoutSecs; + LOG.warn(errMsg, exc); + } + } + + timeoutSecs = System.getProperty(ZpeConsts.ZPE_PROP_MON_CLEANUP_TOKENS, null); + if (timeoutSecs != null) { + try { + long secs = Long.parseLong(timeoutSecs); + _cleanupTokenInterval = TimeUnit.MILLISECONDS.convert(secs, TimeUnit.SECONDS); + } catch (NumberFormatException exc) { + String errMsg = "start: WARNING: Failed using system property(" + + ZpeConsts.ZPE_PROP_MON_CLEANUP_TOKENS + + ") Got property value=" + timeoutSecs; + LOG.warn(errMsg, exc); + } + } + } + + // create thread or event handler to monitor changes to ZpePolFiles + // see JavaYnetDbWrapper for scheduled thread way to monitor + // find the java7 api for monitoring files + // see http://docs.oracle.com/javase/tutorial/essential/io/notification.html + private ScheduledThreadPoolExecutor scheduledExecutorSvc = new ScheduledThreadPoolExecutor( + 1, new ZpeThreadFactory("ZpeUpdPolLoader")); + + private ZpeUpdMonitor updMonWorker; + + // key is the domain name, value is a map keyed by role name with list of assertions + ConcurrentHashMap>> domStandardRoleAllowMap = new ConcurrentHashMap<>(); + + // wild card role map, keys and values same as domRoleMap above + ConcurrentHashMap>> domWildcardRoleAllowMap = new ConcurrentHashMap<>(); + + // key is the domain name, value is a map keyed by role name with list of assertions + ConcurrentHashMap>> domStandardRoleDenyMap = new ConcurrentHashMap<>(); + + // wild card role map, keys and values same as domRoleMap above + ConcurrentHashMap>> domWildcardRoleDenyMap = new ConcurrentHashMap<>(); + + // cache of active Role Tokens + static ConcurrentHashMap roleTokenCacheMap = new ConcurrentHashMap(); + + // array of file status objects + static class ZpeFileStatus { + String fname; + String domain; + long modifyTimeMillis; + boolean validPolFile; + + ZpeFileStatus(String fname, long modTimeMillis) { + domain = null; + modifyTimeMillis = modTimeMillis; + validPolFile = false; + } + } + private Map fileStatusRef = new ConcurrentHashMap(); + + private String polDirName; + + + ZpeUpdPolLoader(String dirName) { + + if (null != dirName) { + polDirName = dirName; + try { + loadDb(); + } catch (Exception exc) { + LOG.error("loadDb Failed", exc); + } + } + } + + String getDirName() { + return polDirName; + } + + Map getFileStatusMap() { + return fileStatusRef; + } + + // return map of wildcard role with assertion list with allow effect + // + public Map> getWildcardRoleAllowMap(String domainName) { + return domWildcardRoleAllowMap.get(domainName); + } + + // return map of role-name with assertion list with allow effect + // + public Map> getStandardRoleAllowMap(String domainName) { + return domStandardRoleAllowMap.get(domainName); + } + + // return map of wildcard role with assertion list with deny effect + // + public Map> getWildcardRoleDenyMap(String domainName) { + return domWildcardRoleDenyMap.get(domainName); + } + + // return map of role-name with assertion list with deny effect + // + public Map> getStandardRoleDenyMap(String domainName) { + return domStandardRoleDenyMap.get(domainName); + } + + static public Map getRoleTokenCacheMap() { + return roleTokenCacheMap; + } + + public void start() throws Exception { + if (polDirName == null) { + String errMsg = "ERROR: start: no policy directory name, can't monitor data files"; + throw new Exception(errMsg); + } + + if (updMonWorker == null) { + updMonWorker = new ZpeUpdMonitor(this); + } + scheduledExecutorSvc.scheduleAtFixedRate(updMonWorker, 0, + _sleepTimeMillis, TimeUnit.MILLISECONDS); + } + + @Override + public void close() { + if (updMonWorker != null) { + updMonWorker.cancel(); + } + scheduledExecutorSvc.shutdownNow(); + } + + static public void cleanupRoleTokenCache() { + // is it time to cleanup? + long now = System.currentTimeMillis(); + if (now < (_cleanupTokenInterval + _lastTokenCleanup)) { + return; + } + + List expired = new ArrayList(); + long nowSecs = now / 1000; + for (java.util.Enumeration keys = roleTokenCacheMap.keys(); + keys.hasMoreElements();) { + String key = keys.nextElement(); + RoleToken rToken = roleTokenCacheMap.get(key); + if (rToken == null) { + continue; + } + long expiry = rToken.getExpiryTime(); + if (expiry != 0 && expiry < nowSecs) { + expired.add(key); + if (LOG.isDebugEnabled()) { + LOG.debug("cleanupRoleTokenCache: Remove expired token. now(secs)=" + + nowSecs + " expiry=" + expiry + " token=" + key); + } + } + } + // HAVE: list of expired tokens + for (String key: expired) { + roleTokenCacheMap.remove(key); + } + _lastTokenCleanup = now; // reset time of last cleanup + } + + void loadDb() { + if (updMonWorker == null) { + updMonWorker = new ZpeUpdMonitor(this); + } + File[] polFileNames = updMonWorker.loadFileStatus(); + loadDb(polFileNames); + } + + /** + * Process the given policy file list and determine if any of the + * policy domain files have been updated. New ones will be loaded + * into the policy domain map. + **/ + void loadDb(File []polFileNames) { + if (polFileNames == null) { + LOG.error("loadDb: no policy files to load"); + return; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("loadDb: START thrd=" + Thread.currentThread().getId() + " directory=" + polDirName); + } + for (File polFile: polFileNames) { + + String fileName = polFile.getName(); + if (LOG.isDebugEnabled()) { + LOG.debug("loadDb: START thrd=" + Thread.currentThread().getId() + " file name=" + fileName); + } + long lastModMilliSeconds = polFile.lastModified(); + Map fsmap = getFileStatusMap(); + ZpeFileStatus fstat = fsmap.get(fileName); + if (fstat != null) { + + if (polFile.exists() == false) { // file was deleted + if (LOG.isDebugEnabled()) { + LOG.debug("loadDb: file(" + fileName + " ) was deleted or doesn't exist"); + } + fsmap.remove(fileName); + + if (fstat.validPolFile == false || fstat.domain == null) { + continue; + } + + // replace domain with empty data + // + domStandardRoleAllowMap.put(fstat.domain, new TreeMap>()); + domWildcardRoleAllowMap.put(fstat.domain, new TreeMap>()); + domStandardRoleDenyMap.put(fstat.domain, new TreeMap>()); + domWildcardRoleDenyMap.put(fstat.domain, new TreeMap>()); + continue; + } + + // check if file was modified since last time it was loaded + // + if (lastModMilliSeconds <= fstat.modifyTimeMillis) { + // if valid and up to date return + // if not valid, may be due to timing issue for a new + // file not completely written - and file system timestamp + // only accurate up to the second - not millis + String timeMsg = " last-file-mod-time=" + lastModMilliSeconds; + if (fstat.validPolFile == true) { + if (LOG.isDebugEnabled()) { + LOG.debug("loadDb: ignore reload file: " + fileName + " since up to date: " + timeMsg); + } + continue; + } else if (LOG.isDebugEnabled()) { + LOG.debug("loadDb: retry load file: " + fileName + " since last load was bad: " + timeMsg); + } + + } + } else { + fstat = new ZpeFileStatus(fileName, lastModMilliSeconds); + fsmap.put(fileName, fstat); + } + loadFile(polFile); + } + } + + ZpeMatch getMatchObject(String value) { + + ZpeMatch match = null; + if ("*".equals(value)) { + match = new ZpeMatchAll(); + } else { + int anyCharMatch = value.indexOf('*'); + int singleCharMatch = value.indexOf('?'); + + if (anyCharMatch == -1 && singleCharMatch == -1) { + match = new ZpeMatchEqual(value); + } else if (anyCharMatch == value.length() - 1 && singleCharMatch == -1) { + match = new ZpeMatchStartsWith(value.substring(0, value.length() - 1)); + } else { + match = new ZpeMatchRegex(value); + } + } + + return match; + } + + /** + * Loads and parses the given file. It will create the domain assertion + * list per role and put it into the domain policy maps(domRoleMap, domWildcardRoleMap). + **/ + private void loadFile(File polFile) { + if (LOG.isDebugEnabled()) { + LOG.debug("loadFile: file(" + polFile.getName() + ")"); + } + + Path path = Paths.get(polDirName + File.separator + polFile.getName()); + DomainSignedPolicyData spols = null; + try { + spols = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + } catch (Exception ex) { + LOG.error("loadFile: unable to decode policy file=" + polFile.getName() + " error: " + ex.getMessage()); + } + if (spols == null) { + LOG.error("loadFile: unable to decode domain file=" + polFile.getName()); + // mark this as an invalid file + Map fsmap = getFileStatusMap(); + ZpeFileStatus fstat = fsmap.get(polFile.getName()); + if (fstat != null) { + fstat.validPolFile = false; + } + return; + } + + SignedPolicyData signedPolicyData = spols.getSignedPolicyData(); + String signature = spols.getSignature(); + String keyId = spols.getKeyId(); + + // first let's verify the ZTS signature for our policy file + + boolean verified = false; + if (signedPolicyData != null) { + java.security.PublicKey pubKey = AuthZpeClient.getZtsPublicKey(keyId); + verified = Crypto.verify(SignUtils.asCanonicalString(signedPolicyData), pubKey, signature); + } + + PolicyData policyData = null; + if (verified) { + // now let's verify that the ZMS signature for our policy file + policyData = signedPolicyData.getPolicyData(); + signature = signedPolicyData.getZmsSignature(); + keyId = signedPolicyData.getZmsKeyId(); + + if (policyData != null) { + java.security.PublicKey pubKey = AuthZpeClient.getZmsPublicKey(keyId); + verified = Crypto.verify(SignUtils.asCanonicalString(policyData), pubKey, signature); + } + } + + if (verified == false) { + LOG.error("loadFile: policy file=" + polFile.getName() + " is invalid"); + // mark this as an invalid file + Map fsmap = getFileStatusMap(); + ZpeFileStatus fstat = fsmap.get(polFile.getName()); + if (fstat != null) { + fstat.validPolFile = false; + } + return; + } + + // HAVE: valid policy file + + String domainName = policyData.getDomain(); + if (LOG.isDebugEnabled()) { + LOG.debug("loadFile: policy file(" + polFile.getName() + ") for domain(" + domainName + ") is valid"); + } + + // Process the policies into assertions, process the assertions: action, resource, role + // If there is a wildcard in the action or resource, compile the + // regexpr and place it into the assertion Struct. + // This is a performance enhancement for AuthZpeClient when it + // performs the authorization checks. + Map> roleStandardAllowMap = new TreeMap>(); + Map> roleWildcardAllowMap = new TreeMap>(); + Map> roleStandardDenyMap = new TreeMap>(); + Map> roleWildcardDenyMap = new TreeMap>(); + List policies = policyData.getPolicies(); + for (Policy policy : policies) { + String pname = policy.getName(); + if (LOG.isDebugEnabled()) { + LOG.debug("loadFile: domain(" + domainName + ") policy(" + pname + ")"); + } + List assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + for (Assertion assertion : assertions) { + com.yahoo.rdl.Struct strAssert = new Struct(); + strAssert.put(ZpeConsts.ZPE_FIELD_POLICY_NAME, pname); + + String passertAction = assertion.getAction(); + ZpeMatch matchStruct = getMatchObject(passertAction); + strAssert.put(ZpeConsts.ZPE_ACTION_MATCH_STRUCT, matchStruct); + + String passertResource = assertion.getResource(); + String rsrc = AuthZpeClient.stripDomainPrefix(passertResource, domainName, passertResource); + strAssert.put(ZpeConsts.ZPE_FIELD_RESOURCE, rsrc); + matchStruct = getMatchObject(rsrc); + strAssert.put(ZpeConsts.ZPE_RESOURCE_MATCH_STRUCT, matchStruct); + + String passertRole = assertion.getRole(); + String pRoleName = AuthZpeClient.stripDomainPrefix(passertRole, domainName, passertRole); + // strip the prefix "role." too + pRoleName = pRoleName.replaceFirst("^role.", ""); + strAssert.put(ZpeConsts.ZPE_FIELD_ROLE, pRoleName); + + // based on the effect and role name determine what + // map we're going to use + + Map> roleMap = null; + AssertionEffect passertEffect = assertion.getEffect(); + matchStruct = getMatchObject(pRoleName); + strAssert.put(ZpeConsts.ZPE_ROLE_MATCH_STRUCT, matchStruct); + + if (passertEffect != null && passertEffect.toString().compareTo("DENY") == 0) { + if (matchStruct instanceof ZpeMatchEqual) { + roleMap = roleStandardDenyMap; + } else { + roleMap = roleWildcardDenyMap; + } + } else { + if (matchStruct instanceof ZpeMatchEqual) { + roleMap = roleStandardAllowMap; + } else { + roleMap = roleWildcardAllowMap; + } + } + + List assertList = roleMap.get(pRoleName); + if (assertList == null) { + assertList = new ArrayList(); + roleMap.put(pRoleName, assertList); + } + assertList.add(strAssert); + } + } + + Map fsmap = getFileStatusMap(); + ZpeFileStatus fstat = fsmap.get(polFile.getName()); + if (fstat != null) { + fstat.validPolFile = true; + fstat.domain = domainName; + } + + domStandardRoleAllowMap.put(domainName, roleStandardAllowMap); + domWildcardRoleAllowMap.put(domainName, roleWildcardAllowMap); + domStandardRoleDenyMap.put(domainName, roleStandardDenyMap); + domWildcardRoleDenyMap.put(domainName, roleWildcardDenyMap); + } +} + diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdater.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdater.java new file mode 100644 index 00000000000..cd63898ca38 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeUpdater.java @@ -0,0 +1,99 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import java.io.File; +import java.util.List; +import java.util.Map; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.token.RoleToken; +import com.yahoo.rdl.Struct; + +public class ZpeUpdater implements ZpeClient { + + private static final Logger LOG = LoggerFactory.getLogger(ZpeUpdater.class); + + // default policy directory "/home/athenz/var/zpe/" + private static final String ZPECLT_POLDIR_DEFAULT; + private static final ZpeUpdPolLoader POLICYLOADER; + + static { + String rootDir = System.getenv("ROOT"); + + if (null == rootDir) { + rootDir = File.separator + "home" + File.separator + "athenz"; + } + + ZPECLT_POLDIR_DEFAULT = rootDir + File.separator + "var" + + File.separator + "zpe"; + + String dirName = System.getProperty(ZpeConsts.ZPE_PROP_POLICY_DIR, ZPECLT_POLDIR_DEFAULT); + + try { + if (LOG.isDebugEnabled()) { + LOG.debug("static-init: start monitoring policy directory=" + dirName); + } + // load the file + POLICYLOADER = new ZpeUpdPolLoader(dirName); + + // this will start monitoring policy directory for file mods + POLICYLOADER.start(); + + } catch (Exception exc) { + LOG.error("static-init: failed loading policy files. System property(" + + ZpeConsts.ZPE_PROP_POLICY_DIR + ") Policy-directory(" + dirName + ")", + exc); + throw new RuntimeException(exc); + } + } + + // @param domain can be null + public void init(String domain) { + try { + synchronized (POLICYLOADER) { + POLICYLOADER.wait(5000); // wait max of 5 seconds + } + } catch (InterruptedException exc) { + LOG.warn("init: waiting for policy loader to be ready, continuing..."); + } + } + + // return current cache of role tokens collected from the remote clients + // + public Map getRoleTokenCacheMap() { + return ZpeUpdPolLoader.getRoleTokenCacheMap(); + } + + public Map> getWildcardAllowAssertions(String domain) { + return POLICYLOADER.getWildcardRoleAllowMap(domain); + } + + public Map> getRoleAllowAssertions(String domain) { + return POLICYLOADER.getStandardRoleAllowMap(domain); + } + + public Map> getWildcardDenyAssertions(String domain) { + return POLICYLOADER.getWildcardRoleDenyMap(domain); + } + + public Map> getRoleDenyAssertions(String domain) { + return POLICYLOADER.getStandardRoleDenyMap(domain); + } +} + diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeYcrKey.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeYcrKey.java new file mode 100644 index 00000000000..fa7f27e44d1 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/ZpeYcrKey.java @@ -0,0 +1,35 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +public class ZpeYcrKey { + + private String keyName; + private short version = 0; + + String getKeyName() { + return keyName; + } + short getVersion() { + return version; + } + void setKeyName(String value) { + keyName = value; + } + void setVersion(short value) { + version = value; + } +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/ZpeMatch.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/ZpeMatch.java new file mode 100644 index 00000000000..aa5d51c354e --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/ZpeMatch.java @@ -0,0 +1,24 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.match; + +public interface ZpeMatch { + + /* + * @return boolean value if the given string matches for ZPE check + */ + public boolean matches(String value); +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchAll.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchAll.java new file mode 100644 index 00000000000..8df6c8120dd --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchAll.java @@ -0,0 +1,28 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.match.impl; + +import com.yahoo.athenz.zpe.match.ZpeMatch; + +public class ZpeMatchAll implements ZpeMatch { + + public ZpeMatchAll() { + } + + public boolean matches(String value) { + return true; + } +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchEqual.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchEqual.java new file mode 100644 index 00000000000..962a2600ca9 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchEqual.java @@ -0,0 +1,30 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.match.impl; + +import com.yahoo.athenz.zpe.match.ZpeMatch; + +public class ZpeMatchEqual implements ZpeMatch { + + private String matchValue; + public ZpeMatchEqual(String value) { + matchValue = value; + } + + public boolean matches(String value) { + return matchValue.equals(value); + } +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchRegex.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchRegex.java new file mode 100644 index 00000000000..2918713af1b --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchRegex.java @@ -0,0 +1,33 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.match.impl; + +import java.util.regex.Pattern; + +import com.yahoo.athenz.zpe.AuthZpeClient; +import com.yahoo.athenz.zpe.match.ZpeMatch; + +public class ZpeMatchRegex implements ZpeMatch { + + private Pattern pattern; + public ZpeMatchRegex(String value) { + pattern = Pattern.compile(AuthZpeClient.patternFromGlob(value)); + } + + public boolean matches(String value) { + return pattern.matcher(value).matches(); + } +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchStartsWith.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchStartsWith.java new file mode 100644 index 00000000000..11c01b5e249 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/match/impl/ZpeMatchStartsWith.java @@ -0,0 +1,30 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.match.impl; + +import com.yahoo.athenz.zpe.match.ZpeMatch; + +public class ZpeMatchStartsWith implements ZpeMatch { + + private String prefix; + public ZpeMatchStartsWith(String value) { + prefix = value; + } + + public boolean matches(String value) { + return value.startsWith(prefix); + } +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/PublicKeyStore.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/PublicKeyStore.java new file mode 100644 index 00000000000..32729541b94 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/PublicKeyStore.java @@ -0,0 +1,35 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.pkey; + +import java.security.PublicKey; + +public interface PublicKeyStore { + + /** + * Returns the ZTS PublicKey object for the given identifier + * @param keyId key identifier + * @return PublicKey + */ + public PublicKey getZtsKey(String keyId); + + /** + * Returns the ZMS PublicKey object for the given identifier + * @param keyId key identifier + * @return PublicKey + */ + public PublicKey getZmsKey(String keyId); +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/PublicKeyStoreFactory.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/PublicKeyStoreFactory.java new file mode 100644 index 00000000000..1c110ad61cb --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/PublicKeyStoreFactory.java @@ -0,0 +1,25 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.pkey; + +public interface PublicKeyStoreFactory { + + /** + * Create and return a new PublicKeyStore instance + * @return PublicKeyStore instance + */ + public PublicKeyStore create(); +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/file/FilePublicKeyStore.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/file/FilePublicKeyStore.java new file mode 100644 index 00000000000..7707d63ee5c --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/file/FilePublicKeyStore.java @@ -0,0 +1,107 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.pkey.file; + +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PublicKey; +import java.util.ArrayList; +import java.util.Map; +import java.util.concurrent.ConcurrentHashMap; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.config.AthenzConfig; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zpe.ZpeConsts; +import com.yahoo.athenz.zpe.pkey.PublicKeyStore; +import com.yahoo.rdl.JSON; + +public class FilePublicKeyStore implements PublicKeyStore { + + private static final Logger LOG = LoggerFactory.getLogger(FilePublicKeyStore.class); + + private static final String ZPE_ATHENZ_CONFIG = "/conf/athenz/athenz.conf"; + + private Map ztsPublicKeyMap = new ConcurrentHashMap<>(); + private Map zmsPublicKeyMap = new ConcurrentHashMap<>(); + + public void init() { + + String rootDir = System.getenv("ROOT"); + if (rootDir == null) { + rootDir = "/home/athenz"; + } + + String confFileName = System.getProperty(ZpeConsts.ZPE_PROP_ATHENZ_CONF, + rootDir + ZPE_ATHENZ_CONFIG); + try { + Path path = Paths.get(confFileName); + AthenzConfig conf = JSON.fromBytes(Files.readAllBytes(path), AthenzConfig.class); + + loadPublicKeys(conf.getZtsPublicKeys(), ztsPublicKeyMap); + loadPublicKeys(conf.getZmsPublicKeys(), zmsPublicKeyMap); + + } catch (Exception ex) { + LOG.error("Unable to extract ZMS Url from {} exc: {}", + confFileName, ex.getMessage()); + return; + } + } + + void loadPublicKeys(ArrayList publicKeys, Map keyMap) { + + if (publicKeys == null) { + return; + } + + for (PublicKeyEntry publicKey : publicKeys) { + String id = publicKey.getId(); + String key = publicKey.getKey(); + if (key == null || id == null) { + continue; + } + PublicKey pubKey = null; + try { + pubKey = Crypto.loadPublicKey(Crypto.ybase64DecodeString(key)); + } catch (Exception e) { + LOG.error("Invalid ZTS public key for id: " + id + " - " + e.getMessage()); + continue; + } + keyMap.put(id, pubKey); + } + } + + @Override + public PublicKey getZtsKey(String keyId) { + if (keyId == null) { + return null; + } + return ztsPublicKeyMap.get(keyId); + } + + @Override + public PublicKey getZmsKey(String keyId) { + if (keyId == null) { + return null; + } + return zmsPublicKeyMap.get(keyId); + } + +} diff --git a/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/file/FilePublicKeyStoreFactory.java b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/file/FilePublicKeyStoreFactory.java new file mode 100644 index 00000000000..fb83a25f5f3 --- /dev/null +++ b/clients/java/zpe/src/main/java/com/yahoo/athenz/zpe/pkey/file/FilePublicKeyStoreFactory.java @@ -0,0 +1,29 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe.pkey.file; + +import com.yahoo.athenz.zpe.pkey.PublicKeyStore; +import com.yahoo.athenz.zpe.pkey.PublicKeyStoreFactory; + +public class FilePublicKeyStoreFactory implements PublicKeyStoreFactory { + + @Override + public PublicKeyStore create() { + FilePublicKeyStore keyStore = new FilePublicKeyStore(); + keyStore.init(); + return keyStore; + } +} diff --git a/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/MockMetricFactory.java b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/MockMetricFactory.java new file mode 100644 index 00000000000..2448c644f24 --- /dev/null +++ b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/MockMetricFactory.java @@ -0,0 +1,94 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import java.util.Map; + +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.metrics.MetricFactory; + +import java.util.HashMap; + +public class MockMetricFactory implements MetricFactory { + + @Override + public Metric create() { + return new MockMetric(); + } + + public static class MockMetric implements Metric { + + Map metricMap = new HashMap<>(); + + public void increment(String metric, int count) { + Integer mcnt = metricMap.get(metric); + if (mcnt == null) { + metricMap.put(metric, new Integer(count)); + System.out.println("MockMetric:increment: " + metric + "=1"); + } else { + int cnt = mcnt.intValue() + count; + metricMap.put(metric, new Integer(cnt)); + System.out.println("MockMetric:increment: " + metric + "=" + cnt); + } + } + + @Override + public void increment(String metric) { + increment(metric, 1); + } + + @Override + public void increment(String metric, String domainName) { + increment(metric + domainName, 1); + } + + @Override + public void increment(String metric, String domainName, int count) { + increment(metric + domainName, count); + } + + public int metricCount(String metric) { + Integer icnt = metricMap.get(metric); + if (icnt == null) { + return -1; + } + return icnt.intValue(); + } + public int metricCount(String metric, String domainName) { + return metricCount(metric + domainName); + } + + @Override + public Object startTiming(String metric, String domainName) { + return null; + } + + @Override + public void stopTiming(Object timerMetric) { + } + + @Override + public void flush() { + metricMap.clear(); + } + + @Override + public void quit() { + metricMap.clear(); + } + } +} + diff --git a/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestAuthZpe.java b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestAuthZpe.java new file mode 100644 index 00000000000..f1fde18a277 --- /dev/null +++ b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestAuthZpe.java @@ -0,0 +1,1016 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertNull; +import static org.testng.Assert.assertNotNull; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; + +import org.mockito.Mockito; +import org.testng.Assert; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.token.RoleToken; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zpe.AuthZpeClient; +import com.yahoo.athenz.zpe.ZpeUpdPolLoader; +import com.yahoo.athenz.zpe.AuthZpeClient.AccessCheckStatus; +import com.yahoo.athenz.zts.DomainSignedPolicyData; +import com.yahoo.athenz.zts.SignedPolicyData; +import com.yahoo.rdl.JSON; + +/** + * These tests are dependent on a policy file in a local dir. + */ +public class TestAuthZpe { + + private PrivateKey ztsPrivateKeyK0; + private PrivateKey ztsPrivateKeyK1; + private PrivateKey ztsPrivateKeyK17; + private PrivateKey ztsPrivateKeyK99; + private PrivateKey zmsPrivateKeyK0; + + private final String roleVersion = "Z1"; + private final long expirationTime = 100; // 100 seconds + private final String salt = "aAkjbbDMhnLX"; + + private RoleToken rToken0AnglerPublic = null; + private RoleToken rToken0AnglerExpirePublic = null; + private RoleToken rToken0AnglerAdmin = null; + private RoleToken rToken0SportsAdmin = null; + private RoleToken rToken1SportsAdmin = null; + private RoleToken rToken0AnglerPachinko = null; + private RoleToken rToken0CoreTechPublic = null; + private RoleToken rToken0EmptyPublic = null; + private RoleToken rToken0AnglerRegex = null; + + private static boolean sleepCompleted = false; + + @BeforeClass + public void beforeClass() throws IOException { + + Path path = Paths.get("./src/test/resources/zts_private_k0.pem"); + ztsPrivateKeyK0 = Crypto.loadPrivateKey(new String((Files.readAllBytes(path)))); + + path = Paths.get("./src/test/resources/zms_private_k0.pem"); + zmsPrivateKeyK0 = Crypto.loadPrivateKey(new String((Files.readAllBytes(path)))); + + path = Paths.get("./src/test/resources/zts_private_k1.pem"); + ztsPrivateKeyK1 = Crypto.loadPrivateKey(new String((Files.readAllBytes(path)))); + + path = Paths.get("./src/test/resources/zts_private_k17.pem"); + ztsPrivateKeyK17 = Crypto.loadPrivateKey(new String((Files.readAllBytes(path)))); + + path = Paths.get("./src/test/resources/zts_private_k99.pem"); + ztsPrivateKeyK99 = Crypto.loadPrivateKey(new String((Files.readAllBytes(path)))); + + List roles = new ArrayList(); + roles.add("public"); + rToken0AnglerPublic = createRoleToken("angler", roles, "0"); + rToken0AnglerExpirePublic = createRoleToken("angler", roles, "0", 3); + rToken0CoreTechPublic = createRoleToken("coretech", roles, "0"); + rToken0EmptyPublic = createRoleToken("empty", roles, "0"); + roles = new ArrayList(); + roles.add("admin"); + rToken0AnglerAdmin = createRoleToken("angler", roles, "0"); + rToken0SportsAdmin = createRoleToken("sports", roles, "0"); + rToken1SportsAdmin = createRoleToken("sports", roles, "1"); + + roles = new ArrayList(); + roles.add("pachinko"); + rToken0AnglerPachinko = createRoleToken("angler", roles, "0"); + + roles = new ArrayList(); + roles.add("full_regex"); + roles.add("matchall"); + roles.add("matchstarts"); + roles.add("matchcompare"); + roles.add("matchregex"); + rToken0AnglerRegex = createRoleToken("angler", roles, "0"); + + // NOTE: we will create file with different suffix so as not to confuse + // ZPE update-load thread due to possible timing issue. + // Then rename it with ".pol" suffix afterwards. + // Issue: file is created, but file is empty because it has not + // been written out yet - thus zpe thinks its a bad file and will + // wait for it to get updated before trying to reload. + // Ouch, but the file doesnt get a change in modified timestamp so zpe + // never reloads. + + path = Paths.get("./src/test/resources/angler.pol"); + DomainSignedPolicyData domainSignedPolicyData = JSON.fromBytes(Files.readAllBytes(path), + DomainSignedPolicyData.class); + SignedPolicyData signedPolicyData = domainSignedPolicyData.getSignedPolicyData(); + String signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData.getPolicyData()), zmsPrivateKeyK0); + signedPolicyData.setZmsSignature(signature).setZmsKeyId("0"); + signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData), ztsPrivateKeyK0); + domainSignedPolicyData.setSignature(signature).setKeyId("0"); + File file = new File("./src/test/resources/pol_dir/angler.gen"); + file.createNewFile(); + Files.write(file.toPath(), JSON.bytes(domainSignedPolicyData)); + File renamedFile = new File("./src/test/resources/pol_dir/angler.pol"); + file.renameTo(renamedFile); + + path = Paths.get("./src/test/resources/sports.pol"); + domainSignedPolicyData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + signedPolicyData = domainSignedPolicyData.getSignedPolicyData(); + signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData.getPolicyData()), zmsPrivateKeyK0); + signedPolicyData.setZmsSignature(signature).setZmsKeyId("0"); + signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData), ztsPrivateKeyK1); + domainSignedPolicyData.setSignature(signature).setKeyId("1"); + file = new File("./src/test/resources/pol_dir/sports.gen"); + file.createNewFile(); + Files.write(file.toPath(), JSON.bytes(domainSignedPolicyData)); + renamedFile = new File("./src/test/resources/pol_dir/sports.pol"); + file.renameTo(renamedFile); + + path = Paths.get("./src/test/resources/empty.pol"); + domainSignedPolicyData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + signedPolicyData = domainSignedPolicyData.getSignedPolicyData(); + signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData.getPolicyData()), zmsPrivateKeyK0); + signedPolicyData.setZmsSignature(signature).setZmsKeyId("0"); + signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData), ztsPrivateKeyK0); + domainSignedPolicyData.setSignature(signature).setKeyId("0"); + file = new File("./src/test/resources/pol_dir/empty.gen"); + file.createNewFile(); + Files.write(file.toPath(), JSON.bytes(domainSignedPolicyData)); + + renamedFile = new File("./src/test/resources/pol_dir/empty.pol"); + file.renameTo(renamedFile); + } + + @BeforeMethod + private void loadFiles() { + + if (sleepCompleted) { + return; + } + // sleep for a short period of time so the library has a chance + // to load all the policy files since that's done by a background + // thread + + AuthZpeClient.init(); + try { + Thread.sleep(5000); + } catch (InterruptedException e) { + } + + sleepCompleted = true; + } + + private RoleToken createRoleToken(String svcDomain, List roles, String keyId, long expiry) { + RoleToken token = new RoleToken.Builder(roleVersion, svcDomain, roles) + .salt(salt).expirationWindow(expiry).keyId(keyId).build(); + + PrivateKey key = null; + if ("1".equals(keyId)) { + key = ztsPrivateKeyK1; + } else if ("0".equals(keyId)) { + key = ztsPrivateKeyK0; + } else if ("17".equals(keyId)) { + key = ztsPrivateKeyK17; + } else if ("99".equals(keyId)) { + key = ztsPrivateKeyK99; + } + + token.sign(key); + return token; + } + + private RoleToken createRoleToken(String svcDomain, List roles, String keyId) { + return createRoleToken(svcDomain, roles, keyId, expirationTime); + } + + @Test + public void testKeyIds() { + String action = "read"; + StringBuilder roleName = new StringBuilder(); + + //Test key id 0 on Angler domain + String angResource = "angler:stuff"; + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW, "rsrc=" + angResource + " act=" + action); + Assert.assertEquals(roleName.toString(), "public"); + + //Test key id 1 on Sports domain + roleName.setLength(0); + String resource = "sports.NFL_DB"; + status = AuthZpeClient.allowAccess(rToken1SportsAdmin, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW, "rsrc=" + resource + " act=" + action); + Assert.assertEquals(roleName.toString(), "admin"); + } + + @Test + public void testWrongKeyId() { + String action = "REad"; + StringBuilder roleName = new StringBuilder(); + + //Test key id 0 on Sports domain - should fail because its signed with key id 1 + String resource = "sports.NFL_DB"; + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0SportsAdmin, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "admin"); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0SportsAdmin.getSignedToken()); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "admin"); + + // multi tokens test with duplicate tokens + tokenList = new ArrayList(); + tokenList.add(rToken0SportsAdmin.getSignedToken()); + tokenList.add(rToken0SportsAdmin.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "admin"); + } + + @Test + public void testPublicReadAllowedMixCaseActionResource() { + + String action = "REad"; + String angResource = "ANGler:stuff"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + status = AuthZpeClient.allowAccess(rToken0AnglerPublic.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + } + + @Test + public void testTokenExpired() { + String action = "REad"; + String angResource = "ANGler:stuff"; + StringBuilder roleName = new StringBuilder(); + + RoleToken tokenMock = Mockito.mock(RoleToken.class); + Mockito.when(tokenMock.getExpiryTime()).thenReturn(1L); // too old + + AccessCheckStatus status = AuthZpeClient.allowAccess(tokenMock, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_ROLETOKEN_EXPIRED); + } + + @Test + public void testPublicReadAllowed() { + String action = "read"; + String angResource = "angler:stuff"; + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + } + + @Test + public void testPublicReadMismatchDomain() { + String action = "read"; + String angResource = "anglerTest:stuff"; + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.DENY_DOMAIN_MISMATCH); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); + StringBuilder roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_DOMAIN_MISMATCH); + Assert.assertEquals(roleName.toString(), ""); + } + + @Test + public void testPublicReadDomainNotFound() { + String action = "read"; + String angResource = "CoreTech:stuff"; + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0CoreTechPublic.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.DENY_DOMAIN_NOT_FOUND); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); + StringBuilder roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_DOMAIN_NOT_FOUND); + Assert.assertEquals(roleName.toString(), ""); + } + + @Test + public void testPublicReadDomainEmpty() { + String action = "read"; + String angResource = "empty:stuff"; + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0EmptyPublic.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.DENY_DOMAIN_EMPTY); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0EmptyPublic.getSignedToken()); + StringBuilder roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_DOMAIN_EMPTY); + Assert.assertEquals(roleName.toString(), ""); + } + + @Test + public void testPublicReadInvalidRoleToken() { + String action = "read"; + String angResource = "angler:stuff"; + + // make the token invalid by adding chars to the signature + String roleToken = rToken0AnglerPublic.getSignedToken(); + roleToken = roleToken.replace(";s=", ";s=ab"); + AccessCheckStatus status = AuthZpeClient.allowAccess(roleToken, angResource, action); + Assert.assertEquals(status, AccessCheckStatus.DENY_ROLETOKEN_INVALID); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(roleToken); // add the bad one in + StringBuilder roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "public"); + } + + @Test + public void testPublicReadExpiredRoleToken() { + String action = "read"; + String angResource = "angler:stuff"; + + // sleep 3 seconds so our token gets expired + + try { + Thread.sleep(3000); + } catch (Exception exc) { + } + + // the roletoken validate return false regardless if the token is + // invalid due to expiry or invalid signature. So we'll only + // the expired roletoken if we add it to the cache and then + // try to use it again, but the cache clear test case sets + // the timeout to 1secs so as soon as it's added, within a + // second it's removed so we can't wait until it's expired to + // test again. so for know we'll just get invalid token + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerExpirePublic.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.DENY_ROLETOKEN_INVALID); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0AnglerExpirePublic.getSignedToken()); // add the expired one in + StringBuilder roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "public"); + } + + @Test + public void testPublicReadInvalidParameters() { + String action = "read"; + String angResource = "anglerTest:stuff"; + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic.getSignedToken(), "", action); + Assert.assertEquals(status, AccessCheckStatus.DENY_INVALID_PARAMETERS); + + status = AuthZpeClient.allowAccess(rToken0AnglerPublic.getSignedToken(), angResource, ""); + Assert.assertEquals(status, AccessCheckStatus.DENY_INVALID_PARAMETERS); + } + + @Test + public void testPublicWriteAllowed() { + String action = "write"; + String angResource = "angler:stuff"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "public"); + } + + @Test + public void testPublicWriteAllowedMixCaseActionResource() { + String action = "WRite"; + String angResource = "angLEr:STUff"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + } + + @Test + public void testPublicUknActDenied() { + String action = "WRiteREad"; + String angResource = "angler:stuff"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testPublicThrowDenied() { + String action = "THrow"; + String angResource = "angler:stuff"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY); + } + + @Test + public void testAdminThrowAllowed() { + String action = "THrow"; + String angResource = "angler:stuff"; + StringBuilder roleName = new StringBuilder(); + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerAdmin, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + } + + @Test + public void testValidAccessResource() { + String action = "ACCESS"; + String angResource = "angler:tables.blah"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPachinko, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "pachinko"); + } + + @Test + public void testInvalidAccessResource() { + String action = "ACCESS"; + String angResource = "angler:tables.blahblah"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPachinko, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + Assert.assertEquals(roleName.toString(), ""); + } + + @Test + public void testPublicFishingDenied() { + String action = "fish"; + String angResource = "angler:spawningpondLittleBassLake"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY); + Assert.assertEquals(roleName.toString(), "public"); + } + + @Test + public void testPublicFishingAllowed() { + String action = "fish"; + String angResource = "angler:stockedpondBigBassLake"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "public"); + } + + @Test + public void testPublicFishingAllowedTokenString() { + String action = "fish"; + String angResource = "angler:stockedpondBigBassLake"; + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerPublic.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + } + + @Test + public void testCleanupOfToken() { + // perform an allowed access check + String action = "fish"; + String angResource = "angler:stockedpondBigBassLake"; + List roles = new ArrayList(); + roles.add("public"); + roles.add("admin"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1); // 1 sec expiry + String signedToken = rtoken.getSignedToken(); + AccessCheckStatus status = AuthZpeClient.allowAccess(signedToken, angResource, action); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + + Map roleMap = ZpeUpdPolLoader.getRoleTokenCacheMap(); + RoleToken mapToken = roleMap.get(signedToken); + Assert.assertEquals(signedToken.equals(mapToken.getSignedToken()), true); + // then in a loop, check for existence of the token in the token map + // increase the timeout to 30 secs. in sd sometimes it takes a while + // before the entry is expired. + for (int cnt = 0; mapToken != null && cnt < 30; ++cnt) { + System.out.println("testCleanupOfToken: in loop, cnt=" + cnt + " token=" + signedToken); + // -Dyahoo.zpeclient.updater.monitor_timeout_secs=1 + // -Dyahoo.zpeclient.updater.cleanup_tokens_secs=1 + try { + Thread.sleep(1000); // test has timeout set to 1 second + } catch (Exception exc) { + System.out.println("testCleanupOfToken: sleep was interrupted: in loop, cnt=" + cnt + " token=" + signedToken); + } + + mapToken = roleMap.get(signedToken); + if (mapToken != null) { + Assert.assertEquals(signedToken.equals(mapToken.getSignedToken()), true); + } + } + // assert token is not in the map outside of the loop + Assert.assertNull(mapToken); + } + + @Test + public void testCleanupOfTokenNotCleaned() { + // perform an allowed access check + String action = "fish"; + String angResource = "angler:stockedpondBigBassLake"; + List roles = new ArrayList(); + roles.add("public"); + roles.add("admin"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 10); // 10 sec expiry + String signedToken = rtoken.getSignedToken(); + AccessCheckStatus status = AuthZpeClient.allowAccess(signedToken, angResource, action); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + + Map roleMap = ZpeUpdPolLoader.getRoleTokenCacheMap(); + RoleToken mapToken = roleMap.get(signedToken); + Assert.assertEquals(signedToken.equals(mapToken.getSignedToken()), true); + // then in a loop, check for existence of the token in the token map + for (int cnt = 0; mapToken != null && cnt < 5; ++cnt) { + System.out.println("testCleanupOfToken: in loop, cnt=" + cnt + " token=" + signedToken); + // -Dyahoo.zpeclient.updater.monitor_timeout_secs=1 + // -Dyahoo.zpeclient.updater.cleanup_tokens_secs=1 + try { + Thread.sleep(1000); // test has timeout set to 1 second + } catch (Exception exc) { + System.out.println("testCleanupOfToken: sleep was interrupted: in loop, cnt=" + cnt + " token=" + signedToken); + } + + mapToken = roleMap.get(signedToken); + Assert.assertNotNull(mapToken); + Assert.assertEquals(signedToken.equals(mapToken.getSignedToken()), true); + } + // assert token is not in the map outside of the loop + Assert.assertNotNull(mapToken); + Assert.assertEquals(signedToken.equals(mapToken.getSignedToken()), true); + } + + @Test + public void testWildcardManagePondsKernDenied() { + String action = "manage"; + String angResource = "angler:pondsVenturaCounty"; + List roles = new ArrayList(); + roles.add("managerkernco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + StringBuilder roleName = new StringBuilder(256); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken, angResource, action, roleName); + // Kern county manager not allowed to manage Ventura county ponds + Assert.assertEquals(status, AccessCheckStatus.DENY); + } + + @Test + public void testWildcardManagePondsKernAllowed() { + String action = "manage"; + String angResource = "angler:pondsKernCounty"; + List roles = new ArrayList(); + roles.add("managerkernco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + StringBuilder roleName = new StringBuilder(256); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken, angResource, action, roleName); + // Ventura county manager is allowed to manage Kern county ponds + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "manager*"); + } + + @Test + public void testWildcardManageRiversKernAllowed() { + String action = "manage"; + String angResource = "angler:RiversKernCounty"; + List roles = new ArrayList(); + roles.add("managerkernco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + StringBuilder roleName = new StringBuilder(256); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken, angResource, action, roleName); + // Ventura county manager is allowed to manage Kern county ponds + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "manager*"); + } + + @Test + public void testWildcardManagePondsVenturaAllowed() { + String action = "manage"; + String angResource = "angler:pondsKernCounty"; + List roles = new ArrayList(); + roles.add("managerventuraco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + StringBuilder roleName = new StringBuilder(256); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken, angResource, action, roleName); + // Ventura county manager is allowed to manage Kern county ponds + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "manager*"); + } + + @Test + public void testWildcardManageRiversVenturaAllowed() { + String action = "manage"; + String angResource = "angler:RiversVenturaCounty"; + List roles = new ArrayList(); + roles.add("managerventuraco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + StringBuilder roleName = new StringBuilder(256); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken, angResource, action, roleName); + // Ventura county manager is allowed to manage Kern county ponds + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + } + + @Test + public void testWildcardManageRiversVenturaDenied() { + String action = "manage"; + String angResource = "angler:RiversKernCounty"; + List roles = new ArrayList(); + roles.add("managerventuraco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + StringBuilder roleName = new StringBuilder(256); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken, angResource, action, roleName); + // Ventura county manager is allowed to manage Kern county ponds + Assert.assertEquals(status, AccessCheckStatus.DENY); + Assert.assertEquals(roleName.toString(), "managerventura*"); + } + + @Test + public void testWildcardManagePondsAllowedTokenString() { + String action = "manage"; + String angResource = "angler:pondsKernCounty"; + List roles = new ArrayList(); + roles.add("managerkernco"); + roles.add("managerventuraco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + } + + @Test + public void testWildcardManageRiversDeniedTokenString() { + String action = "manage"; + String angResource = "angler:riversKernCounty"; + List roles = new ArrayList(); + roles.add("managerkernco"); + roles.add("managerventuraco"); + RoleToken rtoken = createRoleToken("angler", roles, "0", 1000); // 1000 sec expiry + + AccessCheckStatus status = AuthZpeClient.allowAccess(rtoken.getSignedToken(), angResource, action); + Assert.assertEquals(status, AccessCheckStatus.DENY); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerAdmin.getSignedToken()); // add an ALLOW role + tokenList.add(rtoken.getSignedToken()); // add the DENY role token in + StringBuilder roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY); // DENY over-rides ALLOW + Assert.assertEquals(roleName.toString(), "managerventura*"); + + tokenList = new ArrayList(); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); // add a DENY_DOMAIN_MISMATCH + tokenList.add(rToken0AnglerAdmin.getSignedToken()); // add an ALLOW role + tokenList.add(rtoken.getSignedToken()); // add the DENY role token in + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY); // DENY over-rides everything else + Assert.assertEquals(roleName.toString(), "managerventura*"); + + // order wont matter + tokenList = new ArrayList(); + tokenList.add(rtoken.getSignedToken()); // add the DENY role token in + tokenList.add(rToken0CoreTechPublic.getSignedToken()); // add a DENY_DOMAIN_MISMATCH + tokenList.add(rToken0AnglerAdmin.getSignedToken()); // add an ALLOW role + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, angResource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY); // DENY over-rides everything else + Assert.assertEquals(roleName.toString(), "managerventura*"); + } + + @Test + public void testAllowAccessMatchAll() { + + String action = "all"; + String resource = "angler:stuff"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchall"); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0AnglerRegex.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchall"); + } + + @Test + public void testAllowAccessMatchStartsWithAllowed() { + + String action = "startswith"; + String resource = "angler:startswithgreat"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchstarts"); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerExpirePublic.getSignedToken()); + tokenList.add(rToken0AnglerRegex.getSignedToken()); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchstarts"); + } + + @Test + public void testAllowAccessMatchEqualAllowed() { + + String action = "compare"; + String resource = "angler:compare"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchcompare"); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerExpirePublic.getSignedToken()); + tokenList.add(rToken0AnglerRegex.getSignedToken()); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchcompare"); + } + + @Test + public void testAllowAccessMatchRegexAllowed() { + + String action = "regex"; + String resource = "angler:nhllosangeleskings"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchregex"); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerExpirePublic.getSignedToken()); + tokenList.add(rToken0AnglerRegex.getSignedToken()); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.ALLOW); + Assert.assertEquals(roleName.toString(), "matchregex"); + } + + @Test + public void testAllowAccessMatchStartsWithDenied() { + + String action = "startswith"; + String resource = "angler:startswitgreat"; /* missing h from startswith */ + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + Assert.assertEquals(roleName.toString(), ""); + + // multi tokens test + List tokenList = new ArrayList(); + tokenList.add(rToken0AnglerExpirePublic.getSignedToken()); + tokenList.add(rToken0AnglerRegex.getSignedToken()); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + // last token was for domain coretech + Assert.assertEquals(status, AccessCheckStatus.DENY_DOMAIN_MISMATCH); + Assert.assertEquals(roleName.toString(), ""); + + tokenList = new ArrayList(); + tokenList.add(rToken0AnglerExpirePublic.getSignedToken()); + tokenList.add(rToken0AnglerPublic.getSignedToken()); + tokenList.add(rToken0CoreTechPublic.getSignedToken()); + tokenList.add(rToken0AnglerRegex.getSignedToken()); + roleName = new StringBuilder(); + status = AuthZpeClient.allowAccess(tokenList, resource, action, roleName); + // last token was for domain angler with regex token + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + Assert.assertEquals(roleName.toString(), ""); + + } + + @Test + public void testAllowAccessMatchEqualDenied() { + + String action = "compare"; + String resource = "angler:compares"; /* extra s after compare */ + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testAllowAccessMatchRegexDenied() { + + String action = "regex"; + String resource = "angler:nhllosangeleskingsA"; /* extra A after kings */ + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testAllowAccessMatchRegexInvalidOr1() { + + String action = "full_regex"; + String resource = "angler:coretech"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testAllowAccessMatchRegexInvalidOr2() { + + String action = "full_regex"; + String resource = "angler:corecommit"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testAllowAccessMatchRegexInvalidRange1() { + + String action = "full_regex"; + String resource = "angler:corea"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testAllowAccessMatchRegexInvalidRange2() { + + String action = "full_regex"; + String resource = "angler:coreb"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testAllowAccessMatchRegexInvalidRange3() { + + String action = "full_regex"; + String resource = "angler:coref"; + StringBuilder roleName = new StringBuilder(); + + AccessCheckStatus status = AuthZpeClient.allowAccess(rToken0AnglerRegex, resource, action, roleName); + Assert.assertEquals(status, AccessCheckStatus.DENY_NO_MATCH); + } + + @Test + public void testPatternFromGlob() { + assertEquals("^abc$", AuthZpeClient.patternFromGlob("abc")); + assertEquals("^abc.*$", AuthZpeClient.patternFromGlob("abc*")); + assertEquals("^abc.$", AuthZpeClient.patternFromGlob("abc?")); + assertEquals("^.*abc.$", AuthZpeClient.patternFromGlob("*abc?")); + assertEquals("^abc\\.abc:.*$", AuthZpeClient.patternFromGlob("abc.abc:*")); + assertEquals("^ab\\[a-c]c$", AuthZpeClient.patternFromGlob("ab[a-c]c")); + assertEquals("^ab.*\\.\\(\\)\\^\\$c$", AuthZpeClient.patternFromGlob("ab*.()^$c")); + assertEquals("^abc\\\\test\\\\$", AuthZpeClient.patternFromGlob("abc\\test\\")); + assertEquals("^ab\\{\\|c\\+$", AuthZpeClient.patternFromGlob("ab{|c+")); + assertEquals("^\\^\\$\\[\\(\\)\\\\\\+\\{\\..*.\\|$", AuthZpeClient.patternFromGlob("^$[()\\+{.*?|")); + } + + @Test + public void testValidateRoleToken() { + + List roles = new ArrayList(); + roles.add("public_role"); + RoleToken rToken = createRoleToken("coretech", roles, "0"); + + RoleToken validatedToken = AuthZpeClient.validateRoleToken(rToken.getSignedToken()); + assertNotNull(validatedToken); + assertEquals(validatedToken.getRoles().size(), 1); + assertEquals(validatedToken.getRoles().get(0), "public_role"); + assertEquals(validatedToken.getDomain(), "coretech"); + + // asking for the same token should return the data from our cache + + validatedToken = AuthZpeClient.validateRoleToken(rToken.getSignedToken()); + assertNotNull(validatedToken); + assertEquals(validatedToken.getRoles().size(), 1); + assertEquals(validatedToken.getRoles().get(0), "public_role"); + assertEquals(validatedToken.getDomain(), "coretech"); + } + + @Test + public void testValidateRoleTokenInvalidKeyVersion() { + + List roles = new ArrayList(); + roles.add("public_role"); + RoleToken rToken = createRoleToken("coretech", roles, "0"); + + String tamperedToken = rToken.getSignedToken().replace(";k=0;", ";k=zone1.invalid"); + RoleToken validatedToken = AuthZpeClient.validateRoleToken(tamperedToken); + assertNull(validatedToken); + } + + @Test + public void testValidateRoleTokenInvalidSignature() { + + List roles = new ArrayList(); + roles.add("public_role"); + RoleToken rToken = createRoleToken("coretech", roles, "0"); + + String tamperedToken = rToken.getSignedToken().replace(";s=", ";s=siginvalid"); + RoleToken validatedToken = AuthZpeClient.validateRoleToken(tamperedToken); + assertNull(validatedToken); + } + + @Test + public void testAccessCheckStatus() { + for (AccessCheckStatus stat : AccessCheckStatus.values()) { + assertNotNull(stat.toString()); + System.out.println("Debug for AccessCheckStatus()"); + System.out.println(stat.toString()); + } + } + + @Test + public void testInit() { + AuthZpeClient.init(); + } + + @Test + public void testgetZtsPublicKeyNull() throws Exception { + PublicKey key = AuthZpeClient.getZtsPublicKey("notexist"); + assertNull(key); + } +} + diff --git a/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeMatch.java b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeMatch.java new file mode 100644 index 00000000000..21413888a42 --- /dev/null +++ b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeMatch.java @@ -0,0 +1,101 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.zpe.ZpeUpdPolLoader; +import com.yahoo.athenz.zpe.match.ZpeMatch; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchAll; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchEqual; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchRegex; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchStartsWith; + +import static org.testng.Assert.assertTrue; +import static org.testng.Assert.assertFalse; + +public class TestZpeMatch { + + @Test + public void testGetMatchAll() { + + try (ZpeUpdPolLoader loader = new ZpeUpdPolLoader(null)) { + + ZpeMatch matchObject = loader.getMatchObject("*"); + assertTrue(matchObject instanceof ZpeMatchAll); + + assertTrue(matchObject.matches("abc")); + assertTrue(matchObject.matches("false")); + assertTrue(matchObject.matches("whatever")); + } + } + + @Test + public void testGetMatchRegex() { + + try (ZpeUpdPolLoader loader = new ZpeUpdPolLoader(null)) { + + ZpeMatch matchObject = loader.getMatchObject("coretech?test*"); + assertTrue(matchObject instanceof ZpeMatchRegex); + + assertTrue(matchObject.matches("coretechAtest")); + assertTrue(matchObject.matches("coretechbtestgreat")); + + // failures + + assertFalse(matchObject.matches("whatever")); // random data + assertFalse(matchObject.matches("coretechtestgreat")); // missing ? + } + } + + @Test + public void testGetMatchEqual() { + + try (ZpeUpdPolLoader loader = new ZpeUpdPolLoader(null)) { + + ZpeMatch matchObject = loader.getMatchObject("coretech"); + assertTrue(matchObject instanceof ZpeMatchEqual); + + assertTrue(matchObject.matches("coretech")); + + // failures + + assertFalse(matchObject.matches("whatever")); // random data + assertFalse(matchObject.matches("coretechA")); // extra A + assertFalse(matchObject.matches("coretec")); // missing h + } + } + + @Test + public void testGetMatchStartsWith() { + + try (ZpeUpdPolLoader loader = new ZpeUpdPolLoader(null)) { + + ZpeMatch matchObject = loader.getMatchObject("coretech*"); + assertTrue(matchObject instanceof ZpeMatchStartsWith); + + assertTrue(matchObject.matches("coretech")); + assertTrue(matchObject.matches("coretechtest")); + assertTrue(matchObject.matches("coretechtesttest")); + + // failures + + assertFalse(matchObject.matches("whatever")); // random data + assertFalse(matchObject.matches("coretec")); // missing h + assertFalse(matchObject.matches("coretecA")); // missing h + extra A + } + } +} diff --git a/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeMetric.java b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeMetric.java new file mode 100644 index 00000000000..a1f861886eb --- /dev/null +++ b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeMetric.java @@ -0,0 +1,133 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import java.io.IOException; +import junit.framework.TestCase; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.List; +import java.io.File; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zpe.AuthZpeClient; +import com.yahoo.athenz.zpe.ZpeConsts; +import com.yahoo.athenz.zpe.ZpeMetric; +import com.yahoo.athenz.zts.DomainMetric; +import com.yahoo.athenz.zts.DomainMetrics; +import com.yahoo.rdl.JSON; + +public class TestZpeMetric extends TestCase { + + @Test + public void testZpeMetric() throws IOException { + + // setting the system property to write in file every 5 secs + System.setProperty(ZpeConsts.ZPE_PROP_METRIC_WRITE_INTERVAL, "5000"); + + final String metricDirPath = "/tmp/zpe-metrics"; + File metricsDir = new File(metricDirPath); + metricsDir.mkdirs(); + System.setProperty(ZpeConsts.ZPE_PROP_METRIC_FILE_PATH, metricDirPath); + + final String TEST_DOMAIN = "test"; + ZpeMetric.statsEnabled = true; + ZpeMetric test = new ZpeMetric(); + + // cleaning the directory + File dir = new File(test.getFilePath()); + System.out.println(test.getFilePath()); + if (dir.exists()) { + for (File file: dir.listFiles()) { + if (!file.isDirectory()) { + file.delete(); + } + } + } else { + dir.mkdirs(); + } + + // incrementing metrics for testing + Integer index = com.yahoo.athenz.zts.DomainMetricType.valueOf(ZpeConsts.ZPE_METRIC_NAME).ordinal(); + System.out.println("Metric is now " + test.counter.get(index)); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + System.out.println("Metric is now " + test.counter.get(index)); + + System.out.println("testZpeMetric Sleep Millisecs= 4000"); + try { + Thread.sleep(4000); + } catch (InterruptedException e) { + } + System.out.println("testZpeMetric: Nap over"); + + System.out.println("Metric is now " + test.counter.get(index)); + test.increment(ZpeConsts.ZPE_METRIC_NAME, TEST_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, TEST_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + test.increment(ZpeConsts.ZPE_METRIC_NAME, AuthZpeClient.DEFAULT_DOMAIN); + System.out.println("Metric is now " + test.counter.get(index)); + + System.out.println("testZpeMetric Sleep Millisecs= 2000"); + try { + Thread.sleep(2000); + } catch (InterruptedException e) { + } + System.out.println("testZpeMetric: Nap over"); + + // Reading from the json file generated + File[] filenames = dir.listFiles(); + + String filepath = test.getFilePath() + filenames[0].getName(); + Path path = Paths.get(filepath); + DomainMetrics domainMetrics = JSON.fromBytes(Files.readAllBytes(path), DomainMetrics.class); + // verifying the value of the metric + List metricList = domainMetrics.getMetricList(); + boolean metricVerified = false; + for (DomainMetric metric : metricList) { + if (metric.getMetricType().toString().equals(ZpeConsts.ZPE_METRIC_NAME)) { + assertEquals(10, metric.getMetricVal()); + metricVerified = true; + } + } + assertTrue(metricVerified); + + filepath = test.getFilePath() + filenames[1].getName(); + path = Paths.get(filepath); + domainMetrics = JSON.fromBytes(Files.readAllBytes(path), DomainMetrics.class); + // verifying the value of the metric + metricList = domainMetrics.getMetricList(); + metricVerified = false; + for (DomainMetric metric : metricList) { + if (metric.getMetricType().toString().equals(ZpeConsts.ZPE_METRIC_NAME)) { + assertEquals(2, metric.getMetricVal()); + metricVerified = true; + } + } + assertTrue(metricVerified); + + // unsetting the system property + System.clearProperty(ZpeConsts.ZPE_PROP_METRIC_WRITE_INTERVAL); + } + +} \ No newline at end of file diff --git a/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeUpdPolLoader.java b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeUpdPolLoader.java new file mode 100644 index 00000000000..5da685cc777 --- /dev/null +++ b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeUpdPolLoader.java @@ -0,0 +1,165 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zpe.match.ZpeMatch; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchAll; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchEqual; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchRegex; +import com.yahoo.athenz.zpe.match.impl.ZpeMatchStartsWith; + +import static org.testng.Assert.assertTrue; + +import java.io.File; + +public class TestZpeUpdPolLoader { + + static String TEST_POL_DIR = "./src/test/resources/upd_pol_dir/"; + static String TEST_POL_FILE = "angler.pol"; + static String TEST_POL_GOOD_FILE = "./src/test/resources/pol_dir/angler.pol"; + + static String TEST_POL_FILE_EMPTY = "empty.pol"; + static String TEST_POL_GOOD_FILE_EMPTY = "./src/test/resources/pol_dir/empty.pol"; + + @Test + public void testGetMatchObject() { + + try (ZpeUpdPolLoader loader = new ZpeUpdPolLoader(null)) { + + ZpeMatch matchObject = loader.getMatchObject("*"); + assertTrue(matchObject instanceof ZpeMatchAll); + + matchObject = loader.getMatchObject("**"); + assertTrue(matchObject instanceof ZpeMatchRegex); + + matchObject = loader.getMatchObject("?*"); + assertTrue(matchObject instanceof ZpeMatchRegex); + + matchObject = loader.getMatchObject("?"); + assertTrue(matchObject instanceof ZpeMatchRegex); + + matchObject = loader.getMatchObject("test?again*"); + assertTrue(matchObject instanceof ZpeMatchRegex); + + matchObject = loader.getMatchObject("*test"); + assertTrue(matchObject instanceof ZpeMatchRegex); + + matchObject = loader.getMatchObject("test"); + assertTrue(matchObject instanceof ZpeMatchEqual); + + matchObject = loader.getMatchObject("(test|again)"); + assertTrue(matchObject instanceof ZpeMatchEqual); + + matchObject = loader.getMatchObject("test*"); + assertTrue(matchObject instanceof ZpeMatchStartsWith); + } + } + + @Test + public void testLoadDb() throws Exception { + + System.out.println("TestZpeUpdPolLoader: testLoadDb: dir=" + TEST_POL_DIR); + + java.nio.file.Path dirPath = java.nio.file.Paths.get(TEST_POL_DIR); + try { + java.nio.file.Files.createDirectory(dirPath); + } catch (java.nio.file.FileAlreadyExistsException exc) { + } + + ZpeUpdPolLoader loader = new ZpeUpdPolLoader(TEST_POL_DIR); + + java.nio.file.Path badFile = java.nio.file.Paths.get(TEST_POL_DIR, TEST_POL_FILE); + java.nio.file.Files.deleteIfExists(badFile); + java.io.File polFile = new java.io.File(TEST_POL_DIR, TEST_POL_FILE); + polFile.createNewFile(); + java.io.File [] files = { polFile }; + loader.loadDb(files); + + long lastModMilliSeconds = polFile.lastModified(); + java.util.Map fsmap = loader.getFileStatusMap(); + ZpeUpdPolLoader.ZpeFileStatus fstat = fsmap.get(polFile.getName()); + assertTrue(fstat.validPolFile == false); + + // move good policy file over the bad one + java.nio.file.Path goodFile = java.nio.file.Paths.get(TEST_POL_GOOD_FILE); + java.nio.file.Files.copy(goodFile, badFile, java.nio.file.StandardCopyOption.REPLACE_EXISTING); + + loader.loadDb(files); + long lastModMilliSeconds2 = polFile.lastModified(); + fsmap = loader.getFileStatusMap(); + fstat = fsmap.get(polFile.getName()); + assertTrue(fstat.validPolFile == true); + loader.close(); + System.out.println("TestZpeUpdPolLoader: testLoadDb: timestamp1=" + lastModMilliSeconds + " timestamp2=" + lastModMilliSeconds2); + } + + @Test + public void testLoadDBNull() { + ZpeUpdPolLoader loader = new ZpeUpdPolLoader(TEST_POL_DIR); + loader.loadDb(null); + + loader.close(); + } + + @Test + public void testLoadDBNotExist() throws Exception { + ZpeUpdPolLoader loader = new ZpeUpdPolLoader(TEST_POL_DIR); + File fileMock = Mockito.mock(File.class); + java.io.File [] files = { fileMock }; + + // delete file + Mockito.when(fileMock.exists()).thenReturn(false); + + try { + loader.loadDb(files); + } catch(Exception ex) { + loader.close(); + } + + loader.close(); + } + + @Test(expectedExceptions = {java.lang.Exception.class}) + public void testStartNullDir() throws Exception { + ZpeUpdPolLoader loader = new ZpeUpdPolLoader(null); + loader.start(); + loader.close(); + } + + @Test + public void testLoadFileStatusNull() { + ZpeUpdPolLoader loader = new ZpeUpdPolLoader("./noexist"); + ZpeUpdMonitor monitor = new ZpeUpdMonitor(loader); + File[] files = monitor.loadFileStatus(); + assertTrue(files == null); + loader.close(); + } + + @Test + public void testUpdLoaderInvalid() { + ZpeUpdPolLoader loaderMock = Mockito.mock(ZpeUpdPolLoader.class); + Mockito.when(loaderMock.getDirName()).thenReturn(null); + ZpeUpdMonitor monitor = new ZpeUpdMonitor(loaderMock); + + // TODO: validate log message + monitor.run(); + monitor.cancel(); + monitor.run(); + } +} diff --git a/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeYcrKey.java b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeYcrKey.java new file mode 100644 index 00000000000..ba570d43300 --- /dev/null +++ b/clients/java/zpe/src/test/java/com/yahoo/athenz/zpe/TestZpeYcrKey.java @@ -0,0 +1,35 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe; + +import static org.testng.Assert.assertEquals; + +import org.testng.annotations.Test; + +public class TestZpeYcrKey { + + @Test + public void testGetSetYcrKey() { + + ZpeYcrKey ycrkey = new ZpeYcrKey(); + + ycrkey.setKeyName("key1"); + ycrkey.setVersion((short) 0); + + assertEquals(ycrkey.getKeyName(), "key1"); + assertEquals(ycrkey.getVersion(), (short) 0); + } +} diff --git a/clients/java/zpe/src/test/resources/angler.pol b/clients/java/zpe/src/test/resources/angler.pol new file mode 100644 index 00000000000..414453c316e --- /dev/null +++ b/clients/java/zpe/src/test/resources/angler.pol @@ -0,0 +1,162 @@ +{ + "signedPolicyData": { + "expires": "2014-05-31T00:35:44.535Z", + "modified": "2014-05-24T00:34:45.922Z", + "policyData": { + "domain": "angler", + "policies": [ + { + "assertions": [ + { + "action": "*", + "role": "angler:role.admin", + "resource": "angler:*" + } + ], + "modified": "2014-05-24T00:34:45.922Z", + "name": "angler:policy.admin" + }, + { + "assertions": [ + { + "action": "read", + "role": "angler:role.public", + "resource": "angler:stuff" + }, + { + "effect": "ALLOW", + "action": "write", + "role": "angler:role.public", + "resource": "angler:stuff" + }, + { + "effect": "DENY", + "action": "throw", + "role": "angler:role.public", + "resource": "angler:stuff" + }, + { + "effect": "DENY", + "action": "fish", + "role": "angler:role.public", + "resource": "angler:spawningpond*" + }, + { + "effect": "ALLOW", + "action": "fish", + "role": "angler:role.public", + "resource": "angler:stockedpond*" + }, + { + "role": "angler:role.pachinko", + "action": "access", + "effect": "ALLOW", + "resource": "angler:tables.blah" + } + ], + "modified": "2014-05-24T00:35:11.387Z", + "name": "angler:policy.public" + }, + { + "assertions": [ + { + "action": "direct", + "role": "angler:role.director", + "resource": "angler:ponds*" + }, + { + "action": "oversee", + "role": "angler:role.foreman", + "resource": "angler:ponds*" + }, + { + "action": "manage", + "role": "angler:role.manager*", + "resource": "angler:ponds*" + }, + { + "effect": "DENY", + "action": "manage", + "role": "angler:role.managerkern*", + "resource": "angler:pondsventura*" + }, + { + "action": "direct", + "role": "angler:role.director", + "resource": "angler:rivers*" + }, + { + "action": "oversee", + "role": "angler:role.foreman", + "resource": "angler:rivers*" + }, + { + "action": "manage", + "role": "angler:role.manager*", + "resource": "angler:rivers*" + }, + { + "effect": "DENY", + "action": "manage", + "role": "angler:role.managerventura*", + "resource": "angler:riverskern*" + } + ], + "modified": "2014-05-24T00:34:45.922Z", + "name": "angler:policy.wildcardgamewardens" + }, + { + "assertions": [ + { + "action": "all", + "role": "angler:role.matchall", + "resource": "angler:*" + }, + { + "action": "startswith", + "role": "angler:role.matchstarts", + "resource": "angler:startswith*" + }, + { + "action": "compare", + "role": "angler:role.matchcompare", + "resource": "angler:compare" + }, + { + "action": "regex", + "role": "angler:role.matchregex", + "resource": "angler:nhl*kings" + } + ], + "modified": "2014-05-24T00:35:11.387Z", + "name": "angler:policy.matchtypes" + }, + { + "assertions": [ + { + "action": "full_regex", + "role": "angler:role.full_regex", + "resource": "angler:?ore(tech|commit)" + }, + { + "action": "full_regex", + "role": "angler:role.full_regex", + "resource": "angler:?ore[a-c]" + }, + { + "action": "full_regex", + "role": "angler:role.full_regex", + "resource": "angler:?ore[def]" + } + ], + "modified": "2014-05-24T00:35:11.387Z", + "name": "angler:policy.full_regex" + } + ] + }, + "zmsSignature": "eN5aZiqCof3HjHctjkYB2itNvI.90u.bq6zzLoXG8CJ8hSwG6IBMaIQ0yf.Q_SR5HTFi7Tmrc1quQuH17H0PJg--", + "zmsKeyId": "0" + }, + "signature": "o6G6eXPifUvvE87ElgpquAaSQGr0L0v_6HkcXJ972.v62eaedhMkJO5fPLS0RbmhQfiy_GPZsZNPB_gkULI4eFSsqfWb4hTtKgo1uqS6QoPc2KZDeXrGc_ocAqpB4l1qsj4y_o9vj8ICtHgLqRxIvmdajSPmy4xo0p8Us7q0pZ2_td8xN3ZsjMZDES78_grhRexcwnI_3a25jAWg_BzUZh5ynGUh221wAZZ3FzqL7CijKzHv.V7iUqOaqb4yziCtxEuWIkcpyQ8U77BA8jCxvwxoIEBbGXE_BM0Hp8G7sfFFxV6WojoY4YwHfVIPCOlG5C0fcH5gf0NzsvlUb7oOew--", + "keyId": "0" +} diff --git a/clients/java/zpe/src/test/resources/athenz.conf b/clients/java/zpe/src/test/resources/athenz.conf new file mode 100755 index 00000000000..3a1ec2da776 --- /dev/null +++ b/clients/java/zpe/src/test/resources/athenz.conf @@ -0,0 +1,24 @@ +{ + "zmsUrl": "https://dev.zms.athenzcompany.com:4443/", + "ztsUrl": "https://dev.zts.athenzcompany.com:4443/", + "ztsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTkFEQ0JpUUtCZ1FERmQzSjJWOFdDUy9nTkUyR1BCY3R1T1J5awpqZ1FtTGZXclRRRkVGYld4TU1mVUdtUm8vSnFHQ0h1SjE0TWU5aXJjSU5CcTdvZkxFdXhrQ3dZc3dsNE8zd3BPCnRyQTFmekdTRFo4RGpmWUxDbThjWUovWml4WG1FbW1yVk01UGxVYVlRNkJ6U0FRdnFuZzdXSjJZYkIySEZmU2EKZEJqNUN6YXJvVGRVMXdPNEV3SURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + }, + { + "id": "1", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTkFEQ0JpUUtCZ1FETGlLY1hjUDlrMWRJcGU4bm1OS3pBaWpGcApuY0VWbEFveS8xcHordE5ETjExcDQ0MTJEREhXejhFSUNiVkE0RE16Wm1ta09URFdlUDBQSWdnNTg0RlF1SGpsCmsyOWU4VjJXT3pqQWZybGlad0dKbm1mdlBhb3FOQkNhZDI3cWFubm1MOVU3cTcvSEdRWmpMeGdoaXhGa0FtczEKaHFlbnlkb2JSVkhheHV3cDB3SURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ], + "zmsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + }, + { + "id": "1", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ] +} diff --git a/clients/java/zpe/src/test/resources/athenz_no_0.conf b/clients/java/zpe/src/test/resources/athenz_no_0.conf new file mode 100755 index 00000000000..19132fc2b7c --- /dev/null +++ b/clients/java/zpe/src/test/resources/athenz_no_0.conf @@ -0,0 +1,24 @@ +{ + "zmsUrl": "https://dev.zms.athenzcompany.com:4443/", + "ztsUrl": "https://dev.zts.athenzcompany.com:4443/", + "ztsPublicKeys": [ + { + "id": "unused", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTkFEQ0JpUUtCZ1FDZVUvZ0pKODA0MmN6QVUwQk1ub3N6bS9BdgpabGFzVUY2U0FhOGVXQkhSVmFCOTJ3Ty9ZZHBTZ3BDalVnUXdGN3RzTCtSd3ZCVGVpOEJKRDhhTUE2MmFaNDhOCjZYWjc4ams2Sm53bHN4aWFsUXNkNXdDNkhWUUlTclVvSEM1UkxtdUFyRHlrSWo1dWVuVDhqcTA3Ky9sNWdMQnUKQkpMSlNrSlpJa3lzcVRqRmZRSURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + }, + { + "id": "1", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTkFEQ0JpUUtCZ1FETGlLY1hjUDlrMWRJcGU4bm1OS3pBaWpGcApuY0VWbEFveS8xcHordE5ETjExcDQ0MTJEREhXejhFSUNiVkE0RE16Wm1ta09URFdlUDBQSWdnNTg0RlF1SGpsCmsyOWU4VjJXT3pqQWZybGlad0dKbm1mdlBhb3FOQkNhZDI3cWFubm1MOVU3cTcvSEdRWmpMeGdoaXhGa0FtczEKaHFlbnlkb2JSVkhheHV3cDB3SURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ], + "zmsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + }, + { + "id": "1", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ] +} diff --git a/clients/java/zpe/src/test/resources/empty.pol b/clients/java/zpe/src/test/resources/empty.pol new file mode 100644 index 00000000000..fbf0105553a --- /dev/null +++ b/clients/java/zpe/src/test/resources/empty.pol @@ -0,0 +1,15 @@ +{ + "signedPolicyData": { + "modified": "2015-01-13T19:13:18.601Z", + "policyData": { + "domain": "empty", + "policies": [ + ] + }, + "zmsSignature": "eN5aZiqCof3HjHctjkYB2itNvI.90u.bq6zzLoXG8CJ8hSwG6IBMaIQ0yf.Q_SR5HTFi7Tmrc1quQuH17H0PJg--", + "zmsKeyId": "0", + "expires": "2015-01-20T19:13:18.599Z" + }, + "signature": "qJXtTXPI0aQcxUgerT9X4BM6HoKVM1pNClt86UViintmC5.IK9uYoFhtdMfDLq7Kzc8jdyT1iCqv_OmEyMHLCA--", + "keyId": "0" +} diff --git a/clients/java/zpe/src/test/resources/logback.xml b/clients/java/zpe/src/test/resources/logback.xml new file mode 100644 index 00000000000..0343d82c9e9 --- /dev/null +++ b/clients/java/zpe/src/test/resources/logback.xml @@ -0,0 +1,16 @@ + + + + + System.out + + %-4relative [%thread] %-5level %class - %msg%n + + + + + + + + + diff --git a/clients/java/zpe/src/test/resources/logback_perf.xml b/clients/java/zpe/src/test/resources/logback_perf.xml new file mode 100644 index 00000000000..476b077502a --- /dev/null +++ b/clients/java/zpe/src/test/resources/logback_perf.xml @@ -0,0 +1,16 @@ + + + + + System.out + + %-4relative [%thread] %-5level %class - %msg%n + + + + + + + + + diff --git a/clients/java/zpe/src/test/resources/pol_dir/.keepme b/clients/java/zpe/src/test/resources/pol_dir/.keepme new file mode 100644 index 00000000000..e69de29bb2d diff --git a/clients/java/zpe/src/test/resources/sports.pol b/clients/java/zpe/src/test/resources/sports.pol new file mode 100644 index 00000000000..3ee12813eab --- /dev/null +++ b/clients/java/zpe/src/test/resources/sports.pol @@ -0,0 +1,32 @@ +{ + "signedPolicyData": { + "modified": "2015-01-13T19:13:18.601Z", + "policyData": { + "domain": "sports", + "policies": [ + { + "name": "sports:policy.admin", + "assertions": [ + { + "resource": "*", + "role": "sports:role.admin", + "action": "*", + "effect": "ALLOW" + }, + { + "resource": "*", + "role": "sports:role.non-admin", + "action": "*", + "effect": "DENY" + } + ] + } + ] + }, + "expires": "2015-01-20T19:13:18.599Z", + "zmsSignature": "eN5aZiqCof3HjHctjkYB2itNvI.90u.bq6zzLoXG8CJ8hSwG6IBMaIQ0yf.Q_SR5HTFi7Tmrc1quQuH17H0PJg--", + "zmsKeyId": "0" + }, + "signature": "qJXtTXPI0aQcxUgerT9X4BM6HoKVM1pNClt86UViintmC5.IK9uYoFhtdMfDLq7Kzc8jdyT1iCqv_OmEyMHLCA--", + "keyId": "0" +} diff --git a/clients/java/zpe/src/test/resources/sys.auth.pol b/clients/java/zpe/src/test/resources/sys.auth.pol new file mode 100644 index 00000000000..a9d1d898219 --- /dev/null +++ b/clients/java/zpe/src/test/resources/sys.auth.pol @@ -0,0 +1,32 @@ +{ + "signedPolicyData": { + "modified": "2015-01-13T19:13:37.745Z", + "policyData": { + "domain": "sys.auth", + "policies": [ + { + "name": "sys.auth:policy.admin", + "assertions": [ + { + "resource": "*", + "role": "sys.auth:role.admin", + "action": "*", + "effect": "ALLOW" + }, + { + "resource": "*", + "role": "sys.auth:role.non-admin", + "action": "*", + "effect": "DENY" + } + ] + } + ] + }, + "expires": "2015-01-20T19:13:37.744Z", + "zmsSignature": "eN5aZiqCof3HjHctjkYB2itNvI.90u.bq6zzLoXG8CJ8hSwG6IBMaIQ0yf.Q_SR5HTFi7Tmrc1quQuH17H0PJg--", + "zmsKeyId": "0" + }, + "signature": "eN5aZiqCof3HjHctjkYB2itNvI.90u.bq6zzLoXG8CJ8hSwG6IBMaIQ0yf.Q_SR5HTFi7Tmrc1quQuH17H0PJg--", + "keyId": "0" +} diff --git a/clients/java/zpe/src/test/resources/zms_private_k0.pem b/clients/java/zpe/src/test/resources/zms_private_k0.pem new file mode 100644 index 00000000000..356e1edf8bd --- /dev/null +++ b/clients/java/zpe/src/test/resources/zms_private_k0.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- diff --git a/clients/java/zpe/src/test/resources/zms_public_k0.pem b/clients/java/zpe/src/test/resources/zms_public_k0.pem new file mode 100644 index 00000000000..727c3c67f22 --- /dev/null +++ b/clients/java/zpe/src/test/resources/zms_public_k0.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_private_k0.pem b/clients/java/zpe/src/test/resources/zts_private_k0.pem new file mode 100644 index 00000000000..0f4e4f68ebc --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_private_k0.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXAIBAAKBgQDFd3J2V8WCS/gNE2GPBctuORykjgQmLfWrTQFEFbWxMMfUGmRo +/JqGCHuJ14Me9ircINBq7ofLEuxkCwYswl4O3wpOtrA1fzGSDZ8DjfYLCm8cYJ/Z +ixXmEmmrVM5PlUaYQ6BzSAQvqng7WJ2YbB2HFfSadBj5CzaroTdU1wO4EwIDAQAB +AoGAIH4nN5H5zhbyGjS2OPKbJuf+7pTv2dh2NFnXe3yXCTEdsKknHJ90TdnXejcc +PFwFcXN02COn9KKIg23M9lCFaWLhv/DtxW/pHMNPUmV26j8+mgFX7JsWdPLlobB0 +yTUjbv7RMk4UY+iHS4wsy1VtlPJtGWV96qyQW1BV3UgLxwECQQDwTuFOnsqTO+RL +Km9zXh0YnWWAADig53qTwtlJjY+siqccg2B111gF19DQJezoitrmgqDrfhbe9AeO +bwqHkHanAkEA0lxnpUYP0clRjDvZf2ey7Q0geCBv2KMGPXNvhoqV5KLGjy4jjON9 +UY86NpuTJxCG9mxgZ2MLtFrDM8yGXzAMtQJAPnAAUnEnqUGye2U3N/6ICNE8ghmM +nSIH00SZOGczoV0VNm9cLMIa+MmuU6bG+1S4s5PVQ9qrDprRK8zmK3r5mQJBAJto +uwWmAg/pnD5vBNsUIGLy3LcCt76jifuiKZWLEvwLqYej/Y2bjzzPBKHNQ+SLWDn7 +jSk0SjRfDXFaOzddhzUCQEI+I+tvOB0Vz7XdP9qr2hcSY1aL2YMCEA0sarZgPy81 +yWVgJcMwDR3MWGhz0AR0ao4WrKmg9JjtSUxvNbV82IU= +-----END RSA PRIVATE KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_private_k1.pem b/clients/java/zpe/src/test/resources/zts_private_k1.pem new file mode 100644 index 00000000000..efbf892ebb6 --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_private_k1.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXwIBAAKBgQDLiKcXcP9k1dIpe8nmNKzAijFpncEVlAoy/1pz+tNDN11p4412 +DDHWz8EICbVA4DMzZmmkOTDWeP0PIgg584FQuHjlk29e8V2WOzjAfrliZwGJnmfv +PaoqNBCad27qannmL9U7q7/HGQZjLxghixFkAms1hqenydobRVHaxuwp0wIDAQAB +AoGBAI4mpuzMUtNOMzYd6ukJKQ5gdhpZv50eg/ESP055hEuRw4BNGWO1KKnq99px +TVI+RARGJso311AzuCp1jmFLHKjQwSeqBdO3a7dt3d6YUTkQg3bV+LuS0ruYstOb +moyDQ/pLRaFvK31Gd6t91Js1ZMm9XWyUZQBw3M9qdA0NaJYBAkEA7s2bgY9i8Vgh +n9qpDlv6+qgbZfEZK/maVJPH7mKWfT6AP0CBuHcLKv89506rYeyK+Vc2vAcQIkDu +82mVl1QlEwJBANow2KwHxiTwGM6GRMY00FwD1wB4WU3mzMtiWtrwaEChlWq1c8m8 +DtnX4rGVGxizYhKisZ8EEy5b2b/6tRTOQEECQQDoZMsq4IFnYV8Hk+HliXnLqQFQ +ybq3Yubf3Bk7UlIlfEeORpZ3D9Kce1yg15xNZccxM8CeZzk6PHrOAziC1m5lAkEA +kTdlXcmmxLrPp9SRPWG1MyiTFgsDVOfBcbO6SHEs0ac5bNXrhF6Xe8FFbW+RozTw +lvqVQQJTSc1z9WQE1R4YgQJBAK8PtvWSmMVUlwVa/np3vQCoeILI1ugjicCOLiq7 +b3Wj1aQoi3gXa746cxnG4Y8lzKdIm1ukCCdBc47/Y8ayIgY= +-----END RSA PRIVATE KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_private_k17.pem b/clients/java/zpe/src/test/resources/zts_private_k17.pem new file mode 100644 index 00000000000..9e8891ce042 --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_private_k17.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXAIBAAKBgQC2fHq0j2Rs4FK6XQ7EM485H4suikgJOgkXX0p9efUU8vQpHvwD +iiJh1rmfBqAcxYjr1vXA5N0e0LV//qfxog6KPnDrbZ99FrkLYAtEL21riuyPrDhQ +pDnG+fpkI6jjL0XPXIML8Tg3n+6vusbnKF9PeO9to0UU6s76z3Gof8FhOwIDAQAB +AoGAFmSMAiAeaKXWQPwuVbEmABJ418ssL8WpW+7biy4t/tYZU/pzXlPTCEJ7IKKF +f0JWHOqR2Yu7/o4J15z+Ks6CDgto1VwDTFuz7Cwwx/L4QFLAAzZNBl1JDV7XrMMU +Vf1MSBiqIwLYm4sHSPmfW726PUqwF7oZOiGpbeFsWPgno/ECQQDwFAr4BwsGvAOD +oNL1NFVl24p35OW2U54kIW14tn3lFo03QrJG/EYPezYwrYzKeIl6mPyK9gqwUQ+x +m8ajzNIPAkEAwpapK6ia1yA96N0p3bXUiYU2J0ROx3ao7yc4qkZ2zzzGWWLeDvcs +Fa1YyU761WcXVC2/BAhdF87aJ4Fio5d6FQJBAKc0jl8oKJnMIHZwb/yvMjr6qHnQ +RdyyaBWp4mCMWSpQhpHSNfASi4kEuz0z4jaxtK5aFqmBqvgZvOBqKfKzGCkCQEvK +Tr3Yf+bGghaO/d2DEvM1VXBZ5K1ABHCRwDpiE6iILWFnZsJBd4RB7lEKWByCeM2q +u7mgYFIDmWjFtluthjkCQAz4rdNBmBnbte8dWpbEqxEiWfbnx1eLsiYnKVroNION +fQyEagDRqyo/nI9EWeQnEv+hTEJPY9JHJymlHWK9qXU= +-----END RSA PRIVATE KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_private_k99.pem b/clients/java/zpe/src/test/resources/zts_private_k99.pem new file mode 100644 index 00000000000..1fe548c63db --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_private_k99.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXQIBAAKBgQC+xl5AphtG0NnPbheJl0/6hcKFN0NP0q61zzSW3IQ8W5Q1bEJl +5IhjqK7+S5oG6MoHxqQf1MINL5hj8y0ej9tP06DGSBrHH3eclTbaEABJ4+y1fWG7 +DFoJLWaSJkcnTcchcKKajPwhzLGWef+Ukitr6OybnhiyMRjMerraAfwbeQIDAQAB +AoGAewdCUT7N6GVXkcXVuA20rkMEpxR0fE3KDcWKjJ+5R5NniOxABaXTrzFhaO0o +b7xATbN0tHJokkhXZl20gzkSnNI8gQAKQSaA2Est8n4BHsWTVMiKYjOxnQ1cjkf+ +jQIyUEdS2e8F/B0CPYyGKopT2tByu1aQ0+x+3TfzmoMDFuECQQDwSMATi8QC5zDi +Tv2ZqXW5YfsfwRyFsQfOoQ8rmFZZrHRfoU1uJqO+LszTsDZTWJ0E4J+wlcLO8QPG ++52BA8iPAkEAy0Cl8Qmy6P5URQPiNGpUASWI6nMNgUIgPmRt+DsR4b40WW4IJ4Ig +d6xZPHTtoKsjkXEj2UePTwvcuODmNa6PdwJBANgte7GaI0VBXrecvYiL74BT6K0O +/mxBc3axbIaaTcXr499Nre4WEWc/j8Q8WwPtS4dh2An1Ewk/yVgyc+fo0X0CQQDF +9Jfp841JeXLvqMGmVSyt1TXNSfMMQjAPNFcancVjvJFVzGGqwQUIKVbcF/HcOvIw +VCYbF6QO07nMYlY0UGgvAkBnAqUUVUI59BOR3bAnG8kx75V77PZ7pA8uqoDq38Xp +xAVmrm8u8hLsiE9iROhCofhHj/r40hcHiyzwu3B/DSO3 +-----END RSA PRIVATE KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_public_k0.pem b/clients/java/zpe/src/test/resources/zts_public_k0.pem new file mode 100644 index 00000000000..58b8bb295fd --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_public_k0.pem @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDFd3J2V8WCS/gNE2GPBctuORyk +jgQmLfWrTQFEFbWxMMfUGmRo/JqGCHuJ14Me9ircINBq7ofLEuxkCwYswl4O3wpO +trA1fzGSDZ8DjfYLCm8cYJ/ZixXmEmmrVM5PlUaYQ6BzSAQvqng7WJ2YbB2HFfSa +dBj5CzaroTdU1wO4EwIDAQAB +-----END PUBLIC KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_public_k1.pem b/clients/java/zpe/src/test/resources/zts_public_k1.pem new file mode 100644 index 00000000000..5c229adc4c1 --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_public_k1.pem @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLiKcXcP9k1dIpe8nmNKzAijFp +ncEVlAoy/1pz+tNDN11p4412DDHWz8EICbVA4DMzZmmkOTDWeP0PIgg584FQuHjl +k29e8V2WOzjAfrliZwGJnmfvPaoqNBCad27qannmL9U7q7/HGQZjLxghixFkAms1 +hqenydobRVHaxuwp0wIDAQAB +-----END PUBLIC KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_public_k17.pem b/clients/java/zpe/src/test/resources/zts_public_k17.pem new file mode 100644 index 00000000000..fd57e88f91b --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_public_k17.pem @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2fHq0j2Rs4FK6XQ7EM485H4su +ikgJOgkXX0p9efUU8vQpHvwDiiJh1rmfBqAcxYjr1vXA5N0e0LV//qfxog6KPnDr +bZ99FrkLYAtEL21riuyPrDhQpDnG+fpkI6jjL0XPXIML8Tg3n+6vusbnKF9PeO9t +o0UU6s76z3Gof8FhOwIDAQAB +-----END PUBLIC KEY----- diff --git a/clients/java/zpe/src/test/resources/zts_public_k99.pem b/clients/java/zpe/src/test/resources/zts_public_k99.pem new file mode 100644 index 00000000000..2e1ec2d6823 --- /dev/null +++ b/clients/java/zpe/src/test/resources/zts_public_k99.pem @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+xl5AphtG0NnPbheJl0/6hcKF +N0NP0q61zzSW3IQ8W5Q1bEJl5IhjqK7+S5oG6MoHxqQf1MINL5hj8y0ej9tP06DG +SBrHH3eclTbaEABJ4+y1fWG7DFoJLWaSJkcnTcchcKKajPwhzLGWef+Ukitr6Oyb +nhiyMRjMerraAfwbeQIDAQAB +-----END PUBLIC KEY----- diff --git a/clients/java/zts/README.md b/clients/java/zts/README.md new file mode 100644 index 00000000000..659ec0ef52f --- /dev/null +++ b/clients/java/zts/README.md @@ -0,0 +1,27 @@ +zts-java-client +=============== + +A Java client library to access ZTS. This client library is generated +from the RDL, and includes zts-core and all other dependencies. + +--- Connection Timeouts --- + +Default read and connect timeout values for ZTS Client connections +are 30000ms (30sec). The application can change these values by using +the following system properties: + + * athenz.zts.client.read_timeout + * athenz.zts.client.connect_timeout + +The values specified for timeouts must be in milliseconds. + +--- Prefetch Settings --- + + * athenz.zts.client.prefetch_auto_enable : true or false, default is false + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() + diff --git a/clients/java/zts/pom.xml b/clients/java/zts/pom.xml new file mode 100644 index 00000000000..22f2003e33e --- /dev/null +++ b/clients/java/zts/pom.xml @@ -0,0 +1,235 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../../pom.xml + + + zts_java_client + jar + zts-java-client + ZTS Java Client Library + + + + ${project.groupId} + zts_core + ${project.parent.version} + + + ${project.groupId} + sia_java_client + ${project.parent.version} + + + ${project.groupId} + client_common + ${project.parent.version} + + + ${project.groupId} + auth_core + ${project.parent.version} + + + org.glassfish.jersey.media + jersey-media-json-jackson + ${jersey.version} + + + com.fasterxml.jackson.core + jackson-annotations + + + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + org.glassfish.jersey.core + jersey-client + ${jersey.version} + + + + + + + org.codehaus.mojo + exec-maven-plugin + 1.1.1 + + + + exec + + generate-sources + + + + bash + + scripts/make_stubs.sh + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 2.10.4 + + + prepare-package + + jar + + + + + + org.apache.maven.plugins + maven-shade-plugin + 2.3 + + + package + + shade + + + + + + + + org.glassfish.hk2 + org.glassfish.hk2.external + org.glassfish.jersey + org.glassfish.jersey.ext + org.glassfish.jersey.core + org.glassfish.jersey.media + org.glassfish.jersey.bundles.repackaged + com.fasterxml.jackson.core + com.fasterxml.jackson.jaxrs + com.fasterxml.jackson.module + javax.ws.rs + javax.annotation + javax.inject + jersey.repackaged.com.google.common + org.aopalliance + com.yahoo.athenz:sia_java_client + com.kohlschutter.junixsocket + + + + + javax.inject + athenz.shade.zts.javax.inject + + + org.aopalliance + athenz.shade.zts.org.aopalliance + + + jersey.repackaged.com.google.common + athenz.shade.zts.jersey.repackaged.com.google.common + + + javax.ws.rs + athenz.shade.zts.javax.ws.rs + + + javax.annotation + athenz.shade.zts.javax.annotation + + + org.glassfish.jersey + athenz.shade.zts.org.glassfish.jersey + + + org.glassfish.hk2 + athenz.shade.zts.org.glassfish.hk2 + + + org.glassfish.hk2.external + athenz.shade.zts.org.glassfish.hk2.external + + + org.jvnet.hk2 + athenz.shade.zts.org.jvnet.hk2 + + + org.jvnet.tiger_types + athenz.shade.zts.org.jvnet.tiger_types + + + com.fasterxml.jackson + athenz.shade.zts.com.fasterxml.jackson + + + + + *:* + + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + + + + + + + + + + coverage + + + coverage + + + + + + com.atlassian.maven.plugins + maven-clover2-plugin + 4.0.4 + + 1.8 + + + **/ZTSRDLGeneratedClient.java + **/*Mock.java + + ${HOME}/license/clover.license + + + + + + + diff --git a/clients/java/zts/scripts/make_stubs.sh b/clients/java/zts/scripts/make_stubs.sh new file mode 100755 index 00000000000..e046ac7f6c6 --- /dev/null +++ b/clients/java/zts/scripts/make_stubs.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +# If the zts_core dependency has been updated, then this script should be run +# manually to pick up the latest rdl to generate the appropriate client library + +# Note this script is dependent on the rdl utility. +# go get github.com/ardielle/ardielle-tools/... + +command -v rdl >/dev/null 2>&1 || { + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "SOURCE WARNING"; + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "Please install rdl utility: go get github.com/ardielle/ardielle-tools/..."; + echo >&2 "Skipping source generation..."; + exit 0; +} + +RDL_FILE=../../../core/zts/src/main/rdl/ZTS.rdl + +echo "Generate the client library..." +rdl -s generate -o src/main/java -x clientclass=ZTSRDLGenerated java-client $RDL_FILE diff --git a/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ResourceError.java b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ResourceError.java new file mode 100644 index 00000000000..ddd96536251 --- /dev/null +++ b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ResourceError.java @@ -0,0 +1,24 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +public class ResourceError { + + public int code; + public String message; + + public ResourceError code(int code) { + this.code = code; + return this; + } + public ResourceError message(String message) { + this.message = message; + return this; + } + + public String toString() { + return "{code: " + code + ", message: \"" + message + "\"}"; + } + +} diff --git a/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ResourceException.java b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ResourceException.java new file mode 100644 index 00000000000..4d094b4ee5c --- /dev/null +++ b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ResourceException.java @@ -0,0 +1,79 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +public class ResourceException extends RuntimeException { + public final static int OK = 200; + public final static int CREATED = 201; + public final static int ACCEPTED = 202; + public final static int NO_CONTENT = 204; + public final static int MOVED_PERMANENTLY = 301; + public final static int FOUND = 302; + public final static int SEE_OTHER = 303; + public final static int NOT_MODIFIED = 304; + public final static int TEMPORARY_REDIRECT = 307; + public final static int BAD_REQUEST = 400; + public final static int UNAUTHORIZED = 401; + public final static int FORBIDDEN = 403; + public final static int NOT_FOUND = 404; + public final static int CONFLICT = 409; + public final static int GONE = 410; + public final static int PRECONDITION_FAILED = 412; + public final static int UNSUPPORTED_MEDIA_TYPE = 415; + public final static int INTERNAL_SERVER_ERROR = 500; + public final static int NOT_IMPLEMENTED = 501; + + public final static int SERVICE_UNAVAILABLE = 503; + + public static String codeToString(int code) { + switch (code) { + case OK: return "OK"; + case CREATED: return "Created"; + case ACCEPTED: return "Accepted"; + case NO_CONTENT: return "No Content"; + case MOVED_PERMANENTLY: return "Moved Permanently"; + case FOUND: return "Found"; + case SEE_OTHER: return "See Other"; + case NOT_MODIFIED: return "Not Modified"; + case TEMPORARY_REDIRECT: return "Temporary Redirect"; + case BAD_REQUEST: return "Bad Request"; + case UNAUTHORIZED: return "Unauthorized"; + case FORBIDDEN: return "Forbidden"; + case NOT_FOUND: return "Not Found"; + case CONFLICT: return "Conflict"; + case GONE: return "Gone"; + case PRECONDITION_FAILED: return "Precondition Failed"; + case UNSUPPORTED_MEDIA_TYPE: return "Unsupported Media Type"; + case INTERNAL_SERVER_ERROR: return "Internal Server Error"; + case NOT_IMPLEMENTED: return "Not Implemented"; + default: return "" + code; + } + } + + int code; + Object data; + + public ResourceException(int code) { + this(code, new ResourceError().code(code).message(codeToString(code))); + } + + public ResourceException(int code, Object data) { + super("ResourceException (" + code + "): " + data); + this.code = code; + this.data = data; + } + + public int getCode() { + return code; + } + + public Object getData() { + return data; + } + + public T getData(Class cl) { + return cl.cast(data); + } + +} diff --git a/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClient.java b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClient.java new file mode 100644 index 00000000000..6dbf44205ca --- /dev/null +++ b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClient.java @@ -0,0 +1,1533 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import java.io.Closeable; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.cert.Certificate; +import java.security.cert.CertificateParsingException; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.Collection; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Queue; +import java.util.Timer; +import java.util.TimerTask; +import java.util.concurrent.ConcurrentHashMap; +import java.util.concurrent.ConcurrentLinkedQueue; +import java.util.concurrent.atomic.AtomicLong; +import java.util.concurrent.atomic.AtomicReference; +import java.util.ServiceLoader; +import java.util.Set; + +import javax.net.ssl.HostnameVerifier; +import javax.net.ssl.SSLPeerUnverifiedException; +import javax.net.ssl.SSLSession; + +import org.glassfish.jersey.client.ClientProperties; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.RoleAuthority; +import com.yahoo.athenz.common.config.AthenzConfig; +import com.yahoo.athenz.sia.SIA; +import com.yahoo.athenz.sia.impl.SIAClient; +import com.yahoo.rdl.JSON; + +public class ZTSClient implements Closeable { + + private static final Logger LOG = LoggerFactory.getLogger(ZTSClient.class); + + private String ztsUrl = null; + private String domain = null; + private String service = null; + protected ZTSRDLGeneratedClient ztsClient; + protected SIA siaClient = null; + + // configurable fields + // + static private boolean cacheDisabled = false; + static private int tokenMinExpiryTime = 900; + static private int siaTokenMinExpiryTime = 300; + static private int siaTokenMaxExpiryTime = 3600; + static private long prefetchInterval = 60; // seconds + static private boolean prefetchAutoEnable = false; + + @SuppressWarnings("unused") + static private boolean initialized = initConfigValues(); + + private boolean enablePrefetch = true; + Principal principal = null; + + // system properties + + public static final String ZTS_CLIENT_PROP_ATHENZ_CONF = "athenz.athenz_conf"; + + public static final String ZTS_CLIENT_PROP_TOKEN_MIN_EXPIRY_TIME = "athenz.zts.client.token_min_expiry_time"; + public static final String ZTS_CLIENT_PROP_TOKEN_SIA_MIN_EXPIRY_TIME = "athenz.zts.client.sia_token_min_expiry_time"; + public static final String ZTS_CLIENT_PROP_TOKEN_SIA_MAX_EXPIRY_TIME = "athenz.zts.client.sia_token_max_expiry_time"; + public static final String ZTS_CLIENT_PROP_READ_TIMEOUT = "athenz.zts.client.read_timeout"; + public static final String ZTS_CLIENT_PROP_CONNECT_TIMEOUT = "athenz.zts.client.connect_timeout"; + public static final String ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL = "athenz.zts.client.prefetch_sleep_interval"; + public static final String ZTS_CLIENT_PROP_PREFETCH_AUTO_ENABLE = "athenz.zts.client.prefetch_auto_enable"; + public static final String ZTS_CLIENT_PROP_X509CERT_DNS_NAME = "athenz.zts.client.x509cert_dns_name"; + public static final String ZTS_CLIENT_PROP_DISABLE_CACHE = "athenz.zts.client.disable_cache"; + + public static final String ROLE_TOKEN_HEADER = System.getProperty(RoleAuthority.ATHENZ_PROP_ROLE_HEADER, + RoleAuthority.HTTP_HEADER); + + final static ConcurrentHashMap ROLE_TOKEN_CACHE = new ConcurrentHashMap<>(); + static ConcurrentHashMap awsCredCache = new ConcurrentHashMap<>(); + + private static final long FETCH_EPSILON = 60; // if cache expires in the next minute, fetch it. + private static final Queue PREFETCH_SCHEDULED_ITEMS = new ConcurrentLinkedQueue<>(); + private static Timer FETCH_TIMER; + private static final Object TIMER_LOCK = new Object(); + static AtomicLong FETCHER_LAST_RUN_AT = new AtomicLong(-1); + + // allows outside implementations to get role tokens for special environments - ex. hadoop + + private static final ServiceLoader ZTS_TOKEN_PROVIDERS = ServiceLoader.load(ZTSClientService.class); + private static final AtomicReference> SVC_LOADER_CACHE_KEYS = new AtomicReference<>(); + static { + loadSvcProviderTokens(); + } + + static boolean initConfigValues() { + + /* The minimum token expiry time by default is 15 minutes (900). By default the + * server gives out role tokens for 2 hours and with this setting we'll be able + * to cache tokens for 1hr45mins before requesting a new one from ZTS */ + + tokenMinExpiryTime = Integer.parseInt(System.getProperty(ZTS_CLIENT_PROP_TOKEN_MIN_EXPIRY_TIME, "900")); + if (tokenMinExpiryTime < 0) { + tokenMinExpiryTime = 900; + } + + /* We're going to cache Service Principal Tokens as long as possible so by default + * we're going to request tokens with a minimum timeout of 5 mins and max default + * value of 1hr. SIA Client Library provides the caching support so we'll just + * make the call for every request and let the SIA client library to return the + * cached token back to us */ + + siaTokenMinExpiryTime = Integer.parseInt(System.getProperty(ZTS_CLIENT_PROP_TOKEN_SIA_MIN_EXPIRY_TIME, "300")); + if (siaTokenMinExpiryTime < 0) { + siaTokenMinExpiryTime = 300; + } + siaTokenMaxExpiryTime = Integer.parseInt(System.getProperty(ZTS_CLIENT_PROP_TOKEN_SIA_MAX_EXPIRY_TIME, "3600")); + if (siaTokenMaxExpiryTime < 0) { + siaTokenMaxExpiryTime = 3600; + } + + prefetchInterval = Integer.parseInt(System.getProperty(ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "60")); + if (prefetchInterval >= tokenMinExpiryTime) { + prefetchInterval = 60; + } + + prefetchAutoEnable = Boolean.parseBoolean(System.getProperty(ZTS_CLIENT_PROP_PREFETCH_AUTO_ENABLE, "false")); + cacheDisabled = Boolean.parseBoolean(System.getProperty(ZTS_CLIENT_PROP_DISABLE_CACHE, "false")); + return true; + } + + /** + * Constructs a new ZTSClient object with the given principal identity + * and media type set to application/json. The url for ZTS Server is + * automatically retrieved from the athenz_config package's configuration + * file (zts_url field). + * Default read and connect timeout values are 30000ms (30sec). The application can + * change these values by using the yahoo.zts_java_client.read_timeout and + * yahoo.zts_java_client.connect_timeout system properties. The values specified + * for timeouts must be in milliseconds. + * @param identity Principal identity for authenticating requests + */ + public ZTSClient(Principal identity) { + initClient(null, identity, null, null); + enablePrefetch = false; // cant use this domain and service for prefetch + } + + /** + * Constructs a new ZTSClient object with the given principal identity + * and ZTS Server URL and media type set to application/json. + * Default read and connect timeout values are 30000ms (30sec). The application can + * change these values by using the yahoo.zts_java_client.read_timeout and + * yahoo.zts_java_client.connect_timeout system properties. The values specified + * for timeouts must be in milliseconds. + * @param url ZTS Server's URL + * @param identity Principal identity for authenticating requests + */ + public ZTSClient(String url, Principal identity) { + initClient(url, identity, null, null); + enablePrefetch = false; // cant use this domain and service for prefetch + } + + /** + * Constructs a new ZTSClient object with the given service identity + * and media type set to application/json. The url for ZTS Server is + * automatically retrieved from the athenz_config package's configuration + * file (zts_url field). The service's principal token will be retrieved + * from the SIA Client. + * Default read and connect timeout values are 30000ms (30sec). The application can + * change these values by using the yahoo.zts_java_client.read_timeout and + * yahoo.zts_java_client.connect_timeout system properties. The values specified + * for timeouts must be in milliseconds. + * @param domainName name of the domain + * @param serviceName name of the service + */ + public ZTSClient(String domainName, String serviceName) { + initClient(null, null, domainName, serviceName); + } + + /** + * Constructs a new ZTSClient object with the given service identity + * and media type set to application/json. The service's principal + * token will be retrieved from the SIA Client. + * Default read and connect timeout values are 30000ms (30sec). The application can + * change these values by using the yahoo.zts_java_client.read_timeout and + * yahoo.zts_java_client.connect_timeout system properties. The values specified + * for timeouts must be in milliseconds. + * @param url ZTS Server's URL + * @param domainName name of the domain + * @param serviceName name of the service + */ + public ZTSClient(String url, String domainName, String serviceName) { + initClient(url, null, domainName, serviceName); + } + + /** + * Close the ZTSClient object and release any allocated resources. + */ + @Override + public void close() { + ztsClient.close(); + } + + void removePrefetcher() { + PREFETCH_SCHEDULED_ITEMS.clear(); + if (FETCH_TIMER != null) { + FETCH_TIMER.purge(); + FETCH_TIMER.cancel(); + FETCH_TIMER = null; + } + } + + /** + * Returns the locally configured ZTS Server's URL value + * @return ZTS Server URL + */ + public String getZTSUrl() { + return ztsUrl; + } + + public void setZTSRDLGeneratedClient(ZTSRDLGeneratedClient client) { + this.ztsClient = client; + } + + public void setSIAClient(SIA client) { + this.siaClient = client; + } + + String lookupZTSUrl() { + + String rootDir = System.getenv("ROOT"); + if (rootDir == null) { + rootDir = "/home/athenz"; + } + + String confFileName = System.getProperty(ZTS_CLIENT_PROP_ATHENZ_CONF, + rootDir + "/conf/athenz/athenz.conf"); + String url = null; + try { + Path path = Paths.get(confFileName); + AthenzConfig conf = JSON.fromBytes(Files.readAllBytes(path), AthenzConfig.class); + url = conf.getZtsUrl(); + } catch (Exception ex) { + LOG.error("Unable to extract ZTS Url from {} exc: {}", + confFileName, ex.getMessage()); + } + + return url; + } + + void initClient(String url, Principal identity, String domainName, String serviceName) { + + if (url == null) { + ztsUrl = lookupZTSUrl(); + } else { + ztsUrl = url; + } + + /* verify if the url is ending with /zts/v1 and if it's + * not we'll automatically append it */ + + if (ztsUrl != null && !ztsUrl.isEmpty()) { + if (!ztsUrl.endsWith("/zts/v1")) { + if (ztsUrl.charAt(ztsUrl.length() - 1) != '/') { + ztsUrl += '/'; + } + ztsUrl += "zts/v1"; + } + } + + /* determine our read and connect timeouts */ + + int readTimeout = Integer.parseInt(System.getProperty(ZTS_CLIENT_PROP_READ_TIMEOUT, "30000")); + int connectTimeout = Integer.parseInt(System.getProperty(ZTS_CLIENT_PROP_CONNECT_TIMEOUT, "30000")); + String x509CertDNSName = System.getProperty(ZTS_CLIENT_PROP_X509CERT_DNS_NAME); + HostnameVerifier hostnameVerifier = null; + if (x509CertDNSName != null && !x509CertDNSName.isEmpty()) { + hostnameVerifier = new AWSHostNameVerifier(x509CertDNSName); + } + + ztsClient = new ZTSRDLGeneratedClient(ztsUrl, hostnameVerifier) + .setProperty(ClientProperties.CONNECT_TIMEOUT, connectTimeout) + .setProperty(ClientProperties.READ_TIMEOUT, readTimeout); + + principal = identity; + if (principal != null && principal.getAuthority() != null) { + domain = principal.getDomain(); + service = principal.getName(); + ztsClient.addCredentials(identity.getAuthority().getHeader(), identity.getCredentials()); + } else if (domainName != null && serviceName != null) { + domain = domainName; + service = serviceName; + siaClient = new SIAClient(); + } + } + + void setPrefetchInterval(long interval) { + prefetchInterval = interval; + } + + long getPrefetchInterval() { + return prefetchInterval; + } + + /** + * Returns the header name that the client needs to use to pass + * the received RoleToken to the Athenz protected service. + * @return HTTP header name + */ + public String getHeader() { + return ROLE_TOKEN_HEADER; + } + + /** + * Clear the principal identity set for the client. Unless a new principal is set + * using the addCredentials method, the client can only be used to requests data + * from the ZTS Server that doesn't require any authentication. + * @param identity Principal identity for authenticating requests + * @return self ZTSClient object + */ + public ZTSClient addCredentials(Principal identity) { + return addPrincipalCredentials(identity, true); + } + + /** + * Clear the principal identity set for the client. Unless a new principal is set + * using the addCredentials method, the client can only be used to requests data + * from the ZTS Server that doesn't require any authentication. + * @return self ZTSClient object + */ + public ZTSClient clearCredentials() { + + if (principal != null) { + ztsClient.addCredentials(principal.getAuthority().getHeader(), null); + principal = null; + } + return this; + } + + ZTSClient addPrincipalCredentials(Principal identity, boolean resetServiceDetails) { + + if (identity != null && identity.getAuthority() != null) { + ztsClient.addCredentials(identity.getAuthority().getHeader(), identity.getCredentials()); + } + + // if the client is adding new principal identity then we have to + // clear out the SIA client object reference so that we don't try + // to get a service token since we already have one given to us + + if (resetServiceDetails) { + siaClient = null; + } + + principal = identity; + return this; + } + + boolean sameCredentialsAsBefore(Principal svcPrincipal) { + + // if we don't have a principal or no credentials + // then the principal has changed + + if (principal == null) { + return false; + } + + String creds = principal.getCredentials(); + if (creds == null) { + return false; + } + + return creds.equals(svcPrincipal.getCredentials()); + } + + boolean updateServicePrincipal() { + + /* if we have a service principal then we need to keep updating + * our PrincipalToken otherwise it might expire. */ + + if (siaClient == null) { + return false; + } + + try { + Principal svcPrincipal = siaClient.getServicePrincipal(domain, service, + siaTokenMinExpiryTime, siaTokenMaxExpiryTime, false); + + // if the principal has the same credentials as before + // then we don't need to update anything + + if (sameCredentialsAsBefore(svcPrincipal)) { + return false; + } + + addPrincipalCredentials(svcPrincipal, false); + + } catch (IOException ex) { + + // we should log and throw an IllegalArgumentException otherwise the + // client doesn't know that something bad has happened - in this case + // illegal domain/service was passed to the constructor - + // and the ZTS Server just rejects the request with 401 + + String msg = "UpdateServicePrincipal: Unable to get PrincipalToken from SIA Server for " + + domain + "." + service + ": " + ex.getMessage(); + LOG.error(msg); + throw new IllegalArgumentException(msg); + } + + return true; + } + + /** + * Retrieve list of services that have been configured to run on the specified host + * @param host name of the host + * @return list of service names on success. ZTSClientException will be thrown in case of failure + */ + public HostServices getHostServices(String host) { + updateServicePrincipal(); + try { + return ztsClient.getHostServices(host); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * For the specified requester(user/service) return the corresponding Role Token that + * includes the list of roles that the principal has access to in the specified domain. + * The client will automatically fulfill the request from the cache, if possible. + * The default minimum expiry time is 900 secs (15 mins). + * @param domainName name of the domain + * @return ZTS generated Role Token. ZTSClientException will be thrown in case of failure + */ + public RoleToken getRoleToken(String domainName) { + return getRoleToken(domainName, null, null, null, false, null); + } + + /** + * For the specified requester(user/service) return the corresponding Role Token that + * includes the list of roles that the principal has access to in the specified domain + * and filtered to include only those that end with the specified suffix. + * The client will automatically fulfill the request from the cache, if possible. + * The default minimum expiry time is 900 secs (15 mins). + * @param domainName name of the domain + * @param roleName only interested in roles with this name + * @return ZTS generated Role Token. ZTSClientException will be thrown in case of failure + */ + public RoleToken getRoleToken(String domainName, String roleName) { + if (roleName == null || roleName.isEmpty()) { + throw new IllegalArgumentException("RoleName cannot be null or empty"); + } + return getRoleToken(domainName, roleName, null, null, false, null); + } + + /** + * For the specified requester(user/service) return the corresponding Role Token that + * includes the list of roles that the principal has access to in the specified domain + * @param domainName name of the domain + * @param roleName (optional) only interested in roles with this name + * @param minExpiryTime (optional) specifies that the returned RoleToken must be + * at least valid (min/lower bound) for specified number of seconds, + * @param maxExpiryTime (optional) specifies that the returned RoleToken must be + * at most valid (max/upper bound) for specified number of seconds. + * @param ignoreCache ignore the cache and retrieve the token from ZTS Server + * @return ZTS generated Role Token. ZTSClientException will be thrown in case of failure + */ + public RoleToken getRoleToken(String domainName, String roleName, Integer minExpiryTime, + Integer maxExpiryTime, boolean ignoreCache) { + return getRoleToken(domainName, roleName, minExpiryTime, maxExpiryTime, + ignoreCache, null); + } + + /** + * For the specified requester(user/service) return the corresponding Role Token that + * includes the list of roles that the principal has access to in the specified domain + * @param domainName name of the domain + * @param roleName (optional) only interested in roles with this name + * @param minExpiryTime (optional) specifies that the returned RoleToken must be + * at least valid (min/lower bound) for specified number of seconds, + * @param maxExpiryTime (optional) specifies that the returned RoleToken must be + * at most valid (max/upper bound) for specified number of seconds. + * @param ignoreCache ignore the cache and retrieve the token from ZTS Server + * @param proxyForPrincipal (optional) this request is proxy for this principal + * @return ZTS generated Role Token. ZTSClientException will be thrown in case of failure + */ + public RoleToken getRoleToken(String domainName, String roleName, Integer minExpiryTime, + Integer maxExpiryTime, boolean ignoreCache, String proxyForPrincipal) { + + RoleToken roleToken = null; + + // first lookup in our cache to see if it can be satisfied + // only if we're not asked to ignore the cache + + String cacheKey = null; + if (!cacheDisabled) { + cacheKey = getRoleTokenCacheKey(domainName, roleName, proxyForPrincipal); + if (cacheKey != null && !ignoreCache) { + roleToken = lookupRoleTokenInCache(cacheKey, minExpiryTime, maxExpiryTime); + if (roleToken != null) { + return roleToken; + } + // start prefetch for this token if prefetch is enabled + if (enablePrefetch && prefetchAutoEnable) { + if (prefetchRoleToken(domainName, roleName, minExpiryTime, maxExpiryTime, proxyForPrincipal)) { + roleToken = lookupRoleTokenInCache(cacheKey, minExpiryTime, maxExpiryTime); + } + if (roleToken != null) { + return roleToken; + } + LOG.error("GetRoleToken: cache prefetch and lookup error"); + } + } + } + + // 2nd look in service providers + // + for (ZTSClientService provider: ZTS_TOKEN_PROVIDERS) { + if (LOG.isDebugEnabled()) { + LOG.debug("getRoleToken: found service provider=" + provider); + } + + // provider needs to know who the client is so we'll be passing + // the client's domain and service names as the first two fields + + roleToken = provider.fetchToken(domain, service, domainName, roleName, + minExpiryTime, maxExpiryTime, proxyForPrincipal); + if (roleToken != null) { + if (LOG.isDebugEnabled()) { + LOG.debug("getRoleToken: service provider=" + provider + " returns token"); + } + return roleToken; + } + } + + // if no hit then we need to request a new token from ZTS + + updateServicePrincipal(); + try { + roleToken = ztsClient.getRoleToken(domainName, roleName, + minExpiryTime, maxExpiryTime, proxyForPrincipal); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + + // need to add the token to our cache. If our principal was + // updated then we need to retrieve a new cache key + + if (!cacheDisabled) { + if (cacheKey == null) { + cacheKey = getRoleTokenCacheKey(domainName, roleName, proxyForPrincipal); + } + if (cacheKey != null) { + ROLE_TOKEN_CACHE.put(cacheKey, roleToken); + } + } + return roleToken; + } + + private static class RolePrefetchTask extends TimerTask { + + @Override + public void run() { + long currentTime = System.currentTimeMillis() / 1000; + FETCHER_LAST_RUN_AT.set(currentTime); + + if (LOG.isDebugEnabled()) { + LOG.debug("RolePrefetchTask: Fetching role token from the scheduled queue. Size=" + PREFETCH_SCHEDULED_ITEMS.size()); + } + if (PREFETCH_SCHEDULED_ITEMS.isEmpty()) { + if (LOG.isDebugEnabled()) { + LOG.debug("RolePrefetchTask: No items to fetch. Queue is empty"); + } + return; + } + + List toFetch = new ArrayList<>(PREFETCH_SCHEDULED_ITEMS.size()); + synchronized (PREFETCH_SCHEDULED_ITEMS) { + // if this item is to be fetched now, add it to collection + for (PrefetchRoleTokenScheduledItem item : PREFETCH_SCHEDULED_ITEMS) { + // see if item expires within next two minutes + long expiryTime = item.expiresAtUTC - (currentTime + FETCH_EPSILON + prefetchInterval); + if (LOG.isDebugEnabled()) { + LOG.debug("RolePrefetchTask: item=" + item.identityDomain + "." + item.identityName + + " domain=" + item.domainName + " suffix=" + item.roleName + + ": to be expired at " + expiryTime); + } + if (isExpiredToken(expiryTime, item.minDuration, item.maxDuration, item.tokenMinExpiryTime)) { + if (LOG.isDebugEnabled()) { + LOG.debug("RolePrefetchTask: item=" + item.identityDomain + "." + + item.identityName + " domain=" + item.domainName + + " roleName=" + item.roleName + ": expired. Fetch this item. " + expiryTime); + } + toFetch.add(item); + } + } + } + + // if toFetch is not empty, fetch those tokens, and add refreshed scheduled items back to the queue + if (!toFetch.isEmpty()) { + Set oldSvcLoaderCache = SVC_LOADER_CACHE_KEYS.get(); + Set newSvcLoaderCache = null; + // fetch items + for (PrefetchRoleTokenScheduledItem item : toFetch) { + // create ZTS Client for this particular item + try (ZTSClient itemZtsClient = new ZTSClient(item.identityDomain, item.identityName)) { + + if (item.siaClient != null) { + itemZtsClient.siaClient = item.siaClient; + } + if (item.ztsClient != null) { + itemZtsClient.ztsClient = item.ztsClient; + } + if (item.isRoleToken()) { + // check if this came from service provider + // + String key = itemZtsClient.getRoleTokenCacheKey(item.domainName, item.roleName, + item.proxyForPrincipal); + if (oldSvcLoaderCache.contains(key)) { + // if haven't gotten the new list of service + // loader tokens then get it now + if (newSvcLoaderCache == null) { + newSvcLoaderCache = loadSvcProviderTokens(); + } + // check if the key is in the new key set + // - if not, mark the item as invalid + if (!newSvcLoaderCache.contains(key)) { + item.invalid(true); + } + } else { + RoleToken token = itemZtsClient.getRoleToken(item.domainName, item.roleName, + item.minDuration, item.maxDuration, true, item.proxyForPrincipal); + // update the expire time + item.expiresAtUTC(token.getExpiryTime()); + } + } else { + AWSTemporaryCredentials awsCred = itemZtsClient.getAWSTemporaryCredentials(item.domainName, + item.roleName, true); + item.expiresAtUTC(awsCred.getExpiration().millis() / 1000); + } + } catch (Exception ex) { + // any exception should remove this item from fetch queue + item.invalid(true); + PREFETCH_SCHEDULED_ITEMS.remove(item); + LOG.error("RolePrefetchTask: Error while trying to prefetch token, msg=" + + ex.getMessage(), ex); + } + } + + // remove all invalid items. + toFetch.removeIf(p -> p.invalid); + + // now, add items back. + if (!toFetch.isEmpty()) { + synchronized (PREFETCH_SCHEDULED_ITEMS) { + // make sure there are no items of common + PREFETCH_SCHEDULED_ITEMS.removeAll(toFetch); + // add them back + PREFETCH_SCHEDULED_ITEMS.addAll(toFetch); + } + } + } + } + } + + // method useful for test purposes only + int getScheduledItemsSize() { + synchronized (PREFETCH_SCHEDULED_ITEMS) { + // ConcurrentLinkedQueue.size() method is typically not very useful in concurrent applications + return PREFETCH_SCHEDULED_ITEMS.size(); + } + } + + /** + * Pre-fetches role tokens so that the client does not take the hit of + * contacting ZTS Server for its first request (avg ~75ms). The client + * library will automatically try to keep the cache up to date such + * that the tokens are never expired and regular getRoleToken requests + * are fulfilled from the cache instead of contacting ZTS Server. + * @param domainName name of the domain + * @param roleName (optional) only interested in roles with this name + * @param minExpiryTime (optional) specifies that the returned RoleToken must be + * at least valid (min/lower bound) for specified number of seconds, + * @param maxExpiryTime (optional) specifies that the returned RoleToken must be + * at most valid (max/upper bound) for specified number of seconds. + * @return true if all is well, else false + */ + boolean prefetchRoleToken(String domainName, String roleName, + Integer minExpiryTime, Integer maxExpiryTime) { + + return prefetchRoleToken(domainName, roleName, minExpiryTime, maxExpiryTime, null); + } + + /** + * Pre-fetches role tokens so that the client does not take the hit of + * contacting ZTS Server for its first request (avg ~75ms). The client + * library will automatically try to keep the cache up to date such + * that the tokens are never expired and regular getRoleToken requests + * are fulfilled from the cache instead of contacting ZTS Server. + * @param domainName name of the domain + * @param roleName (optional) only interested in roles with this name + * @param minExpiryTime (optional) specifies that the returned RoleToken must be + * at least valid (min/lower bound) for specified number of seconds, + * @param maxExpiryTime (optional) specifies that the returned RoleToken must be + * at most valid (max/upper bound) for specified number of seconds. + * @param proxyForPrincipal (optional) request is proxy for this principal + * @return true if all is well, else false + */ + boolean prefetchRoleToken(String domainName, String roleName, + Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal) { + return prefetchToken(domainName, roleName, minExpiryTime, maxExpiryTime, proxyForPrincipal, true); + } + + boolean prefetchAwsCred(String domainName, String roleName, Integer minExpiryTime, Integer maxExpiryTime) { + return prefetchToken(domainName, roleName, minExpiryTime, maxExpiryTime, null, false); + } + + boolean prefetchToken(String domainName, String roleName, Integer minExpiryTime, + Integer maxExpiryTime, String proxyForPrincipal, boolean isRoleToken) { + + if (domainName == null || domainName.trim().isEmpty()) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, "Domain Name cannot be empty"); + } + + long expiryTimeUTC = 0; + if (isRoleToken) { + RoleToken token = getRoleToken(domainName, roleName, minExpiryTime, maxExpiryTime, true, proxyForPrincipal); + if (token == null) { + if (LOG.isWarnEnabled()) { + LOG.warn("PrefetchToken: No token fetchable using given params, domain=" + domainName + + ", roleSuffix=" + roleName); + } + return false; + } + expiryTimeUTC = token.getExpiryTime(); + } else { + AWSTemporaryCredentials awsCred = getAWSTemporaryCredentials(domainName, roleName, true); + if (awsCred == null) { + if (LOG.isWarnEnabled()) { + LOG.warn("PrefetchToken: No aws credential fetchable using given params, domain=" + domainName + + ", roleName=" + roleName); + } + return false; + } + expiryTimeUTC = awsCred.getExpiration().millis() / 1000; + } + + if (enablePrefetch == false || domain == null || domain.isEmpty() || service == null || service.isEmpty()) { + if (LOG.isWarnEnabled()) { + LOG.warn("PrefetchToken: Failure to setup ongoing prefetch of tokens. Both domain(" + + domain + ") and service(" + service + ") is required"); + } + return false; + } + PrefetchRoleTokenScheduledItem item = new PrefetchRoleTokenScheduledItem() + .isRoleToken(isRoleToken) + .domainName(domainName) + .roleName(roleName) + .proxyForPrincipal(proxyForPrincipal) + .minDuration(minExpiryTime) + .maxDuration(maxExpiryTime) + .expiresAtUTC(expiryTimeUTC) + .identityDomain(domain) + .identityName(service) + .tokenMinExpiryTime(ZTSClient.tokenMinExpiryTime) + .providedZTSUrl(this.ztsUrl) + .ztsClient(this.ztsClient) + .siaClient(this.siaClient); + + if (!PREFETCH_SCHEDULED_ITEMS.contains(item)) { + PREFETCH_SCHEDULED_ITEMS.add(item); + } else { + // contains item based on these 6 fields: + // domainName identityDomain identityName suffix trustDomain isRoleToken + // + // So need to remove and append since the new token expiry has changed + // .expiresAtUTC(token.getExpiryTime()) + // + PREFETCH_SCHEDULED_ITEMS.remove(item); + PREFETCH_SCHEDULED_ITEMS.add(item); + } + + if (FETCH_TIMER == null) { + synchronized (TIMER_LOCK) { + if (FETCH_TIMER == null) { + FETCH_TIMER = new Timer(); + // check the fetch items every prefetchInterval seconds. + FETCH_TIMER.schedule(new RolePrefetchTask(), 0, prefetchInterval * 1000); + } + } + } + + return true; + } + + String getRoleTokenCacheKey(String domainName, String roleName) { + return getRoleTokenCacheKey(domainName, roleName, null); + } + + String getRoleTokenCacheKey(String domainName, String roleName, String proxyForPrincipal) { + + // before we generate a cache key we need to have a valid domain + + if (domain == null) { + return null; + } + + StringBuilder cacheKey = new StringBuilder(256); + cacheKey.append("p="); + cacheKey.append(domain); + if (service != null) { + cacheKey.append(".").append(service); + } + + cacheKey.append(";d="); + cacheKey.append(domainName); + + if (roleName != null && !roleName.isEmpty()) { + cacheKey.append(";r="); + cacheKey.append(roleName); + } + if (proxyForPrincipal != null && !proxyForPrincipal.isEmpty()) { + cacheKey.append(";u="); + cacheKey.append(proxyForPrincipal); + } + + return cacheKey.toString(); + } + + boolean isExpiredToken(long expiryTime, Integer minExpiryTime, Integer maxExpiryTime) { + return isExpiredToken(expiryTime, minExpiryTime, maxExpiryTime, ZTSClient.tokenMinExpiryTime); + } + + static boolean isExpiredToken(long expiryTime, Integer minExpiryTime, Integer maxExpiryTime, int tokenMinExpiryTime) { + + // we'll first make sure if we're given both min and max expiry + // times then both conditions are satisfied + if (minExpiryTime != null && expiryTime < minExpiryTime) { + return true; + } + + if (maxExpiryTime != null && expiryTime > maxExpiryTime) { + return true; + } + + // if both limits were null then we need to make sure + // that our token is valid for based on our min configured value + + if (minExpiryTime == null && maxExpiryTime == null && expiryTime < tokenMinExpiryTime) { + return true; + } + + return false; + } + + RoleToken lookupRoleTokenInCache(String cacheKey, Integer minExpiryTime, Integer maxExpiryTime) { + + RoleToken roleToken = ROLE_TOKEN_CACHE.get(cacheKey); + if (roleToken == null) { + if (LOG.isInfoEnabled()) { + LOG.info("LookupRoleTokenInCache: cache-lookup key: " + cacheKey + " result: not found"); + } + return null; + } + + // before returning our cache hit we need to make sure it + // satisfies the time requirements as specified by the client + + long expiryTime = roleToken.getExpiryTime() - (System.currentTimeMillis() / 1000); + + if (isExpiredToken(expiryTime, minExpiryTime, maxExpiryTime, tokenMinExpiryTime)) { + + if (LOG.isInfoEnabled()) { + LOG.info("LookupRoleTokenInCache: role-cache-lookup key: " + cacheKey + " token-expiry: " + expiryTime + + " req-min-expiry: " + minExpiryTime + " req-max-expiry: " + maxExpiryTime + + " client-min-expiry: " + tokenMinExpiryTime + " result: expired"); + } + + ROLE_TOKEN_CACHE.remove(cacheKey); + return null; + } + + return roleToken; + } + + AWSTemporaryCredentials lookupAwsCredInCache(String cacheKey, Integer minExpiryTime, Integer maxExpiryTime) { + + AWSTemporaryCredentials awsCred = awsCredCache.get(cacheKey); + if (awsCred == null) { + if (LOG.isInfoEnabled()) { + LOG.info("LookupAwsCredInCache: aws-cache-lookup key: " + cacheKey + " result: not found"); + } + return null; + } + + // before returning our cache hit we need to make sure it + // satisfies the time requirements as specified by the client + + long expiryTime = awsCred.getExpiration().millis() - System.currentTimeMillis(); + expiryTime /= 1000; // expiry time is in seconds + + if (isExpiredToken(expiryTime, minExpiryTime, maxExpiryTime, tokenMinExpiryTime)) { + + if (LOG.isInfoEnabled()) { + LOG.info("LookupAwsCredInCache: aws-cache-lookup key: " + cacheKey + " token-expiry: " + expiryTime + + " req-min-expiry: " + minExpiryTime + " req-max-expiry: " + maxExpiryTime + + " client-min-expiry: " + tokenMinExpiryTime + " result: expired"); + } + + awsCredCache.remove(cacheKey); + return null; + } + + return awsCred; + } + + /** + * Retrieve the list of roles that the given principal has access to in the domain + * @param domainName name of the domain + * @param principal name of the principal + * @return RoleAccess object on success. ZTSClientException will be thrown in case of failure + */ + public RoleAccess getRoleAccess(String domainName, String principal) { + updateServicePrincipal(); + try { + return ztsClient.getRoleAccess(domainName, principal); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getMessage()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the specified service object from a domain + * @param domainName name of the domain + * @param serviceName name of the service to be retrieved + * @return ServiceIdentity object on success. ZTSClientException will be thrown in case of failure + */ + public ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + updateServicePrincipal(); + try { + return ztsClient.getServiceIdentity(domainName, serviceName); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the specified public key from the given service object + * @param domainName name of the domain + * @param serviceName name of the service + * @param keyId the identifier of the public key to be retrieved + * @return PublicKeyEntry object or ZTSClientException will be thrown in case of failure + */ + public PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, String keyId) { + try { + return ztsClient.getPublicKeyEntry(domainName, serviceName, keyId); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Retrieve the full list of services defined in a domain + * @param domainName name of the domain + * @return list of all service names on success. ZTSClientException will be thrown in case of failure + */ + public ServiceIdentityList getServiceIdentityList(String domainName) { + updateServicePrincipal(); + try { + return ztsClient.getServiceIdentityList(domainName); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * For a given provider domain get a list of tenant domain names that the user is a member of + * @param providerDomainName name of the provider domain + * @param userName is the name of the user to search for in the tenant domains of the provider + * @param roleName is the name of the role to filter on when searching through the list of tenants with + * the specified role name. + * @param serviceName is the name of the service to filter on that the tenant has on-boarded to + * @return TenantDomains object which contains a list of tenant domain names for a given provider + * domain, that the user is a member of + */ + public TenantDomains getTenantDomains(String providerDomainName, String userName, + String roleName, String serviceName) { + updateServicePrincipal(); + try { + return ztsClient.getTenantDomains(providerDomainName, userName, roleName, serviceName); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Request by a service to refresh its NToken. The original NToken must have been + * obtained by an authorized service by calling the postInstanceTenantRequest + * method. + * @param domain Name of the domain + * @param service Name of the service + * @param req InstanceRefreshRequest object for th request + * @return Identity object that includes a refreshed NToken for the service + */ + public Identity postInstanceRefreshRequest(String domain, String service, InstanceRefreshRequest req) { + updateServicePrincipal(); + try { + return ztsClient.postInstanceRefreshRequest(domain, service, req); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * For a given domain and role return AWS temporary credentials + * @param domainName name of the domain + * @param roleName is the name of the role + * @return AWSTemporaryCredentials AWS credentials + */ + public AWSTemporaryCredentials getAWSTemporaryCredentials(String domainName, String roleName) { + + return getAWSTemporaryCredentials(domainName, roleName, false); + } + + public AWSTemporaryCredentials getAWSTemporaryCredentials(String domainName, String roleName, boolean ignoreCache) { + + // first lookup in our cache to see if it can be satisfied + // only if we're not asked to ignore the cache + + AWSTemporaryCredentials awsCred = null; + String cacheKey = getRoleTokenCacheKey(domainName, roleName, null); + if (cacheKey != null && !ignoreCache) { + awsCred = lookupAwsCredInCache(cacheKey, null, null); + if (awsCred != null) { + return awsCred; + } + // start prefetch for this token if prefetch is enabled + if (enablePrefetch && prefetchAutoEnable) { + if (prefetchAwsCred(domainName, roleName, null, null)) { + awsCred = lookupAwsCredInCache(cacheKey, null, null); + } + if (awsCred != null) { + return awsCred; + } + LOG.error("GetAWSTemporaryCredentials: cache prefetch and lookup error"); + } + } + + // if no hit then we need to request a new token from ZTS + + updateServicePrincipal(); + + try { + awsCred = ztsClient.getAWSTemporaryCredentials(domainName, roleName); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + + // need to add the token to our cache. If our principal was + // updated then we need to retrieve a new cache key + + if (cacheKey == null) { + cacheKey = getRoleTokenCacheKey(domainName, roleName, null); + } + if (cacheKey != null) { + awsCredCache.put(cacheKey, awsCred); + } + return awsCred; + } + + /** + * Retrieve the list of all policies (not just names) from the ZTS Server that + * is signed with both ZTS's and ZMS's private keys. It will pass an option matchingTag + * so that ZTS can skip returning signed policies if no changes have taken + * place since that tag was issued. + * @param domainName name of the domain + * @param matchingTag name of the tag issued with last request + * @param responseHeaders contains the "tag" returned for modification + * time of the policies, map key = "tag", List should contain a single value + * @return list of policies signed by ZTS Server. ZTSClientException will be thrown in case of failure + */ + public DomainSignedPolicyData getDomainSignedPolicyData(String domainName, String matchingTag, + Map> responseHeaders) { + try { + DomainSignedPolicyData sp = ztsClient.getDomainSignedPolicyData(domainName, matchingTag, responseHeaders); + return sp; + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Verify if the given principal has access to the specified role in the + * domain or not. + * @param domainName name of the domain + * @param roleName name of the role + * @param principal name of the principal to check for + * @return Access object with grant true/false response. ZTSClientException will be thrown in case of failure + */ + public Access getAccess(String domainName, String roleName, String principal) { + updateServicePrincipal(); + try { + return ztsClient.getAccess(domainName, roleName, principal); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + /** + * Caller may post set of domain metric attributes for monitoring and logging. + * ZTSClientException will be thrown in case of failure + * @param domainName name of the domain + * @param req list of domain metrics with their values + */ + public void postDomainMetrics(String domainName, DomainMetrics req) { + updateServicePrincipal(); + try { + ztsClient.postDomainMetrics(domainName, req); + } catch (ResourceException ex) { + throw new ZTSClientException(ex.getCode(), ex.getData()); + } catch (Exception ex) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, ex.getMessage()); + } + } + + static class PrefetchRoleTokenScheduledItem { + + boolean isRoleToken = true; + PrefetchRoleTokenScheduledItem isRoleToken(boolean isRole) { + isRoleToken = isRole; + return this; + } + boolean isRoleToken() { + return isRoleToken; + } + + String providedZTSUrl; + PrefetchRoleTokenScheduledItem providedZTSUrl(String u) { + providedZTSUrl = u; + return this; + } + + SIA siaClient; + PrefetchRoleTokenScheduledItem siaClient(SIA s) { + siaClient = s; + return this; + } + + ZTSRDLGeneratedClient ztsClient; + PrefetchRoleTokenScheduledItem ztsClient(ZTSRDLGeneratedClient z) { + ztsClient = z; + return this; + } + + boolean invalid; + PrefetchRoleTokenScheduledItem invalid(boolean i) { + invalid = i; + return this; + } + + String identityDomain; + PrefetchRoleTokenScheduledItem identityDomain(String d) { + identityDomain = d; + return this; + } + + String identityName; + PrefetchRoleTokenScheduledItem identityName(String d) { + identityName = d; + return this; + } + + String domainName; + PrefetchRoleTokenScheduledItem domainName(String d) { + domainName = d; + return this; + } + + String roleName; + PrefetchRoleTokenScheduledItem roleName(String s) { + roleName = s; + return this; + } + + String proxyForPrincipal; + PrefetchRoleTokenScheduledItem proxyForPrincipal(String u) { + proxyForPrincipal = u; + return this; + } + + Integer minDuration; + PrefetchRoleTokenScheduledItem minDuration(Integer min) { + minDuration = min; + return this; + } + + Integer maxDuration; + PrefetchRoleTokenScheduledItem maxDuration(Integer max) { + maxDuration = max; + return this; + } + + long expiresAtUTC; + PrefetchRoleTokenScheduledItem expiresAtUTC(long e) { + expiresAtUTC = e; + return this; + } + + int tokenMinExpiryTime; + PrefetchRoleTokenScheduledItem tokenMinExpiryTime(int t) { + tokenMinExpiryTime = t; + return this; + } + + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((domainName == null) ? 0 : domainName.hashCode()); + result = prime * result + ((identityDomain == null) ? 0 : identityDomain.hashCode()); + result = prime * result + ((identityName == null) ? 0 : identityName.hashCode()); + result = prime * result + ((roleName == null) ? 0 : roleName.hashCode()); + result = prime * result + ((proxyForPrincipal == null) ? 0 : proxyForPrincipal.hashCode()); + result = prime * result + Boolean.hashCode(isRoleToken); + + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + PrefetchRoleTokenScheduledItem other = (PrefetchRoleTokenScheduledItem) obj; + if (domainName == null) { + if (other.domainName != null) { + return false; + } + } else if (!domainName.equals(other.domainName)) { + return false; + } + if (identityDomain == null) { + if (other.identityDomain != null) { + return false; + } + } else if (!identityDomain.equals(other.identityDomain)) { + return false; + } + if (identityName == null) { + if (other.identityName != null) { + return false; + } + } else if (!identityName.equals(other.identityName)) { + return false; + } + if (roleName == null) { + if (other.roleName != null) { + return false; + } + } else if (!roleName.equals(other.roleName)) { + return false; + } + if (proxyForPrincipal == null) { + if (other.proxyForPrincipal != null) { + return false; + } + } else if (!proxyForPrincipal.equals(other.proxyForPrincipal)) { + return false; + } + return true; + } + + } + + public class AWSHostNameVerifier implements HostnameVerifier { + + String dnsHostname = null; + + public AWSHostNameVerifier(String hostname) { + dnsHostname = hostname; + } + + @Override + public boolean verify(String hostname, SSLSession session) { + + Certificate[] certs = null; + try { + certs = session.getPeerCertificates(); + } catch (SSLPeerUnverifiedException e) { + } + if (certs == null) { + return false; + } + + for (Certificate cert : certs) { + try { + X509Certificate x509Cert = (X509Certificate) cert; + if (matchDnsHostname(x509Cert.getSubjectAlternativeNames())) { + return true; + } + } catch (CertificateParsingException e) { + } + } + return false; + } + + boolean matchDnsHostname(Collection> altNames) { + + if (altNames == null) { + return false; + } + + // GeneralName ::= CHOICE { + // otherName [0] OtherName, + // rfc822Name [1] IA5String, + // dNSName [2] IA5String, + // x400Address [3] ORAddress, + // directoryName [4] Name, + // ediPartyName [5] EDIPartyName, + // uniformResourceIdentifier [6] IA5String, + // iPAddress [7] OCTET STRING, + // registeredID [8] OBJECT IDENTIFIER} + + for (@SuppressWarnings("rawtypes") List item : altNames) { + Integer type = (Integer) item.get(0); + if (type == 2) { + String dns = (String) item.get(1); + if (dnsHostname.equalsIgnoreCase(dns)) { + return true; + } + } + } + + return false; + } + } + + private static Set loadSvcProviderTokens() { + + // if have service loader implementations, then stuff role tokens into cache + // and keep track of these tokens so that they will get refreshed from + // service loader and not zts server + + Set cacheKeySet = new HashSet<>(); + for (ZTSClientService provider: ZTS_TOKEN_PROVIDERS) { + Collection descs = provider.loadTokens(); + if (descs == null) { + if (LOG.isInfoEnabled()) { + LOG.info("loadSvcProviderTokens: provider didn't return tokens: prov=" + provider); + } + continue; + } + for (ZTSClientService.RoleTokenDescriptor desc: descs) { + if (desc.signedToken != null) { + // stuff token in cache and record service loader key + String key = cacheSvcProvRoleToken(desc); + if (key != null) { + cacheKeySet.add(key); + } + } + } + } + + SVC_LOADER_CACHE_KEYS.set(cacheKeySet); + return cacheKeySet; + } + + /** + * stuff pre-loaded service token in cache. in this model an external + * service (proxy user) has retrieved the role tokens and added to the + * client cache so it can run without the need to contact zts server. + * in this model we're going to look at the principal field only and + * ignore the proxy field since the client doesn't need to know anything + * about that detail. + * + * start prefetch task to reload to prevent expiry + * return the cache key used + */ + static String cacheSvcProvRoleToken(ZTSClientService.RoleTokenDescriptor desc) { + + if (cacheDisabled) { + return null; + } + + com.yahoo.athenz.auth.token.RoleToken rt = new com.yahoo.athenz.auth.token.RoleToken(desc.getSignedToken()); + String domainName = rt.getDomain(); + String principalName = rt.getPrincipal(); + boolean completeRoleSet = rt.getDomainCompleteRoleSet(); + List roles = rt.getRoles(); + + // before doing anything else we need to see if we can cache this + // token - the requirement is either we have a full set or + // if it's not then we must have a single role in the list + + if (!completeRoleSet && roles.size() != 1) { + LOG.error("cacheSvcProvRoleToken: Unable to determine original rolename query: " + rt.getUnsignedToken()); + return null; + } + + // if the role token was for a complete set then we're not going + // to use the rolename field (it indicates that the original request + // was completed without the rolename field being specified) + + final String roleName = (completeRoleSet) ? null : rt.getRoles().get(0); + + // parse principalName for the tenant domain and service name + // we must have valid components otherwise we'll just + // ignore the token - you can't have a principal without + // valid domain and service names + + int index = principalName.lastIndexOf('.'); // ex: cities.burbank.mysvc + if (index == -1) { + LOG.error("cacheSvcProvRoleToken: Invalid principal in token: " + rt.getSignedToken()); + return null; + } + + final String tenantDomain = principalName.substring(0, index); + final String tenantService = principalName.substring(index + 1); + Long expiryTime = rt.getExpiryTime(); + + RoleToken roleToken = new RoleToken().setToken(desc.getSignedToken()).setExpiryTime(expiryTime); + + String key = null; + try (ZTSClient clt = new ZTSClient(tenantDomain, tenantService)) { + + key = clt.getRoleTokenCacheKey(domainName, roleName, null); + + if (LOG.isInfoEnabled()) { + LOG.info("cacheSvcProvRoleToken: cache-add key: " + key + " expiry: " + expiryTime); + } + + ROLE_TOKEN_CACHE.put(key, roleToken); + } + + // setup prefetch task + + Long expiryTimeUTC = roleToken.getExpiryTime(); + prefetchSvcProvTokens(tenantDomain, tenantService, domainName, + roleName, null, null, expiryTimeUTC, null); + + return key; + } + + static void prefetchSvcProvTokens(String domain, String service, String domainName, + String roleName, Integer minExpiryTime, Integer maxExpiryTime, + Long expiryTimeUTC, String proxyForPrincipal) { + + if (domainName == null || domainName.trim().isEmpty()) { + throw new ZTSClientException(ZTSClientException.BAD_REQUEST, "Domain Name cannot be empty"); + } + + PrefetchRoleTokenScheduledItem item = new PrefetchRoleTokenScheduledItem() + .isRoleToken(true) + .domainName(domainName) + .roleName(roleName) + .proxyForPrincipal(proxyForPrincipal) + .minDuration(minExpiryTime) + .maxDuration(maxExpiryTime) + .expiresAtUTC(expiryTimeUTC) + .identityDomain(domain) + .identityName(service) + .tokenMinExpiryTime(ZTSClient.tokenMinExpiryTime); + + if (PREFETCH_SCHEDULED_ITEMS.contains(item)) { + // contains item based on these 5 fields: + // domainName identityDomain identityName roleName proxyForProfile isRoleToken + // + // So need to remove and append since the new token expiry has changed + // .expiresAtUTC(token.getExpiryTime()) + // + PREFETCH_SCHEDULED_ITEMS.remove(item); + } + PREFETCH_SCHEDULED_ITEMS.add(item); + + if (FETCH_TIMER == null) { + synchronized (TIMER_LOCK) { + if (FETCH_TIMER == null) { + FETCH_TIMER = new Timer(); + // check the fetch items every prefetchInterval seconds. + FETCH_TIMER.schedule(new RolePrefetchTask(), 0, prefetchInterval * 1000); + } + } + } + } +} diff --git a/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientException.java b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientException.java new file mode 100644 index 00000000000..78b33111b4a --- /dev/null +++ b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientException.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +public class ZTSClientException extends ResourceException { + + private static final long serialVersionUID = -2191523509996056171L; + + public ZTSClientException(int code, Object data) { + super(code, data); + } +} diff --git a/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientService.java b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientService.java new file mode 100644 index 00000000000..0ba6e68b665 --- /dev/null +++ b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientService.java @@ -0,0 +1,83 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import java.util.Collection; + +/* + * Service Providers will implement this interface for special env needs + * whereby retrieving a role token from zts server may not be feasible. + * The provider implementation will need to be specified in the clients package + * in the file: META-INF/services/com.yahoo.athenz.zts.ZTSClientService + **/ +public interface ZTSClientService { + + /** + * Athenz token client cache entry + */ + public static class RoleTokenDescriptor { + + /** + * Construct the object with any needed params. Note there are no setters. + * @param signedToken signed role token from zts - required + */ + public RoleTokenDescriptor(String signedToken) { + this.signedToken = signedToken; + } + + public String getSignedToken() { + return signedToken; + } + + final String signedToken; + } + + /** + * ZTSClient calls to pre-load the Athens client token cache. + * @return collection of RoleTokenDescriptor objects that include + * the service retrieved role tokens. It can return either an + * empty set or null if there are no tokens to pre-load. + */ + default public Collection loadTokens() { + return null; + } + + /** + * ZTSClient will use this implementation to get a role token and avoid using the + * cache if a token is returned. If no token is returned, ZTSClient will process + * in the usual way - lookup in the cache (if not disabled) and then if not + * found contact ZTS Server directly to retrieve the role token. + * + * For the specified requester(user/service) return the corresponding Role Token that + * includes the list of roles that the principal has access to in the specified domain + * @param clientDomainName client's domain name that is requesting this role token + * @param clientServiceName client's service name that is requesting this role token + * @param domainName name of the domain to retrieve a role from + * @param roleName (optional) only interested in roles with this value + * @param minExpiryTime (optional) specifies that the returned RoleToken must be + * at least valid (min/lower bound) for specified number of seconds, + * @param maxExpiryTime (optional) specifies that the returned RoleToken must be + * at most valid (max/upper bound) for specified number of seconds. + * @param proxyForPrincipal (optional) this request is proxy for this principal + * @return ZTS generated Role Token. Must return null if not available/found. + */ + default public RoleToken fetchToken(String clientDomainName, String clientServiceName, + String domainName, String roleName, Integer minExpiryTime, Integer maxExpiryTime, + String proxyForPrincipal) { + return null; + } +} + diff --git a/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientTokenCacher.java b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientTokenCacher.java new file mode 100644 index 00000000000..dab64865363 --- /dev/null +++ b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSClientTokenCacher.java @@ -0,0 +1,61 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class ZTSClientTokenCacher { + + private static final Logger LOG = LoggerFactory.getLogger(ZTSClientTokenCacher.class); + + public static void setRoleToken(String signedRoleToken, String roleName, String trustDomain) { + + // parse domain, roles, principalName, and expiry out of the token + + com.yahoo.athenz.auth.token.RoleToken rt = new com.yahoo.athenz.auth.token.RoleToken(signedRoleToken); + + String domainName = rt.getDomain(); + String principalName = rt.getPrincipal(); + + // parse principalName for the tenant domain and service name + // if we have an invalid principal name then we'll just skip + + String tenantDomain = null; + String serviceName = null; + int index = principalName.lastIndexOf('.'); // ex: cities.burbank.mysvc + if (index == -1) { + return; + } + + tenantDomain = principalName.substring(0, index); + serviceName = principalName.substring(index + 1); + Long expiryTime = rt.getExpiryTime(); + + RoleToken roleToken = new RoleToken().setToken(signedRoleToken).setExpiryTime(expiryTime); + + try (ZTSClient clt = new ZTSClient(tenantDomain, serviceName)) { + String key = clt.getRoleTokenCacheKey(domainName, roleName, null); + + if (LOG.isInfoEnabled()) { + LOG.info("ZTSTokenCache: cache-add key: " + key + " expiry: " + expiryTime); + } + + ZTSClient.ROLE_TOKEN_CACHE.put(key, roleToken); + } + } +} + diff --git a/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSRDLGeneratedClient.java b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSRDLGeneratedClient.java new file mode 100644 index 00000000000..79a9b6c342c --- /dev/null +++ b/clients/java/zts/src/main/java/com/yahoo/athenz/zts/ZTSRDLGeneratedClient.java @@ -0,0 +1,333 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +import com.yahoo.rdl.*; +import javax.ws.rs.client.*; +import javax.ws.rs.*; +import javax.ws.rs.core.*; +import javax.net.ssl.HostnameVerifier; + +public class ZTSRDLGeneratedClient { + Client client; + WebTarget base; + String credsHeader; + String credsToken; + + public ZTSRDLGeneratedClient(String url) { + client = ClientBuilder.newClient(); + base = client.target(url); + } + + public ZTSRDLGeneratedClient(String url, HostnameVerifier hostnameVerifier) { + client = ClientBuilder.newBuilder() + .hostnameVerifier(hostnameVerifier) + .build(); + base = client.target(url); + } + + public void close() { + client.close(); + } + + public ZTSRDLGeneratedClient setProperty(String name, Object value) { + client = client.property(name, value); + return this; + } + + public ZTSRDLGeneratedClient addCredentials(String header, String token) { + credsHeader = header; + credsToken = token; + return this; + } + + public ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + WebTarget target = base.path("/domain/{domainName}/service/{serviceName}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("serviceName", serviceName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ServiceIdentity.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public ServiceIdentityList getServiceIdentityList(String domainName) { + WebTarget target = base.path("/domain/{domainName}/service") + .resolveTemplate("domainName", domainName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(ServiceIdentityList.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, String keyId) { + WebTarget target = base.path("/domain/{domainName}/service/{serviceName}/publickey/{keyId}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("serviceName", serviceName) + .resolveTemplate("keyId", keyId); + Invocation.Builder invocationBuilder = target.request("application/json"); + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(PublicKeyEntry.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public HostServices getHostServices(String host) { + WebTarget target = base.path("/host/{host}/services") + .resolveTemplate("host", host); + Invocation.Builder invocationBuilder = target.request("application/json"); + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(HostServices.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DomainSignedPolicyData getDomainSignedPolicyData(String domainName, String matchingTag, java.util.Map> headers) { + WebTarget target = base.path("/domain/{domainName}/signed_policy_data") + .resolveTemplate("domainName", domainName); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (matchingTag != null) { + invocationBuilder = invocationBuilder.header("If-None-Match", matchingTag); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + case 304: + if (headers != null) { + headers.put("tag", java.util.Arrays.asList((String)response.getHeaders().getFirst("ETag"))); + } + if (code == 304) { + return null; + } + return response.readEntity(DomainSignedPolicyData.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public RoleToken getRoleToken(String domainName, String role, Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal) { + WebTarget target = base.path("/domain/{domainName}/token") + .resolveTemplate("domainName", domainName); + if (role != null) { + target = target.queryParam("role", role); + } + if (minExpiryTime != null) { + target = target.queryParam("minExpiryTime", minExpiryTime); + } + if (maxExpiryTime != null) { + target = target.queryParam("maxExpiryTime", maxExpiryTime); + } + if (proxyForPrincipal != null) { + target = target.queryParam("proxyForPrincipal", proxyForPrincipal); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(RoleToken.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Access getAccess(String domainName, String roleName, String principal) { + WebTarget target = base.path("/access/domain/{domainName}/role/{roleName}/principal/{principal}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("roleName", roleName) + .resolveTemplate("principal", principal); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Access.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public RoleAccess getRoleAccess(String domainName, String principal) { + WebTarget target = base.path("/access/domain/{domainName}/principal/{principal}") + .resolveTemplate("domainName", domainName) + .resolveTemplate("principal", principal); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(RoleAccess.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantDomains getTenantDomains(String providerDomainName, String userName, String roleName, String serviceName) { + WebTarget target = base.path("/providerdomain/{providerDomainName}/user/{userName}") + .resolveTemplate("providerDomainName", providerDomainName) + .resolveTemplate("userName", userName); + if (roleName != null) { + target = target.queryParam("roleName", roleName); + } + if (serviceName != null) { + target = target.queryParam("serviceName", serviceName); + } + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(TenantDomains.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Identity postInstanceInformation(InstanceInformation info) { + WebTarget target = base.path("/instance"); + Invocation.Builder invocationBuilder = target.request("application/json"); + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(info, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Identity.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Identity postInstanceRefreshRequest(String domain, String service, InstanceRefreshRequest req) { + WebTarget target = base.path("/instance/{domain}/{service}/refresh") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(req, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Identity.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Identity postAWSInstanceInformation(AWSInstanceInformation info) { + WebTarget target = base.path("/aws/instance"); + Invocation.Builder invocationBuilder = target.request("application/json"); + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(info, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Identity.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Identity postAWSCertificateRequest(String domain, String service, AWSCertificateRequest req) { + WebTarget target = base.path("/aws/instance/{domain}/{service}/refresh") + .resolveTemplate("domain", domain) + .resolveTemplate("service", service); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(req, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Identity.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public AWSTemporaryCredentials getAWSTemporaryCredentials(String domainName, String role) { + WebTarget target = base.path("/domain/{domainName}/role/{role}/creds") + .resolveTemplate("domainName", domainName) + .resolveTemplate("role", role); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(AWSTemporaryCredentials.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public DomainMetrics postDomainMetrics(String domainName, DomainMetrics req) { + WebTarget target = base.path("/metrics/{domainName}") + .resolveTemplate("domainName", domainName); + Invocation.Builder invocationBuilder = target.request("application/json"); + Response response = invocationBuilder.post(javax.ws.rs.client.Entity.entity(req, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(DomainMetrics.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + +} diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.core.JsonFactory b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.core.JsonFactory new file mode 100644 index 00000000000..8fdbde1f214 --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.core.JsonFactory @@ -0,0 +1 @@ +athenz.shade.zts.com.fasterxml.jackson.core.JsonFactory diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.core.ObjectCodec b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.core.ObjectCodec new file mode 100644 index 00000000000..8e5c5d1129a --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.core.ObjectCodec @@ -0,0 +1 @@ +athenz.shade.zts.com.fasterxml.jackson.databind.ObjectMapper diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.databind.Module b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.databind.Module new file mode 100644 index 00000000000..31b2acaf4da --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.com.fasterxml.jackson.databind.Module @@ -0,0 +1 @@ +athenz.shade.zts.com.fasterxml.jackson.module.jaxb.JaxbAnnotationModule diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.client.ClientBuilder b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.client.ClientBuilder new file mode 100644 index 00000000000..8cce2def714 --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.client.ClientBuilder @@ -0,0 +1 @@ +athenz.shade.zts.org.glassfish.jersey.client.JerseyClientBuilder diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.MessageBodyReader b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.MessageBodyReader new file mode 100644 index 00000000000..24ee78c9ea1 --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.MessageBodyReader @@ -0,0 +1 @@ +athenz.shade.zts.com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.MessageBodyWriter b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.MessageBodyWriter new file mode 100644 index 00000000000..24ee78c9ea1 --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.MessageBodyWriter @@ -0,0 +1 @@ +athenz.shade.zts.com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.RuntimeDelegate b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.RuntimeDelegate new file mode 100644 index 00000000000..ca9090ee738 --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.javax.ws.rs.ext.RuntimeDelegate @@ -0,0 +1 @@ +athenz.shade.zts.org.glassfish.jersey.internal.RuntimeDelegateImpl diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.org.glassfish.hk2.extension.ServiceLocatorGenerator b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.org.glassfish.hk2.extension.ServiceLocatorGenerator new file mode 100644 index 00000000000..15b62923421 --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.org.glassfish.hk2.extension.ServiceLocatorGenerator @@ -0,0 +1 @@ +athenz.shade.zts.org.jvnet.hk2.external.generator.ServiceLocatorGeneratorImpl diff --git a/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.org.glassfish.jersey.internal.spi.AutoDiscoverable b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.org.glassfish.jersey.internal.spi.AutoDiscoverable new file mode 100644 index 00000000000..ecae8c20568 --- /dev/null +++ b/clients/java/zts/src/main/resources/META-INF/services/athenz.shade.zts.org.glassfish.jersey.internal.spi.AutoDiscoverable @@ -0,0 +1,2 @@ +athenz.shade.zts.org.glassfish.jersey.jackson.internal.JacksonAutoDiscoverable +athenz.shade.zts.org.glassfish.jersey.logging.LoggingFeatureAutoDiscoverable diff --git a/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientMock.java b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientMock.java new file mode 100644 index 00000000000..de5bcf00a7e --- /dev/null +++ b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientMock.java @@ -0,0 +1,326 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import com.yahoo.rdl.Timestamp; + +public class ZTSClientMock extends ZTSRDLGeneratedClient implements java.io.Closeable { + + public ZTSClientMock() { + super("http://localhost:4080/"); + } + + public ZTSClientMock(String url) { + super(url); + } + + private long sleepInterval = 60; + private int expiryTime = 2400; + private String roleName = null; + private String policyName = null; + private List tenantDomains = null; + + Map credsMap = new HashMap<>(); + + private Map lastRoleTokenFetchedTime = new HashMap(); + + static String getKey(String domain, String roleName, String proxyForPrincipal) { + return domain + "-" + roleName + "-" + proxyForPrincipal; + } + + long getLastRoleTokenFetchedTime(String domain, String roleName) { + return getLastRoleTokenFetchedTime(domain, roleName, null); + } + + long getLastRoleTokenFetchedTime(String domain, String roleName, String proxyForPrincipal) { + String key = getKey(domain, roleName, proxyForPrincipal); + if (lastRoleTokenFetchedTime.containsKey(key)) { + return lastRoleTokenFetchedTime.get(key); + } + return -1; + } + + public void setTestSleepInterval(long intervalSecs) { + sleepInterval = intervalSecs; + } + + @Override + public HostServices getHostServices(String hostName) { + if (hostName == "not.exist.host") { + throw new ResourceException(404, "hostname not found"); + } + + HostServices hostServices = new HostServices().setHost(hostName) + .setNames(Arrays.asList("service1", "service2")); + return hostServices; + } + + @Override + public PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, + String keyId) { + if (domainName == "invalid.domain") { + throw new ResourceException(404, "invalid domain"); + } + + PublicKeyEntry publicKeyEntry = new PublicKeyEntry().setId(keyId).setKey("test-key"); + return publicKeyEntry; + } + + @Override + public RoleAccess getRoleAccess(String domainName, String principal) { + if (domainName.equals("exc")) { + throw new ResourceException(400, "Invalid request"); + } else if (domainName.equals("unknown")) { + throw new ResourceException(404, "Unknown domain"); + } + RoleAccess roleAccess = new RoleAccess(); + ArrayList roles = new ArrayList<>(); + roles.add("role1"); + roles.add("role2"); + roleAccess.setRoles(roles); + return roleAccess; + } + + @Override + public RoleToken getRoleToken(String domainName, String rName, + Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal) { + + if (rName != null && !roleName.endsWith(rName)) { + throw new ResourceException(403, "No access to any roles"); + } + + // calculate expiry time based on test domain name + long expireWindow = expiryTime; + if (domainName.equals("providerdomain")) { + expireWindow = sleepInterval + 10; + } + + List roles = new ArrayList<>(); + roles.add(roleName); + com.yahoo.athenz.auth.token.RoleToken token = + new com.yahoo.athenz.auth.token.RoleToken.Builder("Z1", domainName, roles) + .expirationWindow(expireWindow).keyId("0").proxyUser(proxyForPrincipal).build(); + RoleToken roleToken = new RoleToken(); + roleToken.setToken(token.getUnsignedToken()); + roleToken.setExpiryTime(token.getExpiryTime()); + String key = getKey(domainName, rName, proxyForPrincipal); + long lastUpdatedTime = System.currentTimeMillis(); + lastRoleTokenFetchedTime.put(key, lastUpdatedTime); + return roleToken; + } + + @Override + public ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + if (domainName == "unknown.domain") { + throw new ResourceException(404, "Domain not found"); + } + + ServiceIdentity serviceIdentity = new ServiceIdentity().setName(serviceName); + + return serviceIdentity; + } + + @Override + public ServiceIdentityList getServiceIdentityList(String domainName) { + if (domainName == "unknown.domain") { + throw new ResourceException(404, "Domain not found"); + } + + ServiceIdentityList serviceIdentityList = new ServiceIdentityList().setNames(Arrays.asList("storage")); + + return serviceIdentityList; + } + + public void setAwsCreds(Timestamp expiration, String domainName, String roleName) { + String key = domainName + ":" + roleName; + setAwsCreds(expiration, domainName, roleName, key + "session", key + "secret", key + "keyid"); + } + + public void setAwsCreds(Timestamp expiration, String domainName, String roleName, + String sessToken, String secretKey, String accessKeyId) { + + AWSTemporaryCredentials awsCreds = new AWSTemporaryCredentials(); + String key = domainName + ":" + roleName; + awsCreds.setExpiration(expiration).setSessionToken(sessToken). + setSecretAccessKey(secretKey).setAccessKeyId(accessKeyId); + + credsMap.put(key, awsCreds); + } + + @Override + public AWSTemporaryCredentials getAWSTemporaryCredentials(String domainName, String roleName) { + + if (credsMap.isEmpty()) { + throw new ZTSClientException(ZTSClientException.NOT_FOUND, "role is not assumed"); + } + String key = domainName + ":" + roleName; + AWSTemporaryCredentials creds = credsMap.get(key); + if (creds == null) { + return null; + } + + // calculate expiry time based on test domain name + long expireWindow = expiryTime; + if (domainName.equals("providerdomain")) { + expireWindow = sleepInterval + 10; + } + long expiration = System.currentTimeMillis() + (expireWindow * 1000); + String sessToken = Long.toString(expiration); + String oldSessToken = creds.getSessionToken(); + String keyid = creds.getAccessKeyId(); + String secret = creds.getSecretAccessKey(); + + creds = new AWSTemporaryCredentials(); + creds.setExpiration(Timestamp.fromMillis(expiration)); + creds.setAccessKeyId(keyid); + creds.setSecretAccessKey(secret); + + String []split = oldSessToken.split(":"); + creds.setSessionToken(split[0] + ":" + sessToken); + + key = getKey(domainName, roleName, null); + credsMap.put(key, creds); + long lastUpdatedTime = System.currentTimeMillis(); + lastRoleTokenFetchedTime.put(key, lastUpdatedTime); + + return creds; + } + + @Override + public DomainSignedPolicyData getDomainSignedPolicyData(String domainName, String matchingTag, + Map> responseHeaders) { + if (policyName == null) { + return null; + } else if (domainName == null) { + throw new ResourceException(400, "Invalid request"); + } + + Policy policy = new Policy(); + policy.setName(policyName); + + List policyList = new ArrayList<>(); + policyList.add(policy); + + PolicyData policyData = new PolicyData(); + policyData.setDomain(domainName); + policyData.setPolicies(policyList); + + SignedPolicyData signedPolicyData = new SignedPolicyData(); + signedPolicyData.setZmsSignature("zmsSignature"); + signedPolicyData.setZmsKeyId("0"); + signedPolicyData.setPolicyData(policyData); + signedPolicyData.setExpires(Timestamp.fromMillis(System.currentTimeMillis())); + signedPolicyData.setModified(Timestamp.fromMillis(System.currentTimeMillis())); + + DomainSignedPolicyData domSignedPolicyData = new DomainSignedPolicyData(); + domSignedPolicyData.setKeyId("0"); + domSignedPolicyData.setSignature("signature"); + domSignedPolicyData.setSignedPolicyData(signedPolicyData); + + return domSignedPolicyData; + } + + @Override + public TenantDomains getTenantDomains(String providerDomainName, String userName, + String roleName, String serviceName) { + if (providerDomainName.equals("exc")) { + throw new ResourceException(400, "Invalid request"); + } else if (providerDomainName.equals("unknown")) { + throw new ResourceException(404, "Unknown domain"); + } + + TenantDomains doms = new TenantDomains(); + doms.setTenantDomainNames(tenantDomains); + return doms; + } + + public String getRoleName() { + return roleName; + } + + public void setRoleName(String roleName) { + this.roleName = roleName; + } + + public String getPolicyName() { + return policyName; + } + + public void setPolicyName(String policyName) { + this.policyName = policyName; + } + + public int getExpiryTime() { + return expiryTime; + } + + public void setExpiryTime(int expiryTime) { + this.expiryTime = expiryTime; + } + + public void setTenantDomains(List tenantDomains) { + this.tenantDomains = tenantDomains; + } + + @Override + public Identity postAWSCertificateRequest(String domain, String service, AWSCertificateRequest req) { + return null; + } + + @Override + public Identity postInstanceInformation(InstanceInformation info) { + return null; + } + + @Override + public Identity postAWSInstanceInformation(AWSInstanceInformation info) { + return null; + } + + @Override + public Identity postInstanceRefreshRequest(String domain, String service, InstanceRefreshRequest req) { + if (domain.equals("exc")) { + throw new ResourceException(400, "Invalid request"); + } + Identity identity = new Identity().setName(domain + "." + service) + .setServiceToken("v=S1;d=" + domain + ";n=" + service + ";k=zts.dev;z=zts;o=athenz.svc;t=1234;e=1235;s=sig"); + return identity; + } + + @Override + public Access getAccess(String domainName, String roleName, String principal) { + if (domainName.equals("exc")) { + throw new ResourceException(400, "Invalid request"); + } + Access access = new Access(); + access.setGranted(roleName.equals("match")); + return access; + } + + @Override + public DomainMetrics postDomainMetrics(String domainName, DomainMetrics req) { + if (domainName.equals("exc")) { + throw new ResourceException(400, "Invalid request"); + } + return null; + } +} diff --git a/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientServiceProvider.java b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientServiceProvider.java new file mode 100644 index 00000000000..ab8b2bbf429 --- /dev/null +++ b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientServiceProvider.java @@ -0,0 +1,58 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +public class ZTSClientServiceProvider implements ZTSClientService { + + static RoleToken roleToken; + static String domainName; + static String roleName; + static String trustDomain; + static String proxyForPrincipal; + + @Override + public RoleToken fetchToken(String domain, String seervice, String domName, + String rName, Integer minExpiryTime, Integer maxExpiryTime, String proxy) { + + System.out.println("ZTSClientServiceProvider:fetchToken: domain=" + domName + + " role=" + roleName + " proxy=" + proxy); + + if (domainName == null || !domainName.equals(domName)) { + return null; + } + + if (roleName != null && !roleName.equals(rName)) { + return null; + } + + if (proxyForPrincipal != null && !proxyForPrincipal.equals(proxy)) { + return null; + } + + System.out.println("ZTSClientServiceProvider:fetchToken: return token for domain=" + domName + + " role=" + rName + " proxy=" + proxy); + return roleToken; + } + + public static void setToken(RoleToken rToken, String domName, String rName, String proxy) { + + roleToken = rToken; + domainName = domName; + roleName = rName; + proxyForPrincipal = proxy; + } +} + diff --git a/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientTest.java b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientTest.java new file mode 100644 index 00000000000..e88732d5efc --- /dev/null +++ b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSClientTest.java @@ -0,0 +1,2153 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertNotEquals; +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.assertNull; +import static org.testng.Assert.assertTrue; +import static org.testng.Assert.fail; + +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.security.cert.Certificate; +import java.security.cert.CertificateException; +import java.security.cert.CertificateFactory; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import javax.net.ssl.HostnameVerifier; +import javax.net.ssl.SSLPeerUnverifiedException; +import javax.net.ssl.SSLSession; + +import org.mockito.Mockito; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.sia.impl.SIAClient; +import com.yahoo.rdl.Timestamp; + +public class ZTSClientTest { + + final private Authority PRINCIPAL_AUTHORITY = new PrincipalAuthority(); + + @BeforeClass + public void init() { + System.setProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5"); + System.setProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_AUTO_ENABLE, "false"); + } + + @AfterMethod + public void cleanup() { + System.clearProperty(ZTSClient.ZTS_CLIENT_PROP_ATHENZ_CONF); + System.clearProperty(ZTSClient.ZTS_CLIENT_PROP_TOKEN_MIN_EXPIRY_TIME); + ZTSClient.initConfigValues(); + } + + @BeforeMethod + public void setup() { + System.setProperty(ZTSClient.ZTS_CLIENT_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + } + + @Test + public void testGetHeader() { + + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertEquals(client.getHeader(), "Athenz-Role-Auth"); + client.close(); + } + + @Test + public void testLookupZTSUrl() { + + System.setProperty(ZTSClient.ZTS_CLIENT_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertEquals(client.lookupZTSUrl(), "https://dev.zts.athenzcompany.com:4443/"); + System.clearProperty(ZTSClient.ZTS_CLIENT_PROP_ATHENZ_CONF); + client.close(); + } + + @Test + public void testLookupZTSUrlInvalidFile() { + System.setProperty(ZTSClient.ZTS_CLIENT_PROP_ATHENZ_CONF, "src/test/resources/athenz_invaild.conf"); + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertNull(client.lookupZTSUrl()); + client.close(); + } + + @Test + public void testIsExpiredTokenSmallerThanMin() { + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertTrue(client.isExpiredToken(100, 200, null)); + client.close(); + } + + @Test + public void testIsExpiredTokenBiggerThanMax() { + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertTrue(client.isExpiredToken(500, null, 300)); + assertTrue(client.isExpiredToken(500, 200, 300)); + client.close(); + } + + @Test + public void testIsExpiredTokenAtLeastOneLimitIsNotNull() { + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertFalse(client.isExpiredToken(500, null, 600)); + assertFalse(client.isExpiredToken(500, 200, null)); + assertFalse(client.isExpiredToken(500, 200, 501)); + client.close(); + } + + @Test + public void testIsExpiredTokenAtLeastBothLimitsNullSmallerThanMin() { + System.setProperty(ZTSClient.ZTS_CLIENT_PROP_TOKEN_MIN_EXPIRY_TIME, "600"); + ZTSClient.initConfigValues(); + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertTrue(client.isExpiredToken(500, null, null)); + client.close(); + } + + @Test + public void testIsExpiredTokenAtLeastBothLimitsNullBiggerThanMin() { + System.setProperty(ZTSClient.ZTS_CLIENT_PROP_TOKEN_MIN_EXPIRY_TIME, "400"); + ZTSClient.initConfigValues(); + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + System.out.println("test:isexpiredtoken: expiry=500"); + assertFalse(client.isExpiredToken(500, null, null)); + client.close(); + } + + @Test + public void testGetRoleTokenCacheKeyNullPrincipal() { + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertNull(client.getRoleTokenCacheKey("coretech", null, "TrustDomain")); + client.close(); + } + + @Test + public void testGetRoleTokenCacheKeyNullPrincipalCredentials() { + Principal principal = SimplePrincipal.create("user_domain", "user", (String) null, PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + assertNotNull(client.getRoleTokenCacheKey("coretech", null, "TrustDomain")); + client.close(); + } + + @Test + public void testGetRoleTokenCacheKeyNullRole() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + assertEquals(client.getRoleTokenCacheKey("coretech", null, null), "p=user_domain.user;d=coretech"); + client.close(); + } + + @Test + public void testGetRoleTokenCacheKeyEmptyRole() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + assertEquals(client.getRoleTokenCacheKey("coretech", "", null), "p=user_domain.user;d=coretech"); + client.close(); + } + + @Test + public void testGetRoleTokenCacheKey() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + assertEquals(client.getRoleTokenCacheKey("coretech", "Role1", "proxy"), + "p=user_domain.user;d=coretech;r=Role1;u=proxy"); + client.close(); + } + + @Test + public void testLookupAwsCredInCacheNotPresent() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + + String cacheKey = "p=auth_creds;d=coretech;r=Role1"; + assertNull(client.lookupAwsCredInCache(cacheKey, null, null)); + client.close(); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupAwsCredInCacheExpired() { + + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + + String cacheKey = "p=auth_creds;d=coretech;r=Role1"; + AWSTemporaryCredentials awsCred = new AWSTemporaryCredentials().setAccessKeyId("accesskey") + .setExpiration(Timestamp.fromMillis((System.currentTimeMillis() / 1000) + 1000L)) + .setSecretAccessKey("secretkey").setSessionToken("sesstoken"); + client.awsCredCache.put(cacheKey, awsCred); + + assertNull(client.lookupAwsCredInCache(cacheKey, 3000, 4000)); + assertNull(client.lookupAwsCredInCache(cacheKey, 500, 800)); + + client.awsCredCache.clear(); + client.close(); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupAwsCredInCacheSecondClient() { + + // test cache with ZTSClient created using a principal object + // + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient ztsClient = new ZTSClient("http://localhost:4080/", principal); + String accessKey = "accesskey"; + String secretKey = "secretkey"; + String sessToken = "sesstoken"; + AWSTemporaryCredentials awsCred = new AWSTemporaryCredentials() + .setExpiration(Timestamp.fromMillis(System.currentTimeMillis() + 3500000L)) + .setAccessKeyId(accessKey).setSecretAccessKey(secretKey).setSessionToken(sessToken); + String cacheKey = ztsClient.getRoleTokenCacheKey("coretech", "Role1", null); + ztsClient.awsCredCache.put(cacheKey, awsCred); + assertEquals(cacheKey, "p=user_domain.user;d=coretech;r=Role1"); + AWSTemporaryCredentials cred = ztsClient.lookupAwsCredInCache(cacheKey, 3000, 4000); + assertTrue(cred.getAccessKeyId().contains(accessKey)); + assertEquals(cred.getSecretAccessKey(), secretKey); + assertEquals(cred.getSessionToken(), sessToken); + + ztsClient.close(); + + // rest of tests use ZTSClient object created using domain name and service parameters + + ZTSClient client = new ZTSClient("mytenantdomain", "myservice"); + + String cacheKey1 = client.getRoleTokenCacheKey("mydomain", "Role1", null); + client.awsCredCache.put(cacheKey1, awsCred); + assertNotNull(client.lookupAwsCredInCache(cacheKey1, 3000, 4000)); + + // add new aws cred for caching + + String cacheKey2 = client.getRoleTokenCacheKey("mydomain", "admin", null); + AWSTemporaryCredentials awsCredNoTrustDomain = new AWSTemporaryCredentials() + .setExpiration(Timestamp.fromMillis(System.currentTimeMillis() + 3500000L)) + .setAccessKeyId("notrustdomaccesskey") + .setSecretAccessKey(secretKey).setSessionToken(sessToken); + client.awsCredCache.put(cacheKey2, awsCredNoTrustDomain); + assertEquals(cacheKey2, "p=mytenantdomain.myservice;d=mydomain;r=admin"); + assertNotNull(client.lookupAwsCredInCache(cacheKey2, 3000, 4000)); + + // now let's get another client - same domain and service as first one + // + ZTSClient client1 = new ZTSClient("mytenantdomain", "myservice"); + assertNotNull(client1.lookupAwsCredInCache(cacheKey, 3000, 4000)); + assertEquals(client1.lookupAwsCredInCache(cacheKey2, 3000, 4000).getAccessKeyId(), "notrustdomaccesskey"); + + // now let's get yet another client - different domain and service + // + ZTSClient client2 = new ZTSClient("mytenantdomain2", "myservice2"); + + // cache still contains aws creds for the following keys + assertNotNull(client2.lookupAwsCredInCache(cacheKey, 3000, 4000)); + + // add new role token to cache using new domain=mydomain2 and new tenant domain=mytenantdomain2 and new service=myservice2 + String cacheKeyNewDomain = client2.getRoleTokenCacheKey("mydomain2", "admin", null); + AWSTemporaryCredentials awsCredNewDomain = new AWSTemporaryCredentials() + .setExpiration(Timestamp.fromMillis(System.currentTimeMillis() + 3500000L)) + .setAccessKeyId("newdomaccesskey") + .setSecretAccessKey(secretKey).setSessionToken(sessToken); + client.awsCredCache.put(cacheKeyNewDomain, awsCredNewDomain); + assertEquals(cacheKeyNewDomain, "p=mytenantdomain2.myservice2;d=mydomain2;r=admin"); + assertEquals(client2.lookupAwsCredInCache(cacheKeyNewDomain, 3000, 4000).getAccessKeyId(), "newdomaccesskey"); + + // set aws cred without specifying role for the key + // + String cacheKeyNoRole = client2.getRoleTokenCacheKey("mydomain2", null, null); + AWSTemporaryCredentials awsCredNoRole = new AWSTemporaryCredentials() + .setExpiration(Timestamp.fromMillis(System.currentTimeMillis() + 3500000L)) + .setAccessKeyId("noroleaccesskey") + .setSecretAccessKey(secretKey).setSessionToken(sessToken); + client.awsCredCache.put(cacheKeyNoRole, awsCredNoRole); + assertEquals(cacheKeyNoRole, "p=mytenantdomain2.myservice2;d=mydomain2"); + assertEquals(client2.lookupAwsCredInCache(cacheKeyNoRole, 3000, 4000).getAccessKeyId(), "noroleaccesskey"); + + // now let's get yet another client - specify domain but no service + // + ZTSClient client3 = new ZTSClient("mytenantdomain3", (String) null); + + // cache still contains role tokens for the following keys + assertNotNull(client3.lookupAwsCredInCache(cacheKey, 3000, 4000)); + + // token principal field has no service so in sync with ZTSClient + String cacheKeyNoSvc = client3.getRoleTokenCacheKey("mydomain3", null, null); + assertNull(cacheKeyNoSvc); + + client.ROLE_TOKEN_CACHE.clear(); + client.close(); + client1.close(); + client2.close(); + client3.close(); + } + + @Test + public void testLookupRoleTokenInCacheNotPresent() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + + String cacheKey = "p=auth_creds;d=coretech;r=Role1"; + assertNull(client.lookupRoleTokenInCache(cacheKey, null, null)); + client.close(); + } + + + @SuppressWarnings("static-access") + @Test + public void testLookupRoleTokenInCacheExpired() { + + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + + String cacheKey = "p=auth_creds;d=coretech;r=Role1"; + RoleToken roleToken = new RoleToken().setToken("role_token").setExpiryTime((System.currentTimeMillis() / 1000) + 1000L); + client.ROLE_TOKEN_CACHE.put(cacheKey, roleToken); + + assertNull(client.lookupRoleTokenInCache(cacheKey, 3000, 4000)); + assertNull(client.lookupRoleTokenInCache(cacheKey, 500, 800)); + + client.ROLE_TOKEN_CACHE.clear(); + client.close(); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupRoleTokenInCache() { + + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + + String cacheKey = "p=user_domain.user;d=coretech;r=Role1"; + RoleToken roleToken = new RoleToken().setToken("role_token").setExpiryTime((System.currentTimeMillis() / 1000) + 3500L); + client.ROLE_TOKEN_CACHE.put(cacheKey, roleToken); + + assertNotNull(client.lookupRoleTokenInCache(cacheKey, 3000, 4000)); + + Long expiryTime = roleToken.getExpiryTime(); + String token = "v=Z1;d=mydomain;r=admin;p=user_domain.user;h=localhost;a=f10bc905071a72d1;t=1448045776;e=" + expiryTime.toString() + ";k=0;i=10.11.12.13;s=pujvQuvaLa2jgE3k24bCw5Hm7AP9dUQkmkwNfX2bPhVXyhdRkOlbttF4exJm9V571sJXid6vsihgopCdxqW_qA--"; + ZTSClientTokenCacher.setRoleToken(token, "admin", null); + cacheKey = client.getRoleTokenCacheKey("mydomain", "admin", null); + assertEquals(cacheKey, "p=user_domain.user;d=mydomain;r=admin"); + assertNotNull(client.lookupRoleTokenInCache(cacheKey, 3000, 4000)); + + client.ROLE_TOKEN_CACHE.clear(); + client.close(); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupRoleTokenInCacheSecondClient() { + + // test cache with ZTSClient created using a principal object + // + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient ztsClient = new ZTSClient("http://localhost:4080/", principal); + RoleToken roleToken = new RoleToken().setToken("role_token").setExpiryTime((System.currentTimeMillis() / 1000) + 3500L); + String coreTechToken = "v=Z1;d=coretech;r=admin;p=user_domain.user;h=localhost;a=f10bc905071a72d1;t=1448045776;e=" + roleToken.getExpiryTime() + ";k=0;i=10.11.12.13;s=pujvQuvaLa2jgE3k24bCw5Hm7AP9dUQkmkwNfX2bPhVXyhdRkOlbttF4exJm9V571sJXid6vsihgopCdxqW_qA--"; + ZTSClientTokenCacher.setRoleToken(coreTechToken, "Role1", null); + String cacheKey = ztsClient.getRoleTokenCacheKey("coretech", "Role1", null); + assertEquals(cacheKey, "p=user_domain.user;d=coretech;r=Role1"); + assertEquals(ztsClient.lookupRoleTokenInCache(cacheKey, 3000, 4000).getToken(), coreTechToken); + ztsClient.close(); + + // rest of tests use ZTSClient object created using domain name and service parameters + + ZTSClient client = new ZTSClient("mytenantdomain", "myservice"); + + String cacheKeyRole1 = client.getRoleTokenCacheKey("mydomain", "Role1", null); + client.ROLE_TOKEN_CACHE.put(cacheKeyRole1, roleToken); + + assertNotNull(client.lookupRoleTokenInCache(cacheKeyRole1, 3000, 4000)); + + // add new role token to the cache + // + Long expiryTime = roleToken.getExpiryTime(); + String token = "v=Z1;d=mydomain;r=admin;p=mytenantdomain.myservice;h=localhost;a=f10bc905071a72d1;t=1448045776;e=" + expiryTime.toString() + ";k=0;i=10.11.12.13;s=pujvQuvaLa2jgE3k24bCw5Hm7AP9dUQkmkwNfX2bPhVXyhdRkOlbttF4exJm9V571sJXid6vsihgopCdxqW_qA--"; + ZTSClientTokenCacher.setRoleToken(token, "admin", null); + String cacherKeyCacher = client.getRoleTokenCacheKey("mydomain", "admin", null); + assertEquals(cacherKeyCacher, "p=mytenantdomain.myservice;d=mydomain;r=admin"); + assertNotNull(client.lookupRoleTokenInCache(cacherKeyCacher, 3000, 4000)); + + // now let's get another client - same domain and service as first one + // + ZTSClient client1 = new ZTSClient("mytenantdomain", "myservice"); + assertNotNull(client1.lookupRoleTokenInCache(cacheKey, 3000, 4000)); + assertNotNull(client1.lookupRoleTokenInCache(cacherKeyCacher, 3000, 4000)); + + // now let's get yet another client - different domain and service + // + ZTSClient client2 = new ZTSClient("mytenantdomain2", "myservice2"); + + // cache still contains role tokens for the following keys + assertNotNull(client2.lookupRoleTokenInCache(cacheKey, 3000, 4000)); + assertNotNull(client2.lookupRoleTokenInCache(cacherKeyCacher, 3000, 4000)); + + // add new role token to cache using new domain=mydomain2 and new tenant domain=mytenantdomain2 and new service=myservice2 + String token2 = "v=Z1;d=mydomain2;r=admin;p=mytenantdomain2.myservice2;h=localhost;a=f10bc905071a72d1;t=1448045776;e=" + expiryTime.toString() + ";k=0;i=10.11.12.13;s=pujvQuvaLa2jgE3k24bCw5Hm7AP9dUQkmkwNfX2bPhVXyhdRkOlbttF4exJm9V571sJXid6vsihgopCdxqW_qA--"; + ZTSClientTokenCacher.setRoleToken(token2, "admin", null); + String cacheKeyNewDomain = client2.getRoleTokenCacheKey("mydomain2", "admin", null); + assertEquals(cacheKeyNewDomain, "p=mytenantdomain2.myservice2;d=mydomain2;r=admin"); + assertEquals(client2.lookupRoleTokenInCache(cacheKeyNewDomain, 3000, 4000).getToken(), token2); + + // set role token without specifying role for the key + // + ZTSClientTokenCacher.setRoleToken(token2, null, null); + String cacheKeyNoRole = client2.getRoleTokenCacheKey("mydomain2", null, null); + assertEquals(cacheKeyNoRole, "p=mytenantdomain2.myservice2;d=mydomain2"); + assertEquals(client2.lookupRoleTokenInCache(cacheKeyNoRole, 3000, 4000).getToken(), token2); + + // now let's get yet another client - specify domain but no service + // + ZTSClient client3 = new ZTSClient("mytenantdomain3", (String) null); + + // cache still contains role tokens for the following keys + assertNotNull(client3.lookupRoleTokenInCache(cacheKey, 3000, 4000)); + assertNotNull(client3.lookupRoleTokenInCache(cacherKeyCacher, 3000, 4000)); + + String cacheKeyNoSvc = client3.getRoleTokenCacheKey("mydomain3", null, null); + assertNull(cacheKeyNoSvc); + + client.ROLE_TOKEN_CACHE.clear(); + client.close(); + client1.close(); + client2.close(); + client3.close(); + } + + @SuppressWarnings("static-access") + @Test + public void testLookupRoleTokenServiceProvider() { + + String domName = "svcdomtest"; + Long expiryTime = (System.currentTimeMillis() / 1000) + 3500L; + String token = "v=Z1;d=" + domName + ";r=admin;p=sports.hockey;h=localhost;a=f10bc905071a72d1;t=1448045776;e=" + expiryTime.toString() + + ";k=0;i=10.11.12.13;s=pujvQuvaLa2jgE3k24bCw5Hm7AP9dUQkmkwNfX2bPhVXyhdRkOlbttF4exJm9V571sJXid6vsihgopCdxqW_qA--"; + RoleToken roleToken = new RoleToken().setToken(token).setExpiryTime((System.currentTimeMillis() / 1000) + 3500L); + + java.util.ServiceLoader providers = java.util.ServiceLoader.load(ZTSClientService.class); + for (ZTSClientService provider: providers) { + if (provider instanceof ZTSClientServiceProvider) { + ZTSClientServiceProvider sprov = (ZTSClientServiceProvider) provider; + sprov.setToken(roleToken, domName, null, null); + roleToken = null; + break; + } + } + assertNull(roleToken); // means it found the test service provider + + // now get role token for that domain + Authority principalAuthority = new PrincipalAuthority(); + Principal principal = SimplePrincipal.create("sports", "hockey", "v=S1;d=sports;n=hockey;s=sig", principalAuthority); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setZTSRDLGeneratedClient(ztsClientMock); + + // purposely ignoring cache so 1st thing it will do is check in the providers + RoleToken rToken = client.getRoleToken(domName, null, null, null, true, null); + assertNotNull(rToken); + + // not in cache + String cacheKey = client.getRoleTokenCacheKey(domName, null, null); + rToken = client.lookupRoleTokenInCache(cacheKey, null, null); + assertNull(rToken); + + // dont ignore cache so 1st thing it will do is check in the cache + // before it checks the providers + rToken = client.getRoleToken(domName, null, null, null, false, null); + assertNotNull(rToken); + + client.close(); + } + + @Test + public void testUpdateServicePrincipalSIAClientNull() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + assertFalse(client.updateServicePrincipal()); + client.close(); + } + + @SuppressWarnings("unchecked") + @Test + public void testUpdateServicePrincipalException() throws IOException { + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.eq("iaas.athenz"), + Mockito.eq("ci"), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenThrow(IOException.class); + + ZTSClient client = new ZTSClient("http://localhost:4080/", + "iaas.athenz", "ci"); + client.setSIAClient(siaClient); + try { + client.updateServicePrincipal(); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(ex.getMessage().contains("iaas.athenz.ci")); + } + client.close(); + } + + @Test + public void testSameCredentialsAsBeforeNullPrincipal() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertFalse(client.sameCredentialsAsBefore(principal)); + client.close(); + } + + @Test + public void testSameCredentialsAsBeforePrincipalNoCreds() { + + Principal principal = SimplePrincipal.create("user_domain", "user", (String) null, PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + Principal newPrincipal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + assertFalse(client.sameCredentialsAsBefore(newPrincipal)); + client.close(); + } + + @Test + public void testSameCredentialsAsBeforePrincipalDiffCreds1() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds2", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + Principal newPrincipal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + assertFalse(client.sameCredentialsAsBefore(newPrincipal)); + client.close(); + } + + @Test + public void testSameCredentialsAsBeforePrincipalDiffCreds2() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + Principal newPrincipal = SimplePrincipal.create("user_domain", "user", "auth_creds2", PRINCIPAL_AUTHORITY); + assertFalse(client.sameCredentialsAsBefore(newPrincipal)); + client.close(); + } + + @Test + public void testSameCredentialsAsBeforePrincipalSameCreds() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + Principal newPrincipal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + assertTrue(client.sameCredentialsAsBefore(newPrincipal)); + client.close(); + } + + @Test + public void testAddandClearCredentials() { + + // add credential + ZTSClient client = new ZTSClient("coretech", "storage"); + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + client.addCredentials(principal); + assertNotNull(client.principal); + assertNull(client.siaClient); + + // clear credential + client.clearCredentials(); + assertNull(client.principal); + + client.close(); + } + + @Test + public void testAddPrincipalCredentialsNoSIAReset() { + + ZTSClient client = new ZTSClient("coretech", "storage"); + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + client.addPrincipalCredentials(principal, false); + assertNotNull(client); + assertNotNull(client.siaClient); + client.close(); + } + + @Test + public void testAddPrincipalCredentialsSIAReset() { + + ZTSClient client = new ZTSClient("coretech", "storage"); + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + client.addPrincipalCredentials(principal, true); + assertNotNull(client); + assertNull(client.siaClient); + client.close(); + } + + @Test + public void testConstructorPrincipal() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient(principal); + assertNotNull(client); + assertNotNull(client.ztsClient); + assertNull(client.siaClient); + assertEquals(client.principal, principal); + } + + @Test + public void testConstructorPrincipalAndUrl() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080/", principal); + assertNotNull(client); + assertNotNull(client.ztsClient); + assertNull(client.siaClient); + assertEquals(client.principal, principal); + assertEquals(client.getZTSUrl(), "http://localhost:4080/zts/v1"); + } + + @Test + public void testConstructorServiceWithClients() { + + ZTSClient client = new ZTSClient("http://localhost:4080/", "coretech", "storage"); + assertNotNull(client); + assertNotNull(client.siaClient); + assertNull(client.principal); + } + + @Test + public void testGetZTSUrlWithTrailingSlash() { + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertEquals(client.getZTSUrl(), "http://localhost:4080/zts/v1"); + client.close(); + } + + @Test + public void testGetZTSUrlWithoutTrailingSlash() { + ZTSClient client = new ZTSClient("http://localhost:4080/", (Principal) null); + assertEquals(client.getZTSUrl(), "http://localhost:4080/zts/v1"); + client.close(); + } + + @Test + public void testClientInvalidPort() { + + ZTSClient client = new ZTSClient("http://localhost:11080/", (Principal) null); + + try { + client.getRoleToken("coretech"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 400); + } + + client.close(); + } + + @Test + public void testGetRoleToken() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setZTSRDLGeneratedClient(ztsClientMock); + + RoleToken roleToken = client.getRoleToken("coretech"); + assertNotNull(roleToken); + + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getDomain(), "coretech"); + assertEquals(1, token.getRoles().size()); + assertTrue(token.getRoles().contains("role1")); + + // now we're going to get a token again and this time we should get back + // from our cache thus the same exact one + + RoleToken roleToken2 = client.getRoleToken("coretech"); + assertTrue(roleToken2.getToken().equals(roleToken.getToken())); + + // now we're going to use the full API to request the token with ignoring from the cache + // and we should get back a new token + + roleToken2 = client.getRoleToken("coretech", null, null, null, true, null); + assertFalse(roleToken2.getToken().equals(roleToken.getToken())); + client.close(); + } + + @Test + public void testPrefetchRoleTokenShouldNotCallServer() throws Exception { + System.out.println("testPrefetchRoleTokenShouldNotCallServer"); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + long intervalSecs = Integer.parseInt(System.getProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5")); + ztsClientMock.setTestSleepInterval(intervalSecs); + + final Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.anyString(), + Mockito.anyString(), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenReturn(principal); + + ZTSClient client = new ZTSClient("http://localhost:4080/", "user_domain", "user"); + client.setZTSRDLGeneratedClient(ztsClientMock); + client.setSIAClient(siaClient); + + String domain1 = "coretech"; + String domain2 = "providerdomain"; + + // initially, roleToken was never fetched. + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null) < 0); + + // initialize the prefetch token process. + client.prefetchRoleToken(domain1, null, null, null, null); + int scheduledItemsSize = client.getScheduledItemsSize(); + + // make sure only unique items are in the queue + client.prefetchRoleToken(domain1, null, null, null, null); + int scheduledItemsSize2 = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize, scheduledItemsSize2); + + RoleToken roleToken1 = client.getRoleToken(domain1); + assertTrue(roleToken1 != null); + long rt1Expiry = roleToken1.getExpiryTime(); + + client.prefetchRoleToken(domain2, null, null, null, null); + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 1); + + RoleToken roleToken2 = client.getRoleToken(domain2); + assertTrue(roleToken2 != null); + long rt2Expiry = roleToken2.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: roleToken2:domain=" + domain2 + " expires at " + rt2Expiry + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + + System.out.println("testPrefetchRoleTokenShouldNotCallServer: sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: nap over so what happened"); + + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 1); + long lastTimerTriggered1 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + long lastTokenFetchedTime1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + assertTrue(lastTokenFetchedTime1 > 0); + + roleToken2 = client.getRoleToken(domain2); + long rt2Expiry2 = roleToken2.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: roleToken2:domain=" + domain2 + " expires at " + rt2Expiry2 + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + assertTrue(rt2Expiry2 > rt2Expiry); // this token was refreshed + + // wait a few seconds, and see subsequent fetch happened. + System.out.println("testPrefetchRoleTokenShouldNotCallServer: again sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: again nap over so what happened"); + + RoleToken roleToken3 = client.getRoleToken(domain2); + long rt2Expiry3 = roleToken3.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: roleToken3:domain=" + domain2 + " expires at " + rt2Expiry3); + assertTrue(rt2Expiry3 > rt2Expiry2); // this token was refreshed + + long lastTokenFetchedTime2 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + long lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + long lastTimerTriggered2 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + // Since token should be good for 2 hrs, lastTokenFetchedTime1 & 2 & 3 all should be the same + // because token is not expired yet. + assertEquals(lastTokenFetchedTime1, lastTokenFetchedTime2); + assertEquals(lastTokenFetchedTime3, lastTokenFetchedTime2); + + // token should be identical since didnt get refreshed + RoleToken roleToken1b = client.getRoleToken(domain1); + long rt1bExpiry = roleToken1b.getExpiryTime(); + assertEquals(rt1Expiry, rt1bExpiry); + assertEquals(roleToken1.getToken(), roleToken1b.getToken()); + + // But, make sure the Timer actually triggered. + assertTrue(lastTimerTriggered1 > 0); + assertTrue(lastTimerTriggered2 > 0); + assertNotEquals(lastTimerTriggered1, lastTimerTriggered2); + assertTrue(lastTimerTriggered2 > lastTimerTriggered1); + + client.removePrefetcher(); + client.close(); + } + + @Test + public void testPrefetchRoleTokenWithUserDataShouldNotCallServer() throws Exception { + System.out.println("testPrefetchRoleTokenShouldNotCallServer"); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + long intervalSecs = Integer.parseInt(System.getProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5")); + ztsClientMock.setTestSleepInterval(intervalSecs); + + final Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.anyString(), + Mockito.anyString(), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenReturn(principal); + + ZTSClient client = new ZTSClient("http://localhost:4080/", "user_domain", "user"); + client.setZTSRDLGeneratedClient(ztsClientMock); + client.setSIAClient(siaClient); + + String domain1 = "coretech"; + String domain2 = "providerdomain"; + + // initially, roleToken was never fetched. + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, "user_domain.userdata1") < 0); + + // initialize the prefetch token process. + client.prefetchRoleToken(domain1, null, null, null, "user_domain.userdata1"); + int scheduledItemsSize = client.getScheduledItemsSize(); + + // make sure only unique items are in the queue + client.prefetchRoleToken(domain1, null, null, null, "user_domain.userdata1"); + int scheduledItemsSize2 = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize, scheduledItemsSize2); + + RoleToken roleToken1 = client.getRoleToken(domain1, null, null, null, false, "user_domain.userdata1"); + assertTrue(roleToken1 != null); + long rt1Expiry = roleToken1.getExpiryTime(); + + client.prefetchRoleToken(domain2, null, null, null, "user_domain.userdata2"); + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 1); + + RoleToken roleToken2 = client.getRoleToken(domain2, null, null, null, false, "user_domain.userdata2"); + assertTrue(roleToken2 != null); + long rt2Expiry = roleToken2.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: roleToken2:domain=" + domain2 + " expires at " + rt2Expiry + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + + System.out.println("testPrefetchRoleTokenShouldNotCallServer: sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: nap over so what happened"); + + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 1); + long lastTimerTriggered1 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + long lastTokenFetchedTime1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, "user_domain.userdata1"); + assertTrue(lastTokenFetchedTime1 > 0); + + roleToken2 = client.getRoleToken(domain2, null, null, null, false, "user_domain.userdata2"); + long rt2Expiry2 = roleToken2.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: roleToken2:domain=" + domain2 + " expires at " + rt2Expiry2 + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + assertTrue(rt2Expiry2 > rt2Expiry); // this token was refreshed + + // wait a few seconds, and see subsequent fetch happened. + System.out.println("testPrefetchRoleTokenShouldNotCallServer: again sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: again nap over so what happened"); + + RoleToken roleToken3 = client.getRoleToken(domain2, null, null, null, false, "user_domain.userdata2"); + assertTrue(roleToken3.getToken().contains(";proxy=user_domain.userdata2;")); + long rt2Expiry3 = roleToken3.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldNotCallServer: roleToken3:domain=" + domain2 + " expires at " + rt2Expiry3); + assertTrue(rt2Expiry3 > rt2Expiry2); // this token was refreshed + + long lastTokenFetchedTime2 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, "user_domain.userdata1"); + long lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, "user_domain.userdata1"); + long lastTimerTriggered2 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + // Since token should be good for 2 hrs, lastTokenFetchedTime1 & 2 & 3 all should be the same + // because token is not expired yet. + assertEquals(lastTokenFetchedTime1, lastTokenFetchedTime2); + assertEquals(lastTokenFetchedTime3, lastTokenFetchedTime2); + + // token should be identical since didnt get refreshed + RoleToken roleToken1b = client.getRoleToken(domain1, null, null, null, false, "user_domain.userdata1"); + assertTrue(roleToken1b.getToken().contains(";proxy=user_domain.userdata1;")); + long rt1bExpiry = roleToken1b.getExpiryTime(); + assertEquals(rt1Expiry, rt1bExpiry); + assertEquals(roleToken1.getToken(), roleToken1b.getToken()); + + // But, make sure the Timer actually triggered. + assertTrue(lastTimerTriggered1 > 0); + assertTrue(lastTimerTriggered2 > 0); + assertNotEquals(lastTimerTriggered1, lastTimerTriggered2); + assertTrue(lastTimerTriggered2 > lastTimerTriggered1); + + client.removePrefetcher(); + client.close(); + } + + @Test + public void testPrefetchAwsCredShouldNotCallServer() throws Exception { + System.out.println("testPrefetchAwsCredShouldNotCallServer"); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + long intervalSecs = Integer.parseInt(System.getProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5")); + ztsClientMock.setTestSleepInterval(intervalSecs); + + final Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.anyString(), + Mockito.anyString(), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenReturn(principal); + + ZTSClient client = new ZTSClient("http://localhost:4080/", "user_domain", "user"); + client.setZTSRDLGeneratedClient(ztsClientMock); + client.setSIAClient(siaClient); + + String domain1 = "coretech"; + String domain2 = "providerdomain"; + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain1, "role1"); + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain2, "role1"); + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain2, "role2"); + + // initially, roleToken was never fetched. + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null) < 0); + + // initialize the prefetch token process. + client.prefetchAwsCred(domain1, "role1", null, null); + int scheduledItemsSize = client.getScheduledItemsSize(); + + // make sure only unique items are in the queue + client.prefetchAwsCred(domain1, "role1", null, null); + int scheduledItemsSize2 = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize, scheduledItemsSize2); + + AWSTemporaryCredentials awsCred1 = client.getAWSTemporaryCredentials(domain1, "role1"); + assertTrue(awsCred1 != null); + long rt1Expiry = awsCred1.getExpiration().millis(); + + client.prefetchAwsCred(domain2, "role1", null, null); + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 1); + + AWSTemporaryCredentials awsCred2 = client.getAWSTemporaryCredentials(domain2, "role1"); + assertTrue(awsCred2 != null); + long rt2Expiry = awsCred2.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldNotCallServer: awsCred2:domain=" + domain2 + " expires at " + rt2Expiry + " curtime_millis=" + System.currentTimeMillis()); + + System.out.println("testPrefetchAwsCredShouldNotCallServer: sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchAwsCredShouldNotCallServer: nap over so what happened"); + + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 1); + long lastTimerTriggered1 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + long lastTokenFetchedTime1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + assertTrue(lastTokenFetchedTime1 > 0); + + awsCred2 = client.getAWSTemporaryCredentials(domain2, "role1"); + long rt2Expiry2 = awsCred2.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldNotCallServer: awsCred2:domain=" + domain2 + " expires at " + rt2Expiry2 + " curtime_millis=" + System.currentTimeMillis()); + assertTrue(rt2Expiry2 > rt2Expiry); // this token was refreshed + + // wait a few seconds, and see subsequent fetch happened. + System.out.println("testPrefetchAwsCredShouldNotCallServer: again sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchAwsCredShouldNotCallServer: again nap over so what happened"); + + AWSTemporaryCredentials awsCred3 = client.getAWSTemporaryCredentials(domain2, "role1"); + long rt2Expiry3 = awsCred3.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldNotCallServer: awsCred3:domain=" + domain2 + " expires at " + rt2Expiry3); + assertTrue(rt2Expiry3 > rt2Expiry2); // this token was refreshed + + long lastTokenFetchedTime2 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + long lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + long lastTimerTriggered2 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + // Since token should be good for 2 hrs, lastTokenFetchedTime1 & 2 & 3 all should be the same + // because token is not expired yet. + assertEquals(lastTokenFetchedTime1, lastTokenFetchedTime2); + assertEquals(lastTokenFetchedTime3, lastTokenFetchedTime2); + + // token should be identical since didnt get refreshed + AWSTemporaryCredentials awsCred1b = client.getAWSTemporaryCredentials(domain1, "role1"); + long rt1bExpiry = awsCred1b.getExpiration().millis(); + assertEquals(rt1Expiry, rt1bExpiry); + assertEquals(awsCred1.getSessionToken(), awsCred1b.getSessionToken()); + + // But, make sure the Timer actually triggered. + assertTrue(lastTimerTriggered1 > 0); + assertTrue(lastTimerTriggered2 > 0); + assertNotEquals(lastTimerTriggered1, lastTimerTriggered2); + assertTrue(lastTimerTriggered2 > lastTimerTriggered1); + + client.prefetchAwsCred(domain2, "role2", null, null); + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 2); + + AWSTemporaryCredentials awsCred4 = client.getAWSTemporaryCredentials(domain2, "role2"); + assertTrue(awsCred4 != null); + long rtExpiry3 = awsCred4.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldNotCallServer: awsCred4:domain=" + domain2 + " role=role2 expires at " + rtExpiry3 + " curtime_millis=" + System.currentTimeMillis()); + + lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain2, "role2", null); + assertTrue(lastTokenFetchedTime3 > lastTokenFetchedTime2); + + AWSTemporaryCredentials awsCred5 = client.getAWSTemporaryCredentials(domain2, "role1"); + assertTrue(awsCred5 != null); + assertNotEquals(awsCred4.getAccessKeyId(), awsCred5.getAccessKeyId()); + + client.removePrefetcher(); + client.close(); + } + + @Test + public void testPrefetchShouldNotCallServer() throws Exception { + System.out.println("testPrefetchShouldNotCallServer"); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + long intervalSecs = Integer.parseInt(System.getProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5")); + ztsClientMock.setTestSleepInterval(intervalSecs); + + final Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.anyString(), + Mockito.anyString(), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenReturn(principal); + + ZTSClient client = new ZTSClient("http://localhost:4080/", "user_domain", "user"); + client.setZTSRDLGeneratedClient(ztsClientMock); + client.setSIAClient(siaClient); + + String domain1 = "coretech"; + String domain2 = "providerdomain"; + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain1, "role1"); + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain2, "role1"); + + // initially, roleToken was never fetched. + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null) < 0); + + // initialize the prefetch token process. + client.prefetchRoleToken(domain1, null, null, null, null); + int scheduledItemsSize = client.getScheduledItemsSize(); + + // make sure only unique items are in the queue + client.prefetchRoleToken(domain1, null, null, null, null); + int scheduledItemsSize2 = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize, scheduledItemsSize2); + + // repeat for aws cred + // + client.prefetchAwsCred(domain1, "role1", null, null); + scheduledItemsSize = client.getScheduledItemsSize(); + assertTrue(scheduledItemsSize > scheduledItemsSize2); + + // make sure only unique items are in the queue + client.prefetchAwsCred(domain1, "role1", null, null); + scheduledItemsSize2 = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize, scheduledItemsSize2); + + AWSTemporaryCredentials awsCred1 = client.getAWSTemporaryCredentials(domain1, "role1"); + assertTrue(awsCred1 != null); + long awsCredExpiryd1r1 = awsCred1.getExpiration().millis(); + + RoleToken roleToken1 = client.getRoleToken(domain1); + assertTrue(roleToken1 != null); + long rt1Expiry = roleToken1.getExpiryTime(); + + long lastTokenFetchedTime1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + long lastTokenFetchedTime1nr = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + + // work with domain2 + // + client.prefetchRoleToken(domain2, null, null, null, null); + scheduledItemsSize2 = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize2, scheduledItemsSize + 1); + + client.prefetchAwsCred(domain2, "role1", null, null); + scheduledItemsSize2 = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize2, scheduledItemsSize + 2); + + RoleToken roleToken2 = client.getRoleToken(domain2); + assertTrue(roleToken2 != null); + long rt2Expiry = roleToken2.getExpiryTime(); + + AWSTemporaryCredentials awsCred2 = client.getAWSTemporaryCredentials(domain2, "role1"); + assertTrue(awsCred2 != null); + long awsCredExpiry = awsCred2.getExpiration().millis(); + + System.out.println("testPrefetchShouldNotCallServer: sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchShouldNotCallServer: nap over so what happened"); + + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 2); + long lastTimerTriggered1 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + long lastTokenFetchedTimeDom2 = ztsClientMock.getLastRoleTokenFetchedTime(domain2, null, null); + assertTrue(lastTokenFetchedTimeDom2 > 0); + + roleToken2 = client.getRoleToken(domain2); + long rt2Expiry2 = roleToken2.getExpiryTime(); + assertTrue(rt2Expiry2 > rt2Expiry); // this token was refreshed + + awsCred2 = client.getAWSTemporaryCredentials(domain2, "role1"); + long awsCredExpiry2 = awsCred2.getExpiration().millis(); + assertTrue(awsCredExpiry2 > awsCredExpiry); // this cred was refreshed + + // wait a few seconds, and see subsequent fetch happened. + System.out.println("testPrefetchRoleTokenShouldNotCallServer: again sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchShouldNotCallServer: again nap over so what happened"); + + RoleToken roleToken3 = client.getRoleToken(domain2); + long rt2Expiry3 = roleToken3.getExpiryTime(); + System.out.println("testPrefetchShouldNotCallServer: roleToken3:domain=" + domain2 + " expires at " + rt2Expiry3); + assertTrue(rt2Expiry3 > rt2Expiry2); // this token was refreshed + + AWSTemporaryCredentials awsCred3 = client.getAWSTemporaryCredentials(domain2, "role1"); + long awsCredExpiry3 = awsCred3.getExpiration().millis(); + assertTrue(awsCredExpiry3 > awsCredExpiry2); // this cred was refreshed + + long lastTokenFetchedTimed1r1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + long lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + + long lastTimerTriggered2 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + // Since token should be good for 2 hrs, lastTokenFetchedTime1 & 2 & 3 all should be the same + // because token is not expired yet. + assertEquals(lastTokenFetchedTime1, lastTokenFetchedTimed1r1); + assertEquals(lastTokenFetchedTime3, lastTokenFetchedTime1nr); + + // token should be identical since didnt get refreshed + RoleToken roleToken1b = client.getRoleToken(domain1); + long rt1bExpiry = roleToken1b.getExpiryTime(); + assertEquals(rt1Expiry, rt1bExpiry); + assertEquals(roleToken1.getToken(), roleToken1b.getToken()); + + // aws cred should be identical since didnt get refreshed + AWSTemporaryCredentials awsCred1b = client.getAWSTemporaryCredentials(domain1, "role1"); + long ac1bExpiry = awsCred1b.getExpiration().millis(); + assertEquals(awsCredExpiryd1r1, ac1bExpiry); + assertEquals(awsCred1.getSessionToken(), awsCred1b.getSessionToken()); + + // But, make sure the Timer actually triggered. + assertTrue(lastTimerTriggered1 > 0); + assertTrue(lastTimerTriggered2 > 0); + assertNotEquals(lastTimerTriggered1, lastTimerTriggered2); + assertTrue(lastTimerTriggered2 > lastTimerTriggered1); + + client.removePrefetcher(); + client.close(); + } + + @Test + public void testPrefetchRoleTokenShouldCallServer() throws Exception { + System.out.println("testPrefetchRoleTokenShouldCallServer"); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + int intervalSecs = Integer.parseInt(System.getProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5")); + ztsClientMock.setTestSleepInterval(intervalSecs); + ztsClientMock.setExpiryTime(intervalSecs); // token expires in 5 seconds + ztsClientMock.setRoleName("role1"); + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.anyString(), + Mockito.anyString(), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenReturn(principal); + + ZTSClient client = new ZTSClient("http://localhost:4080/", "user_domain", "user"); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + client.setSIAClient(siaClient); + + String domain1 = "coretech"; + + // initially, roleToken was never fetched. + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null) < 0); + + // initialize the prefetch token process. + client.prefetchRoleToken(domain1, null, null, null, null); + // make sure only unique items are in the queue + assertEquals(client.getScheduledItemsSize(), 1); + + RoleToken roleToken1 = client.getRoleToken(domain1); + assertTrue(roleToken1 != null); + long rtExpiry = roleToken1.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldCallServer: roleToken1:domain=" + domain1 + " expires at " + rtExpiry + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + + System.out.println("testPrefetchRoleTokenShouldCallServer: sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchRoleTokenShouldCallServer: nap over so what happened"); + + assertEquals(client.getScheduledItemsSize(), 1); + + long lastTimerTriggered1 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + long lastTokenFetchedTime1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + roleToken1 = client.getRoleToken(domain1); + long rtExpiry2 = roleToken1.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldCallServer: roleToken1:domain=" + domain1 + " expires at " + rtExpiry2 + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + assertTrue(rtExpiry2 > rtExpiry); // this token was refreshed + + assertTrue(lastTokenFetchedTime1 > 0); + + // wait a few seconds, and see subsequent fetch happened. + System.out.println("testPrefetchRoleTokenShouldCallServer: again sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchRoleTokenShouldCallServer: again nap over so what happened"); + + long lastTokenFetchedTime2 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + RoleToken roleToken2 = client.getRoleToken(domain1); + long rt2Expiry = roleToken2.getExpiryTime(); + System.out.println("testPrefetchRoleTokenShouldCallServer: roleToken2:domain=" + domain1 + " expires at " + rt2Expiry + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + assertTrue(rt2Expiry > rtExpiry2); // this token was refreshed + + // token should be different + assertNotEquals(roleToken1.getToken(), roleToken2.getToken()); + + long lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + + long lastTimerTriggered2 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + // Since token should be good for 5 seconds, lastTokenFetchedTime1 & 2 & 3 all should be different, + assertNotEquals(lastTokenFetchedTime1, lastTokenFetchedTime2); + assertNotEquals(lastTokenFetchedTime3, lastTokenFetchedTime2); + + // make sure the Timer actually triggered. + assertTrue(lastTimerTriggered1 > 0); + assertTrue(lastTimerTriggered2 > 0); + assertNotEquals(lastTimerTriggered1, lastTimerTriggered2); + assertTrue(lastTimerTriggered2 > lastTimerTriggered1); + + client.removePrefetcher(); + client.close(); + } + + @Test + public void testPrefetchAwsCredShouldCallServer() throws Exception { + System.out.println("testPrefetchAwsCredShouldCallServer"); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + int intervalSecs = Integer.parseInt(System.getProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5")); + ztsClientMock.setTestSleepInterval(intervalSecs); + ztsClientMock.setExpiryTime(intervalSecs); // token expires in 5 seconds + ztsClientMock.setRoleName("role1"); + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.anyString(), + Mockito.anyString(), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenReturn(principal); + + ZTSClient client = new ZTSClient("http://localhost:4080/", "user_domain", "user"); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + client.setSIAClient(siaClient); + + String domain1 = "coretech"; + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain1, "role1"); + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain1, "role2"); + + // initially, roleToken was never fetched. + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null) < 0); + + // initialize the prefetch token process. + client.prefetchAwsCred(domain1, "role1", null, null); + // make sure only unique items are in the queue + long scheduledItemsSize = client.getScheduledItemsSize(); + assertEquals(scheduledItemsSize, 1); + + AWSTemporaryCredentials awsCred1 = client.getAWSTemporaryCredentials(domain1, "role1"); + assertTrue(awsCred1 != null); + long rtExpiry = awsCred1.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldCallServer: awsCred1:domain=" + domain1 + " expires at " + rtExpiry + " curtime_millis=" + System.currentTimeMillis()); + + System.out.println("testPrefetchAwsCredShouldCallServer: sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchAwsCredShouldCallServer: nap over so what happened"); + + assertEquals(client.getScheduledItemsSize(), 1); + + long lastTimerTriggered1 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + long lastTokenFetchedTime1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + awsCred1 = client.getAWSTemporaryCredentials(domain1, "role1"); + long rtExpiry2 = awsCred1.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldCallServer: roleToken1:domain=" + domain1 + " expires at " + rtExpiry2 + " curtime_millis=" + System.currentTimeMillis()); + assertTrue(rtExpiry2 > rtExpiry); // this token was refreshed + + assertTrue(lastTokenFetchedTime1 > 0); + + // wait a few seconds, and see subsequent fetch happened. + System.out.println("testPrefetchAwsCredShouldCallServer: again sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchAwsCredShouldCallServer: again nap over so what happened"); + + long lastTokenFetchedTime2 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + AWSTemporaryCredentials awsCred2 = client.getAWSTemporaryCredentials(domain1, "role1"); + long rt2Expiry = awsCred2.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldCallServer: awsCred2:domain=" + domain1 + " expires at " + rt2Expiry + " curtime_millis=" + System.currentTimeMillis()); + assertTrue(rt2Expiry > rtExpiry2); // this token was refreshed + + // token should be different + assertNotEquals(awsCred1.getSessionToken(), awsCred2.getSessionToken()); + + long lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + + long lastTimerTriggered2 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + // Since token should be good for 5 seconds, lastTokenFetchedTime1 & 2 & 3 all should be different, + assertNotEquals(lastTokenFetchedTime1, lastTokenFetchedTime2); + assertNotEquals(lastTokenFetchedTime3, lastTokenFetchedTime2); + + // make sure the Timer actually triggered. + assertTrue(lastTimerTriggered1 > 0); + assertTrue(lastTimerTriggered2 > 0); + assertNotEquals(lastTimerTriggered1, lastTimerTriggered2); + assertTrue(lastTimerTriggered2 > lastTimerTriggered1); + + client.prefetchAwsCred(domain1, "role2", null, null); + assertEquals(client.getScheduledItemsSize(), scheduledItemsSize + 1); + + AWSTemporaryCredentials awsCred4 = client.getAWSTemporaryCredentials(domain1, "role2"); + assertTrue(awsCred4 != null); + long rtExpiry3 = awsCred4.getExpiration().millis(); + System.out.println("testPrefetchAwsCredShouldCallServer: awsCred4:domain=" + domain1 + " role=role2 expires at " + rtExpiry3 + " curtime_millis=" + System.currentTimeMillis()); + + lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role2", null); + assertTrue(lastTokenFetchedTime3 > lastTokenFetchedTime2); + + AWSTemporaryCredentials awsCred5 = client.getAWSTemporaryCredentials(domain1, "role1"); + assertTrue(awsCred5 != null); + assertNotEquals(awsCred4.getAccessKeyId(), awsCred5.getAccessKeyId()); + + client.removePrefetcher(); + client.close(); + } + + @Test + public void testPrefetchShouldCallServer() throws Exception { + System.out.println("testPrefetchShouldCallServer"); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + int intervalSecs = Integer.parseInt(System.getProperty(ZTSClient.ZTS_CLIENT_PROP_PREFETCH_SLEEP_INTERVAL, "5")); + ztsClientMock.setTestSleepInterval(intervalSecs); + ztsClientMock.setExpiryTime(intervalSecs); // token expires in 5 seconds + ztsClientMock.setRoleName("role1"); + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + SIAClient siaClient = Mockito.mock(SIAClient.class); + Mockito.when(siaClient.getServicePrincipal(Mockito.anyString(), + Mockito.anyString(), Mockito.anyInt(), Mockito.anyInt(), + Mockito.eq(false))).thenReturn(principal); + + ZTSClient client = new ZTSClient("http://localhost:4080/", "user_domain", "user"); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + client.setSIAClient(siaClient); + + String domain1 = "coretech"; + ztsClientMock.setAwsCreds(Timestamp.fromCurrentTime(), domain1, "role1"); + + // initially, roleToken was never fetched. + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null) < 0); + assertTrue(ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null) < 0); + + // initialize the prefetch token process. + client.prefetchRoleToken(domain1, null, null, null, null); + // make sure only unique items are in the queue + assertEquals(client.getScheduledItemsSize(), 1); + + // initialize the prefetch aws processing + client.prefetchAwsCred(domain1, "role1", null, null); + assertEquals(client.getScheduledItemsSize(), 2); + + RoleToken roleToken1 = client.getRoleToken(domain1); + assertTrue(roleToken1 != null); + long rtExpiry = roleToken1.getExpiryTime(); + System.out.println("testPrefetchShouldCallServer: roleToken1:domain=" + domain1 + " expires at " + rtExpiry + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + + AWSTemporaryCredentials awsCred1 = client.getAWSTemporaryCredentials(domain1, "role1"); + assertTrue(awsCred1 != null); + long awsExpiry = awsCred1.getExpiration().millis(); + System.out.println("testPrefetchShouldCallServer: awsCred1:domain=" + domain1 + " expires at " + awsExpiry + " curtime_millis=" + System.currentTimeMillis()); + assertEquals(client.getScheduledItemsSize(), 2); + + System.out.println("testPrefetchShouldCallServer: sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchShouldCallServer: nap over so what happened"); + + assertEquals(client.getScheduledItemsSize(), 2); + + long lastTimerTriggered1 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + long lastTokenFetchedTime1 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + roleToken1 = client.getRoleToken(domain1); + long rtExpiry2 = roleToken1.getExpiryTime(); + System.out.println("testPrefetchShouldCallServer: roleToken1:domain=" + domain1 + " expires at " + rtExpiry2 + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + assertTrue(rtExpiry2 > rtExpiry); // this token was refreshed + + assertTrue(lastTokenFetchedTime1 > 0); + + long lastTokenFetchedTime1aws = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + AWSTemporaryCredentials awsCredLast = client.getAWSTemporaryCredentials(domain1, "role1"); + long awsExpiry2 = awsCredLast.getExpiration().millis(); + System.out.println("testPrefetchShouldCallServer: awsCred1:domain=" + domain1 + " expires at " + awsExpiry2 + " curtime_millis=" + System.currentTimeMillis()); + assertTrue(awsExpiry2 > awsExpiry); // this token was refreshed + + assertTrue(lastTokenFetchedTime1aws > 0); + + // wait a few seconds, and see subsequent fetch happened. + System.out.println("testPrefetchShouldCallServer: again sleep Secs=" + (2*intervalSecs) + "+0.1"); + Thread.sleep((2 * intervalSecs * 1000) + 100); + System.out.println("testPrefetchShouldCallServer: again nap over so what happened"); + + long lastTokenFetchedTime2 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + long lastTokenFetchedTime2aws = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + + RoleToken roleToken2 = client.getRoleToken(domain1); + long rt2Expiry = roleToken2.getExpiryTime(); + System.out.println("testPrefetchShouldCallServer: roleToken2:domain=" + domain1 + " expires at " + rt2Expiry + " curtime_secs=" + (System.currentTimeMillis() / 1000)); + assertTrue(rt2Expiry > rtExpiry2); // this token was refreshed + + // token should be different + assertNotEquals(roleToken1.getToken(), roleToken2.getToken()); + + long lastTokenFetchedTime3 = ztsClientMock.getLastRoleTokenFetchedTime(domain1, null, null); + + AWSTemporaryCredentials awsCred3 = client.getAWSTemporaryCredentials(domain1, "role1"); + long awsExpiry3 = awsCred3.getExpiration().millis(); + System.out.println("testPrefetchShouldCallServer: awsCred3:domain=" + domain1 + " expires at " + awsExpiry3 + " curtime_millis=" + System.currentTimeMillis()); + assertTrue(awsExpiry3 > awsExpiry2); // this token was refreshed + + // token should be different + assertNotEquals(awsCredLast.getSessionToken(), awsCred3.getSessionToken()); + + long lastTokenFetchedTime3aws = ztsClientMock.getLastRoleTokenFetchedTime(domain1, "role1", null); + + long lastTimerTriggered2 = ZTSClient.FETCHER_LAST_RUN_AT.get(); + + // Since token should be good for 5 seconds, lastTokenFetchedTime1 & 2 & 3 all should be different, + assertNotEquals(lastTokenFetchedTime1, lastTokenFetchedTime2); + assertNotEquals(lastTokenFetchedTime3, lastTokenFetchedTime2); + + assertNotEquals(lastTokenFetchedTime1aws, lastTokenFetchedTime2aws); + assertNotEquals(lastTokenFetchedTime3aws, lastTokenFetchedTime2aws); + + // make sure the Timer actually triggered. + assertTrue(lastTimerTriggered1 > 0); + assertTrue(lastTimerTriggered2 > 0); + assertNotEquals(lastTimerTriggered1, lastTimerTriggered2); + assertTrue(lastTimerTriggered2 > lastTimerTriggered1); + + client.removePrefetcher(); + client.close(); + } + + @Test + public void testGetHostServices() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + + HostServices hostServices = client.getHostServices("host.exist"); + + assertEquals(hostServices.getHost(), "host.exist"); + assertEquals(hostServices.getNames().size(), 2); + + try { + client.getHostServices("not.exist.host"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 404); + } + + client.close(); + } + + @Test + public void testGetPublicKeyEntry() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + + PublicKeyEntry publicKeyEntry = client.getPublicKeyEntry("coretech", "storage", "key1"); + assertEquals(publicKeyEntry.getId(), "key1"); + assertEquals(publicKeyEntry.getKey(), "test-key"); + + try { + client.getPublicKeyEntry("invalid.domain", "storage", "key1"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 404); + } + + client.close(); + } + + @Test + public void testGetServiceIdentity() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + + ServiceIdentity serviceIdentity = client.getServiceIdentity("coretech", "storage"); + assertEquals(serviceIdentity.getName(), "storage"); + + try { + client.getServiceIdentity("unknown.domain", "storage"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 404); + } + + client.close(); + } + + @Test + public void testGetServiceIdentityList() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + + ServiceIdentityList serviceIdentityList = client.getServiceIdentityList("coretech"); + assertEquals(serviceIdentityList.getNames(), Arrays.asList("storage")); + + try { + client.getServiceIdentityList("unknown.domain"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 404); + } + + client.close(); + } + + @Test + public void testGetRoleTokenName() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + + RoleToken roleToken = client.getRoleToken("coretech", "role1"); + assertNotNull(roleToken); + + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getDomain(), "coretech"); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("role1")); + + try { + roleToken = client.getRoleToken("coretech", "role2"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 403); + } + client.close(); + } + + @Test + public void testGetRoleTokenSuffixInvalid() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + + try { + client.getRoleToken("coretech", null); + fail(); + } catch (IllegalArgumentException ex) { + // expected exception + assertTrue(true); + } catch (Exception ex) { + fail(); + } + + try { + client.getRoleToken("coretech", ""); + fail(); + } catch (IllegalArgumentException ex) { + // expected exception + assertTrue(true); + } catch (Exception ex) { + fail(); + } + client.close(); + } + + @Test + public void testGetRoleTokenCacheExpire() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.removePrefetcher(); + client.setZTSRDLGeneratedClient(ztsClientMock); + + RoleToken roleToken = client.getRoleToken("coretech"); + assertNotNull(roleToken); + + // now we're going to get a token again without any expiry timeouts and this time + // we should get back from our cache thus the same exact one + + RoleToken roleToken2 = client.getRoleToken("coretech"); + assertTrue(roleToken2.getToken().equals(roleToken.getToken())); + + // now we're going to use the full API to request the token with timeouts + // that should satisfy the expiry time and thus get back the same one + + roleToken2 = client.getRoleToken("coretech", null, 1800, 3600, false); + assertTrue(roleToken2.getToken().equals(roleToken.getToken())); + + // this time we're going to ask for an increased min expiry time + // thus the cache should no longer be satisfied + + roleToken2 = client.getRoleToken("coretech", null, 2800, 3600, false); + assertFalse(roleToken2.getToken().equals(roleToken.getToken())); + client.close(); + } + + @Test + public void testGetDomainSignedPolicyDataNull() { + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + + Map> responseHeaders = new HashMap<>(); + DomainSignedPolicyData domainSignedPolicyData = client.getDomainSignedPolicyData("coretech", null, responseHeaders); + assertNull(domainSignedPolicyData); + client.close(); + } + + @Test + public void testGetDomainSignedPolicyData() { + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setPolicyName("policy1"); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + + Map> responseHeaders = new HashMap<>(); + DomainSignedPolicyData domainSignedPolicyData = client.getDomainSignedPolicyData("coretech", null, responseHeaders); + assertNotNull(domainSignedPolicyData); + + SignedPolicyData signedPolicyData = domainSignedPolicyData.getSignedPolicyData(); + assertNotNull(signedPolicyData); + assertEquals(signedPolicyData.getZmsSignature(), "zmsSignature"); + assertEquals(signedPolicyData.getZmsKeyId(), "0"); + + try { + client.getDomainSignedPolicyData(null, null, responseHeaders); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + PolicyData policyData = signedPolicyData.getPolicyData(); + assertNotNull(policyData); + assertEquals(policyData.getDomain(), "coretech"); + + List policyList = policyData.getPolicies(); + assertNotNull(policyList); + assertEquals(policyList.size(), 1); + assertEquals(policyList.get(0).getName(), "policy1"); + client.close(); + } + + @Test + public void testGetTenantDomains() { + ZTSClientMock ztsClientMock = new ZTSClientMock(); + List tenantDomains = new ArrayList<>(); + tenantDomains.add("iaas.athenz"); + tenantDomains.add("coretech.storage"); + ztsClientMock.setTenantDomains(tenantDomains); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + + TenantDomains doms = client.getTenantDomains("provider", "user", "admin", "storage"); + assertNotNull(doms); + assertTrue(doms.getTenantDomainNames().contains("iaas.athenz")); + assertTrue(doms.getTenantDomainNames().contains("coretech.storage")); + + try { + client.getTenantDomains("unknown", "user", "admin", "storage"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } catch (Exception ex) { + fail(); + } + + client.close(); + } + + @Test + public void testGetAWSTemporaryCredentials() { + + Timestamp currentTime = Timestamp.fromCurrentTime(); + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setAwsCreds(currentTime, "coretech", "role", "sessionToken", "secretAccessKey", "accessKeyId"); + + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + + AWSTemporaryCredentials awsCreds = client.getAWSTemporaryCredentials("coretech", "role"); + assertNotNull(awsCreds); + assertEquals("accessKeyId", awsCreds.getAccessKeyId()); + assertEquals("secretAccessKey", awsCreds.getSecretAccessKey()); + assertTrue(awsCreds.getSessionToken().startsWith("sessionToken")); + currentTime = awsCreds.getExpiration(); + + AWSTemporaryCredentials awsCreds2 = client.getAWSTemporaryCredentials("coretech", "role"); + assertNotNull(awsCreds2); + assertEquals("accessKeyId", awsCreds2.getAccessKeyId()); + assertEquals("secretAccessKey", awsCreds2.getSecretAccessKey()); + assertTrue(awsCreds2.getSessionToken().startsWith("sessionToken")); + assertEquals(currentTime.millis() / 1000, awsCreds2.getExpiration().millis() / 1000); + + // now let's try with invalid domain/role values; + + assertNull(client.getAWSTemporaryCredentials("coretech", "role1")); + assertNull(client.getAWSTemporaryCredentials("coretech1", "role")); + + client.close(); + } + + @Test + public void testGetAWSTemporaryCredentialsException() { + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + + try { + client.getAWSTemporaryCredentials("coretech", "role"); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 404); + } + + client.close(); + } + + @Test + public void testHostnameVerifierSupport() { + + ZTSRDLGeneratedClientMock client = new ZTSRDLGeneratedClientMock("http://localhost:4080", null); + assertNull(client.getHostnameVerifier()); + + HostnameVerifier hostnameVerifier = new ZTSClientTest.TestHostVerifier(); + client = new ZTSRDLGeneratedClientMock("http://localhost:4080", null, hostnameVerifier); + assertNotNull(client.getHostnameVerifier()); + } + + @Test + public void testHostnamVerifierDnsMatchStandard() { + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + ZTSClient.AWSHostNameVerifier hostnameVerifier = client.new AWSHostNameVerifier("host1"); + + ArrayList> altNames = new ArrayList<>(); + ArrayList rfcName = new ArrayList<>(); + rfcName.add(Integer.valueOf(1)); + rfcName.add("rfcname"); + altNames.add(rfcName); + + ArrayList dnsName = new ArrayList<>(); + dnsName.add(Integer.valueOf(2)); + dnsName.add("host1"); + altNames.add(dnsName); + + assertTrue(hostnameVerifier.matchDnsHostname(altNames)); + + ArrayList> altNames2 = new ArrayList<>(); + ArrayList rfcName2 = new ArrayList<>(); + rfcName2.add(Integer.valueOf(1)); + rfcName2.add("rfcname"); + altNames2.add(rfcName2); + + ArrayList dnsName2 = new ArrayList<>(); + dnsName2.add(Integer.valueOf(2)); + dnsName2.add("host11"); + altNames2.add(dnsName2); + + assertFalse(hostnameVerifier.matchDnsHostname(altNames2)); + + client.close(); + } + + @Test + public void testHostnamVerifierDnsMatchWildcard() { + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + ZTSClient.AWSHostNameVerifier hostnameVerifier = client.new AWSHostNameVerifier("*.host1"); + + ArrayList> altNames = new ArrayList<>(); + ArrayList rfcName = new ArrayList<>(); + rfcName.add(Integer.valueOf(1)); + rfcName.add("rfcname"); + altNames.add(rfcName); + + ArrayList dnsName = new ArrayList<>(); + dnsName.add(Integer.valueOf(2)); + dnsName.add("*.host1"); + altNames.add(dnsName); + + assertTrue(hostnameVerifier.matchDnsHostname(altNames)); + + ArrayList> altNames2 = new ArrayList<>(); + ArrayList rfcName2 = new ArrayList<>(); + rfcName2.add(Integer.valueOf(1)); + rfcName2.add("rfcname"); + altNames2.add(rfcName2); + + ArrayList dnsName2 = new ArrayList<>(); + dnsName2.add(Integer.valueOf(2)); + dnsName2.add("*.host11"); + altNames2.add(dnsName2); + + assertFalse(hostnameVerifier.matchDnsHostname(altNames2)); + + client.close(); + } + + @Test + public void testHostnamVerifierDnsMatchNone() { + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + ZTSClient.AWSHostNameVerifier hostnameVerifier = client.new AWSHostNameVerifier("host1"); + + ArrayList> altNames = new ArrayList<>(); + ArrayList rfcName = new ArrayList<>(); + rfcName.add(Integer.valueOf(1)); + rfcName.add("rfcname"); + altNames.add(rfcName); + + ArrayList dnsName = new ArrayList<>(); + dnsName.add(Integer.valueOf(3)); + dnsName.add("host1"); + altNames.add(dnsName); + + assertFalse(hostnameVerifier.matchDnsHostname(altNames)); + client.close(); + } + + @Test + public void testHostnamVerifierDnsNull() { + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + ZTSClient.AWSHostNameVerifier hostnameVerifier = client.new AWSHostNameVerifier("host1"); + + assertFalse(hostnameVerifier.matchDnsHostname(null)); + client.close(); + } + + private static class TestHostVerifier implements HostnameVerifier { + + public boolean verify(String hostname, SSLSession session) { + return true; + } + } + + @Test + public void testPostInstanceRefreshRequest() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setZTSRDLGeneratedClient(ztsClientMock); + + InstanceRefreshRequest req = new InstanceRefreshRequest().setExpiryTime(600); + Identity identity = client.postInstanceRefreshRequest("coretech", "unit", req); + assertNotNull(identity); + assertNotNull(identity.getServiceToken()); + client.close(); + } + + @Test + public void testPostInstanceRefreshRequestException() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setZTSRDLGeneratedClient(ztsClientMock); + + InstanceRefreshRequest req = new InstanceRefreshRequest().setExpiryTime(600); + try { + client.postInstanceRefreshRequest("exc", "unit", req); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 400); + } + client.close(); + } + + @Test + public void testGetRoleTokenWithUserData() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ztsClientMock.setRoleName("role1"); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setZTSRDLGeneratedClient(ztsClientMock); + + RoleToken roleToken = client.getRoleToken("coretech", null, null, null, true, "user_domain.user4"); + assertNotNull(roleToken); + + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getDomain(), "coretech"); + assertEquals(1, token.getRoles().size()); + assertTrue(token.getRoles().contains("role1")); + assertEquals(token.getProxyUser(), "user_domain.user4"); + + client.close(); + } + + @Test + public void testGetRoleAccess() { + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + + RoleAccess roleAccess = client.getRoleAccess("coretech", "yby.user"); + List roles = roleAccess.getRoles(); + assertEquals(roles.size(), 2); + assertTrue(roles.contains("role1")); + + try { + client.getRoleAccess("exc", "yby.user"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + client.getRoleAccess("unknown", "yby.user"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 404); + } + client.close(); + } + + @Test + public void testGetAccess() { + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + + Access access = client.getAccess("coretech", "match", "user_domain.user1"); + assertTrue(access.getGranted()); + + access = client.getAccess("coretech", "no-match", "user_domain.user1"); + assertFalse(access.getGranted()); + + try { + client.getAccess("exc", "match", "user_domain.user1"); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 400); + } + + client.close(); + } + + @Test + public void testPostDomainMetrics() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setZTSRDLGeneratedClient(ztsClientMock); + + List metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(99)); + DomainMetrics req = new DomainMetrics(). + setDomainName("coretech"). + setMetricList(metricList); + client.postDomainMetrics("coretech", req); + client.close(); + } + + @Test + public void testPostDomainMetricsBadRequest() { + + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setZTSRDLGeneratedClient(ztsClientMock); + + List metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(99)); + DomainMetrics req = new DomainMetrics(). + setDomainName("coretech"). + setMetricList(metricList); + try { + client.postDomainMetrics("exc", req); + fail(); + } catch (ZTSClientException ex) { + assertEquals(ex.getCode(), 400); + } + client.close(); + } + + @Test + public void testPrefetchInterval() { + Principal principal = SimplePrincipal.create("user_domain", "user", "auth_creds", PRINCIPAL_AUTHORITY); + ZTSClient client = new ZTSClient("http://localhost:4080", principal); + client.setPrefetchInterval(10L); + assertEquals(client.getPrefetchInterval(), 10l); + + client.close(); + } + + @Test + public void testException() { + + List codes = Arrays.asList(200, 201, 202, 204, 301, 302, 303, 304 + ,307, 400, 401, 403, 404, 409, 410, 412, 415, 500, 501, 503); + + for (int code : codes) { + ResourceException e = new ResourceException(code); + assertNotNull(e.getData()); + } + + ResourceException ex = new ResourceException(400); + + assertEquals(ex.getCode(), 400); + assertEquals(ex.getData().toString(), "{code: 400, message: \"Bad Request\"}"); + } + + @Test + public void testHostNameVerifierVerifyCertNull() throws SSLPeerUnverifiedException { + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + ZTSClient.AWSHostNameVerifier hostnameVerifier = client.new AWSHostNameVerifier("host1"); + + SSLSession session = Mockito.mock(SSLSession.class); + Mockito.when(session.getPeerCertificates()).thenReturn(null); + + assertFalse(hostnameVerifier.verify("host1", session)); + + System.out.println("hashCode:" + client.hashCode()); + + client.close(); + } + + + final static String crlf = System.getProperty("line.separator"); + final static String test_cert = + "-----BEGIN CERTIFICATE-----"+crlf + + "MIIDRDCCAiwCCQDltWO9Xjhd8DANBgkqhkiG9w0BAQUFADBkMQswCQYDVQQGEwJK"+crlf + + "UDEOMAwGA1UECBMFVG9reW8xEjAQBgNVBAcTCVN1bWlkYS1rdTEPMA0GA1UEChMG"+crlf + + "WUpURVNUMQ8wDQYDVQQLEwZZSlRFU1QxDzANBgNVBAMTBllKVEVTVDAeFw0xNjEx"+crlf + + "MTEwODMzMTVaFw0yNjExMDkwODMzMTVaMGQxCzAJBgNVBAYTAkpQMQ4wDAYDVQQI"+crlf + + "EwVUb2t5bzESMBAGA1UEBxMJU3VtaWRhLWt1MQ8wDQYDVQQKEwZZSlRFU1QxDzAN"+crlf + + "BgNVBAsTBllKVEVTVDEPMA0GA1UEAxMGWUpURVNUMIIBIjANBgkqhkiG9w0BAQEF"+crlf + + "AAOCAQ8AMIIBCgKCAQEA1Ssz+hLCTXyMlDH9E0bd9EEm0yNyPH4XhtUkSEDdYE+Z"+crlf + + "0m/7BkfrKTRRew8wrfpLkK0wZsoVkEjwd0GktZXnGTRUs42Bd5tSYXV1Z78oqjS4"+crlf + + "AGpjkQlQva+f6ANnDhPNxHJ6QlY6DLePIByjepmJS8UZGRuNPiDpbtWWhuCLbn6p"+crlf + + "to2SiclLHr6K/5uFYjawS8k3bGmoV9QfeWvY+aiGvuxDsPCxcePpwSA8btubpTsJ"+crlf + + "CvC31rJChgN5VQFE26vfhVCwmuhwOCcUThdgaI9LAjLETknrLt/kiFaiIhm5peSG"+crlf + + "t0DP89u9fnaUX7P8jc/4V57lnp+ynRpGpHfv4Fi4wQIDAQABMA0GCSqGSIb3DQEB"+crlf + + "BQUAA4IBAQARH92fKPsVoCq80ARt70LM8ynaq9dlXcLjr34CWINbGbXG4a0RP1l9"+crlf + + "bFZih7rCG96W+fDKxvgR2YwXhRJq5NchOoBB0mtOBG3VwbXFNm6CBHqwtbrNiPzv"+crlf + + "BvK7jerZd1g0CgTWzfoPgO/87F2uX5J92CsvXRYrDJsFYHnhmUg3JWCT4q+Xe9J4"+crlf + + "/Eyw+C1DgDwWjjBB1Qb3QBO/dpGR+EWv4mtNK8D2o+iEFJLjtNdqIkcrUIXfqI8M"+crlf + + "z+7Tph5eLFgI5lEW+Pu/myzLIXCNWoRr7UQute898v/1XZiRS4sSCEQSgXnZflA8"+crlf + + "c2KrYjMGSUogzw6+1gKeucygV32rA2B2"+crlf + + "-----END CERTIFICATE-----"; + + @Test + public void testHostNameVerifierVerifyCert() throws CertificateException, IOException { + ZTSClientMock ztsClientMock = new ZTSClientMock(); + ZTSClient client = new ZTSClient("http://localhost:4080", (Principal) null); + client.setZTSRDLGeneratedClient(ztsClientMock); + ZTSClient.AWSHostNameVerifier hostnameVerifier = client.new AWSHostNameVerifier("host1"); + + InputStream is = new ByteArrayInputStream(test_cert.getBytes("utf-8")); + + CertificateFactory cf = CertificateFactory.getInstance("X.509"); + java.security.cert.Certificate cert = cf.generateCertificate(is); + is.close(); + + Certificate[] certs = new Certificate[1]; certs[0] = cert; + + SSLSession session = Mockito.mock(SSLSession.class); + Mockito.when(session.getPeerCertificates()).thenReturn(certs); + + + assertFalse(hostnameVerifier.verify("unknown", session)); + client.close(); + } +} diff --git a/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSRDLGeneratedClientMock.java b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSRDLGeneratedClientMock.java new file mode 100644 index 00000000000..fc47d4fef67 --- /dev/null +++ b/clients/java/zts/src/test/java/com/yahoo/athenz/zts/ZTSRDLGeneratedClientMock.java @@ -0,0 +1,45 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import javax.net.ssl.HostnameVerifier; + +import com.yahoo.athenz.auth.Principal; + +public class ZTSRDLGeneratedClientMock extends ZTSRDLGeneratedClient { + + public ZTSRDLGeneratedClientMock(String url) { + super(url); + } + + public ZTSRDLGeneratedClientMock(String url, Principal identity) { + super(url); + if (identity != null && identity.getAuthority() != null) { + addCredentials(identity.getAuthority().getHeader(), identity.getCredentials()); + } + } + + public ZTSRDLGeneratedClientMock(String url, Principal identity, HostnameVerifier hostnameVerifier) { + super(url, hostnameVerifier); + if (identity != null && identity.getAuthority() != null) { + addCredentials(identity.getAuthority().getHeader(), identity.getCredentials()); + } + } + + public HostnameVerifier getHostnameVerifier() { + return client.getHostnameVerifier(); + } +} diff --git a/clients/java/zts/src/test/resources/META-INF/services/com.yahoo.athenz.zts.ZTSClientService b/clients/java/zts/src/test/resources/META-INF/services/com.yahoo.athenz.zts.ZTSClientService new file mode 100644 index 00000000000..2ad3df47c5c --- /dev/null +++ b/clients/java/zts/src/test/resources/META-INF/services/com.yahoo.athenz.zts.ZTSClientService @@ -0,0 +1 @@ +com.yahoo.athenz.zts.ZTSClientServiceProvider diff --git a/clients/java/zts/src/test/resources/athenz.conf b/clients/java/zts/src/test/resources/athenz.conf new file mode 100644 index 00000000000..bddf2f268aa --- /dev/null +++ b/clients/java/zts/src/test/resources/athenz.conf @@ -0,0 +1,17 @@ +{ + "zmsUrl": "https://dev.zms.athenzcompany.com:4443/", + "ztsUrl": "https://dev.zts.athenzcompany.com:4443/", + "ztsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ], + "zmsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ] +} + diff --git a/core/zms/README.md b/core/zms/README.md new file mode 100644 index 00000000000..d9a36f84d6e --- /dev/null +++ b/core/zms/README.md @@ -0,0 +1,12 @@ +ZMS Core Support +================ + +Contains the ZMS interface and support classes. + +The interface, schema, and support classes are generated from the ZMS RDL definition herein. Clients and servers will use these classes to implement the interface. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/core/zms/pom.xml b/core/zms/pom.xml new file mode 100644 index 00000000000..c382b4b4995 --- /dev/null +++ b/core/zms/pom.xml @@ -0,0 +1,67 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../pom.xml + + + zms_core + jar + zms_core + Core ZMS Interfaces + + + + com.fasterxml.jackson.core + jackson-databind + ${jackson.version} + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + + + + + org.codehaus.mojo + exec-maven-plugin + 1.1.1 + + + + exec + + generate-sources + + + + bash + + scripts/make_stubs.sh + + + + + + + diff --git a/core/zms/scripts/make_stubs.sh b/core/zms/scripts/make_stubs.sh new file mode 100755 index 00000000000..4fcbae50071 --- /dev/null +++ b/core/zms/scripts/make_stubs.sh @@ -0,0 +1,27 @@ +#!/bin/bash + +# If any of the RDL files have been updated, then this script should be run +# rdl to generate the appropriate model classes. + +# Note this script is dependent on the rdl utility. +# go get github.com/ardielle/ardielle-tools/... +# + +command -v rdl >/dev/null 2>&1 || { + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "SOURCE WARNING"; + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "Please install rdl utility: go get github.com/ardielle/ardielle-tools/..."; + echo >&2 "Skipping source generation..."; + exit 0; +} + +RDL_ZMS_FILE=src/main/rdl/ZMS.rdl +RDL_PROVIDER_FILE=src/main/rdl/Provider.rdl + +echo "Generating model classes..." +rdl -s generate -x getsetters=true -o src/main/java java-model $RDL_ZMS_FILE +rdl -s generate -x getsetters=true -o src/main/java java-model $RDL_PROVIDER_FILE + +# Copyright 2016 Yahoo Inc. +# Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. diff --git a/core/zms/src/main/java/com/yahoo/athenz/provider/ProviderSchema.java b/core/zms/src/main/java/com/yahoo/athenz/provider/ProviderSchema.java new file mode 100644 index 00000000000..6de2a5e53d2 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/provider/ProviderSchema.java @@ -0,0 +1,187 @@ +// +// This file generated by rdl 1.4.8 +// + +package com.yahoo.athenz.provider; +import com.yahoo.rdl.*; + +public class ProviderSchema { + + private final static Schema INSTANCE = build(); + public static Schema instance() { + return INSTANCE; + } + + private static Schema build() { + SchemaBuilder sb = new SchemaBuilder("Provider"); + sb.version(1); + sb.namespace("com.yahoo.athenz.provider"); + sb.comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. This \"service\" definition is just to provide a generic client stub for any service implementing the provider API"); + + sb.stringType("SimpleName") + .comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. Common name types used by several API definitions A simple identifier, an element of compound name.") + .pattern("[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("CompoundName") + .comment("A compound name. Most names in this API are compound names.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("DomainName") + .comment("A domain name is the general qualifier prefix, as its uniqueness is managed.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("EntityName") + .comment("An entity name is a short form of a resource name, including only the domain and entity.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ServiceName") + .comment("A service name will generally be a unique subdomain.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("LocationName") + .comment("A location name is not yet defined, but will be a dotted name like everything else.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ActionName") + .comment("An action (operation) name.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ResourceName") + .comment("A shorthand for a YRN with no service or location. The 'tail' of a YRN, just the domain:entity. Note that the EntityName part is optional, that is, a domain name followed by a colon is valid resource name.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?"); + + sb.stringType("YRN") + .comment("A full Yahoo Resource name (YRN).") + .pattern("(yrn:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:)?([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?"); + + sb.stringType("YBase64") + .comment("The Y-specific URL-safe Base64 variant.") + .pattern("[a-zA-Z0-9\\._-]+"); + + sb.stringType("YEncoded") + .comment("YEncoded includes ybase64 chars, as well as = and %. This can represent a user cookie and URL-encoded values.") + .pattern("[a-zA-Z0-9\\._%=-]*"); + + sb.stringType("AuthorityName") + .comment("Used as the prefix in a signed assertion. This uniquely identifies a signing authority. i.e. \"user\"") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("SignedToken") + .comment("A signed assertion if identity. i.e. the user cookie value. This token will only make sense to the authority that generated it, so it is beneficial to have something in the value that is cheaply recognized to quickly reject if it belongs to another authority. In addition to the YEncoded set our token includes ; to separate components and , to separate roles and : for IPv6 addresses") + .pattern("[a-zA-Z0-9\\._%=:;,-]*"); + + sb.enumType("TenantState") + .element("INACTIVE") + .element("PENDING") + .element("ACTIVE"); + + sb.structType("Tenant") + .field("service", "SimpleName", false, "name of the service") + .field("name", "DomainName", false, "name of the tenant domain in this service. Must be a valid domain name the caller has rights to") + .field("state", "TenantState", false, "the state of the tenant", null) + .arrayField("roles", "EntityName", true, "the roles this tenant may assume. Determined by and returned by this service") + .arrayField("resourceGroups", "EntityName", true, "registered resource groups for this tenant"); + + sb.structType("TenantResourceGroup") + .field("service", "SimpleName", false, "name of the service") + .field("name", "DomainName", false, "name of the tenant domain in this service. Must be a valid domain name the caller has rights to") + .field("resourceGroup", "EntityName", false, "resource group for this tenant") + .arrayField("roles", "EntityName", true, "the roles this tenant may assume. Determined by and returned by this service"); + + + sb.resource("Tenant", "PUT", "/service/{service}/tenant/{tenant}") + .comment("Create a new tenant in this provider note optional 3rd arg in this case -- it is unusual!") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("tenant", "DomainName", "name of the tenant domain in this service") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("template", "Tenant", "") + .auth("assume_role", "role.{service}.tenant.{tenant}.admin", false, "{tenant}") + .expected("OK") + .exception("ACCEPTED", "Tenant", "") + + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Tenant", "GET", "/service/{service}/tenant/{tenant}") + .comment("Get information about the tenant") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("tenant", "DomainName", "name of the tenant domain in this service") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Tenant", "DELETE", "/service/{service}/tenant/{tenant}") + .comment("Remove a tenant and all its resources. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("tenant", "DomainName", "name of the tenant domain in this service") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("assume_role", "role.{service}.tenant.{tenant}.admin", false, "{tenant}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantResourceGroup", "PUT", "/service/{service}/tenant/{tenant}/resourceGroup/{resourceGroup}") + .comment("Create a new resource group for this tenant in this provider. The tenant must already be registered with the provider") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("tenant", "DomainName", "name of the tenant domain in this service") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("template", "TenantResourceGroup", "") + .auth("assume_role", "role.{service}.tenant.{tenant}.admin", false, "{tenant}") + .expected("OK") + .exception("ACCEPTED", "Tenant", "") + + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantResourceGroup", "DELETE", "/service/{service}/tenant/{tenant}/resourceGroup/{resourceGroup}") + .comment("Remove the specified resource group from this tenant and all its resources.") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("tenant", "DomainName", "name of the tenant domain in this service") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("assume_role", "role.{service}.tenant.{tenant}.admin", false, "{tenant}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + + return sb.build(); + } + +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/provider/Tenant.java b/core/zms/src/main/java/com/yahoo/athenz/provider/Tenant.java new file mode 100644 index 00000000000..749739e7303 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/provider/Tenant.java @@ -0,0 +1,85 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.provider; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Tenant - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Tenant { + public String service; + public String name; + @RdlOptional + public TenantState state; + @RdlOptional + public List roles; + @RdlOptional + public List resourceGroups; + + public Tenant setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public Tenant setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public Tenant setState(TenantState state) { + this.state = state; + return this; + } + public TenantState getState() { + return state; + } + public Tenant setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + public Tenant setResourceGroups(List resourceGroups) { + this.resourceGroups = resourceGroups; + return this; + } + public List getResourceGroups() { + return resourceGroups; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Tenant.class) { + return false; + } + Tenant a = (Tenant) another; + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (state == null ? a.state != null : !state.equals(a.state)) { + return false; + } + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + if (resourceGroups == null ? a.resourceGroups != null : !resourceGroups.equals(a.resourceGroups)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/provider/TenantResourceGroup.java b/core/zms/src/main/java/com/yahoo/athenz/provider/TenantResourceGroup.java new file mode 100644 index 00000000000..126c0ae1227 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/provider/TenantResourceGroup.java @@ -0,0 +1,72 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.provider; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TenantResourceGroup - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TenantResourceGroup { + public String service; + public String name; + public String resourceGroup; + @RdlOptional + public List roles; + + public TenantResourceGroup setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public TenantResourceGroup setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public TenantResourceGroup setResourceGroup(String resourceGroup) { + this.resourceGroup = resourceGroup; + return this; + } + public String getResourceGroup() { + return resourceGroup; + } + public TenantResourceGroup setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TenantResourceGroup.class) { + return false; + } + TenantResourceGroup a = (TenantResourceGroup) another; + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (resourceGroup == null ? a.resourceGroup != null : !resourceGroup.equals(a.resourceGroup)) { + return false; + } + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/provider/TenantState.java b/core/zms/src/main/java/com/yahoo/athenz/provider/TenantState.java new file mode 100644 index 00000000000..42e6a8e1a42 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/provider/TenantState.java @@ -0,0 +1,24 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.provider; +import com.yahoo.rdl.*; + +// +// TenantState - +// +public enum TenantState { + INACTIVE, + PENDING, + ACTIVE; + + public static TenantState fromString(String v) { + for (TenantState e : values()) { + if (e.toString().equals(v)) { + return e; + } + } + throw new IllegalArgumentException("Invalid string representation for TenantState: " + v); + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Access.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Access.java new file mode 100644 index 00000000000..198b737ee50 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Access.java @@ -0,0 +1,37 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Access - Access can be checked and returned as this resource. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Access { + public boolean granted; + + public Access setGranted(boolean granted) { + this.granted = granted; + return this; + } + public boolean getGranted() { + return granted; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Access.class) { + return false; + } + Access a = (Access) another; + if (granted != a.granted) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Assertion.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Assertion.java new file mode 100644 index 00000000000..db563490a24 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Assertion.java @@ -0,0 +1,84 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Assertion - A representation for the encapsulation of an action to be +// performed on a resource by a principal. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Assertion { + public String role; + public String resource; + public String action; + @RdlOptional + public AssertionEffect effect; + @RdlOptional + public Long id; + + public Assertion setRole(String role) { + this.role = role; + return this; + } + public String getRole() { + return role; + } + public Assertion setResource(String resource) { + this.resource = resource; + return this; + } + public String getResource() { + return resource; + } + public Assertion setAction(String action) { + this.action = action; + return this; + } + public String getAction() { + return action; + } + public Assertion setEffect(AssertionEffect effect) { + this.effect = effect; + return this; + } + public AssertionEffect getEffect() { + return effect; + } + public Assertion setId(Long id) { + this.id = id; + return this; + } + public Long getId() { + return id; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Assertion.class) { + return false; + } + Assertion a = (Assertion) another; + if (role == null ? a.role != null : !role.equals(a.role)) { + return false; + } + if (resource == null ? a.resource != null : !resource.equals(a.resource)) { + return false; + } + if (action == null ? a.action != null : !action.equals(a.action)) { + return false; + } + if (effect == null ? a.effect != null : !effect.equals(a.effect)) { + return false; + } + if (id == null ? a.id != null : !id.equals(a.id)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/AssertionEffect.java b/core/zms/src/main/java/com/yahoo/athenz/zms/AssertionEffect.java new file mode 100644 index 00000000000..76042be9fa2 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/AssertionEffect.java @@ -0,0 +1,23 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; + +// +// AssertionEffect - Every assertion can have the effect of ALLOW or DENY. +// +public enum AssertionEffect { + ALLOW, + DENY; + + public static AssertionEffect fromString(String v) { + for (AssertionEffect e : values()) { + if (e.toString().equals(v)) { + return e; + } + } + throw new IllegalArgumentException("Invalid string representation for AssertionEffect: " + v); + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DanglingPolicy.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DanglingPolicy.java new file mode 100644 index 00000000000..77d7c65db94 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DanglingPolicy.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DanglingPolicy - A dangling policy where the assertion is referencing a role +// name that doesn't exist in the domain +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DanglingPolicy { + public String policyName; + public String roleName; + + public DanglingPolicy setPolicyName(String policyName) { + this.policyName = policyName; + return this; + } + public String getPolicyName() { + return policyName; + } + public DanglingPolicy setRoleName(String roleName) { + this.roleName = roleName; + return this; + } + public String getRoleName() { + return roleName; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DanglingPolicy.class) { + return false; + } + DanglingPolicy a = (DanglingPolicy) another; + if (policyName == null ? a.policyName != null : !policyName.equals(a.policyName)) { + return false; + } + if (roleName == null ? a.roleName != null : !roleName.equals(a.roleName)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DefaultAdmins.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DefaultAdmins.java new file mode 100644 index 00000000000..17f337cf4f9 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DefaultAdmins.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DefaultAdmins - The list of domain administrators. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DefaultAdmins { + public List admins; + + public DefaultAdmins setAdmins(List admins) { + this.admins = admins; + return this; + } + public List getAdmins() { + return admins; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DefaultAdmins.class) { + return false; + } + DefaultAdmins a = (DefaultAdmins) another; + if (admins == null ? a.admins != null : !admins.equals(a.admins)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Domain.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Domain.java new file mode 100644 index 00000000000..d17b8dec05c --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Domain.java @@ -0,0 +1,151 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Domain - A domain is an independent partition of users, roles, and +// resources. Its name represents the definition of a namespace; the only way a +// new namespace can be created, from the top, is by creating Domains. +// Administration of a domain is governed by the parent domain (using +// reverse-DNS namespaces). The top level domains are governed by the special +// "sys.auth" domain. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Domain { + public String name; + @RdlOptional + public Timestamp modified; + @RdlOptional + public UUID id; + @RdlOptional + public String description; + @RdlOptional + public String org; + @RdlOptional + public Boolean enabled; + @RdlOptional + public Boolean auditEnabled; + @RdlOptional + public String account; + @RdlOptional + public Integer ypmId; + + public Domain setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public Domain setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public Domain setId(UUID id) { + this.id = id; + return this; + } + public UUID getId() { + return id; + } + public Domain setDescription(String description) { + this.description = description; + return this; + } + public String getDescription() { + return description; + } + public Domain setOrg(String org) { + this.org = org; + return this; + } + public String getOrg() { + return org; + } + public Domain setEnabled(Boolean enabled) { + this.enabled = enabled; + return this; + } + public Boolean getEnabled() { + return enabled; + } + public Domain setAuditEnabled(Boolean auditEnabled) { + this.auditEnabled = auditEnabled; + return this; + } + public Boolean getAuditEnabled() { + return auditEnabled; + } + public Domain setAccount(String account) { + this.account = account; + return this; + } + public String getAccount() { + return account; + } + public Domain setYpmId(Integer ypmId) { + this.ypmId = ypmId; + return this; + } + public Integer getYpmId() { + return ypmId; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Domain.class) { + return false; + } + Domain a = (Domain) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (id == null ? a.id != null : !id.equals(a.id)) { + return false; + } + if (description == null ? a.description != null : !description.equals(a.description)) { + return false; + } + if (org == null ? a.org != null : !org.equals(a.org)) { + return false; + } + if (enabled == null ? a.enabled != null : !enabled.equals(a.enabled)) { + return false; + } + if (auditEnabled == null ? a.auditEnabled != null : !auditEnabled.equals(a.auditEnabled)) { + return false; + } + if (account == null ? a.account != null : !account.equals(a.account)) { + return false; + } + if (ypmId == null ? a.ypmId != null : !ypmId.equals(a.ypmId)) { + return false; + } + } + return true; + } + + // + // sets up the instance according to its default field values, if any + // + public Domain init() { + if (enabled == null) { + enabled = true; + } + if (auditEnabled == null) { + auditEnabled = false; + } + return this; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainData.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainData.java new file mode 100644 index 00000000000..70a74608d1c --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainData.java @@ -0,0 +1,117 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainData - A domain object that includes its roles, policies and services. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainData { + public String name; + @RdlOptional + public String account; + @RdlOptional + public Integer ypmId; + public List roles; + public SignedPolicies policies; + public List services; + public List entities; + public Timestamp modified; + + public DomainData setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public DomainData setAccount(String account) { + this.account = account; + return this; + } + public String getAccount() { + return account; + } + public DomainData setYpmId(Integer ypmId) { + this.ypmId = ypmId; + return this; + } + public Integer getYpmId() { + return ypmId; + } + public DomainData setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + public DomainData setPolicies(SignedPolicies policies) { + this.policies = policies; + return this; + } + public SignedPolicies getPolicies() { + return policies; + } + public DomainData setServices(List services) { + this.services = services; + return this; + } + public List getServices() { + return services; + } + public DomainData setEntities(List entities) { + this.entities = entities; + return this; + } + public List getEntities() { + return entities; + } + public DomainData setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainData.class) { + return false; + } + DomainData a = (DomainData) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (account == null ? a.account != null : !account.equals(a.account)) { + return false; + } + if (ypmId == null ? a.ypmId != null : !ypmId.equals(a.ypmId)) { + return false; + } + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + if (policies == null ? a.policies != null : !policies.equals(a.policies)) { + return false; + } + if (services == null ? a.services != null : !services.equals(a.services)) { + return false; + } + if (entities == null ? a.entities != null : !entities.equals(a.entities)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainDataCheck.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainDataCheck.java new file mode 100644 index 00000000000..c45a6f992a6 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainDataCheck.java @@ -0,0 +1,110 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainDataCheck - Domain data object representing the results of a check +// operation looking for dangling roles, policies and trust relationships that +// are set either on tenant or provider side only +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainDataCheck { + @RdlOptional + public List danglingRoles; + @RdlOptional + public List danglingPolicies; + public int policyCount; + public int assertionCount; + public int roleWildCardCount; + @RdlOptional + public List providersWithoutTrust; + @RdlOptional + public List tenantsWithoutAssumeRole; + + public DomainDataCheck setDanglingRoles(List danglingRoles) { + this.danglingRoles = danglingRoles; + return this; + } + public List getDanglingRoles() { + return danglingRoles; + } + public DomainDataCheck setDanglingPolicies(List danglingPolicies) { + this.danglingPolicies = danglingPolicies; + return this; + } + public List getDanglingPolicies() { + return danglingPolicies; + } + public DomainDataCheck setPolicyCount(int policyCount) { + this.policyCount = policyCount; + return this; + } + public int getPolicyCount() { + return policyCount; + } + public DomainDataCheck setAssertionCount(int assertionCount) { + this.assertionCount = assertionCount; + return this; + } + public int getAssertionCount() { + return assertionCount; + } + public DomainDataCheck setRoleWildCardCount(int roleWildCardCount) { + this.roleWildCardCount = roleWildCardCount; + return this; + } + public int getRoleWildCardCount() { + return roleWildCardCount; + } + public DomainDataCheck setProvidersWithoutTrust(List providersWithoutTrust) { + this.providersWithoutTrust = providersWithoutTrust; + return this; + } + public List getProvidersWithoutTrust() { + return providersWithoutTrust; + } + public DomainDataCheck setTenantsWithoutAssumeRole(List tenantsWithoutAssumeRole) { + this.tenantsWithoutAssumeRole = tenantsWithoutAssumeRole; + return this; + } + public List getTenantsWithoutAssumeRole() { + return tenantsWithoutAssumeRole; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainDataCheck.class) { + return false; + } + DomainDataCheck a = (DomainDataCheck) another; + if (danglingRoles == null ? a.danglingRoles != null : !danglingRoles.equals(a.danglingRoles)) { + return false; + } + if (danglingPolicies == null ? a.danglingPolicies != null : !danglingPolicies.equals(a.danglingPolicies)) { + return false; + } + if (policyCount != a.policyCount) { + return false; + } + if (assertionCount != a.assertionCount) { + return false; + } + if (roleWildCardCount != a.roleWildCardCount) { + return false; + } + if (providersWithoutTrust == null ? a.providersWithoutTrust != null : !providersWithoutTrust.equals(a.providersWithoutTrust)) { + return false; + } + if (tenantsWithoutAssumeRole == null ? a.tenantsWithoutAssumeRole != null : !tenantsWithoutAssumeRole.equals(a.tenantsWithoutAssumeRole)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainList.java new file mode 100644 index 00000000000..5f989056306 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainList.java @@ -0,0 +1,50 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainList - A paginated list of domains. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainList { + public List names; + @RdlOptional + public String next; + + public DomainList setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + public DomainList setNext(String next) { + this.next = next; + return this; + } + public String getNext() { + return next; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainList.class) { + return false; + } + DomainList a = (DomainList) another; + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + if (next == null ? a.next != null : !next.equals(a.next)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainMeta.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainMeta.java new file mode 100644 index 00000000000..e15d64feebe --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainMeta.java @@ -0,0 +1,112 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainMeta - Set of metadata attributes that all domains may have and can be +// changed. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainMeta { + @RdlOptional + public String description; + @RdlOptional + public String org; + @RdlOptional + public Boolean enabled; + @RdlOptional + public Boolean auditEnabled; + @RdlOptional + public String account; + @RdlOptional + public Integer ypmId; + + public DomainMeta setDescription(String description) { + this.description = description; + return this; + } + public String getDescription() { + return description; + } + public DomainMeta setOrg(String org) { + this.org = org; + return this; + } + public String getOrg() { + return org; + } + public DomainMeta setEnabled(Boolean enabled) { + this.enabled = enabled; + return this; + } + public Boolean getEnabled() { + return enabled; + } + public DomainMeta setAuditEnabled(Boolean auditEnabled) { + this.auditEnabled = auditEnabled; + return this; + } + public Boolean getAuditEnabled() { + return auditEnabled; + } + public DomainMeta setAccount(String account) { + this.account = account; + return this; + } + public String getAccount() { + return account; + } + public DomainMeta setYpmId(Integer ypmId) { + this.ypmId = ypmId; + return this; + } + public Integer getYpmId() { + return ypmId; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainMeta.class) { + return false; + } + DomainMeta a = (DomainMeta) another; + if (description == null ? a.description != null : !description.equals(a.description)) { + return false; + } + if (org == null ? a.org != null : !org.equals(a.org)) { + return false; + } + if (enabled == null ? a.enabled != null : !enabled.equals(a.enabled)) { + return false; + } + if (auditEnabled == null ? a.auditEnabled != null : !auditEnabled.equals(a.auditEnabled)) { + return false; + } + if (account == null ? a.account != null : !account.equals(a.account)) { + return false; + } + if (ypmId == null ? a.ypmId != null : !ypmId.equals(a.ypmId)) { + return false; + } + } + return true; + } + + // + // sets up the instance according to its default field values, if any + // + public DomainMeta init() { + if (enabled == null) { + enabled = true; + } + if (auditEnabled == null) { + auditEnabled = false; + } + return this; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainModified.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainModified.java new file mode 100644 index 00000000000..84ad813706a --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainModified.java @@ -0,0 +1,50 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainModified - Tuple of domain-name and modification time-stamps. This +// object is returned when the caller has requested list of domains modified +// since a specific timestamp. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainModified { + public String name; + public long modified; + + public DomainModified setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public DomainModified setModified(long modified) { + this.modified = modified; + return this; + } + public long getModified() { + return modified; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainModified.class) { + return false; + } + DomainModified a = (DomainModified) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (modified != a.modified) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainModifiedList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainModifiedList.java new file mode 100644 index 00000000000..d89a21a7f07 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainModifiedList.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainModifiedList - A list of {domain, modified-timestamp} tuples. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainModifiedList { + public List nameModList; + + public DomainModifiedList setNameModList(List nameModList) { + this.nameModList = nameModList; + return this; + } + public List getNameModList() { + return nameModList; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainModifiedList.class) { + return false; + } + DomainModifiedList a = (DomainModifiedList) another; + if (nameModList == null ? a.nameModList != null : !nameModList.equals(a.nameModList)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainPolicies.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainPolicies.java new file mode 100644 index 00000000000..4fb3059257a --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainPolicies.java @@ -0,0 +1,52 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainPolicies - We need to include the name of the domain in this struct +// since this data will be passed back to ZPU through ZTS so we need to sign not +// only the list of policies but also the corresponding domain name that the +// policies belong to. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainPolicies { + public String domain; + public List policies; + + public DomainPolicies setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public DomainPolicies setPolicies(List policies) { + this.policies = policies; + return this; + } + public List getPolicies() { + return policies; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainPolicies.class) { + return false; + } + DomainPolicies a = (DomainPolicies) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (policies == null ? a.policies != null : !policies.equals(a.policies)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainTemplate.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainTemplate.java new file mode 100644 index 00000000000..ec08e6ba27d --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainTemplate.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainTemplate - solution template(s) to be applied to a domain +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainTemplate { + public List templateNames; + + public DomainTemplate setTemplateNames(List templateNames) { + this.templateNames = templateNames; + return this; + } + public List getTemplateNames() { + return templateNames; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainTemplate.class) { + return false; + } + DomainTemplate a = (DomainTemplate) another; + if (templateNames == null ? a.templateNames != null : !templateNames.equals(a.templateNames)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/DomainTemplateList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainTemplateList.java new file mode 100644 index 00000000000..1829e32f07e --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/DomainTemplateList.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainTemplateList - List of solution templates to be applied to a domain +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainTemplateList { + public List templateNames; + + public DomainTemplateList setTemplateNames(List templateNames) { + this.templateNames = templateNames; + return this; + } + public List getTemplateNames() { + return templateNames; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainTemplateList.class) { + return false; + } + DomainTemplateList a = (DomainTemplateList) another; + if (templateNames == null ? a.templateNames != null : !templateNames.equals(a.templateNames)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Entity.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Entity.java new file mode 100644 index 00000000000..a111ac7513d --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Entity.java @@ -0,0 +1,50 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Entity - An entity is a name and a structured value. some entity +// names/prefixes are reserved (i.e. "role", "policy", "meta", "domain", +// "service") +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Entity { + public String name; + public Struct value; + + public Entity setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public Entity setValue(Struct value) { + this.value = value; + return this; + } + public Struct getValue() { + return value; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Entity.class) { + return false; + } + Entity a = (Entity) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (value == null ? a.value != null : !value.equals(a.value)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/EntityList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/EntityList.java new file mode 100644 index 00000000000..c706902bf24 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/EntityList.java @@ -0,0 +1,39 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// EntityList - The representation for an enumeration of entities in the +// namespace +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class EntityList { + public List names; + + public EntityList setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != EntityList.class) { + return false; + } + EntityList a = (EntityList) another; + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/HostServices.java b/core/zms/src/main/java/com/yahoo/athenz/zms/HostServices.java new file mode 100644 index 00000000000..f08a9b6e460 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/HostServices.java @@ -0,0 +1,50 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// HostServices - The representation for an enumeration of services authorized +// to run on a specific host. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class HostServices { + public String host; + public List names; + + public HostServices setHost(String host) { + this.host = host; + return this; + } + public String getHost() { + return host; + } + public HostServices setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != HostServices.class) { + return false; + } + HostServices a = (HostServices) another; + if (host == null ? a.host != null : !host.equals(a.host)) { + return false; + } + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Membership.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Membership.java new file mode 100644 index 00000000000..a8046eef971 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Membership.java @@ -0,0 +1,71 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Membership - The representation for a role membership. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Membership { + public String memberName; + @RdlOptional + public Boolean isMember; + @RdlOptional + public String roleName; + + public Membership setMemberName(String memberName) { + this.memberName = memberName; + return this; + } + public String getMemberName() { + return memberName; + } + public Membership setIsMember(Boolean isMember) { + this.isMember = isMember; + return this; + } + public Boolean getIsMember() { + return isMember; + } + public Membership setRoleName(String roleName) { + this.roleName = roleName; + return this; + } + public String getRoleName() { + return roleName; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Membership.class) { + return false; + } + Membership a = (Membership) another; + if (memberName == null ? a.memberName != null : !memberName.equals(a.memberName)) { + return false; + } + if (isMember == null ? a.isMember != null : !isMember.equals(a.isMember)) { + return false; + } + if (roleName == null ? a.roleName != null : !roleName.equals(a.roleName)) { + return false; + } + } + return true; + } + + // + // sets up the instance according to its default field values, if any + // + public Membership init() { + if (isMember == null) { + isMember = true; + } + return this; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Policies.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Policies.java new file mode 100644 index 00000000000..1e8fa310c8f --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Policies.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Policies - The representation of list of policy objects +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Policies { + public List list; + + public Policies setList(List list) { + this.list = list; + return this; + } + public List getList() { + return list; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Policies.class) { + return false; + } + Policies a = (Policies) another; + if (list == null ? a.list != null : !list.equals(a.list)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Policy.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Policy.java new file mode 100644 index 00000000000..6607047f521 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Policy.java @@ -0,0 +1,61 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Policy - The representation for a Policy with set of assertions. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Policy { + public String name; + @RdlOptional + public Timestamp modified; + public List assertions; + + public Policy setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public Policy setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public Policy setAssertions(List assertions) { + this.assertions = assertions; + return this; + } + public List getAssertions() { + return assertions; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Policy.class) { + return false; + } + Policy a = (Policy) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (assertions == null ? a.assertions != null : !assertions.equals(a.assertions)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/PolicyList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/PolicyList.java new file mode 100644 index 00000000000..73ffe089701 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/PolicyList.java @@ -0,0 +1,51 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// PolicyList - The representation for an enumeration of policies in the +// namespace, with pagination. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class PolicyList { + public List names; + @RdlOptional + public String next; + + public PolicyList setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + public PolicyList setNext(String next) { + this.next = next; + return this; + } + public String getNext() { + return next; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != PolicyList.class) { + return false; + } + PolicyList a = (PolicyList) another; + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + if (next == null ? a.next != null : !next.equals(a.next)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ProviderResourceGroupRoles.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ProviderResourceGroupRoles.java new file mode 100644 index 00000000000..42ebd1c287e --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ProviderResourceGroupRoles.java @@ -0,0 +1,83 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ProviderResourceGroupRoles - A representation of provider roles to be +// provisioned. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ProviderResourceGroupRoles { + public String domain; + public String service; + public String tenant; + public List roles; + public String resourceGroup; + + public ProviderResourceGroupRoles setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public ProviderResourceGroupRoles setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public ProviderResourceGroupRoles setTenant(String tenant) { + this.tenant = tenant; + return this; + } + public String getTenant() { + return tenant; + } + public ProviderResourceGroupRoles setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + public ProviderResourceGroupRoles setResourceGroup(String resourceGroup) { + this.resourceGroup = resourceGroup; + return this; + } + public String getResourceGroup() { + return resourceGroup; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ProviderResourceGroupRoles.class) { + return false; + } + ProviderResourceGroupRoles a = (ProviderResourceGroupRoles) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (tenant == null ? a.tenant != null : !tenant.equals(a.tenant)) { + return false; + } + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + if (resourceGroup == null ? a.resourceGroup != null : !resourceGroup.equals(a.resourceGroup)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/PublicKeyEntry.java b/core/zms/src/main/java/com/yahoo/athenz/zms/PublicKeyEntry.java new file mode 100644 index 00000000000..50c55eb3d10 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/PublicKeyEntry.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// PublicKeyEntry - The representation of the public key in a service identity +// object. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class PublicKeyEntry { + public String key; + public String id; + + public PublicKeyEntry setKey(String key) { + this.key = key; + return this; + } + public String getKey() { + return key; + } + public PublicKeyEntry setId(String id) { + this.id = id; + return this; + } + public String getId() { + return id; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != PublicKeyEntry.class) { + return false; + } + PublicKeyEntry a = (PublicKeyEntry) another; + if (key == null ? a.key != null : !key.equals(a.key)) { + return false; + } + if (id == null ? a.id != null : !id.equals(a.id)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ResourceAccess.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ResourceAccess.java new file mode 100644 index 00000000000..eb715130423 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ResourceAccess.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ResourceAccess - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ResourceAccess { + public String principal; + public List assertions; + + public ResourceAccess setPrincipal(String principal) { + this.principal = principal; + return this; + } + public String getPrincipal() { + return principal; + } + public ResourceAccess setAssertions(List assertions) { + this.assertions = assertions; + return this; + } + public List getAssertions() { + return assertions; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ResourceAccess.class) { + return false; + } + ResourceAccess a = (ResourceAccess) another; + if (principal == null ? a.principal != null : !principal.equals(a.principal)) { + return false; + } + if (assertions == null ? a.assertions != null : !assertions.equals(a.assertions)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ResourceAccessList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ResourceAccessList.java new file mode 100644 index 00000000000..c92c8527876 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ResourceAccessList.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ResourceAccessList - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ResourceAccessList { + public List resources; + + public ResourceAccessList setResources(List resources) { + this.resources = resources; + return this; + } + public List getResources() { + return resources; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ResourceAccessList.class) { + return false; + } + ResourceAccessList a = (ResourceAccessList) another; + if (resources == null ? a.resources != null : !resources.equals(a.resources)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Role.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Role.java new file mode 100644 index 00000000000..b25a95d1a8f --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Role.java @@ -0,0 +1,86 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Role - The representation for a Role with set of members. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Role { + public String name; + @RdlOptional + public Timestamp modified; + @RdlOptional + public List members; + @RdlOptional + public String trust; + @RdlOptional + public List auditLog; + + public Role setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public Role setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public Role setMembers(List members) { + this.members = members; + return this; + } + public List getMembers() { + return members; + } + public Role setTrust(String trust) { + this.trust = trust; + return this; + } + public String getTrust() { + return trust; + } + public Role setAuditLog(List auditLog) { + this.auditLog = auditLog; + return this; + } + public List getAuditLog() { + return auditLog; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Role.class) { + return false; + } + Role a = (Role) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (members == null ? a.members != null : !members.equals(a.members)) { + return false; + } + if (trust == null ? a.trust != null : !trust.equals(a.trust)) { + return false; + } + if (auditLog == null ? a.auditLog != null : !auditLog.equals(a.auditLog)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/RoleAuditLog.java b/core/zms/src/main/java/com/yahoo/athenz/zms/RoleAuditLog.java new file mode 100644 index 00000000000..2f63366458d --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/RoleAuditLog.java @@ -0,0 +1,82 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// RoleAuditLog - An audit log entry for role membership change. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class RoleAuditLog { + public String member; + public String admin; + public Timestamp created; + public String action; + @RdlOptional + public String auditRef; + + public RoleAuditLog setMember(String member) { + this.member = member; + return this; + } + public String getMember() { + return member; + } + public RoleAuditLog setAdmin(String admin) { + this.admin = admin; + return this; + } + public String getAdmin() { + return admin; + } + public RoleAuditLog setCreated(Timestamp created) { + this.created = created; + return this; + } + public Timestamp getCreated() { + return created; + } + public RoleAuditLog setAction(String action) { + this.action = action; + return this; + } + public String getAction() { + return action; + } + public RoleAuditLog setAuditRef(String auditRef) { + this.auditRef = auditRef; + return this; + } + public String getAuditRef() { + return auditRef; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != RoleAuditLog.class) { + return false; + } + RoleAuditLog a = (RoleAuditLog) another; + if (member == null ? a.member != null : !member.equals(a.member)) { + return false; + } + if (admin == null ? a.admin != null : !admin.equals(a.admin)) { + return false; + } + if (created == null ? a.created != null : !created.equals(a.created)) { + return false; + } + if (action == null ? a.action != null : !action.equals(a.action)) { + return false; + } + if (auditRef == null ? a.auditRef != null : !auditRef.equals(a.auditRef)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/RoleList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/RoleList.java new file mode 100644 index 00000000000..111bf74f8e9 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/RoleList.java @@ -0,0 +1,51 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// RoleList - The representation for an enumeration of roles in the namespace, +// with pagination. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class RoleList { + public List names; + @RdlOptional + public String next; + + public RoleList setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + public RoleList setNext(String next) { + this.next = next; + return this; + } + public String getNext() { + return next; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != RoleList.class) { + return false; + } + RoleList a = (RoleList) another; + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + if (next == null ? a.next != null : !next.equals(a.next)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Roles.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Roles.java new file mode 100644 index 00000000000..305421fc193 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Roles.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Roles - The representation for a list of roles with full details +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Roles { + public List list; + + public Roles setList(List list) { + this.list = list; + return this; + } + public List getList() { + return list; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Roles.class) { + return false; + } + Roles a = (Roles) another; + if (list == null ? a.list != null : !list.equals(a.list)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ServerTemplateList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ServerTemplateList.java new file mode 100644 index 00000000000..489775190d9 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ServerTemplateList.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ServerTemplateList - List of solution templates available in the server +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ServerTemplateList { + public List templateNames; + + public ServerTemplateList setTemplateNames(List templateNames) { + this.templateNames = templateNames; + return this; + } + public List getTemplateNames() { + return templateNames; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ServerTemplateList.class) { + return false; + } + ServerTemplateList a = (ServerTemplateList) another; + if (templateNames == null ? a.templateNames != null : !templateNames.equals(a.templateNames)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentities.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentities.java new file mode 100644 index 00000000000..832ed6b28be --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentities.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ServiceIdentities - The representation of list of services +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ServiceIdentities { + public List list; + + public ServiceIdentities setList(List list) { + this.list = list; + return this; + } + public List getList() { + return list; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ServiceIdentities.class) { + return false; + } + ServiceIdentities a = (ServiceIdentities) another; + if (list == null ? a.list != null : !list.equals(a.list)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentity.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentity.java new file mode 100644 index 00000000000..e68a9b7a762 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentity.java @@ -0,0 +1,122 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ServiceIdentity - The representation of the service identity object. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ServiceIdentity { + public String name; + @RdlOptional + public List publicKeys; + @RdlOptional + public String providerEndpoint; + @RdlOptional + public Timestamp modified; + @RdlOptional + public String executable; + @RdlOptional + public List hosts; + @RdlOptional + public String user; + @RdlOptional + public String group; + + public ServiceIdentity setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public ServiceIdentity setPublicKeys(List publicKeys) { + this.publicKeys = publicKeys; + return this; + } + public List getPublicKeys() { + return publicKeys; + } + public ServiceIdentity setProviderEndpoint(String providerEndpoint) { + this.providerEndpoint = providerEndpoint; + return this; + } + public String getProviderEndpoint() { + return providerEndpoint; + } + public ServiceIdentity setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public ServiceIdentity setExecutable(String executable) { + this.executable = executable; + return this; + } + public String getExecutable() { + return executable; + } + public ServiceIdentity setHosts(List hosts) { + this.hosts = hosts; + return this; + } + public List getHosts() { + return hosts; + } + public ServiceIdentity setUser(String user) { + this.user = user; + return this; + } + public String getUser() { + return user; + } + public ServiceIdentity setGroup(String group) { + this.group = group; + return this; + } + public String getGroup() { + return group; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ServiceIdentity.class) { + return false; + } + ServiceIdentity a = (ServiceIdentity) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (publicKeys == null ? a.publicKeys != null : !publicKeys.equals(a.publicKeys)) { + return false; + } + if (providerEndpoint == null ? a.providerEndpoint != null : !providerEndpoint.equals(a.providerEndpoint)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (executable == null ? a.executable != null : !executable.equals(a.executable)) { + return false; + } + if (hosts == null ? a.hosts != null : !hosts.equals(a.hosts)) { + return false; + } + if (user == null ? a.user != null : !user.equals(a.user)) { + return false; + } + if (group == null ? a.group != null : !group.equals(a.group)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentityList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentityList.java new file mode 100644 index 00000000000..2c0a027517a --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ServiceIdentityList.java @@ -0,0 +1,51 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ServiceIdentityList - The representation for an enumeration of services in +// the namespace, with pagination. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ServiceIdentityList { + public List names; + @RdlOptional + public String next; + + public ServiceIdentityList setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + public ServiceIdentityList setNext(String next) { + this.next = next; + return this; + } + public String getNext() { + return next; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ServiceIdentityList.class) { + return false; + } + ServiceIdentityList a = (ServiceIdentityList) another; + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + if (next == null ? a.next != null : !next.equals(a.next)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ServicePrincipal.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ServicePrincipal.java new file mode 100644 index 00000000000..bfd3939810a --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ServicePrincipal.java @@ -0,0 +1,59 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ServicePrincipal - A service principal object identifying a given service. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ServicePrincipal { + public String domain; + public String service; + public String token; + + public ServicePrincipal setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public ServicePrincipal setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public ServicePrincipal setToken(String token) { + this.token = token; + return this; + } + public String getToken() { + return token; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ServicePrincipal.class) { + return false; + } + ServicePrincipal a = (ServicePrincipal) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (token == null ? a.token != null : !token.equals(a.token)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/SignedDomain.java b/core/zms/src/main/java/com/yahoo/athenz/zms/SignedDomain.java new file mode 100644 index 00000000000..fe8d2c7c899 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/SignedDomain.java @@ -0,0 +1,59 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// SignedDomain - A domain object signed with server's private key +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class SignedDomain { + public DomainData domain; + public String signature; + public String keyId; + + public SignedDomain setDomain(DomainData domain) { + this.domain = domain; + return this; + } + public DomainData getDomain() { + return domain; + } + public SignedDomain setSignature(String signature) { + this.signature = signature; + return this; + } + public String getSignature() { + return signature; + } + public SignedDomain setKeyId(String keyId) { + this.keyId = keyId; + return this; + } + public String getKeyId() { + return keyId; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != SignedDomain.class) { + return false; + } + SignedDomain a = (SignedDomain) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (signature == null ? a.signature != null : !signature.equals(a.signature)) { + return false; + } + if (keyId == null ? a.keyId != null : !keyId.equals(a.keyId)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/SignedDomains.java b/core/zms/src/main/java/com/yahoo/athenz/zms/SignedDomains.java new file mode 100644 index 00000000000..3cbe7656e27 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/SignedDomains.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// SignedDomains - A list of signed domain objects +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class SignedDomains { + public List domains; + + public SignedDomains setDomains(List domains) { + this.domains = domains; + return this; + } + public List getDomains() { + return domains; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != SignedDomains.class) { + return false; + } + SignedDomains a = (SignedDomains) another; + if (domains == null ? a.domains != null : !domains.equals(a.domains)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/SignedPolicies.java b/core/zms/src/main/java/com/yahoo/athenz/zms/SignedPolicies.java new file mode 100644 index 00000000000..05c585df0b0 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/SignedPolicies.java @@ -0,0 +1,60 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// SignedPolicies - A signed bulk transfer of policies. The data is signed with +// server's private key. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class SignedPolicies { + public DomainPolicies contents; + public String signature; + public String keyId; + + public SignedPolicies setContents(DomainPolicies contents) { + this.contents = contents; + return this; + } + public DomainPolicies getContents() { + return contents; + } + public SignedPolicies setSignature(String signature) { + this.signature = signature; + return this; + } + public String getSignature() { + return signature; + } + public SignedPolicies setKeyId(String keyId) { + this.keyId = keyId; + return this; + } + public String getKeyId() { + return keyId; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != SignedPolicies.class) { + return false; + } + SignedPolicies a = (SignedPolicies) another; + if (contents == null ? a.contents != null : !contents.equals(a.contents)) { + return false; + } + if (signature == null ? a.signature != null : !signature.equals(a.signature)) { + return false; + } + if (keyId == null ? a.keyId != null : !keyId.equals(a.keyId)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/SubDomain.java b/core/zms/src/main/java/com/yahoo/athenz/zms/SubDomain.java new file mode 100644 index 00000000000..5b64804a27c --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/SubDomain.java @@ -0,0 +1,144 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// SubDomain - A Subdomain is a TopLevelDomain, except it has a parent. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class SubDomain { + @RdlOptional + public String description; + @RdlOptional + public String org; + @RdlOptional + public Boolean enabled; + @RdlOptional + public Boolean auditEnabled; + @RdlOptional + public String account; + @RdlOptional + public Integer ypmId; + public String name; + public List adminUsers; + @RdlOptional + public DomainTemplateList templates; + public String parent; + + public SubDomain setDescription(String description) { + this.description = description; + return this; + } + public String getDescription() { + return description; + } + public SubDomain setOrg(String org) { + this.org = org; + return this; + } + public String getOrg() { + return org; + } + public SubDomain setEnabled(Boolean enabled) { + this.enabled = enabled; + return this; + } + public Boolean getEnabled() { + return enabled; + } + public SubDomain setAuditEnabled(Boolean auditEnabled) { + this.auditEnabled = auditEnabled; + return this; + } + public Boolean getAuditEnabled() { + return auditEnabled; + } + public SubDomain setAccount(String account) { + this.account = account; + return this; + } + public String getAccount() { + return account; + } + public SubDomain setYpmId(Integer ypmId) { + this.ypmId = ypmId; + return this; + } + public Integer getYpmId() { + return ypmId; + } + public SubDomain setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public SubDomain setAdminUsers(List adminUsers) { + this.adminUsers = adminUsers; + return this; + } + public List getAdminUsers() { + return adminUsers; + } + public SubDomain setTemplates(DomainTemplateList templates) { + this.templates = templates; + return this; + } + public DomainTemplateList getTemplates() { + return templates; + } + public SubDomain setParent(String parent) { + this.parent = parent; + return this; + } + public String getParent() { + return parent; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != SubDomain.class) { + return false; + } + SubDomain a = (SubDomain) another; + if (description == null ? a.description != null : !description.equals(a.description)) { + return false; + } + if (org == null ? a.org != null : !org.equals(a.org)) { + return false; + } + if (enabled == null ? a.enabled != null : !enabled.equals(a.enabled)) { + return false; + } + if (auditEnabled == null ? a.auditEnabled != null : !auditEnabled.equals(a.auditEnabled)) { + return false; + } + if (account == null ? a.account != null : !account.equals(a.account)) { + return false; + } + if (ypmId == null ? a.ypmId != null : !ypmId.equals(a.ypmId)) { + return false; + } + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (adminUsers == null ? a.adminUsers != null : !adminUsers.equals(a.adminUsers)) { + return false; + } + if (templates == null ? a.templates != null : !templates.equals(a.templates)) { + return false; + } + if (parent == null ? a.parent != null : !parent.equals(a.parent)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Template.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Template.java new file mode 100644 index 00000000000..6803c8413fd --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Template.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Template - Solution Template object defined on the server +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Template { + public List roles; + public List policies; + + public Template setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + public Template setPolicies(List policies) { + this.policies = policies; + return this; + } + public List getPolicies() { + return policies; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Template.class) { + return false; + } + Template a = (Template) another; + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + if (policies == null ? a.policies != null : !policies.equals(a.policies)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/TemplateList.java b/core/zms/src/main/java/com/yahoo/athenz/zms/TemplateList.java new file mode 100644 index 00000000000..6c59e03d91a --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/TemplateList.java @@ -0,0 +1,39 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TemplateList - List of template names that is the base struct for server and +// domain templates +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TemplateList { + public List templateNames; + + public TemplateList setTemplateNames(List templateNames) { + this.templateNames = templateNames; + return this; + } + public List getTemplateNames() { + return templateNames; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TemplateList.class) { + return false; + } + TemplateList a = (TemplateList) another; + if (templateNames == null ? a.templateNames != null : !templateNames.equals(a.templateNames)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/Tenancy.java b/core/zms/src/main/java/com/yahoo/athenz/zms/Tenancy.java new file mode 100644 index 00000000000..8fc78132985 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/Tenancy.java @@ -0,0 +1,61 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Tenancy - A representation of tenant. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Tenancy { + public String domain; + public String service; + @RdlOptional + public List resourceGroups; + + public Tenancy setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public Tenancy setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public Tenancy setResourceGroups(List resourceGroups) { + this.resourceGroups = resourceGroups; + return this; + } + public List getResourceGroups() { + return resourceGroups; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Tenancy.class) { + return false; + } + Tenancy a = (Tenancy) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (resourceGroups == null ? a.resourceGroups != null : !resourceGroups.equals(a.resourceGroups)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/TenancyResourceGroup.java b/core/zms/src/main/java/com/yahoo/athenz/zms/TenancyResourceGroup.java new file mode 100644 index 00000000000..4f564313c93 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/TenancyResourceGroup.java @@ -0,0 +1,59 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TenancyResourceGroup - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TenancyResourceGroup { + public String domain; + public String service; + public String resourceGroup; + + public TenancyResourceGroup setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public TenancyResourceGroup setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public TenancyResourceGroup setResourceGroup(String resourceGroup) { + this.resourceGroup = resourceGroup; + return this; + } + public String getResourceGroup() { + return resourceGroup; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TenancyResourceGroup.class) { + return false; + } + TenancyResourceGroup a = (TenancyResourceGroup) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (resourceGroup == null ? a.resourceGroup != null : !resourceGroup.equals(a.resourceGroup)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/TenantDomains.java b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantDomains.java new file mode 100644 index 00000000000..f3a1bd2042d --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantDomains.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TenantDomains - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TenantDomains { + public List tenantDomainNames; + + public TenantDomains setTenantDomainNames(List tenantDomainNames) { + this.tenantDomainNames = tenantDomainNames; + return this; + } + public List getTenantDomainNames() { + return tenantDomainNames; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TenantDomains.class) { + return false; + } + TenantDomains a = (TenantDomains) another; + if (tenantDomainNames == null ? a.tenantDomainNames != null : !tenantDomainNames.equals(a.tenantDomainNames)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/TenantResourceGroupRoles.java b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantResourceGroupRoles.java new file mode 100644 index 00000000000..c30d7e514e2 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantResourceGroupRoles.java @@ -0,0 +1,83 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TenantResourceGroupRoles - A representation of tenant roles for resource +// groups to be provisioned. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TenantResourceGroupRoles { + public String domain; + public String service; + public String tenant; + public List roles; + public String resourceGroup; + + public TenantResourceGroupRoles setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public TenantResourceGroupRoles setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public TenantResourceGroupRoles setTenant(String tenant) { + this.tenant = tenant; + return this; + } + public String getTenant() { + return tenant; + } + public TenantResourceGroupRoles setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + public TenantResourceGroupRoles setResourceGroup(String resourceGroup) { + this.resourceGroup = resourceGroup; + return this; + } + public String getResourceGroup() { + return resourceGroup; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TenantResourceGroupRoles.class) { + return false; + } + TenantResourceGroupRoles a = (TenantResourceGroupRoles) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (tenant == null ? a.tenant != null : !tenant.equals(a.tenant)) { + return false; + } + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + if (resourceGroup == null ? a.resourceGroup != null : !resourceGroup.equals(a.resourceGroup)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/TenantRoleAction.java b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantRoleAction.java new file mode 100644 index 00000000000..2db1f76909d --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantRoleAction.java @@ -0,0 +1,48 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TenantRoleAction - A representation of tenant role action. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TenantRoleAction { + public String role; + public String action; + + public TenantRoleAction setRole(String role) { + this.role = role; + return this; + } + public String getRole() { + return role; + } + public TenantRoleAction setAction(String action) { + this.action = action; + return this; + } + public String getAction() { + return action; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TenantRoleAction.class) { + return false; + } + TenantRoleAction a = (TenantRoleAction) another; + if (role == null ? a.role != null : !role.equals(a.role)) { + return false; + } + if (action == null ? a.action != null : !action.equals(a.action)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/TenantRoles.java b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantRoles.java new file mode 100644 index 00000000000..0c77b73d565 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/TenantRoles.java @@ -0,0 +1,71 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TenantRoles - A representation of tenant roles to be provisioned. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TenantRoles { + public String domain; + public String service; + public String tenant; + public List roles; + + public TenantRoles setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public TenantRoles setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public TenantRoles setTenant(String tenant) { + this.tenant = tenant; + return this; + } + public String getTenant() { + return tenant; + } + public TenantRoles setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TenantRoles.class) { + return false; + } + TenantRoles a = (TenantRoles) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (tenant == null ? a.tenant != null : !tenant.equals(a.tenant)) { + return false; + } + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/TopLevelDomain.java b/core/zms/src/main/java/com/yahoo/athenz/zms/TopLevelDomain.java new file mode 100644 index 00000000000..f07b1191e2f --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/TopLevelDomain.java @@ -0,0 +1,134 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TopLevelDomain - Top Level Domain object. The required attributes include +// the name of the domain and list of domain administrators. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TopLevelDomain { + @RdlOptional + public String description; + @RdlOptional + public String org; + @RdlOptional + public Boolean enabled; + @RdlOptional + public Boolean auditEnabled; + @RdlOptional + public String account; + @RdlOptional + public Integer ypmId; + public String name; + public List adminUsers; + @RdlOptional + public DomainTemplateList templates; + + public TopLevelDomain setDescription(String description) { + this.description = description; + return this; + } + public String getDescription() { + return description; + } + public TopLevelDomain setOrg(String org) { + this.org = org; + return this; + } + public String getOrg() { + return org; + } + public TopLevelDomain setEnabled(Boolean enabled) { + this.enabled = enabled; + return this; + } + public Boolean getEnabled() { + return enabled; + } + public TopLevelDomain setAuditEnabled(Boolean auditEnabled) { + this.auditEnabled = auditEnabled; + return this; + } + public Boolean getAuditEnabled() { + return auditEnabled; + } + public TopLevelDomain setAccount(String account) { + this.account = account; + return this; + } + public String getAccount() { + return account; + } + public TopLevelDomain setYpmId(Integer ypmId) { + this.ypmId = ypmId; + return this; + } + public Integer getYpmId() { + return ypmId; + } + public TopLevelDomain setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public TopLevelDomain setAdminUsers(List adminUsers) { + this.adminUsers = adminUsers; + return this; + } + public List getAdminUsers() { + return adminUsers; + } + public TopLevelDomain setTemplates(DomainTemplateList templates) { + this.templates = templates; + return this; + } + public DomainTemplateList getTemplates() { + return templates; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TopLevelDomain.class) { + return false; + } + TopLevelDomain a = (TopLevelDomain) another; + if (description == null ? a.description != null : !description.equals(a.description)) { + return false; + } + if (org == null ? a.org != null : !org.equals(a.org)) { + return false; + } + if (enabled == null ? a.enabled != null : !enabled.equals(a.enabled)) { + return false; + } + if (auditEnabled == null ? a.auditEnabled != null : !auditEnabled.equals(a.auditEnabled)) { + return false; + } + if (account == null ? a.account != null : !account.equals(a.account)) { + return false; + } + if (ypmId == null ? a.ypmId != null : !ypmId.equals(a.ypmId)) { + return false; + } + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (adminUsers == null ? a.adminUsers != null : !adminUsers.equals(a.adminUsers)) { + return false; + } + if (templates == null ? a.templates != null : !templates.equals(a.templates)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/UserDomain.java b/core/zms/src/main/java/com/yahoo/athenz/zms/UserDomain.java new file mode 100644 index 00000000000..6b837bfafcc --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/UserDomain.java @@ -0,0 +1,122 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// UserDomain - A UserDomain is the user's own top level domain in user - e.g. +// user.hga +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class UserDomain { + @RdlOptional + public String description; + @RdlOptional + public String org; + @RdlOptional + public Boolean enabled; + @RdlOptional + public Boolean auditEnabled; + @RdlOptional + public String account; + @RdlOptional + public Integer ypmId; + public String name; + @RdlOptional + public DomainTemplateList templates; + + public UserDomain setDescription(String description) { + this.description = description; + return this; + } + public String getDescription() { + return description; + } + public UserDomain setOrg(String org) { + this.org = org; + return this; + } + public String getOrg() { + return org; + } + public UserDomain setEnabled(Boolean enabled) { + this.enabled = enabled; + return this; + } + public Boolean getEnabled() { + return enabled; + } + public UserDomain setAuditEnabled(Boolean auditEnabled) { + this.auditEnabled = auditEnabled; + return this; + } + public Boolean getAuditEnabled() { + return auditEnabled; + } + public UserDomain setAccount(String account) { + this.account = account; + return this; + } + public String getAccount() { + return account; + } + public UserDomain setYpmId(Integer ypmId) { + this.ypmId = ypmId; + return this; + } + public Integer getYpmId() { + return ypmId; + } + public UserDomain setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public UserDomain setTemplates(DomainTemplateList templates) { + this.templates = templates; + return this; + } + public DomainTemplateList getTemplates() { + return templates; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != UserDomain.class) { + return false; + } + UserDomain a = (UserDomain) another; + if (description == null ? a.description != null : !description.equals(a.description)) { + return false; + } + if (org == null ? a.org != null : !org.equals(a.org)) { + return false; + } + if (enabled == null ? a.enabled != null : !enabled.equals(a.enabled)) { + return false; + } + if (auditEnabled == null ? a.auditEnabled != null : !auditEnabled.equals(a.auditEnabled)) { + return false; + } + if (account == null ? a.account != null : !account.equals(a.account)) { + return false; + } + if (ypmId == null ? a.ypmId != null : !ypmId.equals(a.ypmId)) { + return false; + } + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (templates == null ? a.templates != null : !templates.equals(a.templates)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/UserToken.java b/core/zms/src/main/java/com/yahoo/athenz/zms/UserToken.java new file mode 100644 index 00000000000..e794577a539 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/UserToken.java @@ -0,0 +1,37 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// UserToken - A user token generated based on user's credentials +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class UserToken { + public String token; + + public UserToken setToken(String token) { + this.token = token; + return this; + } + public String getToken() { + return token; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != UserToken.class) { + return false; + } + UserToken a = (UserToken) another; + if (token == null ? a.token != null : !token.equals(a.token)) { + return false; + } + } + return true; + } +} diff --git a/core/zms/src/main/java/com/yahoo/athenz/zms/ZMSSchema.java b/core/zms/src/main/java/com/yahoo/athenz/zms/ZMSSchema.java new file mode 100644 index 00000000000..f9f7209b474 --- /dev/null +++ b/core/zms/src/main/java/com/yahoo/athenz/zms/ZMSSchema.java @@ -0,0 +1,1413 @@ +// +// This file generated by rdl 1.4.8 +// + +package com.yahoo.athenz.zms; +import com.yahoo.rdl.*; + +public class ZMSSchema { + + private final static Schema INSTANCE = build(); + public static Schema instance() { + return INSTANCE; + } + + private static Schema build() { + SchemaBuilder sb = new SchemaBuilder("ZMS"); + sb.version(1); + sb.namespace("com.yahoo.athenz.zms"); + sb.comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. The Authorization Management Service (ZMS) Classes"); + + sb.stringType("SimpleName") + .comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. Common name types used by several API definitions A simple identifier, an element of compound name.") + .pattern("[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("CompoundName") + .comment("A compound name. Most names in this API are compound names.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("DomainName") + .comment("A domain name is the general qualifier prefix, as its uniqueness is managed.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("EntityName") + .comment("An entity name is a short form of a resource name, including only the domain and entity.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ServiceName") + .comment("A service name will generally be a unique subdomain.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("LocationName") + .comment("A location name is not yet defined, but will be a dotted name like everything else.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ActionName") + .comment("An action (operation) name.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ResourceName") + .comment("A shorthand for a YRN with no service or location. The 'tail' of a YRN, just the domain:entity. Note that the EntityName part is optional, that is, a domain name followed by a colon is valid resource name.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?"); + + sb.stringType("YRN") + .comment("A full Yahoo Resource name (YRN).") + .pattern("(yrn:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:)?([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?"); + + sb.stringType("YBase64") + .comment("The Y-specific URL-safe Base64 variant.") + .pattern("[a-zA-Z0-9\\._-]+"); + + sb.stringType("YEncoded") + .comment("YEncoded includes ybase64 chars, as well as = and %. This can represent a user cookie and URL-encoded values.") + .pattern("[a-zA-Z0-9\\._%=-]*"); + + sb.stringType("AuthorityName") + .comment("Used as the prefix in a signed assertion. This uniquely identifies a signing authority. i.e. \"user\"") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("SignedToken") + .comment("A signed assertion if identity. i.e. the user cookie value. This token will only make sense to the authority that generated it, so it is beneficial to have something in the value that is cheaply recognized to quickly reject if it belongs to another authority. In addition to the YEncoded set our token includes ; to separate components and , to separate roles and : for IPv6 addresses") + .pattern("[a-zA-Z0-9\\._%=:;,-]*"); + + sb.structType("Domain") + .comment("A domain is an independent partition of users, roles, and resources. Its name represents the definition of a namespace; the only way a new namespace can be created, from the top, is by creating Domains. Administration of a domain is governed by the parent domain (using reverse-DNS namespaces). The top level domains are governed by the special \"sys.auth\" domain.") + .field("name", "DomainName", false, "the common name to be referred to, the symbolic id. It is immutable") + .field("modified", "Timestamp", true, "the last modification timestamp of any object or attribute in this domain") + .field("id", "UUID", true, "unique identifier of the domain. generated on create, never reused") + .field("description", "String", true, "description of the domain") + .field("org", "ResourceName", true, "a reference to an Organization") + .field("enabled", "Bool", false, "Future use only, currently not used", true) + .field("auditEnabled", "Bool", false, "Flag indicates whether or not domain modifications should be logged for SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for any API defining it.", false) + .field("account", "String", true, "associated cloud (i.e. aws) account id") + .field("ypmId", "Int32", true, "associated product id"); + + sb.structType("RoleList") + .comment("The representation for an enumeration of roles in the namespace, with pagination.") + .arrayField("names", "EntityName", false, "list of role names") + .field("next", "String", true, "if the response is a paginated list, this attribute specifies the value to be used in the next role list request as the value for the skip query parameter."); + + sb.structType("RoleAuditLog") + .comment("An audit log entry for role membership change.") + .field("member", "ResourceName", false, "name of the role member") + .field("admin", "ResourceName", false, "name of the principal executing the change") + .field("created", "Timestamp", false, "timestamp of the entry") + .field("action", "String", false, "log action - either add or delete") + .field("auditRef", "String", true, "audit reference string for the change as supplied by admin"); + + sb.structType("Role") + .comment("The representation for a Role with set of members.") + .field("name", "ResourceName", false, "name of the role") + .field("modified", "Timestamp", true, "last modification timestamp of the role") + .arrayField("members", "ResourceName", true, "an explicit list of members. Might be empty or null, if trust is set") + .field("trust", "DomainName", true, "a trusted domain to delegate membership decisions to") + .arrayField("auditLog", "RoleAuditLog", true, "an audit log for role membership changes"); + + sb.structType("Roles") + .comment("The representation for a list of roles with full details") + .arrayField("list", "Role", false, "list of role objects"); + + sb.structType("Membership") + .comment("The representation for a role membership.") + .field("memberName", "ResourceName", false, "name of the member") + .field("isMember", "Bool", false, "flag to indicate whether or the user is a member or not", true) + .field("roleName", "ResourceName", true, "name of the role"); + + sb.structType("DefaultAdmins") + .comment("The list of domain administrators.") + .arrayField("admins", "ResourceName", false, "list of domain administrators"); + + sb.enumType("AssertionEffect") + .comment("Every assertion can have the effect of ALLOW or DENY.") + .element("ALLOW") + .element("DENY"); + + sb.structType("Assertion") + .comment("A representation for the encapsulation of an action to be performed on a resource by a principal.") + .field("role", "String", false, "the subject of the assertion - a role") + .field("resource", "String", false, "the object of the assertion. Must be in the local namespace. Can contain wildcards") + .field("action", "String", false, "the predicate of the assertion. Can contain wildcards") + .field("effect", "AssertionEffect", false, "the effect of the assertion in the policy language", null) + .field("id", "Int64", true, "assertion id - auto generated by server. Not required during put operations."); + + sb.structType("Policy") + .comment("The representation for a Policy with set of assertions.") + .field("name", "ResourceName", false, "name of the policy") + .field("modified", "Timestamp", true, "last modification timestamp of this policy") + .arrayField("assertions", "Assertion", false, "list of defined assertions for this policy"); + + sb.structType("Policies") + .comment("The representation of list of policy objects") + .arrayField("list", "Policy", false, "list of policy objects"); + + sb.structType("Template") + .comment("Solution Template object defined on the server") + .arrayField("roles", "Role", false, "list of roles in the template") + .arrayField("policies", "Policy", false, "list of policies defined in this template"); + + sb.structType("TemplateList") + .comment("List of template names that is the base struct for server and domain templates") + .arrayField("templateNames", "SimpleName", false, "list of template names"); + + sb.structType("DomainTemplate", "TemplateList") + .comment("solution template(s) to be applied to a domain"); + + sb.structType("DomainTemplateList", "TemplateList") + .comment("List of solution templates to be applied to a domain"); + + sb.structType("ServerTemplateList", "TemplateList") + .comment("List of solution templates available in the server"); + + sb.structType("DomainList") + .comment("A paginated list of domains.") + .arrayField("names", "DomainName", false, "list of domain names") + .field("next", "String", true, "if the response is a paginated list, this attribute specifies the value to be used in the next domain list request as the value for the skip query parameter."); + + sb.structType("DomainMeta") + .comment("Set of metadata attributes that all domains may have and can be changed.") + .field("description", "String", true, "a description of the domain") + .field("org", "ResourceName", true, "a reference to an Organization. (i.e. org:media)") + .field("enabled", "Bool", false, "Future use only, currently not used", true) + .field("auditEnabled", "Bool", false, "Flag indicates whether or not domain modifications should be logged for SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for any API defining it.", false) + .field("account", "String", true, "associated cloud (i.e. aws) account id") + .field("ypmId", "Int32", true, "associated product id"); + + sb.structType("TopLevelDomain", "DomainMeta") + .comment("Top Level Domain object. The required attributes include the name of the domain and list of domain administrators.") + .field("name", "SimpleName", false, "name of the domain") + .arrayField("adminUsers", "ResourceName", false, "list of domain administrators") + .field("templates", "DomainTemplateList", true, "list of solution template names"); + + sb.structType("SubDomain", "TopLevelDomain") + .comment("A Subdomain is a TopLevelDomain, except it has a parent.") + .field("parent", "DomainName", false, "name of the parent domain"); + + sb.structType("UserDomain", "DomainMeta") + .comment("A UserDomain is the user's own top level domain in user - e.g. user.hga") + .field("name", "SimpleName", false, "user id which will be the domain name") + .field("templates", "DomainTemplateList", true, "list of solution template names"); + + sb.structType("DanglingPolicy") + .comment("A dangling policy where the assertion is referencing a role name that doesn't exist in the domain") + .field("policyName", "EntityName", false, "") + .field("roleName", "EntityName", false, ""); + + sb.structType("DomainDataCheck") + .comment("Domain data object representing the results of a check operation looking for dangling roles, policies and trust relationships that are set either on tenant or provider side only") + .arrayField("danglingRoles", "EntityName", true, "Names of roles not specified in any assertion. Might be empty or null if no dangling roles.") + .arrayField("danglingPolicies", "DanglingPolicy", true, "Policy+role tuples where role doesnt exist. Might be empty or null if no dangling policies.") + .field("policyCount", "Int32", false, "total number of policies") + .field("assertionCount", "Int32", false, "total number of assertions") + .field("roleWildCardCount", "Int32", false, "total number of assertions containing roles as wildcards") + .arrayField("providersWithoutTrust", "ServiceName", true, "Service names (domain.service) that dont contain trust role if this is a tenant domain. Might be empty or null, if not a tenant or if all providers support this tenant.") + .arrayField("tenantsWithoutAssumeRole", "DomainName", true, "Names of Tenant domains that dont contain assume role assertions if this is a provider domain. Might be empty or null, if not a provider or if all tenants support use this provider."); + + sb.structType("Entity") + .comment("An entity is a name and a structured value. some entity names/prefixes are reserved (i.e. \"role\", \"policy\", \"meta\", \"domain\", \"service\")") + .field("name", "EntityName", false, "name of the entity object") + .field("value", "Struct", false, "value of the entity"); + + sb.structType("EntityList") + .comment("The representation for an enumeration of entities in the namespace") + .arrayField("names", "EntityName", false, "list of entity names"); + + sb.structType("PolicyList") + .comment("The representation for an enumeration of policies in the namespace, with pagination.") + .arrayField("names", "EntityName", false, "list of policy names") + .field("next", "String", true, "if the response is a paginated list, this attribute specifies the value to be used in the next policy list request as the value for the skip query parameter."); + + sb.structType("PublicKeyEntry") + .comment("The representation of the public key in a service identity object.") + .field("key", "String", false, "the public key for the service") + .field("id", "String", false, "the key identifier (version or zone name)"); + + sb.structType("ServiceIdentity") + .comment("The representation of the service identity object.") + .field("name", "ServiceName", false, "the full name of the service, i.e. \"sports.storage\"") + .arrayField("publicKeys", "PublicKeyEntry", true, "array of public keys for key rotation") + .field("providerEndpoint", "String", true, "if present, then this service can provision tenants via this endpoint.") + .field("modified", "Timestamp", true, "the timestamp when this entry was last modified") + .field("executable", "String", true, "the path of the executable that runs the service") + .arrayField("hosts", "String", true, "list of host names that this service can run on") + .field("user", "String", true, "local (unix) user name this service can run as") + .field("group", "String", true, "local (unix) group name this service can run as"); + + sb.structType("ServiceIdentities") + .comment("The representation of list of services") + .arrayField("list", "ServiceIdentity", false, "list of services"); + + sb.structType("ServiceIdentityList") + .comment("The representation for an enumeration of services in the namespace, with pagination.") + .arrayField("names", "EntityName", false, "list of service names") + .field("next", "String", true, "if the response is a paginated list, this attribute specifies the value to be used in the next service list request as the value for the skip query parameter."); + + sb.structType("Tenancy") + .comment("A representation of tenant.") + .field("domain", "DomainName", false, "the domain that is to get a tenancy") + .field("service", "ServiceName", false, "the provider service on which the tenancy is to reside") + .arrayField("resourceGroups", "EntityName", true, "registered resource groups for this tenant"); + + sb.structType("TenancyResourceGroup") + .field("domain", "DomainName", false, "the domain that is to get a tenancy") + .field("service", "ServiceName", false, "the provider service on which the tenancy is to reside") + .field("resourceGroup", "EntityName", false, "registered resource group for this tenant"); + + sb.structType("TenantRoleAction") + .comment("A representation of tenant role action.") + .field("role", "SimpleName", false, "name of the role") + .field("action", "String", false, "action value for the generated policy assertion"); + + sb.structType("TenantRoles") + .comment("A representation of tenant roles to be provisioned.") + .field("domain", "DomainName", false, "name of the provider domain") + .field("service", "SimpleName", false, "name of the provider service") + .field("tenant", "DomainName", false, "name of the tenant domain") + .arrayField("roles", "TenantRoleAction", false, "the role/action pairs to provision"); + + sb.structType("TenantResourceGroupRoles") + .comment("A representation of tenant roles for resource groups to be provisioned.") + .field("domain", "DomainName", false, "name of the provider domain") + .field("service", "SimpleName", false, "name of the provider service") + .field("tenant", "DomainName", false, "name of the tenant domain") + .arrayField("roles", "TenantRoleAction", false, "the role/action pairs to provision") + .field("resourceGroup", "EntityName", false, "tenant resource group"); + + sb.structType("ProviderResourceGroupRoles") + .comment("A representation of provider roles to be provisioned.") + .field("domain", "DomainName", false, "name of the provider domain") + .field("service", "SimpleName", false, "name of the provider service") + .field("tenant", "DomainName", false, "name of the tenant domain") + .arrayField("roles", "TenantRoleAction", false, "the role/action pairs to provision") + .field("resourceGroup", "EntityName", false, "tenant resource group"); + + sb.structType("Access") + .comment("Access can be checked and returned as this resource.") + .field("granted", "Bool", false, "true (allowed) or false (denied)"); + + sb.structType("ResourceAccess") + .field("principal", "EntityName", false, "") + .arrayField("assertions", "Assertion", false, ""); + + sb.structType("ResourceAccessList") + .arrayField("resources", "ResourceAccess", false, ""); + + sb.structType("DomainModified") + .comment("Tuple of domain-name and modification time-stamps. This object is returned when the caller has requested list of domains modified since a specific timestamp.") + .field("name", "DomainName", false, "name of the domain") + .field("modified", "Int64", false, "last modified timestamp of the domain"); + + sb.structType("DomainModifiedList") + .comment("A list of {domain, modified-timestamp} tuples.") + .arrayField("nameModList", "DomainModified", false, "list of modified domains"); + + sb.structType("DomainPolicies") + .comment("We need to include the name of the domain in this struct since this data will be passed back to ZPU through ZTS so we need to sign not only the list of policies but also the corresponding domain name that the policies belong to.") + .field("domain", "DomainName", false, "name of the domain") + .arrayField("policies", "Policy", false, "list of policies defined in this server"); + + sb.structType("SignedPolicies") + .comment("A signed bulk transfer of policies. The data is signed with server's private key.") + .field("contents", "DomainPolicies", false, "list of policies defined in a domain") + .field("signature", "String", false, "signature generated based on the domain policies object") + .field("keyId", "String", false, "the identifier of the key used to generate the signature"); + + sb.structType("DomainData") + .comment("A domain object that includes its roles, policies and services.") + .field("name", "DomainName", false, "name of the domain") + .field("account", "String", true, "associated cloud (i.e. aws) account id") + .field("ypmId", "Int32", true, "associated product id") + .arrayField("roles", "Role", false, "list of roles in the domain") + .field("policies", "SignedPolicies", false, "list of policies in the domain signed with ZMS private key") + .arrayField("services", "ServiceIdentity", false, "list of services in the domain") + .arrayField("entities", "Entity", false, "list of entities in the domain") + .field("modified", "Timestamp", false, "last modification timestamp"); + + sb.structType("SignedDomain") + .comment("A domain object signed with server's private key") + .field("domain", "DomainData", false, "domain object with its roles, policies and services") + .field("signature", "String", false, "signature generated based on the domain object") + .field("keyId", "String", false, "the identifier of the key used to generate the signature"); + + sb.structType("SignedDomains") + .comment("A list of signed domain objects") + .arrayField("domains", "SignedDomain", false, ""); + + sb.structType("UserToken") + .comment("A user token generated based on user's credentials") + .field("token", "SignedToken", false, "Signed user token identifying a specific authenticated user"); + + sb.structType("ServicePrincipal") + .comment("A service principal object identifying a given service.") + .field("domain", "DomainName", false, "name of the domain") + .field("service", "EntityName", false, "name of the service") + .field("token", "SignedToken", false, "service's signed token"); + + + sb.resource("Domain", "GET", "/domain/{domain}") + .comment("Get info for the specified domain, by name. This request only returns the configured domain attributes and not any domain objects like roles, policies or service identities.") + .pathParam("domain", "DomainName", "name of the domain") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DomainList", "GET", "/domain") + .comment("Enumerate domains. Can be filtered by prefix and depth, and paginated. This operation can be expensive, as it may span multiple domains.") + .queryParam("limit", "limit", "Int32", null, "restrict the number of results in this call") + .queryParam("skip", "skip", "String", null, "restrict the set to those after the specified \"next\" token returned from a previous call") + .queryParam("prefix", "prefix", "String", null, "restrict to names that start with the prefix") + .queryParam("depth", "depth", "Int32", null, "restrict the depth of the name, specifying the number of '.' characters that can appear") + .queryParam("account", "account", "String", null, "restrict to domain names that have specified account name") + .queryParam("ypmid", "productId", "Int32", null, "restrict the domain names that have specified product id") + .queryParam("member", "roleMember", "ResourceName", null, "restrict the domain names where the specified user is in a role - see roleName") + .queryParam("role", "roleName", "ResourceName", null, "restrict the domain names where the specified user is in this role - see roleMember") + .headerParam("If-Modified-Since", "modifiedSince", "String", null, "This header specifies to the server to return any domains modified since this HTTP date") + .expected("OK") + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TopLevelDomain", "POST", "/domain") + .comment("Create a new top level domain. This is a privileged action for the \"sys.auth\" administrators.") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "TopLevelDomain", "TopLevelDomain object to be created") + .auth("create", "sys.auth:domain") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("SubDomain", "POST", "/subdomain/{parent}") + .comment("Create a new subdomain. The domain administrators of the {parent} domain have the privilege to create subdomains.") + .pathParam("parent", "DomainName", "name of the parent domain") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "SubDomain", "Subdomain object to be created") + .auth("create", "{parent}:domain") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("UserDomain", "POST", "/userdomain/{name}") + .comment("Create a new user domain. The user domain will be created in the user top level domain and the user himself will be set as the administrator for this domain.") + .pathParam("name", "SimpleName", "name of the domain which will be the user id") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "UserDomain", "UserDomain object to be created") + .auth("create", "user.{name}:domain") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TopLevelDomain", "DELETE", "/domain/{name}") + .comment("Delete the specified domain. This is a privileged action for the \"sys.auth\" administrators. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("name", "DomainName", "name of the domain to be deleted") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "sys.auth:domain") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("SubDomain", "DELETE", "/subdomain/{parent}/{name}") + .comment("Delete the specified subdomain. Caller must have domain delete permissions in parent. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("parent", "DomainName", "name of the parent domain") + .pathParam("name", "DomainName", "name of the subdomain to be deleted") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{parent}:domain") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("UserDomain", "DELETE", "/userdomain/{name}") + .comment("Delete the specified userdomain. Caller must have domain delete permissions in the domain. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("name", "SimpleName", "name of the domain to be deleted which will be the user id") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "user.{name}:domain") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DomainMeta", "PUT", "/domain/{name}/meta") + .comment("Update the specified top level domain metadata. Note that entities in the domain are not affected. Caller must have update privileges on the domain itself.") + .pathParam("name", "DomainName", "name of the domain to be updated") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "DomainMeta", "DomainMeta object with updated attribute values") + .auth("update", "{name}:") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DomainTemplate", "PUT", "/domain/{name}/template") + .comment("Update the given domain by applying the roles and policies defined in the specified solution template(s). Caller must have UPDATE privileges on the domain itself.") + .pathParam("name", "DomainName", "name of the domain to be updated") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("template", "DomainTemplate", "DomainTemplate object with solution template name(s)") + .auth("update", "{name}:") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DomainTemplateList", "GET", "/domain/{name}/template") + .comment("Get the list of solution templates applied to a domain") + .pathParam("name", "DomainName", "name of the domain") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DomainTemplate", "DELETE", "/domain/{name}/template/{template}") + .comment("Update the given domain by deleting the specified template from the domain template list. Cycles through the roles and policies defined in the template and deletes them. Caller must have delete privileges on the domain itself.") + .pathParam("name", "DomainName", "name of the domain to be updated") + .pathParam("template", "SimpleName", "name of the solution template") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{name}:") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DomainDataCheck", "GET", "/domain/{domainName}/check") + .comment("Carry out data check operation for the specified domain.") + .pathParam("domainName", "DomainName", "name of the domain") + .auth("", "", true) + .expected("OK") + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Entity", "PUT", "/domain/{domainName}/entity/{entityName}") + .comment("Put an entity into the domain.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("entityName", "EntityName", "name of entity") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("entity", "Entity", "Entity object to be added to the domain") + .auth("update", "{domainName}:{entityName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Entity", "GET", "/domain/{domainName}/entity/{entityName}") + .comment("Get a entity from a domain. open for all authenticated users to read") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("entityName", "EntityName", "name of entity") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Entity", "DELETE", "/domain/{domainName}/entity/{entityName}") + .comment("Delete the entity from the domain. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("entityName", "EntityName", "name of entity") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{domainName}:{entityName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("EntityList", "GET", "/domain/{domainName}/entity") + .comment("Enumerate entities provisioned in this domain.") + .pathParam("domainName", "DomainName", "name of the domain") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("RoleList", "GET", "/domain/{domainName}/role") + .comment("Enumerate roles provisioned in this domain.") + .pathParam("domainName", "DomainName", "name of the domain") + .queryParam("limit", "limit", "Int32", null, "restrict the number of results in this call") + .queryParam("skip", "skip", "String", null, "restrict the set to those after the specified \"next\" token returned from a previous call") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Roles", "GET", "/domain/{domainName}/roles") + .comment("Get the list of all roles in a domain with optional flag whether or not include members") + .pathParam("domainName", "DomainName", "name of the domain") + .queryParam("members", "members", "Bool", false, "return list of members in the role") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Role", "GET", "/domain/{domainName}/role/{roleName}") + .comment("Get the specified role in the domain.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("roleName", "EntityName", "name of the role to be retrieved") + .queryParam("auditLog", "auditLog", "Bool", false, "flag to indicate whether or not to return role audit log") + .queryParam("expand", "expand", "Bool", false, "expand delegated trust roles and return trusted members") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Role", "PUT", "/domain/{domainName}/role/{roleName}") + .comment("Create/update the specified role.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("roleName", "EntityName", "name of the role to be added/updated") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("role", "Role", "Role object to be added/updated in the domain") + .auth("update", "{domainName}:role.{roleName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Role", "DELETE", "/domain/{domainName}/role/{roleName}") + .comment("Delete the specified role. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("roleName", "EntityName", "name of the role to be deleted") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{domainName}:role.{roleName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Membership", "GET", "/domain/{domainName}/role/{roleName}/member/{memberName}") + .comment("Get the membership status for a specified user in a role.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("roleName", "EntityName", "name of the role") + .pathParam("memberName", "ResourceName", "user name to be checked for membership") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Membership", "PUT", "/domain/{domainName}/role/{roleName}/member/{memberName}") + .comment("Add the specified user to the role's member list.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("roleName", "EntityName", "name of the role") + .pathParam("memberName", "ResourceName", "name of the user to be added as a member") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("membership", "Membership", "Membership object (must contain role/member names as specified in the URI)") + .auth("update", "{domainName}:role.{roleName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Membership", "DELETE", "/domain/{domainName}/role/{roleName}/member/{memberName}") + .comment("Delete the specified role membership. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("roleName", "EntityName", "name of the role") + .pathParam("memberName", "ResourceName", "name of the user to be removed as a member") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("update", "{domainName}:role.{roleName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DefaultAdmins", "PUT", "/domain/{domainName}/admins") + .comment("Verify and, if necessary, fix domain roles and policies to make sure the given set of users have administrative access to the domain. This request is only restricted to \"sys.auth\" domain administrators and can be used when the domain administrators incorrectly have blocked their own access to their domains.") + .pathParam("domainName", "DomainName", "name of the domain") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("defaultAdmins", "DefaultAdmins", "list of domain administrators") + .auth("update", "sys.auth:domain") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("PolicyList", "GET", "/domain/{domainName}/policy") + .comment("List policies provisioned in this namespace.") + .pathParam("domainName", "DomainName", "name of the domain") + .queryParam("limit", "limit", "Int32", null, "restrict the number of results in this call") + .queryParam("skip", "skip", "String", null, "restrict the set to those after the specified \"next\" token returned from a previous call") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Policies", "GET", "/domain/{domainName}/policies") + .comment("List policies provisioned in this namespace.") + .pathParam("domainName", "DomainName", "name of the domain") + .queryParam("assertions", "assertions", "Bool", false, "return list of assertions in the policy") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Policy", "GET", "/domain/{domainName}/policy/{policyName}") + .comment("Read the specified policy.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("policyName", "EntityName", "name of the policy to be retrieved") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Policy", "PUT", "/domain/{domainName}/policy/{policyName}") + .comment("Create or update the specified policy.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("policyName", "EntityName", "name of the policy to be added/updated") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("policy", "Policy", "Policy object to be added or updated in the domain") + .auth("update", "{domainName}:policy.{policyName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Policy", "DELETE", "/domain/{domainName}/policy/{policyName}") + .comment("Delete the specified policy. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("policyName", "EntityName", "name of the policy to be deleted") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{domainName}:policy.{policyName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Assertion", "GET", "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + .comment("Get the assertion details with specified id in the given policy") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("policyName", "EntityName", "name of the policy") + .pathParam("assertionId", "Int64", "assertion id") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Assertion", "PUT", "/domain/{domainName}/policy/{policyName}/assertion") + .comment("Add the specified assertion to the given policy") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("policyName", "EntityName", "name of the policy") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("assertion", "Assertion", "Assertion object to be added to the given policy") + .auth("update", "{domainName}:policy.{policyName}") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Assertion", "DELETE", "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + .comment("Delete the specified policy assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("policyName", "EntityName", "name of the policy") + .pathParam("assertionId", "Int64", "assertion id") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("update", "{domainName}:policy.{policyName}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ServiceIdentity", "PUT", "/domain/{domain}/service/{service}") + .comment("Register the specified ServiceIdentity in the specified domain") + .pathParam("domain", "DomainName", "name of the domain") + .pathParam("service", "SimpleName", "name of the service") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "ServiceIdentity", "ServiceIdentity object to be added/updated in the domain") + .auth("update", "{domain}:service") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ServiceIdentity", "GET", "/domain/{domain}/service/{service}") + .comment("Get info for the specified ServiceIdentity.") + .pathParam("domain", "DomainName", "name of the domain") + .pathParam("service", "SimpleName", "name of the service to be retrieved") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ServiceIdentity", "DELETE", "/domain/{domain}/service/{service}") + .comment("Delete the specified ServiceIdentity. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domain", "DomainName", "name of the domain") + .pathParam("service", "SimpleName", "name of the service to be deleted") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{domain}:service") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ServiceIdentities", "GET", "/domain/{domainName}/services") + .comment("Retrieve list of service identities") + .pathParam("domainName", "DomainName", "name of the domain") + .queryParam("publickeys", "publickeys", "Bool", false, "return list of public keys in the service") + .queryParam("hosts", "hosts", "Bool", false, "return list of hosts in the service") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ServiceIdentityList", "GET", "/domain/{domainName}/service") + .comment("Enumerate services provisioned in this domain.") + .pathParam("domainName", "DomainName", "name of the domain") + .queryParam("limit", "limit", "Int32", null, "restrict the number of results in this call") + .queryParam("skip", "skip", "String", null, "restrict the set to those after the specified \"next\" token returned from a previous call") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("PublicKeyEntry", "GET", "/domain/{domain}/service/{service}/publickey/{id}") + .comment("Retrieve the specified public key from the service.") + .pathParam("domain", "DomainName", "name of the domain") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("id", "String", "the identifier of the public key to be retrieved") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("PublicKeyEntry", "PUT", "/domain/{domain}/service/{service}/publickey/{id}") + .comment("Add the specified public key to the service.") + .pathParam("domain", "DomainName", "name of the domain") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("id", "String", "the identifier of the public key to be added") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("publicKeyEntry", "PublicKeyEntry", "PublicKeyEntry object to be added/updated in the service") + .auth("update", "{domain}:service.{service}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("PublicKeyEntry", "DELETE", "/domain/{domain}/service/{service}/publickey/{id}") + .comment("Remove the specified public key from the service. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domain", "DomainName", "name of the domain") + .pathParam("service", "SimpleName", "name of the service") + .pathParam("id", "String", "the identifier of the public key to be deleted") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("update", "{domain}:service.{service}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Tenancy", "PUT", "/domain/{domain}/tenancy/{service}") + .comment("Add a tenant for the specified service.") + .pathParam("domain", "DomainName", "name of the tenant domain") + .pathParam("service", "ServiceName", "name of the provider service") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "Tenancy", "tenancy object") + .auth("update", "{domain}:tenancy") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Tenancy", "GET", "/domain/{domain}/tenancy/{service}") + .comment("Retrieve the specified tenant.") + .pathParam("domain", "DomainName", "name of the tenant domain") + .pathParam("service", "ServiceName", "name of the provider service") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Tenancy", "DELETE", "/domain/{domain}/tenancy/{service}") + .comment("Delete the tenant from the specified service. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domain", "DomainName", "name of the tenant domain") + .pathParam("service", "ServiceName", "name of the provider service") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{domain}:tenancy") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenancyResourceGroup", "PUT", "/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + .comment("Add a new resource group for the tenant for the specified service.") + .pathParam("domain", "DomainName", "name of the tenant domain") + .pathParam("service", "ServiceName", "name of the provider service") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "TenancyResourceGroup", "tenancy resource group object") + .auth("update", "{domain}:tenancy.{service}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenancyResourceGroup", "DELETE", "/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + .comment("Delete the specified resource group for tenant from the specified service.") + .pathParam("domain", "DomainName", "name of the tenant domain") + .pathParam("service", "ServiceName", "name of the provider service") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("update", "{domain}:tenancy.{service}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantRoles", "PUT", "/domain/{domain}/service/{service}/tenant/{tenantDomain}") + .comment("Create/update set of roles for a given tenant.") + .pathParam("domain", "DomainName", "name of the provider domain") + .pathParam("service", "SimpleName", "name of the provider service") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "TenantRoles", "list of roles to be added/updated for the tenant") + .auth("update", "{domain}:tenant.{tenantDomain}") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantRoles", "GET", "/domain/{domain}/service/{service}/tenant/{tenantDomain}") + .comment("Retrieve the configured set of roles for the tenant.") + .pathParam("domain", "DomainName", "name of the provider domain") + .pathParam("service", "SimpleName", "name of the provider service") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantRoles", "DELETE", "/domain/{domain}/service/{service}/tenant/{tenantDomain}") + .comment("Delete the configured set of roles for the tenant. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).") + .pathParam("domain", "DomainName", "name of the provider domain") + .pathParam("service", "SimpleName", "name of the provider service") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("delete", "{domain}:tenant.{tenantDomain}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantResourceGroupRoles", "PUT", "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + .comment("Create/update set of roles for a given tenant and resource group") + .pathParam("domain", "DomainName", "name of the provider domain") + .pathParam("service", "SimpleName", "name of the provider service") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "TenantResourceGroupRoles", "list of roles to be added/updated for the tenant") + .auth("update", "{domain}:tenant.{tenantDomain}") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantResourceGroupRoles", "GET", "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + .comment("Retrieve the configured set of roles for the tenant and resource group") + .pathParam("domain", "DomainName", "name of the provider domain") + .pathParam("service", "SimpleName", "name of the provider service") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantResourceGroupRoles", "DELETE", "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + .comment("Delete the configured set of roles for the tenant and resource group") + .pathParam("domain", "DomainName", "name of the provider domain") + .pathParam("service", "SimpleName", "name of the provider service") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("update", "{domain}:tenant.{tenantDomain}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ProviderResourceGroupRoles", "PUT", "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + .comment("Create/update set of roles for a given provider and resource group") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .pathParam("provDomain", "DomainName", "name of the provider domain") + .pathParam("provService", "SimpleName", "name of the provider service") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .input("detail", "ProviderResourceGroupRoles", "list of roles to be added/updated for the provider") + .auth("update", "{tenantDomain}:tenancy.{provDomain}.{provService}") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ProviderResourceGroupRoles", "GET", "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + .comment("Retrieve the configured set of roles for the provider and resource group") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .pathParam("provDomain", "DomainName", "name of the provider domain") + .pathParam("provService", "SimpleName", "name of the provider service") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ProviderResourceGroupRoles", "DELETE", "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + .comment("Delete the configured set of roles for the provider and resource group") + .pathParam("tenantDomain", "DomainName", "name of the tenant domain") + .pathParam("provDomain", "DomainName", "name of the provider domain") + .pathParam("provService", "SimpleName", "name of the provider service") + .pathParam("resourceGroup", "EntityName", "tenant resource group") + .headerParam("Y-Audit-Ref", "auditRef", "String", null, "Audit param required(not empty) if domain auditEnabled is true.") + .auth("update", "{tenantDomain}:tenancy.{provDomain}.{provService}") + .expected("NO_CONTENT") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("CONFLICT", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Access", "GET", "/access/{action}/{resource}") + .comment("Check access for the specified operation on the specified resource for the currently authenticated user. This is the slow centralized access for control-plane purposes. Use distributed mechanisms for decentralized (data-plane) access by fetching signed policies and role tokens for users.") + .pathParam("action", "ActionName", "action as specified in the policy assertion, i.e. update or read") + .pathParam("resource", "YRN", "the resource to check access against, i.e. \"media.news:articles\"") + .queryParam("domain", "domain", "DomainName", null, "usually null. If present, it specifies an alternate domain for cross-domain trust relation") + .queryParam("principal", "checkPrincipal", "EntityName", null, "usually null. If present, carry out the access check for this principal") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Access", "GET", "/access/{action}") + .name("GetAccessExt") + .pathParam("action", "ActionName", "action as specified in the policy assertion, i.e. update or read") + .queryParam("resource", "resource", "String", null, "the resource to check access against, i.e. \"media.news:articles\"") + .queryParam("domain", "domain", "DomainName", null, "usually null. If present, it specifies an alternate domain for cross-domain trust relation") + .queryParam("principal", "checkPrincipal", "EntityName", null, "usually null. If present, carry out the access check for this principal") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ResourceAccessList", "GET", "/resource") + .comment("Return list of resources that the given principal has access to. Even though the principal is marked as optional, it must be specified unless the caller has authorization from sys.auth domain to check access for all user principals. (action: access, resource: resource-lookup-all)") + .queryParam("principal", "principal", "EntityName", null, "specifies principal to query the resource list for") + .queryParam("action", "action", "ActionName", null, "action as specified in the policy assertion") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("SignedDomains", "GET", "/sys/modified_domains") + .comment("Retrieve the list of modified domains since the specified timestamp. The server will return the list of all modified domains and the latest modification timestamp as the value of the ETag header. The client will need to use this value during its next call to request the changes since the previous request. When metaonly set to true, dont add roles, policies or services, dont sign") + .queryParam("domain", "domain", "DomainName", null, "filter the domain list only to the specified name") + .queryParam("metaonly", "metaOnly", "String", null, "valid values are \"true\" or \"false\"") + .headerParam("If-None-Match", "matchingTag", "String", null, "Retrieved from the previous request, this timestamp specifies to the server to return any domains modified since this time") + .output("ETag", "tag", "String", "") + .auth("", "", true) + .expected("OK") + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("UserToken", "GET", "/user/{userName}/token") + .comment("Return a user/principal token for the specified authenticated user. Typical authenticated users with their native credentials are not allowed to update their domain data. They must first obtain a UserToken and then use that token for authentication and authorization of their update requests.") + .pathParam("userName", "SimpleName", "name of the user") + .queryParam("services", "serviceNames", "String", null, "comma separated list of on-behalf-of service names") + .auth("", "", true) + .expected("OK") + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("UserToken", "OPTIONS", "/user/{userName}/token") + .comment("CORS (Cross-Origin Resource Sharing) support to allow Provider Services to obtain AuthorizedService Tokens on behalf of Tenant administrators") + .pathParam("userName", "SimpleName", "name of the user") + .queryParam("services", "serviceNames", "String", null, "comma separated list of on-behalf-of service names") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") +; + + sb.resource("ServicePrincipal", "GET", "/principal") + .comment("Return a ServicePrincipal object if the serviceToken is valid. This request provides a simple operation that an external application can execute to validate a service token.") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ServerTemplateList", "GET", "/template") + .comment("Get the list of solution templates defined in the server") + .auth("", "", true) + .expected("OK") + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Template", "GET", "/template/{template}") + .comment("Get solution template details. Includes the roles and policies that will be automatically provisioned when the template is applied to a domain") + .pathParam("template", "SimpleName", "name of the solution template") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + + return sb.build(); + } + +} diff --git a/core/zms/src/main/rdl/Access.rdli b/core/zms/src/main/rdl/Access.rdli new file mode 100644 index 00000000000..4604081262d --- /dev/null +++ b/core/zms/src/main/rdl/Access.rdli @@ -0,0 +1,70 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; +include "Policy.tdl"; + +//Access can be checked and returned as this resource. +type Access Struct { + Bool granted; //true (allowed) or false (denied) +} + +//Check access for the specified operation on the specified resource +//for the currently authenticated user. This is the slow centralized +//access for control-plane purposes. Use distributed mechanisms for +//decentralized (data-plane) access by fetching signed policies and +//role tokens for users. +resource Access GET "/access/{action}/{resource}?domain={domain}&principal={checkPrincipal}" { + ActionName action; //action as specified in the policy assertion, i.e. update or read + YRN resource; //the resource to check access against, i.e. "media.news:articles" + DomainName domain (optional); //usually null. If present, it specifies an alternate domain for cross-domain trust relation + EntityName checkPrincipal (optional); //usually null. If present, carry out the access check for this principal + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError NOT_FOUND; + } +} + +resource Access GET "/access/{action}?resource={resource}&domain={domain}&principal={checkPrincipal}" (name=GetAccessExt) { + ActionName action; //action as specified in the policy assertion, i.e. update or read + String resource; //the resource to check access against, i.e. "media.news:articles" + DomainName domain (optional); //usually null. If present, it specifies an alternate domain for cross-domain trust relation + EntityName checkPrincipal (optional); //usually null. If present, carry out the access check for this principal + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError NOT_FOUND; + } +} + +type ResourceAccess Struct { + EntityName principal; + Array assertions; +} + +type ResourceAccessList Struct { + Array resources; +} + +//Return list of resources that the given principal has access to. Even though the principal +//is marked as optional, it must be specified unless the caller has authorization from sys.auth +//domain to check access for all user principals. (action: access, resource: resource-lookup-all) +resource ResourceAccessList GET "/resource?principal={principal}&action={action}" { + EntityName principal (optional); //specifies principal to query the resource list for + ActionName action (optional); //action as specified in the policy assertion + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError NOT_FOUND; + } +} diff --git a/core/zms/src/main/rdl/Domain.rdli b/core/zms/src/main/rdl/Domain.rdli new file mode 100644 index 00000000000..b1b3381d067 --- /dev/null +++ b/core/zms/src/main/rdl/Domain.rdli @@ -0,0 +1,233 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Domain API +include "Names.tdl"; +include "Domain.tdl"; +include "Template.tdl"; + +//Get info for the specified domain, by name. This request only returns +//the configured domain attributes and not any domain objects like roles, +//policies or service identities. +resource Domain GET "/domain/{domain}" { + DomainName domain; //name of the domain + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//A paginated list of domains. +type DomainList Struct { + Array names; //list of domain names + String next (optional); //if the response is a paginated list, this attribute specifies the value to be used in the next domain list request as the value for the skip query parameter. +} + +//Enumerate domains. Can be filtered by prefix and depth, and paginated. +//This operation can be expensive, as it may span multiple domains. +resource DomainList GET "/domain?limit={limit}&skip={skip}&prefix={prefix}&depth={depth}&account={account}&ypmid={productId}&member={roleMember}&role={roleName}" { + Int32 limit (optional); //restrict the number of results in this call + String skip (optional); //restrict the set to those after the specified "next" token returned from a previous call + String prefix (optional); //restrict to names that start with the prefix + Int32 depth (optional); //restrict the depth of the name, specifying the number of '.' characters that can appear + String account (optional); //restrict to domain names that have specified account name + Int32 productId (optional); //restrict the domain names that have specified product id + ResourceName roleMember (optional); //restrict the domain names where the specified user is in a role - see roleName + ResourceName roleName (optional); //restrict the domain names where the specified user is in this role - see roleMember + String modifiedSince (header="If-Modified-Since"); //This header specifies to the server to return any domains modified since this HTTP date + exceptions { + ResourceError UNAUTHORIZED; + } +} + +//Set of metadata attributes that all domains may have and can be changed. +type DomainMeta Struct { + String description (optional); //a description of the domain + ResourceName org (optional); //a reference to an Organization. (i.e. org:media) + Bool enabled (optional, default=true); //Future use only, currently not used + Bool auditEnabled (optional, default=false); //Flag indicates whether or not domain modifications should be logged for SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for any API defining it. + String account (optional); // associated cloud (i.e. aws) account id + Int32 ypmId (optional); // associated product id +} + +//Top Level Domain object. The required attributes include the name of the +//domain and list of domain administrators. +type TopLevelDomain DomainMeta { + SimpleName name; //name of the domain + Array adminUsers; //list of domain administrators + DomainTemplateList templates (optional); //list of solution template names +} + +//A Subdomain is a TopLevelDomain, except it has a parent. +type SubDomain TopLevelDomain { + DomainName parent; //name of the parent domain +} + +//Create a new top level domain. This is a privileged action for the "sys.auth" administrators. +resource Domain POST "/domain" { + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + TopLevelDomain detail; //TopLevelDomain object to be created + authorize ("create", "sys.auth:domain"); + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Create a new subdomain. The domain administrators of the {parent} domain +//have the privilege to create subdomains. +resource Domain POST "/subdomain/{parent}" { + DomainName parent; //name of the parent domain + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + SubDomain detail; //Subdomain object to be created + authorize ("create", "{parent}:domain"); + expected OK; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//A UserDomain is the user's own top level domain in user - e.g. user.hga +type UserDomain DomainMeta { + SimpleName name; //user id which will be the domain name + DomainTemplateList templates (optional); //list of solution template names +} + +//Create a new user domain. The user domain will be created in the user +//top level domain and the user himself will be set as the administrator +//for this domain. +resource Domain POST "/userdomain/{name}" { + SimpleName name; //name of the domain which will be the user id + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + UserDomain detail; //UserDomain object to be created + authorize ("create", "user.{name}:domain"); + expected OK; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the specified domain. This is a privileged action for the "sys.auth" administrators. +//Upon successful completion of this delete request, the server will return NO_CONTENT status +//code without any data (no object will be returned). +resource TopLevelDomain DELETE "/domain/{name}" { + DomainName name; //name of the domain to be deleted + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "sys.auth:domain"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the specified subdomain. Caller must have domain delete permissions in parent. +//Upon successful completion of this delete request, the server will return NO_CONTENT status +//code without any data (no object will be returned). +resource SubDomain DELETE "/subdomain/{parent}/{name}" { + DomainName parent; //name of the parent domain + DomainName name; //name of the subdomain to be deleted + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "{parent}:domain"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the specified userdomain. Caller must have domain delete permissions in the domain. +//Upon successful completion of this delete request, the server will return NO_CONTENT status +//code without any data (no object will be returned). +resource UserDomain DELETE "/userdomain/{name}" { + SimpleName name; //name of the domain to be deleted which will be the user id + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "user.{name}:domain"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Update the specified top level domain metadata. Note that entities in the domain +//are not affected. Caller must have update privileges on the domain itself. +resource Domain PUT "/domain/{name}/meta" { + DomainName name; //name of the domain to be updated + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + DomainMeta detail; //DomainMeta object with updated attribute values + authorize ("update", "{name}:"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Update the given domain by applying the roles and policies defined +//in the specified solution template(s). Caller must have UPDATE privileges +//on the domain itself. +resource DomainTemplate PUT "/domain/{name}/template" { + DomainName name; //name of the domain to be updated + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + DomainTemplate template; //DomainTemplate object with solution template name(s) + authorize ("update", "{name}:"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Get the list of solution templates applied to a domain +resource DomainTemplateList GET "/domain/{name}/template" { + DomainName name; //name of the domain + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + +//Update the given domain by deleting the specified template from the +//domain template list. Cycles through the roles and policies defined in the +//template and deletes them. +//Caller must have delete privileges on the domain itself. +resource DomainTemplate DELETE "/domain/{name}/template/{template}" { + DomainName name; //name of the domain to be updated + SimpleName template; //name of the solution template + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "{name}:"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} diff --git a/core/zms/src/main/rdl/Domain.tdl b/core/zms/src/main/rdl/Domain.tdl new file mode 100644 index 00000000000..2adfb67cee0 --- /dev/null +++ b/core/zms/src/main/rdl/Domain.tdl @@ -0,0 +1,23 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Domain types +include "Names.tdl"; + +//A domain is an independent partition of users, roles, and resources. +//Its name represents the definition of a namespace; the only way a +//new namespace can be created, from the top, is by creating Domains. +//Administration of a domain is governed by the parent domain (using +//reverse-DNS namespaces). The top level domains are governed by the +//special "sys.auth" domain. +type Domain Struct { + DomainName name; //the common name to be referred to, the symbolic id. It is immutable + Timestamp modified (optional); //the last modification timestamp of any object or attribute in this domain + UUID id (optional); //unique identifier of the domain. generated on create, never reused + String description (optional); //description of the domain + ResourceName org (optional); //a reference to an Organization + Bool enabled (optional, default=true); //Future use only, currently not used + Bool auditEnabled (optional, default=false); //Flag indicates whether or not domain modifications should be logged for SOX+Auditing. If true, the auditRef parameter must be supplied(not empty) for any API defining it. + String account (optional); // associated cloud (i.e. aws) account id + Int32 ypmId (optional); // associated product id +} diff --git a/core/zms/src/main/rdl/DomainDataCheck.rdli b/core/zms/src/main/rdl/DomainDataCheck.rdli new file mode 100644 index 00000000000..961475a7765 --- /dev/null +++ b/core/zms/src/main/rdl/DomainDataCheck.rdli @@ -0,0 +1,52 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// DomainDataCheck API + +include "Names.tdl"; + +// A dangling policy where the assertion is referencing +// a role name that doesn't exist in the domain +type DanglingPolicy Struct { + EntityName policyName; + EntityName roleName; +} + +// Domain data object representing the results of a +// check operation looking for dangling roles, policies +// and trust relationships that are set either on tenant +// or provider side only +type DomainDataCheck Struct { + + // Names of roles not specified in any assertion. + // Might be empty or null if no dangling roles. + Array danglingRoles (optional); + + // Policy+role tuples where role doesnt exist. + // Might be empty or null if no dangling policies. + Array danglingPolicies (optional); + + Int32 policyCount; // total number of policies + Int32 assertionCount; // total number of assertions + Int32 roleWildCardCount; // total number of assertions containing roles as wildcards + + // Service names (domain.service) that dont contain trust role if this is a tenant domain. + // Might be empty or null, if not a tenant or if all providers support this tenant. + Array providersWithoutTrust (optional); + + // Names of Tenant domains that dont contain assume role assertions if this is a provider domain. + // Might be empty or null, if not a provider or if all tenants support use this provider. + Array tenantsWithoutAssumeRole (optional); +} + +// Carry out data check operation for the specified domain. +resource DomainDataCheck GET "/domain/{domainName}/check" { + DomainName domainName; //name of the domain + authenticate; + exceptions { + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + diff --git a/core/zms/src/main/rdl/Entity.rdli b/core/zms/src/main/rdl/Entity.rdli new file mode 100644 index 00000000000..978b0dba489 --- /dev/null +++ b/core/zms/src/main/rdl/Entity.rdli @@ -0,0 +1,66 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Entity API. Not strictly needed for Athenz, but useful for storing info in/about domains. +include "Names.tdl"; +include "Entity.tdl"; + +//Put an entity into the domain. +resource Entity PUT "/domain/{domainName}/entity/{entityName}" { + DomainName domainName; //name of the domain + EntityName entityName; //name of entity + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + Entity entity; //Entity object to be added to the domain + authorize ("update", "{domainName}:{entityName}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Get a entity from a domain. +resource Entity GET "/domain/{domainName}/entity/{entityName}" { + DomainName domainName; //name of the domain + EntityName entityName; //name of entity + authenticate; //open for all authenticated users to read + expected OK; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the entity from the domain. Upon successful completion of this delete +//request, the server will return NO_CONTENT status code without any data +//(no object will be returned). +resource Entity DELETE "/domain/{domainName}/entity/{entityName}" { + DomainName domainName; //name of the domain + EntityName entityName; //name of entity + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "{domainName}:{entityName}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Enumerate entities provisioned in this domain. +resource EntityList GET "/domain/{domainName}/entity" { + DomainName domainName; //name of the domain + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zms/src/main/rdl/Entity.tdl b/core/zms/src/main/rdl/Entity.tdl new file mode 100644 index 00000000000..f2158c81022 --- /dev/null +++ b/core/zms/src/main/rdl/Entity.tdl @@ -0,0 +1,17 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Entity API. Not strictly needed for Athenz, but useful for storing info in/about domains. +include "Names.tdl"; + +//An entity is a name and a structured value. +//some entity names/prefixes are reserved (i.e. "role", "policy", "meta", "domain", "service") +type Entity Struct { + EntityName name; //name of the entity object + Struct value; //value of the entity +} + +//The representation for an enumeration of entities in the namespace +type EntityList Struct { + Array names; //list of entity names +} diff --git a/core/zms/src/main/rdl/Names.tdl b/core/zms/src/main/rdl/Names.tdl new file mode 100644 index 00000000000..561c975a51c --- /dev/null +++ b/core/zms/src/main/rdl/Names.tdl @@ -0,0 +1,58 @@ +// +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. +// +//Common name types used by several API definitions +// + +//A simple identifier, an element of compound name. +type SimpleName String (pattern="[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + +//A compound name. Most names in this API are compound names. +type CompoundName String (pattern="({SimpleName}\\.)*{SimpleName}"); + +//A domain name is the general qualifier prefix, as its uniqueness is managed. +type DomainName String (pattern="{CompoundName}"); + +//An entity name is a short form of a resource name, +//including only the domain and entity. +type EntityName String (pattern="{CompoundName}"); + +//A service name will generally be a unique subdomain. +type ServiceName String (pattern="{CompoundName}"); + +//A location name is not yet defined, but will be a +//dotted name like everything else. +type LocationName String (pattern="{CompoundName}"); + +//An action (operation) name. +type ActionName String (pattern="{CompoundName}"); + +//A shorthand for a YRN with no service or location. +//The 'tail' of a YRN, just the domain:entity. +//Note that the EntityName part is optional, that is, +//a domain name followed by a colon is valid resource name. +type ResourceName String (pattern="{DomainName}(:{EntityName})?"); + +//A full Yahoo Resource name (YRN). +type YRN String (pattern="(yrn:({ServiceName})?:({LocationName})?:)?{ResourceName}"); + +//The Y-specific URL-safe Base64 variant. +type YBase64 String (pattern="[a-zA-Z0-9\\._-]+"); + +//YEncoded includes ybase64 chars, as well as = and %. +//This can represent a user cookie and URL-encoded values. +type YEncoded String (pattern="[a-zA-Z0-9\\._%=-]*"); + +//Used as the prefix in a signed assertion. This uniquely +//identifies a signing authority. +type AuthorityName String (pattern="{CompoundName}"); //i.e. "user" + +//A signed assertion if identity. i.e. the user cookie value. +//This token will only make sense to the authority that +//generated it, so it is beneficial to have something in the +//value that is cheaply recognized to quickly reject if +//it belongs to another authority. In addition to the +//YEncoded set our token includes ; to separate components +//and , to separate roles and : for IPv6 addresses +type SignedToken String (pattern="[a-zA-Z0-9\\._%=:;,-]*"); diff --git a/core/zms/src/main/rdl/Policy.rdli b/core/zms/src/main/rdl/Policy.rdli new file mode 100644 index 00000000000..17c20bce7bd --- /dev/null +++ b/core/zms/src/main/rdl/Policy.rdli @@ -0,0 +1,136 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Policy API +include "Names.tdl"; +include "Policy.tdl"; + +//The representation for an enumeration of policies in the namespace, with pagination. +type PolicyList Struct { + Array names; //list of policy names + String next (optional); //if the response is a paginated list, this attribute specifies the value to be used in the next policy list request as the value for the skip query parameter. +} + +//List policies provisioned in this namespace. +resource PolicyList GET "/domain/{domainName}/policy?limit={limit}&skip={skip}" { + DomainName domainName; //name of the domain + Int32 limit (optional); //restrict the number of results in this call + String skip (optional); //restrict the set to those after the specified "next" token returned from a previous call + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//List policies provisioned in this namespace. +resource Policies GET "/domain/{domainName}/policies?assertions={assertions}" { + DomainName domainName; //name of the domain + Bool assertions (optional, default=false); // return list of assertions in the policy + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + +//Read the specified policy. +resource Policy GET "/domain/{domainName}/policy/{policyName}" { + DomainName domainName; //name of the domain + EntityName policyName; //name of the policy to be retrieved + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Create or update the specified policy. +resource Policy PUT "/domain/{domainName}/policy/{policyName}" { + DomainName domainName; //name of the domain + EntityName policyName; //name of the policy to be added/updated + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + Policy policy; //Policy object to be added or updated in the domain + authorize("update", "{domainName}:policy.{policyName}"); + expected NO_CONTENT; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Delete the specified policy. Upon successful completion of this delete +//request, the server will return NO_CONTENT status code without any data +//(no object will be returned). +resource Policy DELETE "/domain/{domainName}/policy/{policyName}" { + DomainName domainName; //name of the domain + EntityName policyName; //name of the policy to be deleted + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize("delete", "{domainName}:policy.{policyName}"); + expected NO_CONTENT; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Get the assertion details with specified id in the given policy +resource Assertion GET "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}" { + DomainName domainName; //name of the domain + EntityName policyName; //name of the policy + Int64 assertionId; //assertion id + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Add the specified assertion to the given policy +resource Assertion PUT "/domain/{domainName}/policy/{policyName}/assertion" { + DomainName domainName; //name of the domain + EntityName policyName; //name of the policy + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + Assertion assertion; //Assertion object to be added to the given policy + authorize ("update", "{domainName}:policy.{policyName}"); + expected OK, CREATED; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Delete the specified policy assertion. Upon successful completion of this delete +//request, the server will return NO_CONTENT status code without any data (no +//object will be returned). +resource Assertion DELETE "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}" { + DomainName domainName; //name of the domain + EntityName policyName; //name of the policy + Int64 assertionId; //assertion id + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("update", "{domainName}:policy.{policyName}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} \ No newline at end of file diff --git a/core/zms/src/main/rdl/Policy.tdl b/core/zms/src/main/rdl/Policy.tdl new file mode 100644 index 00000000000..ac6d1d2d2ab --- /dev/null +++ b/core/zms/src/main/rdl/Policy.tdl @@ -0,0 +1,30 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Policy Types +include "Names.tdl"; + +//Every assertion can have the effect of ALLOW or DENY. +type AssertionEffect Enum { ALLOW, DENY } + +//A representation for the encapsulation of an action to be performed on a +//resource by a principal. +type Assertion Struct { + String role; //the subject of the assertion - a role + String resource; //the object of the assertion. Must be in the local namespace. Can contain wildcards + String action; //the predicate of the assertion. Can contain wildcards + AssertionEffect effect (optional, default=ALLOW); //the effect of the assertion in the policy language + Int64 id (optional); //assertion id - auto generated by server. Not required during put operations. +} + +//The representation for a Policy with set of assertions. +type Policy Struct { + ResourceName name; //name of the policy + Timestamp modified (optional); //last modification timestamp of this policy + Array assertions; //list of defined assertions for this policy +} + +//The representation of list of policy objects +type Policies Struct { + Array list; // list of policy objects +} diff --git a/core/zms/src/main/rdl/Provider.rdl b/core/zms/src/main/rdl/Provider.rdl new file mode 100644 index 00000000000..b6685689ce9 --- /dev/null +++ b/core/zms/src/main/rdl/Provider.rdl @@ -0,0 +1,12 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// +//This "service" definition is just to provide a generic client +//stub for any service implementing the provider API +// +name Provider; +version 1; +namespace com.yahoo.athenz.provider; + +include "Provider.rdli"; diff --git a/core/zms/src/main/rdl/Provider.rdli b/core/zms/src/main/rdl/Provider.rdli new file mode 100644 index 00000000000..777a897c165 --- /dev/null +++ b/core/zms/src/main/rdl/Provider.rdli @@ -0,0 +1,109 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// +//The Provider API is the API to be implement to host tenants +// +include "Names.tdl"; + +type TenantState Enum { INACTIVE, PENDING, ACTIVE } + +type Tenant Struct { + SimpleName service; //name of the service + DomainName name; //name of the tenant domain in this service. Must be a valid domain name the caller has rights to + TenantState state (optional, default=ACTIVE); //the state of the tenant + Array roles (optional); //the roles this tenant may assume. Determined by and returned by this service + Array resourceGroups (optional); //registered resource groups for this tenant +} + +type TenantResourceGroup Struct { + SimpleName service; //name of the service + DomainName name; //name of the tenant domain in this service. Must be a valid domain name the caller has rights to + EntityName resourceGroup; //resource group for this tenant + Array roles (optional); //the roles this tenant may assume. Determined by and returned by this service +} + +//Create a new tenant in this provider +resource Tenant PUT "/service/{service}/tenant/{tenant}" { + SimpleName service; //name of the service + DomainName tenant; //name of the tenant domain in this service + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + Tenant template; + authorize("assume_role", "role.{service}.tenant.{tenant}.admin", "{tenant}"); //note optional 3rd arg in this case -- it is unusual! + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + Tenant ACCEPTED; + } +} + +//Get information about the tenant +resource Tenant GET "/service/{service}/tenant/{tenant}" { + SimpleName service; //name of the service + DomainName tenant; //name of the tenant domain in this service + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Remove a tenant and all its resources. Upon successful completion of this delete +//request, the server will return NO_CONTENT status code without any data (no +//object will be returned). +resource Tenant DELETE "/service/{service}/tenant/{tenant}" { + SimpleName service; //name of the service + DomainName tenant; //name of the tenant domain in this service + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize("assume_role", "role.{service}.tenant.{tenant}.admin", "{tenant}"); + expected NO_CONTENT; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Create a new resource group for this tenant in this provider. The tenant +//must already be registered with the provider +resource TenantResourceGroup PUT "/service/{service}/tenant/{tenant}/resourceGroup/{resourceGroup}" { + SimpleName service; //name of the service + DomainName tenant; //name of the tenant domain in this service + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + TenantResourceGroup template; + authorize("assume_role", "role.{service}.tenant.{tenant}.admin", "{tenant}"); + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + Tenant ACCEPTED; + } +} + +//Remove the specified resource group from this tenant and all its resources. +resource TenantResourceGroup DELETE "/service/{service}/tenant/{tenant}/resourceGroup/{resourceGroup}" { + SimpleName service; //name of the service + DomainName tenant; //name of the tenant domain in this service + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize("assume_role", "role.{service}.tenant.{tenant}.admin", "{tenant}"); + expected NO_CONTENT; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} diff --git a/core/zms/src/main/rdl/Role.rdli b/core/zms/src/main/rdl/Role.rdli new file mode 100644 index 00000000000..b2fd46fe833 --- /dev/null +++ b/core/zms/src/main/rdl/Role.rdli @@ -0,0 +1,151 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Role API +include "Role.tdl"; + +//Enumerate roles provisioned in this domain. +resource RoleList GET "/domain/{domainName}/role?limit={limit}&skip={skip}" { + DomainName domainName; //name of the domain + Int32 limit (optional); //restrict the number of results in this call + String skip (optional); //restrict the set to those after the specified "next" token returned from a previous call + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +// Get the list of all roles in a domain with optional flag +// whether or not include members +resource Roles GET "/domain/{domainName}/roles?members={members}" { + DomainName domainName; // name of the domain + Bool members (optional, default=false); // return list of members in the role + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + +//Get the specified role in the domain. +resource Role GET "/domain/{domainName}/role/{roleName}?auditLog={auditLog}&expand={expand}" { + DomainName domainName; //name of the domain + EntityName roleName; //name of the role to be retrieved + Bool auditLog (optional, default=false); //flag to indicate whether or not to return role audit log + Bool expand (optional, default=false); // expand delegated trust roles and return trusted members + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Create/update the specified role. +resource Role PUT "/domain/{domainName}/role/{roleName}" { + DomainName domainName; //name of the domain + EntityName roleName; //name of the role to be added/updated + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + Role role; //Role object to be added/updated in the domain + authorize ("update", "{domainName}:role.{roleName}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Delete the specified role. Upon successful completion of this delete +//request, the server will return NO_CONTENT status code without any +//data (no object will be returned). +resource Role DELETE "/domain/{domainName}/role/{roleName}" { + DomainName domainName; //name of the domain + EntityName roleName; //name of the role to be deleted + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "{domainName}:role.{roleName}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Get the membership status for a specified user in a role. +resource Membership GET "/domain/{domainName}/role/{roleName}/member/{memberName}" { + DomainName domainName; //name of the domain + EntityName roleName; //name of the role + ResourceName memberName; //user name to be checked for membership + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Add the specified user to the role's member list. +resource Membership PUT "/domain/{domainName}/role/{roleName}/member/{memberName}" { + DomainName domainName; //name of the domain + EntityName roleName; //name of the role + ResourceName memberName; //name of the user to be added as a member + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + Membership membership; //Membership object (must contain role/member names as specified in the URI) + authorize ("update", "{domainName}:role.{roleName}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Delete the specified role membership. Upon successful completion of this delete +//request, the server will return NO_CONTENT status code without any data (no +//object will be returned). +resource Membership DELETE "/domain/{domainName}/role/{roleName}/member/{memberName}" { + DomainName domainName; //name of the domain + EntityName roleName; //name of the role + ResourceName memberName; //name of the user to be removed as a member + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("update", "{domainName}:role.{roleName}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Verify and, if necessary, fix domain roles and policies to make sure the given +//set of users have administrative access to the domain. This request is only +//restricted to "sys.auth" domain administrators and can be used when the domain +//administrators incorrectly have blocked their own access to their domains. +resource DefaultAdmins PUT "/domain/{domainName}/admins" { + DomainName domainName; //name of the domain + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + DefaultAdmins defaultAdmins; //list of domain administrators + authorize ("update", "sys.auth:domain"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zms/src/main/rdl/Role.tdl b/core/zms/src/main/rdl/Role.tdl new file mode 100644 index 00000000000..0b69f6ebd15 --- /dev/null +++ b/core/zms/src/main/rdl/Role.tdl @@ -0,0 +1,45 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +//The representation for an enumeration of roles in the namespace, with pagination. +type RoleList Struct { + Array names; //list of role names + String next (optional); //if the response is a paginated list, this attribute specifies the value to be used in the next role list request as the value for the skip query parameter. +} + +//An audit log entry for role membership change. +type RoleAuditLog Struct { + ResourceName member; //name of the role member + ResourceName admin; //name of the principal executing the change + Timestamp created; //timestamp of the entry + String action; //log action - either add or delete + String auditRef (optional); //audit reference string for the change as supplied by admin +} + +//The representation for a Role with set of members. +type Role Struct { + ResourceName name; //name of the role + Timestamp modified (optional); //last modification timestamp of the role + Array members (optional); //an explicit list of members. Might be empty or null, if trust is set + DomainName trust (optional); //a trusted domain to delegate membership decisions to + Array auditLog (optional); //an audit log for role membership changes +} + +//The representation for a list of roles with full details +type Roles Struct { + Array list; // list of role objects +} + +//The representation for a role membership. +type Membership Struct { + ResourceName memberName; //name of the member + Bool isMember (optional, default=true); //flag to indicate whether or the user is a member or not + ResourceName roleName (optional); //name of the role +} + +//The list of domain administrators. +type DefaultAdmins Struct { + Array admins; //list of domain administrators +} diff --git a/core/zms/src/main/rdl/ServiceIdentity.rdli b/core/zms/src/main/rdl/ServiceIdentity.rdli new file mode 100644 index 00000000000..e42b77b6168 --- /dev/null +++ b/core/zms/src/main/rdl/ServiceIdentity.rdli @@ -0,0 +1,130 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "ServiceIdentity.tdl"; + +//Register the specified ServiceIdentity in the specified domain +resource ServiceIdentity PUT "/domain/{domain}/service/{service}" { + DomainName domain; //name of the domain + SimpleName service; //name of the service + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + ServiceIdentity detail; //ServiceIdentity object to be added/updated in the domain + authorize ("update", "{domain}:service"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Get info for the specified ServiceIdentity. +resource ServiceIdentity GET "/domain/{domain}/service/{service}" { + DomainName domain; //name of the domain + SimpleName service; //name of the service to be retrieved + authenticate; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the specified ServiceIdentity. Upon successful completion of this +//delete request, the server will return NO_CONTENT status code without any +//data (no object will be returned). +resource ServiceIdentity DELETE "/domain/{domain}/service/{service}" { + DomainName domain; //name of the domain + SimpleName service; //name of the service to be deleted + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "{domain}:service"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Retrieve list of service identities +resource ServiceIdentities GET "/domain/{domainName}/services?publickeys={publickeys}&hosts={hosts}" { + DomainName domainName; //name of the domain + Bool publickeys (optional, default=false); // return list of public keys in the service + Bool hosts (optional, default=false); // return list of hosts in the service + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + +//Enumerate services provisioned in this domain. +resource ServiceIdentityList GET "/domain/{domainName}/service?limit={limit}&skip={skip}" { + DomainName domainName;//name of the domain + Int32 limit (optional); //restrict the number of results in this call + String skip (optional); //restrict the set to those after the specified "next" token returned from a previous call + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Retrieve the specified public key from the service. +resource PublicKeyEntry GET "/domain/{domain}/service/{service}/publickey/{id}" { + DomainName domain; //name of the domain + SimpleName service; //name of the service + String id; //the identifier of the public key to be retrieved + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Add the specified public key to the service. +resource PublicKeyEntry PUT "/domain/{domain}/service/{service}/publickey/{id}" { + DomainName domain; //name of the domain + SimpleName service; //name of the service + String id; //the identifier of the public key to be added + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + PublicKeyEntry publicKeyEntry; //PublicKeyEntry object to be added/updated in the service + authorize ("update", "{domain}:service.{service}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Remove the specified public key from the service. Upon successful completion of +//this delete request, the server will return NO_CONTENT status code without any +//data (no object will be returned). +resource PublicKeyEntry DELETE "/domain/{domain}/service/{service}/publickey/{id}" { + DomainName domain; //name of the domain + SimpleName service; //name of the service + String id; //the identifier of the public key to be deleted + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("update", "{domain}:service.{service}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} diff --git a/core/zms/src/main/rdl/ServiceIdentity.tdl b/core/zms/src/main/rdl/ServiceIdentity.tdl new file mode 100644 index 00000000000..4ff1a9d3733 --- /dev/null +++ b/core/zms/src/main/rdl/ServiceIdentity.tdl @@ -0,0 +1,33 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +//The representation of the public key in a service identity object. +type PublicKeyEntry Struct { + String key; //the public key for the service + String id; //the key identifier (version or zone name) +} + +//The representation of the service identity object. +type ServiceIdentity Struct { + ServiceName name; //the full name of the service, i.e. "sports.storage" + Array publicKeys (optional); //array of public keys for key rotation + String providerEndpoint (optional); //if present, then this service can provision tenants via this endpoint. + Timestamp modified (optional); //the timestamp when this entry was last modified + String executable (optional); //the path of the executable that runs the service + Array hosts (optional); //list of host names that this service can run on + String user (optional); //local (unix) user name this service can run as + String group (optional); //local (unix) group name this service can run as +} + +//The representation of list of services +type ServiceIdentities Struct { + Array list; //list of services +} + +//The representation for an enumeration of services in the namespace, with pagination. +type ServiceIdentityList Struct { + Array names; //list of service names + String next (optional); //if the response is a paginated list, this attribute specifies the value to be used in the next service list request as the value for the skip query parameter. +} diff --git a/core/zms/src/main/rdl/SignedDomains.rdli b/core/zms/src/main/rdl/SignedDomains.rdli new file mode 100644 index 00000000000..95e5322139a --- /dev/null +++ b/core/zms/src/main/rdl/SignedDomains.rdli @@ -0,0 +1,79 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Policy.tdl"; +include "Role.tdl"; +include "ServiceIdentity.tdl"; +include "Entity.tdl"; + +//Tuple of domain-name and modification time-stamps. This object is returned +//when the caller has requested list of domains modified since a specific timestamp. +type DomainModified Struct { + DomainName name; //name of the domain + Int64 modified; //last modified timestamp of the domain +} + +//A list of {domain, modified-timestamp} tuples. +type DomainModifiedList Struct { + Array nameModList; //list of modified domains +} + +//We need to include the name of the domain in this struct since +//this data will be passed back to ZPU through ZTS so we need to +//sign not only the list of policies but also the corresponding +//domain name that the policies belong to. +type DomainPolicies Struct { + DomainName domain; //name of the domain + Array policies; //list of policies defined in this server +} + +//A signed bulk transfer of policies. The data is signed with server's +//private key. +type SignedPolicies Struct { + DomainPolicies contents; //list of policies defined in a domain + String signature; //signature generated based on the domain policies object + String keyId; //the identifier of the key used to generate the signature +} + +//A domain object that includes its roles, policies and services. +type DomainData Struct { + DomainName name; //name of the domain + String account (optional); // associated cloud (i.e. aws) account id + Int32 ypmId (optional); // associated product id + Array roles; //list of roles in the domain + SignedPolicies policies; //list of policies in the domain signed with ZMS private key + Array services; //list of services in the domain + Array entities; //list of entities in the domain + Timestamp modified; //last modification timestamp +} + +//A domain object signed with server's private key +type SignedDomain Struct { + DomainData domain; //domain object with its roles, policies and services + String signature; //signature generated based on the domain object + String keyId; //the identifier of the key used to generate the signature +} + +//A list of signed domain objects +type SignedDomains Struct { + Array domains; +} + +//Retrieve the list of modified domains since the specified timestamp. The +//server will return the list of all modified domains and the latest modification +//timestamp as the value of the ETag header. The client will need to use this +//value during its next call to request the changes since the previous request. +// When metaonly set to true, dont add roles, policies or services, dont sign +resource SignedDomains GET "/sys/modified_domains?domain={domain}&metaonly={metaOnly}" { + DomainName domain (optional); //filter the domain list only to the specified name + String metaOnly (optional); // valid values are "true" or "false" + String matchingTag (header="If-None-Match"); //Retrieved from the previous request, this timestamp specifies to the server to return any domains modified since this time + String tag (header="ETag", out); //The current latest modification timestamp is returned in this header + authenticate; + expected OK, NOT_MODIFIED; + exceptions { + ResourceError NOT_FOUND; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zms/src/main/rdl/Template.rdli b/core/zms/src/main/rdl/Template.rdli new file mode 100644 index 00000000000..8f85b3f19d1 --- /dev/null +++ b/core/zms/src/main/rdl/Template.rdli @@ -0,0 +1,26 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; +include "Template.tdl"; + +//Get the list of solution templates defined in the server +resource ServerTemplateList GET "/template" { + authenticate; + exceptions { + ResourceError UNAUTHORIZED; + } +} + +//Get solution template details. Includes the roles and policies +//that will be automatically provisioned when the template +//is applied to a domain +resource Template GET "/template/{template}" { + SimpleName template; //name of the solution template + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zms/src/main/rdl/Template.tdl b/core/zms/src/main/rdl/Template.tdl new file mode 100644 index 00000000000..9fa343c0433 --- /dev/null +++ b/core/zms/src/main/rdl/Template.tdl @@ -0,0 +1,31 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Template API +include "Names.tdl"; +include "Role.tdl"; +include "Policy.tdl"; + +//Solution Template object defined on the server +type Template Struct { + Array roles; //list of roles in the template + Array policies; //list of policies defined in this template +} + +//List of template names that is the base struct for +//server and domain templates +type TemplateList Struct { + Array templateNames; //list of template names +} + +//solution template(s) to be applied to a domain +type DomainTemplate TemplateList { +} + +//List of solution templates to be applied to a domain +type DomainTemplateList TemplateList { +} + +//List of solution templates available in the server +type ServerTemplateList TemplateList { +} diff --git a/core/zms/src/main/rdl/Tenancy.rdli b/core/zms/src/main/rdl/Tenancy.rdli new file mode 100644 index 00000000000..8934b455fa3 --- /dev/null +++ b/core/zms/src/main/rdl/Tenancy.rdli @@ -0,0 +1,101 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//The API to create/remove a tenancy for a client domain. Called as that tenant's admins. +include "Names.tdl"; + +//A representation of tenant. +type Tenancy Struct { + DomainName domain; //the domain that is to get a tenancy + ServiceName service; //the provider service on which the tenancy is to reside + Array resourceGroups (optional); //registered resource groups for this tenant +} + +type TenancyResourceGroup Struct { + DomainName domain; //the domain that is to get a tenancy + ServiceName service; //the provider service on which the tenancy is to reside + EntityName resourceGroup; //registered resource group for this tenant +} + +//Add a tenant for the specified service. +resource Tenancy PUT "/domain/{domain}/tenancy/{service}" { + DomainName domain; //name of the tenant domain + ServiceName service; //name of the provider service + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + Tenancy detail; //tenancy object + authorize ("update", "{domain}:tenancy"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Retrieve the specified tenant. +resource Tenancy GET "/domain/{domain}/tenancy/{service}" { + DomainName domain; //name of the tenant domain + ServiceName service; //name of the provider service + authenticate; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the tenant from the specified service. Upon successful completion of +//this delete request, the server will return NO_CONTENT status code without +//any data (no object will be returned). +resource Tenancy DELETE "/domain/{domain}/tenancy/{service}" { + DomainName domain; //name of the tenant domain + ServiceName service; //name of the provider service + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "{domain}:tenancy"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Add a new resource group for the tenant for the specified service. +resource TenancyResourceGroup PUT "/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}" { + DomainName domain; //name of the tenant domain + ServiceName service; //name of the provider service + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + TenancyResourceGroup detail; //tenancy resource group object + authorize ("update", "{domain}:tenancy.{service}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Delete the specified resource group for tenant from the specified service. +resource TenancyResourceGroup DELETE "/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}" { + DomainName domain; //name of the tenant domain + ServiceName service; //name of the provider service + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("update", "{domain}:tenancy.{service}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} diff --git a/core/zms/src/main/rdl/TenantRoles.rdli b/core/zms/src/main/rdl/TenantRoles.rdli new file mode 100644 index 00000000000..e23f7ce1f8f --- /dev/null +++ b/core/zms/src/main/rdl/TenantRoles.rdli @@ -0,0 +1,192 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//The API for a provider service to grant tenant access, providing the roles. +include "Names.tdl"; + +//A representation of tenant role action. +type TenantRoleAction Struct { + SimpleName role; //name of the role + String action; //action value for the generated policy assertion +} + +//A representation of tenant roles to be provisioned. +type TenantRoles Struct { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenant; //name of the tenant domain + Array roles; //the role/action pairs to provision +} + +//A representation of tenant roles for resource groups to be provisioned. +type TenantResourceGroupRoles Struct { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenant; //name of the tenant domain + Array roles; //the role/action pairs to provision + EntityName resourceGroup; //tenant resource group +} + +//A representation of provider roles to be provisioned. +type ProviderResourceGroupRoles Struct { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenant; //name of the tenant domain + Array roles; //the role/action pairs to provision + EntityName resourceGroup; //tenant resource group +} + +//Create/update set of roles for a given tenant. +resource TenantRoles PUT "/domain/{domain}/service/{service}/tenant/{tenantDomain}" { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenantDomain; //name of the tenant domain + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + TenantRoles detail; //list of roles to be added/updated for the tenant + authorize ("update", "{domain}:tenant.{tenantDomain}"); + expected OK, CREATED; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Retrieve the configured set of roles for the tenant. +resource TenantRoles GET "/domain/{domain}/service/{service}/tenant/{tenantDomain}" { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenantDomain; //name of the tenant domain + authenticate; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the configured set of roles for the tenant. Upon successful completion of +//this delete request, the server will return NO_CONTENT status code without any +//data (no object will be returned). +resource TenantRoles DELETE "/domain/{domain}/service/{service}/tenant/{tenantDomain}" { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenantDomain; //name of the tenant domain + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("delete", "{domain}:tenant.{tenantDomain}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Create/update set of roles for a given tenant and resource group +resource TenantResourceGroupRoles PUT "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}" { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenantDomain; //name of the tenant domain + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + TenantResourceGroupRoles detail; //list of roles to be added/updated for the tenant + authorize ("update", "{domain}:tenant.{tenantDomain}"); + expected OK, CREATED; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Retrieve the configured set of roles for the tenant and resource group +resource TenantResourceGroupRoles GET "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}" { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenantDomain; //name of the tenant domain + EntityName resourceGroup; //tenant resource group + authenticate; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the configured set of roles for the tenant and resource group +resource TenantResourceGroupRoles DELETE "/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}" { + DomainName domain; //name of the provider domain + SimpleName service; //name of the provider service + DomainName tenantDomain; //name of the tenant domain + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("update", "{domain}:tenant.{tenantDomain}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Create/update set of roles for a given provider and resource group +resource ProviderResourceGroupRoles PUT "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}" { + DomainName tenantDomain; //name of the tenant domain + DomainName provDomain; //name of the provider domain + SimpleName provService; //name of the provider service + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + ProviderResourceGroupRoles detail; //list of roles to be added/updated for the provider + authorize ("update", "{tenantDomain}:tenancy.{provDomain}.{provService}"); + expected OK, CREATED; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} + +//Retrieve the configured set of roles for the provider and resource group +resource ProviderResourceGroupRoles GET "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}" { + DomainName tenantDomain; //name of the tenant domain + DomainName provDomain; //name of the provider domain + SimpleName provService; //name of the provider service + EntityName resourceGroup; //tenant resource group + authenticate; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//Delete the configured set of roles for the provider and resource group +resource ProviderResourceGroupRoles DELETE "/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}" { + DomainName tenantDomain; //name of the tenant domain + DomainName provDomain; //name of the provider domain + SimpleName provService; //name of the provider service + EntityName resourceGroup; //tenant resource group + String auditRef (header="Y-Audit-Ref"); //Audit param required(not empty) if domain auditEnabled is true. + authorize ("update", "{tenantDomain}:tenancy.{provDomain}.{provService}"); + expected NO_CONTENT; + exceptions { + ResourceError NOT_FOUND; + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError CONFLICT; + } +} diff --git a/core/zms/src/main/rdl/Token.rdli b/core/zms/src/main/rdl/Token.rdli new file mode 100644 index 00000000000..bfcaaedd5af --- /dev/null +++ b/core/zms/src/main/rdl/Token.rdli @@ -0,0 +1,52 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +//A user token generated based on user's credentials +type UserToken Struct { + SignedToken token; //Signed user token identifying a specific authenticated user +} + +//Return a user/principal token for the specified authenticated user. Typical +//authenticated users with their native credentials are not allowed to update +//their domain data. They must first obtain a UserToken and then use that +//token for authentication and authorization of their update requests. +resource UserToken GET "/user/{userName}/token?services={serviceNames}" { + SimpleName userName; //name of the user + String serviceNames (optional); //comma separated list of on-behalf-of service names + authenticate; + exceptions { + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +//CORS (Cross-Origin Resource Sharing) support to allow Provider Services to obtain +//AuthorizedService Tokens on behalf of Tenant administrators +resource UserToken OPTIONS "/user/{userName}/token?services={serviceNames}" { + SimpleName userName; //name of the user + String serviceNames (optional); //comma separated list of on-behalf-of service names + exceptions { + ResourceError BAD_REQUEST; + } +} + +//A service principal object identifying a given service. +type ServicePrincipal Struct { + DomainName domain; //name of the domain + EntityName service; //name of the service + SignedToken token; //service's signed token +} + +//Return a ServicePrincipal object if the serviceToken is valid. This request +//provides a simple operation that an external application can execute to +//validate a service token. +resource ServicePrincipal GET "/principal" { + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zms/src/main/rdl/ZMS.rdl b/core/zms/src/main/rdl/ZMS.rdl new file mode 100644 index 00000000000..816097f8213 --- /dev/null +++ b/core/zms/src/main/rdl/ZMS.rdl @@ -0,0 +1,23 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// +// The Authorization Management Service (ZMS) Classes +// + +name ZMS; +version 1; +namespace com.yahoo.athenz.zms; + +include "Domain.rdli"; +include "DomainDataCheck.rdli"; +include "Entity.rdli"; +include "Role.rdli"; +include "Policy.rdli"; +include "ServiceIdentity.rdli"; +include "Tenancy.rdli"; +include "TenantRoles.rdli"; +include "Access.rdli"; +include "SignedDomains.rdli"; +include "Token.rdli"; +include "Template.rdli"; diff --git a/core/zms/src/test/java/com/yahoo/athenz/provider/ProviderSchemaTest.java b/core/zms/src/test/java/com/yahoo/athenz/provider/ProviderSchemaTest.java new file mode 100644 index 00000000000..c5ebbabb2c6 --- /dev/null +++ b/core/zms/src/test/java/com/yahoo/athenz/provider/ProviderSchemaTest.java @@ -0,0 +1,155 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.provider; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.assertTrue; + +import java.util.Arrays; +import java.util.List; + +import org.testng.annotations.Test; + +import com.yahoo.rdl.Schema; +import com.yahoo.rdl.Validator; +import com.yahoo.rdl.Validator.Result; + +public class ProviderSchemaTest { + + @Test + public void test() { + Schema schema = ProviderSchema.instance(); + assertNotNull(schema); + } + + @Test + public void testTenants() { + + Schema schema = ProviderSchema.instance(); + Validator validator = new Validator(schema); + + Tenant t = new Tenant().setService("test-service").setName("test.domain").setState(TenantState.ACTIVE); + Result result = validator.validate(t, "Tenant"); + assertTrue(result.valid); + + t = new Tenant().setService("test_service").setName("test.domain").setState(TenantState.ACTIVE); + result = validator.validate(t, "Tenant"); + assertTrue(result.valid); + + t = new Tenant().setService("test@service").setName("test.domain").setState(TenantState.ACTIVE); + result = validator.validate(t, "Tenant"); + assertFalse(result.valid); + + } + + @Test + public void testTenantsMethods() { + + Schema schema = ProviderSchema.instance(); + Validator validator = new Validator(schema); + + List roles = Arrays.asList("test-role"); + List rg = Arrays.asList("test-resource-group"); + + Tenant t = new Tenant().setService("test-service").setName("test.domain").setState(TenantState.ACTIVE) + .setRoles(roles).setResourceGroups(rg); + Result result = validator.validate(t, "Tenant"); + assertTrue(result.valid); + + assertEquals(t.getService(), "test-service"); + assertEquals(t.getName(), "test.domain"); + assertEquals(t.getState(), TenantState.ACTIVE); + assertEquals(t.getRoles(), roles); + assertEquals(t.getResourceGroups(), rg); + assertEquals(t.getState(), TenantState.fromString("ACTIVE")); + + Tenant t2 = new Tenant().setService("test-service").setName("test.domain").setState(TenantState.ACTIVE) + .setRoles(roles).setResourceGroups(rg); + assertTrue(t.equals(t)); + + t.setResourceGroups(null); + assertFalse(t.equals(t2)); + t.setRoles(null); + assertFalse(t.equals(t2)); + t.setState(null); + assertFalse(t.equals(t2)); + t.setName(null); + assertFalse(t.equals(t2)); + t.setService(null); + assertFalse(t.equals(t2)); + + assertFalse(t.equals(new String())); + } + + @Test(expectedExceptions = { java.lang.IllegalArgumentException.class }) + public void testTenantStateException() { + TenantState.fromString("INVALID-STATE"); + } + + @Test + public void testTenantResourceGroup() { + + Schema schema = ProviderSchema.instance(); + Validator validator = new Validator(schema); + + TenantResourceGroup trg = new TenantResourceGroup().setService("test-service").setName("test.domain") + .setResourceGroup("test-group"); + Result result = validator.validate(trg, "TenantResourceGroup"); + assertTrue(result.valid); + + trg = new TenantResourceGroup().setService("test@service").setName("test.domain") + .setResourceGroup("test-group"); + result = validator.validate(trg, "TenantResourceGroup"); + assertFalse(result.valid); + + } + + @Test + public void testTenantResourceGroupMethods() { + Schema schema = ProviderSchema.instance(); + Validator validator = new Validator(schema); + + List roles = Arrays.asList("test-role"); + + TenantResourceGroup trg = new TenantResourceGroup().setService("test-service").setName("test.domain") + .setResourceGroup("test-group").setRoles(roles); + + Result result = validator.validate(trg, "TenantResourceGroup"); + assertTrue(result.valid); + + assertEquals(trg.getService(), "test-service"); + assertEquals(trg.getName(), "test.domain"); + assertEquals(trg.getResourceGroup(), "test-group"); + assertEquals(trg.getRoles(), roles); + + TenantResourceGroup trg2 = new TenantResourceGroup().setService("test-service").setName("test.domain") + .setResourceGroup("test-group").setRoles(roles); + + assertTrue(trg.equals(trg)); + trg.setRoles(null); + assertFalse(trg.equals(trg2)); + trg.setResourceGroup(null); + assertFalse(trg.equals(trg2)); + trg.setName(null); + assertFalse(trg.equals(trg2)); + trg.setService(null); + assertFalse(trg.equals(trg2)); + assertFalse(trg.equals(new String())); + + } +} diff --git a/core/zms/src/test/java/com/yahoo/athenz/zms/ZMSCoreTest.java b/core/zms/src/test/java/com/yahoo/athenz/zms/ZMSCoreTest.java new file mode 100644 index 00000000000..6f1424a1214 --- /dev/null +++ b/core/zms/src/test/java/com/yahoo/athenz/zms/ZMSCoreTest.java @@ -0,0 +1,1417 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zms; + +import com.yahoo.rdl.Schema; +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.Timestamp; +import com.yahoo.rdl.UUID; +import com.yahoo.rdl.Validator; +import com.yahoo.rdl.Validator.Result; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; +import java.util.List; +import java.util.Arrays; + +public class ZMSCoreTest { + + @Test + public void test() { + Schema schema = ZMSSchema.instance(); + assertNotNull(schema); + } + + @Test + public void testRoles() { + + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List members = Arrays.asList("user:boynton"); + Role r = new Role().setName("sys.auth:role.admin").setMembers(members); + Result result = validator.validate(r, "Role"); + assertTrue(result.valid); + + members = Arrays.asList("user.boynton"); // new + r = new Role().setName("sys.auth:role.admin").setMembers(members); + result = validator.validate(r, "Role"); + assertTrue(result.valid); + + members = Arrays.asList("someuser@somecompany.com"); // not a valid principal + r = new Role().setName("sys.auth:role.admin").setMembers(members); + result = validator.validate(r, "Role"); + assertFalse(result.valid); + } + + @Test + public void testRolesMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + // RoleAuditlog test + RoleAuditLog ral = new RoleAuditLog().setMember("user.test").setAdmin("user.admin") + .setCreated(Timestamp.fromMillis(123456789123L)).setAction("add").setAuditRef("zmstest"); + Result result = validator.validate(ral, "RoleAuditLog"); + assertTrue(result.valid); + + assertEquals(ral.getMember(), "user.test"); + assertEquals(ral.getAdmin(), "user.admin"); + assertEquals(ral.getCreated(), Timestamp.fromMillis(123456789123L)); + assertEquals(ral.getAction(), "add"); + assertEquals(ral.getAuditRef(), "zmstest"); + + RoleAuditLog ral2 = new RoleAuditLog().setMember("user.test").setAdmin("user.admin") + .setCreated(Timestamp.fromMillis(123456789123L)).setAction("add"); + assertTrue(ral.equals(ral)); + + ral2.setAuditRef(null); + assertFalse(ral2.equals(ral)); + ral2.setAction(null); + assertFalse(ral2.equals(ral)); + ral2.setCreated(null); + assertFalse(ral2.equals(ral)); + ral2.setAdmin(null); + assertFalse(ral2.equals(ral)); + ral2.setMember(null); + assertFalse(ral2.equals(ral)); + assertFalse(ral2.equals(new String())); + + List rall = Arrays.asList(ral); + + // Role test + List members = Arrays.asList("user:boynton"); + Role r = new Role().setName("sys.auth:role.admin").setMembers(members) + .setModified(Timestamp.fromMillis(123456789123L)).setTrust("domain.admin").setAuditLog(rall); + result = validator.validate(r, "Role"); + assertTrue(result.valid); + + assertEquals(r.getName(), "sys.auth:role.admin"); + assertEquals(r.getModified(), Timestamp.fromMillis(123456789123L)); + assertEquals(r.getMembers(), members); + assertEquals(r.getTrust(), "domain.admin"); + assertEquals(r.getAuditLog(), rall); + + Role r2 = new Role().setName("sys.auth:role.admin").setMembers(members) + .setModified(Timestamp.fromMillis(123456789123L)).setTrust("domain.admin"); + assertTrue(r.equals(r)); + + r2.setAuditLog(null); + assertFalse(r2.equals(r)); + r2.setTrust(null); + assertFalse(r2.equals(r)); + r2.setMembers(null); + assertFalse(r2.equals(r)); + r2.setModified(null); + assertFalse(r2.equals(r)); + r2.setName(null); + assertFalse(r2.equals(r)); + assertFalse(r.equals(new String())); + + List rl = Arrays.asList(r); + + // Roles test + Roles rs = new Roles().setList(rl); + result = validator.validate(rs, "Roles"); + assertTrue(result.valid); + + assertEquals(rs.getList(), rl); + + assertTrue(rs.equals(rs)); + assertFalse(rs.equals(new Roles())); + assertFalse(rs.equals(new String())); + + } + + @Test + public void testRoleListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List names = Arrays.asList("test.role"); + + RoleList rl = new RoleList().setNames(names).setNext("next"); + + Result result = validator.validate(rl, "RoleList"); + assertTrue(result.valid); + + assertEquals(rl.getNames(), names); + assertEquals(rl.getNext(), "next"); + + RoleList rl2 = new RoleList().setNames(names); + + assertTrue(rl.equals(rl)); + + rl2.setNext(null); + assertFalse(rl2.equals(rl)); + rl2.setNames(null); + assertFalse(rl2.equals(rl)); + assertFalse(rl.equals(new String())); + } + + @Test + public void testSignedTokens() { + String[] signedTokens = { "v=R1;d=domain;s=test;i=127.0.0.1;h=someserver1.somecompany.com;r=role1,role2;s=signature", + "v=R1;d=domai_-.test;s=test---test;i=2001:db8:85a3:8d3:1319:8a2e:370:7348;h=hostname;r=role1,role2s=signature" }; + + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + System.out.println("Testing valid SignedTokens..."); + for (String s : signedTokens) { + System.out.println(s); + Result result = validator.validate(s, "SignedToken"); + assertTrue(result.valid); + } + } + + @Test + public void testYRN() { + String[] goodYRNs = { "domain:role.test1_", "domain:role._test1_", "domain:role._-test1_", "domain:role._-----", + "domain:role._____", "3com:role.3role_-", "3com:entity", "_domain:3entity_", "domain:entity", + "my.domain:entity", "my.domain:entity.path", "yrn:::domain:entity", "yrn:::my.domain:my.entity", + "yrn:service::domain:entity", "yrn:my.service::domain:entity", "yrn:my.service::my.domain:my.entity", + "yrn:service:location:domain:entity", "yrn:some.service:some.location:my.domain:my.entity" }; + + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + System.out.println("Testing valid YRNs..."); + for (String s : goodYRNs) { + System.out.println(s); + Result result = validator.validate(s, "YRN"); + assertTrue(result.valid); + } + + String[] badYRNs = { "domain:role.-----", "-domain:role.role1", "Non_ascii:��", "cannot-start-with:-dash", + "cannot-use:Punctuation_except_underbar!", "yrn::location_only", "yrn:service:location_only", + "non_yrn_prefix:service:location:domain:entity", "missing_yrn_prefix_service:location:domain:entity" }; + + System.out.println("Testing bad YRNs..."); + for (String s : badYRNs) { + System.out.println(s); + Result result = validator.validate(s, "YRN"); + assertFalse(result.valid); + } + } + + @Test + public void testSignedDomainsMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + Role r = new Role().setName("test.role"); + List rl = Arrays.asList(r); + + // assertion test + Assertion a = new Assertion().setRole("test.role.*").setResource("test.resource.*").setAction("test-action") + .setEffect(AssertionEffect.ALLOW).setId(0L); + Result result = validator.validate(a, "Assertion"); + assertTrue(result.valid); + + assertEquals(a.getRole(), "test.role.*"); + assertEquals(a.getResource(), "test.resource.*"); + assertEquals(a.getAction(), "test-action"); + assertEquals(a.getEffect(), AssertionEffect.fromString("ALLOW")); + assertEquals((long) a.getId(), 0L); + + Assertion a2 = new Assertion().setRole("test.role.*").setResource("test.resource.*").setAction("test-action") + .setEffect(AssertionEffect.ALLOW); + assertTrue(a.equals(a)); + + a2.setId(null); + assertFalse(a2.equals(a)); + a2.setEffect(null); + assertFalse(a2.equals(a)); + a2.setAction(null); + assertFalse(a2.equals(a)); + a2.setResource(null); + assertFalse(a2.equals(a)); + a2.setRole(null); + assertFalse(a2.equals(a)); + assertFalse(a.equals(new String())); + + List al = Arrays.asList(a); + + // Policy test + Policy p = new Policy().setName("test-policy").setModified(Timestamp.fromMillis(123456789123L)) + .setAssertions(al); + result = validator.validate(p, "Policy"); + assertTrue(result.valid); + + assertEquals(p.getName(), "test-policy"); + assertEquals(p.getModified(), Timestamp.fromMillis(123456789123L)); + assertEquals(p.getAssertions(), al); + + Policy p2 = new Policy().setName("test-policy").setModified(Timestamp.fromMillis(123456789123L)); + assertTrue(p.equals(p)); + + p2.setAssertions(null); + assertFalse(p2.equals(p)); + p2.setModified(null); + assertFalse(p2.equals(p)); + p2.setName(null); + assertFalse(p2.equals(p)); + assertFalse(p.equals(new String())); + + // PublicKeyEntry test + PublicKeyEntry pke = new PublicKeyEntry().setId("v1").setKey("pubkey===="); + result = validator.validate(pke, "PublicKeyEntry"); + assertTrue(result.valid); + + assertEquals(pke.getId(), "v1"); + assertEquals(pke.getKey(), "pubkey===="); + + PublicKeyEntry pke2 = new PublicKeyEntry().setKey("pubkey===="); + assertTrue(pke.equals(pke)); + + pke2.setId(null); + assertFalse(pke2.equals(pke)); + pke2.setKey(null); + assertFalse(pke2.equals(pke)); + assertFalse(pke.equals(new String())); + + // Entity test + Entity e = new Entity().setName("test.entity").setValue(new Struct().with("key", "test")); + result = validator.validate(e, "Entity"); + + assertEquals(e.getName(), "test.entity"); + assertEquals(e.getValue(), new Struct().with("key", (Object) "test")); + + Entity e2 = new Entity().setName("test.entity"); + assertTrue(e.equals(e)); + + e2.setValue(null); + assertFalse(e2.equals(e)); + e2.setName(null); + assertFalse(e2.equals(e)); + assertFalse(e.equals(new String())); + + List pl = Arrays.asList(p); + // DomainPolicies test + DomainPolicies dps = new DomainPolicies().setDomain("dps.domain").setPolicies(pl); + result = validator.validate(dps, "DomainPolicies"); + assertTrue(result.valid); + + assertEquals(dps.getDomain(), "dps.domain"); + assertEquals(dps.getPolicies(), pl); + + DomainPolicies dps2 = new DomainPolicies().setDomain("dps.domain"); + assertTrue(dps.equals(dps)); + + dps2.setPolicies(null); + assertFalse(dps2.equals(dps)); + dps2.setDomain(null); + assertFalse(dps2.equals(dps)); + assertFalse(dps.equals(new String())); + + // SignedPolicies test + SignedPolicies sp = new SignedPolicies().setContents(dps).setSignature("zmssignature").setKeyId("v1"); + result = validator.validate(sp, "SignedPolicies"); + assertTrue(result.valid); + + assertEquals(sp.getContents(), dps); + assertEquals(sp.getSignature(), "zmssignature"); + assertEquals(sp.getKeyId(), "v1"); + + SignedPolicies sp2 = new SignedPolicies().setContents(dps).setSignature("zmssignature"); + assertTrue(sp.equals(sp)); + + sp2.setKeyId(null); + assertFalse(sp2.equals(sp)); + sp2.setSignature(null); + assertFalse(sp2.equals(sp)); + sp2.setContents(null); + assertFalse(sp2.equals(sp)); + assertFalse(sp.equals(new String())); + + List pkel = Arrays.asList(pke); + List hosts = Arrays.asList("test.host"); + // ServiceIdentity test + ServiceIdentity si = new ServiceIdentity().setName("test.service").setPublicKeys(pkel) + .setProviderEndpoint("http://test.endpoint").setModified(Timestamp.fromMillis(123456789123L)) + .setExecutable("exec/path").setHosts(hosts).setUser("user.test").setGroup("test.group"); + result = validator.validate(si, "ServiceIdentity"); + assertTrue(result.valid); + + assertEquals(si.getName(), "test.service"); + assertEquals(si.getPublicKeys(), pkel); + assertEquals(si.getProviderEndpoint(), "http://test.endpoint"); + assertEquals(si.getModified(), Timestamp.fromMillis(123456789123L)); + assertEquals(si.getExecutable(), "exec/path"); + assertEquals(si.getHosts(), hosts); + assertEquals(si.getUser(), "user.test"); + assertEquals(si.getGroup(), "test.group"); + + ServiceIdentity si2 = new ServiceIdentity().setName("test.service").setPublicKeys(pkel) + .setProviderEndpoint("http://test.endpoint").setModified(Timestamp.fromMillis(123456789123L)) + .setExecutable("exec/path").setHosts(hosts).setUser("user.test"); + assertTrue(si.equals(si)); + + si2.setGroup(null); + assertFalse(si2.equals(si)); + si2.setUser(null); + assertFalse(si2.equals(si)); + si2.setHosts(null); + assertFalse(si2.equals(si)); + si2.setExecutable(null); + assertFalse(si2.equals(si)); + si2.setModified(null); + assertFalse(si2.equals(si)); + si2.setProviderEndpoint(null); + assertFalse(si2.equals(si)); + si2.setPublicKeys(null); + assertFalse(si2.equals(si)); + si2.setName(null); + assertFalse(si2.equals(si)); + assertFalse(si.equals(new String())); + + List sil = Arrays.asList(si); + List el = Arrays.asList(e); + + // ServiceIdentities test + ServiceIdentities sis = new ServiceIdentities().setList(sil); + result = validator.validate(sis, "ServiceIdentities"); + assertTrue(result.valid); + + assertEquals(sis.getList(), sil); + + assertTrue(sis.equals(sis)); + assertFalse(sis.equals(new ServiceIdentities())); + assertFalse(sis.equals(new String())); + + // DomainData test + DomainData dd = new DomainData().setName("test.domain").setAccount("user.test").setYpmId(1).setRoles(rl) + .setPolicies(sp).setServices(sil).setEntities(el).setModified(Timestamp.fromMillis(123456789123L)); + result = validator.validate(dd, "DomainData"); + assertTrue(result.valid); + + assertEquals(dd.getName(), "test.domain"); + assertEquals(dd.getAccount(), "user.test"); + assertEquals((int) dd.getYpmId(), 1); + assertEquals(dd.getRoles(), rl); + assertEquals(dd.getPolicies(), sp); + assertEquals(dd.getServices(), sil); + assertEquals(dd.getEntities(), el); + assertEquals(dd.getModified(), Timestamp.fromMillis(123456789123L)); + + DomainData dd2 = new DomainData().setName("test.domain").setAccount("user.test").setYpmId(1).setRoles(rl) + .setPolicies(sp).setServices(sil).setEntities(el); + assertTrue(dd.equals(dd)); + + dd2.setModified(null); + assertFalse(dd2.equals(dd)); + dd2.setEntities(null); + assertFalse(dd2.equals(dd)); + dd2.setServices(null); + assertFalse(dd2.equals(dd)); + dd2.setPolicies(null); + assertFalse(dd2.equals(dd)); + dd2.setRoles(null); + assertFalse(dd2.equals(dd)); + dd2.setYpmId(null); + assertFalse(dd2.equals(dd)); + dd2.setAccount(null); + assertFalse(dd2.equals(dd)); + dd2.setName(null); + assertFalse(dd2.equals(dd)); + assertFalse(dd.equals(new String())); + + // SignedDomain test + SignedDomain sd = new SignedDomain().setDomain(dd).setSignature("zmssignature").setKeyId("v1"); + result = validator.validate(sd, "SignedDomain"); + assertTrue(result.valid); + + assertEquals(sd.getDomain(), dd); + assertEquals(sd.getSignature(), "zmssignature"); + assertEquals(sd.getKeyId(), "v1"); + + SignedDomain sd2 = new SignedDomain().setDomain(dd).setSignature("zmssignature"); + assertTrue(sd.equals(sd)); + + sd2.setKeyId(null); + assertFalse(sd2.equals(sd)); + sd2.setSignature(null); + assertFalse(sd2.equals(sd)); + sd2.setDomain(null); + assertFalse(sd2.equals(sd)); + assertFalse(sd.equals(new String())); + + List sdl = Arrays.asList(sd); + // SignedDomains test + SignedDomains sds = new SignedDomains().setDomains(sdl); + result = validator.validate(sds, "SignedDomains"); + assertTrue(result.valid); + + assertEquals(sds.getDomains(), sdl); + + assertTrue(sds.equals(sds)); + assertFalse(sds.equals(new SignedDomains())); + assertFalse(sds.equals(new String())); + + } + + @Test + public void testAccess() { + Access a = new Access().setGranted(true); + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + Result result = validator.validate(a, "Access"); + assertTrue(result.valid); + + Access a2 = new Access().setGranted(false); + assertEquals(a.getGranted(), true); + + assertTrue(a.equals(a)); + + assertFalse(a.equals(a2)); + assertFalse(a.equals(new String())); + } + + @Test(expectedExceptions = { java.lang.IllegalArgumentException.class }) + public void testAssertionEffectExcept() { + AssertionEffect.fromString("INVALID EFFECT"); + } + + @Test + public void testDomainDataCheckMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List dlrl = Arrays.asList("test.role"); + + // DanglingPolicy test + DanglingPolicy dlp = new DanglingPolicy().setPolicyName("test.policy").setRoleName("test.role"); + Result result = validator.validate(dlp, "DanglingPolicy"); + assertTrue(result.valid); + + assertEquals(dlp.getPolicyName(), "test.policy"); + assertEquals(dlp.getRoleName(), "test.role"); + + DanglingPolicy dlp2 = new DanglingPolicy().setPolicyName("test.policy"); + assertTrue(dlp.equals(dlp)); + + dlp2.setRoleName(null); + assertFalse(dlp2.equals(dlp)); + dlp2.setPolicyName(null); + assertFalse(dlp2.equals(dlp)); + + List dlpl = Arrays.asList(dlp); + List pwt = Arrays.asList("provider.without.trust"); + List twar = Arrays.asList("tenants.without.assume.role"); + + DomainDataCheck ddc = new DomainDataCheck().setDanglingRoles(dlrl).setDanglingPolicies(dlpl).setPolicyCount(10) + .setAssertionCount(10).setRoleWildCardCount(10).setProvidersWithoutTrust(pwt) + .setTenantsWithoutAssumeRole(twar); + result = validator.validate(ddc, "DomainDataCheck"); + assertTrue(result.valid); + + assertEquals(ddc.getDanglingRoles(), dlrl); + assertEquals(ddc.getDanglingPolicies(), dlpl); + assertEquals(ddc.getPolicyCount(), 10); + assertEquals(ddc.getProvidersWithoutTrust(), pwt); + assertEquals(ddc.getTenantsWithoutAssumeRole(), twar); + assertEquals(ddc.getAssertionCount(), 10); + assertEquals(ddc.getRoleWildCardCount(), 10); + + DomainDataCheck ddc2 = new DomainDataCheck().setDanglingRoles(dlrl).setDanglingPolicies(dlpl).setPolicyCount(10) + .setAssertionCount(10).setRoleWildCardCount(10).setProvidersWithoutTrust(pwt); + assertTrue(ddc.equals(ddc)); + + ddc2.setTenantsWithoutAssumeRole(null); + assertFalse(ddc2.equals(ddc)); + ddc2.setProvidersWithoutTrust(null); + assertFalse(ddc2.equals(ddc)); + ddc2.setRoleWildCardCount(11); + assertFalse(ddc2.equals(ddc)); + ddc2.setAssertionCount(11); + assertFalse(ddc2.equals(ddc)); + ddc2.setPolicyCount(11); + assertFalse(ddc2.equals(ddc)); + ddc2.setDanglingPolicies(null); + assertFalse(ddc2.equals(ddc)); + ddc2.setDanglingRoles(null); + assertFalse(ddc2.equals(ddc)); + assertFalse(ddc2.equals(null)); + + } + + @Test + public void testDefaultAdmins() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List admins = Arrays.asList("user.admin"); + + DefaultAdmins da = new DefaultAdmins().setAdmins(admins); + Result result = validator.validate(da, "DefaultAdmins"); + assertTrue(result.valid); + + assertEquals(da.getAdmins(), admins); + + DefaultAdmins da2 = new DefaultAdmins().setAdmins(Arrays.asList("user.admin2")); + assertTrue(da.equals(da)); + + da2.setAdmins(null); + assertFalse(da2.equals(da)); + assertFalse(da2.equals(null)); + } + + @Test + public void testDomainMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + Domain d = new Domain().init(); + d.setName("test.domain").setModified(Timestamp.fromMillis(123456789123L)).setId(UUID.fromString("test-id")) + .setDescription("test desc").setOrg("test-org").setEnabled(true).setAuditEnabled(true) + .setAccount("user.test").setYpmId(1); + Result result = validator.validate(d, "Domain"); + assertTrue(result.valid); + + assertEquals(d.getName(), "test.domain"); + assertEquals(d.getModified(), Timestamp.fromMillis(123456789123L)); + assertEquals(d.getId(), UUID.fromString("test-id")); + assertEquals(d.getDescription(), "test desc"); + assertEquals(d.getOrg(), "test-org"); + assertTrue(d.getEnabled()); + assertTrue(d.getAuditEnabled()); + assertEquals(d.getAccount(), "user.test"); + assertEquals((int) d.getYpmId(), 1); + + Domain d2 = new Domain().setName("test.domain").setModified(Timestamp.fromMillis(123456789123L)) + .setId(UUID.fromString("test-id")).setDescription("test desc").setOrg("test-org").setEnabled(true) + .setAuditEnabled(true).setAccount("user.test"); + + assertTrue(d.equals(d)); + + d2.setYpmId(null); + assertFalse(d2.equals(d)); + d2.setAccount(null); + assertFalse(d2.equals(d)); + d2.setAuditEnabled(null); + assertFalse(d2.equals(d)); + d2.setEnabled(null); + assertFalse(d2.equals(d)); + d2.setOrg(null); + assertFalse(d2.equals(d)); + d2.setDescription(null); + assertFalse(d2.equals(d)); + d2.setId(null); + assertFalse(d2.equals(d)); + d2.setModified(null); + assertFalse(d2.equals(d)); + d2.setName(null); + assertFalse(d2.equals(d)); + assertFalse(d2.equals(null)); + assertFalse(d.equals(new String())); + + } + + @Test + public void testDomainList() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List domainnames = Arrays.asList("test.domain"); + + DomainList dl = new DomainList().setNames(domainnames).setNext("next"); + + Result result = validator.validate(dl, "DomainList"); + assertTrue(result.valid); + + assertEquals(dl.getNames(), domainnames); + assertEquals(dl.getNext(), "next"); + + DomainList dl2 = new DomainList().setNames(domainnames); + assertTrue(dl.equals(dl)); + + dl2.setNext(null); + assertFalse(dl2.equals(dl)); + dl2.setNames(null); + assertFalse(dl2.equals(dl)); + assertFalse(dl2.equals(null)); + assertFalse(dl.equals(new String())); + } + + @Test + public void testDomainMetaMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + DomainMeta dm = new DomainMeta().init(); + dm.setDescription("domain desc").setOrg("org:test").setEnabled(true).setAuditEnabled(false) + .setAccount("user.test").setYpmId(10); + + Result result = validator.validate(dm, "DomainMeta"); + assertTrue(result.valid); + + assertEquals(dm.getDescription(), "domain desc"); + assertEquals(dm.getOrg(), "org:test"); + assertTrue(dm.getEnabled()); + assertFalse(dm.getAuditEnabled()); + assertEquals(dm.getAccount(), "user.test"); + assertEquals((int) dm.getYpmId(), 10); + + DomainMeta dm2 = new DomainMeta().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test"); + assertTrue(dm.equals(dm)); + + dm2.setYpmId(null); + assertFalse(dm2.equals(dm)); + dm2.setAccount(null); + assertFalse(dm2.equals(dm)); + dm2.setAuditEnabled(null); + assertFalse(dm2.equals(dm)); + dm2.setEnabled(null); + assertFalse(dm2.equals(dm)); + dm2.setOrg(null); + assertFalse(dm2.equals(dm)); + dm2.setDescription(null); + assertFalse(dm2.equals(dm)); + assertFalse(dm2.equals(null)); + assertFalse(dm.equals(new String())); + + } + + @Test + public void testTopLevelDomainMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List admins = Arrays.asList("test.admin1"); + + // DomainTemplateList test + List templateNames = Arrays.asList("test"); + DomainTemplateList dtl = new DomainTemplateList().setTemplateNames(templateNames); + + Result result = validator.validate(dtl, "DomainTemplateList"); + assertTrue(result.valid); + + assertEquals(dtl.getTemplateNames(), templateNames); + assertTrue(dtl.equals(dtl)); + assertFalse(dtl.equals(new DomainTemplateList())); + + // TopLevelDomain test + TopLevelDomain tld = new TopLevelDomain().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test").setYpmId(10).setName("testdomain").setAdminUsers(admins) + .setTemplates(dtl); + + result = validator.validate(tld, "TopLevelDomain"); + assertTrue(result.valid); + + assertEquals(tld.getDescription(), "domain desc"); + assertEquals(tld.getOrg(), "org:test"); + assertTrue(tld.getEnabled()); + assertFalse(tld.getAuditEnabled()); + assertEquals(tld.getAccount(), "user.test"); + assertEquals((int) tld.getYpmId(), 10); + assertEquals(tld.getName(), "testdomain"); + assertEquals(tld.getAdminUsers(), admins); + assertNotNull(tld.getTemplates()); + + TopLevelDomain tld2 = new TopLevelDomain().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test").setYpmId(10).setName("testdomain") + .setAdminUsers(admins); + + assertTrue(tld.equals(tld)); + + tld2.setTemplates(null); + assertFalse(tld2.equals(tld)); + tld2.setAdminUsers(null); + assertFalse(tld2.equals(tld)); + tld2.setName(null); + assertFalse(tld2.equals(tld)); + tld2.setYpmId(null); + assertFalse(tld2.equals(tld)); + tld2.setAccount(null); + assertFalse(tld2.equals(tld)); + tld2.setAuditEnabled(null); + assertFalse(tld2.equals(tld)); + tld2.setEnabled(null); + assertFalse(tld2.equals(tld)); + tld2.setOrg(null); + assertFalse(tld2.equals(tld)); + tld2.setDescription(null); + assertFalse(tld2.equals(tld)); + assertFalse(tld2.equals(null)); + assertFalse(tld.equals(new String())); + } + + @Test + public void testSubDomainMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List admins = Arrays.asList("test.admin1"); + + SubDomain sd = new SubDomain().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test").setYpmId(10).setName("testdomain").setAdminUsers(admins) + .setTemplates(new DomainTemplateList().setTemplateNames(Arrays.asList("test.template"))) + .setParent("domain.parent"); + + Result result = validator.validate(sd, "SubDomain"); + assertTrue(result.valid); + + assertEquals(sd.getDescription(), "domain desc"); + assertEquals(sd.getOrg(), "org:test"); + assertTrue(sd.getEnabled()); + assertFalse(sd.getAuditEnabled()); + assertEquals(sd.getAccount(), "user.test"); + assertEquals((int) sd.getYpmId(), 10); + assertEquals(sd.getName(), "testdomain"); + assertEquals(sd.getAdminUsers(), admins); + assertNotNull(sd.getTemplates()); + assertEquals(sd.getParent(), "domain.parent"); + + SubDomain sd2 = new SubDomain().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test").setYpmId(10).setName("testdomain").setAdminUsers(admins) + .setTemplates(new DomainTemplateList().setTemplateNames(Arrays.asList("test.template"))) + .setParent("domain.parent2"); + + assertTrue(sd.equals(sd)); + + sd2.setParent(null); + assertFalse(sd2.equals(sd)); + sd2.setTemplates(null); + assertFalse(sd2.equals(sd)); + sd2.setAdminUsers(null); + assertFalse(sd2.equals(sd)); + sd2.setName(null); + assertFalse(sd2.equals(sd)); + sd2.setYpmId(null); + assertFalse(sd2.equals(sd)); + sd2.setAccount(null); + assertFalse(sd2.equals(sd)); + sd2.setAuditEnabled(null); + assertFalse(sd2.equals(sd)); + sd2.setEnabled(null); + assertFalse(sd2.equals(sd)); + sd2.setOrg(null); + assertFalse(sd2.equals(sd)); + sd2.setDescription(null); + assertFalse(sd2.equals(sd)); + assertFalse(sd2.equals(null)); + } + + @Test + public void testUserDomainMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + UserDomain ud = new UserDomain().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test").setYpmId(10).setName("testuser") + .setTemplates(new DomainTemplateList().setTemplateNames(Arrays.asList("template"))); + + Result result = validator.validate(ud, "UserDomain"); + assertTrue(result.valid); + + assertEquals(ud.getDescription(), "domain desc"); + assertEquals(ud.getOrg(), "org:test"); + assertTrue(ud.getEnabled()); + assertFalse(ud.getAuditEnabled()); + assertEquals(ud.getAccount(), "user.test"); + assertEquals((int) ud.getYpmId(), 10); + assertEquals(ud.getName(), "testuser"); + assertNotNull(ud.getTemplates()); + + UserDomain ud2 = new UserDomain().setDescription("domain desc").setOrg("org:test").setEnabled(true) + .setAuditEnabled(false).setAccount("user.test").setYpmId(10).setName("testuser"); + + assertTrue(ud.equals(ud)); + + ud2.setTemplates(null); + assertFalse(ud2.equals(ud)); + ud2.setName(null); + assertFalse(ud2.equals(ud)); + ud2.setYpmId(null); + assertFalse(ud2.equals(ud)); + ud2.setAccount(null); + assertFalse(ud2.equals(ud)); + ud2.setAuditEnabled(null); + assertFalse(ud2.equals(ud)); + ud2.setEnabled(null); + assertFalse(ud2.equals(ud)); + ud2.setOrg(null); + assertFalse(ud2.equals(ud)); + ud2.setDescription(null); + assertFalse(ud2.equals(ud)); + assertFalse(ud2.equals(null)); + assertFalse(ud.equals(new String())); + } + + @Test + public void testDomainModifiedListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + // DomainModified test + DomainModified dm = new DomainModified().setName("test.domain").setModified(123456789123L); + + Result result = validator.validate(dm, "DomainModified"); + assertTrue(result.valid); + + assertEquals(dm.getName(), "test.domain"); + assertEquals(dm.getModified(), 123456789123L); + + DomainModified dm2 = new DomainModified().setName("test.domain"); + assertTrue(dm.equals(dm)); + + dm2.setModified(123456789124L); + assertFalse(dm2.equals(dm)); + dm2.setName(null); + assertFalse(dm2.equals(dm)); + assertFalse(dm2.equals(null)); + + // DomainModifiedList test + List dml = Arrays.asList(dm); + + DomainModifiedList dmlist = new DomainModifiedList().setNameModList(dml); + result = validator.validate(dmlist, "DomainModifiedList"); + assertTrue(result.valid); + + assertEquals(dmlist.getNameModList(), dml); + + assertTrue(dmlist.equals(dmlist)); + assertFalse(dmlist.equals(new DomainModifiedList())); + } + + @Test + public void testDomainTemplateMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List dl = Arrays.asList("user_provisioning"); + + DomainTemplate dt = new DomainTemplate().setTemplateNames(dl); + Result result = validator.validate(dt, "DomainTemplate"); + assertTrue(result.valid); + + assertEquals(dt.getTemplateNames(), dl); + + DomainTemplate dt2 = new DomainTemplate(); + assertTrue(dt.equals(dt)); + assertFalse(dt.equals(dt2)); + assertFalse(dt.equals(null)); + assertFalse(dt.equals(new String())); + } + + @Test + public void testMembershipMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + Membership ms = new Membership().init(); + ms.setMemberName("test.member").setIsMember(false).setRoleName("test.role"); + + Result result = validator.validate(ms, "Membership"); + assertTrue(result.valid); + + assertEquals(ms.getMemberName(), "test.member"); + assertFalse(ms.getIsMember()); + assertEquals(ms.getRoleName(), "test.role"); + + Membership ms2 = new Membership().setMemberName("test.member").setIsMember(false); + assertTrue(ms.equals(ms)); + + ms2.setRoleName(null); + assertFalse(ms2.equals(ms)); + ms2.setIsMember(null); + assertFalse(ms2.equals(ms)); + ms2.setMemberName(null); + assertFalse(ms2.equals(ms)); + assertFalse(ms2.equals(null)); + assertFalse(ms.equals(new String())); + + } + + @Test + public void testDefaultAdminsMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List dal = Arrays.asList("user.admin1"); + + DefaultAdmins da = new DefaultAdmins().setAdmins(dal); + + Result result = validator.validate(da, "DefaultAdmins"); + assertTrue(result.valid); + + assertEquals(da.getAdmins(), dal); + + DefaultAdmins da2 = new DefaultAdmins(); + assertTrue(da.equals(da)); + assertFalse(da.equals(da2)); + assertFalse(da.equals(null)); + + } + + @Test + public void testPolicyListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List plist = Arrays.asList("test.policy"); + + PolicyList pl = new PolicyList().setNames(plist).setNext("next"); + + Result result = validator.validate(pl, "PolicyList"); + assertTrue(result.valid); + + assertEquals(pl.getNames(), plist); + assertEquals(pl.getNext(), "next"); + + PolicyList pl2 = new PolicyList().setNames(plist); + assertTrue(pl.equals(pl)); + + pl2.setNext(null); + assertFalse(pl2.equals(pl)); + pl2.setNames(null); + assertFalse(pl2.equals(pl)); + assertFalse(pl2.equals(null)); + + } + + @Test + public void testServiceIdentityListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List slist = Arrays.asList("test.service"); + + ServiceIdentityList sil = new ServiceIdentityList().setNames(slist).setNext("next"); + + Result result = validator.validate(sil, "ServiceIdentityList"); + assertTrue(result.valid); + + assertEquals(sil.getNames(), slist); + assertEquals(sil.getNext(), "next"); + + ServiceIdentityList sil2 = new ServiceIdentityList().setNames(slist); + assertTrue(sil.equals(sil)); + + sil2.setNext(null); + assertFalse(sil2.equals(sil)); + sil2.setNames(null); + assertFalse(sil2.equals(sil)); + assertFalse(sil2.equals(null)); + assertFalse(sil.equals(new String())); + + } + + @Test + public void testTemplateListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List tnames = Arrays.asList("testtemplate"); + + TemplateList tl = new TemplateList().setTemplateNames(tnames); + + Result result = validator.validate(tl, "TemplateList"); + assertTrue(result.valid); + + assertEquals(tl.getTemplateNames(), tnames); + + TemplateList tl2 = new TemplateList(); + assertTrue(tl.equals(tl)); + assertFalse(tl.equals(tl2)); + assertFalse(tl.equals(null)); + assertFalse(tl.equals(new String())); + + } + + @Test + public void testDomainTemplateListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List tnames = Arrays.asList("testtemplate"); + + DomainTemplate tl = new DomainTemplate().setTemplateNames(tnames); + + Result result = validator.validate(tl, "DomainTemplate"); + assertTrue(result.valid); + + assertEquals(tl.getTemplateNames(), tnames); + + DomainTemplate tl2 = new DomainTemplate(); + assertTrue(tl.equals(tl)); + assertFalse(tl.equals(tl2)); + assertFalse(tl.equals(new String())); + + } + + @Test + public void testServerTemplateListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List tnames = Arrays.asList("testtemplate"); + + ServerTemplateList tl = new ServerTemplateList().setTemplateNames(tnames); + + Result result = validator.validate(tl, "ServerTemplateList"); + assertTrue(result.valid); + + assertEquals(tl.getTemplateNames(), tnames); + + ServerTemplateList tl2 = new ServerTemplateList(); + assertTrue(tl.equals(tl)); + assertFalse(tl.equals(tl2)); + assertFalse(tl.equals(new String())); + + } + + @Test + public void testUserTokenMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + UserToken ut = new UserToken().setToken("testtoken"); + + Result result = validator.validate(ut, "UserToken"); + assertTrue(result.valid); + + assertEquals(ut.getToken(), "testtoken"); + + UserToken ut2 = new UserToken().setToken("test"); + assertTrue(ut.equals(ut)); + assertFalse(ut.equals(ut2)); + assertFalse(ut.equals(new String())); + } + + @Test + public void testTenantRolesMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + // TenantRoleAction test + TenantRoleAction tra = new TenantRoleAction().setRole("testrole").setAction("add"); + Result result = validator.validate(tra, "TenantRoleAction"); + assertTrue(result.valid); + + assertEquals(tra.getRole(), "testrole"); + assertEquals(tra.getAction(), "add"); + + TenantRoleAction tra2 = new TenantRoleAction().setRole("testrole"); + assertTrue(tra.equals(tra)); + + tra2.setAction(null); + assertFalse(tra2.equals(tra)); + tra2.setRole(null); + assertFalse(tra2.equals(tra)); + assertFalse(tra.equals(new String())); + + // TenantRoles test + List tral = Arrays.asList(tra); + TenantRoles tr = new TenantRoles().setDomain("test.provider.domain").setService("testservice") + .setTenant("test.tenant").setRoles(tral); + + result = validator.validate(tr, "TenantRoles"); + assertTrue(result.valid); + + assertEquals(tr.getDomain(), "test.provider.domain"); + assertEquals(tr.getService(), "testservice"); + assertEquals(tr.getTenant(), "test.tenant"); + assertEquals(tr.getRoles(), tral); + + TenantRoles tr2 = new TenantRoles().setDomain("test.provider.domain").setService("testservice") + .setTenant("test.tenant"); + assertTrue(tr.equals(tr)); + + tr2.setRoles(null); + assertFalse(tr2.equals(tr)); + tr2.setTenant(null); + assertFalse(tr2.equals(tr)); + tr2.setService(null); + assertFalse(tr2.equals(tr)); + tr2.setDomain(null); + assertFalse(tr2.equals(tr)); + assertFalse(tr2.equals(null)); + assertFalse(tr.equals(new String())); + + } + + @Test + public void testEntityListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List elist = Arrays.asList("test.entity"); + + EntityList el = new EntityList().setNames(elist); + + Result result = validator.validate(el, "EntityList"); + assertTrue(result.valid); + + assertEquals(el.getNames(), elist); + + EntityList el2 = new EntityList(); + assertTrue(el.equals(el)); + assertFalse(el.equals(el2)); + assertFalse(el.equals(new String())); + + } + + @Test + public void testPoliciesMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + Assertion a = new Assertion().setRole("test.role.*").setResource("test.resource.*").setAction("test-action") + .setEffect(AssertionEffect.ALLOW).setId(0L); + + List plist = Arrays.asList(new Policy().setName("test").setAssertions(Arrays.asList(a))); + + Policies ps = new Policies().setList(plist); + + Result result = validator.validate(ps, "Policies"); + assertTrue(result.valid); + + assertEquals(ps.getList(), plist); + + Policies ps2 = new Policies(); + assertTrue(ps.equals(ps)); + assertFalse(ps.equals(ps2)); + assertFalse(ps.equals(new String())); + + } + + @Test + public void testTenancyMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List rg = Arrays.asList("test-resource"); + + Tenancy t = new Tenancy().setDomain("test.domain").setService("test-service").setResourceGroups(rg); + + Result result = validator.validate(t, "Tenancy"); + assertTrue(result.valid); + + assertEquals(t.getDomain(), "test.domain"); + assertEquals(t.getService(), "test-service"); + assertEquals(t.getResourceGroups(), rg); + + Tenancy t2 = new Tenancy().setDomain("test.domain").setService("test-service"); + assertTrue(t.equals(t)); + + t2.setResourceGroups(null); + assertFalse(t2.equals(t)); + t2.setService(null); + assertFalse(t2.equals(t)); + t2.setDomain(null); + assertFalse(t2.equals(t)); + assertFalse(t2.equals(null)); + assertFalse(t.equals(new String())); + + } + + @Test + public void testTenancyResourceGroupMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + TenancyResourceGroup trg = new TenancyResourceGroup().setDomain("test.domain").setService("test-service") + .setResourceGroup("test.group"); + + Result result = validator.validate(trg, "TenancyResourceGroup"); + assertTrue(result.valid); + + assertEquals(trg.getDomain(), "test.domain"); + assertEquals(trg.getService(), "test-service"); + assertEquals(trg.getResourceGroup(), "test.group"); + + TenancyResourceGroup trg2 = new TenancyResourceGroup().setDomain("test.domain").setService("test-service"); + assertTrue(trg.equals(trg)); + + trg2.setResourceGroup(null); + assertFalse(trg2.equals(trg)); + trg2.setService(null); + assertFalse(trg2.equals(trg)); + trg2.setDomain(null); + assertFalse(trg2.equals(trg)); + assertFalse(trg2.equals(null)); + assertFalse(trg2.equals(new String())); + } + + @Test + public void testResourceAccessListMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + Assertion a = new Assertion().setRole("test.role.*").setResource("test.resource.*").setAction("test-action") + .setEffect(AssertionEffect.ALLOW).setId(0L); + + List al = Arrays.asList(a); + // ResourceAccess test + ResourceAccess ra = new ResourceAccess().setPrincipal("test.principal").setAssertions(al); + + Result result = validator.validate(ra, "ResourceAccess"); + assertTrue(result.valid); + + assertEquals(ra.getPrincipal(), "test.principal"); + assertEquals(ra.getAssertions(), al); + + ResourceAccess ra2 = new ResourceAccess().setPrincipal("test.principal"); + assertTrue(ra.equals(ra)); + + ra2.setAssertions(null); + assertFalse(ra2.equals(ra)); + ra2.setPrincipal(null); + assertFalse(ra2.equals(ra)); + assertFalse(ra.equals(new String())); + + // ResourceAccessList test + List ralist = Arrays.asList(ra); + ResourceAccessList ral = new ResourceAccessList().setResources(ralist); + result = validator.validate(ral, "ResourceAccessList"); + assertTrue(result.valid); + + assertEquals(ral.getResources(), ralist); + + assertTrue(ral.equals(ral)); + assertFalse(ral.equals(new ResourceAccessList())); + assertFalse(ral.equals(null)); + } + + @Test + public void testServicePrincipalMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + ServicePrincipal sp = new ServicePrincipal().setDomain("test.domain").setService("test-service") + .setToken("test-token"); + + Result result = validator.validate(sp, "ServicePrincipal"); + assertTrue(result.valid); + + assertEquals(sp.getDomain(), "test.domain"); + assertEquals(sp.getService(), "test-service"); + assertEquals(sp.getToken(), "test-token"); + + ServicePrincipal sp2 = new ServicePrincipal().setDomain("test.domain").setService("test-service"); + assertTrue(sp.equals(sp)); + + sp2.setToken(null); + assertFalse(sp2.equals(sp)); + sp2.setService(null); + assertFalse(sp2.equals(sp)); + sp2.setDomain(null); + assertFalse(sp2.equals(sp)); + assertFalse(sp2.equals(null)); + assertFalse(sp.equals(new String())); + + } + + @Test + public void testTemplateMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + List rl = Arrays.asList(new Role().setName("sys.auth:role.admin").setMembers(Arrays.asList("test"))); + List pl = Arrays + .asList(new Policy().setName("test-policy").setModified(Timestamp.fromMillis(123456789123L))); + Template t = new Template().setRoles(rl).setPolicies(pl); + + Result result = validator.validate(t, "Template"); + assertTrue(result.valid); + + assertEquals(t.getPolicies(), pl); + assertEquals(t.getRoles(), rl); + + Template t2 = new Template().setRoles(rl); + assertTrue(t.equals(t)); + + t2.setRoles(null); + assertFalse(t2.equals(t)); + t2.setPolicies(null); + assertFalse(t2.equals(t)); + assertFalse(t2.equals(null)); + assertFalse(t.equals(new String())); + + } + + @Test + public void testProviderResourceGroupRolesMethod() { + Schema schema = ZMSSchema.instance(); + Validator validator = new Validator(schema); + + TenantRoleAction tra = new TenantRoleAction().setRole("testrole").setAction("add"); + List tral = Arrays.asList(tra); + + ProviderResourceGroupRoles prgr = new ProviderResourceGroupRoles().setDomain("test.domain") + .setService("test-service").setTenant("test.tenant").setRoles(tral).setResourceGroup("test-group"); + + Result result = validator.validate(prgr, "ProviderResourceGroupRoles"); + assertTrue(result.valid); + + assertEquals(prgr.getDomain(), "test.domain"); + assertEquals(prgr.getService(), "test-service"); + assertEquals(prgr.getTenant(), "test.tenant"); + assertEquals(prgr.getRoles(), tral); + assertEquals(prgr.getResourceGroup(), "test-group"); + + ProviderResourceGroupRoles prgr2 = new ProviderResourceGroupRoles().setDomain("test.domain") + .setService("test-service").setTenant("test.tenant").setRoles(tral); + assertTrue(prgr.equals(prgr)); + + prgr2.setResourceGroup(null); + assertFalse(prgr2.equals(prgr)); + prgr2.setRoles(null); + assertFalse(prgr2.equals(prgr)); + prgr2.setTenant(null); + assertFalse(prgr2.equals(prgr)); + prgr2.setService(null); + assertFalse(prgr2.equals(prgr)); + prgr2.setDomain(null); + assertFalse(prgr2.equals(prgr)); + assertFalse(prgr2.equals(null)); + assertFalse(prgr.equals(new String())); + + // TenantResourceGroupRoles test + TenantResourceGroupRoles trgr = new TenantResourceGroupRoles().setDomain("test.domain") + .setService("test-service").setTenant("test.domain").setRoles(tral).setResourceGroup("test.tenant"); + result = validator.validate(trgr, "TenantResourceGroupRoles"); + assertTrue(result.valid); + + assertEquals(trgr.getDomain(), "test.domain"); + assertEquals(trgr.getService(), "test-service"); + assertEquals(trgr.getTenant(), "test.domain"); + assertEquals(trgr.getRoles(), tral); + assertEquals(trgr.getResourceGroup(), "test.tenant"); + + TenantResourceGroupRoles trgr2 = new TenantResourceGroupRoles().setDomain("test.domain") + .setService("test-service").setTenant("test.domain").setRoles(tral); + + assertTrue(trgr.equals(trgr)); + + trgr2.setResourceGroup(null); + assertFalse(trgr2.equals(trgr)); + trgr2.setRoles(null); + assertFalse(trgr2.equals(trgr)); + trgr2.setTenant(null); + assertFalse(trgr2.equals(trgr)); + trgr2.setService(null); + assertFalse(trgr2.equals(trgr)); + trgr2.setDomain(null); + assertFalse(trgr2.equals(trgr)); + assertFalse(trgr.equals(new String())); + } + +} diff --git a/core/zms/src/test/resources/zms_private.pem b/core/zms/src/test/resources/zms_private.pem new file mode 100644 index 00000000000..356e1edf8bd --- /dev/null +++ b/core/zms/src/test/resources/zms_private.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- diff --git a/core/zms/src/test/resources/zms_public.pem b/core/zms/src/test/resources/zms_public.pem new file mode 100644 index 00000000000..727c3c67f22 --- /dev/null +++ b/core/zms/src/test/resources/zms_public.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- diff --git a/core/zts/README.md b/core/zts/README.md new file mode 100644 index 00000000000..38e18bbd825 --- /dev/null +++ b/core/zts/README.md @@ -0,0 +1,12 @@ +ZTS Core Support +================ + +Contains the ZTS interface and support classes. + +The interface, schema, and support classes are generated from the ZTS RDL definitions herein. Clients and servers will use these classes to implement the interface. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/core/zts/pom.xml b/core/zts/pom.xml new file mode 100644 index 00000000000..15727fb2893 --- /dev/null +++ b/core/zts/pom.xml @@ -0,0 +1,67 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../pom.xml + + + zts_core + jar + zts_core + Core ZTS Interfaces + + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + com.fasterxml.jackson.core + jackson-databind + ${jackson.version} + + + + + + + org.codehaus.mojo + exec-maven-plugin + 1.1.1 + + + + exec + + generate-sources + + + + bash + + scripts/make_stubs.sh + + + + + + + diff --git a/core/zts/scripts/make_stubs.sh b/core/zts/scripts/make_stubs.sh new file mode 100755 index 00000000000..3e5c9ee25bf --- /dev/null +++ b/core/zts/scripts/make_stubs.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +# If any of the RDL files have been updated, then this script should be run +# rdl to generate the appropriate model classes. + +# Note this script is dependent on the rdl utility. +# go get github.com/ardielle/ardielle-tools/... +# + +command -v rdl >/dev/null 2>&1 || { + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "SOURCE WARNING"; + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "Please install rdl utility: go get github.com/ardielle/ardielle-tools/..."; + echo >&2 "Skipping source generation..."; + exit 0; +} + +RDL_ZTS_FILE=src/main/rdl/ZTS.rdl + +echo "Generating model classes..." +rdl -s generate -x getsetters=true -o src/main/java java-model $RDL_ZTS_FILE + +# Copyright 2016 Yahoo Inc. +# Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. \ No newline at end of file diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/AWSCertificateRequest.java b/core/zts/src/main/java/com/yahoo/athenz/zts/AWSCertificateRequest.java new file mode 100644 index 00000000000..91168231270 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/AWSCertificateRequest.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// AWSCertificateRequest - AWSCertificateRequest - a certificate signing +// request +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class AWSCertificateRequest { + public String csr; + + public AWSCertificateRequest setCsr(String csr) { + this.csr = csr; + return this; + } + public String getCsr() { + return csr; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != AWSCertificateRequest.class) { + return false; + } + AWSCertificateRequest a = (AWSCertificateRequest) another; + if (csr == null ? a.csr != null : !csr.equals(a.csr)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/AWSInstanceInformation.java b/core/zts/src/main/java/com/yahoo/athenz/zts/AWSInstanceInformation.java new file mode 100644 index 00000000000..59ac80580cb --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/AWSInstanceInformation.java @@ -0,0 +1,193 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// AWSInstanceInformation - AWSInstanceInformation - the information a booting +// EC2 instance must provide to ZTS to authenticate. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class AWSInstanceInformation { + public String document; + public String signature; + public String domain; + public String service; + public String csr; + public String name; + public String account; + @RdlOptional + public String cloud; + public String subnet; + public String access; + public String secret; + public String token; + public Timestamp expires; + public Timestamp modified; + public String flavor; + + public AWSInstanceInformation setDocument(String document) { + this.document = document; + return this; + } + public String getDocument() { + return document; + } + public AWSInstanceInformation setSignature(String signature) { + this.signature = signature; + return this; + } + public String getSignature() { + return signature; + } + public AWSInstanceInformation setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public AWSInstanceInformation setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public AWSInstanceInformation setCsr(String csr) { + this.csr = csr; + return this; + } + public String getCsr() { + return csr; + } + public AWSInstanceInformation setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public AWSInstanceInformation setAccount(String account) { + this.account = account; + return this; + } + public String getAccount() { + return account; + } + public AWSInstanceInformation setCloud(String cloud) { + this.cloud = cloud; + return this; + } + public String getCloud() { + return cloud; + } + public AWSInstanceInformation setSubnet(String subnet) { + this.subnet = subnet; + return this; + } + public String getSubnet() { + return subnet; + } + public AWSInstanceInformation setAccess(String access) { + this.access = access; + return this; + } + public String getAccess() { + return access; + } + public AWSInstanceInformation setSecret(String secret) { + this.secret = secret; + return this; + } + public String getSecret() { + return secret; + } + public AWSInstanceInformation setToken(String token) { + this.token = token; + return this; + } + public String getToken() { + return token; + } + public AWSInstanceInformation setExpires(Timestamp expires) { + this.expires = expires; + return this; + } + public Timestamp getExpires() { + return expires; + } + public AWSInstanceInformation setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public AWSInstanceInformation setFlavor(String flavor) { + this.flavor = flavor; + return this; + } + public String getFlavor() { + return flavor; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != AWSInstanceInformation.class) { + return false; + } + AWSInstanceInformation a = (AWSInstanceInformation) another; + if (document == null ? a.document != null : !document.equals(a.document)) { + return false; + } + if (signature == null ? a.signature != null : !signature.equals(a.signature)) { + return false; + } + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (csr == null ? a.csr != null : !csr.equals(a.csr)) { + return false; + } + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (account == null ? a.account != null : !account.equals(a.account)) { + return false; + } + if (cloud == null ? a.cloud != null : !cloud.equals(a.cloud)) { + return false; + } + if (subnet == null ? a.subnet != null : !subnet.equals(a.subnet)) { + return false; + } + if (access == null ? a.access != null : !access.equals(a.access)) { + return false; + } + if (secret == null ? a.secret != null : !secret.equals(a.secret)) { + return false; + } + if (token == null ? a.token != null : !token.equals(a.token)) { + return false; + } + if (expires == null ? a.expires != null : !expires.equals(a.expires)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (flavor == null ? a.flavor != null : !flavor.equals(a.flavor)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/AWSTemporaryCredentials.java b/core/zts/src/main/java/com/yahoo/athenz/zts/AWSTemporaryCredentials.java new file mode 100644 index 00000000000..beb6acf1abf --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/AWSTemporaryCredentials.java @@ -0,0 +1,70 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// AWSTemporaryCredentials - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class AWSTemporaryCredentials { + public String accessKeyId; + public String secretAccessKey; + public String sessionToken; + public Timestamp expiration; + + public AWSTemporaryCredentials setAccessKeyId(String accessKeyId) { + this.accessKeyId = accessKeyId; + return this; + } + public String getAccessKeyId() { + return accessKeyId; + } + public AWSTemporaryCredentials setSecretAccessKey(String secretAccessKey) { + this.secretAccessKey = secretAccessKey; + return this; + } + public String getSecretAccessKey() { + return secretAccessKey; + } + public AWSTemporaryCredentials setSessionToken(String sessionToken) { + this.sessionToken = sessionToken; + return this; + } + public String getSessionToken() { + return sessionToken; + } + public AWSTemporaryCredentials setExpiration(Timestamp expiration) { + this.expiration = expiration; + return this; + } + public Timestamp getExpiration() { + return expiration; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != AWSTemporaryCredentials.class) { + return false; + } + AWSTemporaryCredentials a = (AWSTemporaryCredentials) another; + if (accessKeyId == null ? a.accessKeyId != null : !accessKeyId.equals(a.accessKeyId)) { + return false; + } + if (secretAccessKey == null ? a.secretAccessKey != null : !secretAccessKey.equals(a.secretAccessKey)) { + return false; + } + if (sessionToken == null ? a.sessionToken != null : !sessionToken.equals(a.sessionToken)) { + return false; + } + if (expiration == null ? a.expiration != null : !expiration.equals(a.expiration)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/Access.java b/core/zts/src/main/java/com/yahoo/athenz/zts/Access.java new file mode 100644 index 00000000000..1bd70443453 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/Access.java @@ -0,0 +1,37 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Access - Access can be checked and returned as this resource. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Access { + public boolean granted; + + public Access setGranted(boolean granted) { + this.granted = granted; + return this; + } + public boolean getGranted() { + return granted; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Access.class) { + return false; + } + Access a = (Access) another; + if (granted != a.granted) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/Assertion.java b/core/zts/src/main/java/com/yahoo/athenz/zts/Assertion.java new file mode 100644 index 00000000000..3f9e276102a --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/Assertion.java @@ -0,0 +1,84 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Assertion - A representation for the encapsulation of an action to be +// performed on a resource by a principal. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Assertion { + public String role; + public String resource; + public String action; + @RdlOptional + public AssertionEffect effect; + @RdlOptional + public Long id; + + public Assertion setRole(String role) { + this.role = role; + return this; + } + public String getRole() { + return role; + } + public Assertion setResource(String resource) { + this.resource = resource; + return this; + } + public String getResource() { + return resource; + } + public Assertion setAction(String action) { + this.action = action; + return this; + } + public String getAction() { + return action; + } + public Assertion setEffect(AssertionEffect effect) { + this.effect = effect; + return this; + } + public AssertionEffect getEffect() { + return effect; + } + public Assertion setId(Long id) { + this.id = id; + return this; + } + public Long getId() { + return id; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Assertion.class) { + return false; + } + Assertion a = (Assertion) another; + if (role == null ? a.role != null : !role.equals(a.role)) { + return false; + } + if (resource == null ? a.resource != null : !resource.equals(a.resource)) { + return false; + } + if (action == null ? a.action != null : !action.equals(a.action)) { + return false; + } + if (effect == null ? a.effect != null : !effect.equals(a.effect)) { + return false; + } + if (id == null ? a.id != null : !id.equals(a.id)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/AssertionEffect.java b/core/zts/src/main/java/com/yahoo/athenz/zts/AssertionEffect.java new file mode 100644 index 00000000000..a4c5e5df64b --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/AssertionEffect.java @@ -0,0 +1,23 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; + +// +// AssertionEffect - Every assertion can have the effect of ALLOW or DENY. +// +public enum AssertionEffect { + ALLOW, + DENY; + + public static AssertionEffect fromString(String v) { + for (AssertionEffect e : values()) { + if (e.toString().equals(v)) { + return e; + } + } + throw new IllegalArgumentException("Invalid string representation for AssertionEffect: " + v); + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetric.java b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetric.java new file mode 100644 index 00000000000..72ee69031b4 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetric.java @@ -0,0 +1,48 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainMetric - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainMetric { + public DomainMetricType metricType; + public int metricVal; + + public DomainMetric setMetricType(DomainMetricType metricType) { + this.metricType = metricType; + return this; + } + public DomainMetricType getMetricType() { + return metricType; + } + public DomainMetric setMetricVal(int metricVal) { + this.metricVal = metricVal; + return this; + } + public int getMetricVal() { + return metricVal; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainMetric.class) { + return false; + } + DomainMetric a = (DomainMetric) another; + if (metricType == null ? a.metricType != null : !metricType.equals(a.metricType)) { + return false; + } + if (metricVal != a.metricVal) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetricType.java b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetricType.java new file mode 100644 index 00000000000..77a72103420 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetricType.java @@ -0,0 +1,39 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; + +// +// DomainMetricType - zpe metric attributes +// +public enum DomainMetricType { + ACCESS_ALLOWED, + ACCESS_ALLOWED_DENY, + ACCESS_ALLOWED_DENY_NO_MATCH, + ACCESS_ALLOWED_ALLOW, + ACCESS_ALLOWED_ERROR, + ACCESS_ALLOWED_TOKEN_INVALID, + ACCESS_Allowed_TOKEN_EXPIRED, + ACCESS_ALLOWED_DOMAIN_NOT_FOUND, + ACCESS_ALLOWED_DOMAIN_MISMATCH, + ACCESS_ALLOWED_DOMAIN_EXPIRED, + ACCESS_ALLOWED_DOMAIN_EMPTY, + ACCESS_ALLOWED_TOKEN_CACHE_FAILURE, + ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND, + ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS, + ACCESS_ALLOWED_TOKEN_VALIDATE, + LOAD_FILE_FAIL, + LOAD_FILE_GOOD, + LOAD_DOMAIN_GOOD; + + public static DomainMetricType fromString(String v) { + for (DomainMetricType e : values()) { + if (e.toString().equals(v)) { + return e; + } + } + throw new IllegalArgumentException("Invalid string representation for DomainMetricType: " + v); + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetrics.java b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetrics.java new file mode 100644 index 00000000000..68b5c79f2d3 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainMetrics.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainMetrics - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainMetrics { + public String domainName; + public List metricList; + + public DomainMetrics setDomainName(String domainName) { + this.domainName = domainName; + return this; + } + public String getDomainName() { + return domainName; + } + public DomainMetrics setMetricList(List metricList) { + this.metricList = metricList; + return this; + } + public List getMetricList() { + return metricList; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainMetrics.class) { + return false; + } + DomainMetrics a = (DomainMetrics) another; + if (domainName == null ? a.domainName != null : !domainName.equals(a.domainName)) { + return false; + } + if (metricList == null ? a.metricList != null : !metricList.equals(a.metricList)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/DomainSignedPolicyData.java b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainSignedPolicyData.java new file mode 100644 index 00000000000..cf6b3583d5f --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/DomainSignedPolicyData.java @@ -0,0 +1,60 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// DomainSignedPolicyData - A signed bulk transfer of policies. The data is +// signed with server's private key. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class DomainSignedPolicyData { + public SignedPolicyData signedPolicyData; + public String signature; + public String keyId; + + public DomainSignedPolicyData setSignedPolicyData(SignedPolicyData signedPolicyData) { + this.signedPolicyData = signedPolicyData; + return this; + } + public SignedPolicyData getSignedPolicyData() { + return signedPolicyData; + } + public DomainSignedPolicyData setSignature(String signature) { + this.signature = signature; + return this; + } + public String getSignature() { + return signature; + } + public DomainSignedPolicyData setKeyId(String keyId) { + this.keyId = keyId; + return this; + } + public String getKeyId() { + return keyId; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != DomainSignedPolicyData.class) { + return false; + } + DomainSignedPolicyData a = (DomainSignedPolicyData) another; + if (signedPolicyData == null ? a.signedPolicyData != null : !signedPolicyData.equals(a.signedPolicyData)) { + return false; + } + if (signature == null ? a.signature != null : !signature.equals(a.signature)) { + return false; + } + if (keyId == null ? a.keyId != null : !keyId.equals(a.keyId)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/HostServices.java b/core/zts/src/main/java/com/yahoo/athenz/zts/HostServices.java new file mode 100644 index 00000000000..7da23cf3342 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/HostServices.java @@ -0,0 +1,50 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// HostServices - The representation for an enumeration of services authorized +// to run on a specific host. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class HostServices { + public String host; + public List names; + + public HostServices setHost(String host) { + this.host = host; + return this; + } + public String getHost() { + return host; + } + public HostServices setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != HostServices.class) { + return false; + } + HostServices a = (HostServices) another; + if (host == null ? a.host != null : !host.equals(a.host)) { + return false; + } + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/Identity.java b/core/zts/src/main/java/com/yahoo/athenz/zts/Identity.java new file mode 100644 index 00000000000..11094dc57ce --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/Identity.java @@ -0,0 +1,100 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.Map; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Identity - Identity - a signed assertion of service or human identity, the +// response could be either a client certificate or just a regular NToken +// (depending if the request contained a csr or not). +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Identity { + public String name; + @RdlOptional + public String certificate; + @RdlOptional + public String caCertBundle; + @RdlOptional + public String sshServerCert; + @RdlOptional + public String serviceToken; + @RdlOptional + public Map attributes; + + public Identity setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public Identity setCertificate(String certificate) { + this.certificate = certificate; + return this; + } + public String getCertificate() { + return certificate; + } + public Identity setCaCertBundle(String caCertBundle) { + this.caCertBundle = caCertBundle; + return this; + } + public String getCaCertBundle() { + return caCertBundle; + } + public Identity setSshServerCert(String sshServerCert) { + this.sshServerCert = sshServerCert; + return this; + } + public String getSshServerCert() { + return sshServerCert; + } + public Identity setServiceToken(String serviceToken) { + this.serviceToken = serviceToken; + return this; + } + public String getServiceToken() { + return serviceToken; + } + public Identity setAttributes(Map attributes) { + this.attributes = attributes; + return this; + } + public Map getAttributes() { + return attributes; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Identity.class) { + return false; + } + Identity a = (Identity) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (certificate == null ? a.certificate != null : !certificate.equals(a.certificate)) { + return false; + } + if (caCertBundle == null ? a.caCertBundle != null : !caCertBundle.equals(a.caCertBundle)) { + return false; + } + if (sshServerCert == null ? a.sshServerCert != null : !sshServerCert.equals(a.sshServerCert)) { + return false; + } + if (serviceToken == null ? a.serviceToken != null : !serviceToken.equals(a.serviceToken)) { + return false; + } + if (attributes == null ? a.attributes != null : !attributes.equals(a.attributes)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/InstanceInformation.java b/core/zts/src/main/java/com/yahoo/athenz/zts/InstanceInformation.java new file mode 100644 index 00000000000..1bacaa9a017 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/InstanceInformation.java @@ -0,0 +1,94 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// InstanceInformation - Instance object that includes requested service +// details plus host document that is signed by provider as part of the host +// bootstrap process +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class InstanceInformation { + public String document; + public String signature; + public String keyId; + public String domain; + public String service; + public String csr; + + public InstanceInformation setDocument(String document) { + this.document = document; + return this; + } + public String getDocument() { + return document; + } + public InstanceInformation setSignature(String signature) { + this.signature = signature; + return this; + } + public String getSignature() { + return signature; + } + public InstanceInformation setKeyId(String keyId) { + this.keyId = keyId; + return this; + } + public String getKeyId() { + return keyId; + } + public InstanceInformation setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public InstanceInformation setService(String service) { + this.service = service; + return this; + } + public String getService() { + return service; + } + public InstanceInformation setCsr(String csr) { + this.csr = csr; + return this; + } + public String getCsr() { + return csr; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != InstanceInformation.class) { + return false; + } + InstanceInformation a = (InstanceInformation) another; + if (document == null ? a.document != null : !document.equals(a.document)) { + return false; + } + if (signature == null ? a.signature != null : !signature.equals(a.signature)) { + return false; + } + if (keyId == null ? a.keyId != null : !keyId.equals(a.keyId)) { + return false; + } + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (service == null ? a.service != null : !service.equals(a.service)) { + return false; + } + if (csr == null ? a.csr != null : !csr.equals(a.csr)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/InstanceRefreshRequest.java b/core/zts/src/main/java/com/yahoo/athenz/zts/InstanceRefreshRequest.java new file mode 100644 index 00000000000..a9d3d37c6b4 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/InstanceRefreshRequest.java @@ -0,0 +1,50 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// InstanceRefreshRequest - InstanceRefreshRequest - a certificate refresh +// request +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class InstanceRefreshRequest { + public String csr; + @RdlOptional + public Integer expiryTime; + + public InstanceRefreshRequest setCsr(String csr) { + this.csr = csr; + return this; + } + public String getCsr() { + return csr; + } + public InstanceRefreshRequest setExpiryTime(Integer expiryTime) { + this.expiryTime = expiryTime; + return this; + } + public Integer getExpiryTime() { + return expiryTime; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != InstanceRefreshRequest.class) { + return false; + } + InstanceRefreshRequest a = (InstanceRefreshRequest) another; + if (csr == null ? a.csr != null : !csr.equals(a.csr)) { + return false; + } + if (expiryTime == null ? a.expiryTime != null : !expiryTime.equals(a.expiryTime)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/Policy.java b/core/zts/src/main/java/com/yahoo/athenz/zts/Policy.java new file mode 100644 index 00000000000..939b80287d8 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/Policy.java @@ -0,0 +1,61 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// Policy - The representation for a Policy with set of assertions. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class Policy { + public String name; + @RdlOptional + public Timestamp modified; + public List assertions; + + public Policy setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public Policy setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public Policy setAssertions(List assertions) { + this.assertions = assertions; + return this; + } + public List getAssertions() { + return assertions; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != Policy.class) { + return false; + } + Policy a = (Policy) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (assertions == null ? a.assertions != null : !assertions.equals(a.assertions)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/PolicyData.java b/core/zts/src/main/java/com/yahoo/athenz/zts/PolicyData.java new file mode 100644 index 00000000000..66da2d5ec0c --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/PolicyData.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// PolicyData - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class PolicyData { + public String domain; + public List policies; + + public PolicyData setDomain(String domain) { + this.domain = domain; + return this; + } + public String getDomain() { + return domain; + } + public PolicyData setPolicies(List policies) { + this.policies = policies; + return this; + } + public List getPolicies() { + return policies; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != PolicyData.class) { + return false; + } + PolicyData a = (PolicyData) another; + if (domain == null ? a.domain != null : !domain.equals(a.domain)) { + return false; + } + if (policies == null ? a.policies != null : !policies.equals(a.policies)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/PublicKeyEntry.java b/core/zts/src/main/java/com/yahoo/athenz/zts/PublicKeyEntry.java new file mode 100644 index 00000000000..e512a93b96b --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/PublicKeyEntry.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// PublicKeyEntry - The representation of the public key in a service identity +// object. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class PublicKeyEntry { + public String key; + public String id; + + public PublicKeyEntry setKey(String key) { + this.key = key; + return this; + } + public String getKey() { + return key; + } + public PublicKeyEntry setId(String id) { + this.id = id; + return this; + } + public String getId() { + return id; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != PublicKeyEntry.class) { + return false; + } + PublicKeyEntry a = (PublicKeyEntry) another; + if (key == null ? a.key != null : !key.equals(a.key)) { + return false; + } + if (id == null ? a.id != null : !id.equals(a.id)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/RoleAccess.java b/core/zts/src/main/java/com/yahoo/athenz/zts/RoleAccess.java new file mode 100644 index 00000000000..86a92df82f7 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/RoleAccess.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// RoleAccess - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class RoleAccess { + public List roles; + + public RoleAccess setRoles(List roles) { + this.roles = roles; + return this; + } + public List getRoles() { + return roles; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != RoleAccess.class) { + return false; + } + RoleAccess a = (RoleAccess) another; + if (roles == null ? a.roles != null : !roles.equals(a.roles)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/RoleToken.java b/core/zts/src/main/java/com/yahoo/athenz/zts/RoleToken.java new file mode 100644 index 00000000000..8d768a79405 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/RoleToken.java @@ -0,0 +1,48 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// RoleToken - A representation of a signed RoleToken +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class RoleToken { + public String token; + public long expiryTime; + + public RoleToken setToken(String token) { + this.token = token; + return this; + } + public String getToken() { + return token; + } + public RoleToken setExpiryTime(long expiryTime) { + this.expiryTime = expiryTime; + return this; + } + public long getExpiryTime() { + return expiryTime; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != RoleToken.class) { + return false; + } + RoleToken a = (RoleToken) another; + if (token == null ? a.token != null : !token.equals(a.token)) { + return false; + } + if (expiryTime != a.expiryTime) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/ServiceIdentity.java b/core/zts/src/main/java/com/yahoo/athenz/zts/ServiceIdentity.java new file mode 100644 index 00000000000..b5c0fcf5392 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/ServiceIdentity.java @@ -0,0 +1,122 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ServiceIdentity - The representation of the service identity object. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ServiceIdentity { + public String name; + @RdlOptional + public List publicKeys; + @RdlOptional + public String providerEndpoint; + @RdlOptional + public Timestamp modified; + @RdlOptional + public String executable; + @RdlOptional + public List hosts; + @RdlOptional + public String user; + @RdlOptional + public String group; + + public ServiceIdentity setName(String name) { + this.name = name; + return this; + } + public String getName() { + return name; + } + public ServiceIdentity setPublicKeys(List publicKeys) { + this.publicKeys = publicKeys; + return this; + } + public List getPublicKeys() { + return publicKeys; + } + public ServiceIdentity setProviderEndpoint(String providerEndpoint) { + this.providerEndpoint = providerEndpoint; + return this; + } + public String getProviderEndpoint() { + return providerEndpoint; + } + public ServiceIdentity setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public ServiceIdentity setExecutable(String executable) { + this.executable = executable; + return this; + } + public String getExecutable() { + return executable; + } + public ServiceIdentity setHosts(List hosts) { + this.hosts = hosts; + return this; + } + public List getHosts() { + return hosts; + } + public ServiceIdentity setUser(String user) { + this.user = user; + return this; + } + public String getUser() { + return user; + } + public ServiceIdentity setGroup(String group) { + this.group = group; + return this; + } + public String getGroup() { + return group; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ServiceIdentity.class) { + return false; + } + ServiceIdentity a = (ServiceIdentity) another; + if (name == null ? a.name != null : !name.equals(a.name)) { + return false; + } + if (publicKeys == null ? a.publicKeys != null : !publicKeys.equals(a.publicKeys)) { + return false; + } + if (providerEndpoint == null ? a.providerEndpoint != null : !providerEndpoint.equals(a.providerEndpoint)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (executable == null ? a.executable != null : !executable.equals(a.executable)) { + return false; + } + if (hosts == null ? a.hosts != null : !hosts.equals(a.hosts)) { + return false; + } + if (user == null ? a.user != null : !user.equals(a.user)) { + return false; + } + if (group == null ? a.group != null : !group.equals(a.group)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/ServiceIdentityList.java b/core/zts/src/main/java/com/yahoo/athenz/zts/ServiceIdentityList.java new file mode 100644 index 00000000000..c9c45cf9f74 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/ServiceIdentityList.java @@ -0,0 +1,39 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// ServiceIdentityList - The representation for an enumeration of services in +// the namespace. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class ServiceIdentityList { + public List names; + + public ServiceIdentityList setNames(List names) { + this.names = names; + return this; + } + public List getNames() { + return names; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != ServiceIdentityList.class) { + return false; + } + ServiceIdentityList a = (ServiceIdentityList) another; + if (names == null ? a.names != null : !names.equals(a.names)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/SignedPolicyData.java b/core/zts/src/main/java/com/yahoo/athenz/zts/SignedPolicyData.java new file mode 100644 index 00000000000..9e3b3941da5 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/SignedPolicyData.java @@ -0,0 +1,82 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// SignedPolicyData - A representation of policies object defined in a given +// server. +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class SignedPolicyData { + public PolicyData policyData; + public String zmsSignature; + public String zmsKeyId; + public Timestamp modified; + public Timestamp expires; + + public SignedPolicyData setPolicyData(PolicyData policyData) { + this.policyData = policyData; + return this; + } + public PolicyData getPolicyData() { + return policyData; + } + public SignedPolicyData setZmsSignature(String zmsSignature) { + this.zmsSignature = zmsSignature; + return this; + } + public String getZmsSignature() { + return zmsSignature; + } + public SignedPolicyData setZmsKeyId(String zmsKeyId) { + this.zmsKeyId = zmsKeyId; + return this; + } + public String getZmsKeyId() { + return zmsKeyId; + } + public SignedPolicyData setModified(Timestamp modified) { + this.modified = modified; + return this; + } + public Timestamp getModified() { + return modified; + } + public SignedPolicyData setExpires(Timestamp expires) { + this.expires = expires; + return this; + } + public Timestamp getExpires() { + return expires; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != SignedPolicyData.class) { + return false; + } + SignedPolicyData a = (SignedPolicyData) another; + if (policyData == null ? a.policyData != null : !policyData.equals(a.policyData)) { + return false; + } + if (zmsSignature == null ? a.zmsSignature != null : !zmsSignature.equals(a.zmsSignature)) { + return false; + } + if (zmsKeyId == null ? a.zmsKeyId != null : !zmsKeyId.equals(a.zmsKeyId)) { + return false; + } + if (modified == null ? a.modified != null : !modified.equals(a.modified)) { + return false; + } + if (expires == null ? a.expires != null : !expires.equals(a.expires)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/TenantDomains.java b/core/zts/src/main/java/com/yahoo/athenz/zts/TenantDomains.java new file mode 100644 index 00000000000..fd5bb4f2b58 --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/TenantDomains.java @@ -0,0 +1,38 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// + +package com.yahoo.athenz.zts; +import java.util.List; +import com.yahoo.rdl.*; +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +// +// TenantDomains - +// +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class TenantDomains { + public List tenantDomainNames; + + public TenantDomains setTenantDomainNames(List tenantDomainNames) { + this.tenantDomainNames = tenantDomainNames; + return this; + } + public List getTenantDomainNames() { + return tenantDomainNames; + } + + @Override + public boolean equals(Object another) { + if (this != another) { + if (another == null || another.getClass() != TenantDomains.class) { + return false; + } + TenantDomains a = (TenantDomains) another; + if (tenantDomainNames == null ? a.tenantDomainNames != null : !tenantDomainNames.equals(a.tenantDomainNames)) { + return false; + } + } + return true; + } +} diff --git a/core/zts/src/main/java/com/yahoo/athenz/zts/ZTSSchema.java b/core/zts/src/main/java/com/yahoo/athenz/zts/ZTSSchema.java new file mode 100644 index 00000000000..9217baaf7fb --- /dev/null +++ b/core/zts/src/main/java/com/yahoo/athenz/zts/ZTSSchema.java @@ -0,0 +1,430 @@ +// +// This file generated by rdl 1.4.8 +// + +package com.yahoo.athenz.zts; +import com.yahoo.rdl.*; + +public class ZTSSchema { + + private final static Schema INSTANCE = build(); + public static Schema instance() { + return INSTANCE; + } + + private static Schema build() { + SchemaBuilder sb = new SchemaBuilder("ZTS"); + sb.version(1); + sb.namespace("com.yahoo.athenz.zts"); + sb.comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. The Authorization Management Service (ZTS) API"); + + sb.stringType("SimpleName") + .comment("Copyright 2016 Yahoo Inc. Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. Common name types used by several API definitions A simple identifier, an element of compound name.") + .pattern("[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("CompoundName") + .comment("A compound name. Most names in this API are compound names.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("DomainName") + .comment("A domain name is the general qualifier prefix, as its uniqueness is managed.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("EntityName") + .comment("An entity name is a short form of a resource name, including only the domain and entity.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ServiceName") + .comment("A service name will generally be a unique subdomain.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("LocationName") + .comment("A location name is not yet defined, but will be a dotted name like everything else.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ActionName") + .comment("An action (operation) name.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("ResourceName") + .comment("A shorthand for a YRN with no service or location. The 'tail' of a YRN, just the domain:entity. Note that the EntityName part is optional, that is, a domain name followed by a colon is valid resource name.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?"); + + sb.stringType("YRN") + .comment("A full Yahoo Resource name (YRN).") + .pattern("(yrn:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:(([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?:)?([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*(:([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*)?"); + + sb.stringType("YBase64") + .comment("The Y-specific URL-safe Base64 variant.") + .pattern("[a-zA-Z0-9\\._-]+"); + + sb.stringType("YEncoded") + .comment("YEncoded includes ybase64 chars, as well as = and %. This can represent a user cookie and URL-encoded values.") + .pattern("[a-zA-Z0-9\\._%=-]*"); + + sb.stringType("AuthorityName") + .comment("Used as the prefix in a signed assertion. This uniquely identifies a signing authority.") + .pattern("([a-zA-Z0-9_][a-zA-Z0-9_-]*\\.)*[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + + sb.stringType("SignedToken") + .comment("A signed assertion if identity. i.e. the user cookie value. This token will only make sense to the authority that generated it, so it is beneficial to have something in the value that is cheaply recognized to quickly reject if it belongs to another authority. In addition to the YEncoded set our token includes ; to separate components and , to separate roles") + .pattern("[a-zA-Z0-9\\._%=;,-]*"); + + sb.structType("PublicKeyEntry") + .comment("The representation of the public key in a service identity object.") + .field("key", "String", false, "the public key for the service") + .field("id", "String", false, "the key identifier (version or zone name)"); + + sb.structType("ServiceIdentity") + .comment("The representation of the service identity object.") + .field("name", "ServiceName", false, "the full name of the service, i.e. \"sports.storage\"") + .arrayField("publicKeys", "PublicKeyEntry", true, "array of public keys for key rotation") + .field("providerEndpoint", "String", true, "if present, then this service can provision tenants via this endpoint.") + .field("modified", "Timestamp", true, "the timestamp when this entry was last modified") + .field("executable", "String", true, "the path of the executable that runs the service") + .arrayField("hosts", "String", true, "list of host names that this service can run on") + .field("user", "String", true, "local (unix) user name this service can run as") + .field("group", "String", true, "local (unix) group name this service can run as"); + + sb.structType("ServiceIdentityList") + .comment("The representation for an enumeration of services in the namespace.") + .arrayField("names", "EntityName", false, "list of service names"); + + sb.structType("HostServices") + .comment("The representation for an enumeration of services authorized to run on a specific host.") + .field("host", "String", false, "name of the host") + .arrayField("names", "EntityName", false, "list of service names authorized to run on this host"); + + sb.enumType("AssertionEffect") + .comment("Every assertion can have the effect of ALLOW or DENY.") + .element("ALLOW") + .element("DENY"); + + sb.structType("Assertion") + .comment("A representation for the encapsulation of an action to be performed on a resource by a principal.") + .field("role", "String", false, "the subject of the assertion, a role") + .field("resource", "String", false, "the object of the assertion. Must be in the local namespace. Can contain wildcards") + .field("action", "String", false, "the predicate of the assertion. Can contain wildcards") + .field("effect", "AssertionEffect", false, "the effect of the assertion in the policy language", null) + .field("id", "Int64", true, "assertion id - auto generated by server"); + + sb.structType("Policy") + .comment("The representation for a Policy with set of assertions.") + .field("name", "ResourceName", false, "name of the policy") + .field("modified", "Timestamp", true, "last modification timestamp of this policy") + .arrayField("assertions", "Assertion", false, "list of defined assertions for this policy"); + + sb.structType("PolicyData") + .field("domain", "DomainName", false, "name of the domain") + .arrayField("policies", "Policy", false, "list of policies defined in this server"); + + sb.structType("SignedPolicyData") + .comment("A representation of policies object defined in a given server.") + .field("policyData", "PolicyData", false, "list of policies defined in a domain") + .field("zmsSignature", "String", false, "zms signature generated based on the domain policies object") + .field("zmsKeyId", "String", false, "the identifier of the zms key used to generate the signature") + .field("modified", "Timestamp", false, "when the domain itself was last modified") + .field("expires", "Timestamp", false, "timestamp specifying the expiration time for using this set of policies"); + + sb.structType("DomainSignedPolicyData") + .comment("A signed bulk transfer of policies. The data is signed with server's private key.") + .field("signedPolicyData", "SignedPolicyData", false, "policy data signed by ZMS") + .field("signature", "String", false, "signature generated based on the domain policies object") + .field("keyId", "String", false, "the identifier of the key used to generate the signature"); + + sb.structType("RoleToken") + .comment("A representation of a signed RoleToken") + .field("token", "String", false, "") + .field("expiryTime", "Int64", false, ""); + + sb.structType("Access") + .comment("Access can be checked and returned as this resource.") + .field("granted", "Bool", false, "true (allowed) or false (denied)"); + + sb.structType("RoleAccess") + .arrayField("roles", "EntityName", false, ""); + + sb.structType("TenantDomains") + .arrayField("tenantDomainNames", "DomainName", false, ""); + + sb.structType("Identity") + .comment("Identity - a signed assertion of service or human identity, the response could be either a client certificate or just a regular NToken (depending if the request contained a csr or not).") + .field("name", "CompoundName", false, "name of the identity, fully qualified, i.e. my.domain.service1, or aws.1232321321312.myusername") + .field("certificate", "String", true, "a certificate usable for both client and server in TLS connections") + .field("caCertBundle", "String", true, "the CA certificate chain to use with all IMS-generated certs") + .field("sshServerCert", "String", true, "the SSH server cert, signed by the CA") + .field("serviceToken", "SignedToken", true, "service token instead of TLS certificate") + .mapField("attributes", "String", "String", true, "other config-like attributes determined at boot time"); + + sb.structType("InstanceInformation") + .comment("Instance object that includes requested service details plus host document that is signed by provider as part of the host bootstrap process") + .field("document", "String", false, "signed document containing attributes like IP address, instance-id, account#, etc.") + .field("signature", "String", false, "the signature for the document") + .field("keyId", "String", false, "the keyid used to sign the document") + .field("domain", "CompoundName", false, "the domain of the instance") + .field("service", "SimpleName", false, "the service this instance is supposed to run") + .field("csr", "String", false, "return a certificate in the response"); + + sb.structType("InstanceRefreshRequest") + .comment("InstanceRefreshRequest - a certificate refresh request") + .field("csr", "String", false, "Cert CSR if requesting TLS certificate") + .field("expiryTime", "Int32", true, "in seconds how long token should be valid for"); + + sb.structType("AWSInstanceInformation") + .comment("AWSInstanceInformation - the information a booting EC2 instance must provide to ZTS to authenticate.") + .field("document", "String", false, "signed document containing attributes like IP address, instance-id, account#, etc.") + .field("signature", "String", false, "the signature for the document") + .field("domain", "CompoundName", false, "the domain of the instance") + .field("service", "SimpleName", false, "the service this instance is supposed to run") + .field("csr", "String", false, "return a certificate in the response") + .field("name", "CompoundName", false, "the full service identity name (same as the EC2 instance profile name)") + .field("account", "SimpleName", false, "the account id (as a string) for the instance. parsed from the instance profile ARN") + .field("cloud", "SimpleName", true, "the name of the cloud (namespace) within the account, parsed from the name") + .field("subnet", "SimpleName", false, "the name of the subnet this instance is expected to be running in, parsed from the name") + .field("access", "String", false, "the AWS Access Key Id for the role") + .field("secret", "String", false, "the AWS Secret Access Key for the role") + .field("token", "String", false, "the AWS STS Token for the role") + .field("expires", "Timestamp", false, "the expiration time of the access keys") + .field("modified", "Timestamp", false, "the modified time of the access keys") + .field("flavor", "String", false, "the 'flavor' of the access keys, i.e. \"AWS-HMAC\""); + + sb.structType("AWSCertificateRequest") + .comment("AWSCertificateRequest - a certificate signing request") + .field("csr", "String", false, ""); + + sb.structType("AWSTemporaryCredentials") + .field("accessKeyId", "String", false, "") + .field("secretAccessKey", "String", false, "") + .field("sessionToken", "String", false, "") + .field("expiration", "Timestamp", false, ""); + + sb.enumType("DomainMetricType") + .comment("zpe metric attributes") + .element("ACCESS_ALLOWED") + .element("ACCESS_ALLOWED_DENY") + .element("ACCESS_ALLOWED_DENY_NO_MATCH") + .element("ACCESS_ALLOWED_ALLOW") + .element("ACCESS_ALLOWED_ERROR") + .element("ACCESS_ALLOWED_TOKEN_INVALID") + .element("ACCESS_Allowed_TOKEN_EXPIRED") + .element("ACCESS_ALLOWED_DOMAIN_NOT_FOUND") + .element("ACCESS_ALLOWED_DOMAIN_MISMATCH") + .element("ACCESS_ALLOWED_DOMAIN_EXPIRED") + .element("ACCESS_ALLOWED_DOMAIN_EMPTY") + .element("ACCESS_ALLOWED_TOKEN_CACHE_FAILURE") + .element("ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND") + .element("ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS") + .element("ACCESS_ALLOWED_TOKEN_VALIDATE") + .element("LOAD_FILE_FAIL") + .element("LOAD_FILE_GOOD") + .element("LOAD_DOMAIN_GOOD"); + + sb.structType("DomainMetric") + .field("metricType", "DomainMetricType", false, "") + .field("metricVal", "Int32", false, ""); + + sb.structType("DomainMetrics") + .field("domainName", "DomainName", false, "name of the domain the metrics pertain to") + .arrayField("metricList", "DomainMetric", false, "list of the domains metrics"); + + + sb.resource("ServiceIdentity", "GET", "/domain/{domainName}/service/{serviceName}") + .comment("Get info for the specified ServiceIdentity.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("serviceName", "ServiceName", "name of the service to be retrieved") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("ServiceIdentityList", "GET", "/domain/{domainName}/service") + .comment("Enumerate services provisioned in this domain.") + .pathParam("domainName", "DomainName", "name of the domain") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("PublicKeyEntry", "GET", "/domain/{domainName}/service/{serviceName}/publickey/{keyId}") + .comment("Retrieve the specified public key from the service.") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("serviceName", "SimpleName", "name of the service") + .pathParam("keyId", "String", "the identifier of the public key to be retrieved") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") +; + + sb.resource("HostServices", "GET", "/host/{host}/services") + .comment("Enumerate services provisioned on a specific host") + .pathParam("host", "String", "name of the host") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") +; + + sb.resource("DomainSignedPolicyData", "GET", "/domain/{domainName}/signed_policy_data") + .comment("Get a signed policy enumeration from the service, to transfer to a local store. An ETag is generated for the PolicyList that changes when any item in the list changes. If the If-None-Match header is provided, and it matches the ETag that would be returned, then a NOT_MODIFIED response is returned instead of the list.") + .pathParam("domainName", "DomainName", "name of the domain") + .headerParam("If-None-Match", "matchingTag", "String", null, "Retrieved from the previous request, this timestamp specifies to the server to return any policies modified since this time") + .output("ETag", "tag", "String", "") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") +; + + sb.resource("RoleToken", "GET", "/domain/{domainName}/token") + .comment("Return a security token for the specific role in the namespace that the user can assume. If the role is omitted, then all roles in the namespace that the authenticated user can assume are returned. the caller can specify how long the RoleToken should be valid for by specifying the minExpiryTime and maxExpiryTime parameters. The minExpiryTime specifies that the returned RoleToken must be at least valid (min/lower bound) for specified number of seconds, while maxExpiryTime specifies that the RoleToken must be at most valid (max/upper bound) for specified number of seconds. If both values are the same, the server must return a RoleToken for that many seconds. If no values are specified, the server's default RoleToken Timeout value is used.") + .pathParam("domainName", "DomainName", "name of the domain") + .queryParam("role", "role", "EntityName", null, "only interested for a token for this role") + .queryParam("minExpiryTime", "minExpiryTime", "Int32", null, "in seconds min expiry time") + .queryParam("maxExpiryTime", "maxExpiryTime", "Int32", null, "in seconds max expiry time") + .queryParam("proxyForPrincipal", "proxyForPrincipal", "EntityName", null, "optional this request is proxy for this principal") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("Access", "GET", "/access/domain/{domainName}/role/{roleName}/principal/{principal}") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("roleName", "EntityName", "name of the role to check access for") + .pathParam("principal", "EntityName", "carry out the access check for this principal") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("RoleAccess", "GET", "/access/domain/{domainName}/principal/{principal}") + .pathParam("domainName", "DomainName", "name of the domain") + .pathParam("principal", "EntityName", "carry out the role access lookup for this principal") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("TenantDomains", "GET", "/providerdomain/{providerDomainName}/user/{userName}") + .comment("Get list of tenant domains user has access to for specified provider domain and service") + .pathParam("providerDomainName", "DomainName", "name of the provider domain") + .pathParam("userName", "EntityName", "name of the user to retrieve tenant domain access for") + .queryParam("roleName", "roleName", "EntityName", null, "role name to filter on when looking for the tenants in provider") + .queryParam("serviceName", "serviceName", "ServiceName", null, "service name to filter on when looking for the tenants in provider") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("InstanceInformation", "POST", "/instance") + .comment("Get a cert for service being bootstrapped by supported service") + .input("info", "InstanceInformation", "") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("InstanceRefreshRequest", "POST", "/instance/{domain}/{service}/refresh") + .comment("Refresh self identity if the original identity was issued by ZTS") + .pathParam("domain", "CompoundName", "name of the domain requesting the refresh") + .pathParam("service", "SimpleName", "name of the service requesting the refresh") + .input("req", "InstanceRefreshRequest", "the refresh request") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("AWSInstanceInformation", "POST", "/aws/instance") + .comment("Register an instance in AWS ZTS. Whether this succeeds or not depends on the contents of the request (the request itself is not authenticated or authorized in the normal way). If successful, the Identity is returned as a x.509 client certificate (to be used in TLS operations)") + .input("info", "AWSInstanceInformation", "") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("AWSCertificateRequest", "POST", "/aws/instance/{domain}/{service}/refresh") + .comment("Rotate certs. Make this request with previous cert, the result is new cert for the same identity.") + .pathParam("domain", "CompoundName", "name of the domain requesting the refresh") + .pathParam("service", "SimpleName", "name of the service requesting the refresh") + .input("req", "AWSCertificateRequest", "the refresh request") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("AWSTemporaryCredentials", "GET", "/domain/{domainName}/role/{role}/creds") + .comment("perform an AWS AssumeRole of the target role and return the credentials. ZTS must have been granted the ability to assume the role in IAM, and granted the ability to ASSUME_AWS_ROLE in Athenz for this to succeed.") + .pathParam("domainName", "DomainName", "name of the domain containing the role, which implies the target account") + .pathParam("role", "CompoundName", "the target AWS role name in the domain account, in Athenz terms, i.e. \"the.role\"") + .auth("", "", true) + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + sb.resource("DomainMetrics", "POST", "/metrics/{domainName}") + .comment("called to post multiple zpe related metric attributes") + .pathParam("domainName", "DomainName", "name of the domain the metrics pertain to") + .input("req", "DomainMetrics", "") + .expected("OK") + .exception("BAD_REQUEST", "ResourceError", "") + + .exception("FORBIDDEN", "ResourceError", "") + + .exception("NOT_FOUND", "ResourceError", "") + + .exception("UNAUTHORIZED", "ResourceError", "") +; + + + return sb.build(); + } + +} diff --git a/core/zts/src/main/rdl/AWSAuth.rdli b/core/zts/src/main/rdl/AWSAuth.rdli new file mode 100644 index 00000000000..04e22aeea22 --- /dev/null +++ b/core/zts/src/main/rdl/AWSAuth.rdli @@ -0,0 +1,79 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; +include "Identity.tdl"; + +// AWSInstanceInformation - the information a booting EC2 instance must provide to ZTS to authenticate. +type AWSInstanceInformation Struct { + String document; //signed document containing attributes like IP address, instance-id, account#, etc. + String signature; //the signature for the document + CompoundName domain; //the domain of the instance + SimpleName service; //the service this instance is supposed to run + String csr; //return a certificate in the response + CompoundName name; //the full service identity name (same as the EC2 instance profile name) + SimpleName account; //the account id (as a string) for the instance. parsed from the instance profile ARN + SimpleName cloud (optional); //the name of the cloud (namespace) within the account, parsed from the name + SimpleName subnet; //the name of the subnet this instance is expected to be running in, parsed from the name + String access; //the AWS Access Key Id for the role + String secret; //the AWS Secret Access Key for the role + String token; //the AWS STS Token for the role + Timestamp expires; // the expiration time of the access keys + Timestamp modified; //the modified time of the access keys + String flavor; //the 'flavor' of the access keys, i.e. "AWS-HMAC" +} + +// Register an instance in AWS ZTS. Whether this succeeds or not depends on the +// contents of the request (the request itself is not authenticated or authorized in the normal way). +// If successful, the Identity is returned as a x.509 client certificate (to be used in TLS operations) +resource Identity POST "/aws/instance" { + AWSInstanceInformation info; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +// AWSCertificateRequest - a certificate signing request +type AWSCertificateRequest Struct { + String csr; +} + +// Rotate certs. Make this request with previous cert, the result +// is new cert for the same identity. +resource Identity POST "/aws/instance/{domain}/{service}/refresh" { + CompoundName domain; //name of the domain requesting the refresh + SimpleName service; //name of the service requesting the refresh + AWSCertificateRequest req; //the refresh request + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +type AWSTemporaryCredentials Struct { + String accessKeyId; + String secretAccessKey; + String sessionToken; + Timestamp expiration; +} + +// perform an AWS AssumeRole of the target role and return the credentials. ZTS +// must have been granted the ability to assume the role in IAM, and granted +// the ability to ASSUME_AWS_ROLE in Athenz for this to succeed. +resource AWSTemporaryCredentials GET "/domain/{domainName}/role/{role}/creds" { + DomainName domainName; //name of the domain containing the role, which implies the target account + CompoundName role; //the target AWS role name in the domain account, in Athenz terms, i.e. "the.role" + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zts/src/main/rdl/DomainMetrics.rdli b/core/zts/src/main/rdl/DomainMetrics.rdli new file mode 100644 index 00000000000..25a22008311 --- /dev/null +++ b/core/zts/src/main/rdl/DomainMetrics.rdli @@ -0,0 +1,50 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +// zpe metric attributes +type DomainMetricType Enum { + ACCESS_ALLOWED, + ACCESS_ALLOWED_DENY, + ACCESS_ALLOWED_DENY_NO_MATCH, + ACCESS_ALLOWED_ALLOW, + ACCESS_ALLOWED_ERROR, + ACCESS_ALLOWED_TOKEN_INVALID, + ACCESS_Allowed_TOKEN_EXPIRED, + ACCESS_ALLOWED_DOMAIN_NOT_FOUND, + ACCESS_ALLOWED_DOMAIN_MISMATCH, + ACCESS_ALLOWED_DOMAIN_EXPIRED, + ACCESS_ALLOWED_DOMAIN_EMPTY, + ACCESS_ALLOWED_TOKEN_CACHE_FAILURE, + ACCESS_ALLOWED_TOKEN_CACHE_NOT_FOUND, + ACCESS_ALLOWED_TOKEN_CACHE_SUCCESS, + ACCESS_ALLOWED_TOKEN_VALIDATE, + LOAD_FILE_FAIL, + LOAD_FILE_GOOD, + LOAD_DOMAIN_GOOD +} + +type DomainMetric Struct { + DomainMetricType metricType; + Int32 metricVal; +} + +type DomainMetrics Struct { + DomainName domainName; //name of the domain the metrics pertain to + Array metricList; //list of the domains metrics +} + +// called to post multiple zpe related metric attributes +resource DomainMetrics POST "/metrics/{domainName}" { + DomainName domainName; //name of the domain the metrics pertain to + DomainMetrics req; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + diff --git a/core/zts/src/main/rdl/Identity.rdli b/core/zts/src/main/rdl/Identity.rdli new file mode 100644 index 00000000000..db4066f7428 --- /dev/null +++ b/core/zts/src/main/rdl/Identity.rdli @@ -0,0 +1,48 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; +include "Identity.tdl"; + +// Instance object that includes requested service details plus host document +// that is signed by provider as part of the host bootstrap process +type InstanceInformation Struct { + String document; //signed document containing attributes like IP address, instance-id, account#, etc. + String signature; //the signature for the document + String keyId; // the keyid used to sign the document + CompoundName domain; //the domain of the instance + SimpleName service; //the service this instance is supposed to run + String csr; //return a certificate in the response +} + +// Get a cert for service being bootstrapped by supported service +resource Identity POST "/instance" { + InstanceInformation info; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + } +} + +// InstanceRefreshRequest - a certificate refresh request +type InstanceRefreshRequest Struct { + String csr; // Cert CSR if requesting TLS certificate + Int32 expiryTime (optional); //in seconds how long token should be valid for +} + +// Refresh self identity if the original identity was issued by ZTS +resource Identity POST "/instance/{domain}/{service}/refresh" { + CompoundName domain; //name of the domain requesting the refresh + SimpleName service; //name of the service requesting the refresh + InstanceRefreshRequest req; //the refresh request + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zts/src/main/rdl/Identity.tdl b/core/zts/src/main/rdl/Identity.tdl new file mode 100644 index 00000000000..80bbc15c494 --- /dev/null +++ b/core/zts/src/main/rdl/Identity.tdl @@ -0,0 +1,15 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +// Identity - a signed assertion of service or human identity, the response could be either a client certificate +// or just a regular NToken (depending if the request contained a csr or not). +type Identity Struct { + CompoundName name; //name of the identity, fully qualified, i.e. my.domain.service1, or aws.1232321321312.myusername + String certificate (optional); //a certificate usable for both client and server in TLS connections + String caCertBundle (optional); //the CA certificate chain to use with all IMS-generated certs + String sshServerCert (optional); //the SSH server cert, signed by the CA + SignedToken serviceToken (optional); //service token instead of TLS certificate + Map attributes (optional); //other config-like attributes determined at boot time +} diff --git a/core/zts/src/main/rdl/Names.tdl b/core/zts/src/main/rdl/Names.tdl new file mode 100644 index 00000000000..804c0636f3c --- /dev/null +++ b/core/zts/src/main/rdl/Names.tdl @@ -0,0 +1,53 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// +//Common name types used by several API definitions +// + +//A simple identifier, an element of compound name. +type SimpleName String (pattern="[a-zA-Z0-9_][a-zA-Z0-9_-]*"); + +//A compound name. Most names in this API are compound names. +type CompoundName String (pattern="({SimpleName}\\.)*{SimpleName}"); + +//A domain name is the general qualifier prefix, as its uniqueness is managed. +type DomainName String (pattern="{CompoundName}"); + +//An entity name is a short form of a resource name, including only the domain and entity. +type EntityName String (pattern="{CompoundName}"); + +//A service name will generally be a unique subdomain. +type ServiceName String (pattern="{CompoundName}"); + +//A location name is not yet defined, but will be a dotted name like everything else. +type LocationName String (pattern="{CompoundName}"); + +//An action (operation) name. +type ActionName String (pattern="{CompoundName}"); + +//A shorthand for a YRN with no service or location. The 'tail' of a YRN, just the domain:entity. +//Note that the EntityName part is optional, that is, a domain name followed by a colon is valid resource name. +type ResourceName String (pattern="{DomainName}(:{EntityName})?"); + +//A full Yahoo Resource name (YRN). +type YRN String (pattern="(yrn:({ServiceName})?:({LocationName})?:)?{ResourceName}"); + +//The Y-specific URL-safe Base64 variant. +type YBase64 String (pattern="[a-zA-Z0-9\\._-]+"); + +//YEncoded includes ybase64 chars, as well as = and %. This can represent a user cookie and URL-encoded values. +type YEncoded String (pattern="[a-zA-Z0-9\\._%=-]*"); + +//Used as the prefix in a signed assertion. This uniquely identifies a signing authority. +type AuthorityName String (pattern="{CompoundName}"); + +//A signed assertion if identity. i.e. the user cookie value. +//This token will only make sense to the authority that +//generated it, so it is beneficial to have something in the +//value that is cheaply recognized to quickly reject if +//it belongs to another authority. In addition to the +//YEncoded set our token includes ; to separate components +//and , to separate roles +type SignedToken String (pattern="[a-zA-Z0-9\\._%=;,-]*"); + diff --git a/core/zts/src/main/rdl/Policy.tdl b/core/zts/src/main/rdl/Policy.tdl new file mode 100644 index 00000000000..02d8e989171 --- /dev/null +++ b/core/zts/src/main/rdl/Policy.tdl @@ -0,0 +1,24 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +//Policy Types +include "Names.tdl"; + +//Every assertion can have the effect of ALLOW or DENY. +type AssertionEffect Enum { ALLOW, DENY } + +//A representation for the encapsulation of an action to be performed on a resource by a principal. +type Assertion Struct { + String role; //the subject of the assertion, a role + String resource; //the object of the assertion. Must be in the local namespace. Can contain wildcards + String action; //the predicate of the assertion. Can contain wildcards + AssertionEffect effect (optional, default=ALLOW); //the effect of the assertion in the policy language + Int64 id (optional); //assertion id - auto generated by server +} + +//The representation for a Policy with set of assertions. +type Policy Struct { + ResourceName name; //name of the policy + Timestamp modified (optional); //last modification timestamp of this policy + Array assertions; //list of defined assertions for this policy +} diff --git a/core/zts/src/main/rdl/ServiceIdentity.rdli b/core/zts/src/main/rdl/ServiceIdentity.rdli new file mode 100644 index 00000000000..56a53a36556 --- /dev/null +++ b/core/zts/src/main/rdl/ServiceIdentity.rdli @@ -0,0 +1,75 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +//The representation of the public key in a service identity object. +type PublicKeyEntry Struct { + String key; //the public key for the service + String id; //the key identifier (version or zone name) +} + +//The representation of the service identity object. +type ServiceIdentity Struct { + ServiceName name; //the full name of the service, i.e. "sports.storage" + Array publicKeys (optional); //array of public keys for key rotation + String providerEndpoint (optional); //if present, then this service can provision tenants via this endpoint. + Timestamp modified (optional); //the timestamp when this entry was last modified + String executable (optional); //the path of the executable that runs the service + Array hosts (optional); //list of host names that this service can run on + String user (optional); //local (unix) user name this service can run as + String group (optional); //local (unix) group name this service can run as +} + +//Get info for the specified ServiceIdentity. +resource ServiceIdentity GET "/domain/{domainName}/service/{serviceName}" { + DomainName domainName; //name of the domain + ServiceName serviceName; //name of the service to be retrieved + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + +//The representation for an enumeration of services in the namespace. +type ServiceIdentityList Struct { + Array names; //list of service names +} + +//Enumerate services provisioned in this domain. +resource ServiceIdentityList GET "/domain/{domainName}/service" { + DomainName domainName;//name of the domain + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + +//Retrieve the specified public key from the service. +resource PublicKeyEntry GET "/domain/{domainName}/service/{serviceName}/publickey/{keyId}" { + DomainName domainName; //name of the domain + SimpleName serviceName; //name of the service + String keyId; //the identifier of the public key to be retrieved + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + } +} + +//The representation for an enumeration of services authorized to run on a specific host. +type HostServices Struct { + String host; //name of the host + Array names; //list of service names authorized to run on this host +} + +//Enumerate services provisioned on a specific host +resource HostServices GET "/host/{host}/services" { + String host; //name of the host + exceptions { + ResourceError BAD_REQUEST; + } +} diff --git a/core/zts/src/main/rdl/SignedPolicies.rdli b/core/zts/src/main/rdl/SignedPolicies.rdli new file mode 100644 index 00000000000..f6df62abb05 --- /dev/null +++ b/core/zts/src/main/rdl/SignedPolicies.rdli @@ -0,0 +1,41 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Policy.tdl"; + +type PolicyData Struct { + DomainName domain; //name of the domain + Array policies; //list of policies defined in this server +} + +//A representation of policies object defined in a given server. +type SignedPolicyData Struct { + PolicyData policyData; //list of policies defined in a domain + String zmsSignature; //zms signature generated based on the domain policies object + String zmsKeyId; //the identifier of the zms key used to generate the signature + Timestamp modified; //when the domain itself was last modified + Timestamp expires; //timestamp specifying the expiration time for using this set of policies +} + +//A signed bulk transfer of policies. The data is signed with server's +//private key. +type DomainSignedPolicyData Struct { + SignedPolicyData signedPolicyData; //policy data signed by ZMS + String signature; //signature generated based on the domain policies object + String keyId; //the identifier of the key used to generate the signature +} + +//Get a signed policy enumeration from the service, to transfer to a local store. +//An ETag is generated for the PolicyList that changes when any item in the list +//changes. If the If-None-Match header is provided, and it matches the ETag that +//would be returned, then a NOT_MODIFIED response is returned instead of the list. +resource DomainSignedPolicyData GET "/domain/{domainName}/signed_policy_data" { + DomainName domainName; //name of the domain + String matchingTag (header="If-None-Match"); //Retrieved from the previous request, this timestamp specifies to the server to return any policies modified since this time + String tag (header="ETag", out); //The current latest modification timestamp is returned in this header + expected OK, NOT_MODIFIED; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + } +} diff --git a/core/zts/src/main/rdl/Tenancy.rdli b/core/zts/src/main/rdl/Tenancy.rdli new file mode 100644 index 00000000000..7556dddc8d5 --- /dev/null +++ b/core/zts/src/main/rdl/Tenancy.rdli @@ -0,0 +1,23 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +type TenantDomains Struct { + Array tenantDomainNames; +} + +// Get list of tenant domains user has access to for specified provider domain and service + +resource TenantDomains GET "/providerdomain/{providerDomainName}/user/{userName}?roleName={roleName}&serviceName={serviceName}" { + DomainName providerDomainName; // name of the provider domain + EntityName userName; // name of the user to retrieve tenant domain access for + EntityName roleName (optional); // role name to filter on when looking for the tenants in provider + ServiceName serviceName (optional); // service name to filter on when looking for the tenants in provider + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} diff --git a/core/zts/src/main/rdl/Token.rdli b/core/zts/src/main/rdl/Token.rdli new file mode 100644 index 00000000000..6d5db7fc79f --- /dev/null +++ b/core/zts/src/main/rdl/Token.rdli @@ -0,0 +1,72 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +include "Names.tdl"; + +//A representation of a signed RoleToken +type RoleToken Struct { + String token; + Int64 expiryTime; +} + +//Return a security token for the specific role in the namespace that +//the user can assume. If the role is omitted, then all roles in the +//namespace that the authenticated user can assume are returned. +//the caller can specify how long the RoleToken should be valid for +//by specifying the minExpiryTime and maxExpiryTime parameters. The +//minExpiryTime specifies that the returned RoleToken must be at +//least valid (min/lower bound) for specified number of seconds, +//while maxExpiryTime specifies that the RoleToken must be at most +//valid (max/upper bound) for specified number of seconds. If both +//values are the same, the server must return a RoleToken for that +//many seconds. If no values are specified, the server's default +//RoleToken Timeout value is used. +resource RoleToken GET "/domain/{domainName}/token?role={role}&minExpiryTime={minExpiryTime}&maxExpiryTime={maxExpiryTime}&proxyForPrincipal={proxyForPrincipal}" { + DomainName domainName; //name of the domain + EntityName role (optional); //only interested for a token for this role + Int32 minExpiryTime (optional); //in seconds min expiry time + Int32 maxExpiryTime (optional); //in seconds max expiry time + EntityName proxyForPrincipal (optional); //optional this request is proxy for this principal + authenticate; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError NOT_FOUND; + ResourceError UNAUTHORIZED; + } +} + +//Access can be checked and returned as this resource. +type Access Struct { + Bool granted; //true (allowed) or false (denied) +} + +resource Access GET "/access/domain/{domainName}/role/{roleName}/principal/{principal}" { + DomainName domainName; //name of the domain + EntityName roleName; //name of the role to check access for + EntityName principal; //carry out the access check for this principal + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError FORBIDDEN; + ResourceError UNAUTHORIZED; + ResourceError NOT_FOUND; + } +} + +type RoleAccess Struct { + Array roles; +} + +resource RoleAccess GET "/access/domain/{domainName}/principal/{principal}" { + DomainName domainName; //name of the domain + EntityName principal; //carry out the role access lookup for this principal + authenticate; + expected OK; + exceptions { + ResourceError BAD_REQUEST; + ResourceError UNAUTHORIZED; + ResourceError NOT_FOUND; + } +} diff --git a/core/zts/src/main/rdl/ZTS.rdl b/core/zts/src/main/rdl/ZTS.rdl new file mode 100644 index 00000000000..bb927bef519 --- /dev/null +++ b/core/zts/src/main/rdl/ZTS.rdl @@ -0,0 +1,17 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// +//The Authorization Management Service (ZTS) API +// +name ZTS; +version 1; +namespace com.yahoo.athenz.zts; + +include "ServiceIdentity.rdli"; +include "SignedPolicies.rdli"; +include "Token.rdli"; +include "Tenancy.rdli"; +include "Identity.rdli"; +include "AWSAuth.rdli"; +include "DomainMetrics.rdli"; diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/AWSCertificateRequestTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/AWSCertificateRequestTest.java new file mode 100644 index 00000000000..068a1fc3062 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/AWSCertificateRequestTest.java @@ -0,0 +1,43 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +public class AWSCertificateRequestTest { + + @Test + public void testIdentity() { + AWSCertificateRequest i = new AWSCertificateRequest(); + AWSCertificateRequest i2 = new AWSCertificateRequest(); + + // set + i.setCsr("sample_csr"); + + // getter assertion + assertEquals(i.getCsr(), "sample_csr"); + + assertTrue(i.equals(i)); + assertFalse(i.equals(i2)); + assertFalse(i.equals(new String())); + + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/AWSInstanceInformationTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/AWSInstanceInformationTest.java new file mode 100644 index 00000000000..df4bf1ba282 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/AWSInstanceInformationTest.java @@ -0,0 +1,118 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +import com.yahoo.rdl.Timestamp; + +public class AWSInstanceInformationTest { + + @Test + public void testIdentity() { + AWSInstanceInformation i = new AWSInstanceInformation(); + AWSInstanceInformation i2 = new AWSInstanceInformation(); + + // set + i.setDocument("test_doc"); + i.setSignature("test_sig"); + i.setDomain("test.domain"); + i.setService("test.service"); + i.setCsr("test.csr"); + i.setName("test.name"); + i.setAccount("user.test"); + i.setAccess("test.access"); + i.setCloud("test.cloud"); + i.setSubnet("test.subnet"); + i.setSecret("test.secret"); + i.setToken("test.token"); + i.setExpires(Timestamp.fromMillis(123456789123L)); + i.setModified(Timestamp.fromMillis(123456789122L)); + i.setFlavor("test.flavor"); + + i2.setDocument("test_doc"); + i2.setSignature("test_sig"); + i2.setDomain("test.domain"); + i2.setService("test.service"); + i2.setCsr("test.csr"); + i2.setName("test.name"); + i2.setAccount("user.test"); + i2.setAccess("test.access"); + i2.setCloud("test.cloud"); + i2.setSubnet("test.subnet"); + i2.setSecret("test.secret"); + i2.setToken("test.token"); + i2.setExpires(Timestamp.fromMillis(123456789123L)); + i2.setModified(Timestamp.fromMillis(123456789122L)); + + // getter assertion + assertEquals(i.getDocument(), "test_doc"); + assertEquals(i.getSignature(), "test_sig"); + assertEquals(i.getDomain(), "test.domain"); + assertEquals(i.getService(), "test.service"); + assertEquals(i.getCsr(), "test.csr"); + assertEquals(i.getName(), "test.name"); + assertEquals(i.getAccount(), "user.test"); + assertEquals(i.getAccess(), "test.access"); + assertEquals(i.getCloud(), "test.cloud"); + assertEquals(i.getSubnet(), "test.subnet"); + assertEquals(i.getSecret(), "test.secret"); + assertEquals(i.getToken(), "test.token"); + assertEquals(i.getExpires(), Timestamp.fromMillis(123456789123L)); + assertEquals(i.getModified(), Timestamp.fromMillis(123456789122L)); + assertEquals(i.getFlavor(), "test.flavor"); + + assertTrue(i.equals(i)); + + assertFalse(i2.equals(i)); + i2.setModified(null); + assertFalse(i2.equals(i)); + i2.setExpires(null); + assertFalse(i2.equals(i)); + i2.setToken(null); + assertFalse(i2.equals(i)); + i2.setSecret(null); + assertFalse(i2.equals(i)); + i2.setAccess(null); + assertFalse(i2.equals(i)); + i2.setSubnet(null); + assertFalse(i2.equals(i)); + i2.setCloud(null); + assertFalse(i2.equals(i)); + i2.setAccount(null); + assertFalse(i2.equals(i)); + i2.setName(null); + assertFalse(i2.equals(i)); + i2.setCsr(null); + assertFalse(i2.equals(i)); + i2.setService(null); + assertFalse(i2.equals(i)); + i2.setDomain(null); + assertFalse(i2.equals(i)); + i2.setSignature(null); + assertFalse(i2.equals(i)); + i2.setDocument(null); + assertFalse(i2.equals(i)); + + assertFalse(i.equals(new String())); + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/AWSTemporaryCredentialsTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/AWSTemporaryCredentialsTest.java new file mode 100644 index 00000000000..7c453a05646 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/AWSTemporaryCredentialsTest.java @@ -0,0 +1,63 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +import com.yahoo.rdl.Timestamp; + +public class AWSTemporaryCredentialsTest { + + @Test + public void testIdentity() { + AWSTemporaryCredentials i = new AWSTemporaryCredentials(); + AWSTemporaryCredentials i2 = new AWSTemporaryCredentials(); + + // set + i.setAccessKeyId("key01"); + i.setSecretAccessKey("test_secret"); + i.setSessionToken("test_token"); + i.setExpiration(Timestamp.fromMillis(123456789123L)); + i2.setAccessKeyId("key01"); + i2.setSecretAccessKey("test_secret"); + i2.setSessionToken("test_token"); + + // getter assertion + assertEquals(i.getAccessKeyId(), "key01"); + assertEquals(i.getSecretAccessKey(), "test_secret"); + assertEquals(i.getSessionToken(), "test_token"); + assertEquals(i.getExpiration(), Timestamp.fromMillis(123456789123L)); + + assertTrue(i.equals(i)); + + assertFalse(i2.equals(i)); + i2.setSessionToken(null); + assertFalse(i2.equals(i)); + i2.setSecretAccessKey(null); + assertFalse(i2.equals(i)); + i2.setAccessKeyId(null); + assertFalse(i2.equals(i)); + + assertFalse(i.equals(new String())); + + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/AccessTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/AccessTest.java new file mode 100644 index 00000000000..a522304f21d --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/AccessTest.java @@ -0,0 +1,52 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +public class AccessTest { + + @Test + public void testSetGranted() { + Access a = new Access(); + assertTrue(a.setGranted(true).granted); + } + + @Test + public void testGetGranted() { + Access a = new Access(); + a.setGranted(true); + assertTrue(a.getGranted()); + } + + @Test + public void testEqualsSameObj() { + Access a = new Access().setGranted(true); + Access b = new Access().setGranted(false); + assertTrue(a.equals(a)); + assertFalse(a.equals(b)); + } + + @Test + public void testEqualsDifObj() { + Access a = new Access(); + assertFalse(a.equals(new String())); + } +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/AssertionEffectTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/AssertionEffectTest.java new file mode 100644 index 00000000000..3bda6bac2b6 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/AssertionEffectTest.java @@ -0,0 +1,35 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; + +import org.testng.annotations.Test; + +public class AssertionEffectTest { + + @Test + public void TestFramStringOK() { + assertEquals(AssertionEffect.ALLOW, AssertionEffect.fromString("ALLOW")); + + } + + @Test(expectedExceptions = { java.lang.IllegalArgumentException.class }) + public void TestFromStringNG() throws Exception { + AssertionEffect.fromString("HOGE"); + } +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/DomainMetricTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/DomainMetricTest.java new file mode 100644 index 00000000000..6a20ff2f502 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/DomainMetricTest.java @@ -0,0 +1,106 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import java.util.ArrayList; +import java.util.List; + +import org.testng.annotations.Test; + +import junit.framework.Assert; + +public class DomainMetricTest { + + @Test + public void testsetgetMetricType() { + DomainMetric dm = new DomainMetric(); + + dm.setMetricType(DomainMetricType.ACCESS_ALLOWED); + dm.setMetricVal(1); + + Assert.assertEquals(DomainMetricType.ACCESS_ALLOWED, dm.getMetricType()); + Assert.assertEquals(1, dm.getMetricVal()); + Assert.assertEquals(DomainMetricType.ACCESS_ALLOWED, DomainMetricType.fromString("ACCESS_ALLOWED")); + } + + @Test(expectedExceptions = { java.lang.IllegalArgumentException.class }) + public void testMetricTypeException() throws Exception { + DomainMetricType.fromString("NOT_EXIST"); + } + + @Test + public void testMetricTypeEqualsTrueFalse() { + DomainMetric dm1 = new DomainMetric(); + DomainMetric dm2 = new DomainMetric(); + + dm1.setMetricType(DomainMetricType.ACCESS_ALLOWED); + dm1.setMetricVal(1); + dm2.setMetricType(DomainMetricType.ACCESS_ALLOWED); + dm2.setMetricVal(1); + + Assert.assertTrue(dm1.equals(dm2)); + + // change value + dm2.setMetricVal(0); + Assert.assertFalse(dm1.equals(dm2)); + + // change type + dm1.setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY); + Assert.assertFalse(dm1.equals(dm2)); + + Assert.assertFalse(dm1.equals(new String())); + } + + @Test + public void testDomainMetrics() { + DomainMetrics dms1 = new DomainMetrics(); + DomainMetrics dms2 = new DomainMetrics(); + + DomainMetric dm = new DomainMetric(); + + // set/get test + List dmlist = new ArrayList(); + dmlist.add(dm); + + dms1.setDomainName("test.org"); + dms1.setMetricList(dmlist); + dms2.setDomainName("test.org"); + dms2.setMetricList(dmlist); + + assertEquals("test.org", dms1.getDomainName()); + assertEquals(dmlist, dms1.getMetricList()); + + //// equals + // true case + Assert.assertTrue(dms1.equals(dms1)); + assertTrue(dms1.equals(dms2)); + + // false case + dms2.setMetricList(new ArrayList()); + Assert.assertFalse(dms1.equals(dms2)); + + dms2.setDomainName("test.net"); + assertFalse(dms1.equals(dms2)); + + assertFalse(dms1.equals(new String())); + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/DomainSignedPolicyDataTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/DomainSignedPolicyDataTest.java new file mode 100644 index 00000000000..57d9bafdcd7 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/DomainSignedPolicyDataTest.java @@ -0,0 +1,185 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import java.util.ArrayList; +import java.util.List; + +import org.testng.annotations.Test; + +import com.yahoo.rdl.Timestamp; + +public class DomainSignedPolicyDataTest implements Cloneable { + + @Test + public void testsetgetSignedPolicyData() { + + DomainSignedPolicyData dspd = new DomainSignedPolicyData(); + DomainSignedPolicyData dspd2 = new DomainSignedPolicyData(); + + SignedPolicyData spd = new SignedPolicyData(); + SignedPolicyData spd2 = new SignedPolicyData(); + + PolicyData pd = new PolicyData(); + PolicyData pd2 = new PolicyData(); + + Policy p = new Policy(); + Policy p2 = new Policy(); + + Assertion a = new Assertion(); + Assertion a2 = new Assertion(); + + //// set + // set assertion + a.setRole("user.hoge:role.test"); + a.setResource("user.hoge:coffee.blends.*"); + a.setAction("read"); + a.setEffect(AssertionEffect.ALLOW); + a.setId(0L); + + a2.setRole("user.hoge:role.test"); + a2.setResource("user.hoge:coffee.blends.*"); + a2.setAction("read"); + a2.setEffect(AssertionEffect.ALLOW); + + List al = new ArrayList(); + al.add(a); + + // set policy + p.setName("test_policy"); + p.setModified(Timestamp.fromMillis(1234567890123L)); + p.setAssertions(al); + + p2.setName("test_policy"); + p2.setModified(Timestamp.fromMillis(1234567890123L)); + + List pl = new ArrayList(); + pl.add(p); + + // set policy data + pd.setDomain("user.hoge"); + pd.setPolicies(pl); + + pd2.setDomain("user.hoge"); + + // set signed policy data + spd.setExpires(Timestamp.fromMillis(1234567890123L)); + spd.setModified(Timestamp.fromMillis(1234567890123L)); + spd.setPolicyData(pd); + spd.setZmsKeyId("zmsid"); + spd.setZmsSignature("signature"); + + spd2.setModified(Timestamp.fromMillis(1234567890123L)); + spd2.setPolicyData(pd); + spd2.setZmsKeyId("zmsid"); + spd2.setZmsSignature("signature"); + + // set domain signed policy data + dspd.setKeyId("kid"); + dspd.setSignature("signature"); + dspd.setSignedPolicyData(spd); + + dspd2.setSignature("signature"); + dspd2.setSignedPolicyData(spd); + + //// get assertion + // get assertion + assertEquals(a.getRole(), "user.hoge:role.test"); + assertEquals(a.getResource(), "user.hoge:coffee.blends.*"); + assertEquals((long) a.getId(), 0L); + assertEquals(a.getEffect(), AssertionEffect.ALLOW); + assertEquals(a.getAction(), "read"); + + // get policy + assertEquals(p.getAssertions(), al); + assertEquals(p.getModified(), Timestamp.fromMillis(1234567890123L)); + assertEquals(p.getName(), "test_policy"); + + // get policy data + assertEquals(pd.getDomain(), "user.hoge"); + assertEquals(pd.getPolicies(), pl); + + // get signed policy data + assertEquals(spd.getExpires(), Timestamp.fromMillis(1234567890123L)); + assertEquals(spd.getModified(), Timestamp.fromMillis(1234567890123L)); + assertEquals(spd.getPolicyData(), pd); + assertEquals(spd.getZmsKeyId(), "zmsid"); + assertEquals(spd.getZmsSignature(), "signature"); + + // get domain signed policy data + assertEquals(dspd.getKeyId(), "kid"); + assertEquals(dspd.getSignature(), "signature"); + assertEquals(dspd.getSignedPolicyData(), spd); + + // equals true + assertTrue(a.equals(a)); + assertTrue(p.equals(p)); + assertTrue(pd.equals(pd)); + assertTrue(spd.equals(spd)); + assertTrue(dspd.equals(dspd)); + + // equals false + assertFalse(a2.equals(a)); + a2.setEffect(null); + assertFalse(a2.equals(a)); + a2.setAction(null); + assertFalse(a2.equals(a)); + a2.setResource(null); + assertFalse(a2.equals(a)); + a2.setRole(null); + assertFalse(a2.equals(a)); + + + assertFalse(p2.equals(p)); + p2.setModified(null); + assertFalse(p2.equals(p)); + p2.setName(null); + assertFalse(p2.equals(p)); + + assertFalse(pd2.equals(pd)); + pd2.setDomain(null); + assertFalse(pd2.equals(pd)); + + assertFalse(spd2.equals(spd)); + spd2.setModified(null); + assertFalse(spd2.equals(spd)); + spd2.setZmsKeyId(null); + assertFalse(spd2.equals(spd)); + spd2.setZmsSignature(null); + assertFalse(spd2.equals(spd)); + spd2.setPolicyData(null); + assertFalse(spd2.equals(spd)); + + assertFalse(dspd2.equals(dspd)); + dspd2.setSignature(null); + assertFalse(dspd2.equals(dspd)); + dspd2.setSignedPolicyData(null); + assertFalse(dspd2.equals(dspd)); + + assertFalse(a.equals(new String())); + assertFalse(p.equals(new String())); + assertFalse(pd.equals(new String())); + assertFalse(spd.equals(new String())); + assertFalse(dspd.equals(new String())); + + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/HostServicesTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/HostServicesTest.java new file mode 100644 index 00000000000..5a1f74cea0f --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/HostServicesTest.java @@ -0,0 +1,53 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; + +import java.util.ArrayList; +import java.util.List; + +import org.testng.annotations.Test; + +public class HostServicesTest { + + @Test + public void testHostService() { + HostServices hs = new HostServices(); + HostServices hs2 = new HostServices(); + + List nl = new ArrayList(); + nl.add("sample.service1"); + + // set + hs.setNames(nl); + hs.setHost("sample.com"); + hs2.setHost("sample.com"); + + // getter assertion + assertEquals(hs.getHost(), "sample.com"); + assertEquals(hs.getNames(), nl); + assertTrue(hs.equals(hs)); + + assertFalse(hs2.equals(hs)); + hs2.setHost(null); + assertFalse(hs2.equals(hs)); + + assertFalse(hs.equals(new String())); + + } +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/IdentityTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/IdentityTest.java new file mode 100644 index 00000000000..508439e67dd --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/IdentityTest.java @@ -0,0 +1,79 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; + +import java.util.HashMap; + +import org.testng.annotations.Test; + +public class IdentityTest { + + @Test + public void testIdentity() { + Identity i = new Identity(); + Identity i2 = new Identity(); + + HashMap attr = new HashMap() { + + private static final long serialVersionUID = 1L; + + { + put("hosts", "sample.athenz.com"); + put("user", "user.test"); + } + }; + + // set + i.setName("sample"); + i.setCertificate("sample_cert"); + i.setCaCertBundle("sample_certbundle"); + i.setSshServerCert("sample_sshcert"); + i.setServiceToken("sample_token"); + i2.setName("sample"); + i2.setCertificate("sample_cert"); + i2.setCaCertBundle("sample_certbundle"); + i2.setSshServerCert("sample_sshcert"); + i2.setServiceToken("sample_token"); + i.setAttributes(attr); + + // getter assertion + assertEquals(i.getName(), "sample"); + assertEquals(i.getCertificate(), "sample_cert"); + assertEquals(i.getCaCertBundle(), "sample_certbundle"); + assertEquals(i.getSshServerCert(), "sample_sshcert"); + assertEquals(i.getServiceToken(), "sample_token"); + assertEquals(i.getAttributes(), attr); + + assertTrue(i.equals(i)); + + assertFalse(i2.equals(i)); + i2.setServiceToken(null); + assertFalse(i2.equals(i)); + i2.setSshServerCert(null); + assertFalse(i2.equals(i)); + i2.setCaCertBundle(null); + assertFalse(i2.equals(i)); + i2.setCertificate(null); + assertFalse(i2.equals(i)); + i2.setName(null); + assertFalse(i2.equals(i)); + + assertFalse(i.equals(new String())); + } +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/InstanceInformationTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/InstanceInformationTest.java new file mode 100644 index 00000000000..f0540bac635 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/InstanceInformationTest.java @@ -0,0 +1,65 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +public class InstanceInformationTest { + + @Test + public void testInstanceInformation() { + InstanceInformation i = new InstanceInformation(); + InstanceInformation i2 = new InstanceInformation(); + + // set + i.setDocument("doc"); + i.setSignature("sig"); + i.setDomain("sample.com"); + i.setService("sample.service"); + i.setCsr("sample_csr"); + i2.setDocument("doc"); + i2.setSignature("sig"); + i2.setDomain("sample.com"); + i2.setService("sample.service"); + + // getter assertion + assertEquals(i.getDocument(), "doc"); + assertEquals(i.getSignature(), "sig"); + assertEquals(i.getDomain(), "sample.com"); + assertEquals(i.getService(), "sample.service"); + assertEquals(i.getCsr(), "sample_csr"); + + assertTrue(i.equals(i)); + + assertFalse(i2.equals(i)); + i2.setService(null); + assertFalse(i2.equals(i)); + i2.setDomain(null); + assertFalse(i2.equals(i)); + i2.setSignature(null); + assertFalse(i2.equals(i)); + i2.setDocument(null); + assertFalse(i2.equals(i)); + + assertFalse(i.equals(new String())); + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/InstanceRefreshRequestTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/InstanceRefreshRequestTest.java new file mode 100644 index 00000000000..ea9d4fa90e3 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/InstanceRefreshRequestTest.java @@ -0,0 +1,47 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +public class InstanceRefreshRequestTest { + + @Test + public void testInstanceRefreshRequest() { + InstanceRefreshRequest i = new InstanceRefreshRequest(); + InstanceRefreshRequest i2 = new InstanceRefreshRequest(); + + // set + i.setCsr("test_csr"); + i.setExpiryTime(123456789); + i2.setCsr("test_csr"); + + // getter assertion + assertEquals(i.getCsr(), "test_csr"); + assertEquals(i.getExpiryTime(), (Integer) 123456789); + + assertTrue(i.equals(i)); + assertFalse(i.equals(i2)); + assertFalse(i2.equals(i)); + assertFalse(i.equals(new String())); + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/RoleAccessTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/RoleAccessTest.java new file mode 100644 index 00000000000..38d602a5934 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/RoleAccessTest.java @@ -0,0 +1,53 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import java.util.Arrays; +import java.util.List; + +import org.testng.Assert; +import org.testng.annotations.Test; + +public class RoleAccessTest { + + @Test + public void TestsetgetRoleAccess() { + + List roles = Arrays.asList("role1", "role2", "role3"); + RoleAccess ra = new RoleAccess().setRoles(roles); + + Assert.assertEquals(ra.getRoles(), roles); + } + + @Test + public void TestEqualsTrue() { + RoleAccess ra = new RoleAccess(); + ra.equals(ra); + } + + @Test + public void TestEqualsFalse() { + RoleAccess ra1 = new RoleAccess(); + RoleAccess ra2 = new RoleAccess(); + + List roles = Arrays.asList("role1", "role2", "role3"); + ra1.setRoles(roles); + Assert.assertFalse(ra1.equals(ra2)); + Assert.assertFalse(ra1.equals(new String())); + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/RoleTokenTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/RoleTokenTest.java new file mode 100644 index 00000000000..b87c640f650 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/RoleTokenTest.java @@ -0,0 +1,47 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +public class RoleTokenTest { + + @Test + public void testRoleToken() { + RoleToken rt = new RoleToken(); + RoleToken rt2 = new RoleToken(); + + // set + rt.setToken("sample_token").setExpiryTime(30L); + rt2.setToken("sample_token").setExpiryTime(40L); + + // getter assertion + assertEquals(rt.getToken(), "sample_token"); + assertEquals(rt.getExpiryTime(), 30L); + assertTrue(rt.equals(rt)); + assertFalse(rt.equals(rt2)); + rt2.setToken(null); + assertFalse(rt2.equals(rt)); + assertFalse(rt.equals(new String())); + + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/ServiceIdentityListTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/ServiceIdentityListTest.java new file mode 100644 index 00000000000..a9416a4431e --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/ServiceIdentityListTest.java @@ -0,0 +1,46 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import java.util.ArrayList; +import java.util.List; + +import org.testng.annotations.Test; + +public class ServiceIdentityListTest { + + @Test + public void testServiceIdentityList() { + ServiceIdentityList sil = new ServiceIdentityList(); + ServiceIdentityList sil2 = new ServiceIdentityList(); + + List nl = new ArrayList(); + nl.add("sample.service1"); + + sil.setNames(nl); + assertEquals(sil.getNames(), nl); + + assertTrue(sil.equals(sil)); + assertFalse(sil.equals(null)); + assertFalse(sil.equals(sil2)); + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/ServiceIdentityTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/ServiceIdentityTest.java new file mode 100644 index 00000000000..847eb06c49b --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/ServiceIdentityTest.java @@ -0,0 +1,112 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertTrue; + +import java.util.ArrayList; +import java.util.List; + +import org.testng.annotations.Test; + +import com.yahoo.rdl.Timestamp; + +public class ServiceIdentityTest { + + @Test + public void testsetgetServiceIdentity() { + ServiceIdentity si = new ServiceIdentity(); + ServiceIdentity si2 = new ServiceIdentity(); + PublicKeyEntry pkey = new PublicKeyEntry(); + + // set + pkey.setId("key01"); + pkey.setKey("pkey=="); + + List pkeylist = new ArrayList(); + pkeylist.add(pkey); + + List hosts = new ArrayList(); + hosts.add("example.host"); + + si.setExecutable("add-domain"); + si.setGroup("sample_group"); + si.setHosts(hosts); + si.setModified(Timestamp.fromMillis(1234567890123L)); + si.setName("apicomponent"); + si.setProviderEndpoint("sample_endpoint"); + si.setPublicKeys(pkeylist); + si.setUser("user.test"); + + si2.setExecutable("add-domain"); + si.setGroup("sample_group"); + si2.setHosts(hosts); + si2.setModified(Timestamp.fromMillis(1234567890123L)); + si2.setName("apicomponent"); + si2.setProviderEndpoint("sample_endpoint"); + si2.setPublicKeys(pkeylist); + si2.setUser("user.test"); + + // get assertions + assertEquals(pkey.getId(), "key01"); + assertEquals(pkey.getKey(), "pkey=="); + + assertEquals(si.getExecutable(), "add-domain"); + assertEquals(si.getGroup(), "sample_group"); + assertEquals(si.getHosts(), hosts); + assertEquals(si.getModified(), Timestamp.fromMillis(1234567890123L)); + assertEquals(si.getName(), "apicomponent"); + assertEquals(si.getProviderEndpoint(), "sample_endpoint"); + assertEquals(si.getPublicKeys(), pkeylist); + assertEquals(si.getUser(), "user.test"); + + // equals true + assertTrue(pkey.equals(pkey)); + assertTrue(si.equals(si)); + + // equals false + assertFalse(pkey.equals(new String())); + assertFalse(pkey.equals(new PublicKeyEntry())); + PublicKeyEntry pkey2 = new PublicKeyEntry().setKey("pkey=="); + assertFalse(pkey2.equals(pkey)); + + assertFalse(si.equals(new String())); + + si2.setGroup(null); + assertFalse(si2.equals(si)); + si2.setUser(null); + assertFalse(si2.equals(si)); + si2.setHosts(null); + assertFalse(si2.equals(si)); + si2.setExecutable(null); + assertFalse(si2.equals(si)); + si2.setModified(null); + assertFalse(si2.equals(si)); + si2.setProviderEndpoint(null); + assertFalse(si2.equals(si)); + si2.setPublicKeys(null); + assertFalse(si2.equals(si)); + si2.setName(null); + assertFalse(si2.equals(si)); + assertFalse(si2.equals(null)); + assertFalse(si.equals(new ServiceIdentity())); + + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/TenantDomainsTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/TenantDomainsTest.java new file mode 100644 index 00000000000..eed7fd529a5 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/TenantDomainsTest.java @@ -0,0 +1,56 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; + +import org.testng.Assert; +import org.testng.annotations.Test; + +public class TenantDomainsTest { + + @Test + public void TestsetgetTenantDomainNames() { + TenantDomains td = new TenantDomains(); + + List list = new ArrayList(Arrays.asList("A", "B", "C")); + + td.setTenantDomainNames(list); + + Assert.assertEquals(td.getTenantDomainNames(), list); + } + + @Test + public void TestEqualsTrue() { + TenantDomains td = new TenantDomains(); + td.equals(td); + } + + @Test + public void TestEqualsFalse() { + TenantDomains td1 = new TenantDomains(); + TenantDomains td2 = new TenantDomains(); + + td1.setTenantDomainNames(new ArrayList(Arrays.asList("A", "B", "C"))); + + Assert.assertFalse(td1.equals(td2)); + Assert.assertFalse(td1.equals(new String())); + } + +} diff --git a/core/zts/src/test/java/com/yahoo/athenz/zts/ZTSCoreTest.java b/core/zts/src/test/java/com/yahoo/athenz/zts/ZTSCoreTest.java new file mode 100644 index 00000000000..c24c0fe9809 --- /dev/null +++ b/core/zts/src/test/java/com/yahoo/athenz/zts/ZTSCoreTest.java @@ -0,0 +1,89 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.assertTrue; + +import org.testng.annotations.Test; + +import com.yahoo.rdl.Schema; +import com.yahoo.rdl.Validator; +import com.yahoo.rdl.Validator.Result; + +public class ZTSCoreTest { + + @Test + public void test() { + Schema schema = ZTSSchema.instance(); + assertNotNull(schema); + } + + @Test + public void testYRN() { + String [] goodYRNs = { + "domain:role.test1_", + "domain:role._test1_", + "domain:role._-test1_", + "domain:role._-----", + "domain:role._____", + "3com:role.3role_-", + "3com:entity", + "_domain:3entity_", + "domain:entity", + "my.domain:entity", + "my.domain:entity.path", + "yrn:::domain:entity", + "yrn:::my.domain:my.entity", + "yrn:service::domain:entity", + "yrn:my.service::domain:entity", + "yrn:my.service::my.domain:my.entity", + "yrn:service:location:domain:entity", + "yrn:some.service:some.location:my.domain:my.entity" + }; + + Schema schema = ZTSSchema.instance(); + Validator validator = new Validator(schema); + + System.out.println("Testing valid YRNs..."); + for (String s : goodYRNs) { + System.out.println(s); + Result result = validator.validate(s, "YRN"); + assertTrue(result.valid); + } + + String [] badYRNs = { + "domain:role.-----", + "-domain:role.role1", + "Non_ascii:��", + "cannot-start-with:-dash", + "cannot-use:Punctuation_except_underbar!", + "yrn::location_only", + "yrn:service:location_only", + "non_yrn_prefix:service:location:domain:entity", + "missing_yrn_prefix_service:location:domain:entity" + }; + + System.out.println("Testing bad YRNs..."); + for (String s : badYRNs) { + System.out.println(s); + Result result = validator.validate(s, "YRN"); + assertFalse(result.valid); + } + } +} diff --git a/docs/auth_flow.md b/docs/auth_flow.md new file mode 100644 index 00000000000..e018ff47468 --- /dev/null +++ b/docs/auth_flow.md @@ -0,0 +1,248 @@ +# Architecture - Authorization Flow +---------------------------------------- + +* [Use Cases](#use-cases) + * [Manage Access Control / Permissions for Resources](#manage-access-control-and-permissions-for-resources) + * [Real-Time Service Security](#real-time-service-security) +* [Authorization Flow](#authorization-flow) + * [Centralized Access Control (Control-Plane)](#centralized-access-control-control-plane) + * [Principals](#principals) + * [Unix-Authenticated User](#unix-authenticated-user) + * [Authenticated Service](#authenticated-service) + * [Decentralized Access Control (Data-Plane)](#decentralized-access-control-data-plane) + * [Policy Engine](#policy-engine) +* [Reserved Domains](#reserved-domains) +* [Management Scenarios](#management-scenarios) + * [Simple Centralized Scenario](#simple-centralized-scenario) + * [Multi-tenancy Scenario](#multi-tenancy-scenario) + * [Service Authentication](#service-authentication) + + +## Use Cases +------------ + +### Manage Access Control and Permissions for Resources +----------------------------------------------------- + +Athenz allows you to manage access control and permissions to resources +through the centralized authori**z**ation **m**anagement **s**ervice +(ZMS) and domain configuration that defines resources, roles, and +actions. + +The diagram below shows a simplification of the use case without domain +configuration. + +![Use Case for User Authorization](images/use_case-user_auth.png) + +Your domain configuration file gives you fine control over who can +access resources and what actions can be taken. ZMS manages your domain +files and provides a RESTful API that allows you to create and modify +domain configurations. + +This gives you the ability to control **user access**, +**tenancy**, and secure **editorial content** and **infrastructure +assets**. + +### Real-Time Service Security +------------------------------ + +Athenz provides endpoint protection for services, so a service such as +Sports in the diagram below doesn't need to set network ACLs for other +services wanting to access data. Instead, services are authorized by +Athenz to access resources from another service based on the permissions +defined by the domain administrator. + +![Use Case for Service Authorization](images/use_case-service_auth.png) + +## Authorization Flow +--------------------- + +### Centralized Access Control (Control-Plane) +---------------------------------------------- + +A traditional centralized mechanism works as expected for services that +are not dealing with the decentralized authorization: the server with +resources can simply ask the ZMS directly about access, passing the +NToken and resource/action information to get a simple boolean answer. +This does not scale well enough for data-plane access, since a central +service must be consulted, but requires no local installation of the ZPE +and related storage and synchronization logic, so it is suitable for +human interaction and control-plane provisioning uses. + +#### Principals +--------------- + +In Athenz, actors that can assume a role are called principals. +Principals can be users or services, and users can be those looking for +resources from a service or use the ZMS management console. In the +following sections, we'll look at centralized authorization for the +principals we just discussed. + +##### Unix-Authenticated User +----------------------------- + +In the simplest case, we have no service management at all. When a user, +authenticated with his/her unix credentials, is to be authorized to access +a resource in a service, the user's NToken is passed straight to the target +service. That service must then make a call to ZMS to perform the check, +passing this identity on to ZMS. + +The figure below shows how the user's tool fetches the user's token from +ZMS and then uses it to access a resource. + +![Centralized Authorization for Users](images/centralized_authz_for_users.png) + +When implementing such solution, one must consider all security implications +of sending a user's NToken to another service. Athenz system already provides +some protection from user NToken reuse: +* To request RoleTokens for a given User NToken, the IP address of the + incoming connection must match to the IP address that's in the NToken. +* To make modifications to a domain (e.g. the user is a domain admin) + the IP address of the incoming connection must match to the IP address + that's in the NToken. + +However, if there are multiple services that are supporting centralized +authorization for user, then each one must make sure that the NToken +identifying the user is coming from the same IP address that is registered +in the NToken. Otherwise, if the service1 is compromised, then the user's +NToken can be used to access the resources authorized to that user from +service2 without user's knowledge. + +##### Authenticated Service +--------------------------- + +Similarly, another service could be the principal (instead of a user or +domain manager), in which case it would present its NToken to the target +service, which would perform an identical check with ZMS to confirm +access. + +![Authenticated Service as Principal](images/centralized_authz_for_services.png) + +This model is more desirable that the Authenticated User model since +the domain administrator can create a separate service that only has +access for the given provider, thus provider having access to the +service's identity will not have access to any other resource. + +### Decentralized Access Control (Data-Plane) +--------------------------------------------- + +A more interesting scenario introduces the local policy engine (ZPE), +and a few supporting changes. Rather than directly asking for an access +check with a principal identity, the identity is instead used to get a +ZToken, and that is presented to the target service until it expires. +This mechanism allows a service to make a completely local access check +against ZPE, given a ZToken and locally cached policies. + +Specifically, as shown in the diagram below, the client service/user +presents an authentication token (NToken) from SIA Provider to get an +authorization token (ZToken) from ZTS, and then presents the ZToken +to a target service to access its resources. + +![Decentralized Authorization for Services](images/decentralized_authz_for_services.png) + +That service can make use of a local ZPE to validate the role assertions +in the ZToken, and then correlate them to the asynchronously updated +Policies for the domain involved. The ZPE can make the decision locally, +without going off box. It has no knowledge about specific users, only +roles, and because roles and policies are always in the domain, the +amount of data to distribute to the machine is small. + +#### Policy Engine +------------------ + +The Policy Engine (ZPE) only needs to deal with policies and their roles, +actions, and resources. Concepts like groups would only affect how a +principal can assume a role, so is involved in getting the ZToken, but not +using it in the ZPE. When evaluating policies, the relevant assertions of +all relevant policies must be considered. Assertions are treated like a +big "OR" with the default effect of "Allow", whereas any single "Deny" will +override any other assertions. The policies can have prefix-matching wildcards, +so that glob-style matching needs to be part of the "is this assertion relevant" +logic. + +The policies must be fetched from ZTS for the ZPE to operate. Additionally, the +policies must be refreshed as they change. It is expected that policies +will change at a much lower frequency than user/role assignments, so a daily +pull may be fine for this. + +The policies are not sensitive (secret) information, but their integrity is +important, so the policies fetched (per domain) is signed by both ZMS and ZTS +servers. This requires a predictable serialization of the policy data structures. +That will be fields in the order the schema specifies, serialized to JSON, then +signed. + +The actual fetch is performed by a locally running distribution agent, which could +be implemented as a cron job or other async fetching mechanism. The resulting policies +could be atomically changed per domain. Because the ZPE only will have policies for +the domains of services running on the same host/container, there will be relatively +few of them. + +The API for getting signed policies actually gets many policies in a single list, +which is signed as a whole according to the ordering rules above. + +## Reserved Domains +------------------- + +The following domains are reserved and are automatically provisioned during +server startup: + +* user - The reserved domain for authenticated users. +* sys - The reserved domain for managing system activities +* sys.auth - The Athenz domain itself, which is where policies governing + the top level domains reside. + +## Management Scenarios +----------------------- + +### Simple Centralized Scenario +------------------------------- + +In the simplest scenario, one would perform the following actions. Note that +even in this case, the management calls themselves are protected by Athenz, +so for example one property admin cannot modify another property's domain. + +1. Set up domains as a super admin +2. Assign domain administrators for the domain +3. Create services in the domain +4. Create roles, as the domain admin, to model the expected activity. Assign + users and services as needed. +5. Create policies, with references to resources that are the target of various actions +6. The services would implement the access check calls to enforce access + based on the ZMS "access check" API. This may happen in a container or filter. + +### Multi-tenancy Scenario +-------------------------- + +Setting up a tenant in a provider requires the concepts of a cross-domain +"trust relation". Such a trust relation can be implemented as follows: + +1. A Policy is set up in the group-defining domain (Domain-A) that asserts + that one of its local Roles can “assume” a role in the target Domain. + The role used in this policy is arbitrary, under the control of Domain-A, + who can add/remove users from it as it needs. +2. A Role is created in the target Domain-B, but instead of specifying users, + the trusted domain is set to Domain-A. +3. Domain-B can then set up whatever policies it needs to protect relevant + resources, by referring to its special role as the principal +4. At access check time, when the policy is encountered that indicates a role + that is trusted, that role (in another Domain) must then be consulted to + determine who can assume the role. + +### Service Authentication +-------------------------- + +Authenticating a service involves first registering the service with some +evidence that allow verification of a signed NToken originating from the +service. + +A simple scenario involves a service that is externally managed. Such a service +must arrange on its own to generate a keypair, and securely provide the private +key to the service. In such a case, the external management system must register +the service with its public key in the service management system. The result of +this will be a signing certificate. At that point, we have a public key to verify +the signature on any NTokens coming from the service. + +The NToken expires periodically, so the external service must repeatedly refresh it. +This requires careful handling and rotation of the keypairs, and while simple in +concept, every service would need to implement such a system. + diff --git a/docs/data_model.md b/docs/data_model.md new file mode 100644 index 00000000000..5cce3df56cc --- /dev/null +++ b/docs/data_model.md @@ -0,0 +1,290 @@ +# Architecture - Data Model +------------------------------- + +* [Concepts](#concepts) +* [Data Model](#data-model) + * [Terminology](#terminology) + * [Domains](#domains) + * [Resources](#resources) + * [Policies](#policies) + * [Roles](#roles) + * [Principals](#principals) + * [Users](#users) + * [Services](#services) +* [Tokens](#tokens) + * [Principal Token - NToken](#principal-token-ntoken) + * [Role Token - ZToken](#role-token-ztoken) + +Having a firm grasp on some fundamental concepts will help you +understand the Athenz architecture, the flow for both centralized and +decentralized authorization, and how to set up role-based authorization. + +## Concepts +----------- + +1. Role based Access Control (RBAC) system +2. Symbolic names are used to identify the entities involved in authorization, + so humans can read and understand the assertions +3. Namespaces are strictly partitioned into Domains, which imply an ownership + and control aspect to the names +4. Enforcement can be factored such that it can be done in a distributed way, + making possible data-plane checks that do not go off-box +5. Administrative tasks can be delegated to created subdomains to avoid reliance + on central "super user" administrative roles. +6. Multi-tenancy relationships across domains can also take advantage of delegated + administration +7. Cryptographic signatures are used to ensure the fidelity of assertions and + their lifecycle attributes +8. Policy orientation, as opposed to Resource orientation, allows few assertions + (in policies) to affect a potentially large number of resources, and also allows + more flexible scoping via wildcarding over groups of resources. +9. In Athenz, the authorization management server converts all incoming + data to lowercase before any processing - this applies to all data types + within Athenz (e.g. domain names, role names, policy names, resource + group values, etc). + + +## Data Model +------------- + +![Data Model](images/data_model.png) + +### Terminology +--------------- + +* Domain - a partition/namespace/account of control and isolation +* Role - an entity that takes action on resources, when assumed by a principal +* Resource - an entity to take action on, referred to by unique name +* Policy - a set of assertions that govern usage of resources +* Assertion - a quadruple of <effect, role, action, resource> +* Principal - an authenticated user or service that assumes one or more roles +* User - a user identity that is authenticate by a particular authority like Bouncer +* Service - An identity that exposes reusable resources, authenticated by + an Athenz-aware container, reachable via an explicit endpoint. +* Provider - a type of service that participates in the multi-tenant provisioning protocol. +* Tenant - a Domain that is provisioned to access some Resources in a Provider +* Group - A group is a Role with explicit principal assignments +* Control Plane - operations done to provision or otherwise setup a system, + outside its normal operation. +* Data Plane - operations done in the normal usage of a system, after it is + set up. These operations are usually highly performance sensitive + +There are numerous domains, and domains can themselves “contain” subdomains, +from a creation/deletion perspective. However, all domains and subdomains, +regardless of their administrative relationships, are independent and share +no state. Relationships between them (i.e. quotas, billing roll ups, etc) +must be explicitly introduced if desired. Roles, Policies and their Assertions, +and Services are all defined in a Domain. + +### Domains +----------- + +Domains are namespaces, strictly partitioned, providing a context for +authoritative statements to be made about entities it contains. Only +system administrators can create and destroy top level domains. Each +such domain is assigned users in an administrative role. Those admins +can, in turn, create and delete subdomains, that is, domains that start +with the parent domain as a prefix, using a '.' as a domain delimiter. +For example, "media" is a top level domain, and "media.news" is a +subdomain of it. It is important to note that the only relation between +these two domains involves creation and destruction of the domains -- +the two domains share no state by default, and there is no inheritance +or other relation between them other than that implied by their names. +This allows all domains (whether top level or subdomains) to be +completely partitioned from each other, and the ownership of the +entities defined within a domain is clear. + +A domain is a place to group your resources and entities. + +- All resources are partitioned across some set of domains +- Domains are given a symbolic name, so humans can easily understand a + reference to them +- The domain name is used as a namespace for resource names +- Domains are similar the concept of an account, and provides a + “walled garden” in which to operate + +### Resources +------------- + +Resources aren't explicitly modeled in Athenz, they are referred to by +name. A resource is something that is "owned" and controlled in a +specific domain. + +- Concrete example: a machine +- Abstract example: a security policy +- Identified by a canonical name, so humans can comprehend references + to it + +When referring to resources for authorization, a global naming system +needs to be introduced to handle names in namespaces. A Resource +Name is defined as follows: + + {Domain}:{Entity} + +The Domain is the namespace mentioned above, and the Entity is an entity +path (delimited by periods) within that namespace. The two are often +used together to form a short resource name. For example, if the +media.news property provisions a table in a db service, the resource +name for the table may look like this: + + media.news:storage.db.table + +### Policies +------------ + +To implement access control, we have policies in our domain that govern +the use of our resources. A policy is a set of assertions (rules) about +granting or denying an operation/action on a resource. For example, the +assertion `[grant, update, dev, storage.db.table]` would grant the +**update** operation/action to all the members in the **dev** role on +the **storage.db.table** resource. Note that the assertion fields are +declared as general strings, as they may contain "globbing" style +wildcards, for example "media.news:role.*", which would apply to any +entity that matched the pattern. + +### Roles +--------- + +A role can be thought of as a group, anyone in the group can *assume* +the role that takes a particular action. Every policy assertion +describes what can be done by a role. + +A role can also delegate the determination of membership to another +trusted domain. For example, a netops role managed outside a property +domain. This is how we can model tenant relations between a provider +domain and tenant domains. + +Because roles are defined in domains, they can be partitioned by domain, +unlike users, which are global. This allows the distributed operation to +be more easily scaled. + +### Principals +-------------- + +The actors in Athenz that can assume a role are called principals. These +principals are authenticated and can be users (for example, authenticated by +their Unix or Kerberos credentials). Principals can also be services that +are authenticated by a service management system. Athenz currently provides +service identity and authentication support. In either case, the identity +is expressed as a resource name, and the proof of that identity is provided +as a token, typically called an NToken (aka PrincipalToken). + +#### Users +---------- + +Users are actually defined in some external authority, e.g. Unix or Kerberos +system. A special domain is reserved for the purpose of namespacing users, +the name of that domain is **user**, so some example users are: + +* user.john +* user.doe + +The credentials that the external system requires are exchanged for a NToken +before operating on any data. + +#### Services +------------- + +The concept of a Service Identity is introduced as the identity of independent +agents of execution. Services are defined as a subdomain of the managing domain, +which provides a simple way of naming them. For example: + +* media.news.msbe +* sports.storage + +The relationship of a service identity and its parent domain essentially means +that the parent domain is an authority for the service itself, from a management +perspective. + +A Service Identity may be used as a principal when specifying Roles, just like a +User. Athenz provides support for registering such a Service Identity, in a domain, +along with its public key that can be used to later verify an NToken that is +presented by the service. + +## Tokens +-------- + +Athenz authorization system utilizes 2 types of tokens: Principal Tokens +(NTokens) and RoleTokens (ZTokens). + +### Principal Token (NToken) +---------------------------- + +The Principal token can be thought of an identity token because it +identifies either a user or a service. Users submit their credentials +to ZMS, which validates those credentials and generates, signs and +returns principal tokens. A service generates its principal token using +the service's private key. The principal token can then be used to access +role tokens. + +A principal token is serialized as a string with following attributes: + +- version (v) - the version of the token - U1 for user tokens and S1 + for service tokens +- domain (d) - the domain of principal. For users this will always be + "user" +- name (n) - the name of the principal +- host (h) - the FQDN of the host that issued this token +- salt (a) - a salt +- time (t) - the time the token was issued +- expires (e) - the time the token expires +- keyId (k) - the key identifier of the private key that was used to + sign this token +- ip (i) - the IP address where the request to get this token was + initiated from +- authorized-services (b) - the list of services authorized to use + this user token +- signature (s) - the signature of the other items + +The single letter in parentheses is the key in the serialized string, +where semicolons separate key value pairs, and the key and value are +separated by an equals sign. + +For example: + + v=U1;d=user;n=joe;h=host.athenz.org;a=bb4e;t=1442255237;e=1442258837;k=0;i=10.72.42.32;s=Jw8SvYGYrk + +Note that requests that include a principal token should be protected to +keep the token from being intercepted and reused (for the lifetime of +the token). It is strongly recommended to always use HTTPS for such +requests. + +### Role Token (ZToken) +----------------------- + +Role tokens represent an authoritative statement that a given principal +may assume some number of roles in a domain for a limited period of +time. Like NTokens, they are signed to prevent tampering. In a sense, +the ZTS is an authority except that it is an authority +over Roles instead of Users. + +A role token is serialized as a string with following attributes: + +- version (v) - the version of the token - Z1 +- domain (d) - the domain of role token +- roles (r) - a list of comma-separated role names +- principal (p) - the name of the principal (user/service) who + requested this role token +- host (h) - the FQDN of the ZTS host that issued this token +- salt (a) - a salt +- time (t) - the time the token was issued +- expires (e) - the time the token expires +- keyId (k) - the key identifier of the ZTS private key that was + used to sign this token +- ip (i) - the IP address where the request to get this token was + initiated from +- signature (s) - the signature of the other items + +The single letter in parentheses is the key in the serialized string, +where semicolons separate key value pairs, and the key and value are +separated by an equals sign. + +For example: + + v=Z1;d=media.news;r=editor;p=user.joe;h=host.athenz.com;a=bb4e;t=1442255237;e=1442258837;k=0;i=10.72.42.32;s=P43Vp_LQh1" + +Note that requests that include a ZToken should be encrypted to keep the +ZToken from being intercepted and reused (for the lifetime of the +token). It is strongly recommended to always use HTTPS for such +requests. + diff --git a/docs/dev_centralized_access.md b/docs/dev_centralized_access.md new file mode 100644 index 00000000000..c98d242f19c --- /dev/null +++ b/docs/dev_centralized_access.md @@ -0,0 +1,123 @@ +# Developer Guide - Centralized Access Control +---------------------------------------------- + +* [Client - Obtaining NTokens from SIA Provider](#client---obtaining-ntokens-from-sia-provider) +* [Server - Authorization Checks](#server---authorization-checks) + +In the centralized access control model, the service as a principal +requests its NToken from SIA Provider and then presents it to the +target service which would perform an identical check with ZMS to confirm +access. + +![Authenticated Service as Principal](images/centralized_authz_for_services.png) + +The required steps to setup the environment for provider and tenant +services to support centralized access control are as follows: + +* System administrator creates the provider and tenant domains. +* Tenant Domain administrator generates a public/private key pair + and registers a service in its domain. +* Provider Domain administrator creates a role and policy that + grants access to the given role with configured action and resource. +* Provider Domain administrator adds the Tenant Service to the + role to grant access. +* Tenant Domain administrator installs the private key on the host + that will be running the client/tenant service. + +The next two sections describe the code changes that the developers +must make to their services to support authorized access. + +## Client - Obtaining NTokens from SIA Provider +----------------------------------------------- + +First you need to update your Java project `pom.xml` file to indicate +the dependency on the Athenz auth_core Library: + +``` + + com.yahoo.athenz + auth_core + 1.X.Y + +``` + +The domain administrator must have already generated a public/private key pair +for the service and registered public key in Athenz. The private key must be +available on the host where the service will be running. + +``` + // we're going to extract our private key from a given file + + File rsaPrivateKey = new File("/home/athenz/service/rsa_private.key"); + PrivateKey privateKey = Crypto.loadPrivateKey(rsaPrivateKey); + + // setup the key identifier that the corresponding public key + // has been registered in ZMS, and set the timeout to be 1 hour + + String keyId = "v0"; + long tokenTimeout = TimeUnit.SECONDS.convert(1, TimeUnit.HOURS); + + // create our authority and sia provider object + + Authority authority = new PrincipalAuthority(); + SimpleServiceIdentityProvider siaProvider = + new SimpleServiceIdentityProvider(authority, privateKey, keyId, tokenTimeout); + + // generate a principal for our given domain and service + + Principal principal = siaProvider.getIdentity(domainName, serviceName); + + // include the principal.getSignedToken() string as the value for the + // Athenz-Principal-Auth header +``` + +## Server - Authorization Checks +-------------------------------- + +On the server side the we just need to determine the specific requests +action and the resource, extract the NToken string from the +Athenz-Principal-Auth header value and contact ZMS to carry out the +authorization check. + +First you need to update your Java project `pom.xml` file to indicate +the dependency on the Athenz zms java client Library: + +``` + + com.yahoo.athenz + zms_java_client + 1.X.Y + +``` + +Now, the most important part of the rest of the required code is to +determine the resource and action based on the given http request. +Once you have those two values determined, then all that is left +is to extract the NToken and contact ZMS for the authorization +check. + +``` + HttpServletRequest req = (HttpServletRequest)servletRequest; + + // your method of extracting the resource value from the http + // request. It might need to look at just the URI or possibly + // the full body of the request. + + String resource = translateToMyServiceResource(req); + + // your method of extracting an action string from the http + // request. + + String action = translateToMyServiceAction(req); + + // finally extract the ntoken from the header. + + String nToken = req.getHeader(“Athenz-Principal-Auth”); + + // create a zms authorizer and contact ZMS to carry out the check + + ZMSAuthorizer authorizer = new ZMSAuthorizer(serviceDomain); + boolean access = authorizer.access(action, resource, nToken, null); + + + diff --git a/docs/dev_decentralized_access.md b/docs/dev_decentralized_access.md new file mode 100644 index 00000000000..25b773d395f --- /dev/null +++ b/docs/dev_decentralized_access.md @@ -0,0 +1,455 @@ +# Developer guide - Decentralized Access Control +------------------------------------------------------- + +* [Client - Obtaining RoleTokens from ZTS Server](#client---obtaining-roletokens-from-zts-server) + * [Obtaining ServiceIdentityProvider object](#obtaining-serviceidentityprovider-object) + * [ZTS Client Object](#zts-client-object) + * [Obtaining a Role Token](#obtaining-a-role-token) + * [ZTS getRoleToken Error Codes](#zts-getroletoken-error-codes) + * [Token Caching](#token-caching) + * [Token Prefetch Caching](#token-prefetch-caching) +* [Server - Authorization Checks](#server---authorization-checks) + +In the decentralized access control model, the client service/user +presents an authentication token (NToken) from SIA Provider to get an +authorization token (ZToken) from ZTS, and then presents the ZToken +to a target service to access its resources. + +![Decentralized Authorization for Services](images/decentralized_authz_for_services.png) + +The required steps to setup the environment for provider and tenant +services to support centralized access control are as follows: + +* System administrator creates the provider and tenant domains. +* Tenant Domain administrator generates a public/private key pair + and registers a service in its domain. +* Provider Domain administrator creates a role and policy that + grants access to the given role with configured action and resource. +* Provider Domain administrator adds the Tenant Service to the + role to grant access. +* Provider Domain administrator installs Athenz Policy Engine + Updater (ZPU) on the hosts that will be running the provider + service. ZPU must be configured with the provider domain name + and setup to run as a cron job to periodically download the + latest policy files for the server/provider domain. +* Tenant Domain administrator installs the private key on the host + that will be running the client/tenant service. + +The next two sections describe the code changes that the developers +must make to their services to support authorized access. + +## Client - Obtaining RoleTokens from ZTS Server +------------------------------------------------ + +The client must carry out two major steps in order to retrieve a role +token from ZTS Server. First, using the service's name and private key +it needs to generate a ServiceIdentityProvider object which then it +can use to retrieve a role token using ZTS Client Library. + +### Obtaining ServiceIdentityProvider object +-------------------------------------------- + +First you need to update your Java project `pom.xml` file to indicate +the dependency on the Athenz auth_core Library: + +``` + + com.yahoo.athenz + auth_core + 1.X.Y + +``` + +The domain administrator must have already generated a public/private key pair +for the service and registered public key in Athenz. The private key must be +available on the host where the service will be running. + +``` + // we're going to extract our private key from a given file + + File rsaPrivateKey = new File("/home/athenz/service/rsa_private.key"); + PrivateKey privateKey = Crypto.loadPrivateKey(rsaPrivateKey); + + // setup the key identifier that the corresponding public key + // has been registered in ZMS, and set the timeout to be 1 hour + + String keyId = "v0"; + long tokenTimeout = TimeUnit.SECONDS.convert(1, TimeUnit.HOURS); + + // create our authority and sia provider object + + Authority authority = new PrincipalAuthority(); + SimpleServiceIdentityProvider siaProvider = + new SimpleServiceIdentityProvider(authority, privateKey, keyId, tokenTimeout); +``` + +### ZTS Client Object +--------------------- + +First you need to update your Java project `pom.xml` file to indicate +the dependency on the ZTS Java Client Library: + +``` + + com.yahoo.athenz + zts_java_client + 1.X.Y + +``` + +ZTS Client Library provides several constructors; however, the most +commonly used one would be the constructor to create a client object +based on a given domain and service identifier. + +``` + /** + * Constructs a new ZTSClient object with the given service identity + * and media type set to application/json. The url for ZTS Server is + * automatically retrieved from the athenz_config package's configuration + * file (zts_url field). The service's principal token will be retrieved + * from the SIA Provider. + * Default read and connect timeout values are 30000ms (30sec). The application can + * change these values by using the yahoo.zts_java_client.read_timeout and + * yahoo.zts_java_client.connect_timeout system properties. The values specified + * for timeouts must be in milliseconds. + * @param domainName name of the domain + * @param serviceName name of the service + * @param siaProvider ServiceIdentityProvider object for the given service + */ + public ZTSClient(String domainName, String serviceName, ServiceIdentityProvider siaProvider); +``` + +ZTSClient object must be closed to release any allocated resources. ZTSClient +class implements Closeable interface. + +The client library automatically retrieves the URL of the ZTS server +from its configuration file. + +For example, if you have already registered service called `storage` in +the domain `athenz`, use the command below to instantiate a ZTS +Client object: + +``` + SimpleServiceIdentityProvider siaProvider = + new SimpleServiceIdentityProvider(authority, privateKey, keyId, tokenTimeout); + try (ZTSClient ztsClient = new ZTSClient("athenz", "storage", siaProvider)) { + // carry out requests against ZTS Server + } +``` + +If your application will only handle a single service, then rather than +creating and destroying a ZTSClient object for every request, you can +just create a single instance of the ZTSClient and use that instance +by multiple threads to request role tokens: + +``` + // in your service initialization method + + void initZTSClient(String domainName, String serviceName, String privateKeyPath, String keyId) { + + File rsaPrivateKey = new File("/home/athenz/service/rsa_private.key"); + PrivateKey privateKey = Crypto.loadPrivateKey(rsaPrivateKey); + + // set the timeout to be 1 hour + + long tokenTimeout = TimeUnit.SECONDS.convert(1, TimeUnit.HOURS); + + // create our authority and sia provider object + + Authority authority = new PrincipalAuthority(); + SimpleServiceIdentityProvider siaProvider = + new SimpleServiceIdentityProvider(authority, privateKey, keyId, tokenTimeout); + ztsClient = new ZTSClient(domainName, serviceName, siaProvider); + } + + // then in our service processing code you can use the ztsClient + // instance to retrieve role tokens for your requested domain and role + + RoleToken roleToken = ztsClient.getRoleToken(providerDomain, roleName); +``` + +### Obtaining a Role Token +-------------------------- + +To obtain a Role Token, the application would use one the following methods +from the `ZTSClient` class: + +``` + /** + * For the specified requester(user/service) return the corresponding Role Token that + * includes the list of roles that the principal has access to in the specified domain. + * The client will automatically fulfill the request from the cache, if possible. + * The default minimum expiry time is 900 secs (15 mins). + * @param domainName name of the domain + * @return ZTS generated Role Token. ZTSClientException will be thrown in case of failure + */ + public RoleToken getRoleToken(String domainName); + + /** + * For the specified requester(user/service) return the corresponding Role Token that + * includes the specified role name that the principal has access to in the specified + * domain. The client will automatically fulfill the request from the cache, if possible. + * The default minimum expiry time is 900 secs (15 mins). + * @param domainName name of the domain + * @param roleName only interested in roles with this value + * @return ZTS generated Role Token. ZTSClientException will be thrown in case of failure + */ + public RoleToken getRoleToken(String domainName, String roleName); +``` + +In the simplest case, the method only requires the caller to specify the +domain that the application will be accessing. Thus, it needs a Role +Token for that domain. For example, if the `athenz.storage` service +identifier is trying to access a resource from a domain `weather`, then +the API call to retrieve the `roleToken` would be the following: + +``` + RoleToken roleToken = null; + try { + roleToken = ztsClient.getRoleToken("weather"); + } catch (ZTSClientException ex) { + // log error using ex.getCode() and ex.getMessage() + } +``` + +Then the client will include the retrieved Role Token value as one of +its headers when submitting its request to the provider service: + +``` + ztsClient.getHeader(); // returns Header name: "Athenz-Role-Auth" + roleToken.getToken() // returns header value +``` + +However, the above method returns a RoleToken that includes all the roles +the given principal has access to the provider domain. This may not be +desirable as it violates the principle of least privilege. Instead, the +caller should (in fact, the system administrator has the option to require +this rather than making it possible) specify the roleName that it requires +to complete its request.For example, if the `athenz.storage` service +identifier is trying to access a resource from a domain `weather` and requires +only read access which is granted to the service as being member of the `readers` +role in the `weather` domain, then the API call to retrieve the `roleToken` +would be the following: + +``` + RoleToken roleToken = null; + try { + roleToken = ztsClient.getRoleToken("weather", "readers"); + } catch (ZTSClientException ex) { + // log error using ex.getCode() and ex.getMessage() + } +``` + +#### ZTS getRoleToken Error Codes +--------------------------------- + +When communicating with ZTS Server to obtain a RoleToken, the ZTS Server +will return the following 4xx error codes if it's unable to successfully +process the request: + +- **400** The domain name specified in the request to issue a + RoleToken for contains invalid characters. +- **401** The request could not be successfully authenticated. This + usually indicates that either the Service is not properly registered + in ZMS or there is a mismatch between the registered public key and + the private key that was used to generate the ServiceToken. +- **403** The service identity does not have access to any resources + in the specified domain. +- **404** The domain specified in the request to issue a RoleToken for + does not exist. + +### Token Caching +----------------- + +The ZTS Client Library automatically caches any tokens returned by the +ZTS Server, so any subsequent requests for a Role Token for the same +domain are fulfilled from the local cache as opposed to connecting to +the ZTS Server every time. This provides better performance by reusing +the same Role Token because they’re valid for two hours by default. The +client library will only return cached Role Tokens if they’re valid for +at least 15 minutes. If you want to change this default time, the +application can set the following system property before starting their +application: + + athenz.zts.client.token_min_expiry_time + +The value of this property must be specified in seconds. If for any +reason you need to disable caching or have better control how long to +cache tokens, the application can use the full `getRoleToken` API as +shown below: + +``` + /** + * For the specified requester(user/service) return the corresponding + * Role Token that includes the list of roles that the principal has + * access to in the specified domain + * @param domainName name of the domain + * @param roleName (optional) only interested in the specified role + * @param trustDomain (optional) only look for trusted roles in this domain + * @param minExpiryTime (optional) specifies that the returned RoleToken + * must be at least valid (min/lower bound) for specified number + * of seconds, + * @param maxExpiryTime (optional) specifies that the returned RoleToken + * must be at most valid (max/upper bound) for specified number + * of seconds. + * @param ignoreCache ignore the cache and retrieve the token from ZTS Server + * @return ZTS generated Role Token + */ + public RoleToken getRoleToken(String domainName, String roleName, + Integer minExpiryTime, Integer maxExpiryTime, boolean ignoreCache); +``` + +To completely disable caching, the `ignoreCache` argument (the last +boolean argument) in the `getRoleToken` method can be passed `true`. + +For example, the following call disables caching: + +``` + RoleToken roleToken = null; + try { + roleToken = ztsClient.getRoleToken("weather", "readers", null, null, null, true); + } catch (ZTSClientException ex) { + // log error using ex.getCode() and ex.getMessage() + } +``` + +The code above will contact the ZTS Server every time the applications +requests a role token for accessing resources in domain `weather`. + +The other two important arguments for token caching are the +`minExpiryTime` and `maxExpiryTime` arguments. When passed `null`, the +client library uses the default values, which as described above gets +tokens that are valid for two hours and caches them until they’re 15 +minutes from expiration time. + +If your application wants to take advantage of longer caching, then it +can request tokens from the ZTS Server with an expiration time longer +than the default two hours. For example, the requirements for your +server might be that you can use role tokens that must be at least 30 +minutes from expiration and they can be valid for up to four hours. + +For example, the following would set up the API call that requests +tokens from the Weather server that can only be used if they are 30 +minutes from expiration and last four hours: + +``` + RoleToken roleToken = null; + try { + roleToken = ztsClient.getRoleToken("weather", "readers", null, + 30 * 60, 4 * 60 * 60, true); + } catch (ZTSClientException ex) { + // log error using ex.getCode() and ex.getMessage() + } +``` + +With the above request configuration, your client library will only make +a single connection to the ZTS Server to retrieve a new token once every +three hours and 30 minutes. All other requests within that time frame +will be fulfilled from the local cache. + +### Token Prefetch Caching +--------------------------- + +In addition to the caching described above, the cache can be kept +`fresh` automatically by the ZTS Client library. The library detects +when a token will expire within a short period of time and will actively +retrieve a new token to replace it. In this way, the client will always +get a usable token from the cache. With configuration, the prefetch +mechanism can be triggered automatically upon calling any of the +`getRoleToken` API. + +By default the feature is disabled, but can be enabled via a System +Property. Here is an example of enabling automatic prefetch of tokens. + +``` + athenz.zts.client.prefetch_auto_enable=true +``` + +To use the prefetch caching feature with `getRoleToken`, specify the +`ignoreCache` boolean argument with value `false`. + +## Server - Authorization Checks +-------------------------------- + +In the Athenz enabled server the general processing of a client request +goes as follows: + +1. Your service extracts the Role Token from the header + (`Athenz-Role-Auth`) of the incoming request which it will pass it to + the ZPE API. +2. Your service determines the Action and Resource based on the client + request. Then the service calls the ZPE API with the Action, + Resource, and Role Token to determine authorization access. + +Additionally, the system administrator needs to make sure that +ZPU (Athenz ZPE Policy Updater) utility is installed and configured +to run on the server host. ZPU will download the configured domain +policy data that is used by the ZPE library for authorization +checks. + +First, you need to update your Java project `pom.xml` file to indicate +your dependency on the ZPE Java Client Library: + +``` + + com.yahoo.athenz + zpe_java_client + 1.X.Y + +``` + +Now, the most important part of the rest of the required code is to +determine the resource and action based on the given http request. +Once you have those two values determined, then all that is left +is to extract the ZToken and call ZPE method for the authorization +check. + +``` + HttpServletRequest req = (HttpServletRequest)servletRequest; + + // your method of extracting the resource value from the http + // request. It might need to look at just the URI or possibly + // the full body of the request. + + String resource = translateToMyServiceResource(req); + + // your method of extracting an action string from the http + // request. + + String action = translateToMyServiceAction(req); + + // finally extract the ntoken from the header. + + String zToken = req.getHeader(“Athenz-Role-Auth”); + + // this is a thread-safe call + + AccessCheckStatus status = AuthZpeClient.allowAccess(zToken, resource, action); + if (status != AccessCheckStatus.ALLOW) { + // status provides specific enum value for each reason + // why the access check was denied. For example - here are + // some of the possible values that are returned: + // AccessCheckStatus.DENY - specific rule caused the deny effect + // AccessCheckStatus.DENY_NO_MATCH - there was no match to any assertions + // defined in the domain policy file so the default DENY effect was returned + // AccessCheckStatus.DENY_ROLETOKEN_INVALID - The roletoken provided in the + // request was either invalid or expired + throw new Exception(“Access denied”); + } +``` + +If you want to know which role caused the allow or deny a match to be +returned by the API call, you can use the following API: + +``` + StringBuilder matchRoleName = new StringBuilder(256); + AccessCheckStatus status = AuthZpeClient.allowAccess(zToken, resource, action, matchRoleName); + if (status != AccessCheckStatus.ALLOW) { + throw new Exception(“Access denied”); + } +``` + +The variable `matchRoleName` will include the name of the role from the +assertion that matched the given action and resource. + + diff --git a/docs/dev_environment.md b/docs/dev_environment.md new file mode 100644 index 00000000000..4f90703e9b5 --- /dev/null +++ b/docs/dev_environment.md @@ -0,0 +1,58 @@ +# Development Environment +------------------------- + +* [Development Tools](#development-tools) + * [Java Platform JDK 8](#java-platform-jdk-8) + * [Maven](#maven) + * [Git Client](#git-client) + * [Go](#go) +* [Build Steps](#build-steps) + +## Development Tools +-------------------- + +If you would like to build your own copy of Athenz rather than +using the pre-built binary packages, then here is the list of +development tools you need to have installed on your system. + +### Java Platform JDK 8 +----------------------- + +To build Athenz components, you must have Java Platform JDK 8 installed +on your machine. The main authorization services - ZMS and ZTS, are +written in Java and using embedded Jetty. + +[Oracle Java Platform JDK 8](http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html) + +Athenz has been developed and tested with Oracle Java Platform JDK 8. +However, it should compile and run without any issues with OpenJDK 8 as well. + +### Maven +--------- + +Download and install [Apache Maven](http://maven.apache.org/download.cgi). + +### Git Client +-------------- + +If you don't have git client installed on your host, you can download +one from [Git website](https://git-scm.com/downloads) + +### Go +------ + +Install go by following the directions at +[Getting Started - The Go Programming Language](https://golang.org/doc/install). + +## Build Steps +-------------- + +To build Athenz components, change to the top level directory where +Athenz code has been checked out and execute: + +``` +git clone https://github.com/yahoo/AtheNZ.git +cd AtheNZ +mvn clean install +``` + diff --git a/docs/images/centralized_authz_for_services.png b/docs/images/centralized_authz_for_services.png new file mode 100644 index 00000000000..1d55aefb416 Binary files /dev/null and b/docs/images/centralized_authz_for_services.png differ diff --git a/docs/images/centralized_authz_for_users.png b/docs/images/centralized_authz_for_users.png new file mode 100644 index 00000000000..7dfa0667edb Binary files /dev/null and b/docs/images/centralized_authz_for_users.png differ diff --git a/docs/images/data_model.png b/docs/images/data_model.png new file mode 100644 index 00000000000..515b76f364e Binary files /dev/null and b/docs/images/data_model.png differ diff --git a/docs/images/decentralized_authz_for_services.png b/docs/images/decentralized_authz_for_services.png new file mode 100644 index 00000000000..4d9435f8974 Binary files /dev/null and b/docs/images/decentralized_authz_for_services.png differ diff --git a/docs/images/system_view.png b/docs/images/system_view.png new file mode 100644 index 00000000000..1f92da7d45a Binary files /dev/null and b/docs/images/system_view.png differ diff --git a/docs/images/use_case-service_auth.png b/docs/images/use_case-service_auth.png new file mode 100644 index 00000000000..7a6e92349ec Binary files /dev/null and b/docs/images/use_case-service_auth.png differ diff --git a/docs/images/use_case-user_auth.png b/docs/images/use_case-user_auth.png new file mode 100644 index 00000000000..0396feb010a Binary files /dev/null and b/docs/images/use_case-user_auth.png differ diff --git a/docs/reg_service_guide.md b/docs/reg_service_guide.md new file mode 100644 index 00000000000..05e59d89c9e --- /dev/null +++ b/docs/reg_service_guide.md @@ -0,0 +1,82 @@ +# Registering ZMS Service Identity +---------------------------------- + +* [Key Generation](#key-generation) + * [Private Keys](#private-keys) + * [Key Rotation](#key-rotation) +* [Service Identity Registration](#service-identity-registration) + +Once a domain has been registered in Athenz, the administrator will +register service identities that are specified in domain roles and +policy assertions. The latter can reference those roles having access to +specified resources. + +Before you can register the service identity, you'll need to generate +keys. We'll cover how to create the keys and register the service +identity next. + +## Key Generation +---------------- + +The registration process requires the domain administrator to generate a +private/public RSA key pair (recommended to be at least 2048 bit) +for the service. Athenz also supports EC keys. + +The following are the keys and the services that use those keys: + +- **private key** - The service agent uses the private key to generate a + `ServiceToken` identifying the service. +- **public key** - ZMS/ZTS then use the public key to validate the + `ServiceToken` generated by service agent. + +The `openssl` command-line utility is used to generate the key pair: + + $ openssl genrsa -out service_private.pem 2048 + $ openssl rsa -in service_private.pem -pubout > service_public.pem + + +The zms-cli client utility requires that the public key have an extension +of .pem. + +### Private Keys +---------------- + +The private key file must be installed on all hosts where the client +service will be running. + +Each key pair has a key identifier that will be included in the +generated `ServiceTokens (NToken)` as the value of the `k` component. If +the service’s private key has been compromised or the service has a policy +to periodically rotate the keys, the service administrator will generate +a new key pair, remove the public key with the old identifier, and +register a new public key with a different key identifier. Typically, a +service would start with "0" as its first identifier and increment when +required. + +### Key Rotation +---------------- + +If the service’s private key has been compromised or the service has a +policy to periodically rotate the keys, the service administrator will +generate a new key pair, remove the public key with identifier 0 and +register a new public key with a different key identifier as shown +below: + + $ zms-cli -d delete-public-key 0 + $ zms-cli -d add-public-key 1 new_service_public.pem + +As mentioned above, the key identifier is included in generated Service +Tokens as the value of the `k` component. + +## Service Identity Registration +-------------------------------- + +To create a service identity object in ZMS with the generated public key: + + $ zms-cli -d add-service + +For example, to register the service "storage" in the domain ``athenz`` +with the key identifier ``0`` and the public key stored in the file ``storage_public.pem``, +run the following ``zms-cli`` command: + + $ zms-cli -d athenz add-service storage 0 ./storage_public.pem diff --git a/docs/setup_zms.md b/docs/setup_zms.md new file mode 100644 index 00000000000..27cc738d128 --- /dev/null +++ b/docs/setup_zms.md @@ -0,0 +1,93 @@ +# Setup ZMS (AuthoriZation Management System) +--------------------------------------------- + +* [Requirements](#requirements) + * [JDK 8](#jdk-8) +* [Getting Software](#getting-software) +* [Configuration](#configuration) + * [Private/Public Key Pair](#privatepublic-key-pair) + * [Self Signed X509 Certificate](#self-signed-x509-certificate) +* [Start ZMS Server](#start-zms-server) + +## Requirements +--------------- + +The following tools are required to be installed on hosts +configured to run ZMS server. + +### JDK 8 +--------- + +ZMS Server is written in Java and using embedded Jetty. + +[Oracle Java Platform JDK 8](http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html) + +While ZMS has been developed and tested with Oracle Java Platform JDK 8 +it should run successfully with OpenJDK 8 as well. + +## Getting Software +------------------- + +Download latest ZMS binary release from + +``` +https://github.com/yahoo/AtheNZ/releases/latest +``` + +```shell +$ tar xvfz athenz-zms-X.Y-bin.tar.gz +$ cd athenz-zms-X.Y +``` + +## Configuration +---------------- + +To run ZMS Server, the system administrator must generate the keys +and make necessary changes to the configuration settings. + +### Private/Public Key Pair +--------------------------- + +Generate a unique private/public key pair that ZMS Server will use +to sign any NTokens it issues. From the `athenz-zms-X.Y` directory +execute the following commands: + +``` +cd var/zms_server/keys +openssl genrsa -out zms_private.pem 2048 +openssl rsa -in zms_private.pem -pubout > zms_public.pem +``` + +### Self Signed X509 Certificate +-------------------------------- + +Generate a self-signed X509 certificate for ZMS Server HTTPS +support. After we generate the X509 certificate, we need to add +that certificate along with its private key to a keystore for Jetty +use. From the `athenz-zms-X.Y` directory execute the following +commands: + +``` +cd var/zms_server/certs +openssl req -x509 -newkey rsa:2048 -keyout zms_key.pem -out zms_cert.pem -days 365 +``` + +Generate a keystore in PKCS#12 format: + +``` +openssl pkcs12 -export -out zms_keystore.pkcs12 -in zms_cert.pem -inkey zms_key.pem +``` + +## Start ZMS Server +------------------- + +Set the required Athenz ROOT environment variable to the `athenz-zms-X.Y` +directory and from there start the ZMS Server by executing: + +``` +export ROOT= +sudo -E bin/zms_start.sh +``` + +Based on the sample configuration file provided, ZMS Server will be listening +on port 4443. diff --git a/docs/setup_zts.md b/docs/setup_zts.md new file mode 100644 index 00000000000..cb53c590f93 --- /dev/null +++ b/docs/setup_zts.md @@ -0,0 +1,130 @@ +# Setup ZTS (authoriZation Token System) +---------------------------------------- + +* [Requirements](#requirements) + * [JDK 8](#jdk-8) +* [Getting Software](#getting-software) +* [Configuration](#configuration) + * [Private/Public Key Pair](#privatepublic-key-pair) + * [Self Signed X509 Certificate](#self-signed-x509-certificate) + * [ZMS Certificate TrustStore](#zms-certificate-truststore) + * [Register ZTS Service](#register-zts-service) + * [Update Athenz Configuration File](#update-athenz-configuration-file) +* [Start ZMS Server](#start-zms-server) + +## Requirements +--------------- + +The following tools are required to be installed on hosts +configured to run ZTS server. + +### JDK 8 +--------- + +ZTS Server is written in Java and using embedded Jetty. + +[Oracle Java Platform JDK 8](http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html) + +While ZTS has been developed and tested with Oracle Java Platform JDK 8 +it should run successfully with OpenJDK 8 as well. + +## Getting Software +------------------- + +Download latest ZTS binary release from + +``` +https://github.com/yahoo/AtheNZ/releases/latest +``` + +```shell +$ tar xvfz athenz-zts-X.Y-bin.tar.gz +$ cd athenz-zts-X.Y +``` + +## Configuration +---------------- + +To run ZTS Server, the system administrator must generate the keys +and make necessary changes to the configuration settings. + +### Private/Public Key Pair +--------------------------- + +Generate a unique private/public key pair that ZTS Server will use +to sign any ZTokens it issues. From the `athenz-zts-X.Y` directory +execute the following commands: + +``` +cd var/zts_server/keys +openssl genrsa -out zts_private.pem 2048 +openssl rsa -in zts_private.pem -pubout > zts_public.pem +``` + +### Self Signed X509 Certificate +-------------------------------- + +Generate a self-signed X509 certificate for ZTS Server HTTPS +support. After we generate the X509 certificate, we need to add +that certificate along its private key to a keystore for Jetty +use. From the `athenz-zts-X.Y` directory execute the following +commands: + +``` +cd var/zts_server/certs +openssl req -x509 -newkey rsa:2048 -keyout zts_key.pem -out zts_cert.pem -days 365 +``` + +Generate a keystore in PKCS#12 format: + +``` +openssl pkcs12 -export -out zts_keystore.pkcs12 -in zts_cert.pem -inkey zts_key.pem +``` + +### ZMS Certificate TrustStore +------------------------------ + +ZTS Server needs to access ZMS Server to download all domain details +in order to issue RoleTokens. Since ZMS Server is running with a +self-signed certificate, we need to generate a truststore for the +java http client to use when communicating with the ZMS Server. +From your ZMS Server installation, copy the `zms_cert.pem` file +from the `athenz-zms-X.Y/var/zms_server/certs` directory to the +`athenz-zts-X.Y/var/zts_server/certs` directory and execute the following +command: + +``` +keytool -importcert -noprompt -alias zms -keystore zts_truststore.jks -file zms_cert.pem -storepass athenz +``` + +### Register ZTS Service +------------------------ + +In order for ZTS to access ZMS domain data, it must identify itself +as a registered service in ZMS. Using the `zms-cli` utility, we will +register a new service in `sys.auth` domain: + +``` +cd athenz-zts-X.Y +bin/zms-cli -k -z https://:4443/zms/v1 -d sys.auth add-service zts 0 var/zts_server/keys zts_public.pem +``` + +### Update Athenz Configuration File +------------------------------------ + +Update the Athenz configuration file `athenz.conf` in `athenz-zts-X.Y/conf/zts_server` +directory to include the correct ZMS Server URL and the registered public keys. + +## Start ZTS Server +------------------- + +Set the required Athenz ROOT environment variable to the `athenz-zts-X.Y` +directory and from there start the ZTS Server by executing: + +``` +export ROOT= +sudo -E bin/zts_start.sh +``` + +Based on the sample configuration file provided, ZTS Server will be listening +on port 8443. diff --git a/docs/system_properties.md b/docs/system_properties.md new file mode 100644 index 00000000000..be4ffe80194 --- /dev/null +++ b/docs/system_properties.md @@ -0,0 +1,60 @@ +# Athenz Component System Properties +----------------------------------------- + +* [ZMS Server](#zms-server) + +## ZMS Server +------------- + +| Property Name | Default Value | Description | +| ------------- | ------------- | ----------- | +| athenz.zms.access_log_dir | $ROOT/logs/zms_server | Directory to store access log files | +| athenz.zms.access_log_name | access.yyyy_MM_dd.log | Format of the access log filename | +| athenz.zms.access_log_retain_days | 31 | Set the number of days before rotated access log files are deleted | +| athenz.zms.access_slf4j_logger | none | If specified, the server will use SLF4J logger with the specified name to log events instead of using Jetty's NCSARequestLog class. The administrator then must configure the specified logger in the logback.xml | +| athenz.zms.authz_service_fname | none | Specifies the authorized service json configuration file path. Without any configured value, the server will default to reading /home/athenz/conf/zms_server/authorized_services.json file | +| athenz.zms.conflict_retry_timeout | 60 | In case there is a concurrent update conflict, the server will retry the operation multiple times until this timeout is reached before returning a conflict status code back to the client | +| athenz.zms.db_pool_evict_idle_interval | 1000 * 60 * 30 | The number of milliseconds to sleep between runs of the idle object evictor thread. When non-positive, no idle object evictor thread will be run. The pool default is -1, but we're using 30 minutes to make sure the evictor thread is running | +| athenz.zms.db_pool_evict_idle_timeout | 1000 * 60 * 30 | The minimum amount of time (in milliseconds) an object may sit idle in the pool before it is eligible for eviction by the idle object evictor (if any) | +| athenz.zms.db_pool_max_idle | 8 | The maximum number of connections that can remain idle in the pool, without extra ones being released, or negative for no limit | +| athenz.zms.db_pool_max_total | 8 | The maximum number of active connections that can be allocated from this pool at the same time, or negative for no limit | +| athenz.zms.db_pool_max_ttl | 1000 * 60 * 10 | The maximum lifetime in milliseconds of a connection. After this time is exceeded the connection will fail the next activation, passivation or validation test. A value of zero or less means the connection has an infinite lifetime. | +| athenz.zms.db_pool_max_wait | -1 | The maximum number of milliseconds that the pool will wait (when there are no available connections) for a connection to be returned before throwing an exception, or -1 to wait indefinitely | +| athenz.zms.db_pool_min_idle | 0 | The minimum number of connections that can remain idle in the pool, without extra ones being created, or zero to create none | +| athenz.zms.debug.principal_authority | false | Boolean setting to specify whether or not debug Principal authority is used instead of the real one. If the | athenz.zms.debug is set to true, then this setting has no impact and the the debug authority is used. | +| athenz.zms.debug.role_authority | false | Boolean setting to specify whether or not debug Role authority is used instead of the real one. If the | athenz.zms.debug is set to true, then this setting has no impact and the the debug authority is used. | +| athenz.zms.domain_admin | none | If the datastore does not contain any domains during startup, the server will automatically create sys, sys.auth and user domains and assign the specified user as the admin for those domains | +| athenz.zms.enable_stats | true | Boolean setting to configure whether or not stat counters are enabled or not | +| athenz.zms.home | $ROOT/var/zms_server | Default home directory for ZMS Server. | +| athenz.zms.hostname | none | Specify the FQDN/hostname of the server. This value will be used as the h parameter in the ZMS generated UserTokens. It is also reported as part of the server banner notification in logs. | +| athenz.zms.http_idle_timeout | 30000 | In milliseconds how long that connector will be allowed to remain idle with no traffic before it is shutdown| +| athenz.zms.http_max_threads | 1024 | Max number of threads Jetty is allowed to spawn to handle incoming requests | +| athenz.zms.http_output_buffer_size | 32768 | The size in bytes of the output buffer used to aggregate HTTP output | +| athenz.zms.http_reqeust_header_size | 8192 | The maximum allowed size in bytes for a HTTP request header | +| athenz.zms.http_response_header_size | 8192 | The maximum allowed size in bytes for a HTTP response header | +| athenz.zms.http_send_date_header | false | Boolean setting to specify whether or not the server should include the Date in HTTP headers. | +| athenz.zms.http_send_server_version | false | Boolean setting to specify whether or not the server should send the Server header in response | +| athenz.zms.jdbcstore | none | URL where the ZMS Server will store domain json documents. jdbc:mysql://localhost:3306/zms - specifies MySQL instance /home/athenz/var/zms_server - specifies file store | +| athenz.zms.jdbc_password | none | If the jdbcstore is pointing to a MySQL server then this specifies the password for the jdbc user | +| athenz.zms.jdbc_user | none | If the jdbcstore is pointing to a MySQL server then this specifies the name of the user that has full access to the zms db table | +| athenz.zms.listen_host | none | For HTTP access specifies the IP address/Host for service to listen on. This is necessary when ATS is handling TLS traffic and we need Jetty to listen on 127.0.0.1 loopback address only for HTTP connections from ATS. | +| athenz.zms.port | 10080 | Default port for HTTP access | +| athenz.zms.privatekey | none | Specifies the path to the ZMS Server's private key | +| athenz.zms.privatekey_id | 0 | Specifies the identifier of the private key | +| athenz.zms.publickey | none | Specifies the path to the ZMS Server's public key | +| athenz.zms.read_only_mode | false | If enabled, ZMS will be in maintenance read only mode where only get operations will succeed and all other put, post and delete operations will be rejected with invalid request error. | +| athenz.zms.retry_delay_timeout | 50 | When ZMS determines that updating a domain json document will cause a concurrent update issue and needs to retry the operation, it will sleep configured number of milliseconds before retrying. | +| athenz.zms.signed_policy_timeout | 604800 | Specified in seconds how long the signed policy documents are valid for | +| athenz.zms.ssl_excluded_protocols | SSLv2,SSLv3 | Comma separated list of excluded ssl protocols | +| athenz.zms.ssl_key_manager_password | none | Key Manager password | +| athenz.zms.ssl_key_store | none | The path to the keystore file that contains the server's certificate | +| athenz.zms.ssl_key_store_password | none | Keystore password | +| athenz.zms.ssl_key_store_type | PKCS12 | Specifies the keystore type | +| athenz.zms.ssl_trust_store | none | The path to the trust store file that contains CA certificates | +| athenz.zms.ssl_trust_store_password | none | Trust store password | +| athenz.zms.ssl_trust_store_type | PKCS12 | Specifies the trust store type | +| athenz.zms.tls_port | 0 | Default port for HTTPS access | +| athenz.zms.user_token_timeout | 3600 | Specifies in seconds how long would the User Tokens be valid for | +| athenz.zms.virtual_domain_limit | 2 | If virtual domain support is enabled, this setting specifies the number of sub domains in the user's virtual namespace that are allowed to be created. Value of 0 indicates no limit.| +| athenz.zms.virtual_domain_support | true | Boolean setting to configure whether or not virtual domains are supported or not. These are domains created in the user's own "user" namespace | +| athenz.zms.zms_dbtable | zms_root | If the jdbcstore is pointing to a MySQL server then this specifies the DB table name. If the jdbcstore is pointing to a filestore directory then this specifies the subdirectory name | diff --git a/docs/system_view.md b/docs/system_view.md new file mode 100644 index 00000000000..81cecd01df0 --- /dev/null +++ b/docs/system_view.md @@ -0,0 +1,75 @@ +# Architecture - System View +---------------------------- + +* [System Diagram](#system-diagram) + * [ZMS](#zms-authz-management-system) + * [ZTS](#zts-authz-token-system) + * [SIA](#sia-service-identity-agent-provider) + * [ZPE](#zpe-authz-policy-engine) + * [ZPU](#zpu-authz-policyengine-updater) + +## System Diagram +----------------- + +Before we go into the details of the authorization flow, it's important +to understand the subsystems involved. The authorization (AuthZ) system +shown in the figure below consists of several logical subsystems, which +we will elaborate on in the following section. + +![Athenz System View](images/system_view.png) + +### ZMS (authZ Management System) +--------------------------------- + +ZMS is the source of truth for domains, roles, and policies for +centralized authorization. In addition to allowing CRUD operations +on the basic entities, ZMS provides an API to replicate the entities, +per domain, to ZTS. ZMS supports a centralized call to check if a +principal has access to a resource both for internal management +system checks, as well as a simple centralized deployment. Because +ZMS supports service identities, ZMS can authenticate services. + +For centralized authorization, ZMS may be the only Athenz subsystem +that you need to interact with. + +### ZTS (authZ Token System) +---------------------------- + +ZTS, the authentication token service, is only needed to support +decentralized or data plane functionality. In many ways, ZTS is like a +local replica of ZMS's data to check a principal's authentication and +confirm membership in roles within a domain. The authentication is in +the form of a signed ZToken that can be presented to any decentralized +service that wants to authorize access efficiently. Multiple ZTS +instances can be distributed to different locations as needed to scale +for issuing tokens. + +### SIA (Service Identity Agent) Provider +----------------------------------------- + +SIA (Service Identity Agent) Provider is part of the container, +although likely built with Athenz libraries. As services are +authenticated by their private keys, the job of the SIA Provider +is to generate a NToken and sign it with the given private key so +that the service can present that NToken to ZMS/ZTS as its identity +credentials. The corresponding public key must be registered in +ZMS so Athenz services can validate the signature. + +### ZPE (AuthZ Policy Engine) +----------------------------- + +Like ZTS, ZPE, the authorization policy engine is only needed to support +the decentralized authorization. ZPE is the subsystem of Athenz that +evaluates policies for a set of roles to yield an allowed or a denied +response. + +ZPE is a library that your service calls and only refers to a local +policy cache for your services domain (a small amount of data). + +### ZPU (AuthZ PolicyEngine Updater) +------------------------------------ + +Like ZTS and ZPE, ZPU is only needed to support the decentralized +authorization. The policy updater is the utility that retrieves from ZTS +the policy files for provisioned domains on a host, which ZPE uses to +evaluate access requests. diff --git a/docs/zms_client.md b/docs/zms_client.md new file mode 100644 index 00000000000..283c288ec3f --- /dev/null +++ b/docs/zms_client.md @@ -0,0 +1,314 @@ +# ZMS Client Utility +--------------------- + +* [Overview](#overview) +* [Prerequisites](#prerequisites) +* [Getting Help](#getting-help) +* [Specifying ZMS Environments](#specifying-zms-environments) +* [How the ZMS Client Authenticates](#how-the-zms-client-authenticates) +* [Listing registered domains in Athenz](#listing-registered-domains-in-athenz) +* [Displaying Administrators for a Product Domain](#displaying-administrators-for-a-product-domain) +* [Adding Domains](#adding-domains) + * [Parameters](#parameters) + * [Examples](#examples) +* [Registering Personal Domains](#registering-personal-domains) +* [Adding and Removing Administrators](#adding-and-removing-administrators) +* [Adding a Group Role](#adding-a-group-role) + * [Parameters](#parameters-1) + * [Example](#example) +* [Managing a Group Role Membership](#managing-a-group-role-membership) + * [Parameters](#parameters-2) + * [Example](#example-1) +* [Adding a Policy](#adding-a-policy) + * [Parameters](#parameters-3) + * [Example](#example-2) + +## Overview +---------- + +The ZMS client utility allows administrators to manage Athenz domains, +to check domain details, create personal domains, and add other +administrators. + +## Prerequisites +---------------- + +Before you can use the ZMS client utility, you need to have +asked the Athenz administrators to create your top level domain. + +## Getting Help +--------------- + +The help argument for the utility will display all commands available +through utility. + + $ zms-cli help + +To get additional details about a specific command: + + $ zms-cli help [command] + +For example, to get complete details on how to add a domain including +examples: + + $ zms-cli help add-domain + +## Specifying ZMS Environments +------------------------------ + +Use the `-z` option to point to the required environment for executing commands. + + $ zms-cli -z https://zms-server.athenzcompany.com:4443/zms/v1 -d athenz show-domain + + +## How the ZMS Client Authenticates +----------------------------------- + +The Athenz ZMS server requires the user to provide its `UserToken` to +authorize the requests. The `UserToken` is obtained from the ZMS Server +with the user’s credentials and is valid for one hour. + +Before communicating with the ZMS Server, the `zms-cli` utility: + +1. prompts for the user's password +2. generates an Authorization header and passes it to ZMS to retrieve a `UserToken` + +After communicating with the ZMS Server, the `zms-cli` utility caches +the user's NToken in the user's home directory in the file `.ntoken`. +It will continue to use the token until it expires, and then will prompt +for the user's password. + +## Listing registered domains in Athenz +--------------------------------------- + +To find out what domains have been provisioned in Athenz, run the +following: + + $ zms-cli list-domain + +The list-domain command also takes an optional prefix argument to filter +the domains and only return those that start with the specified string. +For example, if the user wants to list only the domains that have been +configured in the `athenz` product domain, he/she will run the following +command: + + $ zms-cli list-domain athenz + domains: + - athenz + - athenz.ci + - athenz.qa + +## Displaying Administrators for a Product Domain +------------------------------------------------- + +To view the full list of administrators for a given domain, run the +following: + + $ zms-cli -d show-role admin + +For example, to view the Athenz system administrators for the domain +`media.news`: + + $ zms-cli -d media.news show-role admin + +## Adding Domains +----------------- + +The Top Level Product Domains in ZMS are provisioned by Athenz +administrators. + +Once the Product Domain has been created, the designated domain +administrators can create any subdomains as necessary. + +To create a new domain, the administrator uses the `add-domain` command: + + $ zms-cli add-domain [ ...] + +### Parameters + + + +The name of the domain to be added, which could either be a product +domain or a subdomain. For example, to add a subdomain called `storage` +in the `athenz` domain, the value for `` would be +`athenz.storage`. The parent domain must exist before a subdomain +can be created. The domain name can only include any letters, digits and +the '-' character. The maximum length of the domain name (including all +subdomain parts) is 256 bytes. + + [ ...] + +A space-separated list of administrators for the domain. The user +creating the domain is automatically added as an administrator. + +### Examples + +If user `joe` executes the command below, the product domain `coretech` +is created and will include `user.joe` as an administrator: + + $ zms-cli add-domain coretech + +When user `joe` executes the command below, the sub domain `athenz.ci` +is created and will have the administrators `yby.joe`, `yby.john`, and +`yby.jane`: + + $ zms-cli add-domain athenz.ci yby.john yby.jane + +## Registering Personal Domains +------------------------------- + +ZMS supports Personal Domains. These domains are provisioned for users +in the User `user` domain and have the same functionality as Product +Domains in Athenz. The Personal Domain uses the syntax `user.` +and can have configured number of subdomains (default 2). + +For example, if your user ID is joe and you'd like to create a +Personal Domain, you would run the following command: + + $ zms-cli add-domain user.joe + +Then, to create a subdomain called `athenz-test` in your Personal +Domain, you would run the following command: + + $ zms-cli add-domain user.joe.athenz-test + +If the user wants to list only his/her personal domains that have been +registered, he/she will run the following command: + + $ zms-cli list-domain user. + +## Adding and Removing Administrators +------------------------------------- + +Domain administrators are the principals listed as members of the role +`admin`. When you create a domain, the role and corresponding policy +`role` are created. Administrators can manage the list of current domain +administrators by adding or removing members in the `admin` role. + +To add one or more administrators: + + $ zms-cli -d add-member admin [ ...] + +To remove existing domain administrators: + + $ zms-cli -d delete-member admin [ ...] + +ZMS allows you to remove yourself from the `admin` role. + + Once you've been removed, you'll need to ask another domain + administrator to re-add you to the `admin` role. + +## Adding a Group Role +---------------------- + +To add new group role to a domain, the administrator will execute the +following zms-cli command: + + $ zms-cli -d add-group-role [ ...] + +### Parameters + + + +The name of the domain that the new role belongs to. + + + +The name of the new role to be added. + + [ ...] + +A space-separated list of members for the role. At least one member must +be specified. If the member is a regular user, then user's id +must be prefixed with `user.`. Once the group has been created, the +administrator can add and/or delete members using the `add-member` and +`delete-member` commands. + +### Example + +When the domain administrator executes the command below, a new role +called `readers` will be added to the the domain `athenz.ci` will +have the following members: user - `yby.john` and service - +`media.sports.storage`: + + $ zms-cli -d athenz.ci add-group-role readers yby.john media.sports.storage + +## Managing a Group Role Membership +----------------------------------- + +To add and/or delete members to/from a given role in a domain, the +administrator will execute the following zms-cli commands: + + $ zms-cli -d add-member [ ...] + $ zms-cli -d delete-member [ ...] + +### Parameters + + + +The name of the domain that the role belongs to. + + + +The name of the role that will be modified to add or remove members. + + [ ...] + +A space-separated list of members to be added to the role or to be +removed from the role. At least one member must be specified. If the +member is a regular user, the user's id must be prefixed with +`user.`. + +When specifying service identities as members you must provide +the full service name in then <domain-name>.<service-name> format. + +### Example + +To add two new members: service "media.sports.storage" and user +"yby.john", to a role called "readers" in the domain "athenz", the +domain administrator will execute the following command: + + $ zms-cli -d athenz add-member readers yby.john media.sports.storage + +To delete member "media.sports.storage" from a role called "writers" in +the domain "athenz", the domain administrator will execute the +following command: + + $ zms-cli -d athenz delete-member writers media.sports.storage + +## Adding a Policy +------------------ + +To add new policy to a domain, the administrator will execute the +following zms-cli command: + + $ zms-cli -d add-policy [] + +### Parameters + + + +The name of the domain that the new policy belongs to. + + + +The name of the new policy to be added. + + [] where is ' to on ' + +The value effect must be either 'grant' or 'deny'. The action is the +domain administrator defined action available for the resource (e.g. +read, write, delete). The role is the name of the role this assertion +applies to. The resource is the YRN of the resource this assertion +applies to. Once the policy has been created, the administrator can add +and/or delete assertions using the `add-assertion` and +`delete-assertion` commands. + +### Example + +When the domain administrator executes the command below, a new policy +called `writers` will be added to the the domain `athenz.ci` that +will grant `write` access to all the members of the `sports_writers` +role on `articles.sports.*`: + + $ zms-cli -d athenz.ci add-policy writers grant write to sports_writers on 'articles.sports.*' diff --git a/libs/go/zmscli/README.md b/libs/go/zmscli/README.md new file mode 100644 index 00000000000..f46c61ebd86 --- /dev/null +++ b/libs/go/zmscli/README.md @@ -0,0 +1,11 @@ +zms-cli +======= + +ZMS Client application library in go to manage your Athenz domain in ZMS Server. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() + diff --git a/libs/go/zmscli/access.go b/libs/go/zmscli/access.go new file mode 100644 index 00000000000..e2fc161def5 --- /dev/null +++ b/libs/go/zmscli/access.go @@ -0,0 +1,70 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "fmt" + "strings" + + "../../../clients/go/zms" +) + +func (cli Zms) ShowAccess(dn string, action string, resource string, altIdent *string, altDomain *string) (*string, error) { + yrn := resource + idx := strings.Index(resource, ":") + if idx < 0 { + yrn = dn + ":" + resource + } else { + // special handling for assume_role case where the domain in + // the resource does not have to match the value specified + // in the domain argument. + action = strings.ToLower(action) + if action != "assume_role" { + resDomain := resource[0:idx] + if resDomain != dn { + return nil, fmt.Errorf("Domain name mismatch. Expected " + dn + ", encountered in resource " + resDomain) + } + } + } + altPrincipal := "" + if altIdent != nil { + altPrincipal = *altIdent + if strings.Index(altPrincipal, ".") < 0 { + altPrincipal = cli.UserDomain + "." + altPrincipal + } + } + trustDomain := "" + if altDomain != nil { + trustDomain = *altDomain + } + access, err := cli.Zms.GetAccess(zms.ActionName(action), zms.YRN(yrn), zms.DomainName(trustDomain), zms.EntityName(altPrincipal)) + if err != nil { + return nil, err + } + s := "access: granted" + if !access.Granted { + s = "access: denied" + } + return &s, nil +} + +func (cli Zms) ShowResourceAccess(principal string, action string) (*string, error) { + rsrcAccessList, err := cli.Zms.GetResourceAccessList(zms.EntityName(principal), zms.ActionName(action)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("resource-access:\n") + for _, rsrc := range rsrcAccessList.Resources { + buf.WriteString(indent_level1_dash + "principal: " + string(rsrc.Principal) + "\n") + buf.WriteString(indent_level1 + " assertions:\n") + indent2 := indent_level1 + " - " + for _, assertion := range rsrc.Assertions { + cli.dumpAssertion(&buf, assertion, "", indent2) + } + } + s := buf.String() + return &s, nil +} diff --git a/libs/go/zmscli/cli.go b/libs/go/zmscli/cli.go new file mode 100644 index 00000000000..5a03f08d84f --- /dev/null +++ b/libs/go/zmscli/cli.go @@ -0,0 +1,1524 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "encoding/base64" + "fmt" + "io/ioutil" + "net/http" + "strconv" + "strings" + + "../../../clients/go/zms" +) + +type Zms struct { + ZmsUrl string + Identity string + Verbose bool + Bulkmode bool + Interactive bool + Zms zms.ZMSClient + Domain string + AuditRef string + UserDomain string + ProductIdSupport bool + Debug bool +} + +func (cli *Zms) SetClient(tr *http.Transport, authHeader *string, ntoken *string) { + cli.Zms = zms.NewClient(cli.ZmsUrl, tr) + cli.Zms.AddCredentials(*authHeader, *ntoken) +} + +func (cli Zms) interactiveSingleQuoteString(interactive bool, value string) string { + retValue := value + if !interactive { + retValue = "'" + value + "'" + } + return retValue +} + +func (cli Zms) getInt32(str string) (int32, error) { + value, err := strconv.ParseInt(str, 10, 32) + if err != nil { + return -1, err + } + return int32(value), nil +} + +func (cli *Zms) EvalCommand(params []string) (*string, error) { + if len(params) >= 1 { + cmd := params[0] + args := params[1:] + argc := len(args) + dn := cli.Domain + //first do commands that do not require the domain to be set in the context + switch cmd { + case "list-domain", "list-domains", "domain", "domains": + if argc == 0 { + return cli.ListDomains(nil, "", "", nil) + } else if argc == 1 { + prefix := args[0] + return cli.ListDomains(nil, "", prefix, nil) + } else if argc == 4 { + var err error + var limit, depth int32 + limit, err = cli.getInt32(args[0]) + if err != nil { + return nil, err + } + skip := args[1] + prefix := args[2] + depth, err = cli.getInt32(args[3]) + if err != nil { + return nil, err + } + return cli.ListDomains(&limit, skip, prefix, &depth) + } + return cli.helpCommand(params) + case "lookup-domain-by-role": + if argc == 2 { + return cli.LookupDomainByRole(args[0], args[1]) + } + return cli.helpCommand(params) + case "lookup-domain-by-aws-account", "lookup-domain-by-account": + if argc == 1 { + return cli.LookupDomainById(args[0], nil) + } + return cli.helpCommand(params) + case "lookup-domain-by-product-id": + if argc == 1 { + productId, err := cli.getInt32(args[0]) + if err != nil { + return nil, err + } + return cli.LookupDomainById("", &productId) + } + return cli.helpCommand(params) + case "use-domain": + var s string + if argc > 0 { + cli.Domain = args[0] + s = "[now working with the " + cli.Domain + " domain]" + } else { + cli.Domain = "" + s = "[not using any domain]" + } + return &s, nil + case "show-domain": + if argc == 1 { + //override the default domain, this command can show any of them + dn = args[0] + } + if dn != "" { + return cli.ShowDomain(dn) + } else { + return nil, fmt.Errorf("No domain specified") + } + case "check-domain": + if argc == 1 { + //override the default domain, this command can check any of them + dn = args[0] + } + if dn != "" { + return cli.CheckDomain(dn) + } else { + return nil, fmt.Errorf("No domain specified") + } + case "export-domain": + if argc == 1 || argc == 2 { + dn = args[0] + yamlfile := "-" + if argc == 2 { + yamlfile = args[1] + } + return cli.ExportDomain(dn, yamlfile) + } + return cli.helpCommand(params) + case "import-domain": + if argc >= 1 { + dn = args[0] + yamlfile := "-" + admins := args[0:0] + if argc >= 2 { + yamlfile = args[1] + admins = args[2:] + } + cli.Bulkmode = true + return cli.ImportDomain(dn, yamlfile, admins) + } + return cli.helpCommand(params) + case "update-domain": + if argc >= 1 { + dn = args[0] + yamlfile := "-" + if argc >= 2 { + yamlfile = args[1] + } + cli.Bulkmode = true + return cli.UpdateDomain(dn, yamlfile) + } + return cli.helpCommand(params) + case "system-backup": + if argc == 1 { + return cli.SystemBackup(args[0]) + } + return cli.helpCommand(params) + case "add-domain": + if argc > 0 { + dn = args[0] + if cli.ProductIdSupport && strings.LastIndex(dn, ".") < 0 { + if argc < 2 { + return nil, fmt.Errorf("Top Level Domains require a number specified for the product id") + } + productId, err := cli.getInt32(args[1]) + if err != nil { + return nil, fmt.Errorf("Top Level Domains require an integer number specified for the product id") + } + return cli.AddDomain(dn, &productId, args[2:]) + } + return cli.AddDomain(dn, nil, args[1:]) + } + return cli.helpCommand(params) + case "delete-domain": + if argc == 1 { + if args[0] == dn { + return nil, fmt.Errorf("Cannot delete domain while using it") + } + return cli.DeleteDomain(args[0]) + } + return cli.helpCommand(params) + case "set-default-admins": + if argc >= 1 { + return cli.SetDefaultAdmins(args[0], args[1:]) + } + case "get-signed-domains": + matchingTag := "" + if argc == 1 { + matchingTag = args[0] + } + return cli.GetSignedDomains("", matchingTag) + case "list-server-template", "list-server-templates": + return cli.ListServerTemplates() + case "list-domain-template", "list-domain-templates": + if argc == 1 { + //override the default domain, this command can show any of them + dn = args[0] + } + if dn != "" { + return cli.ListDomainTemplates(dn) + } else { + return nil, fmt.Errorf("No domain specified") + } + case "show-server-template": + if argc == 1 { + return cli.ShowServerTemplate(args[0]) + } + case "show-resource": + if argc == 2 { + return cli.ShowResourceAccess(args[0], args[1]) + } + case "help": + return cli.helpCommand(args) + default: + //the rest all rely on the domain being defined + if dn == "" { + var err error + if cli.Interactive { + err = fmt.Errorf("No domain specified. Use use-domain command to set the domain") + } else { + err = fmt.Errorf("No domain specified. Use -d argument to specify the domain. Type 'zms-cli' to see help information") + } + return nil, err + } + //and fall through + } + + switch cmd { + + case "list-policy", "list-policies": + return cli.ListPolicies(dn) + case "show-policy": + if argc == 1 { + return cli.ShowPolicy(dn, args[0]) + } + case "add-policy", "set-policy": + if argc >= 1 { + return cli.AddPolicy(dn, args[0], args[1:]) + } + case "add-assertion": + if argc >= 1 { + return cli.AddAssertion(dn, args[0], args[1:]) + } + case "delete-assertion": + if argc >= 1 { + return cli.DeleteAssertion(dn, args[0], args[1:]) + } + case "delete-policy": + if argc == 1 { + return cli.DeletePolicy(dn, args[0]) + } + case "show-access": + if argc >= 2 { + var trustDomain *string + var altPrincipal *string + if argc > 2 { + altPrincipal = &args[2] + if argc > 3 { + trustDomain = &args[3] + } + } + return cli.ShowAccess(dn, args[0], args[1], altPrincipal, trustDomain) + } + case "list-role", "list-roles": + return cli.ListRoles(dn) + case "show-role": + if argc == 1 { + return cli.ShowRole(dn, args[0], false, false) + } else if argc == 2 && args[1] == "log" { + return cli.ShowRole(dn, args[0], true, false) + } else if argc == 2 && args[1] == "expand" { + return cli.ShowRole(dn, args[0], false, true) + } + case "add-delegated-role", "add-trusted-role": + if argc == 2 { + return cli.AddDelegatedRole(dn, args[0], args[1]) + } + case "add-group-role": + if argc >= 1 { + return cli.AddGroupRole(dn, args[0], args[1:]) + } + case "add-provider-role-member", "add-provider-role-members": + if argc >= 4 { + return cli.AddProviderRoleMembers(dn, args[0], args[1], args[2], args[3:]) + } + case "show-provider-role-member", "show-provider-role-members": + if argc == 3 { + return cli.ShowProviderRoleMembers(dn, args[0], args[1], args[2]) + } + case "delete-provider-role-member", "delete-provider-role-members": + if argc >= 4 { + return cli.DeleteProviderRoleMembers(dn, args[0], args[1], args[2], args[3:]) + } + case "add-member", "add-members": + if argc >= 2 { + return cli.AddMembers(dn, args[0], args[1:]) + } + case "delete-member", "delete-members": + if argc >= 2 { + return cli.DeleteMembers(dn, args[0], args[1:]) + } + case "check-member", "check-members", "show-member", "show-members": + if argc >= 2 { + return cli.CheckMembers(dn, args[0], args[1:]) + } + case "delete-role": + if argc == 1 { + return cli.DeleteRole(dn, args[0]) + } + case "list-service", "list-services": + if argc == 0 { + return cli.ListServices(dn) + } + case "show-service": + if argc == 1 { + return cli.ShowService(dn, args[0]) + } + case "add-service": + if argc == 3 { + pubkey, err := cli.getPublicKey(args[2]) + if err == nil { + return cli.AddService(dn, args[0], args[1], pubkey) + } else { + return nil, err + } + } + case "add-provider-service": + if argc == 3 { + pubkey, err := cli.getPublicKey(args[2]) + if err == nil { + return cli.AddProviderService(dn, args[0], args[1], pubkey) + } else { + return nil, err + } + } + case "set-service-endpoint": + if argc == 2 { + return cli.SetServiceEndpoint(dn, args[0], args[1]) + } + case "set-service-exe": + if argc == 4 { + return cli.SetServiceExe(dn, args[0], args[1], args[2], args[3]) + } + case "add-service-host": + if argc >= 2 { + return cli.AddServiceHost(dn, args[0], args[1:]) + } + case "delete-service-host": + if argc >= 2 { + return cli.DeleteServiceHost(dn, args[0], args[1:]) + } + case "add-public-key": + if argc == 3 { + pubkey, err := cli.getPublicKey(args[2]) + if err == nil { + return cli.AddServicePublicKey(dn, args[0], args[1], pubkey) + } else { + return nil, err + } + } + case "show-public-key": + if argc == 2 { + return cli.ShowServicePublicKey(dn, args[0], args[1]) + } + case "delete-public-key": + if argc == 2 { + return cli.DeleteServicePublicKey(dn, args[0], args[1]) + } + case "delete-service": + if argc == 1 { + return cli.DeleteService(dn, args[0]) + } + case "list-entity", "list-entities": + if argc == 0 { + return cli.ListEntities(dn) + } + case "add-entity": + if argc > 1 { + return cli.AddEntity(dn, args[0], args[1:]) + } + case "delete-entity": + if argc == 1 { + return cli.DeleteEntity(dn, args[0]) + } + case "show-entity": + if argc == 1 { + return cli.ShowEntity(dn, args[0]) + } + case "show-tenancy": + if argc == 1 { + return cli.ShowTenancy(dn, args[0]) + } + case "add-tenancy": + if argc == 1 { + return cli.AddTenancy(dn, args[0]) + } + case "delete-tenancy": + if argc == 1 { + return cli.DeleteTenancy(dn, args[0]) + } + case "add-tenancy-resource-group": + if argc == 2 { + return cli.AddTenancyResourceGroup(dn, args[0], args[1]) + } + case "delete-tenancy-resource-group": + if argc == 2 { + return cli.DeleteTenancyResourceGroup(dn, args[0], args[1]) + } + case "show-tenant-roles": + if argc == 2 { + return cli.ShowTenantRoles(dn, args[0], args[1]) + } + case "add-tenant-roles": + if argc > 2 { + return cli.AddTenantRoles(dn, args[0], args[1], args[2:]) + } + case "delete-tenant-roles": + if argc == 2 { + return cli.DeleteTenantRoles(dn, args[0], args[1]) + } + case "show-tenant-resource-group-roles": + if argc == 3 { + return cli.ShowTenantResourceGroupRoles(dn, args[0], args[1], args[2]) + } + case "add-tenant-resource-group-roles": + if argc > 3 { + return cli.AddTenantResourceGroupRoles(dn, args[0], args[1], args[2], args[3:]) + } + case "delete-tenant-resource-group-roles": + if argc == 3 { + return cli.DeleteTenantResourceGroupRoles(dn, args[0], args[1], args[2]) + } + case "show-provider-resource-group-roles": + if argc == 3 { + return cli.ShowProviderResourceGroupRoles(dn, args[0], args[1], args[2]) + } + case "add-provider-resource-group-roles": + if argc > 3 { + return cli.AddProviderResourceGroupRoles(dn, args[0], args[1], args[2], args[3:]) + } + case "delete-provider-resource-group-roles": + if argc == 3 { + return cli.DeleteProviderResourceGroupRoles(dn, args[0], args[1], args[2]) + } + case "set-domain-meta": + if argc == 3 { + descr := args[0] + org := args[1] + auditEnabled, err := strconv.ParseBool(args[2]) + if err != nil { + return nil, err + } + return cli.SetDomainMeta(dn, descr, org, auditEnabled) + } + case "set-aws-account", "set-domain-account": + if argc == 1 { + return cli.SetDomainAccount(dn, args[0]) + } + case "set-product-id", "set-domain-product-id": + if argc == 1 { + productId, err := cli.getInt32(args[0]) + if err != nil { + return nil, err + } + return cli.SetDomainProductId(dn, productId) + } + case "set-domain-template": + if argc >= 1 { + return cli.SetDomainTemplate(dn, args[0:]) + } + case "delete-domain-template": + if argc == 1 { + return cli.DeleteDomainTemplate(dn, args[0]) + } + case "add-profile": + if argc == 1 { + return cli.AddProfile(dn, args[0]) + } + case "show-profile": + if argc == 1 { + return cli.ShowProfile(dn, args[0]) + } + default: + return nil, fmt.Errorf("Unrecognized command '%v'. Type 'zms-cli help' to see help information", cmd) + } + return nil, fmt.Errorf("Bad command syntax. Type 'zms-cli help' to see help information") + } + return cli.helpCommand(params) +} + +func (cli Zms) helpCommand(params []string) (*string, error) { + s := "" + if params != nil && len(params) == 1 { + s = cli.HelpSpecificCommand(cli.Interactive, params[0]) + } else { + s = cli.HelpListCommand() + } + return &s, nil +} + +func (cli Zms) HelpSpecificCommand(interactive bool, cmd string) string { + var buf bytes.Buffer + + // we are going to display the required domain argument + // only in non-interactive mode + domain_param := "-d domain" + domain_example := "-d coretech" + tenant_example := "-d sports" + if interactive { + domain_param = "" + domain_example = "coretech> " + tenant_example = "sports> " + } + + switch cmd { + case "list-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" list-domain [prefix]\n") + buf.WriteString(" list-domain [limit skip prefix depth]\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" prefix : return domains starting with this value \n") + buf.WriteString(" limit : return specified number of domains only\n") + buf.WriteString(" skip : exclude all the domains including the specified one from the return set\n") + buf.WriteString(" depth : maximum depth of the domains returned (0 - top level domains only)\n") + buf.WriteString(" examples:\n") + buf.WriteString(" list-domain cd\n") + buf.WriteString(" return all domains who names start with cd\n") + case "show-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" show-domain domain\n") + buf.WriteString(" " + domain_param + " show-domain\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : retrieve roles, policies and services for this domain\n") + buf.WriteString(" : this argument is required unless -d is specified or\n") + buf.WriteString(" : running in repl/interactive mode with use-domain specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" show-domain coretech.hosted\n") + buf.WriteString(" " + domain_example + " show-domain\n") + case "lookup-domain-by-account", "lookup-domain-by-aws-account": + buf.WriteString(" syntax:\n") + buf.WriteString(" lookup-domain-by-aws-account account-id\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" account-id : lookup domain with specified account id\n") + buf.WriteString(" examples:\n") + buf.WriteString(" lookup-domain-by-aws-account 1234567890\n") + case "lookup-domain-by-prod-id": + buf.WriteString(" syntax:\n") + buf.WriteString(" lookup-domain-by-prod-id product-id\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" prod-id : lookup domain with specified product id\n") + buf.WriteString(" examples:\n") + buf.WriteString(" lookup-domain-by-prod-id 10001\n") + case "lookup-domain-by-role": + buf.WriteString(" syntax:\n") + buf.WriteString(" lookup-domain-by-role role-member role-name\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" role-member : name of the principal\n") + buf.WriteString(" role-name : name of the role where the principal is a member of\n") + buf.WriteString(" examples:\n") + buf.WriteString(" lookup-domain-by-role " + cli.UserDomain + ".joe admin\n") + case "check-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" check-domain domain\n") + buf.WriteString(" " + domain_param + " check-domain\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : verify domain resources and report any issues\n") + buf.WriteString(" : this argument is required unless -d is specified or\n") + buf.WriteString(" : running in repl/interactive mode with use-domain specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" check-domain coretech.hosted\n") + buf.WriteString(" " + domain_example + " check-domain\n") + case "use-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" use-domain [domain]\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : when running in repl mode sets the domain value for all operations\n") + buf.WriteString(" : passing \"\" domain will reset the client's saved domain value\n") + buf.WriteString(" examples:\n") + buf.WriteString(" use-domain coretech\n") + case "add-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" add-domain domain [prod-id] [admin ...]\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to be added\n") + buf.WriteString(" : The name can be either a top level domain or a subdomain\n") + buf.WriteString(" prod-id : unique product id number required when creating top level domains\n") + buf.WriteString(" admin : list of domain administrators separated by a space\n") + buf.WriteString(" : the user creating the domain will be added as an administrator\n") + buf.WriteString(" examples:\n") + buf.WriteString(" add-domain coretech john jane\n") + buf.WriteString(" add a top level domain called coretech with " + cli.UserDomain + ".john, " + cli.UserDomain + ".jane and the caller as administrators\n") + buf.WriteString(" add-domain coretech.hosted john jane\n") + buf.WriteString(" add a subdomain hosted in domain coretech with " + cli.UserDomain + ".john, " + cli.UserDomain + ".jane and the caller as administrators\n") + case "set-domain-meta": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " set-domain-meta description org audit_enabled\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain being updated\n") + } + buf.WriteString(" description : set the description for the domain\n") + buf.WriteString(" org : set the organization of the domain\n") + buf.WriteString(" audit_enabled : boolean flag indicating if the domain must comply with SOX auditing requirements\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " set-domain-meta \"Coretech Hosted\" cloud.services false\n") + case "set-aws-account", "set-domain-account": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " set-aws-account account-id\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain being updated\n") + } + buf.WriteString(" account-id : set the aws account id for the domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " set-aws-account \"134901934383\"\n") + case "set-prod-id", "set-domain-prod-id": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " set-prod-id prod-id\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain being updated\n") + } + buf.WriteString(" prod-id : set the Product ID for the domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " set-prod-id 10001\n") + case "import-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" import-domain domain [file.yaml [admin ...]] - no file means stdin\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain being imported\n") + buf.WriteString(" file.yaml : file that contains domain contents in yaml format\n") + buf.WriteString(" admin : additional list of administrators to be added to the domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" import-domain coretech coretech.yaml " + cli.UserDomain + ".john\n") + case "update-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" update-domain domain [file.yaml] - no file means stdin\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain being updated\n") + buf.WriteString(" file.yaml : file that contains domain contents in yaml format\n") + buf.WriteString(" examples:\n") + buf.WriteString(" update-domain coretech coretech.yaml\n") + case "export-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" export-domain domain [file.yaml] - no file means stdout\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to be exported\n") + buf.WriteString(" file.yaml : filename where the domain data is stored\n") + buf.WriteString(" examples:\n") + buf.WriteString(" export-domain coretech /tmp/coretech.yaml\n") + case "delete-domain": + buf.WriteString(" syntax:\n") + buf.WriteString(" delete-domain domain\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to be deleted\n") + buf.WriteString(" examples:\n") + buf.WriteString(" delete-domain coretech\n") + case "set-default-admins": + buf.WriteString(" syntax:\n") + buf.WriteString(" set-default-admins domain admin [admin ...]\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to restore admin access\n") + buf.WriteString(" admin : list of administrators to be set for domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" set-default-admins coretech.hosted " + cli.UserDomain + ".john " + cli.UserDomain + ".jane\n") + case "get-signed-domains": + buf.WriteString(" syntax:\n") + buf.WriteString(" get-signed-domains [matching_tag]\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" matching-tag : value of ETag header retrieved from previous get-signed-domain call\n") + buf.WriteString(" : server will return changes since this timestamp only\n") + buf.WriteString(" examples:\n") + buf.WriteString(" get-signed-domains\n") + buf.WriteString(" get-signed-domains \"2015-04-10T20:43:34.023Z-gzip\"\n") + case "list-policy": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " list-policy\n") + if !interactive { + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to retrieve the list of policies from\n") + } + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " list-policy\n") + case "show-policy": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-policy policy\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that policy belongs to\n") + } + buf.WriteString(" policy : name of the policy to be displayed\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-policy admin\n") + case "add-policy", "set-policy": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-policy policy [assertion]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain to add policy to\n") + } + buf.WriteString(" policy : name of the policy\n") + buf.WriteString(" assertion : to on \n") + buf.WriteString(" : effect - grant or deny\n") + buf.WriteString(" : action - domain admin defined action available for the resource (e.g. read, write, delete)\n") + buf.WriteString(" : role - which role this assertion applies to\n") + buf.WriteString(" : client will prepend 'domain:role.' to role name if not specified\n") + buf.WriteString(" : resource - which resource this assertion applies to\n") + buf.WriteString(" : client will prepend 'domain:' to resource if not specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-policy writers_policy grant write to writers_role on articles.sports\n") + buf.WriteString(" " + domain_example + " add-policy readers_policy grant read to readers_role on " + cli.interactiveSingleQuoteString(interactive, "articles.*") + "\n") + case "add-assertion": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-assertion policy assertion\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that policy belongs to\n") + } + buf.WriteString(" policy : name of the policy to add this assertion to\n") + buf.WriteString(" assertion : to on \n") + buf.WriteString(" : effect - grant or deny\n") + buf.WriteString(" : action - domain admin defined action available for the resource (e.g. read, write, delete)\n") + buf.WriteString(" : role - which role this assertion applies to\n") + buf.WriteString(" : client will prepend 'domain:role.' to role name if not specified\n") + buf.WriteString(" : resource - which resource this assertion applies to\n") + buf.WriteString(" : client will prepend 'domain:' to resource if not specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-assertion writers_policy grant write to writers_role on articles.sports\n") + buf.WriteString(" " + domain_example + " add-assertion readers_policy grant read to readers_role on " + cli.interactiveSingleQuoteString(interactive, "articles.*") + "\n") + case "delete-assertion": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-assertion policy assertion\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that policy belongs to\n") + } + buf.WriteString(" policy : name of the policy to delete this assertion from\n") + buf.WriteString(" assertion : existing assertion in the policy in the ' to on ' format\n") + buf.WriteString(" : the value must be exactly what's displayed when executing the show-policy command\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-assertion writers_policy grant write to writers_role on articles.sports\n") + buf.WriteString(" " + domain_example + " delete-assertion readers_policy grant read to readers_role on " + cli.interactiveSingleQuoteString(interactive, "articles.*") + "\n") + case "delete-policy": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-policy policy\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that policy belongs to\n") + } + buf.WriteString(" policy : name of the policy to be deleted\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-policy readers\n") + case "show-access": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-access action resource [alt_identity [trust_domain]]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that resource belongs to\n") + } + buf.WriteString(" action : access check action value\n") + buf.WriteString(" resource : access check resource (yrn)\n") + buf.WriteString(" : client will prepend 'domain:' to resource if not specified\n") + buf.WriteString(" alt_identity : run the access check for this identity instead of the caller\n") + buf.WriteString(" trust_domain : when checking for cross-domain trust relationship\n") + buf.WriteString(" : only check this trusted domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-access node_sudo node.host1\n") + buf.WriteString(" " + domain_example + " show-access node_sudo coretech:node.host1\n") + buf.WriteString(" " + domain_example + " show-access node_sudo coretech:node.host1 " + cli.UserDomain + ".john\n") + case "show-resource": + buf.WriteString(" syntax:\n") + buf.WriteString(" show-resource principal action\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" principal : show resources for this principal only\n") + buf.WriteString(" action : assertion action value to filter on\n") + buf.WriteString(" examples:\n") + buf.WriteString(" show-resource " + cli.UserDomain + ".user1 update\n") + buf.WriteString(" show-resource " + cli.UserDomain + ".user1 \"\"\n") + buf.WriteString(" show-resource \"\" assume_aws_role\n") + case "list-role": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " list-role\n") + if !interactive { + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to retrieve the list of roles from\n") + } + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " list-role\n") + case "show-role": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-role role [log | expand]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" role : name of the role to be displayed\n") + buf.WriteString(" log : option argument to specify to display audit logs for role\n") + buf.WriteString(" expand : option argument to specify to display delegated members\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-role admin\n") + buf.WriteString(" " + domain_example + " show-role admin log\n") + buf.WriteString(" " + domain_example + " show-role delegated-role expand\n") + case "add-delegated-role": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-delegated-role role trusted_domain\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" role : name of the cross-domain/trust delegated role\n") + buf.WriteString(" trust_domain : name of the cross/trusted domain name\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-delegated-role tenant.sports.readers sports\n") + case "add-group-role": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-group-role role member [member ... ]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" role : name of the standard group role\n") + buf.WriteString(" member : list of group members that could be either users or services\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-group-role readers " + cli.UserDomain + ".john " + cli.UserDomain + ".joe media.sports.storage\n") + case "add-member": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-member group_role user_or_service [user_or_service ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" group-role : name of the standard group role to add members to\n") + buf.WriteString(" user_or_service : users or services to be added as members\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-member readers " + cli.UserDomain + ".john " + cli.UserDomain + ".joe media.sports.storage\n") + case "check-member": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " check-member group_role user_or_service [user_or_service ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" group-role : name of the standard group role to check membership\n") + buf.WriteString(" user_or_service : users or services to be checked if they are members\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " check-member readers " + cli.UserDomain + ".john " + cli.UserDomain + ".joe media.sports.storage\n") + case "delete-member": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-member group_role user_or_service [user_or_service ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" group-role : name of the standard group role to remove members from\n") + buf.WriteString(" user_or_service : users or services to be removed as members\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-member readers " + cli.UserDomain + ".john " + cli.UserDomain + ".joe media.sports.storage\n") + case "add-provider-role-member": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-provider-role-member provider_service resource_group provider_role user_or_service [user_or_service ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" provider_service : name of the provider service\n") + buf.WriteString(" resource_group : name of the resource group\n") + buf.WriteString(" provider_role : the provider role name\n") + buf.WriteString(" user_or_service : users or services to be added as members\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-provider-role-member storage.db stats_db access media.sports.storage\n") + case "show-provider-role-member": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-provider-role-member provider_service resource_group provider_role\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" provider_service : name of the provider service\n") + buf.WriteString(" resource_group : name of the resource group\n") + buf.WriteString(" provider_role : the provider role name\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-provider-role-member storage.db stats_db access\n") + case "delete-provider-role-member": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-provider-role-member provider_service resource_group provider_role user_or_service [user_or_service ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" provider_service : name of the provider service\n") + buf.WriteString(" resource_group : name of the resource group\n") + buf.WriteString(" provider_role : the provider role name\n") + buf.WriteString(" user_or_service : users or services to be removed as members\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-provider-role-member storage.db stats_db access media.sports.storage\n") + case "delete-role": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-role role\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that role belongs to\n") + } + buf.WriteString(" role : name of the role to be deleted\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-role readers\n") + case "list-service": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " list-service\n") + if !interactive { + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to retrieve the list of services from\n") + } + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " list-service\n") + case "show-service": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-service service\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to be displayed\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-service storage\n") + case "add-service": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-service service key_id identity_pubkey.pem|identity_key_ybase64\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to be added to the domain\n") + buf.WriteString(" key_id : identifier of the service's public key\n") + buf.WriteString(" identity_pubkey.pem : the filename of the service's public key\n") + buf.WriteString(" : either the filename or ybase64 value must be specified\n") + buf.WriteString(" identity_key_ybase64 : ybase64 encoded value of service's public key\n") + buf.WriteString(" : either the filename or ybase64 value must be specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-service storage v0 /tmp/storage_pub.pem\n") + buf.WriteString(" " + domain_example + " add-service storage v0 \"MIIBOgIBAAJBAOf62yl04giXbiirU8Ck\"\n") + case "add-provider-service": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-provider-service service key_id identity_pubkey.pem|identity_key_ybase64\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to be added to the domain\n") + buf.WriteString(" key_id : identifier of the service's public key\n") + buf.WriteString(" identity_pubkey.pem : the filename of the service's public key\n") + buf.WriteString(" : either the filename or ybase64 value must be specified\n") + buf.WriteString(" identity_key_ybase64 : ybase64 encoded value of service's public key\n") + buf.WriteString(" : either the filename or ybase64 value must be specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-provider-service storage v0 /tmp/storage_pub.pem\n") + buf.WriteString(" " + domain_example + " add-provider-service storage v0 \"MIIBOgIBAAJBAOf62yl04giXbiirU8Ck\"\n") + case "set-service-endpoint": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " set-service-endpoint service endpoint\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to set the tenant auto-provisioning endpoint\n") + buf.WriteString(" endpoint : the url of the provider's service to support auto-provisioning of tenants\n") + buf.WriteString(" : To remove the endpoint pass \"\" as its value\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " set-service-endpoint storage http://coretech.athenzcompany.com:4080/tableProvider\n") + case "set-service-exe": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " set-service-exe service executable user group\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to set executable info\n") + buf.WriteString(" executable : full path of the service's executable\n") + buf.WriteString(" : To remove the setting pass \"\" as its value\n") + buf.WriteString(" user : the user name that the service's process runs as\n") + buf.WriteString(" : To remove the setting pass \"\" as its value\n") + buf.WriteString(" group : the group name that the service's process runs as\n") + buf.WriteString(" : To remove the setting pass \"\" as its value\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " set-service-exe storage /usr/bin/httpd nobody wheel\n") + buf.WriteString(" " + domain_example + " set-service-exe storage \"\" nobody wheel\n") + case "add-service-host": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-service-host service host [host ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to add hosts to\n") + buf.WriteString(" host : fully qualified list of hosts the service is allowed to run on\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-service-host storage ct1.athenzcompany.com ct2.athenzcompany.com\n") + case "delete-service-host": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-service-host service host [host ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to delete hosts from\n") + buf.WriteString(" host : fully qualified list of hosts to remove from service's allowed run list\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-service-host storage ct1.athenzcompany.com ct2.athenzcompany.com\n") + case "add-public-key": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-public-key service key_id identity_pubkey.pem|identity_key_ybase64\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to add a new public key\n") + buf.WriteString(" key_id : identifier of the service's public key\n") + buf.WriteString(" identity_pubkey.pem : the filename of the service's public key\n") + buf.WriteString(" : either the filename or ybase64 value must be specified\n") + buf.WriteString(" identity_key_ybase64 : ybase64 encoded value of service's public key\n") + buf.WriteString(" : either the filename or ybase64 value must be specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-public-key storage v1 /tmp/storage_pub.pem\n") + buf.WriteString(" " + domain_example + " add-public-key storage v1 \"MIIBOgIBAAJBAOf62yl04giXbiirU8Ck\"\n") + case "show-public-key": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-public-key service key_id\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to retrieve public key from\n") + buf.WriteString(" key_id : identifier of the service's public key\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-public-key storage v0\n") + case "delete-public-key": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-public-key service key_id\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to delete public key from\n") + buf.WriteString(" key_id : identifier of the service's public key to be deleted\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-public-key storage v0\n") + case "delete-service": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-service service\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that service belongs to\n") + } + buf.WriteString(" service : name of the service to be deleted\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-service storage\n") + case "list-entity": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " list-entity\n") + if !interactive { + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : name of the domain to retrieve the list of entities from\n") + } + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " list-entity\n") + case "show-entity": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-entity entity\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that entity belongs to\n") + } + buf.WriteString(" entity : name of the entity to be retrieved from the domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-entity profile\n") + case "add-entity": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-entity entity key=value [key=value ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that entity belongs to\n") + } + buf.WriteString(" entity : name of the entity to be added\n") + buf.WriteString(" key : entity field name\n") + buf.WriteString(" value : entity field value\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-entity profile name=security active=yes\n") + case "delete-entity": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-entity entity\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain that entity belongs to\n") + } + buf.WriteString(" entity : name of the entity to be deleted\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-entity profile\n") + case "show-tenancy": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-tenancy provider\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the tenant's domain\n") + } + buf.WriteString(" provider : provider's service name to verify if the domain is a tenant\n") + buf.WriteString(" : the provider's name must be service common name in . format\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " show-tenancy weather.storage\n") + case "add-tenancy": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-tenancy provider\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the tenant's domain\n") + } + buf.WriteString(" provider : provider's service name to auto-provision tenancy for the domain\n") + buf.WriteString(" : the provider's name must be service common name in . format\n") + buf.WriteString(" : the provider must support auto-provisioning and have configured endpoint in the service\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-tenancy weather.storage\n") + case "delete-tenancy": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-tenancy provider\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the tenant's domain\n") + } + buf.WriteString(" provider : provider's service name to remove the tenant from\n") + buf.WriteString(" : the provider's name must be service common name in . format\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-tenancy weather.storage\n") + case "add-tenancy-resource-group": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-tenancy-resource-group provider resource_group\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the tenant's domain\n") + } + buf.WriteString(" provider : provider's service name to auto-provision tenancy for the domain\n") + buf.WriteString(" : the provider's name must be service common name in . format\n") + buf.WriteString(" : the provider must support auto-provisioning and have configured endpoint in the service\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " add-tenancy-resource-group weather.storage dev_group\n") + case "delete-tenancy-resource-group": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-tenancy-resource-group provider resource_group\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the tenant's domain\n") + } + buf.WriteString(" provider : provider's service name to remove the tenant from\n") + buf.WriteString(" : the provider's name must be service common name in . format\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-tenancy-resource-group weather.storage dev_group\n") + case "show-tenant-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-tenant-roles service tenant_domain\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : provider's domain name\n") + } + buf.WriteString(" service : provider's service name\n") + buf.WriteString(" tenant_domain : name of the tenant's domain to list roles for\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" " + tenant_example + " show-tenant-roles hosted coretech\n") + case "add-tenant-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-tenant-roles service tenant_domain role=action [role=action ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : provider's domain name\n") + } + buf.WriteString(" service : provider's service name\n") + buf.WriteString(" tenant_domain : name of the tenant's domain to add roles for\n") + buf.WriteString(" role : name of the role to be added\n") + buf.WriteString(" action : the action value for the role\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" " + tenant_example + " add-tenant-roles hosted coretech readers=read writers=modify\n") + case "delete-tenant-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-tenant-roles service tenant_domain\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : provider's domain name\n") + } + buf.WriteString(" service : provider's service name\n") + buf.WriteString(" tenant_domain : name of the tenant's domain to remove all previously setup tenancy roles\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" " + tenant_example + " delete-tenant-roles hosted coretech\n") + case "show-tenant-resource-group-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-tenant-resource-group-roles service tenant_domain resource_group\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : provider's domain name\n") + } + buf.WriteString(" service : provider's service name\n") + buf.WriteString(" tenant_domain : name of the tenant's domain to list roles for\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" resource group: dev_group\n") + buf.WriteString(" " + tenant_example + " show-tenant-resource-group-roles hosted coretech dev_group\n") + case "add-tenant-resource-group-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-tenant-resource-group-roles service tenant_domain resource_group role=action [role=action ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : provider's domain name\n") + } + buf.WriteString(" service : provider's service name\n") + buf.WriteString(" tenant_domain : name of the tenant's domain to add roles for\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" role : name of the role to be added\n") + buf.WriteString(" action : the action value for the role\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" resource group: dev_group\n") + buf.WriteString(" " + tenant_example + " add-tenant-resource-group-roles hosted coretech dev_group readers=read writers=modify\n") + case "delete-tenant-resource-group-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-tenant-resource-group-roles service tenant_domain resource_group\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : provider's domain name\n") + } + buf.WriteString(" service : provider's service name\n") + buf.WriteString(" tenant_domain : name of the tenant's domain\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" resource group: dev_group\n") + buf.WriteString(" " + tenant_example + " delete-tenant-resource-group-roles hosted coretech dev_group\n") + case "show-provider-resource-group-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " show-provider-resource-group-roles provider_domain provider_service resource_group\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : tenant's domain name\n") + } + buf.WriteString(" provider_domain : provider's domain name\n") + buf.WriteString(" provider_service : provider's service name\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" resource group: dev_group\n") + buf.WriteString(" " + domain_example + " show-provider-resource-group-roles sports hosted dev_group\n") + case "add-provider-resource-group-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " add-provider-resource-group-roles provider_domain provider_service resource_group role=action [role=action ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : tenant's domain name\n") + } + buf.WriteString(" provider_domain : provider's domain name\n") + buf.WriteString(" provider_service : provider's service name\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" role : name of the role to be added\n") + buf.WriteString(" action : the action value for the role\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" resource group: dev_group\n") + buf.WriteString(" " + domain_example + " add-provider-resource-group-roles sports hosted dev_group readers=read writers=modify\n") + case "delete-provider-resource-group-roles": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-provider-resource-group-roles provider_domain provider_service resource_group\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : tenant's domain name\n") + } + buf.WriteString(" provider_domain : provider's domain name\n") + buf.WriteString(" provider_service : provider's service name\n") + buf.WriteString(" resource_group : name of the tenant's resource group\n") + buf.WriteString(" examples:\n") + buf.WriteString(" tenant domain: coretech\n") + buf.WriteString(" provider domain: sports\n") + buf.WriteString(" provider service: hosted\n") + buf.WriteString(" resource group: dev_group\n") + buf.WriteString(" " + domain_example + " delete-provider-resource-group-roles sports hosted dev_group\n") + case "get-user-token": + buf.WriteString(" syntax:\n") + buf.WriteString(" get-user-token [authorized_service]\n") + buf.WriteString(" examples:\n") + buf.WriteString(" get-user-token\n") + buf.WriteString(" get-user-token iaas.athenz.api\n") + case "add-profile": + buf.WriteString(" syntax:\n") + buf.WriteString(" add-profile name \n") + buf.WriteString(" examples:\n") + buf.WriteString(" add-profile dev\n") + case "show-profile": + buf.WriteString(" syntax:\n") + buf.WriteString(" show-profile name \n") + buf.WriteString(" examples:\n") + buf.WriteString(" show-profile dev\n") + case "version": + buf.WriteString(" syntax:\n") + buf.WriteString(" version\n") + buf.WriteString(" examples:\n") + buf.WriteString(" version\n") + case "repl": + buf.WriteString(" syntax:\n") + buf.WriteString(" repl\n") + buf.WriteString(" description:\n") + buf.WriteString(" starts zms-cli client in interactive shell mode where the administrator can specify\n") + buf.WriteString(" the domain to be used for all commands using the use-domain command\n") + buf.WriteString(" examples:\n") + buf.WriteString(" repl\n") + buf.WriteString(" > use-domain corecommit\n") + buf.WriteString(" corecommit> list-role\n") + case "system-backup": + buf.WriteString(" syntax:\n") + buf.WriteString(" system-backup dir\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" dir : directory path to store all exported domain's yaml files\n") + buf.WriteString(" : each filename will have the same filename as the domain name\n") + buf.WriteString(" examples:\n") + buf.WriteString(" system-backup /home/athenz/var/backups/zms_data\n") + case "list-server-template": + buf.WriteString(" syntax:\n") + buf.WriteString(" list-server-template\n") + buf.WriteString(" description:\n") + buf.WriteString(" lists the solution templates defined on the server\n") + buf.WriteString(" example:\n") + buf.WriteString(" list-server-template\n") + case "show-server-template": + buf.WriteString(" syntax:\n") + buf.WriteString(" show-server-template template\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" template : solution template name to be displayed\n") + buf.WriteString(" example:\n") + buf.WriteString(" show-server-template vipng\n") + case "list-domain-template": + buf.WriteString(" syntax:\n") + buf.WriteString(" list-domain-template domain\n") + buf.WriteString(" " + domain_param + " list-domain-template\n") + buf.WriteString(" parameters:\n") + buf.WriteString(" domain : retrieve templates applied to this domain\n") + buf.WriteString(" : this argument is required unless -d is specified or\n") + buf.WriteString(" : running in repl/interactive mode with use-domain specified\n") + buf.WriteString(" examples:\n") + buf.WriteString(" list-domain-template coretech.hosted\n") + buf.WriteString(" " + domain_example + " list-domain-template\n") + case "set-domain-template": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " set-domain-template template [template ...]\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain to apply the template to\n") + } + buf.WriteString(" template : name of the template to be applied to the domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " set-domain-template vipng\n") + buf.WriteString(" " + domain_example + " set-domain-template vipng cm3\n") + case "delete-domain-template": + buf.WriteString(" syntax:\n") + buf.WriteString(" " + domain_param + " delete-domain-template template\n") + buf.WriteString(" parameters:\n") + if !interactive { + buf.WriteString(" domain : name of the domain to delete the template from\n") + } + buf.WriteString(" template : name of the template to be deleted from the domain\n") + buf.WriteString(" examples:\n") + buf.WriteString(" " + domain_example + " delete-domain-template vipng\n") + default: + if interactive { + buf.WriteString("Unknown command. Type 'help' to see available commands") + } else { + buf.WriteString("Unknown command. Type 'zms-cli help' to see available commands") + } + } + return buf.String() +} + +func (cli Zms) HelpListCommand() string { + var buf bytes.Buffer + buf.WriteString(" Domain commands:\n") + buf.WriteString(" list-domain [prefix] | [limit skip prefix depth]\n") + buf.WriteString(" show-domain [domain]\n") + buf.WriteString(" lookup-domain-by-aws-account account-id\n") + buf.WriteString(" lookup-domain-by-prod-id prod-id\n") + buf.WriteString(" lookup-domain-by-role role-member role-name\n") + buf.WriteString(" add-domain domain prod-id [admin ...] - to add top level domains\n") + buf.WriteString(" add-domain domain [admin ...] - to add sub domains\n") + buf.WriteString(" set-domain-meta description org audit_enabled\n") + buf.WriteString(" set-aws-account account-id\n") + buf.WriteString(" set-prod-id prod-id\n") + buf.WriteString(" import-domain domain [file.yaml [admin ...]] - no file means stdin\n") + buf.WriteString(" export-domain domain [file.yaml] - no file means stdout\n") + buf.WriteString(" update-domain domain [file.yaml] - no file means stdin\n") + buf.WriteString(" delete-domain domain\n") + buf.WriteString(" set-default-admins domain admin [admin ...] (for system administrators only)\n") + buf.WriteString(" get-signed-domains [matching_tag]\n") + buf.WriteString(" use-domain [domain]\n") + buf.WriteString(" check-domain [domain]\n") + buf.WriteString("\n") + buf.WriteString(" Policy commands:\n") + buf.WriteString(" list-policy\n") + buf.WriteString(" show-policy policy\n") + buf.WriteString(" add-policy policy [assertion]\n") + buf.WriteString(" add-assertion policy assertion\n") + buf.WriteString(" delete-assertion policy assertion\n") + buf.WriteString(" delete-policy policy\n") + buf.WriteString(" show-access action resource [alt_identity [trust_domain]]\n") + buf.WriteString(" show-resource principal action\n") + buf.WriteString("\n") + buf.WriteString(" Role commands:\n") + buf.WriteString(" list-role\n") + buf.WriteString(" show-role role [log | expand]\n") + buf.WriteString(" add-delegated-role role trusted_domain\n") + buf.WriteString(" add-group-role role member [member ... ]\n") + buf.WriteString(" add-member group_role user_or_service [user_or_service ...]\n") + buf.WriteString(" check-member group_role user_or_service [user_or_service ...]\n") + buf.WriteString(" delete-member group_role user_or_service [user_or_service ...]\n") + buf.WriteString(" add-provider-role-member provider_service resource_group provider_role user_or_service [user_or_service ...]\n") + buf.WriteString(" show-provider-role-member provider_service resource_group provider_role\n") + buf.WriteString(" delete-provider-role-member provider_service resource_group provider_role user_or_service [user_or_service ...]\n") + buf.WriteString(" delete-role role\n") + buf.WriteString("\n") + buf.WriteString(" Service commands:\n") + buf.WriteString(" list-service\n") + buf.WriteString(" show-service service\n") + buf.WriteString(" add-service service key_id identity_pubkey.pem|identity_key_ybase64\n") + buf.WriteString(" add-provider-service service key_id identity_pubkey.pem|identity_key_ybase64\n") + buf.WriteString(" set-service-endpoint service endpoint\n") + buf.WriteString(" set-service-exe service executable user group\n") + buf.WriteString(" add-service-host service host [host ...]\n") + buf.WriteString(" delete-service-host service host [host ...]\n") + buf.WriteString(" add-public-key service key_id identity_pubkey.pem|identity_key_ybase64\n") + buf.WriteString(" show-public-key service key_id\n") + buf.WriteString(" delete-public-key service key_id\n") + buf.WriteString(" delete-service service\n") + buf.WriteString(" list-host-services host\n") + buf.WriteString("\n") + buf.WriteString(" Entity commands:\n") + buf.WriteString(" list-entity\n") + buf.WriteString(" show-entity entity\n") + buf.WriteString(" add-entity entity key=value [key=value ...]\n") + buf.WriteString(" delete-entity entity\n") + buf.WriteString("\n") + buf.WriteString(" Tenancy commands:\n") + buf.WriteString(" show-tenancy provider\n") + buf.WriteString(" add-tenancy provider\n") + buf.WriteString(" delete-tenancy provider\n") + buf.WriteString(" add-tenancy-resource-group provider resource_group\n") + buf.WriteString(" delete-tenancy-resource-group provider resource-group\n") + buf.WriteString(" show-tenant-roles service tenant_domain\n") + buf.WriteString(" add-tenant-roles service tenant_domain role=action [role=action ...]\n") + buf.WriteString(" delete-tenant-roles service tenant_domain\n") + buf.WriteString(" show-tenant-resource-group-roles service tenant_domain resource_group\n") + buf.WriteString(" add-tenant-resource-group-roles service tenant_domain resource_group role=action [role=action ...]\n") + buf.WriteString(" delete-tenant-resource-group-roles service tenant_domain resource_group\n") + buf.WriteString(" show-provider-resource-group-roles provider_domain provider_service resource_group\n") + buf.WriteString(" add-provider-resource-group-roles provider_domain provider_service resource_group role=action [role=action ...]\n") + buf.WriteString(" delete-provider-resource-group-roles provider_domain provider_service resource_group\n") + buf.WriteString("\n") + buf.WriteString(" Template commands:\n") + buf.WriteString(" list-server-template\n") + buf.WriteString(" list-domain-template\n") + buf.WriteString(" show-server-template template\n") + buf.WriteString(" set-domain-template template [template]\n") + buf.WriteString(" delete-domain-template template\n") + buf.WriteString("\n") + buf.WriteString(" Other commands:\n") + buf.WriteString(" get-user-token [authorized_service]\n") + buf.WriteString(" add-profile name\n") + buf.WriteString(" show-profile name\n") + buf.WriteString(" repl\n") + buf.WriteString(" version\n") + buf.WriteString("\n") + return buf.String() +} + +func (cli Zms) ybase64(data []byte) string { + b64 := base64.StdEncoding.EncodeToString(data) + yb64 := strings.Replace(strings.Replace(strings.Replace(b64, "+", ".", -1), "/", "_", -1), "=", "-", -1) + return yb64 +} + +func (cli Zms) getPublicKey(s string) (*string, error) { + if strings.HasSuffix(s, ".pem") || strings.HasSuffix(s, ".key") { + bytes, err := ioutil.ReadFile(s) + if err != nil { + return nil, err + } + yb64 := cli.ybase64(bytes) + return &yb64, nil + } else { + return &s, nil + } +} diff --git a/libs/go/zmscli/domain.go b/libs/go/zmscli/domain.go new file mode 100644 index 00000000000..0b8cf648f1b --- /dev/null +++ b/libs/go/zmscli/domain.go @@ -0,0 +1,480 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "fmt" + "io/ioutil" + "os" + "strconv" + "strings" + + "../../../clients/go/zms" + "gopkg.in/yaml.v2" +) + +func (cli Zms) DeleteDomain(dn string) (*string, error) { + _, err := cli.Zms.GetDomain(zms.DomainName(dn)) + if err == nil { + i := strings.LastIndex(dn, ".") + name := dn + parent := "" + if i < 0 { + err = cli.Zms.DeleteTopLevelDomain(zms.DomainName(dn), cli.AuditRef) + } else { + parent = dn[0:i] + name = dn[i+1:] + // special case for top level user domains + // where parent is just the user domain + if parent == cli.UserDomain { + err = cli.Zms.DeleteUserDomain(zms.SimpleName(name), cli.AuditRef) + } else { + err = cli.Zms.DeleteSubDomain(zms.DomainName(parent), zms.DomainName(name), cli.AuditRef) + } + } + if err == nil { + s := "[Deleted domain " + dn + "]" + return &s, nil + } + } + return nil, err +} + +func (cli Zms) ImportDomain(dn string, filename string, admins []string) (*string, error) { + validatedAdmins := cli.validatedUsers(admins, true) + var spec map[string]interface{} + data, err := ioutil.ReadFile(filename) + if err != nil { + return nil, err + } + err = yaml.Unmarshal(data, &spec) + if err != nil { + return nil, err + } + dnSpec := spec["domain"].(map[interface{}]interface{}) + dn2 := dnSpec["name"].(string) + if dn2 != dn { + return nil, fmt.Errorf("Domain name mismatch. Expected " + dn + ", encountered " + dn2) + } + var productId int + if val, ok := dnSpec["product_id"]; ok { + productId = val.(int) + } else if strings.LastIndex(dn, ".") < 0 { + return nil, fmt.Errorf("Top Level Domains require an integer number specified for the Product ID") + } + productId32 := int32(productId) + _, err = cli.AddDomain(dn, &productId32, admins) + if err != nil { + return nil, err + } + var descr string + if val, ok := dnSpec["description"]; ok { + switch val.(type) { + case int: + descr = strconv.Itoa(val.(int)) + case string: + descr = val.(string) + } + } + var org string + if val, ok := dnSpec["org"]; ok { + org = val.(string) + } + var auditEnabled bool + if val, ok := dnSpec["audit_enabled"]; ok { + auditEnabled = val.(bool) + } + var account string + if val, ok := dnSpec["aws_account"]; ok { + switch val.(type) { + case int: + account = strconv.Itoa(val.(int)) + case string: + account = val.(string) + } + } + err = cli.SetCompleteDomainMeta(dn, descr, org, auditEnabled, account, productId32) + if err != nil { + return nil, err + } + lstRoles := dnSpec["roles"].([]interface{}) + err = cli.importRoles(dn, lstRoles, validatedAdmins, false) + if err != nil { + return nil, err + } + lstPolicies := dnSpec["policies"].([]interface{}) + err = cli.importPolicies(dn, lstPolicies, false) + if err != nil { + return nil, err + } + if lstServices, ok := dnSpec["services"].([]interface{}); ok { + err = cli.importServices(dn, lstServices, false) + if err != nil { + return nil, err + } + } + s := "[imported domain '" + dn + "' successfully]" + return &s, nil +} + +func (cli Zms) UpdateDomain(dn string, filename string) (*string, error) { + var spec map[string]interface{} + data, err := ioutil.ReadFile(filename) + if err != nil { + return nil, err + } + err = yaml.Unmarshal(data, &spec) + if err != nil { + return nil, err + } + dnSpec := spec["domain"].(map[interface{}]interface{}) + dn2 := dnSpec["name"].(string) + if dn2 != dn { + return nil, fmt.Errorf("Domain name mismatch. Expected " + dn + ", encountered " + dn2) + } + var descr string + if val, ok := dnSpec["description"]; ok { + switch val.(type) { + case int: + descr = strconv.Itoa(val.(int)) + case string: + descr = val.(string) + } + } + var org string + if val, ok := dnSpec["org"]; ok { + org = val.(string) + } + var auditEnabled bool + if val, ok := dnSpec["audit_enabled"]; ok { + auditEnabled = val.(bool) + } + var account string + if val, ok := dnSpec["aws_account"]; ok { + switch val.(type) { + case int: + account = strconv.Itoa(val.(int)) + case string: + account = val.(string) + } + } + var productId int + if val, ok := dnSpec["product_id"]; ok { + productId = val.(int) + } + productId32 := int32(productId) + err = cli.SetCompleteDomainMeta(dn, descr, org, auditEnabled, account, productId32) + if err != nil { + return nil, err + } + if lstRoles, ok := dnSpec["roles"].([]interface{}); ok { + err = cli.importRoles(dn, lstRoles, nil, true) + if err != nil { + return nil, err + } + } + if lstPolicies, ok := dnSpec["policies"].([]interface{}); ok { + err = cli.importPolicies(dn, lstPolicies, true) + if err != nil { + return nil, err + } + } + if lstServices, ok := dnSpec["services"].([]interface{}); ok { + err = cli.importServices(dn, lstServices, true) + if err != nil { + return nil, err + } + } + s := "[updated domain '" + dn + "' successfully]" + return &s, nil +} + +func (cli Zms) ExportDomain(dn string, filename string) (*string, error) { + verbose := cli.Verbose + cli.Verbose = false + data, err := cli.showDomain(dn, true) + cli.Verbose = verbose + if err == nil && data != nil { + s := *data + if filename == "-" { + fmt.Println(s) + } else { + err = ioutil.WriteFile(filename, []byte(s), 0644) + } + } + return nil, err +} + +func (cli Zms) SystemBackup(dir string) (*string, error) { + res, err := cli.Zms.GetDomainList(nil, "", "", nil, "", nil, "", "", "") + if err != nil { + return nil, err + } + verbose := cli.Verbose + cli.Verbose = false + for _, name := range res.Names { + fmt.Fprintf(os.Stdout, "Processing domain "+string(name)+"...\n") + filename := dir + "/" + string(name) + data, err := cli.showDomain(string(name), true) + if err == nil && data != nil { + s := *data + err = ioutil.WriteFile(filename, []byte(s), 0644) + } + } + cli.Verbose = verbose + s := "[exported " + strconv.Itoa(len(res.Names)) + " domains to " + dir + " directory]" + return &s, nil +} + +func (cli Zms) AddDomain(dn string, productId *int32, admins []string) (*string, error) { + // sanity check cli usage: sub domain admin list should not contain a productId + if productId == nil && admins != nil && len(admins) > 0 { + // just checking the first admin to decide if productId was actually added + _, err := cli.getInt32(admins[0]) + if err == nil { + s := "Do not specify Product ID when creating a sub domain. Only top level domains require a Product ID. Bad value: " + admins[0] + return nil, fmt.Errorf(s) + } + } + validatedAdmins := cli.validatedUsers(admins, true) + s, err := cli.createDomain(dn, productId, validatedAdmins) + if err != nil { + return nil, err + } + return s, nil +} + +func (cli Zms) createDomain(dn string, productId *int32, admins []string) (*string, error) { + i := strings.LastIndex(dn, ".") + name := dn + parent := "" + if i < 0 { + tld := zms.TopLevelDomain{} + tld.Name = zms.SimpleName(dn) + tld.AdminUsers = cli.createResourceList(admins) + tld.YpmId = productId + _, err := cli.Zms.PostTopLevelDomain(cli.AuditRef, &tld) + if err == nil { + s := "[domain created: " + dn + "]" + return &s, nil + } + return nil, err + } else { + parent = dn[0:i] + name = dn[i+1:] + // special case for top level user domains + // where parent is just the user domain + if parent == cli.UserDomain { + d := zms.UserDomain{} + d.Name = zms.SimpleName(name) + _, err := cli.Zms.PostUserDomain(zms.SimpleName(name), cli.AuditRef, &d) + if err == nil { + s := "[domain created: " + dn + "]" + return &s, nil + } + return nil, err + } else { + d := zms.SubDomain{} + d.Name = zms.SimpleName(name) + d.Parent = zms.DomainName(parent) + d.AdminUsers = cli.createResourceList(admins) + _, err := cli.Zms.PostSubDomain(zms.DomainName(parent), cli.AuditRef, &d) + if err == nil { + s := "[subdomain created: " + dn + "]" + return &s, nil + } + return nil, err + } + } +} + +func (cli Zms) LookupDomainByRole(roleMember string, roleName string) (*string, error) { + var buf bytes.Buffer + res, err := cli.Zms.GetDomainList(nil, "", "", nil, "", nil, zms.ResourceName(roleMember), zms.ResourceName(roleName), "") + if err == nil { + buf.WriteString("domains:\n") + for _, name := range res.Names { + buf.WriteString(indent_level1_dash + string(name) + "\n") + } + s := buf.String() + return &s, nil + } + return nil, err +} + +func (cli Zms) LookupDomainById(account string, productId *int32) (*string, error) { + var buf bytes.Buffer + res, err := cli.Zms.GetDomainList(nil, "", "", nil, account, productId, "", "", "") + if err == nil { + buf.WriteString("domain:\n") + for _, name := range res.Names { + buf.WriteString(indent_level1_dash + string(name) + "\n") + } + s := buf.String() + return &s, nil + } + return nil, err +} + +func (cli Zms) ListDomains(limit *int32, skip string, prefix string, depth *int32) (*string, error) { + var buf bytes.Buffer + fmt.Printf("Our url: " + cli.ZmsUrl + " : " + cli.Zms.URL + "\n") + res, err := cli.Zms.GetDomainList(limit, skip, prefix, depth, "", nil, "", "", "") + if err == nil { + buf.WriteString("domains:\n") + for _, name := range res.Names { + buf.WriteString(indent_level1_dash + string(name) + "\n") + } + s := buf.String() + return &s, nil + } + return nil, err +} + +func (cli Zms) GetSignedDomains(dn string, matchingTag string) (*string, error) { + var buf bytes.Buffer + res, etag, err := cli.Zms.GetSignedDomains(zms.DomainName(dn), "false", matchingTag) + if err != nil { + return nil, err + } + buf.WriteString("ETag: " + etag + "\n") + if res != nil { + for _, domain := range res.Domains { + cli.dumpSignedDomain(&buf, domain, false) + } + } + s := buf.String() + return &s, nil +} + +func (cli Zms) ShowDomain(dn string) (*string, error) { + + domain, err := cli.Zms.GetDomain(zms.DomainName(dn)) + if err != nil { + return nil, err + } + + var buf bytes.Buffer + cli.dumpDomain(&buf, domain) + + // now retrieve the full domain in one call + res, _, err := cli.Zms.GetSignedDomains(zms.DomainName(dn), "false", "") + if err != nil { + return nil, err + } + + // make sure we have a domain and it must be only one + if res != nil && len(res.Domains) == 1 { + cli.dumpSignedDomain(&buf, res.Domains[0], true) + } + s := buf.String() + return &s, nil +} + +func (cli Zms) CheckDomain(dn string) (*string, error) { + domainDataCheck, err := cli.Zms.GetDomainDataCheck(zms.DomainName(dn)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("checked data:\n") + cli.dumpDataCheck(&buf, *domainDataCheck) + s := buf.String() + return &s, nil +} + +func (cli Zms) showDomain(dn string, export bool) (*string, error) { + + domain, err := cli.Zms.GetDomain(zms.DomainName(dn)) + if err != nil { + return nil, err + } + + var buf bytes.Buffer + cli.dumpDomain(&buf, domain) + cli.dumpRoles(&buf, dn) + cli.dumpPolicies(&buf, dn) + cli.dumpServices(&buf, dn) + + var names []string + names, err = cli.entityNames(dn) + if err != nil { + return nil, err + } + cli.dumpEntities(&buf, dn, names) + + s := buf.String() + return &s, nil +} + +func (cli Zms) SetCompleteDomainMeta(dn string, descr string, org string, auditEnabled bool, account string, productId int32) error { + meta := zms.DomainMeta{ + Description: descr, + Org: zms.ResourceName(org), + Enabled: nil, + AuditEnabled: &auditEnabled, + Account: account, + YpmId: &productId, + } + return cli.Zms.PutDomainMeta(zms.DomainName(dn), cli.AuditRef, &meta) +} + +func (cli Zms) SetDomainMeta(dn string, descr string, org string, auditEnabled bool) (*string, error) { + domain, err := cli.Zms.GetDomain(zms.DomainName(dn)) + if err != nil { + return nil, err + } + meta := zms.DomainMeta{ + Description: descr, + Org: zms.ResourceName(org), + Enabled: domain.Enabled, + AuditEnabled: &auditEnabled, + Account: domain.Account, + YpmId: domain.YpmId, + } + err = cli.Zms.PutDomainMeta(zms.DomainName(dn), cli.AuditRef, &meta) + if err != nil { + return nil, err + } + s := "[domain " + dn + " metadata successfully updated]\n" + return &s, nil +} + +func (cli Zms) SetDomainAccount(dn string, account string) (*string, error) { + domain, err := cli.Zms.GetDomain(zms.DomainName(dn)) + if err != nil { + return nil, err + } + err = cli.SetCompleteDomainMeta(dn, domain.Description, string(domain.Org), *domain.AuditEnabled, account, *domain.YpmId) + if err != nil { + return nil, err + } + s := "[domain " + dn + " account successfully updated]\n" + return &s, nil +} + +func (cli Zms) SetDomainProductId(dn string, productId int32) (*string, error) { + domain, err := cli.Zms.GetDomain(zms.DomainName(dn)) + if err != nil { + return nil, err + } + err = cli.SetCompleteDomainMeta(dn, domain.Description, string(domain.Org), *domain.AuditEnabled, domain.Account, productId) + if err != nil { + return nil, err + } + s := "[domain " + dn + " product-id successfully updated]\n" + return &s, nil +} + +func (cli Zms) SetDefaultAdmins(dn string, admins []string) (*string, error) { + validatedAdmins := cli.createResourceList(cli.validatedUsers(admins, false)) + defaultAdmins := zms.DefaultAdmins{Admins: validatedAdmins} + err := cli.Zms.PutDefaultAdmins(zms.DomainName(dn), cli.AuditRef, &defaultAdmins) + if err != nil { + return nil, err + } + s := "[domain " + dn + " administrators successfully set]\n" + return &s, nil +} diff --git a/libs/go/zmscli/dump.go b/libs/go/zmscli/dump.go new file mode 100644 index 00000000000..71382b828e4 --- /dev/null +++ b/libs/go/zmscli/dump.go @@ -0,0 +1,449 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "log" + "strconv" + "strings" + + "../../../clients/go/zms" +) + +var ( + indent_level1 string = " " + indent_level1_dash string = " - " + indent_level1_dash_lvl string = " " + indent_level2 string = " " + indent_level2_dash string = " - " + indent_level2_dash_lvl string = " " + indent_level3 string = " " +) + +func (cli Zms) dumpDomain(buf *bytes.Buffer, domain *zms.Domain) { + buf.WriteString("domain:\n") + + buf.WriteString(indent_level1) + buf.WriteString("name: ") + buf.WriteString(string(domain.Name)) + buf.WriteString("\n") + + if domain.Description != "" { + buf.WriteString(indent_level1) + buf.WriteString("description: ") + buf.WriteString(domain.Description) + buf.WriteString("\n") + } + if domain.Account != "" { + buf.WriteString(indent_level1) + buf.WriteString("aws_account: ") + buf.WriteString(domain.Account) + buf.WriteString("\n") + } + productId := int(*domain.YpmId) + if productId != 0 { + buf.WriteString(indent_level1) + buf.WriteString("product_id: ") + buf.WriteString(strconv.Itoa(productId)) + buf.WriteString("\n") + } + if domain.Org != "" { + buf.WriteString(indent_level1) + buf.WriteString("org: ") + buf.WriteString(string(domain.Org)) + buf.WriteString("\n") + } + if domain.AuditEnabled != nil { + buf.WriteString(indent_level1) + buf.WriteString("audit_enabled: ") + buf.WriteString(strconv.FormatBool(*domain.AuditEnabled)) + buf.WriteString("\n") + } +} + +func (cli Zms) dumpDataCheck(buf *bytes.Buffer, dataCheck zms.DomainDataCheck) { + if len(dataCheck.DanglingRoles) != 0 { + buf.WriteString(indent_level1) + buf.WriteString("Roles not referenced in any assertion or empty: \n") + for _, item := range dataCheck.DanglingRoles { + buf.WriteString(indent_level2 + string(item) + "\n") + } + } + if dataCheck.DanglingPolicies != nil { + buf.WriteString(indent_level1) + buf.WriteString("Policies where assertion is referencing a non-existent role: \n") + for _, item := range dataCheck.DanglingPolicies { + buf.WriteString(indent_level2 + "policy: " + string(item.PolicyName) + " role: " + string(item.RoleName) + "\n") + } + } + buf.WriteString(indent_level1) + buf.WriteString("Number of policies: " + strconv.Itoa(int(dataCheck.PolicyCount)) + "\n") + buf.WriteString(indent_level1) + buf.WriteString("Number of assertions: " + strconv.Itoa(int(dataCheck.AssertionCount)) + "\n") + if len(dataCheck.ProvidersWithoutTrust) != 0 { + buf.WriteString(indent_level1) + buf.WriteString("On-boarded providers without trust relationship: \n") + for _, item := range dataCheck.ProvidersWithoutTrust { + buf.WriteString(indent_level2 + string(item) + "\n") + } + } + if len(dataCheck.TenantsWithoutAssumeRole) != 0 { + buf.WriteString(indent_level1) + buf.WriteString("On-boarded tenants without assume_role assertions: \n") + for _, item := range dataCheck.TenantsWithoutAssumeRole { + buf.WriteString(indent_level2 + string(item) + "\n") + } + } +} + +func (cli Zms) displayObjectName(buf *bytes.Buffer, yrn string, objType string, indent1 string) { + buf.WriteString(indent1) + buf.WriteString("name: ") + if cli.Verbose || objType == "" { + buf.WriteString(yrn) + } else { + buf.WriteString(localName(yrn, objType)) + } + buf.WriteString("\n") +} + +func (cli Zms) dumpRole(buf *bytes.Buffer, role zms.Role, auditLog bool, indent1 string, indent2 string) { + cli.displayObjectName(buf, string(role.Name), ":role.", indent1) + if role.Members != nil && len(role.Members) > 0 { + buf.WriteString(indent2) + buf.WriteString("members: [") + cli.dumpUserName(buf, strings.Join(cli.createStringList(role.Members), ", "), true) + buf.WriteString("]\n") + if auditLog { + buf.WriteString(indent2) + buf.WriteString("changes: \n") + indent3_dash := indent2 + " - " + indent3_dash_lvl := indent2 + " " + for _, logItem := range role.AuditLog { + buf.WriteString(indent3_dash + "Action: " + logItem.Action + "\n") + buf.WriteString(indent3_dash_lvl + "Admin: " + string(logItem.Admin) + "\n") + buf.WriteString(indent3_dash_lvl + "Member: " + string(logItem.Member) + "\n") + buf.WriteString(indent3_dash_lvl + "Date: " + logItem.Created.String() + "\n") + buf.WriteString(indent3_dash_lvl + "Ref: " + logItem.AuditRef + "\n") + } + } + } + if role.Trust != "" { + buf.WriteString(indent2) + buf.WriteString("trust: ") + buf.WriteString(string(role.Trust)) + buf.WriteString("\n") + } +} + +func (cli Zms) dumpRoles(buf *bytes.Buffer, dn string) { + buf.WriteString(indent_level1) + buf.WriteString("roles:\n") + members := true + roles, err := cli.Zms.GetRoles(zms.DomainName(dn), &members) + if err != nil { + log.Fatalf("Unable to get role list - error: %v", err) + } + for _, role := range roles.List { + cli.dumpRole(buf, *role, false, indent_level2_dash, indent_level2_dash_lvl) + } +} + +func localName(yrn string, prefix string) string { + idx := strings.Index(yrn, prefix) + s := yrn + if idx != -1 { + s = yrn[idx+len(prefix):] + } + return s +} + +func (cli Zms) dumpAssertion(buf *bytes.Buffer, assertion *zms.Assertion, dn string, indent1 string) { + showYrn := cli.Verbose + buf.WriteString(indent1) + effect := "grant" + if assertion.Effect != nil { + effect = strings.ToLower(assertion.Effect.String()) + if effect == "allow" { + effect = "grant" + } + } + buf.WriteString(effect) + buf.WriteString(" ") + buf.WriteString(assertion.Action) + buf.WriteString(" to ") + if showYrn { + buf.WriteString(assertion.Role) + } else { + buf.WriteString(localName(assertion.Role, ":role.")) + } + buf.WriteString(" on ") + if showYrn { + buf.WriteString(assertion.Resource) + } else { + prefix := dn + ":" + if strings.HasPrefix(assertion.Resource, prefix) { + buf.WriteString(assertion.Resource[len(prefix):]) + } else { + buf.WriteString(assertion.Resource) + } + } + buf.WriteString("\n") +} + +func (cli Zms) dumpPolicy(buf *bytes.Buffer, policy zms.Policy, indent1 string, indent2 string) { + yrn := string(policy.Name) + cli.displayObjectName(buf, yrn, ":policy.", indent1) + dn := yrn[0:strings.LastIndex(yrn, ":")] + buf.WriteString(indent2) + if len(policy.Assertions) == 0 { + buf.WriteString("assertions: []\n") + } else { + buf.WriteString("assertions:\n") + indent3 := indent2 + " - " + for _, assertion := range policy.Assertions { + cli.dumpAssertion(buf, assertion, dn, indent3) + } + } +} + +func (cli Zms) dumpPolicies(buf *bytes.Buffer, dn string) { + buf.WriteString(indent_level1) + buf.WriteString("policies:\n") + assertions := true + policies, err := cli.Zms.GetPolicies(zms.DomainName(dn), &assertions) + if err != nil { + log.Fatalf("Unable to get policy list - error: %v", err) + } + for _, policy := range policies.List { + cli.dumpPolicy(buf, *policy, indent_level2_dash, indent_level2_dash_lvl) + } +} + +func (cli Zms) dumpEntities(buf *bytes.Buffer, dn string, entitynames []string) { + if len(entitynames) > 0 { + buf.WriteString(indent_level1) + buf.WriteString("entities:\n") + for _, en := range entitynames { + entity, err := cli.Zms.GetEntity(zms.DomainName(dn), zms.EntityName(en)) + if err != nil { + return + } + cli.dumpEntity(buf, *entity, indent_level2_dash, indent_level2_dash_lvl) + } + } +} + +func (cli Zms) dumpEntity(buf *bytes.Buffer, entity zms.Entity, indent1 string, indent2 string) { + cli.displayObjectName(buf, string(entity.Name), "", indent1) + buf.WriteString(indent2) + buf.WriteString("value:\n") + indent3_dash := indent2 + " - " + indent3_dash_lvl := indent2 + " " + for key, data := range entity.Value { + buf.WriteString(indent3_dash + "key: " + string(key) + "\n") + buf.WriteString(indent3_dash_lvl + "data: " + data.(string) + "\n") + } +} + +func (cli Zms) dumpService(buf *bytes.Buffer, svc zms.ServiceIdentity, indent1 string, indent2 string) { + cli.displayObjectName(buf, string(svc.Name), "", indent1) + if svc.Modified != nil { + buf.WriteString(indent2) + buf.WriteString("modified: ") + buf.WriteString(svc.Modified.String()) + buf.WriteString("\n") + } + if svc.Executable != "" { + buf.WriteString(indent2) + buf.WriteString("executable: ") + buf.WriteString(svc.Executable) + buf.WriteString("\n") + } + if svc.User != "" { + buf.WriteString(indent2) + buf.WriteString("user: ") + buf.WriteString(svc.User) + buf.WriteString("\n") + } + if svc.Group != "" { + buf.WriteString(indent2) + buf.WriteString("group: ") + buf.WriteString(svc.Group) + buf.WriteString("\n") + } + if svc.ProviderEndpoint != "" { + buf.WriteString(indent2) + buf.WriteString("providerEndpoint: ") + buf.WriteString(svc.ProviderEndpoint) + buf.WriteString("\n") + } + if svc.Hosts != nil { + buf.WriteString(indent2) + buf.WriteString("hosts: [") + buf.WriteString(strings.Join(svc.Hosts, ", ")) + buf.WriteString("]\n") + } + buf.WriteString(indent2) + if len(svc.PublicKeys) == 0 { + buf.WriteString("publicKeys: []\n") + } else { + buf.WriteString("publicKeys: \n") + for _, publicKey := range svc.PublicKeys { + buf.WriteString(indent2 + " - keyId: " + publicKey.Id + "\n") + buf.WriteString(indent2 + " value: " + publicKey.Key + "\n") + } + } +} + +func (cli Zms) dumpObjectList(buf *bytes.Buffer, list []string, dn string, object string) { + for _, item := range list { + if cli.Verbose { + buf.WriteString(indent_level1_dash + dn + ":" + object + "." + item + "\n") + } else { + buf.WriteString(indent_level1_dash + item + "\n") + } + } +} + +func (cli Zms) dumpServices(buf *bytes.Buffer, dn string) { + publickeys := true + hosts := true + services, err := cli.Zms.GetServiceIdentities(zms.DomainName(dn), &publickeys, &hosts) + if err != nil { + log.Fatalf("Unable to get service list - error: %v", err) + } + if len(services.List) > 0 { + buf.WriteString(indent_level1) + buf.WriteString("services:\n") + for _, service := range services.List { + cli.dumpService(buf, *service, indent_level2_dash, indent_level2_dash_lvl) + } + } +} + +func (cli Zms) dumpMultilineString(buf *bytes.Buffer, s string, indent string) { + lst := strings.Split(s, "\n") + if len(lst) > 0 { + buf.WriteString("\n") + for _, ss := range lst { + buf.WriteString(indent) + buf.WriteString(ss) + buf.WriteString("\n") + } + } else { + buf.WriteString(s) + } +} + +func (cli Zms) dumpTenancy(buf *bytes.Buffer, tenancy *zms.Tenancy, indent string) { + buf.WriteString(indent + "tenant: " + string(tenancy.Domain) + "\n") + buf.WriteString(indent + "provider: " + string(tenancy.Service) + "\n") + for _, resourceGroup := range tenancy.ResourceGroups { + buf.WriteString(indent + "resource-group: " + string(resourceGroup) + "\n") + } +} + +func (cli Zms) dumpTenantRoles(buf *bytes.Buffer, tenantRoles *zms.TenantRoles, indent1 string, indent2 string) { + for _, roleAction := range tenantRoles.Roles { + buf.WriteString(indent1 + "role: " + string(roleAction.Role) + "\n") + buf.WriteString(indent2 + "action: " + roleAction.Action + "\n") + } +} + +func (cli Zms) dumpTenantResourceGroupRoles(buf *bytes.Buffer, tenantRoles *zms.TenantResourceGroupRoles, indent1 string, indent2 string) { + buf.WriteString(indent1 + "name: " + string(tenantRoles.ResourceGroup) + "\n") + buf.WriteString(indent2 + "tenant-roles:\n") + indent3_dash := indent2 + " - " + indent3_dash_lvl := indent2 + " " + for _, roleAction := range tenantRoles.Roles { + buf.WriteString(indent3_dash + "role: " + string(roleAction.Role) + "\n") + buf.WriteString(indent3_dash_lvl + "action: " + roleAction.Action + "\n") + } +} + +func (cli Zms) dumpProviderResourceGroupRoles(buf *bytes.Buffer, providerRoles *zms.ProviderResourceGroupRoles, indent1 string, indent2 string) { + buf.WriteString(indent1 + "name: " + string(providerRoles.ResourceGroup) + "\n") + buf.WriteString(indent2 + "provider-roles:\n") + for _, roleAction := range providerRoles.Roles { + buf.WriteString(indent2 + " - " + string(roleAction.Role) + "\n") + } +} + +func (cli Zms) dumpUserName(buf *bytes.Buffer, user string, showYrn bool) { + if showYrn { + buf.WriteString(user) + } else { + buf.WriteString(strings.Replace(user, cli.UserDomain+".", "", -1)) + } +} + +func (cli Zms) dumpRoleMembership(buf *bytes.Buffer, member zms.Membership) { + buf.WriteString(indent_level1_dash + "member: ") + cli.dumpUserName(buf, string(member.MemberName), true) + buf.WriteString("\n") + buf.WriteString(indent_level1_dash_lvl + "result: " + strconv.FormatBool(*member.IsMember) + "\n") +} + +func (cli Zms) dumpSignedDomain(buf *bytes.Buffer, signedDomain *zms.SignedDomain, showDomain bool) { + + domainData := signedDomain.Domain + if !showDomain { + buf.WriteString("domain: ") + buf.WriteString("\n") + buf.WriteString(indent_level1) + buf.WriteString("name: ") + buf.WriteString(string(domainData.Name)) + buf.WriteString("\n") + if domainData.Account != "" { + buf.WriteString(indent_level1) + buf.WriteString("account: ") + buf.WriteString(domainData.Account) + buf.WriteString("\n") + } + buf.WriteString(indent_level1) + buf.WriteString("signature: ") + buf.WriteString(signedDomain.Signature) + buf.WriteString("\n") + buf.WriteString(indent_level1) + buf.WriteString("keyId: ") + buf.WriteString(signedDomain.KeyId) + buf.WriteString("\n") + } + buf.WriteString(indent_level1) + buf.WriteString("modified: ") + buf.WriteString(domainData.Modified.String()) + buf.WriteString("\n") + + buf.WriteString(indent_level1) + buf.WriteString("roles:\n") + for _, role := range domainData.Roles { + cli.dumpRole(buf, *role, false, indent_level2_dash, indent_level2_dash_lvl) + } + + buf.WriteString(indent_level1) + buf.WriteString("policies:\n") + signedPolicies := domainData.Policies + domainPolicies := signedPolicies.Contents + for _, policy := range domainPolicies.Policies { + cli.dumpPolicy(buf, *policy, indent_level2_dash, indent_level2_dash_lvl) + } + + if len(domainData.Services) > 0 { + buf.WriteString(indent_level1) + buf.WriteString("services:\n") + for _, service := range domainData.Services { + cli.dumpService(buf, *service, indent_level2_dash, indent_level2_dash_lvl) + } + } +} + +func (cli Zms) dumpProfile(buf *bytes.Buffer, name, content string) { + buf.WriteString("profile:\n") + buf.WriteString(indent_level1) + buf.WriteString("name: ") + buf.WriteString(name) + cli.dumpMultilineString(buf, content, indent_level1) +} diff --git a/libs/go/zmscli/dump_test.go b/libs/go/zmscli/dump_test.go new file mode 100644 index 00000000000..17ed03732fa --- /dev/null +++ b/libs/go/zmscli/dump_test.go @@ -0,0 +1,60 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "testing" +) + +func TestLocalName(t *testing.T) { + + local := localName("coretech:role.role1", ":role.") + if local != "role1" { + t.Error("coretech:role.role1 didn't return role1 with prefix :role.") + } + + local = localName("coretech:role.role1.role2", ":role.") + if local != "role1.role2" { + t.Error("coretech:role.role1.role2 didn't return role1.role2 with prefix :role.") + } + + local = localName("coretech.service1", ":service.") + if local != "coretech.service1" { + t.Error("coretech.service1 didn't return service1 with prefix :service.") + } +} + +func TestDisplayObjectName(t *testing.T) { + + var buf bytes.Buffer + zms := Zms{} + + zms.verbose = false + zms.displayObjectName(&buf, "coretech:role.role1", ":role.", "--") + if buf.String() != "--name: role1\n" { + t.Error("coretech:role.role1 didn't display the correct object name with verbose off") + } + + buf.Reset() + zms.verbose = true + zms.displayObjectName(&buf, "coretech:role.role1", ":role.", "--") + if buf.String() != "--name: coretech:role.role1\n" { + t.Error("coretech:role.role1 didn't display the correct object name with verbose on") + } + + buf.Reset() + zms.verbose = false + zms.displayObjectName(&buf, "coretech:role.role1", "", "--") + if buf.String() != "--name: coretech:role.role1\n" { + t.Error("coretech:role.role1 didn't display the correct object name with empty obj type") + } + + buf.Reset() + zms.verbose = false + zms.displayObjectName(&buf, "coretech:role.role1", ":policy.", "--") + if buf.String() != "--name: coretech:role.role1\n" { + t.Error("coretech:role.role1 didn't display the correct object name with no match obj type") + } +} diff --git a/libs/go/zmscli/entity.go b/libs/go/zmscli/entity.go new file mode 100644 index 00000000000..d1a9ec02573 --- /dev/null +++ b/libs/go/zmscli/entity.go @@ -0,0 +1,76 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "strings" + + "github.com/ardielle/ardielle-go/rdl" + "../../../clients/go/zms" +) + +func (cli Zms) ShowEntity(dn string, en string) (*string, error) { + entity, err := cli.Zms.GetEntity(zms.DomainName(dn), zms.EntityName(en)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("entity:\n") + cli.dumpEntity(&buf, *entity, indent_level1_dash, indent_level1_dash_lvl) + s := buf.String() + return &s, nil +} + +func (cli Zms) AddEntity(dn string, en string, values []string) (*string, error) { + entityValue := make(map[rdl.Symbol]interface{}) + for _, item := range values { + tokens := strings.Split(item, "=") + if len(tokens) == 2 { + entityValue[rdl.Symbol(tokens[0])] = tokens[1] + } + } + var entity zms.Entity + entity.Name = zms.EntityName(en) + entity.Value = entityValue + err := cli.Zms.PutEntity(zms.DomainName(dn), zms.EntityName(en), cli.AuditRef, &entity) + if err != nil { + return nil, err + } + return cli.ShowEntity(dn, en) +} + +func (cli Zms) DeleteEntity(dn string, en string) (*string, error) { + err := cli.Zms.DeleteEntity(zms.DomainName(dn), zms.EntityName(en), cli.AuditRef) + if err != nil { + return nil, err + } else { + s := "[Deleted entity: " + dn + "." + en + "]" + return &s, nil + } +} + +func (cli Zms) entityNames(dn string) ([]string, error) { + entities := make([]string, 0) + lst, err := cli.Zms.GetEntityList(zms.DomainName(dn)) + if err != nil { + return nil, err + } + for _, n := range lst.Names { + entities = append(entities, string(n)) + } + return entities, nil +} + +func (cli Zms) ListEntities(dn string) (*string, error) { + var buf bytes.Buffer + entities, err := cli.entityNames(dn) + if err != nil { + return nil, err + } + buf.WriteString("entities:\n") + cli.dumpObjectList(&buf, entities, dn, "entity") + s := buf.String() + return &s, nil +} diff --git a/libs/go/zmscli/import.go b/libs/go/zmscli/import.go new file mode 100644 index 00000000000..bc050aa5b12 --- /dev/null +++ b/libs/go/zmscli/import.go @@ -0,0 +1,212 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "fmt" + "os" + "strconv" + "strings" + + "../../../clients/go/zms" +) + +func (cli Zms) importRoles(dn string, lstRoles []interface{}, validatedAdmins []string, skipErrors bool) error { + for _, role := range lstRoles { + roleMap := role.(map[interface{}]interface{}) + rn := roleMap["name"].(string) + fmt.Fprintf(os.Stdout, "Processing role "+rn+"...\n") + if val, ok := roleMap["members"]; ok { + mem := val.([]interface{}) + members := make([]string, 0) + var err error + if rn == "admin" && validatedAdmins != nil { + // need to retrieve the current admin role + // and make sure to remove any existing admin + role, err := cli.Zms.GetRole(zms.DomainName(dn), "admin", nil, nil) + if err != nil { + return err + } + roleMembers := cli.createStringList(role.Members) + for _, m := range mem { + if !cli.contains(roleMembers, m.(string)) { + members = append(members, m.(string)) + } + } + for _, a := range validatedAdmins { + if !cli.contains(members, a) && !cli.contains(roleMembers, a) { + members = append(members, a) + } + } + _, err = cli.AddMembers(dn, rn, members) + } else { + for _, m := range mem { + members = append(members, m.(string)) + } + b := cli.Verbose + cli.Verbose = true + _, err = cli.AddGroupRole(dn, rn, members) + cli.Verbose = b + } + if err != nil { + if skipErrors { + fmt.Println("***", err) + } else { + return err + } + } + } else if val, ok := roleMap["trust"]; ok { + trust := val.(string) + _, err := cli.AddDelegatedRole(dn, rn, trust) + if err != nil { + if skipErrors { + fmt.Println("***", err) + } else { + return err + } + } + } else { + members := make([]string, 0) + b := cli.Verbose + cli.Verbose = true + _, err := cli.AddGroupRole(dn, rn, members) + cli.Verbose = b + if err != nil { + if skipErrors { + fmt.Println("***", err) + } else { + return err + } + } + } + } + return nil +} + +func (cli Zms) importPolicies(dn string, lstPolicies []interface{}, skipErrors bool) error { + for _, policy := range lstPolicies { + policyMap := policy.(map[interface{}]interface{}) + name := policyMap["name"].(string) + fmt.Fprintf(os.Stdout, "Processing policy "+name+"...\n") + assertions := make([]*zms.Assertion, 0) + if val, ok := policyMap["assertions"]; ok { + if val == nil { + fmt.Fprintf(os.Stdout, "Skipping empty policy: "+name+"\n") + continue + } + lst := val.([]interface{}) + if len(lst) > 0 { + for _, a := range lst { + if name == "admin" && a.(string) == "grant * to admin on *" { + continue + } + assertion := strings.Split(a.(string), " ") + newAssertion, err := parseAssertion(dn, assertion) + if err != nil { + if skipErrors { + fmt.Println("***", err) + } else { + return err + } + } + assertions = append(assertions, newAssertion) + } + } + } + if name != "admin" { + _, err := cli.AddPolicyWithAssertions(dn, name, assertions) + if err != nil { + if skipErrors { + fmt.Println("***", err) + } else { + return err + } + } + } + } + return nil +} + +func (cli Zms) generatePublicKeys(lstPublicKeys []interface{}) []*zms.PublicKeyEntry { + publicKeys := make([]*zms.PublicKeyEntry, 0) + if lstPublicKeys != nil { + for _, pubKey := range lstPublicKeys { + publicKeyMap := pubKey.(map[interface{}]interface{}) + // if we're using just version numbers then yaml + // will interpret the key id as integer + var keyId string + switch v := publicKeyMap["keyId"].(type) { + case int: + keyId = strconv.Itoa(v) + case string: + keyId = v + default: + panic("Unknown data type for keyid") + } + value := publicKeyMap["value"].(string) + publicKey := zms.PublicKeyEntry{ + Key: value, + Id: keyId, + } + publicKeys = append(publicKeys, &publicKey) + } + } + return publicKeys +} + +func (cli Zms) importServices(dn string, lstServices []interface{}, skipErrors bool) error { + for _, service := range lstServices { + serviceMap := service.(map[interface{}]interface{}) + name := serviceMap["name"].(string) + fmt.Fprintf(os.Stdout, "Processing service "+name+"...\n") + var lstPublicKeys []interface{} + if val, ok := serviceMap["publicKeys"]; ok { + lstPublicKeys = val.([]interface{}) + } + publicKeys := cli.generatePublicKeys(lstPublicKeys) + _, err := cli.AddServiceWithKeys(dn, name, publicKeys) + if err != nil { + return err + } + if val, ok := serviceMap["providerEndpoint"]; ok { + endpoint := val.(string) + if endpoint != "" { + _, err = cli.SetServiceEndpoint(dn, name, endpoint) + if err != nil { + return err + } + } + } + user := "" + if val, ok := serviceMap["user"]; ok { + user = val.(string) + } + group := "" + if val, ok := serviceMap["group"]; ok { + group = val.(string) + } + exe := "" + if val, ok := serviceMap["executable"]; ok { + exe = val.(string) + } + if user != "" || group != "" || exe != "" { + _, err = cli.SetServiceExe(dn, name, exe, user, group) + if err != nil { + return err + } + } + if val, ok := serviceMap["hosts"]; ok { + hostList := val.([]interface{}) + hosts := make([]string, 0) + for _, host := range hostList { + hosts = append(hosts, host.(string)) + } + _, err = cli.AddServiceHost(dn, name, hosts) + if err != nil { + return err + } + } + } + return nil +} diff --git a/libs/go/zmscli/policy.go b/libs/go/zmscli/policy.go new file mode 100644 index 00000000000..bc58565fd15 --- /dev/null +++ b/libs/go/zmscli/policy.go @@ -0,0 +1,234 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "fmt" + "strings" + + "github.com/ardielle/ardielle-go/rdl" + "../../../clients/go/zms" +) + +func (cli Zms) policyNames(dn string) ([]string, error) { + names := make([]string, 0) + lst, err := cli.Zms.GetPolicyList(zms.DomainName(dn), nil, "") + if err != nil { + return nil, err + } + for _, n := range lst.Names { + names = append(names, string(n)) + } + return names, nil +} + +func (cli Zms) ListPolicies(dn string) (*string, error) { + var buf bytes.Buffer + policies, err := cli.policyNames(dn) + if err != nil { + return nil, err + } + buf.WriteString("policies:\n") + cli.dumpObjectList(&buf, policies, dn, "policy") + s := buf.String() + return &s, nil +} + +func (cli Zms) ShowPolicy(dn string, name string) (*string, error) { + policy, err := cli.Zms.GetPolicy(zms.DomainName(dn), zms.EntityName(name)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("policy:\n") + cli.dumpPolicy(&buf, *policy, indent_level1_dash, indent_level1_dash_lvl) + s := buf.String() + return &s, nil +} + +func parseAssertion(dn string, lst []string) (*zms.Assertion, error) { + err := fmt.Errorf("Bad assertion syntax. Should be ' to on '") + n := len(lst) + var assertion zms.Assertion + if n != 6 { + return nil, err + } + if strings.ToLower(lst[2]) != "to" { + return nil, err + } + if strings.ToLower(lst[4]) != "on" { + return nil, err + } + // we are using grant in our command line utility but the + // actual effect in the spec is ALLOW + effect := strings.ToUpper(lst[0]) + if effect != "GRANT" { + if effect != "DENY" { + return nil, err + } + } else { + effect = "ALLOW" + } + var assertionEffect = zms.NewAssertionEffect(effect) + assertion.Effect = &assertionEffect + assertion.Action = lst[1] + role := lst[3] + if strings.Index(role, ":") < 0 { + role = dn + ":role." + role + } + assertion.Role = role + resource := lst[5] + if strings.Index(resource, ":") < 0 { + resource = dn + ":" + resource + } + assertion.Resource = resource + return &assertion, nil +} + +func (cli Zms) AddPolicyWithAssertions(dn string, pn string, assertions []*zms.Assertion) (*string, error) { + yrn := dn + ":policy." + pn + policy := zms.Policy{ + Name: zms.ResourceName(yrn), + Modified: nil, + Assertions: assertions, + } + err := cli.Zms.PutPolicy(zms.DomainName(dn), zms.EntityName(pn), cli.AuditRef, &policy) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowPolicy(dn, pn) + } +} + +func (cli Zms) AddPolicy(dn string, pn string, assertion []string) (*string, error) { + yrn := dn + ":policy." + pn + _, err := cli.Zms.GetPolicy(zms.DomainName(dn), zms.EntityName(pn)) + if err == nil { + return nil, fmt.Errorf("Policy already exists: %v", yrn) + } else { + switch v := err.(type) { + case rdl.ResourceError: + if v.Code != 404 { + return nil, v + } + } + } + policy := zms.Policy{} + policy.Name = zms.ResourceName(yrn) + if assertion == nil || len(assertion) == 0 { + policy.Assertions = make([]*zms.Assertion, 0) + } else { + newAssertion, err := parseAssertion(dn, assertion) + if err != nil { + return nil, err + } + tmp := [1]*zms.Assertion{newAssertion} + policy.Assertions = tmp[:] + } + err = cli.Zms.PutPolicy(zms.DomainName(dn), zms.EntityName(pn), cli.AuditRef, &policy) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowPolicy(dn, pn) + } +} + +func (cli Zms) AddAssertion(dn string, pn string, assertion []string) (*string, error) { + newAssertion, err := parseAssertion(dn, assertion) + if err != nil { + return nil, err + } + _, err = cli.Zms.PutAssertion(zms.DomainName(dn), zms.EntityName(pn), cli.AuditRef, newAssertion) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowPolicy(dn, pn) + } +} + +func (cli Zms) assertionMatch(assertion1 *zms.Assertion, assertion2 *zms.Assertion) bool { + if assertion1.Action != assertion2.Action { + return false + } + assert1Effect := "ALLOW" + if assertion1.Effect != nil { + assert1Effect = assertion1.Effect.String() + } + assert2Effect := "ALLOW" + if assertion2.Effect != nil { + assert2Effect = assertion2.Effect.String() + } + if assert1Effect != assert2Effect { + return false + } + if assertion1.Resource != assertion2.Resource { + return false + } + if assertion1.Role != assertion2.Role { + return false + } + return true +} + +func (cli Zms) removeAssertion(policy *zms.Policy, deleteAssertion *zms.Assertion) error { + match_index := -1 + for index, assertion := range policy.Assertions { + if cli.assertionMatch(assertion, deleteAssertion) { + match_index = index + break + } + } + if match_index == -1 { + return fmt.Errorf("Policy does not have the specified assertion") + } + policy.Assertions = append(policy.Assertions[:match_index], policy.Assertions[match_index+1:]...) + return nil +} + +func (cli Zms) DeleteAssertion(dn string, pn string, assertion []string) (*string, error) { + policy, err := cli.Zms.GetPolicy(zms.DomainName(dn), zms.EntityName(pn)) + if err != nil { + return nil, err + } + deleteAssertion, err := parseAssertion(dn, assertion) + if err != nil { + return nil, err + } + err = cli.removeAssertion(policy, deleteAssertion) + if err != nil { + return nil, err + } + err = cli.Zms.PutPolicy(zms.DomainName(dn), zms.EntityName(pn), cli.AuditRef, policy) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowPolicy(dn, pn) + } +} + +func (cli Zms) DeletePolicy(dn string, pn string) (*string, error) { + err := cli.Zms.DeletePolicy(zms.DomainName(dn), zms.EntityName(pn), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Deleted policy: " + pn + "]" + return &s, nil +} diff --git a/libs/go/zmscli/policy_test.go b/libs/go/zmscli/policy_test.go new file mode 100644 index 00000000000..46501742b6c --- /dev/null +++ b/libs/go/zmscli/policy_test.go @@ -0,0 +1,118 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "testing" + + "../../../clients/go/zms" +) + +func TestAssertionMatchTrue(t *testing.T) { + + zms_cli := zms.ZMSClient{ + URL: "dev.zms", + Transport: nil, + CredsHeader: nil, + CredsToken: nil, + Timeout: 0, + } + cli := Zms{"dev.zms", "ntoken", false, false, false, zms_cli, "domain", "", false} + + denyEffect := zms.NewAssertionEffect("DENY") + allowEffect := zms.NewAssertionEffect("ALLOW") + + assertion1 := zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: nil} + assertion2 := zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: nil} + + match := cli.assertionMatch(&assertion1, &assertion2) + if !match { + t.Error("assertion #1 didn't match as expected") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: &allowEffect} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: nil} + match = cli.assertionMatch(&assertion1, &assertion2) + if !match { + t.Error("assertion #2 didn't match as expected") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: nil} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: &allowEffect} + match = cli.assertionMatch(&assertion1, &assertion2) + if !match { + t.Error("assertion #3 didn't match as expected") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: &allowEffect} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: &allowEffect} + match = cli.assertionMatch(&assertion1, &assertion2) + if !match { + t.Error("assertion #4 didn't match as expected") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: &denyEffect} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: &denyEffect} + match = cli.assertionMatch(&assertion1, &assertion2) + if !match { + t.Error("assertion #5 didn't match as expected") + } +} + +func TestAssertionMatchFalse(t *testing.T) { + + zms_cli := zms.ZMSClient{ + URL: "dev.zms", + Transport: nil, + CredsHeader: nil, + CredsToken: nil, + Timeout: 0, + } + cli := Zms{"dev.zms", "ntoken", false, false, false, zms_cli, "domain", "", false} + + denyEffect := zms.NewAssertionEffect("DENY") + allowEffect := zms.NewAssertionEffect("ALLOW") + + assertion1 := zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: nil} + assertion2 := zms.Assertion{Role: "role2", Resource: "resource", Action: "action", Effect: nil} + match := cli.assertionMatch(&assertion1, &assertion2) + if match { + t.Error("assertion #1 incorrectly matched") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action", Effect: nil} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource", Action: "action", Effect: nil} + match = cli.assertionMatch(&assertion1, &assertion2) + if match { + t.Error("assertion #2 incorrectly matched") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action111", Effect: nil} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action11", Effect: nil} + match = cli.assertionMatch(&assertion1, &assertion2) + if match { + t.Error("assertion #3 incorrectly matched") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action", Effect: &allowEffect} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action", Effect: &denyEffect} + match = cli.assertionMatch(&assertion1, &assertion2) + if match { + t.Error("assertion #4 incorrectly matched") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action", Effect: nil} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action", Effect: &denyEffect} + match = cli.assertionMatch(&assertion1, &assertion2) + if match { + t.Error("assertion #5 incorrectly matched") + } + + assertion1 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action", Effect: &denyEffect} + assertion2 = zms.Assertion{Role: "role1", Resource: "resource1", Action: "action", Effect: nil} + match = cli.assertionMatch(&assertion1, &assertion2) + if match { + t.Error("assertion #6 incorrectly matched") + } +} diff --git a/libs/go/zmscli/profile.go b/libs/go/zmscli/profile.go new file mode 100644 index 00000000000..2b865666668 --- /dev/null +++ b/libs/go/zmscli/profile.go @@ -0,0 +1,161 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "fmt" + "strings" + + "github.com/ardielle/ardielle-go/rdl" + "../../../clients/go/zms" +) + +type Assertion []string + +func (cli Zms) getProfilePolicies(name string) (string, string, map[string]Assertion) { + userProfile := fmt.Sprintf("user.profile.%s", name) + superUserProfile := fmt.Sprintf("superuser.profile.%s", name) + + policies := map[string]Assertion{ + userProfile: []string{"grant", "node_user", "to", userProfile, "on", "node.*"}, + superUserProfile: []string{"grant", "node_sudo", "to", superUserProfile, "on", "node.*"}, + } + return userProfile, superUserProfile, policies +} + +func (cli Zms) addProfileRoles(dn string, names []string) error { + for _, name := range names { + // Add the role, if it doesn't exist + _, err := cli.Zms.GetRole(zms.DomainName(dn), zms.EntityName(name), nil, nil) + if err != nil { + switch v := err.(type) { + case rdl.ResourceError: + if v.Code != 404 { + return v + } + } + + _, err = cli.AddGroupRole(dn, name, []string{}) + if err != nil { + return err + } + } + } + + return nil +} + +func (cli Zms) addProfilePolicies(dn string, policies map[string]Assertion) error { + for name, assertion := range policies { + _, err := cli.Zms.GetPolicy(zms.DomainName(dn), zms.EntityName(name)) + if err != nil { + switch v := err.(type) { + case rdl.ResourceError: + if v.Code != 404 { + return v + } + } + // Policy doesn't exist, add it + _, err = cli.AddPolicy(dn, name, assertion) + if err != nil { + return err + } + } else { + // Policy exists, add the assertion (note: ZMS overrides an existing assertion) + _, err = cli.AddAssertion(dn, name, assertion) + if err != nil { + return err + } + } + } + + return nil +} + +func (cli Zms) isValidProfilePolicy(dn, policyName string, assertion Assertion) (error, bool) { + match := func(zmsAssertion *zms.Assertion) bool { + effect := map[string]zms.AssertionEffect{ + "grant": zms.ALLOW, + "deny": zms.DENY, + } + if *zmsAssertion.Effect == effect[assertion[0]] && + zmsAssertion.Action == assertion[1] && + zmsAssertion.Role == dn+":role."+assertion[3] && + zmsAssertion.Resource == dn+":"+assertion[5] { + return true + } + return false + } + + policy, err := cli.Zms.GetPolicy(zms.DomainName(dn), zms.EntityName(policyName)) + if err != nil { + return err, false + } + + // Policy exists, check for the required assertion + for _, a := range policy.Assertions { + if match(a) { + return nil, true + } + } + return nil, false +} + +func (cli Zms) AddProfile(dn, name string) (*string, error) { + _, err := cli.Zms.GetDomain(zms.DomainName(dn)) + if err != nil { + return nil, err + } + + userProfile, superUserProfile, policies := cli.getProfilePolicies(name) + + err = cli.addProfileRoles(dn, []string{userProfile, superUserProfile}) + if err != nil { + return nil, err + } + + err = cli.addProfilePolicies(dn, policies) + if err != nil { + return nil, err + } + + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowProfile(dn, name) + } +} + +func (cli Zms) ShowProfile(dn, name string) (*string, error) { + userProfile, superUserProfile, policies := cli.getProfilePolicies(name) + + // Verify the expected profile policies and assertions in them + for policyName, assertion := range policies { + err, found := cli.isValidProfilePolicy(dn, policyName, assertion) + if err != nil { + return nil, fmt.Errorf("Profile error: %v", err) + } + if !found { + return nil, fmt.Errorf("Profile error: Assertion (%s) not found in the policy: %s", strings.Join(assertion, " "), policyName) + } + } + + userRole, err := cli.ShowRole(dn, userProfile, false, false) + if err != nil { + return nil, err + } + + superUserRole, err := cli.ShowRole(dn, superUserProfile, false, false) + if err != nil { + return nil, err + } + + content := fmt.Sprintf("%s%s", *userRole, strings.TrimSuffix(*superUserRole, "\n")) + var buf bytes.Buffer + cli.dumpProfile(&buf, name, content) + s := buf.String() + return &s, nil +} diff --git a/libs/go/zmscli/repl.go b/libs/go/zmscli/repl.go new file mode 100644 index 00000000000..f135ceeb0f5 --- /dev/null +++ b/libs/go/zmscli/repl.go @@ -0,0 +1,49 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "github.com/boynton/repl" +) + +func (cli *Zms) Eval(expr string) (string, bool, error) { + if expr == "" { + return "", false, nil + } + params, err := cli.tokenizer(expr) + if err != nil { + return "", false, err + } + result, err := cli.EvalCommand(params) + if result == nil || err != nil { + return "", false, err + } else { + return *result, false, err + } +} + +func (cli *Zms) Prompt() string { + red := "\033[0;31m" + black := "\033[0;0m" + return red + cli.Domain + "> " + black +} + +func (cli *Zms) Reset() { +} + +func (cli *Zms) Complete(expr string) (string, []string) { + return "", nil +} + +func (cli *Zms) Start() []string { + return nil +} + +func (cli *Zms) Stop(history []string) { +} + +func (cli *Zms) Repl() (*string, error) { + repl.REPL(cli) + return nil, nil +} diff --git a/libs/go/zmscli/role.go b/libs/go/zmscli/role.go new file mode 100644 index 00000000000..67ef7d9b230 --- /dev/null +++ b/libs/go/zmscli/role.go @@ -0,0 +1,209 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "fmt" + "strings" + + "github.com/ardielle/ardielle-go/rdl" + "../../../clients/go/zms" +) + +func providerRoleName(provider, group, action string) string { + // generate provider role group + return provider + ".res_group." + group + "." + action +} + +func (cli Zms) roleNames(dn string) ([]string, error) { + roles := make([]string, 0) + lst, err := cli.Zms.GetRoleList(zms.DomainName(dn), nil, "") + if err != nil { + return nil, err + } + for _, n := range lst.Names { + roles = append(roles, string(n)) + } + return roles, nil +} + +func (cli Zms) ListRoles(dn string) (*string, error) { + var buf bytes.Buffer + roles, err := cli.roleNames(dn) + if err != nil { + return nil, err + } + buf.WriteString("roles:\n") + cli.dumpObjectList(&buf, roles, dn, "role") + s := buf.String() + return &s, nil +} + +func (cli Zms) ShowRole(dn string, rn string, auditLog, expand bool) (*string, error) { + var log *bool + if auditLog { + log = &auditLog + } else { + log = nil + } + var expnd *bool + if expand { + expnd = &expand + } else { + expnd = nil + } + role, err := cli.Zms.GetRole(zms.DomainName(dn), zms.EntityName(rn), log, expnd) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("role:\n") + cli.dumpRole(&buf, *role, auditLog, indent_level1_dash, indent_level1_dash_lvl) + s := buf.String() + return &s, nil +} + +func (cli Zms) AddDelegatedRole(dn string, rn string, trusted string) (*string, error) { + yrn := dn + ":role." + rn + _, err := cli.Zms.GetRole(zms.DomainName(dn), zms.EntityName(rn), nil, nil) + if err == nil { + return nil, fmt.Errorf("Role already exists: %v", yrn) + } else { + switch v := err.(type) { + case rdl.ResourceError: + if v.Code != 404 { + return nil, v + } + } + } + if rn == "admin" { + return nil, fmt.Errorf("Cannot replace reserved 'admin' role") + } + var role zms.Role + role.Name = zms.ResourceName(yrn) + role.Trust = zms.DomainName(trusted) + err = cli.Zms.PutRole(zms.DomainName(dn), zms.EntityName(rn), cli.AuditRef, &role) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowRole(dn, rn, false, false) + } +} + +func (cli Zms) AddGroupRole(dn string, rn string, members []string) (*string, error) { + yrn := dn + ":role." + rn + var role zms.Role + _, err := cli.Zms.GetRole(zms.DomainName(dn), zms.EntityName(rn), nil, nil) + if err == nil { + return nil, fmt.Errorf("Role already exists: %v", yrn) + } else { + switch v := err.(type) { + case rdl.ResourceError: + if v.Code != 404 { + return nil, v + } + } + } + if rn == "admin" { + return nil, fmt.Errorf("Cannot replace reserved 'admin' role") + } + role.Name = zms.ResourceName(yrn) + m := cli.validatedUsers(members, false) + role.Members = cli.createResourceList(m) + err = cli.Zms.PutRole(zms.DomainName(dn), zms.EntityName(rn), cli.AuditRef, &role) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowRole(dn, rn, false, false) + } +} + +func (cli Zms) DeleteRole(dn string, rn string) (*string, error) { + if rn == "admin" { + return nil, fmt.Errorf("Cannot delete 'admin' role") + } + err := cli.Zms.DeleteRole(zms.DomainName(dn), zms.EntityName(rn), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Deleted role: " + rn + "]" + return &s, nil +} + +func (cli Zms) AddProviderRoleMembers(dn string, provider string, group string, action string, members []string) (*string, error) { + rn := providerRoleName(provider, group, action) + return cli.AddMembers(dn, rn, members) +} + +func (cli Zms) ShowProviderRoleMembers(dn string, provider string, group string, action string) (*string, error) { + rn := providerRoleName(provider, group, action) + return cli.ShowRole(dn, rn, false, false) +} + +func (cli Zms) DeleteProviderRoleMembers(dn string, provider string, group string, action string, members []string) (*string, error) { + rn := providerRoleName(provider, group, action) + return cli.DeleteMembers(dn, rn, members) +} + +func (cli Zms) AddMembers(dn string, rn string, members []string) (*string, error) { + yrn := dn + ":role." + rn + ms := cli.validatedUsers(members, false) + for _, m := range ms { + var member zms.Membership + member.MemberName = zms.ResourceName(m) + member.RoleName = zms.ResourceName(rn) + err := cli.Zms.PutMembership(zms.DomainName(dn), zms.EntityName(rn), zms.ResourceName(m), cli.AuditRef, &member) + if err != nil { + return nil, err + } + } + var s string + if cli.Verbose { + s = "[Added to " + yrn + ": " + strings.Join(ms, ",") + "]" + } else { + s = "[Added to " + rn + ": " + strings.Join(ms, ",") + "]" + } + return &s, nil +} + +func (cli Zms) DeleteMembers(dn string, rn string, members []string) (*string, error) { + yrn := dn + ":role." + rn + ms := cli.validatedUsers(members, false) + for _, m := range ms { + err := cli.Zms.DeleteMembership(zms.DomainName(dn), zms.EntityName(rn), zms.ResourceName(m), cli.AuditRef) + if err != nil { + return nil, err + } + } + var s string + if cli.Verbose { + s = "[Deleted from " + yrn + ": " + strings.Join(ms, ",") + "]" + } else { + s = "[Deleted from " + rn + ": " + strings.Join(ms, ",") + "]" + } + return &s, nil +} + +func (cli Zms) CheckMembers(dn string, rn string, members []string) (*string, error) { + var buf bytes.Buffer + ms := cli.validatedUsers(members, false) + for _, m := range ms { + member, err := cli.Zms.GetMembership(zms.DomainName(dn), zms.EntityName(rn), zms.ResourceName(m)) + cli.dumpRoleMembership(&buf, *member) + if err != nil { + return nil, err + } + } + s := buf.String() + return &s, nil +} diff --git a/libs/go/zmscli/role_test.go b/libs/go/zmscli/role_test.go new file mode 100644 index 00000000000..6cbc88ada4c --- /dev/null +++ b/libs/go/zmscli/role_test.go @@ -0,0 +1,28 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "testing" +) + +func TestProviderRoleName(t *testing.T) { + + // standard provider/resource group test cases + + rn := providerRoleName("coretech.storage", "articles", "read") + if rn != "coretech.storage.res_group.articles.read" { + t.Error("rolename coretech.storage/articles/read failed") + } + + rn = providerRoleName("coretech.athenz.storage", "articles.docs", "read") + if rn != "coretech.athenz.storage.res_group.articles.docs.read" { + t.Error("rolename coretech.athenz.storage/articles.docs/read failed") + } + + rn = providerRoleName("coretech-athenz.storage", "articles", "read") + if rn != "coretech-athenz.storage.res_group.articles.read" { + t.Error("rolename coretech-athenz.storage/articles/read failed") + } +} diff --git a/libs/go/zmscli/service.go b/libs/go/zmscli/service.go new file mode 100644 index 00000000000..305a416f2d7 --- /dev/null +++ b/libs/go/zmscli/service.go @@ -0,0 +1,362 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "fmt" + "strings" + + "github.com/ardielle/ardielle-go/rdl" + "../../../clients/go/zms" +) + +func shortname(dn string, sn string) string { + shortName := sn + if strings.HasPrefix(shortName, dn+".") { + shortName = shortName[len(dn)+1:] + } + return shortName +} + +func (cli Zms) serviceNames(dn string) ([]string, error) { + services := make([]string, 0) + lst, err := cli.Zms.GetServiceIdentityList(zms.DomainName(dn), nil, "") + if err != nil { + return nil, err + } + for _, name := range lst.Names { + services = append(services, string(name)) + } + return services, nil +} + +func (cli Zms) ListServices(dn string) (*string, error) { + var buf bytes.Buffer + services, err := cli.serviceNames(dn) + if err != nil { + return nil, err + } + if len(services) == 0 { + buf.WriteString("services: []\n") + } else { + buf.WriteString("services:\n") + cli.dumpObjectList(&buf, services, dn, "service") + } + s := buf.String() + return &s, nil +} + +func (cli Zms) ShowService(dn string, sn string) (*string, error) { + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(sn)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("service:\n") + cli.dumpService(&buf, *service, indent_level1_dash, indent_level1_dash_lvl) + s := buf.String() + return &s, nil +} + +func (cli Zms) AddService(dn string, sn string, keyId string, pubKey *string) (*string, error) { + shortName := shortname(dn, sn) + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName)) + if err == nil { + return nil, fmt.Errorf("Service identity already exists: " + string(service.Name) + " - use add-public-key to add a key") + } + longName := dn + "." + shortName + publicKeys := make([]*zms.PublicKeyEntry, 0) + publicKey := zms.PublicKeyEntry{ + Key: *pubKey, + Id: keyId, + } + publicKeys = append(publicKeys, &publicKey) + detail := zms.ServiceIdentity{ + Name: zms.ServiceName(longName), + PublicKeys: publicKeys, + ProviderEndpoint: "", + Modified: nil, + Executable: "", + Hosts: nil, + User: "", + Group: "", + } + err = cli.Zms.PutServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName), cli.AuditRef, &detail) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) AddProviderService(dn string, sn string, keyId string, pubKey *string) (*string, error) { + shortName := shortname(dn, sn) + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName)) + if err == nil { + return nil, fmt.Errorf("Service identity already exists: " + string(service.Name) + " - use add-public-key to add a key") + } + longName := dn + "." + shortName + publicKeys := make([]*zms.PublicKeyEntry, 0) + publicKey := zms.PublicKeyEntry{ + Key: *pubKey, + Id: keyId, + } + publicKeys = append(publicKeys, &publicKey) + detail := zms.ServiceIdentity{ + Name: zms.ServiceName(longName), + PublicKeys: publicKeys, + ProviderEndpoint: "", + Modified: nil, + Executable: "", + Hosts: nil, + User: "", + Group: "", + } + err = cli.Zms.PutServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName), cli.AuditRef, &detail) + if err != nil { + return nil, err + } + // after our service has been created we are going to + // create a self_serve role for this provider + rn := shortName + "_self_serve" + yrn := dn + ":role." + rn + var role zms.Role + _, err = cli.Zms.GetRole(zms.DomainName(dn), zms.EntityName(rn), nil, nil) + if err == nil { + return nil, fmt.Errorf("Provider Service created but Self Serve Role already exists: %v", yrn) + } else { + switch v := err.(type) { + case rdl.ResourceError: + if v.Code != 404 { + return nil, v + } + } + } + role.Name = zms.ResourceName(yrn) + role.Members = make([]zms.ResourceName, 0) + role.Members = append(role.Members, zms.ResourceName(longName)) + err = cli.Zms.PutRole(zms.DomainName(dn), zms.EntityName(rn), cli.AuditRef, &role) + if err != nil { + return nil, err + } + // now that the self_serve role has been created we are + // going to create the self_serve policy for this + // provider that would give access to all tenants + pn := shortName + "_self_serve" + yrn = dn + ":policy." + pn + _, err = cli.Zms.GetPolicy(zms.DomainName(dn), zms.EntityName(pn)) + if err == nil { + return nil, fmt.Errorf("Provider Service created but Self Serve Policy already exists: %v", yrn) + } else { + switch v := err.(type) { + case rdl.ResourceError: + if v.Code != 404 { + return nil, v + } + } + } + policy := zms.Policy{} + policy.Name = zms.ResourceName(yrn) + assertion := make([]string, 0) + assertion = append(assertion, "grant") + assertion = append(assertion, "update") + assertion = append(assertion, "to") + assertion = append(assertion, rn) + assertion = append(assertion, "on") + assertion = append(assertion, "tenant.*") + newAssertion, err := parseAssertion(dn, assertion) + if err != nil { + return nil, err + } + tmp := [1]*zms.Assertion{newAssertion} + policy.Assertions = tmp[:] + err = cli.Zms.PutPolicy(zms.DomainName(dn), zms.EntityName(pn), cli.AuditRef, &policy) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) AddServiceWithKeys(dn string, sn string, publicKeys []*zms.PublicKeyEntry) (*string, error) { + shortName := shortname(dn, sn) + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName)) + if err == nil { + return nil, fmt.Errorf("Service identity already exists: " + string(service.Name) + " - use add-public-key to add a key") + } + longName := dn + "." + shortName + detail := zms.ServiceIdentity{ + Name: zms.ServiceName(longName), + PublicKeys: publicKeys, + ProviderEndpoint: "", + Modified: nil, + Executable: "", + Hosts: nil, + User: "", + Group: "", + } + err = cli.Zms.PutServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName), cli.AuditRef, &detail) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) SetServiceEndpoint(dn string, sn string, endpoint string) (*string, error) { + shortName := shortname(dn, sn) + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName)) + if err != nil { + return nil, err + } + service.ProviderEndpoint = endpoint + err = cli.Zms.PutServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName), cli.AuditRef, service) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) SetServiceExe(dn string, sn string, exe string, user string, group string) (*string, error) { + shortName := shortname(dn, sn) + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName)) + if err != nil { + return nil, err + } + service.Executable = exe + service.User = user + service.Group = group + err = cli.Zms.PutServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName), cli.AuditRef, service) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) AddServiceHost(dn string, sn string, hosts []string) (*string, error) { + shortName := shortname(dn, sn) + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName)) + if err != nil { + return nil, err + } + if service.Hosts == nil { + service.Hosts = hosts + } else { + for _, host := range hosts { + if !cli.contains(service.Hosts, host) { + service.Hosts = append(service.Hosts, host) + } + } + } + err = cli.Zms.PutServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName), cli.AuditRef, service) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) DeleteServiceHost(dn string, sn string, hosts []string) (*string, error) { + shortName := shortname(dn, sn) + service, err := cli.Zms.GetServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName)) + if err != nil { + return nil, err + } + if service.Hosts != nil { + service.Hosts = cli.RemoveAll(service.Hosts, hosts) + err = cli.Zms.PutServiceIdentity(zms.DomainName(dn), zms.SimpleName(shortName), cli.AuditRef, service) + if err != nil { + return nil, err + } + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) AddServicePublicKey(dn string, sn string, keyId string, pubKey *string) (*string, error) { + shortName := shortname(dn, sn) + publicKey := zms.PublicKeyEntry{ + Key: *pubKey, + Id: keyId, + } + err := cli.Zms.PutPublicKeyEntry(zms.DomainName(dn), zms.SimpleName(shortName), keyId, cli.AuditRef, &publicKey) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) ShowServicePublicKey(dn string, sn string, keyId string) (*string, error) { + var buf bytes.Buffer + shortName := shortname(dn, sn) + pkey, err := cli.Zms.GetPublicKeyEntry(zms.DomainName(dn), zms.SimpleName(shortName), keyId) + if err != nil { + return nil, err + } + buf.WriteString("public-key:\n") + buf.WriteString(indent_level1 + "keyId: " + pkey.Id + "\n") + buf.WriteString(indent_level1 + "value: " + pkey.Key + "\n") + s := buf.String() + return &s, nil +} + +func (cli Zms) DeleteServicePublicKey(dn string, sn string, keyId string) (*string, error) { + shortName := shortname(dn, sn) + err := cli.Zms.DeletePublicKeyEntry(zms.DomainName(dn), zms.SimpleName(shortName), keyId, cli.AuditRef) + if err != nil { + return nil, err + } + if cli.Bulkmode { + s := "" + return &s, nil + } else { + return cli.ShowService(dn, shortName) + } +} + +func (cli Zms) DeleteService(dn string, sn string) (*string, error) { + err := cli.Zms.DeleteServiceIdentity(zms.DomainName(dn), zms.SimpleName(sn), cli.AuditRef) + if err != nil { + return nil, err + } else { + s := "[Deleted service identity: " + dn + "." + sn + "]" + return &s, nil + } +} diff --git a/libs/go/zmscli/service_test.go b/libs/go/zmscli/service_test.go new file mode 100644 index 00000000000..e4efbf90d11 --- /dev/null +++ b/libs/go/zmscli/service_test.go @@ -0,0 +1,23 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "testing" +) + +func TestShortName(t *testing.T) { + sn := shortname("coretech", "service1") + if sn != "service1" { + t.Error("shortname service1 failed") + } + sn = shortname("coretech", "coretech2.service2") + if sn != "coretech2.service2" { + t.Error("shortname service2 failed") + } + sn = shortname("coretech", "coretech.service3") + if sn != "service3" { + t.Error("shortname service3 failed") + } +} diff --git a/libs/go/zmscli/template.go b/libs/go/zmscli/template.go new file mode 100644 index 00000000000..e459f1776e7 --- /dev/null +++ b/libs/go/zmscli/template.go @@ -0,0 +1,82 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + + "../../../clients/go/zms" +) + +func (cli Zms) ListServerTemplates() (*string, error) { + var buf bytes.Buffer + templates, err := cli.Zms.GetServerTemplateList() + if err != nil { + return nil, err + } + buf.WriteString("templates:\n") + for _, name := range templates.TemplateNames { + buf.WriteString(indent_level1_dash + string(name) + "\n") + } + s := buf.String() + return &s, nil +} + +func (cli Zms) ListDomainTemplates(dn string) (*string, error) { + var buf bytes.Buffer + templates, err := cli.Zms.GetDomainTemplateList(zms.DomainName(dn)) + if err != nil { + return nil, err + } + buf.WriteString("templates:\n") + for _, name := range templates.TemplateNames { + buf.WriteString(indent_level1_dash + string(name) + "\n") + } + s := buf.String() + return &s, nil +} + +func (cli Zms) ShowServerTemplate(templateName string) (*string, error) { + template, err := cli.Zms.GetTemplate(zms.SimpleName(templateName)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("template:\n") + buf.WriteString(indent_level1 + "roles:\n") + for _, role := range template.Roles { + cli.dumpRole(&buf, *role, false, indent_level2_dash, indent_level2_dash_lvl) + } + buf.WriteString(indent_level1 + "policies:\n") + for _, policy := range template.Policies { + cli.dumpPolicy(&buf, *policy, indent_level2_dash, indent_level2_dash_lvl) + } + + s := buf.String() + return &s, nil +} + +func (cli Zms) SetDomainTemplate(dn string, templates []string) (*string, error) { + templateNames := make([]zms.SimpleName, 0) + for _, value := range templates { + templateNames = append(templateNames, zms.SimpleName(value)) + } + var domainTemplateList zms.DomainTemplate + domainTemplateList.TemplateNames = templateNames + err := cli.Zms.PutDomainTemplate(zms.DomainName(dn), cli.AuditRef, &domainTemplateList) + if err != nil { + return nil, err + } + s := "[Template(s) successfully applied to domain]" + return &s, nil +} + +func (cli Zms) DeleteDomainTemplate(dn string, template string) (*string, error) { + err := cli.Zms.DeleteDomainTemplate(zms.DomainName(dn), zms.SimpleName(template), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Deleted template: " + template + "]" + return &s, nil +} diff --git a/libs/go/zmscli/tenant.go b/libs/go/zmscli/tenant.go new file mode 100644 index 00000000000..22515181553 --- /dev/null +++ b/libs/go/zmscli/tenant.go @@ -0,0 +1,206 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bytes" + "strings" + + "../../../clients/go/zms" +) + +func (cli Zms) DeleteTenancy(dn string, provider string) (*string, error) { + err := cli.Zms.DeleteTenancy(zms.DomainName(dn), zms.ServiceName(provider), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Successfully deleted tenant " + dn + " from provider " + provider + "]\n" + return &s, nil +} + +func (cli Zms) AddTenancy(dn string, provider string) (*string, error) { + tenancy := zms.Tenancy{ + Domain: zms.DomainName(dn), + Service: zms.ServiceName(provider), + ResourceGroups: nil, + } + err := cli.Zms.PutTenancy(zms.DomainName(dn), zms.ServiceName(provider), cli.AuditRef, &tenancy) + if err != nil { + return nil, err + } + return cli.ShowTenancy(dn, provider) +} + +func (cli Zms) DeleteTenancyResourceGroup(dn string, provider string, resourceGroup string) (*string, error) { + err := cli.Zms.DeleteTenancyResourceGroup(zms.DomainName(dn), zms.ServiceName(provider), zms.EntityName(resourceGroup), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Successfully deleted tenant " + dn + " resource group " + resourceGroup + " from provider " + provider + "]\n" + return &s, nil +} + +func (cli Zms) AddTenancyResourceGroup(dn string, provider string, resourceGroup string) (*string, error) { + tenancy := zms.TenancyResourceGroup{ + Domain: zms.DomainName(dn), + Service: zms.ServiceName(provider), + ResourceGroup: zms.EntityName(resourceGroup), + } + err := cli.Zms.PutTenancyResourceGroup(zms.DomainName(dn), zms.ServiceName(provider), zms.EntityName(resourceGroup), cli.AuditRef, &tenancy) + if err != nil { + return nil, err + } + return cli.ShowTenancy(dn, provider) +} + +func (cli Zms) ShowTenancy(dn string, provider string) (*string, error) { + tenancy, err := cli.Zms.GetTenancy(zms.DomainName(dn), zms.ServiceName(provider)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + cli.dumpTenancy(&buf, tenancy, indent_level1) + s := buf.String() + return &s, nil +} + +func (cli Zms) ShowTenantRoles(provDomain string, provService string, tenantDomain string) (*string, error) { + tenantRoles, err := cli.Zms.GetTenantRoles(zms.DomainName(provDomain), zms.SimpleName(provService), zms.DomainName(tenantDomain)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("tenant-roles:\n") + cli.dumpTenantRoles(&buf, tenantRoles, indent_level1_dash, indent_level1_dash_lvl) + s := buf.String() + return &s, nil +} + +func (cli Zms) DeleteTenantRoles(provDomain string, provService string, tenantDomain string) (*string, error) { + err := cli.Zms.DeleteTenantRoles(zms.DomainName(provDomain), zms.SimpleName(provService), zms.DomainName(tenantDomain), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Successfully deleted roles for tenant: " + tenantDomain + "]\n" + return &s, nil +} + +func (cli Zms) AddTenantRoles(provDomain string, provService string, tenantDomain string, roleActions []string) (*string, error) { + tenantRoleActions := make([]*zms.TenantRoleAction, 0) + for _, item := range roleActions { + tokens := strings.Split(item, "=") + if len(tokens) == 2 { + roleToken := zms.TenantRoleAction{ + Role: zms.SimpleName(tokens[0]), + Action: tokens[1], + } + tenantRoleActions = append(tenantRoleActions, &roleToken) + } + } + tenantRoles := zms.TenantRoles{ + Domain: zms.DomainName(provDomain), + Service: zms.SimpleName(provService), + Tenant: zms.DomainName(tenantDomain), + Roles: tenantRoleActions, + } + _, err := cli.Zms.PutTenantRoles(zms.DomainName(provDomain), zms.SimpleName(provService), zms.DomainName(tenantDomain), cli.AuditRef, &tenantRoles) + if err != nil { + return nil, err + } + return cli.ShowTenantRoles(provDomain, provService, tenantDomain) +} + +func (cli Zms) ShowTenantResourceGroupRoles(provDomain string, provService string, tenantDomain string, resourceGroup string) (*string, error) { + tenantRoles, err := cli.Zms.GetTenantResourceGroupRoles(zms.DomainName(provDomain), zms.SimpleName(provService), zms.DomainName(tenantDomain), zms.EntityName(resourceGroup)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("resource-group:\n") + cli.dumpTenantResourceGroupRoles(&buf, tenantRoles, indent_level1_dash, indent_level1_dash_lvl) + s := buf.String() + return &s, nil +} + +func (cli Zms) DeleteTenantResourceGroupRoles(provDomain string, provService string, tenantDomain string, resourceGroup string) (*string, error) { + err := cli.Zms.DeleteTenantResourceGroupRoles(zms.DomainName(provDomain), zms.SimpleName(provService), zms.DomainName(tenantDomain), zms.EntityName(resourceGroup), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Successfully deleted resource group " + resourceGroup + " roles for tenant: " + tenantDomain + "]\n" + return &s, nil +} + +func (cli Zms) AddTenantResourceGroupRoles(provDomain string, provService string, tenantDomain string, resourceGroup string, roleActions []string) (*string, error) { + tenantRoleActions := make([]*zms.TenantRoleAction, 0) + for _, item := range roleActions { + tokens := strings.Split(item, "=") + if len(tokens) == 2 { + roleToken := zms.TenantRoleAction{ + Role: zms.SimpleName(tokens[0]), + Action: tokens[1], + } + tenantRoleActions = append(tenantRoleActions, &roleToken) + } + } + tenantRoles := zms.TenantResourceGroupRoles{ + Domain: zms.DomainName(provDomain), + Service: zms.SimpleName(provService), + Tenant: zms.DomainName(tenantDomain), + Roles: tenantRoleActions, + ResourceGroup: zms.EntityName(resourceGroup), + } + _, err := cli.Zms.PutTenantResourceGroupRoles(zms.DomainName(provDomain), zms.SimpleName(provService), zms.DomainName(tenantDomain), zms.EntityName(resourceGroup), cli.AuditRef, &tenantRoles) + if err != nil { + return nil, err + } + return cli.ShowTenantResourceGroupRoles(provDomain, provService, tenantDomain, resourceGroup) +} + +func (cli Zms) ShowProviderResourceGroupRoles(tenantDomain string, providerDomain string, providerService string, resourceGroup string) (*string, error) { + providerRoles, err := cli.Zms.GetProviderResourceGroupRoles(zms.DomainName(tenantDomain), zms.DomainName(providerDomain), zms.SimpleName(providerService), zms.EntityName(resourceGroup)) + if err != nil { + return nil, err + } + var buf bytes.Buffer + buf.WriteString("resource-group:\n") + cli.dumpProviderResourceGroupRoles(&buf, providerRoles, indent_level1_dash, indent_level1_dash_lvl) + s := buf.String() + return &s, nil +} + +func (cli Zms) DeleteProviderResourceGroupRoles(tenantDomain string, providerDomain string, providerService string, resourceGroup string) (*string, error) { + err := cli.Zms.DeleteProviderResourceGroupRoles(zms.DomainName(tenantDomain), zms.DomainName(providerDomain), zms.SimpleName(providerService), zms.EntityName(resourceGroup), cli.AuditRef) + if err != nil { + return nil, err + } + s := "[Successfully deleted resource group " + resourceGroup + " roles for tenant: " + tenantDomain + "]\n" + return &s, nil +} + +func (cli Zms) AddProviderResourceGroupRoles(tenantDomain string, providerDomain string, providerService string, resourceGroup string, roleActions []string) (*string, error) { + tenantRoleActions := make([]*zms.TenantRoleAction, 0) + for _, item := range roleActions { + tokens := strings.Split(item, "=") + if len(tokens) == 2 { + roleToken := zms.TenantRoleAction{ + Role: zms.SimpleName(tokens[0]), + Action: tokens[1], + } + tenantRoleActions = append(tenantRoleActions, &roleToken) + } + } + providerRoles := zms.ProviderResourceGroupRoles{ + Domain: zms.DomainName(providerDomain), + Service: zms.SimpleName(providerService), + Tenant: zms.DomainName(tenantDomain), + Roles: tenantRoleActions, + ResourceGroup: zms.EntityName(resourceGroup), + } + _, err := cli.Zms.PutProviderResourceGroupRoles(zms.DomainName(tenantDomain), zms.DomainName(providerDomain), zms.SimpleName(providerService), zms.EntityName(resourceGroup), cli.AuditRef, &providerRoles) + if err != nil { + return nil, err + } + return cli.ShowProviderResourceGroupRoles(tenantDomain, providerDomain, providerService, resourceGroup) +} diff --git a/libs/go/zmscli/utils.go b/libs/go/zmscli/utils.go new file mode 100644 index 00000000000..51310b75e99 --- /dev/null +++ b/libs/go/zmscli/utils.go @@ -0,0 +1,111 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "bufio" + "strings" + + "../../../clients/go/zms" +) + +func split(data []byte, atEOF bool) (advance int, token []byte, err error) { + + // create a split function using the existing word scanner + // we're going to look for the quoted strings and handle them accordingly + + advance, token, err = bufio.ScanWords(data, atEOF) + if err == nil && token != nil { + if token[0] == '"' { + var advance_fwd int + var token_fwd []byte + for { + advance_fwd, token_fwd, err = bufio.ScanWords(data[advance:], atEOF) + if err != nil || token_fwd == nil { + return + } + advance += advance_fwd + token = append(token, 32) + token = append(token, token_fwd...) + if token_fwd[len(token_fwd)-1] == '"' { + token = token[1 : len(token)-1] + break + } + } + } + } + return +} + +func (cli Zms) createResourceList(items []string) []zms.ResourceName { + list := make([]zms.ResourceName, 0) + for _, item := range items { + list = append(list, zms.ResourceName(item)) + } + return list +} + +func (cli Zms) createStringList(items []zms.ResourceName) []string { + list := make([]string, 0) + for _, item := range items { + list = append(list, string(item)) + } + return list +} + +func (cli Zms) tokenizer(input string) ([]string, error) { + + scanner := bufio.NewScanner(strings.NewReader(input)) + scanner.Split(split) + + tokens := make([]string, 0) + for scanner.Scan() { + tokens = append(tokens, scanner.Text()) + } + err := scanner.Err() + return tokens, err +} + +func indexOfString(s []string, match string) int { + for i, ss := range s { + if ss == match { + return i + } + } + return -1 +} + +func (cli Zms) validatedUsers(users []string, forceSelf bool) []string { + validatedUsers := make([]string, 0) + for _, v := range users { + if strings.Index(v, ".") < 0 { + validatedUsers = append(validatedUsers, cli.UserDomain+"."+v) + } else { + validatedUsers = append(validatedUsers, v) + } + } + if forceSelf && indexOfString(validatedUsers, cli.Identity) < 0 { + validatedUsers = append(validatedUsers, cli.Identity) + } + return validatedUsers +} + +func (cli Zms) contains(s []string, e string) bool { + for _, a := range s { + if a == e { + return true + } + } + return false +} + +func (cli Zms) RemoveAll(fullList []string, removeList []string) []string { + var newList []string + for _, item := range fullList { + if !cli.contains(removeList, item) { + newList = append(newList, item) + } + } + return newList +} diff --git a/libs/go/zmscli/utils_test.go b/libs/go/zmscli/utils_test.go new file mode 100644 index 00000000000..70edfba92b8 --- /dev/null +++ b/libs/go/zmscli/utils_test.go @@ -0,0 +1,170 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +package zmscli + +import ( + "testing" +) + +func TestTokenizer(t *testing.T) { + cli := Zms{} + var list []string + var err error + list, err = cli.tokenizer("one two three") + if err != nil { + t.Error("Tokenizer returned error") + } + if len(list) != 3 { + t.Error("Number of tokens is not 3") + } + if list[0] != "one" { + t.Error("First element is not one") + } + if list[1] != "two" { + t.Error("Second element is not two") + } + if list[2] != "three" { + t.Error("Third element is not three") + } + list, err = cli.tokenizer("set-meta-details \"Description is long\" two three") + if len(list) != 4 { + t.Error("Number of quoted string tokens is not 4") + } + if list[0] != "set-meta-details" { + t.Error("First element is not set-meta-details") + } + if list[1] != "Description is long" { + t.Error("Second element is not 'Description is long' : " + list[1]) + } + if list[2] != "two" { + t.Error("Third element is not two") + } + if list[3] != "three" { + t.Error("Fourth element is not three") + } +} + +func TestIndexOfString(t *testing.T) { + list := []string{"one", "two", "three", "four"} + if indexOfString(list, "one") != 0 { + t.Error("indexOfStrings case 'one' failed") + } + if indexOfString(list, "three") != 2 { + t.Error("indexOfStrings case 'three' failed") + } + if indexOfString(list, "four") != 3 { + t.Error("indexOfStrings case 'four' failed") + } + if indexOfString(list, "five") != -1 { + t.Error("indexOfStrings case 'five' failed") + } +} + +func TestValidatedUsers(t *testing.T) { + cli := Zms{} + cli.UserDomain = "user" + cli.identity = "user.user1" + members := []string{"user.user2", "user3"} + list := cli.validatedUsers(members, false) + if len(list) != 2 { + t.Error("Returned list is not length 2") + } + if list[0] != "user.user2" { + t.Error("First member is not user.user2") + } + if list[1] != "user.user3" { + t.Error("Second member is not user.user3") + } + list = cli.validatedUsers(members, true) + if len(list) != 3 { + t.Error("Returned list is not length 3") + } + if list[0] != "user.user2" { + t.Error("First member is not user.user2") + } + if list[1] != "user.user3" { + t.Error("Second member is not user.user3") + } + if list[2] != "user.user1" { + t.Error("Third member is not user.user1") + } + members = []string{"user.user2", "user1"} + list = cli.validatedUsers(members, false) + if len(list) != 2 { + t.Error("Returned list is not length 2") + } + if list[0] != "user.user2" { + t.Error("First member is not user.user2") + } + if list[1] != "user.user1" { + t.Error("Second member is not user.user1") + } +} + +func TestContains(t *testing.T) { + cli := Zms{} + list := []string{"one", "two", "three", "four"} + if !cli.contains(list, "one") { + t.Error("contains case 'one' failed") + } + if !cli.contains(list, "three") { + t.Error("contains case 'three' failed") + } + if !cli.contains(list, "four") { + t.Error("contains case 'four' failed") + } + if cli.contains(list, "five") { + t.Error("contains case 'five' failed") + } +} + +func TestRemoveAll(t *testing.T) { + cli := Zms{} + fullList := []string{"one", "two", "three"} + removeList := []string{"two", "four"} + list := cli.RemoveAll(fullList, removeList) + if len(list) != 2 { + t.Error("Returned list is not length 2") + } + if list[0] != "one" { + t.Error("First member is not one") + } + if list[1] != "three" { + t.Error("Second member is not three") + } + fullList = []string{"two", "four"} + list = cli.RemoveAll(fullList, removeList) + if len(list) != 0 { + t.Error("Returned list is not empty") + } +} + +func TestGetHttpTransport(t *testing.T) { + tr := getHttpTransport(nil, false) + if tr != nil { + t.Error("Did not receive nil transport") + } + tr = getHttpTransport(nil, true) + if tr.TLSClientConfig == nil { + t.Error("Only TLSConfig not set correctly") + } + if tr.Dial != nil { + t.Error("Only TLSConfig - Dial is not nil") + } + proxy := "socks.athenzcompany.com:10080" + tr = getHttpTransport(&proxy, false) + if tr.TLSClientConfig != nil { + t.Error("Only Proxy - TLSConfig not set correctly") + } + if tr.Dial == nil { + t.Error("Only Proxy - Dial is nil") + } + tr = getHttpTransport(&proxy, true) + if tr.TLSClientConfig == nil { + t.Error("Both optionss - TLSConfig not set correctly") + } + if tr.Dial == nil { + t.Error("Both options - Dial is not set correctly") + } +} diff --git a/libs/java/auth_core/README.md b/libs/java/auth_core/README.md new file mode 100644 index 00000000000..31a84db84c4 --- /dev/null +++ b/libs/java/auth_core/README.md @@ -0,0 +1,10 @@ +auth-core +========= + +Core interfaces for authorization + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/libs/java/auth_core/pom.xml b/libs/java/auth_core/pom.xml new file mode 100644 index 00000000000..7a56d1b1254 --- /dev/null +++ b/libs/java/auth_core/pom.xml @@ -0,0 +1,98 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../../pom.xml + + + auth_core + jar + auth_core + Core Auth Interfaces + + + + com.fasterxml.jackson.core + jackson-databind + ${jackson.version} + + + org.bouncycastle + bcpkix-jdk15on + ${bouncycastle.version} + + + org.kohsuke + libpam4j + 1.6 + + + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 2.10.4 + + + prepare-package + + jar + + + + + + + + + + platform-mac + + false + + mac + + + + + + org.apache.maven.plugins + maven-surefire-plugin + 2.16 + + kerberos-tests + + + + default-test + + test + + + + + + + + + + diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Authority.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Authority.java new file mode 100644 index 00000000000..cba446c59bb --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Authority.java @@ -0,0 +1,89 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth; + +import java.security.cert.X509Certificate; + +/** + * An Authority can validate credentials of a Principal in its domain. It also can provide HTTP header information + * that determines where to find relevant credentials for that task. + */ +public interface Authority { + + /** + * Source for the credentials - either headers or certificate + */ + enum CredSource { + HEADER, + CERTIFICATE + } + + /** + * Initialize the authority + */ + public void initialize(); + + /** + * @return credentials source - headers or certificate with headers being default + */ + default public CredSource getCredSource() { + return CredSource.HEADER; + } + + /** + * @return the domain of the authority, i.e. "user" or "local", as defined by the authorization system + */ + public String getDomain(); + + /** + * @return a string describing where to find the credentials in a request, i.e. "X-Auth-Token" or "Cookie.User" + */ + public String getHeader(); + + /** + * @return a boolean flag indicating whether or not authenticated principals + * by this authority are allowed to be "authorized" to make changes. If this + * flag is true, then the principal must first get a ZMS UserToken and then + * use that UserToken for subsequent operations. + */ + + default public boolean allowAuthorization() { + return true; + } + + /** + * Verify the credentials and if valid return the corresponding Principal, null otherwise. + * @param creds the credentials (i.e. cookie, token, secret) that will identify the principal. + * @param remoteAddr remote IP address of the connection + * @param httpMethod the http method for this request (e.g. GET, PUT, etc) + * @param errMsg will contain error message if authenticate fails + * @return the Principal for the credentials, or null if the credentials are not valid. + */ + public Principal authenticate(String creds, String remoteAddr, String httpMethod, StringBuilder errMsg); + + /** + * Process the client certificates extracted from the http request object. + * Extract the CN field from the Certificate Subject DN which should be the Athenz + * Service Identity and return a corresponding Principal object. In case any exceptions, + * a null object is returned + * @param certs an array of X509 certificates retrieved from the request + * @param errMsg will contain error message if authenticate fails + * @return the Principal for the certificate, or null in case of failure. + */ + default public Principal authenticate(X509Certificate[] certs, StringBuilder errMsg) { + return null; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/AuthorityKeyStore.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/AuthorityKeyStore.java new file mode 100644 index 00000000000..c7c6594cf7c --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/AuthorityKeyStore.java @@ -0,0 +1,21 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth; + +public interface AuthorityKeyStore { + + void setKeyStore(KeyStore keyStore); +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Authorizer.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Authorizer.java new file mode 100644 index 00000000000..ce8263dbca3 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Authorizer.java @@ -0,0 +1,34 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth; + +/** + * An Authorizer is an entity that can authorize an assertion of access. An assertion consists of + * an action performed on a resource by a principal. The resource includes its own domain information + *, but an extra crossDomain argument can be specified to check another domain's idea of access on the + * resource (to handle a cross-domain trust scenario). Normally the crossDomain argument should be null + */ +public interface Authorizer { + /** + * Check access, return true if access is granted, false otherwise. + * @param resource - (YRN) the resource to check access against. Must include the domain. + * @param action - (CompoundName) the action to check access for + * @param principal - (ResourceName) the principal who will access the resource. + * @param crossDomain - (DomainName) an alternate domain responsible for the policy involved. This is usually null. + * @return true if access is granted for the action/resource/principal + */ + public boolean access(String action, String resource, Principal principal, String crossDomain); +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/KeyStore.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/KeyStore.java new file mode 100644 index 00000000000..d78391f126d --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/KeyStore.java @@ -0,0 +1,29 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth; + +public interface KeyStore { + + /** + * Return the PEM encoded public key for the given key id and service. + * The key which should be ybase64decoded prior to return if was ybase64encoded. + * @param domain Name of the domain + * @param service Name of the service + * @param keyId the public key identifier + * @return String with PEM encoded key + */ + String getPublicKey(String domain, String service, String keyId); +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Principal.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Principal.java new file mode 100644 index 00000000000..d259b71d84b --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/Principal.java @@ -0,0 +1,67 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth; + +import java.util.List; + +/** + * A Principal is an authenticated entity that takes an action on a resource. + */ +public interface Principal { + + /** @return the domain of the authority over this principal, i.e. "user" */ + public String getDomain(); + + /** @return the name of the principal as a string, i.e. "joe" */ + public String getName(); + + /** @return the YRN of the principal as a string, i.e. "user.joe" */ + public String getYRN(); + + /** @return the credentials token as a string */ + public String getCredentials(); + + /** @return the credentials token as a string but will not contain a signature */ + public String getUnsignedCredentials(); + + /** @return the list of roles this principal is able to assume. This is null + * for user/service principals, but valid for a principal based on ZTokens. */ + public List getRoles(); + + /** @return the authority over this principal. Can be null, if not authenticated. */ + public Authority getAuthority(); + + /** @return the issue time for the credentials */ + public long getIssueTime(); + + /** @return the service name that was authorized to use the Principal's UserToken */ + public String getAuthorizedService(); + + /** @return the associated IP address provided in the principal token */ + default String getIP() { + return null; + } + + /** @return the associated original requestor specified in the principal token */ + default String getOriginalRequestor() { + return null; + } + + /** @return the associated original key service specified in the principal token */ + default String getKeyService() { + return null; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/ServiceIdentityProvider.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/ServiceIdentityProvider.java new file mode 100644 index 00000000000..34e699d210a --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/ServiceIdentityProvider.java @@ -0,0 +1,31 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth; + +/** + * The interface for a service identity provider. The container of the service defines the actual + * implementation. + */ +public interface ServiceIdentityProvider { + + /** + * @param domainName the name of the domain + * @param serviceName the name of the service + * @return the identity of the service in the form of a Principal. + */ + public Principal getIdentity(String domainName, String serviceName); + +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/CertificateAuthority.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/CertificateAuthority.java new file mode 100644 index 00000000000..d27cd064d90 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/CertificateAuthority.java @@ -0,0 +1,134 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.security.cert.X509Certificate; + +import org.bouncycastle.asn1.x500.RDN; +import org.bouncycastle.asn1.x500.X500Name; +import org.bouncycastle.asn1.x500.style.BCStyle; +import org.bouncycastle.asn1.x500.style.IETFUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; + +public class CertificateAuthority implements Authority { + + private static final Logger LOG = LoggerFactory.getLogger(CertificateAuthority.class); + + @Override + public void initialize() { + } + + @Override + public String getDomain() { + return null; + } + + @Override + public String getHeader() { + return null; + } + + @Override + public Principal authenticate(String creds, String remoteAddr, String httpMethod, StringBuilder errMsg) { + return null; + } + + @Override + public CredSource getCredSource() { + return CredSource.CERTIFICATE; + } + + String extractX509CertCN(X509Certificate x509Cert) { + + String cn = null; + try { + String principalName = x509Cert.getSubjectX500Principal().getName(); + if (LOG.isDebugEnabled()) { + LOG.debug("CertificateAuthority:authenticate: TLS Certificate Principal: " + principalName); + } + if (principalName != null && !principalName.isEmpty()) { + + // in case there are multiple CNs, we're only looking at the first one + + X500Name x500name = new X500Name(x509Cert.getSubjectX500Principal().getName()); + RDN cnRdn = x500name.getRDNs(BCStyle.CN)[0]; + cn = IETFUtils.valueToString(cnRdn.getFirst().getValue()); + } + } catch (Exception ex) { + if (LOG.isDebugEnabled()) { + LOG.debug("CertificateAuthority:authenticate: Unable to extract principal", ex); + } + } + return cn; + } + + @Override + public Principal authenticate(X509Certificate[] certs, StringBuilder errMsg) { + + if (LOG.isDebugEnabled()) { + LOG.debug("CertificateAuthority:authenticate: TLS Certificates: " + certs); + if (certs != null) { + for (X509Certificate cert : certs) { + LOG.debug("CertificateAuthority:authenticate: TLS Certificate: " + cert); + } + } + } + + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + + // make sure we have at least one valid certificate in our list + + if (certs == null || certs[0] == null) { + errMsg.append("CertificateAuthority:authenticate: No certificate available in request"); + return null; + } + + X509Certificate x509Cert = certs[0]; + String principalName = extractX509CertCN(x509Cert); + if (principalName == null || principalName.isEmpty()) { + if (LOG.isDebugEnabled()) { + LOG.debug("CertificateAuthority:authenticate: Certificate principal is empty"); + } + errMsg.append("CertificateAuthority:authenticate: Certificate principal is empty"); + return null; + } + + // extract domain and service names from the name. We must have + // a valid service identity in the form domain.service + + int idx = principalName.lastIndexOf('.'); + if (idx == -1) { + errMsg.append("CertificateAuthority:authenticate: Principal is not a valid service identity: " + + principalName); + return null; + } + + String domain = principalName.substring(0, idx); + String name = principalName.substring(idx + 1); + + // all the role members in Athenz are normalized to lower case so we need to make + // sure our principal's name and domain are created with lower case as well + + SimplePrincipal princ = (SimplePrincipal) SimplePrincipal.create(domain.toLowerCase(), + name.toLowerCase(), x509Cert.toString(), this); + princ.setUnsignedCreds(x509Cert.getSubjectX500Principal().toString()); + return princ; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/KerberosAuthority.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/KerberosAuthority.java new file mode 100644 index 00000000000..74a90a158f6 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/KerberosAuthority.java @@ -0,0 +1,352 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.util.Set; +import java.util.HashSet; +import java.util.Map; +import java.util.HashMap; +import java.util.concurrent.atomic.AtomicReference; + +import javax.security.auth.Subject; +import javax.security.auth.kerberos.KerberosPrincipal; +import javax.security.auth.kerberos.KerberosTicket; +import javax.security.auth.login.AppConfigurationEntry; +import javax.security.auth.login.Configuration; +import javax.security.auth.login.LoginContext; +import javax.security.auth.callback.CallbackHandler; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.token.KerberosToken; + +/** + * An Authority can validate credentials of a Principal in its domain. It also can provide HTTP header information + * that determines where to find relevant credentials for that task. + */ +public class KerberosAuthority implements Authority { + + static final Logger LOG = LoggerFactory.getLogger(KerberosAuthority.class); + + static final String KRB_AUTH_HEADER = "Authorization"; + static final String KRB_PROP_SVCPRPL = "athenz.auth.kerberos.service_principal"; + static final String KRB_PROP_KEYTAB = "athenz.auth.kerberos.keytab_location"; + static final String KRB_PROP_DEBUG = "athenz.auth.kerberos.debug"; + + // This is used if there is a jaas.conf. The jaas.conf path is specified by the system property + // java.security.auth.login.config + static final String KRB_PROP_JAASCFG = "athenz.auth.kerberos.jaas_cfg_section"; + static final String KRB_PROP_LOGIN_CB_CLASS = "athenz.auth.kerberos.login_callback_handler_class"; + static final String KRB_PROP_LOGIN_RENEW_TGT = "athenz.auth.kerberos.renewTGT"; // "true" or "false" + static final String KRB_PROP_LOGIN_USE_TKT_CACHE = "athenz.auth.kerberos.use_ticket_cache"; // "true" or "false" + static final String KRB_PROP_LOGIN_TKT_CACHE_NAME = "athenz.auth.kerberos.ticket_cache_name"; // file path + static final String KRB_PROP_LOGIN_WINDOW = "athenz.auth.kerberos.login_window"; // millis used to determine re-login + + static final String LOGIN_WINDOW_DEF = "60000"; // 60 seconds default + + private String servicePrincipal; // ex: HTTP/localhost@LOCALHOST + private String keyTabConfFile; + private String jaasConfigSection; + private String loginCallbackHandler; + private AtomicReference serviceSubject = new AtomicReference(); + private Exception initState = null; + + private long lastLogin = 0; // last time logged in in millisecs + private long loginWindow = 60000; + + public KerberosAuthority(String servicePrincipal, String keyTabConfFile, String jaasConfigSection) { + + this(); + if (servicePrincipal != null) { + this.servicePrincipal = servicePrincipal; + } + if (keyTabConfFile != null) { + this.keyTabConfFile = keyTabConfFile; + } + if (jaasConfigSection == null) { + this.jaasConfigSection = ""; + } else { + this.jaasConfigSection = jaasConfigSection; + } + } + + public KerberosAuthority() { + servicePrincipal = System.getProperty(KRB_PROP_SVCPRPL); + keyTabConfFile = System.getProperty(KRB_PROP_KEYTAB); + jaasConfigSection = System.getProperty(KRB_PROP_JAASCFG, ""); + loginCallbackHandler = System.getProperty(KRB_PROP_LOGIN_CB_CLASS); + loginWindow = Long.decode(System.getProperty(KRB_PROP_LOGIN_WINDOW, LOGIN_WINDOW_DEF)); + } + + public Exception getInitState() { + return initState; + } + public void setInitState(Exception exc) { + initState = exc; + } + + public long getLoginWindow() { + return loginWindow; + } + public void setLoginWindow(long loginWindowMillis) { + loginWindow = loginWindowMillis; + } + + public long getLastLogin() { + return lastLogin; + } + + /** + * Initialize the authority + */ + @Override + public void initialize() { + login(false); + } + + @SuppressWarnings({ "unchecked", "rawtypes" }) + public synchronized void login(boolean logoutFirst) { + + long now = System.currentTimeMillis(); + if ((now - lastLogin) < loginWindow) { + // recently logged in so dont bother do it again + return; + } + + Subject subject = null; + if (servicePrincipal != null) { + Set principals = new HashSet(1); + principals.add(new KerberosPrincipal(servicePrincipal)); + + subject = new Subject(false, principals, new HashSet(), new HashSet()); + } + + LoginConfig loginConfig = new LoginConfig(keyTabConfFile, servicePrincipal); + initState = null; + try { + // NOTE: if no callback handler specified + // LoginContext uses the auth.login.defaultCallbackHandler security property for the fully + // qualified class name of a default handler implementation + LoginContext loginContext = null; + CallbackHandler loginHandler = null; + if (loginCallbackHandler != null) { + Class cbhandlerClass = Class.forName(loginCallbackHandler); + loginHandler = (CallbackHandler) cbhandlerClass.getConstructor(String.class, String.class).newInstance(servicePrincipal, null); + } + + if (subject == null) { + loginContext = new LoginContext(jaasConfigSection, loginHandler); + } else { + loginContext = new LoginContext(jaasConfigSection, subject, loginHandler, loginConfig); + } + + if (logoutFirst) { + loginContext.logout(); + } + loginContext.login(); + subject = loginContext.getSubject(); + serviceSubject.set(subject); + lastLogin = System.currentTimeMillis(); + + } catch (Exception exc) { + initState = exc; + String params = "svc-princ=" + servicePrincipal + " login-callback=" + loginCallbackHandler + + " keytab=" + keyTabConfFile + " jaas-section=" + jaasConfigSection; + LOG.error("KerberosAuthority:initialize: Login context failure: config params=(" + params + ") exc: " + exc.getMessage(), exc); + } + } + + boolean isTargetPrincipal(KerberosTicket ticket, String remoteSvcPrincipal) { + if (ticket == null) { + return false; + } + + KerberosPrincipal principal = ticket.getServer(); + if (LOG.isDebugEnabled()) { + LOG.debug("KerberosAuthority:isTargetPrincipal: our princ=" + servicePrincipal + " ticket princ=" + principal.getName()); + } + + if (principal.getName().equals(remoteSvcPrincipal)) { + return true; + } + return false; + } + + /** + * Determines if refresh login needed if the ticket for the specified + * remoteSvcPrincipal has expired or is not found. + * @param remoteSvcPrincipal remote service principal + * @return true if refresh is required, false otherwise (ticket is still valid) + */ + public boolean refreshLogin(String remoteSvcPrincipal) { + // check for expiration + // get the original ticket from the serviceSubject + Subject subject = serviceSubject.get(); + KerberosTicket tgt = null; + Set tickets = subject.getPrivateCredentials(KerberosTicket.class); + for (KerberosTicket ticket : tickets) { + if (isTargetPrincipal(ticket, remoteSvcPrincipal)) { + tgt = ticket; + break; + } + } + + if (tgt == null) { + if (LOG.isDebugEnabled()) { + LOG.debug("KerberosAuthority:refreshLogin: Process tickets found no principal match: subject contains number of tickets=" + tickets.size()); + } + return true; + } + long end = tgt.getEndTime().getTime(); + long now = System.currentTimeMillis(); + if (now > end) { + login(true); + return true; + } + return false; + } + + /** + * @return the domain of the authority, defaults to "ygrid" + */ + @Override + public String getDomain() { + return null; + } + + @Override + public String getHeader() { + return KRB_AUTH_HEADER; + } + + /** + * Verify the credentials and if valid return the corresponding Principal, null otherwise. + * @param creds the credentials (i.e. cookie, token, secret) that will identify the principal. + * @param remoteAddr remote IP address of the connection + * @param httpMethod the http method for this request (e.g. GET, PUT, etc) + * @param errMsg will contain error message if authenticate fails + * @return the Principal for the credentials, or null if the credentials are not valid. + */ + @Override + public Principal authenticate(String creds, String remoteAddr, String httpMethod, StringBuilder errMsg) { + + KerberosToken token = null; + try { + token = new KerberosToken(creds, remoteAddr); + } catch (IllegalArgumentException ex) { + if (errMsg == null) { + errMsg = new StringBuilder(); + } + errMsg.append("KerberosAuthority:authenticate: Invalid token: exc="). + append(ex.getMessage()).append(" : credential="). + append(creds); + LOG.error("KerberosAuthority:authenticate: " + errMsg.toString()); + return null; + } + + StringBuilder errDetail = new StringBuilder(512); + if (token.validate(serviceSubject.get(), errDetail) == false) { + if (errMsg != null) { + errMsg.append("KerberosAuthority:authenticate: token validation failure: "); + errMsg.append(errDetail); + } + return null; + } + + String userDomain = token.getDomain(); + String userName = token.getUserName(); + if (userName == null) { + if (errMsg != null) { + errMsg.append("KerberosAuthority:authenticate: token validation failure: missing user"); + } + return null; + } + return SimplePrincipal.create(userDomain, userName, creds, this); + } + + static class LoginConfig extends Configuration { + private String keyTabConfFile; + private String servicePrincipalName; + private boolean debugKrbEnabled = false; + + public LoginConfig(String keyTabConfFile, String servicePrincipalName) { + this.keyTabConfFile = keyTabConfFile; + this.servicePrincipalName = servicePrincipalName; + debugKrbEnabled = Boolean.parseBoolean(System.getProperty(KRB_PROP_DEBUG, "false")); + } + + public boolean isDebugEnabled() { + return debugKrbEnabled; + } + + @Override + public AppConfigurationEntry[] getAppConfigurationEntry(String name) { + Map options = new HashMap(); + if (keyTabConfFile == null || keyTabConfFile.isEmpty()) { + options.put("useKeyTab", "false"); + options.put("tryFirstPass", "true"); + } else { + options.put("useKeyTab", "true"); + options.put("keyTab", keyTabConfFile); + if (LOG.isDebugEnabled()) { + LOG.debug("KerberosAuthority:authenticate: use keytab=" + keyTabConfFile); + } + } + options.put("principal", servicePrincipalName); + options.put("storeKey", "true"); + options.put("doNotPrompt", "true"); + String useTktCache = System.getProperty(KRB_PROP_LOGIN_USE_TKT_CACHE, "true"); + options.put("useTicketCache", useTktCache); + String renewTgt = System.getProperty(KRB_PROP_LOGIN_RENEW_TGT, "true"); + options.put("renewTGT", renewTgt); + /* + * refreshKrb5Config is very important. Without that not able to login + * more than one principal. Fails with + * "KeyTab instance already exists. Unable to obtain password from user" + */ + options.put("refreshKrb5Config", "true"); + + // If "ticketCache" is set, "useTicketCache" must also be set to true; + // Otherwise a configuration error will be returned + if (Boolean.parseBoolean(useTktCache) == true) { + String ticketCacheName = System.getenv("KRB5CCNAME"); // this is what hadoop does + if (ticketCacheName != null) { + options.put("ticketCache", ticketCacheName); + } else { + ticketCacheName = System.getProperty(KRB_PROP_LOGIN_TKT_CACHE_NAME); + if (ticketCacheName != null) { + options.put("ticketCache", ticketCacheName); + } + } + } + + if (debugKrbEnabled) { + options.put("debug", "true"); + } + options.put("isInitiator", "false"); + + return new AppConfigurationEntry[] { + new AppConfigurationEntry( + "com.sun.security.auth.module.Krb5LoginModule", + AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options) + }; + } + } +} + diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/PrincipalAuthority.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/PrincipalAuthority.java new file mode 100644 index 00000000000..bae9cabb61b --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/PrincipalAuthority.java @@ -0,0 +1,319 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.util.List; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.AuthorityKeyStore; +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.auth.token.Token; + +public class PrincipalAuthority implements Authority, AuthorityKeyStore { + + private static final String USER_DOMAIN = "user"; + private static final String SYS_AUTH_DOMAIN = "sys.auth"; + private static final String ZMS_SERVICE = "zms"; + private static final String ZTS_SERVICE = "zts"; + + static final String ATHENZ_PROP_TOKEN_OFFSET = "athenz.auth.principal.token_allowed_offset"; + static final String ATHENZ_PROP_IP_CHECK_MODE = "athenz.auth.principal.remote_ip_check_mode"; + static final String ATHENZ_PROP_USER_DOMAIN = "athenz.user_domain"; + + public static final String HTTP_HEADER = "Athenz-Principal-Auth"; + public static final String ATHENZ_PROP_PRINCIPAL_HEADER = "athenz.auth.principal.header"; + + private static final Logger LOG = LoggerFactory.getLogger(PrincipalAuthority.class); + + enum IpCheckMode { + OPS_ALL, + OPS_WRITE, + OPS_NONE + } + + KeyStore keyStore = null; + private int allowedOffset = 300; + IpCheckMode ipCheckMode = IpCheckMode.OPS_WRITE; + String userDomain = USER_DOMAIN; + final String headerName = System.getProperty(ATHENZ_PROP_PRINCIPAL_HEADER, HTTP_HEADER); + + @Override + public void initialize() { + + allowedOffset = Integer.parseInt(System.getProperty(ATHENZ_PROP_TOKEN_OFFSET, "300")); + ipCheckMode = IpCheckMode.valueOf(System.getProperty(ATHENZ_PROP_IP_CHECK_MODE, IpCheckMode.OPS_WRITE.toString())); + userDomain = System.getProperty(ATHENZ_PROP_USER_DOMAIN, USER_DOMAIN); + + // case of invalid value, we'll default back to 5 minutes + + if (allowedOffset < 0) { + allowedOffset = 300; + } + } + + @Override + public String getDomain() { + return null; //services *are* a domain + } + + @Override + public String getHeader() { + return headerName; + } + + @Override + public Principal authenticate(String signedToken, String remoteAddr, String httpMethod, StringBuilder errMsg) { + + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + if (LOG.isDebugEnabled()) { + LOG.debug("Authenticating PrincipalToken: " + signedToken); + } + + PrincipalToken serviceToken = null; + try { + serviceToken = new PrincipalToken(signedToken); + } catch (IllegalArgumentException ex) { + errMsg.append("PrincipalAuthority:authenticate: Invalid token: exc="). + append(ex.getMessage()).append(" : credential="). + append(Token.getUnsignedToken(signedToken)); + LOG.error(errMsg.toString()); + return null; + } + + /* before authenticating verify that if this is a valid + * authorized service token or not and if required + * components are provided (the method already logs + * all error messages) */ + + StringBuilder errDetail = new StringBuilder(512); + if (!serviceToken.isValidAuthorizedServiceToken(errDetail)) { + errMsg.append("PrincipalAuthority:authenticate: Invalid authorized service token: "); + errMsg.append(errDetail).append(" : credential="). + append(Token.getUnsignedToken(signedToken)); + return null; + } + + String tokenDomain = serviceToken.getDomain().toLowerCase(); + String tokenName = serviceToken.getName().toLowerCase(); + String keyService = serviceToken.getKeyService(); + boolean userToken = tokenDomain.equals(userDomain); + + /* get the public key for this token to validate signature */ + + String publicKey = getPublicKey(tokenDomain, tokenName, keyService, + serviceToken.getKeyId(), userToken); + + /* the validate method logs all error messages */ + + if (serviceToken.validate(publicKey, allowedOffset, errDetail) == false) { + errMsg.append("PrincipalAuthority:authenticate: service token validation failure: "); + errMsg.append(errDetail).append(" : credential="). + append(Token.getUnsignedToken(signedToken)); + return null; + } + + /* if an authorized service signature is available then we're going to validate + * that signature as well to support token chaining in Athenz and, if necessary, + * bypass IP address mismatch for users */ + + String authorizedServiceName = null; + if (serviceToken.getAuthorizedServiceSignature() != null) { + authorizedServiceName = validateAuthorizeService(serviceToken, errDetail); + if (authorizedServiceName == null) { + errMsg.append("PrincipalAuthority:authenticate: validation of authorized service failure: "). + append(errDetail).append(" : credential="). + append(Token.getUnsignedToken(signedToken)); + return null; + } + } + + /* if we have a usertoken and our remote ip check enabled, verify that the IP address + * matches before allowing the operation go through */ + + if (userToken && !remoteIpCheck(remoteAddr, httpMethod, serviceToken, authorizedServiceName)) { + errMsg.append("PrincipalAuthority:authenticate: IP Mismatch - token ("). + append(serviceToken.getIP()).append(") request ("). + append(remoteAddr).append(")"); + LOG.error(errMsg.toString()); + return null; + } + + /* all the role members in Athenz are normalized to lower case so we need to make + * sure our principal's name and domain are created with lower case as well */ + + SimplePrincipal princ = (SimplePrincipal) SimplePrincipal.create(tokenDomain, + tokenName, signedToken, serviceToken.getTimestamp(), this); + princ.setUnsignedCreds(serviceToken.getUnsignedToken()); + princ.setAuthorizedService(authorizedServiceName); + princ.setOriginalRequestor(serviceToken.getOriginalRequestor()); + princ.setKeyService(keyService); + princ.setIP(serviceToken.getIP()); + return princ; + } + + boolean remoteIpCheck(String remoteAddr, String httpMethod, PrincipalToken serviceToken, + String authorizedServiceName) { + + boolean checkResult = true; + switch (ipCheckMode) { + case OPS_ALL: + if (!remoteAddr.equals(serviceToken.getIP())) { + checkResult = false; + } + break; + case OPS_WRITE: + /* if we have a user token for a write operation and we have an IP address + * mismatch then we'll allow this authenticate request to proceed only if it's + * been configured with authorized user only. */ + + if (isWriteOperation(httpMethod) && !remoteAddr.equals(serviceToken.getIP())) { + + if (authorizedServiceName == null) { + checkResult = false; + } + } + break; + default: + break; + } + + return checkResult; + } + + String getPublicKey(String tokenDomain, String tokenName, String keyService, + String keyId, boolean userToken) { + + /* by default we're going to look for the public key for the domain + * and service defined in the token */ + + String publicKeyDomain = tokenDomain; + String publicKeyService = tokenName; + + /* now let's handle the exceptions: + * 1) if the token has a key service field set then only supported values are + * either zms or zts, so we use sys.auth.zms or sys.auth.zts services + * 2) if the token's domain is user then it's a user token or if it's sd then + * it's our special project token so for those cases we are going to ask for + * zms's own public key. */ + + if (keyService != null && !keyService.isEmpty()) { + if (keyService.equals(ZMS_SERVICE)) { + publicKeyDomain = SYS_AUTH_DOMAIN; + publicKeyService = ZMS_SERVICE; + } else if (keyService.equals(ZTS_SERVICE)) { + publicKeyDomain = SYS_AUTH_DOMAIN; + publicKeyService = ZTS_SERVICE; + } + } else if (userToken) { + publicKeyDomain = SYS_AUTH_DOMAIN; + publicKeyService = ZMS_SERVICE; + } + + return keyStore.getPublicKey(publicKeyDomain, publicKeyService, keyId); + } + + boolean isWriteOperation(String httpMethod) { + if (httpMethod == null) { + return false; + } + if (httpMethod.equalsIgnoreCase("PUT") || httpMethod.equalsIgnoreCase("POST") + || httpMethod.equalsIgnoreCase("DELETE")) { + return true; + } else { + return false; + } + } + + String getAuthorizedServiceName(List authorizedServices, String authorizedServiceName) { + + /* if we have an authorized service name specified then it must be + * present in the authorized services list or if it's null then the + * list must contain a single element only */ + + String serviceName = authorizedServiceName; + if (serviceName == null) { + if (authorizedServices.size() != 1) { + LOG.error("getAuthorizedServiceName() failed: No authorized service name specified"); + return null; + } + serviceName = authorizedServices.get(0); + } else { + if (!authorizedServices.contains(serviceName)) { + LOG.error("getAuthorizedServiceName() failed: Invalid authorized service name specified:" + + serviceName); + return null; + } + } + return serviceName; + } + + String validateAuthorizeService(PrincipalToken userToken, StringBuilder errMsg) { + + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + + /* if we have an authorized service name specified then it must be + * present in the authorized services list or if it's null then the + * list must contain a single element only */ + + String authorizedServiceName = userToken.getAuthorizedServiceName(); + if (authorizedServiceName == null) { + List authorizedServices = userToken.getAuthorizedServices(); + if (authorizedServices == null || authorizedServices.size() != 1) { + errMsg.append("PrincipalAuthority:validateAuthorizeService: "). + append("No service name and services list empty OR contains multiple entries: token="). + append(userToken.getUnsignedToken()); + return null; + } else { + authorizedServiceName = authorizedServices.get(0); + } + } + + /* need to extract domain and service name from our full service name value */ + + int idx = authorizedServiceName.lastIndexOf('.'); + if (idx <= 0 || idx == authorizedServiceName.length() - 1) { + errMsg.append("PrincipalAuthority:validateAuthorizeService: "). + append("failed: token=").append(userToken.getUnsignedToken()). + append(" : Invalid authorized service name specified="). + append(authorizedServiceName); + LOG.error(errMsg.toString()); + return null; + } + + String publicKey = keyStore.getPublicKey(authorizedServiceName.substring(0, idx), + authorizedServiceName.substring(idx + 1), userToken.getAuthorizedServiceKeyId()); + + /* the token method reports all error messages */ + StringBuilder errDetail = new StringBuilder(512); + if (userToken.validateForAuthorizedService(publicKey, errDetail) == false) { + errMsg.append("PrincipalAuthority:validateAuthorizeService: token validation for authorized service failed: "). + append(errDetail); + return null; + } + + return authorizedServiceName; + } + + @Override + public void setKeyStore(KeyStore keyStore) { + this.keyStore = keyStore; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/RoleAuthority.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/RoleAuthority.java new file mode 100644 index 00000000000..8585df14b4d --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/RoleAuthority.java @@ -0,0 +1,157 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.AuthorityKeyStore; +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.token.RoleToken; +import com.yahoo.athenz.auth.token.Token; + +public class RoleAuthority implements Authority, AuthorityKeyStore { + + private static final Logger LOG = LoggerFactory.getLogger(RoleAuthority.class); + + public final static String SYS_AUTH_DOMAIN = "sys.auth"; + public final static String ZTS_SERVICE_NAME = "zts"; + private static final String USER_DOMAIN = "user"; + + static final String ATHENZ_PROP_TOKEN_OFFSET = "athenz.auth.role.token_allowed_offset"; + static final String ATHENZ_PROP_USER_DOMAIN = "athenz.user_domain"; + + public static final String HTTP_HEADER = "Athenz-Role-Auth"; + public static final String ATHENZ_PROP_ROLE_HEADER = "athenz.auth.role.header"; + + private int allowedOffset = 300; + + KeyStore keyStore = null; + String userDomain = "user"; + final String headerName = System.getProperty(ATHENZ_PROP_ROLE_HEADER, HTTP_HEADER); + + @Override + public void initialize() { + + allowedOffset = Integer.parseInt(System.getProperty(ATHENZ_PROP_TOKEN_OFFSET, "300")); + userDomain = System.getProperty(ATHENZ_PROP_USER_DOMAIN, USER_DOMAIN); + + // case of invalid value, we'll default back to 5 minutes + + if (allowedOffset < 0) { + allowedOffset = 300; + } + } + + @Override + public String getDomain() { + return "sys.auth"; + } + + @Override + public String getHeader() { + return headerName; + } + + @Override + public Principal authenticate(String signedToken, String remoteAddr, String httpMethod, StringBuilder errMsg) { + + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + if (LOG.isDebugEnabled()) { + LOG.debug("Authenticating RoleToken: " + signedToken); + } + + RoleToken roleToken = null; + try { + roleToken = new RoleToken(signedToken); + } catch (IllegalArgumentException ex) { + errMsg.append("RoleAuthority:authenticate failed: Invalid token: exc="). + append(ex.getMessage()).append(" : credential="). + append(Token.getUnsignedToken(signedToken)); + LOG.error(errMsg.toString()); + return null; + } + + /* if the token's domain is user then we need to check to see if this is a write + * operation (PUT/POST/DELETE) and in that case we must validate the IP + * address of the incoming request to make sure it matches to IP address + * that's stored in the RoleToken */ + + if (!remoteAddr.equals(roleToken.getIP()) && isWriteOperation(httpMethod)) { + + String tokenPrincipal = roleToken.getPrincipal(); + int idx = tokenPrincipal.lastIndexOf('.'); + if (idx <= 0 || idx == tokenPrincipal.length() - 1) { + errMsg.append("RoleAuthority:authenticate failed: Invalid principal specified: "). + append(tokenPrincipal).append(" : credential="). + append(Token.getUnsignedToken(signedToken)); + LOG.error(errMsg.toString()); + return null; + } + + if (tokenPrincipal.substring(0, idx).equalsIgnoreCase(userDomain)) { + errMsg.append("RoleAuthority:authenticate failed: IP Mismatch - token-ip("). + append(roleToken.getIP()).append(") request-addr("). + append(remoteAddr).append(") : credential="). + append(Token.getUnsignedToken(signedToken)); + if (LOG.isWarnEnabled()) { + LOG.warn(errMsg.toString()); + } + + return null; + } + } + + String publicKey = keyStore.getPublicKey(SYS_AUTH_DOMAIN, ZTS_SERVICE_NAME, roleToken.getKeyId()); + + if (roleToken.validate(publicKey, allowedOffset) == false) { + errMsg.append("RoleAuthority:authenticate failed: validation was not successful: credential="). + append(Token.getUnsignedToken(signedToken)); + if (LOG.isWarnEnabled()) { + LOG.warn(errMsg.toString()); + } + return null; + } + + // all the role members in Athenz are normalized to lower case so we need to make + // sure our principal's name and domain are created with lower case as well + + SimplePrincipal princ = (SimplePrincipal) SimplePrincipal.create(roleToken.getDomain().toLowerCase(), + signedToken, roleToken.getRoles(), this); + princ.setUnsignedCreds(roleToken.getUnsignedToken()); + return princ; + } + + boolean isWriteOperation(String httpMethod) { + if (httpMethod == null) { + return false; + } + if (httpMethod.equalsIgnoreCase("PUT") || httpMethod.equalsIgnoreCase("POST") + || httpMethod.equalsIgnoreCase("DELETE")) { + return true; + } else { + return false; + } + } + + @Override + public void setKeyStore(KeyStore keyStore) { + this.keyStore = keyStore; + } + +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/SimplePrincipal.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/SimplePrincipal.java new file mode 100644 index 00000000000..29647ee027c --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/SimplePrincipal.java @@ -0,0 +1,233 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.util.List; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.util.Validate; + +public class SimplePrincipal implements Principal { + + private static final Logger LOG = LoggerFactory.getLogger(SimplePrincipal.class); + + String domain = null; + String name = null; + String yrn = null; + String creds = null; + String unsignedCreds = null; + String ip = null; + long issueTime = 0; + List roles = null; + Authority authority = null; + String authorizedService = null; + String originalRequestor = null; + String keyService = null; + + public static Principal create(String domain, String name, String creds) { + return create(domain, name, creds, 0, null); + } + + /** + * Create a Principal based on a given RoleToken + * @param domain Domain name that the RoleToken was issued for + * @param creds Credentials of the principal (RoleToken) + * @param roles List of roles defined in the token + * @param authority authority responsible for the credentials (RoleAuthority) + * @return a Principal for the given set of roles in a domain + */ + public static Principal create(String domain, String creds, List roles, Authority authority) { + if (!Validate.domainName(domain)) { + if (LOG.isWarnEnabled()) { + LOG.warn("WARNING: domain name doesn't validate: " + creds); + } + } + if (roles == null || roles.size() == 0) { + if (LOG.isWarnEnabled()) { + LOG.warn("WARNING: zero roles: " + creds); + } + } + return new SimplePrincipal(domain, creds, roles, authority); + } + + /** + * Create a Principal for the given identity + * @param domain Domain name for the identity + * @param name Name of the identity + * @param creds Credentials of the principal (PrincipalToken which could be either UserToken or ServiceToken) + * @param authority authority responsible for the credentials (e.g. PrincipalAuthority) + * @return a Principal for the identity + */ + public static Principal create(String domain, String name, String creds, Authority authority) { + return create(domain, name, creds, 0, authority); + } + + /** + * Create a Principal for the given user identity + * @param domain Domain name for the identity (For users this will always be user) + * @param name Name of the identity + * @param creds Credentials of the principal (e.g. Cookie.User) + * @param issueTime when the User Cookie/Credentials was issued + * @param authority authority responsible for the credentials (e.g. UserAuthority) + * @return a Principal for the identity + */ + public static Principal create(String domain, String name, String creds, long issueTime, Authority authority) { + + if (!Validate.principalName(name)) { + if (LOG.isWarnEnabled()) { + LOG.warn("WARNING: principal name doesn't validate: " + name); + } + } + + if (domain != null) { + String matchDomain = (authority == null) ? null : authority.getDomain(); + if (matchDomain != null && !domain.equals(matchDomain)) { + if (LOG.isWarnEnabled()) { + LOG.warn("FAIL: domain mismatch for user " + name + " in authority + " + authority); + } + return null; + } + } else if (authority != null) { + if (authority.getDomain() != null) { + if (LOG.isWarnEnabled()) { + LOG.warn("FAIL: domain mismatch for user " + name + " in authority + " + authority); + } + return null; + } + } + return new SimplePrincipal(domain, name, creds, issueTime, authority); + } + + /** + * Create a Principal for the given host identity + * @param appId Application identifer + * @param creds Credentials of the principal + * @param authority authority responsible for the credentials (e.g. HostAuthority) + * @return a Principal for the host identity + */ + public static Principal create(String appId, String creds, Authority authority) { + return new SimplePrincipal(null, appId, creds, 0, authority); + } + + private SimplePrincipal(String domain, String name, String creds, long issueTime, Authority authority) { + this.domain = domain; + this.name = name; + this.creds = creds; + this.authority = authority; + this.issueTime = issueTime; + } + + private SimplePrincipal(String domain, String creds, List roles, Authority authority) { + this.domain = domain; + this.creds = creds; + this.roles = roles; + this.authority = authority; + } + + public void setUnsignedCreds(String unsignedCreds) { + this.unsignedCreds = unsignedCreds; + } + + public void setAuthorizedService(String authorizedService) { + this.authorizedService = authorizedService; + } + + public void setIP(String ip) { + this.ip = ip; + } + + public void setOriginalRequestor(String originalRequestor) { + this.originalRequestor = originalRequestor; + } + + public void setKeyService(String keyService) { + this.keyService = keyService; + } + + public String getIP() { + return ip; + } + + public String getUnsignedCredentials() { + return unsignedCreds; + } + + public Authority getAuthority() { + return authority; + } + + public String getDomain() { + return domain; + } + + public String getName() { + return name; + } + + public String getOriginalRequestor() { + return originalRequestor; + } + + public String getYRN() { + + if (yrn == null) { + if (domain != null && name != null) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append("."); + str.append(name); + yrn = str.toString(); + } else if (domain != null) { + yrn = domain; + } else if (name != null) { + yrn = name; + } + } + + return yrn; + } + public String getCredentials() { + return creds; + } + + public List getRoles() { + return roles; + } + + public long getIssueTime() { + return issueTime; + } + + public String toString() { + if (roles == null) { + return domain + "." + name; + } else { + return "ZToken_" + domain + "~" + roles.toString().replace("[", "").replace("]", ""); + } + } + + public String getAuthorizedService() { + return authorizedService; + } + + public String getKeyService() { + return keyService; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/SimpleServiceIdentityProvider.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/SimpleServiceIdentityProvider.java new file mode 100644 index 00000000000..5635f6acb98 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/SimpleServiceIdentityProvider.java @@ -0,0 +1,106 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.ServiceIdentityProvider; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.auth.util.CryptoException; + +import java.io.File; +import java.net.InetAddress; +import java.security.PrivateKey; + +/** + * The SimpleServiceIdentityProvider does proper signing of an NToken, but + * doesn't do anything to verify that the caller *should* have the private + * key. For stand-alone services, a stronger guarantee is recommended. This class + * could be used as a base class, to sign the credentials + */ +public class SimpleServiceIdentityProvider implements ServiceIdentityProvider { + + private PrivateKey key = null; + private Authority authority = null; + private long tokenTimeout = 3600; + private String keyId = "0"; + private String host = null; + + public SimpleServiceIdentityProvider(Authority authority, File privateKeyFile) throws CryptoException { + this(authority, Crypto.loadPrivateKey(privateKeyFile), "0", 3600); + } + + public SimpleServiceIdentityProvider(Authority authority, String privateKey) throws CryptoException { + this(authority, Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privateKey)), "0", 3600); + } + + public SimpleServiceIdentityProvider(Authority authority, PrivateKey privateKey) { + this(authority, privateKey, "0", 3600); + } + + public SimpleServiceIdentityProvider(Authority authority, PrivateKey privateKey, long tokenTimeout) { + this(authority, privateKey, "0", tokenTimeout); + } + + public SimpleServiceIdentityProvider(Authority authority, PrivateKey privateKey, + String keyId, long tokenTimeout) { + this.authority = authority; + this.key = privateKey; + this.tokenTimeout = tokenTimeout; + this.keyId = keyId.toLowerCase(); + this.setHost(getServerHostName()); + } + + public Principal getIdentity(String domainName, String serviceName) { + + // all the role members in Athenz are normalized to lower case so we need to make + // sure our principal's name and domain are created with lower case as well + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + + PrincipalToken token = new PrincipalToken.Builder("S1", domainName, serviceName) + .expirationWindow(tokenTimeout).host(host).keyId(keyId).build(); + token.sign(key); + + SimplePrincipal princ = (SimplePrincipal) SimplePrincipal.create(domainName, + serviceName, token.getSignedToken(), System.currentTimeMillis() / 1000, authority); + princ.setUnsignedCreds(token.getUnsignedToken()); + return princ; + } + + String getServerHostName() { + + String urlhost = null; + try { + InetAddress localhost = java.net.InetAddress.getLocalHost(); + urlhost = localhost.getCanonicalHostName(); + } catch (java.net.UnknownHostException e) { + urlhost = "localhost"; + } + + return urlhost; + } + + public String getHost() { + return host; + } + + public void setHost(String host) { + this.host = host; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/UserAuthority.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/UserAuthority.java new file mode 100644 index 00000000000..9aded1f0cd6 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/impl/UserAuthority.java @@ -0,0 +1,142 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; + +import java.nio.charset.StandardCharsets; + +import org.bouncycastle.util.encoders.Base64; +import org.jvnet.libpam.PAM; +import org.jvnet.libpam.PAMException; +import org.jvnet.libpam.UnixUser; + +/** + * Implementation that performs validation of PAM. + */ +public class UserAuthority implements Authority { + + private static final Logger LOG = LoggerFactory.getLogger(UserAuthority.class); + static final String ATHENZ_PROP_PAM_SERVICE_NAME = "athenz.auth.user.pam_service_name"; + + final String serviceName = System.getProperty(ATHENZ_PROP_PAM_SERVICE_NAME, "login"); + private PAM pam = null; + + public UserAuthority() { + } + + @Override + public void initialize() { + } + + @Override + public String getDomain() { + return "user"; + } + + @Override + public String getHeader() { + return "Authorization"; + }; + + /* + * we don't want the user to keep specifying their username and + * password as part of the request. instead, the user must first + * request a usertoken and then use that usertoken for all other + * requests against ZMS and ZTS servers. + * @see com.yahoo.athenz.auth.Authority#allowAuthorization() + */ + @Override + public boolean allowAuthorization() { + return false; + } + + void setPAM(PAM pam) { + this.pam = pam; + } + + PAM getPAM() throws PAMException { + if (pam != null) { + return pam; + } + return new PAM(serviceName); + } + + @Override + public Principal authenticate(String creds, String remoteAddr, String httpMethod, StringBuilder errMsg) { + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + + // the HTTP Basic authorization format is: Basic base64(:) + + if (!creds.startsWith("Basic ")) { + errMsg.append("UserAuthority:authenticate: credentials do not start with 'Basic '"); + LOG.error(errMsg.toString()); + return null; + } + + // decode - need to skip the first 6 bytes for 'Basic ' + + String decoded; + try { + decoded = new String(Base64.decode(creds.substring(6).getBytes(StandardCharsets.UTF_8))); + } catch (Exception e) { + errMsg.append("UserAuthority:authenticate: factory exc=").append(e.getMessage()); + LOG.error(errMsg.toString()); + return null; + } + + String[] userArray = decoded.split(":"); + String username = userArray[0]; + String password = userArray[1]; + + // we need to catch all exceptions here and just return + // failure to allow other authorities to handle authentication + // if necessary + + UnixUser user = null; + try { + user = getPAM().authenticate(username, password); + } catch (Throwable ex) { + errMsg.append("UserAuthority:authenticate: failed: user=").append(username). + append(" exc=").append(ex.getMessage()); + LOG.error(errMsg.toString()); + return null; + } + + if (user == null) { + errMsg.append("UserAuthority:authenticate: failed: user=").append(username); + LOG.error(errMsg.toString()); + return null; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("UserAuthority.authenticate: valid user=" + username); + } + + // all the role members in Athenz are normalized to lower case so we need to make + // sure our principal's name and domain are created with lower case as well + + long issueTime = 0; + SimplePrincipal princ = (SimplePrincipal) SimplePrincipal.create(getDomain().toLowerCase(), + userArray[0].toLowerCase(), creds, issueTime, this); + princ.setUnsignedCreds(creds); + return princ; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/KerberosToken.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/KerberosToken.java new file mode 100644 index 00000000000..d0c13fc3a8c --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/KerberosToken.java @@ -0,0 +1,131 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.token; + +import java.security.PrivilegedExceptionAction; +import java.nio.charset.StandardCharsets; +import java.security.PrivilegedActionException; +import javax.security.auth.Subject; + +import org.bouncycastle.util.encoders.Base64; +import org.ietf.jgss.GSSContext; +import org.ietf.jgss.GSSCredential; +import org.ietf.jgss.GSSManager; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class KerberosToken extends Token { + + private static final Logger LOG = LoggerFactory.getLogger(KerberosToken.class); + + public static final String KRB_AUTH_VAL_FLD = "Negotiate"; + public static final String KRB_PROP_TOKEN_PRIV_ACTION = "athenz.auth.kerberos.krb_privileged_action_class"; + public static final String ATHENZ_PROP_USER_DOMAIN = "athenz.user_domain"; + public static final String ATHENZ_PROP_USER_REALM = "athenz.auth.kerberos.user_realm"; + public static final String ATHENZ_PROP_KRB_USER_DOMAIN = "athenz.auth.kerberos.krb_user_domain"; + public static final String ATHENZ_PROP_KRB_USER_REALM = "athenz.auth.kerberos.krb_user_realm"; + + String krbPrivActionClass = System.getProperty(KRB_PROP_TOKEN_PRIV_ACTION); + String userName = null; + + public static final String USER_DOMAIN = System.getProperty(ATHENZ_PROP_USER_DOMAIN, "user"); + public static final String USER_REALM = System.getProperty(ATHENZ_PROP_USER_REALM, "USER_REALM"); + public static final String KRB_USER_DOMAIN = System.getProperty(ATHENZ_PROP_KRB_USER_DOMAIN, "krb"); + public static final String KRB_USER_REALM = System.getProperty(ATHENZ_PROP_KRB_USER_REALM, "KRB_REALM"); + + public KerberosToken(String creds, String remoteAddr) { + if (creds == null || creds.isEmpty()) { + LOG.error("KerberosToken: Missing credentials"); + throw new IllegalArgumentException("KerberosToken: creds must not be empty"); + } + + if (!creds.startsWith(KRB_AUTH_VAL_FLD)) { + throw new IllegalArgumentException("KerberosToken: creds do not contain required Negotiate component"); + } + + signedToken = creds; + unsignedToken = creds.substring(KRB_AUTH_VAL_FLD.length()).trim(); + domain = KRB_USER_DOMAIN; + } + + @SuppressWarnings({ "unchecked", "rawtypes" }) + public boolean validate(Subject serviceSubject, StringBuilder errMsg) { + + byte[] kerberosTicket = Base64.decode(unsignedToken.getBytes(StandardCharsets.UTF_8)); + PrivilegedExceptionAction privExcAction = null; + try { + if (krbPrivActionClass == null) { + privExcAction = new KerberosValidateAction(kerberosTicket); + } else { + Class privActionClass = Class.forName(krbPrivActionClass); + privExcAction = (PrivilegedExceptionAction) privActionClass.getConstructor(byte[].class).newInstance(kerberosTicket); + } + userName = Subject.doAs(serviceSubject, privExcAction); + int index = userName.indexOf('@'); + if (index != -1) { + if (userName.indexOf(KRB_USER_REALM, index) == -1) { + if (userName.indexOf(USER_REALM, index) != -1) { + domain = USER_DOMAIN; + } else { + throw new Exception("KerberosToken:validate: invalid Kerberos Realm: " + userName); + } + } + userName = userName.substring(0, index); + } + + return true; + } catch (PrivilegedActionException paexc) { + if (errMsg == null) { + errMsg = new StringBuilder(512); + } + errMsg.append("KerberosToken:validate: token=").append(unsignedToken). + append(" : privilege exc=").append(paexc); + LOG.error(errMsg.toString()); + paexc.printStackTrace(); + } catch (Exception exc) { + if (errMsg == null) { + errMsg = new StringBuilder(512); + } + errMsg.append("KerberosToken:validate: token=").append(unsignedToken). + append(" : unknown exc=").append(exc); + LOG.error(errMsg.toString()); + exc.printStackTrace(); + } + return false; + } + + public String getUserName() { + return userName; + } + + private static class KerberosValidateAction implements PrivilegedExceptionAction { + byte[] kerberosTicket; + + public KerberosValidateAction(byte[] kerberosTicket) { + this.kerberosTicket = kerberosTicket; + } + + @Override + public String run() throws Exception { + GSSContext context = GSSManager.getInstance().createContext((GSSCredential) null); + context.acceptSecContext(kerberosTicket, 0, kerberosTicket.length); + String user = context.getSrcName().toString(); + context.dispose(); + return user; + } + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/PrincipalToken.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/PrincipalToken.java new file mode 100644 index 00000000000..71a3a0eecaf --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/PrincipalToken.java @@ -0,0 +1,498 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.token; + +import java.security.PrivateKey; +import java.security.PublicKey; +import java.util.Arrays; +import java.util.List; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.auth.util.CryptoException; + +public class PrincipalToken extends Token { + + private String name = null; + private String originalRequestor = null; + protected String keyService = null; + private List authorizedServices = null; + private String authorizedServiceName = null; + private String authorizedServiceKeyId = "0"; + private String authorizedServiceSignature = null; + + private static final Logger LOG = LoggerFactory.getLogger(PrincipalToken.class); + + public static class Builder { + + // required attributes + private String domain = null; + private String name = null; + private String version = null; + + // optional attributes with default values + private String salt = Crypto.randomSalt(); + private String host = null; + private String ip = null; + private String keyId = "0"; + private long expirationWindow = 3600; + private long issueTime = 0; + private List authorizedServices = null; + private String keyService = null; + private String originalRequestor = null; + + public Builder(String version, String domain, String name) { + + if (version == null || domain == null || name == null) { + throw new IllegalArgumentException("version, domain and name parameters must not be null."); + } + + if (version.isEmpty() || domain.isEmpty() || name.isEmpty()) { + throw new IllegalArgumentException("version, domain and name parameters must have values."); + } + + this.version = version; + this.domain = domain; + this.name = name; + } + + public Builder host(String value) { + this.host = value; + return this; + } + + public Builder salt(String value) { + this.salt = value; + return this; + } + + public Builder ip(String value) { + this.ip = value; + return this; + } + + public Builder keyId(String value) { + this.keyId = value; + return this; + } + + public Builder issueTime(long value) { + this.issueTime = value; + return this; + } + + public Builder expirationWindow(long value) { + this.expirationWindow = value; + return this; + } + + public Builder authorizedServices(List authorizedServices) { + this.authorizedServices = authorizedServices; + return this; + } + + public Builder keyService(String value) { + this.keyService = value; + return this; + } + + public Builder originalRequestor(String value) { + this.originalRequestor = value; + return this; + } + + public PrincipalToken build() { + return new PrincipalToken(this); + } + } + + private PrincipalToken(Builder builder) { + + this.version = builder.version; + this.domain = builder.domain; + this.name = builder.name; + this.host = builder.host; + this.salt = builder.salt; + this.keyId = builder.keyId; + this.ip = builder.ip; + this.authorizedServices = builder.authorizedServices; + this.keyService = builder.keyService; + this.originalRequestor = builder.originalRequestor; + + super.setTimeStamp(builder.issueTime, builder.expirationWindow); + + StringBuilder strBuilder = new StringBuilder(defaultBuilderBufSize); + + strBuilder.append("v="); + strBuilder.append(version); + strBuilder.append(";d="); + strBuilder.append(domain); + strBuilder.append(";n="); + strBuilder.append(name); + + if (host != null && !host.isEmpty()) { + strBuilder.append(";h="); + strBuilder.append(host); + } + + strBuilder.append(";a="); + strBuilder.append(salt); + strBuilder.append(";t="); + strBuilder.append(timestamp); + strBuilder.append(";e="); + strBuilder.append(expiryTime); + strBuilder.append(";k="); + strBuilder.append(keyId); + if (keyService != null && !keyService.isEmpty()) { + strBuilder.append(";z="); + strBuilder.append(keyService); + } + if (originalRequestor != null && !originalRequestor.isEmpty()) { + strBuilder.append(";o="); + strBuilder.append(originalRequestor); + } + if (ip != null && !ip.isEmpty()) { + strBuilder.append(";i="); + strBuilder.append(ip); + } + if (authorizedServices != null && !authorizedServices.isEmpty()) { + strBuilder.append(";b="); + strBuilder.append(String.join(",", authorizedServices)); + } + + unsignedToken = strBuilder.toString(); + + if (LOG.isDebugEnabled()) { + LOG.debug("PrincipalToken created: " + unsignedToken); + } + } + + public PrincipalToken(String signedToken) { + + if (LOG.isDebugEnabled()) { + LOG.debug("Constructing PrincipalToken with input string: " + signedToken); + } + + if (signedToken == null || signedToken.isEmpty()) { + throw new IllegalArgumentException("Input String signedToken must not be empty"); + } + + /** + * first we need to extract data and signature parts + * the signature is always at the end of the token. The principal + * token can represent 2 types - service or user. The version + * string identifies the type by using S or U. Here are two sample + * tokens: + * + * User: + * v=U1;d=user;n=john;a=salt;t=tstamp;e=expiry;s=sig + * + * Service: + * v=S1;d=sports;n=storage;h=host.somecompany.com;a=salt;t=tstamp;e=expiry;s=sig + * + * v: version number U1 or S1 (string) + * d: domain name (as passed by the client) or user for users + * n: service name (as passed by the client) or username + * h: hostname or IP address (string) + * a: random 8 byte salt value hex encoded + * t: timestamp when the token was generated + * e: expiry timestamp based on SIA configuration + * s: signature generated over the "v=U1;a=salt;...;e=expiry" string + * using Service's private Key for service tokens and ZMS service's + * private key for user tokens and y64 encoded + */ + + int idx = signedToken.indexOf(";s="); + if (idx != -1) { + unsignedToken = signedToken.substring(0, idx); + } + + for (String item : signedToken.split(";")) { + String [] kv = item.split("="); + if (kv.length == 2) { + switch (kv[0]) { + case "a": + salt = kv[1]; + break; + case "b": + authorizedServices = Arrays.asList(kv[1].split(",")); + break; + case "bk": + authorizedServiceKeyId = kv[1]; + break; + case "bn": + authorizedServiceName = kv[1]; + break; + case "bs": + authorizedServiceSignature = kv[1]; + break; + case "d": + domain = kv[1]; + break; + case "e": + expiryTime = Long.parseLong(kv[1]); + break; + case "h": + host = kv[1]; + break; + case "i": + ip = kv[1]; + break; + case "k": + keyId = kv[1]; + break; + case "n": + name = kv[1]; + break; + case "o": + originalRequestor = kv[1]; + break; + case "s": + signature = kv[1]; + break; + case "t": + timestamp = Long.parseLong(kv[1]); + break; + case "v": + version = kv[1]; + break; + case "z": + keyService = kv[1]; + break; + } + } + } + + /* the required attributes for the token are + * domain and roles. The signature will be verified + * during the authenticate phase but now we'll make + * sure that domain and roles are present + */ + + if (domain == null || domain.isEmpty()) { + throw new IllegalArgumentException("SignedToken does not contain required domain component"); + } + + if (name == null || name.isEmpty()) { + throw new IllegalArgumentException("SignedToken does not contain required name component"); + } + + this.signedToken = signedToken; + + if (LOG.isDebugEnabled()) { + LOG.debug("Values extracted from token " + + " version:" + version + + " domain:" + domain + + " service:" + name + + " host:" + host + + " ip: " + ip + + " id: " + keyId + + " keyServic: " + keyService + + " originalRequestor: " + originalRequestor + + " salt:" + salt + + " timestamp:" + timestamp + + " expiryTime:" + expiryTime + + " signature:" + signature); + if (authorizedServices != null) { + LOG.debug("Authorized service details from token " + + " authorizedServices:" + String.join(",", authorizedServices) + + " authorizedServiceName:" + authorizedServiceName + + " authorizedServiceKeyId:" + authorizedServiceKeyId + + " authorizedServiceSignature:" + authorizedServiceSignature); + } + } + } + + public void signForAuthorizedService(String authorizedServiceName, String authorizedServiceKeyId, + String privKey) throws CryptoException { + signForAuthorizedService(authorizedServiceName, authorizedServiceKeyId, Crypto.loadPrivateKey(privKey)); + } + + public void signForAuthorizedService(String authorizedServiceName, String authorizedServiceKeyId, + PrivateKey key) throws CryptoException { + + /* first let's make sure the authorized service is one of the + * listed service names in the PrincipalToken */ + + if (authorizedServices == null || !authorizedServices.contains(authorizedServiceName)) { + throw new IllegalArgumentException("Authorized Service is not valid for this token"); + } + + this.authorizedServiceKeyId = authorizedServiceKeyId; + StringBuilder tokenToSign = new StringBuilder(512); + tokenToSign.append(signedToken); + tokenToSign.append(";bk="); + tokenToSign.append(authorizedServiceKeyId); + + if (authorizedServices.size() > 1) { + + /* if the user has allowed multiple authorized services then we need + * to keep track of which one is re-signing this token and as such + * we'll store the service name as the value for the bn field */ + + this.authorizedServiceName = authorizedServiceName; + tokenToSign.append(";bn="); + tokenToSign.append(authorizedServiceName); + } + + authorizedServiceSignature = Crypto.sign(tokenToSign.toString(), key); + + /* now append our new signature to the token we just signed */ + + tokenToSign.append(";bs="); + tokenToSign.append(authorizedServiceSignature); + signedToken = tokenToSign.toString(); + } + + public boolean validateForAuthorizedService(String pubKey, StringBuilder errMsg) { + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + if (authorizedServiceSignature == null) { + errMsg.append("PrincipalToken:validateForAuthorizedService: token="). + append(unsignedToken). + append(" : missing data/signature component: public key="). + append(pubKey); + LOG.error(errMsg.toString()); + return false; + } + + int idx = signedToken.indexOf(";bs="); + if (idx == -1) { + errMsg.append("PrincipalToken:validateForAuthorizedService: token="). + append(unsignedToken).append(" : not signed by any authorized service"); + LOG.error(errMsg.toString()); + return false; + } + + String unsignedAuthorizedServiceToken = signedToken.substring(0, idx); + + if (pubKey == null) { + errMsg.append("PrincipalToken:validateForAuthorizedService: token="). + append(unsignedToken).append(" : No public key provided"); + LOG.error(errMsg.toString()); + return false; + } + + PublicKey pub = null; + boolean verified = false; // fail safe + try { + pub = Crypto.loadPublicKey(pubKey); + verified = Crypto.verify(unsignedAuthorizedServiceToken, pub, authorizedServiceSignature); + if (verified == false) { + errMsg.append("PrincipalToken:validateForAuthorizedService: token="). + append(unsignedToken).append(" : authentication failed: public key="). + append(pubKey); + LOG.error(errMsg.toString()); + } else if (LOG.isDebugEnabled()) { + LOG.debug("validateForAuthorizedService: Token: " + unsignedToken + + " - successfully authenticated"); + } + } catch (Exception e) { + errMsg.append("PrincipalToken:validateForAuthorizedService: token="). + append(unsignedToken). + append(" : authentication failed verifying signature: exc="). + append(e.getMessage()).append(" : public key=").append(pubKey); + LOG.error(errMsg.toString()); + } + + return verified; + } + + public boolean isValidAuthorizedServiceToken(StringBuilder errMsg) { + + /* we start our by checking if this is an authorized service token */ + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + if (authorizedServices == null) { + + /* if both the service name list and signature are not present + * then we have a standard principal token */ + + if (authorizedServiceSignature == null) { + return true; + } + + /* otherwise we have an invalid token without the signature */ + errMsg.append("PrincipalToken:isValidAuthorizedServiceToken: Invalid Token="). + append(unsignedToken). + append(" : Authorized Service Signature available without service name"); + LOG.error(errMsg.toString()); + return false; + } + + /* if we have an authorized service name then we must have a corresponding + * signature available in the token */ + + if (authorizedServiceSignature == null) { + errMsg.append("PrincipalToken:isValidAuthorizedServiceToken: Invalid Token="). + append(unsignedToken). + append(" : Missing signature for specified authorized service"); + LOG.error(errMsg.toString()); + return false; + } + + /* if we have a specific authorized service name specified then + * it must be present in our service list otherwise we must + * have a single entry in our list */ + + if (authorizedServiceName != null) { + if (!authorizedServices.contains(authorizedServiceName)) { + errMsg.append("PrincipalToken:isValidAuthorizedServiceToken: Invalid Token="). + append(unsignedToken). + append(" : Authorized service name=").append(authorizedServiceName). + append(" is not listed in the service list"); + LOG.error(errMsg.toString()); + return false; + } + } else if (authorizedServices.size() != 1) { + errMsg.append("PrincipalToken:isValidAuthorizedServiceToken: Invalid Token="). + append(unsignedToken). + append(" : No service name and Authorized service list contains multiple entries"); + LOG.error(errMsg.toString()); + return false; + } + + return true; + } + + public String getName() { + return name; + } + + public String getKeyService() { + return keyService; + } + + public String getOriginalRequestor() { + return originalRequestor; + } + + public List getAuthorizedServices() { + return authorizedServices; + } + + public String getAuthorizedServiceName() { + return authorizedServiceName; + } + + public String getAuthorizedServiceKeyId() { + return authorizedServiceKeyId; + } + + public String getAuthorizedServiceSignature() { + return authorizedServiceSignature; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/RoleToken.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/RoleToken.java new file mode 100644 index 00000000000..6ac17740e47 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/RoleToken.java @@ -0,0 +1,327 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.token; + +import java.util.Arrays; +import java.util.List; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; + +public class RoleToken extends Token { + + protected List roles = null; + private String principal = null; + private String proxyUser = null; + private boolean domainCompleteRoleSet = false; + + private static final Logger LOG = LoggerFactory.getLogger(RoleToken.class); + + public static class Builder { + + // required attributes + private String domain = null; + private List roles = null; + private String version = null; + private String principal = null; + private String proxyUser = null; + private boolean domainCompleteRoleSet = false; + + // optional attributes with default values + private String salt = Crypto.randomSalt(); + private String host = null; + private String ip = null; + private String keyId = "0"; + private long expirationWindow = 3600; + private long issueTime = 0; + + // Note that it is expected that the Strings in roles should already be lowercased. + public Builder(String version, String domain, List roles) { + + if (version == null || domain == null || roles == null) { + throw new IllegalArgumentException("version, domain and roles parameters must not be null."); + } + + if (version.isEmpty() || domain.isEmpty() || roles.isEmpty()) { + throw new IllegalArgumentException("version, domain and roles parameters must have values."); + } + + this.version = version; + this.domain = domain; + this.roles = roles; + } + + public Builder principal(String value) { + this.principal = value; + return this; + } + + public Builder host(String value) { + this.host = value; + return this; + } + + public Builder salt(String value) { + this.salt = value; + return this; + } + + public Builder ip(String value) { + this.ip = value; + return this; + } + + public Builder keyId(String value) { + this.keyId = value; + return this; + } + + public Builder proxyUser(String value) { + this.proxyUser = value; + return this; + } + + public Builder issueTime(long value) { + this.issueTime = value; + return this; + } + + public Builder expirationWindow(long value) { + this.expirationWindow = value; + return this; + } + + public Builder domainCompleteRoleSet(boolean value) { + this.domainCompleteRoleSet = value; + return this; + } + + public RoleToken build() { + return new RoleToken(this); + } + } + + private RoleToken(Builder builder) { + + this.version = builder.version; + this.domain = builder.domain; + this.roles = builder.roles; + this.host = builder.host; + this.salt = builder.salt; + this.keyId = builder.keyId; + this.ip = builder.ip; + this.principal = builder.principal; + this.proxyUser = builder.proxyUser; + this.domainCompleteRoleSet = builder.domainCompleteRoleSet; + + super.setTimeStamp(builder.issueTime, builder.expirationWindow); + + StringBuilder strBuilder = new StringBuilder(defaultBuilderBufSize); + + strBuilder.append("v="); + strBuilder.append(version); + strBuilder.append(";d="); + strBuilder.append(domain); + strBuilder.append(";r="); + + int i = 0; + for (String role : roles) { + strBuilder.append(role); + if (++i != roles.size()) { + strBuilder.append(","); + } + } + + if (domainCompleteRoleSet) { + strBuilder.append(";c=1"); + } + + if (principal != null && !principal.isEmpty()) { + strBuilder.append(";p="); + strBuilder.append(principal); + } + + if (host != null && !host.isEmpty()) { + strBuilder.append(";h="); + strBuilder.append(host); + } + + if (proxyUser != null && !proxyUser.isEmpty()) { + strBuilder.append(";proxy="); + strBuilder.append(proxyUser); + } + + strBuilder.append(";a="); + strBuilder.append(salt); + strBuilder.append(";t="); + strBuilder.append(timestamp); + strBuilder.append(";e="); + strBuilder.append(expiryTime); + strBuilder.append(";k="); + strBuilder.append(keyId); + if (ip != null && !ip.isEmpty()) { + strBuilder.append(";i="); + strBuilder.append(ip); + } + + unsignedToken = strBuilder.toString(); + + if (LOG.isDebugEnabled()) { + LOG.debug("RoleToken created: " + unsignedToken); + } + } + + public RoleToken(String signedToken) { + + if (LOG.isDebugEnabled()) { + LOG.debug("Constructing RoleToken with input string: " + signedToken); + } + + if (signedToken == null || signedToken.isEmpty()) { + throw new IllegalArgumentException("Input String signedToken must not be empty"); + } + + /** + * first we need to extract data and signature parts + * the signature is always at the end of the token. + * The format for the Token is as follows: + * + * v=Z1;d=sports;r=role1,role2;a=salt;t=tstamp;e=expiry;k=1;s=sig + * + * v: version number Z1 (string) + * d: domain name where the roles are valid for + * r: list of comma separated roles + * c: the list of roles is complete in domain + * p: principal that got the token issued for + * a: random 8 byte salt value hex encoded + * t: timestamp when the token was generated + * h: host that issued this role token + * e: expiry timestamp based on SIA configuration + * k: identifier - either version or zone name + * s: signature generated over the "v=Z1;a=salt;...;e=expiry" string + * using Service's private Key and y64 encoded + * proxy: request was done by this authorized proxy user + */ + + int idx = signedToken.indexOf(";s="); + if (idx != -1) { + unsignedToken = signedToken.substring(0, idx); + } + + String roleNames = null; + for (String item : signedToken.split(";")) { + String [] kv = item.split("="); + if (kv.length == 2) { + switch (kv[0]) { + case "a": + salt = kv[1]; + break; + case "c": + if (Integer.parseInt(kv[1]) == 1) { + domainCompleteRoleSet = true; + } + break; + case "d": + domain = kv[1]; + break; + case "e": + expiryTime = Long.parseLong(kv[1]); + break; + case "h": + host = kv[1]; + break; + case "i": + ip = kv[1]; + break; + case "k": + keyId = kv[1]; + break; + case "p": + principal = kv[1]; + break; + case "r": + roleNames = kv[1]; + break; + case "s": + signature = kv[1]; + break; + case "t": + timestamp = Long.parseLong(kv[1]); + break; + case "proxy": + proxyUser = kv[1]; + break; + case "v": + version = kv[1]; + break; + } + } + } + + /* the required attributes for the token are + * domain and roles. The signature will be verified + * during the authenticate phase but now we'll make + * sure that domain and roles are present + */ + + if (domain == null || domain.isEmpty()) { + throw new IllegalArgumentException("SignedToken does not contain required domain component"); + } + + if (roleNames == null || roleNames.isEmpty()) { + throw new IllegalArgumentException("SignedToken does not contain required roles component"); + } + + roles = Arrays.asList(roleNames.split(",")); + + this.signedToken = signedToken; + + if (LOG.isDebugEnabled()) { + LOG.debug("Values extracted from token " + + " version:" + version + + " domain:" + domain + + " roles:" + roleNames + + " principal:" + principal + + " host:" + host + + " salt:" + salt + + " timestamp:" + timestamp + + " expiryTime:" + expiryTime + + " domainCompleteRoleSet" + domainCompleteRoleSet + + " keyId:" + keyId + + " ip:" + ip + + " proxyUser: " + proxyUser + + " signature:" + signature); + } + } + + public String getPrincipal() { + return principal; + } + + public List getRoles() { + return roles; + } + + public String getProxyUser() { + return proxyUser; + } + + public boolean getDomainCompleteRoleSet() { + return domainCompleteRoleSet; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/Token.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/Token.java new file mode 100644 index 00000000000..ab6def379a8 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/token/Token.java @@ -0,0 +1,205 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.token; + +import java.security.PrivateKey; +import java.security.PublicKey; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.auth.util.CryptoException; + +public class Token { + private static final Logger LOG = LoggerFactory.getLogger(Token.class); + + protected final int defaultBuilderBufSize = 512; + + protected String unsignedToken = null; + protected String signedToken = null; + protected String version = null; + protected String salt = null; + protected String host = null; + protected String ip = null; + protected String domain = null; + protected String signature = null; + protected String keyId = "0"; + protected long expiryTime = 0; + protected long timestamp = 0; + protected String digestAlgorithm = Crypto.SHA256; + + public void sign(String privKey) throws CryptoException { + sign(Crypto.loadPrivateKey(privKey)); + } + + public void sign(PrivateKey key) throws CryptoException { + signature = Crypto.sign(unsignedToken, key, digestAlgorithm); + signedToken = unsignedToken + ";s=" + signature; + } + + public void setTimeStamp(long issueTime, long expirationWindow) { + timestamp = (issueTime > 0) ? issueTime : System.currentTimeMillis() / 1000; + expiryTime = timestamp + expirationWindow; + } + + public boolean validate(String pubKey, int allowedOffset) { + return validate(pubKey, allowedOffset, null); + } + + public boolean validate(String pubKey, int allowedOffset, StringBuilder errMsg) { + + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + if (pubKey == null) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : No public key provided"); + LOG.error(errMsg.toString()); + return false; + } + + PublicKey publicKey = null; + try { + publicKey = Crypto.loadPublicKey(pubKey); + } catch (Exception e) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : unable to load public key due to Exception="). + append(e.getMessage()); + LOG.error(errMsg.toString()); + return false; + } + + return validate(publicKey, allowedOffset, errMsg); + } + + public boolean validate(PublicKey publicKey, int allowedOffset, StringBuilder errMsg) { + + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + if (unsignedToken == null || signature == null) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : missing data/signature component"); + LOG.error(errMsg.toString()); + return false; + } + + if (publicKey == null) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : No public key provided"); + LOG.error(errMsg.toString()); + return false; + } + + long now = System.currentTimeMillis() / 1000; + + /** + * make sure the token does not have a timestamp in the future + * we'll allow the configured offset between servers + */ + + if (timestamp != 0 && timestamp - allowedOffset > now) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : has future timestamp=").append(timestamp). + append(" : current time=").append(now); + LOG.error(errMsg.toString()); + return false; + } + + if (expiryTime != 0 && expiryTime < now) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : has expired time=").append(expiryTime). + append(" : current time=").append(now); + LOG.error(errMsg.toString()); + return false; + } + + boolean verified = false; // fail safe + try { + verified = Crypto.verify(unsignedToken, publicKey, signature, digestAlgorithm); + if (verified == false) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : authentication failed"); + LOG.error(errMsg.toString()); + } else if (LOG.isDebugEnabled()) { + LOG.debug("validate: Token successfully authenticated"); + } + } catch (Exception e) { + errMsg.append("Token:validate: token=").append(unsignedToken). + append(" : verify signature failed due to Exception="). + append(e.getMessage()); + LOG.error(errMsg.toString()); + } + + return verified; + } + + public String getVersion() { + return version; + } + + public String getSalt() { + return salt; + } + + public String getHost() { + return host; + } + + public String getDomain() { + return domain; + } + + public String getSignature() { + return signature; + } + + public long getTimestamp() { + return timestamp; + } + + public long getExpiryTime() { + return expiryTime; + } + + public String getSignedToken() { + return signedToken; + } + + public String getKeyId() { + return keyId; + } + + public String getIP() { + return ip; + } + + public String getUnsignedToken() { + return unsignedToken; + } + + /** + * Helper method to parse a credential to remove the signature from the + * raw credential string. Returning the unsigned credential. + * @param credential full token credentials including signature + * @return credentials without the signature + **/ + public static String getUnsignedToken(String credential) { + int idx = credential.indexOf(";s="); + if (idx != -1) { + credential = credential.substring(0, idx); + } + + return credential; + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/Crypto.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/Crypto.java new file mode 100644 index 00000000000..41e9ec3946d --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/Crypto.java @@ -0,0 +1,892 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.util; + +import java.io.ByteArrayInputStream; +import java.io.File; +import java.io.FileInputStream; +import java.io.FileNotFoundException; +import java.io.FileReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.Reader; +import java.io.StringReader; +import java.io.StringWriter; +import java.math.BigInteger; +import java.nio.charset.StandardCharsets; +import java.security.InvalidKeyException; +import java.security.KeyFactory; +import java.security.NoSuchAlgorithmException; +import java.security.NoSuchProviderException; +import java.security.SecureRandom; +import java.security.Security; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.MessageDigest; +import java.security.SignatureException; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.security.spec.InvalidKeySpecException; +import java.util.ArrayList; +import java.util.Calendar; +import java.util.Collection; +import java.util.Date; +import java.util.Iterator; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.rdl.*; + +import org.bouncycastle.asn1.ASN1ObjectIdentifier; +import org.bouncycastle.asn1.pkcs.PrivateKeyInfo; +import org.bouncycastle.asn1.x509.BasicConstraints; +import org.bouncycastle.asn1.x509.ExtendedKeyUsage; +import org.bouncycastle.asn1.x509.Extension; +import org.bouncycastle.asn1.x509.Extensions; +import org.bouncycastle.asn1.x509.GeneralName; +import org.bouncycastle.asn1.x509.GeneralNames; +import org.bouncycastle.asn1.x509.KeyPurposeId; +import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo; +import org.bouncycastle.asn1.pkcs.Attribute; +import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers; +import org.bouncycastle.asn1.x9.ECNamedCurveTable; +import org.bouncycastle.asn1.x9.X9ECParameters; +import org.bouncycastle.cert.X509CertificateHolder; +import org.bouncycastle.cert.X509v3CertificateBuilder; +import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; +import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder; +import org.bouncycastle.cms.CMSException; +import org.bouncycastle.cms.CMSProcessable; +import org.bouncycastle.cms.CMSProcessableByteArray; +import org.bouncycastle.cms.CMSSignedData; +import org.bouncycastle.cms.SignerInformation; +import org.bouncycastle.cms.SignerInformationStore; +import org.bouncycastle.cms.SignerInformationVerifier; +import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder; +import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPrivateKey; +import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPublicKey; +import org.bouncycastle.jce.X509KeyUsage; +import org.bouncycastle.jce.spec.ECParameterSpec; +import org.bouncycastle.jce.spec.ECPublicKeySpec; +import org.bouncycastle.jce.spec.ECPrivateKeySpec; +import org.bouncycastle.openssl.PEMException; +import org.bouncycastle.openssl.PEMKeyPair; +import org.bouncycastle.openssl.PEMParser; +import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter; +import org.bouncycastle.openssl.jcajce.JcaPEMWriter; +import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder; +import org.bouncycastle.operator.ContentSigner; +import org.bouncycastle.operator.InputDecryptorProvider; +import org.bouncycastle.operator.OperatorCreationException; +import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo; +import org.bouncycastle.pkcs.PKCSException; +import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequest; +import org.bouncycastle.util.encoders.Base64; + +public class Crypto { + + private static final Logger LOG = LoggerFactory.getLogger(Crypto.class); + private static final String RSA = "RSA"; + private static final String RSA_SHA1 = "SHA1withRSA"; + private static final String RSA_SHA256 = "SHA256withRSA"; + + private static final String ECDSA = "ECDSA"; + private static final String ECDSA_SHA1 = "SHA1withECDSA"; + private static final String ECDSA_SHA256 = "SHA256withECDSA"; + + public static final String SHA1 = "SHA1"; + public static final String SHA256 = "SHA256"; + + private static final String BC_PROVIDER = "BC"; + + static final SecureRandom RANDOM; + static { + Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()); + SecureRandom r = null; + try { + r = SecureRandom.getInstance("NativePRNGNonBlocking"); + } catch (NoSuchAlgorithmException nsa) { + r = new SecureRandom(); + } + + RANDOM = r; + // force seeding. + RANDOM.nextBytes(new byte[] { 8 }); + } + + /** + * Return a signature for the specific structured data with HmacSHA256 algorithm, + * using the provided secret. + * @param data structured data + * @param sharedSecret provided secret + * @return signature for the data + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static String hmac(Struct data, String sharedSecret) throws CryptoException { + return hmac(hashableString(data), sharedSecret); + } + + /** + * Calculate the SHA256withRSA signature for the specific structured data, using the provided private key. + * @param data structured data to sign + * @param key the RSA private key to sign with + * @return a ybase64 encoded signature + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static String sign(Struct data, PrivateKey key) throws CryptoException { + return sign(hashableString(data), key); + } + + /** + * Verify the SHA256withRSA signature for the specific structured data, using the provided public key. + * @param data structured data that was signed + * @param key the RSA public key corresponding to the signing key + * @param signature the ybase64 encoded signature to check + * @return true if the data signature can be verified with the given public key + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static boolean verify(Struct data, PublicKey key, String signature) throws CryptoException { + return verify(hashableString(data), key, signature); + } + + private static Object canonical(Object obj) { + if (obj != null) { + if (obj instanceof Struct) { + Struct s = (Struct) obj; + Struct s2 = new Struct(); + for (String k : s.sortedNames()) { + s2.put(k, canonical(s.get(k))); + } + return s2; + } else if (obj instanceof Array) { + Array a = new Array(); + for (Object o : (Array) obj) { + a.add(canonical(o)); + } + return a; + } + } + return obj; + } + + /** + * Make a copy of the data in canonical form. This means the field names are sorted, + * (recursively), so the same data (from a JSON point of view) will produce the same + * string. + * @param data structured data to normalize + * @return the canonical form for the data + */ + public static String hashableString(Struct data) { + return JSON.string(canonical(data)); + } + + /** + * Sign the message with the shared secret using HmacSHA256 + * The result is a ybase64 (url safe) string. + * @param message the UTF-8 string to be signed + * @param sharedSecret the secret to sign with + * @return the ybase64 representation of the signature. + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static String hmac(String message, String sharedSecret) throws CryptoException { + //this has not been optimized! + String method = "HmacSHA256"; + byte [] bsig = null; + try { + + javax.crypto.Mac hmac = javax.crypto.Mac.getInstance(method); + javax.crypto.spec.SecretKeySpec secretKey = new javax.crypto.spec.SecretKeySpec(utf8Bytes(sharedSecret), method); + hmac.init(secretKey); + bsig = hmac.doFinal(message.getBytes()); + + } catch (NoSuchAlgorithmException e) { + LOG.error("hmac: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider."); + throw new CryptoException(e); + } catch (InvalidKeyException e) { + LOG.error("hmac: Caught InvalidKeyException, incorrect key type is being used."); + throw new CryptoException(e); + } + return ybase64(bsig); + } + + static String getSignatureAlgorithm(String keyAlgorithm) throws NoSuchAlgorithmException { + return getSignatureAlgorithm(keyAlgorithm, SHA256); + } + + static String getSignatureAlgorithm(String keyAlgorithm, String digestAlgorithm) throws NoSuchAlgorithmException { + + String signatureAlgorithm = null; + switch (keyAlgorithm) { + case RSA: + if (SHA256.equals(digestAlgorithm)) { + signatureAlgorithm = RSA_SHA256; + } else if (SHA1.equals(digestAlgorithm)) { + signatureAlgorithm = RSA_SHA1; + } + break; + case ECDSA: + if (SHA256.equals(digestAlgorithm)) { + signatureAlgorithm = ECDSA_SHA256; + } else if (SHA1.equals(digestAlgorithm)) { + signatureAlgorithm = ECDSA_SHA1; + } + break; + } + + if (signatureAlgorithm == null) { + LOG.error("getSignatureAlgorithm: Unknown key algorithm: " + keyAlgorithm + + " digest algorithm: " + digestAlgorithm); + throw new NoSuchAlgorithmException(); + } + + if (LOG.isDebugEnabled()) { + LOG.debug("Signature Algorithm: " + signatureAlgorithm); + } + + return signatureAlgorithm; + } + + /** + * Sign the text with with given digest algorithm and private key. Returns the ybase64 encoding of it. + * @param message the message to sign, as a UTF8 string + * @param key the private key to sign with + * @param digestAlgorithm supported values SHA1 and SHA256 + * @return the ybase64 encoded signature for the data + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static String sign(String message, PrivateKey key, String digestAlgorithm) throws CryptoException { + try { + byte [] sig = null; + String signatureAlgorithm = getSignatureAlgorithm(key.getAlgorithm(), digestAlgorithm); + java.security.Signature signer = java.security.Signature.getInstance(signatureAlgorithm, BC_PROVIDER); + signer.initSign(key); + signer.update(utf8Bytes(message)); + sig = signer.sign(); + return ybase64(sig); + } catch (NoSuchProviderException e) { + LOG.error("sign: Caught NoSuchProviderException, check to make sure the provider is loaded correctly."); + throw new CryptoException(e); + } catch (NoSuchAlgorithmException e) { + LOG.error("sign: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider."); + throw new CryptoException(e); + } catch (SignatureException e) { + LOG.error("sign: Caught SignatureException."); + throw new CryptoException(e); + } catch (InvalidKeyException e) { + LOG.error("sign: Caught InvalidKeyException, incorrect key type is being used."); + throw new CryptoException(e); + } + } + + /** + * Sign the text with with SHA-256 and the private key. Returns the ybase64 encoding of it. + * @param message the message to sign, as a UTF8 string + * @param key the private key to sign with + * @return the ybase64 encoded signature for the data + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static String sign(String message, PrivateKey key) throws CryptoException { + return sign(message, key, SHA256); + } + + /** + * Verify the signed data with given digest algorithm and the private key against the ybase64 encoded signature. + * @param message the message to sign, as a UTF8 string + * @param key the public key corresponding to the signing key + * @param signature the ybase64 encoded signature for the data + * @param digestAlgorithm supported values SHA1 and SHA256 + * @return true if the message was indeed signed by the signature. + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static boolean verify(String message, PublicKey key, String signature, + String digestAlgorithm) throws CryptoException { + try { + byte [] sig = ybase64Decode(signature); + String signatureAlgorithm = getSignatureAlgorithm(key.getAlgorithm(), digestAlgorithm); + java.security.Signature signer = java.security.Signature.getInstance(signatureAlgorithm, BC_PROVIDER); + signer.initVerify(key); + signer.update(utf8Bytes(message)); + return signer.verify(sig); + } catch (NoSuchProviderException e) { + LOG.error("verify: Caught NoSuchProviderException, check to make sure the provider is loaded correctly."); + throw new CryptoException(e); + } catch (NoSuchAlgorithmException e) { + LOG.error("verify: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider."); + throw new CryptoException(e); + } catch (SignatureException e) { + LOG.error("verify: Caught SignatureException."); + throw new CryptoException(e); + } catch (InvalidKeyException e) { + LOG.error("verify: Caught InvalidKeyException, invalid key type is being used."); + throw new CryptoException(e); + } + } + + /** + * Verify the signed data with SHA-256 and private key against the ybase64 encoded signature. + * @param message the message to sign, as a UTF8 string + * @param key the public key corresponding to the signing key + * @param signature the ybase64 encoded signature for the data + * @return true if the message was indeed signed by the signature. + * @throws CryptoException for any issues with provider/algorithm/signature/key + */ + public static boolean verify(String message, PublicKey key, String signature) throws CryptoException { + return verify(message, key, signature, SHA256); + } + + static String utf8String(byte [] b) { + return new String(b, StandardCharsets.UTF_8); + } + + static byte [] utf8Bytes(String s) { + return s.getBytes(StandardCharsets.UTF_8); + } + + public static byte [] sha256(byte [] data) throws CryptoException { + MessageDigest sha256; + try { + sha256 = MessageDigest.getInstance("SHA-256"); + } catch (NoSuchAlgorithmException e) { + LOG.error("sha256: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider."); + throw new CryptoException(e); + } + return sha256.digest(data); + } + + public static byte [] sha256(String text) throws CryptoException { + return sha256(utf8Bytes(text)); + } + + /** + * ybase64 is url-safe base64 encoding, using Y's unique convention. + * The industry standard urlsafe solution is ("+/=" => "-_."). + * The Y! convention is ("+/=" => "._-"). + * @param data the data to encode + * @return the ybase64-encoded data as a String + */ + public static String ybase64(byte [] data) { + return utf8String(YBase64.encode(data)); + } + + /** + * ybase64 is url-safe base64 encoding, using Y's unique convention. + * The industry standard urlsafe solution is ("+/=" => "-_."). + * The Y! convention is ("+/=" => "._-"). + * @param b64 the ybase64-encoded data + * @return the decoded data + */ + public static byte [] ybase64Decode(String b64) { + return YBase64.decode(utf8Bytes(b64)); + } + + public static String ybase64DecodeString(String b64) { + return utf8String(ybase64Decode(b64)); + } + + public static X509Certificate loadX509Certificate(File certFile) throws CryptoException { + try (FileReader fileReader = new FileReader(certFile)) { + return loadX509Certificate(fileReader); + } catch (FileNotFoundException e) { + LOG.error("loadX509Certificate: Caught FileNotFoundException while attempting to load certificate for file: " + + certFile.getAbsolutePath()); + throw new CryptoException(e); + } catch (IOException e) { + LOG.error("loadX509Certificate: Caught IOException while attempting to load certificate for file: " + + certFile.getAbsolutePath()); + throw new CryptoException(e); + } + } + + public static X509Certificate loadX509Certificate(String pemEncoded) throws CryptoException { + return Crypto.loadX509Certificate(new StringReader(pemEncoded)); + } + + public static X509Certificate loadX509Certificate(Reader reader) throws CryptoException { + try (PEMParser pemParser = new PEMParser(reader)) { + Object pemObj = pemParser.readObject(); + if (pemObj instanceof X509Certificate) { + return (X509Certificate) pemObj; + } else if (pemObj instanceof X509CertificateHolder) { + try { + return new JcaX509CertificateConverter() + .setProvider(BC_PROVIDER) + .getCertificate((X509CertificateHolder) pemObj); + } catch (CertificateException ex) { + LOG.error("loadX509Certificate: Caught CertificateException, unable to parse X509 certficate", ex); + throw new CryptoException(ex); + } + } + } catch (IOException ex) { + LOG.error("loadX509Certificate: Caught IOException, unable to parse X509 certficate", ex); + throw new CryptoException(ex); + } + + return null; + } + + public static PublicKey loadPublicKey(String pemEncoded) throws CryptoException { + return Crypto.loadPublicKey(new StringReader(pemEncoded)); + } + + public static PublicKey loadPublicKey(Reader r) throws CryptoException { + try (org.bouncycastle.openssl.PEMParser pemReader = new org.bouncycastle.openssl.PEMParser(r)) { + PublicKey pubKey = null; + Object pemObj = pemReader.readObject(); + JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter(); + SubjectPublicKeyInfo keyInfo = null; + X9ECParameters ecParam = null; + + if (pemObj instanceof ASN1ObjectIdentifier) { + + // make sure this is EC Parameter we're handling. In which case + // we'll store it and read the next object which should be our + // EC Public Key + + ASN1ObjectIdentifier ecOID = (ASN1ObjectIdentifier) pemObj; + ecParam = ECNamedCurveTable.getByOID(ecOID); + if (ecParam == null) { + throw new PEMException("Unable to find EC Parameter for the given curve oid: " + + ((ASN1ObjectIdentifier) pemObj).getId()); + } + + pemObj = pemReader.readObject(); + } else if (pemObj instanceof X9ECParameters) { + ecParam = (X9ECParameters) pemObj; + pemObj = pemReader.readObject(); + } + + if (pemObj instanceof org.bouncycastle.cert.X509CertificateHolder) { + keyInfo = ((org.bouncycastle.cert.X509CertificateHolder) pemObj).getSubjectPublicKeyInfo(); + } else { + keyInfo = (SubjectPublicKeyInfo) pemObj; + } + pubKey = pemConverter.getPublicKey(keyInfo); + + if (ecParam != null && ECDSA.equals(pubKey.getAlgorithm())) { + ECParameterSpec ecSpec = new ECParameterSpec(ecParam.getCurve(), ecParam.getG(), + ecParam.getN(), ecParam.getH(), ecParam.getSeed()); + KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, BC_PROVIDER); + ECPublicKeySpec keySpec = new ECPublicKeySpec(((BCECPublicKey) pubKey).getQ(), ecSpec); + pubKey = (PublicKey) keyFactory.generatePublic(keySpec); + } + return pubKey; + } catch (PEMException e) { + throw new CryptoException(e); + } catch (NoSuchProviderException e) { + LOG.error("loadPublicKey: Caught NoSuchProviderException, check to make sure the provider is loaded correctly."); + throw new CryptoException(e); + } catch (NoSuchAlgorithmException e) { + LOG.error("loadPublicKey: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider."); + throw new CryptoException(e); + } catch (InvalidKeySpecException e) { + LOG.error("loadPublicKey: Caught InvalidKeySpecException, invalid key spec is being used."); + throw new CryptoException("InvalidKeySpecException"); + } catch (IOException e) { + throw new CryptoException(e); + } + } + + public static PublicKey loadPublicKey(File f) throws CryptoException { + try (FileReader fileReader = new FileReader(f)) { + return loadPublicKey(fileReader); + } catch (FileNotFoundException e) { + LOG.error("loadPublicKey: Caught FileNotFoundException while attempting to load public key for file: " + + f.getAbsolutePath()); + throw new CryptoException(e); + } catch (IOException e) { + LOG.error("loadPublicKey: Caught IOException while attempting to load public key for file: " + + f.getAbsolutePath()); + throw new CryptoException(e); + } + } + + public static PrivateKey loadPrivateKey(String pemEncoded) throws CryptoException { + return Crypto.loadPrivateKey(new StringReader(pemEncoded), null); + } + + public static PrivateKey loadPrivateKey(Reader reader) throws CryptoException { + return Crypto.loadPrivateKey(reader, null); + } + + public static PrivateKey loadPrivateKey(File file) throws CryptoException { + return Crypto.loadPrivateKey(file, null); + } + + public static PrivateKey loadPrivateKey(File file, String pwd) throws CryptoException { + try (java.io.FileReader fileReader = new java.io.FileReader(file)) { + return loadPrivateKey(fileReader, pwd); + } catch (FileNotFoundException e) { + LOG.error("loadPrivateKey: Caught FileNotFoundException while attempting to load private key for file: " + + file.getAbsolutePath()); + throw new CryptoException(e); + } catch (IOException e) { + LOG.error("loadPrivateKey: Caught IOException while attempting to load private key for file: " + + file.getAbsolutePath()); + throw new CryptoException(e); + } + } + + public static PrivateKey loadPrivateKey(String pemEncoded, String pwd) throws CryptoException { + return Crypto.loadPrivateKey(new StringReader(pemEncoded), pwd); + } + + public static PrivateKey loadPrivateKey(Reader reader, String pwd) throws CryptoException { + + try (PEMParser pemReader = new PEMParser(reader)) { + PrivateKey privKey = null; + X9ECParameters ecParam = null; + + Object pemObj = pemReader.readObject(); + + if (pemObj instanceof ASN1ObjectIdentifier) { + + // make sure this is EC Parameter we're handling. In which case + // we'll store it and read the next object which should be our + // EC Private Key + + ASN1ObjectIdentifier ecOID = (ASN1ObjectIdentifier) pemObj; + ecParam = ECNamedCurveTable.getByOID(ecOID); + if (ecParam == null) { + throw new PEMException("Unable to find EC Parameter for the given curve oid: " + + ((ASN1ObjectIdentifier) pemObj).getId()); + } + + pemObj = pemReader.readObject(); + + } else if (pemObj instanceof X9ECParameters) { + + ecParam = (X9ECParameters) pemObj; + pemObj = pemReader.readObject(); + } + + if (pemObj instanceof PEMKeyPair) { + + PrivateKeyInfo pKeyInfo = ((PEMKeyPair) pemObj).getPrivateKeyInfo(); + JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter(); + privKey = pemConverter.getPrivateKey(pKeyInfo); + + } else if (pemObj instanceof PKCS8EncryptedPrivateKeyInfo) { + + PKCS8EncryptedPrivateKeyInfo pKeyInfo = (PKCS8EncryptedPrivateKeyInfo) pemObj; + if (pwd == null) { + throw new CryptoException("No password specified to decrypt encrypted private key"); + } + + // Decrypt the private key with the specified password + + InputDecryptorProvider pkcs8Prov = new JceOpenSSLPKCS8DecryptorProviderBuilder() + .setProvider(BC_PROVIDER).build(pwd.toCharArray()); + + PrivateKeyInfo privateKeyInfo = pKeyInfo.decryptPrivateKeyInfo(pkcs8Prov); + JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter(); + privKey = pemConverter.getPrivateKey(privateKeyInfo); + } + + // if our private key is EC type and we have parameters specified + // then we need to set it accordingly + + if (ecParam != null && ECDSA.equals(privKey.getAlgorithm())) { + ECParameterSpec ecSpec = new ECParameterSpec(ecParam.getCurve(), ecParam.getG(), + ecParam.getN(), ecParam.getH(), ecParam.getSeed()); + KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, BC_PROVIDER); + ECPrivateKeySpec keySpec = new ECPrivateKeySpec(((BCECPrivateKey) privKey).getS(), ecSpec); + privKey = (PrivateKey) keyFactory.generatePrivate(keySpec); + } + + return privKey; + + } catch (PEMException e) { + LOG.error("loadPrivateKey: Caught PEMException, problem with format of key detected."); + throw new CryptoException(e); + } catch (NoSuchProviderException e) { + LOG.error("loadPrivateKey: Caught NoSuchProviderException, check to make sure the provider is loaded correctly."); + throw new CryptoException(e); + } catch (NoSuchAlgorithmException e) { + LOG.error("loadPrivateKey: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider."); + throw new CryptoException(e); + } catch (InvalidKeySpecException e) { + LOG.error("loadPrivateKey: Caught InvalidKeySpecException, invalid key spec is being used."); + throw new CryptoException(e); + } catch (OperatorCreationException e) { + LOG.error("loadPrivateKey: Caught OperatorCreationException when creating JceOpenSSLPKCS8DecryptorProviderBuilder."); + throw new CryptoException(e); + } catch (PKCSException e) { + LOG.error("loadPrivateKey: Caught PKCSException when decrypting private key."); + throw new CryptoException(e); + } catch (IOException e) { + LOG.error("loadPrivateKey: Caught IOException, while trying to read key."); + throw new CryptoException(e); + } + } + + public static String randomSalt() { + long v = RANDOM.nextLong(); + return Long.toHexString(v); + } + + public static String encodedFile(File f) { + try (FileInputStream in = new FileInputStream(f)) { + byte [] buf = new byte[(int) f.length()]; + in.read(buf); + return ybase64(buf); + } catch (FileNotFoundException e) { + LOG.error("encodedFile: Caught FileNotFoundException while attempting to read encoded file: " + + f.getAbsolutePath()); + throw new RuntimeException(e); + } catch (IOException e) { + LOG.error("encodedFile: Caught IOException while attempting to read encoded file: " + + f.getAbsolutePath()); + throw new RuntimeException(e); + } + } + + public static String encodedFile(FileInputStream is) { + try { + byte [] buf = new byte[4096]; + int readBytes = 0; + String contents = null; + while ((readBytes = is.read(buf)) > 0) { + if (contents == null) { + contents = new String(buf, 0, readBytes - 1); + } else { + contents = contents.concat(new String(buf, 0, readBytes - 1)); + } + } + return ybase64(utf8Bytes(contents)); + } catch (IOException e) { + throw new RuntimeException(e); + } + } + + public static PKCS10CertificationRequest getPKCS10CertRequest(String csr) { + + if (csr == null || csr.isEmpty()) { + LOG.error("getPKCS10CertRequest: CSR is null or empty"); + throw new CryptoException("CSR is null or empty"); + } + + try { + Reader csrReader = new StringReader(csr); + try (PEMParser pemParser = new PEMParser(csrReader)) { + Object pemObj = pemParser.readObject(); + if (pemObj instanceof PKCS10CertificationRequest) { + return (PKCS10CertificationRequest) pemObj; + } + } + } catch (IOException ex) { + LOG.error("getPKCS10CertRequest: unable to parse csr", ex); + throw new CryptoException(ex); + } + + return null; + } + + public static X509Certificate generateX509Certificate(PKCS10CertificationRequest certReq, PrivateKey caPrivateKey, + X509Certificate caCertificate, int validityTimeout, boolean basicConstraints) { + + // set validity for the given number of minutes from now + + Date notBefore = new Date(); + Calendar cal = Calendar.getInstance(); + cal.setTime(notBefore); + cal.add(Calendar.MINUTE, validityTimeout); + Date notAfter = cal.getTime(); + + // Generate self-signed certificate + + X509Certificate cert = null; + try { + JcaPKCS10CertificationRequest jcaPKCS10CertificationRequest = new JcaPKCS10CertificationRequest(certReq); + PublicKey publicKey = jcaPKCS10CertificationRequest.getPublicKey(); + + X509v3CertificateBuilder caBuilder = new JcaX509v3CertificateBuilder( + caCertificate, + BigInteger.valueOf(System.currentTimeMillis()), + notBefore, + notAfter, + certReq.getSubject(), + publicKey) + .addExtension(Extension.basicConstraints, false, + new BasicConstraints(basicConstraints)) + .addExtension(Extension.keyUsage, true, + new X509KeyUsage(X509KeyUsage.digitalSignature | X509KeyUsage.keyEncipherment)) + .addExtension(Extension.extendedKeyUsage, true, + new ExtendedKeyUsage(new KeyPurposeId[]{ KeyPurposeId.id_kp_clientAuth, KeyPurposeId.id_kp_serverAuth })); + + // see if we have the dns/rfc822/ip address extensions specified in the csr + + ArrayList altNames = new ArrayList<>(); + Attribute[] certAttributes = jcaPKCS10CertificationRequest.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest); + if (certAttributes != null && certAttributes.length > 0) { + for (Attribute attribute : certAttributes) { + Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0)); + GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName); + if (gns == null) { + continue; + } + GeneralName[] names = gns.getNames(); + for (int i = 0; i < names.length; i++) { + switch (names[i].getTagNo()) { + case GeneralName.dNSName: + case GeneralName.iPAddress: + case GeneralName.rfc822Name: + altNames.add(names[i]); + break; + } + } + } + if (!altNames.isEmpty()) { + caBuilder.addExtension(Extension.subjectAlternativeName, false, + new GeneralNames(altNames.toArray(new GeneralName[altNames.size()]))); + } + } + + String signatureAlgorithm = getSignatureAlgorithm(caPrivateKey.getAlgorithm(), SHA256); + ContentSigner caSigner = new JcaContentSignerBuilder(signatureAlgorithm) + .setProvider(BC_PROVIDER).build(caPrivateKey); + + JcaX509CertificateConverter converter = new JcaX509CertificateConverter().setProvider(BC_PROVIDER); + cert = converter.getCertificate(caBuilder.build(caSigner)); + + } catch (CertificateException ex) { + LOG.error("generateX509Certificate: Caught CertificateException when generating certificate: " + + ex.getMessage()); + throw new CryptoException(ex); + } catch (OperatorCreationException ex) { + LOG.error("generateX509Certificate: Caught OperatorCreationException when creating JcaContentSignerBuilder: " + + ex.getMessage()); + throw new CryptoException(ex); + } catch (InvalidKeyException ex) { + LOG.error("generateX509Certificate: Caught InvalidKeySpecException, invalid key spec is being used: " + + ex.getMessage()); + throw new CryptoException(ex); + } catch (NoSuchAlgorithmException ex) { + LOG.error("generateX509Certificate: Caught NoSuchAlgorithmException, check to make sure the algorithm is supported by the provider: " + + ex.getMessage()); + throw new CryptoException(ex); + } catch (Exception ex) { + LOG.error("generateX509Certificate: unable to generate X509 Certificate: " + ex.getMessage()); + throw new CryptoException("Unable to generate X509 Certificate"); + } + + return cert; + } + + public static boolean validatePKCS7Signature(String data, String signature, PublicKey publicKey) { + + try { + SignerInformationStore signerStore = null; + try (InputStream sigIs = new ByteArrayInputStream(Base64.decode(signature.getBytes(StandardCharsets.UTF_8)))) { + CMSProcessable content = new CMSProcessableByteArray(data.getBytes(StandardCharsets.UTF_8)); + CMSSignedData signedData = new CMSSignedData(content, sigIs); + signerStore = signedData.getSignerInfos(); + } + + Collection signers = signerStore.getSigners(); + Iterator it = signers.iterator(); + + SignerInformationVerifier infoVerifier = new JcaSimpleSignerInfoVerifierBuilder() + .setProvider(BC_PROVIDER).build(publicKey); + while (it.hasNext()) { + SignerInformation signerInfo = (SignerInformation) it.next(); + if (signerInfo.verify(infoVerifier)) { + return true; + } + } + } catch (CMSException ex) { + LOG.error("validatePKCS7Signature: unable to initialize CMSSignedData object: " + ex.getMessage()); + throw new CryptoException(ex); + } catch (OperatorCreationException ex) { + LOG.error("validatePKCS7Signature: Caught OperatorCreationException when creating JcaSimpleSignerInfoVerifierBuilder: " + + ex.getMessage()); + throw new CryptoException(ex); + } catch (IOException ex) { + LOG.error("validatePKCS7Signature: Caught IOException when closing InputStream: " + ex.getMessage()); + throw new CryptoException(ex); + } catch (Exception ex) { + LOG.error("validatePKCS7Signature: unable to validate signature: " + ex.getMessage()); + throw new CryptoException(ex.getMessage()); + } + + return false; + } + + public static String x509CertificateToPem(X509Certificate cert) { + StringWriter writer = new StringWriter(); + try { + try (JcaPEMWriter pemWriter = new JcaPEMWriter(writer)) { + pemWriter.writeObject(cert); + pemWriter.flush(); + pemWriter.close(); + } + } catch (IOException ex) { + LOG.error("x509CertificateToPem: unable to convert X509 cert to PEM: " + ex.getMessage()); + return null; + } + + return writer.toString(); + } + + public static void main(String [] args) throws CryptoException { + if (args.length >= 2) { + String op = args[0]; + if ("sign".equals(op)) { + if (args.length == 3) { + String sig = Crypto.sign(args[1], Crypto.loadPrivateKey(new File(args[2]))); + System.out.println(sig); + System.exit(0); + } + } else if ("verify".equals(op)) { + if (args.length == 4) { + if (Crypto.verify(args[1], Crypto.loadPublicKey(new File(args[2])), args[3])) { + System.out.println("Verified."); + } else { + System.out.println("NOT VERIFIED"); + } + System.exit(0); + } + } else if ("public".equals(op)) { + if (args.length == 2) { + String pub = encodedFile(new File(args[1])); + Crypto.loadPublicKey(ybase64DecodeString(pub)); //throws if something is wrong + System.out.println(pub); + System.exit(0); + } + } else if ("private".equals(op)) { + if (args.length == 2) { + try { + String priv = encodedFile(new File(args[1])); + Crypto.loadPrivateKey(ybase64DecodeString(priv)); //throws if something is wrong + System.out.println(priv); + System.exit(0); + } catch (Exception e) { + System.out.println("*** " + e.getMessage()); + System.exit(1); + } + } + } + } + System.out.println("usage: r Crypto private privateKeyFile"); + System.out.println("usage: r Crypto public publicKeyFile"); + System.out.println("usage: r Crypto sign msg privateKeyFile"); + System.out.println("usage: r Crypto verify msg privateKeyFile signature"); + System.exit(1); + } + +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/CryptoException.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/CryptoException.java new file mode 100644 index 00000000000..19ed051aa0e --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/CryptoException.java @@ -0,0 +1,86 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.util; + +import java.io.FileNotFoundException; +import java.io.IOException; +import java.security.InvalidKeyException; +import java.security.NoSuchAlgorithmException; +import java.security.NoSuchProviderException; +import java.security.SignatureException; +import java.security.cert.CertificateException; +import java.security.spec.InvalidKeySpecException; + +import org.bouncycastle.cms.CMSException; +import org.bouncycastle.operator.OperatorCreationException; +import org.bouncycastle.pkcs.PKCSException; + +public class CryptoException extends RuntimeException { + + private static final long serialVersionUID = -4194687652165603898L; + + public CryptoException() { + super(); + } + + public CryptoException(String message) { + super(message); + } + + public CryptoException(NoSuchAlgorithmException e) { + super(e); + } + + public CryptoException(InvalidKeyException e) { + super(e); + } + + public CryptoException(NoSuchProviderException e) { + super(e); + } + + public CryptoException(SignatureException e) { + super(e); + } + + public CryptoException(FileNotFoundException e) { + super(e); + } + + public CryptoException(IOException e) { + super(e); + } + + public CryptoException(CertificateException e) { + super(e); + } + + public CryptoException(InvalidKeySpecException e) { + super(e); + } + + public CryptoException(OperatorCreationException e) { + super(e); + } + + public CryptoException(PKCSException e) { + super(e); + } + + public CryptoException(CMSException e) { + super(e); + } +} diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/Validate.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/Validate.java new file mode 100644 index 00000000000..d209c7d0921 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/Validate.java @@ -0,0 +1,50 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.util; + +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +/** + * A utility class to validate various types. + */ +public class Validate { + + private static final String PRINCIPAL_REGEX = "((([a-zA-Z_][a-zA-Z0-9_-]*\\.)*[a-zA-Z_][a-zA-Z0-9_-]*):)?(([a-zA-Z_][a-zA-Z0-9_-]*\\.)*[a-zA-Z_][a-zA-Z0-9_-]*)"; + private static final String DOMAIN_REGEX = "([a-zA-Z_][a-zA-Z0-9_-]*\\.)*[a-zA-Z_][a-zA-Z0-9_-]*"; + + private static Pattern principalPattern = Pattern.compile(PRINCIPAL_REGEX); + private static Pattern domainPattern = Pattern.compile(DOMAIN_REGEX); + + /** + * @param name a principal name to validate + * @return true if the principal name is valid, false otherwise. + */ + public static boolean principalName(String name) { + Matcher matcher = principalPattern.matcher(name); + return matcher.matches(); + } + + /** + * @param name a domain name to validate + * @return true if the domain name is valid, false otherwise. + */ + public static boolean domainName(String name) { + Matcher matcher = domainPattern.matcher(name); + return matcher.matches(); + } +} + diff --git a/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/YBase64.java b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/YBase64.java new file mode 100644 index 00000000000..531442045a9 --- /dev/null +++ b/libs/java/auth_core/src/main/java/com/yahoo/athenz/auth/util/YBase64.java @@ -0,0 +1,305 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.util; + +import java.util.Arrays; + +/** + * Y64 Encode/Decode support: + * URL friendly base64 encoding, it replaces + and / with . and _ and uses - for padding. + * Original implementation is from Java Platforms + */ + +public class YBase64 { + + static final byte[] Y64_ARRAY = { + 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', + 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', + 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '0', '1', '2', '3', + '4', '5', '6', '7', '8', '9', '.', '_' + }; + + public static final byte[] Y64_DECODE_ARRAY = { + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xff, 62, (byte) 0xee, 52, + 53, 54, 55, 56, 57, 58, 59, 60, 61, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, + 17, 18, 19, 20, 21, 22, 23, 24, 25, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, 63, + (byte) 0xee, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, + 47, 48, 49, 50, 51, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee, + (byte) 0xee, (byte) 0xee, (byte) 0xee, (byte) 0xee + }; + + private static final byte decodeByte(int index) { + // java has signed bytes, and the good values are up to 122, so any + // negative indexes are signed byte conversions of >128 and invalid + if (index < 0 || index >= Y64_DECODE_ARRAY.length) { + return (byte) 0xee; + } + return Y64_DECODE_ARRAY[index]; + } + + private static final byte encode1(byte ba) { + // enc1: Y64_array[(a >> 2)]; + // have to make value into an int so we can do shifts. + // but we need to mask off the sign bit. + final int a = ((int) ba) & 0x00ff; + final int i = (a >> 2); + if (i < 0 || i >= Y64_DECODE_ARRAY.length) { + return (byte) 0xee; + } + return Y64_ARRAY[i]; + } + + private static final byte encode2(byte ba, byte bb) { + // enc2: Y64_array[((a << 4) & 0x30) + (b >> 4)]; + // have to make value into an int so we can do shifts. + // but we need to mask off the sign bit. + final int a = ((int) ba) & 0x00ff; + final int b = ((int) bb) & 0x00ff; + final int i = ((a << 4) & 0x30) + (b >> 4); + if (i < 0 || i >= Y64_DECODE_ARRAY.length) { + return (byte) 0xee; + } + + return Y64_ARRAY[i]; + } + + private static final byte encode3(byte bb, byte bc) { + // enc3: Y64_array[((b << 2) & 0x3C) + (c >> 6)]; + // have to make value into an int so we can do shifts. + // but we need to mask off the sign bit. + final int b = ((int) bb) & 0x00ff; + final int c = ((int) bc) & 0x00ff; + final int i = ((b << 2) & 0x3C) + (c >> 6); + if (i < 0 || i >= Y64_DECODE_ARRAY.length) { + return (byte) 0xee; + } + + return Y64_ARRAY[i]; + } + + private static final byte encode4(byte bc) { + // enc4: Y64_array[c & 0x3F]; + // have to make value into an int so we can do shifts. + // but we need to mask off the sign bit. + final int i = ((int) bc) & 0x003f; + if (i < 0 || i >= Y64_DECODE_ARRAY.length) { + return (byte) 0xee; + } + + return Y64_ARRAY[i]; + } + + private static final byte decode1(byte a, byte b) { + return (byte) ((a << 2) + (b >> 4)); + } + + private static final byte decode2(byte b, byte c) { + return (byte) ((b << 4) + (c >> 2)); + } + + private static final byte decode3(byte c, byte d) { + return (byte) ((c << 6) + d); + } + + /** + * Decode the given byte array and return the result + * @param inBytes byte array to be decoded + * @return decoded byte array + * @throws CryptoException in case of invalid padding or characters + */ + public static byte[] decode(byte[] inBytes) { + + if (null == inBytes) { + throw new NullPointerException("Null input buffer"); + } + + /* Sanity check, should always be padded at the end. */ + int len = inBytes.length; + if (len % 4 != 0 && inBytes[len - 1] == '\0') { + len -= 1; + } + + if (len % 4 != 0) { + throw new CryptoException("String not padded ie, input string not modulo 4 len = " + len + + " len%4= " + len % 4); + } + + byte[] out = new byte[(int) y64decodeLen(len)]; + + int i = 0; + int j = 0; + int tlen = 0; + while (i < len) { + tlen = (len - i); + if (tlen > 4) { + tlen = 4; + } + + /* Figure out how long "tlen" really is */ + if (inBytes[i + 3] == '-') { + tlen--; + } + if (inBytes[i + 2] == '-') { + tlen--; + } + + if (inBytes[i + 1] == '-') { /* This case should NEVER happen. */ + throw new CryptoException("Too Many pad characters ( this should never happen )"); + } + + /* decode */ + byte a = decodeByte(inBytes[i++]); + byte b = decodeByte(inBytes[i++]); + byte c = decodeByte(inBytes[i++]); + byte d = decodeByte(inBytes[i++]); + + /* validate */ + if (a == (byte) 0xee || b == (byte) 0xee || c == (byte) 0xee || d == (byte) 0xee) { + throw new CryptoException("Unrecognized characters in y64-encoded input starting at: " + (i - 4)); + } + + if (tlen == 4) { + // dec1: ((a << 2) + (b >> 4)); + out[j++] = decode1(a, b); + // dec2: ((b << 4) + (c >> 2)); + out[j++] = decode2(b, c); + // dec3: ((c << 6) + d); + out[j++] = decode3(c, d); + } else if (tlen == 3) { + if ((c & (byte) 0x03) != 0) { + throw new CryptoException("Unknown decode error c & 0x03 failed, c-pos: " + (i - 2)); + } + // dec1: ((a << 2) + (b >> 4)); + out[j++] = decode1(a, b); + // dec2: ((b << 4) + (c >> 2)); + out[j++] = decode2(b, c); + } else { /* tlen == 2 */ + if ((b & (byte) 0x0F) != 0) { + throw new CryptoException("Invalid decode. b & 0x0f failed, b-pos: " + (i - 3)); + } + // dec1: ((a << 2) + (b >> 4)); + out[j++] = decode1(a, b); + } + } + + return Arrays.copyOf(out, j); + } + + /** + * Encode given byte array into Y64 format. + * @param inBytes data to be encoded + * @return encoded Y64 byte array + * @throws NullPointerException if the input buffer is null + */ + public static byte[] encode(byte[] inBytes) { + + if (null == inBytes) { + throw new NullPointerException("input buffer was null"); + } + + /* Sanity check, should always be padded at the end. */ + if (inBytes.length < 1) { + return new byte[] {}; + } + + int len = inBytes.length; + int encodeLen = y64encodeLen(len); + byte[] out = new byte[encodeLen]; + int j = 0; + int tlen = 0; + + for (int i = 0; i < len; i += 3) { + + tlen = (len - i); + if (tlen > 3) { + tlen = 3; + } + + byte a; + byte b; + byte c; + + if (tlen == 1) { + a = inBytes[i]; + b = 0; + c = 0; + // enc1: Y64_array[(a >> 2)]; + out[j++] = encode1(a); + // enc2: Y64_array[((a << 4) & 0x30) + (b >> 4)]; + out[j++] = encode2(a, b); + out[j++] = '-'; + out[j++] = '-'; + } else if (tlen == 2) { + a = inBytes[i]; + b = inBytes[i + 1]; + c = 0; + // enc1: Y64_array[(a >> 2)]; + out[j++] = encode1(a); + // enc2: Y64_array[((a << 4) & 0x30) + (b >> 4)]; + out[j++] = encode2(a, b); + // enc3: Y64_array[((b << 2) & 0x3C) + (c >> 6)]; + out[j++] = encode3(b, c); + out[j++] = '-'; + } else { + a = inBytes[i]; + b = inBytes[i + 1]; + c = inBytes[i + 2]; + // enc1: Y64_array[(a >> 2)]; + out[j++] = encode1(a); + // enc2: Y64_array[((a << 4) & 0x30) + (b >> 4)]; + out[j++] = encode2(a, b); + // enc3: Y64_array[((b << 2) & 0x3C) + (c >> 6)]; + out[j++] = encode3(b, c); + // enc4: Y64_array[c & 0x3F]; + out[j++] = encode4(c); + } + } + + return Arrays.copyOf(out, j); + } + + static int y64decodeLen(int len) { + // this is not -1 because strings have no null terminator. + return (((len + 3) / 4) * 3) + 1; + } + + static int y64encodeLen(int len) { + // Could check for response length overflow - generated response + // is greater than max size_t can represent. + return ((len + 2) / 3 * 4) + 1; + } +} + diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/CertificateAuthorityTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/CertificateAuthorityTest.java new file mode 100644 index 00000000000..3bee485601d --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/CertificateAuthorityTest.java @@ -0,0 +1,109 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import static org.testng.Assert.*; + +import java.io.FileInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.security.cert.CertificateFactory; +import java.security.cert.X509Certificate; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.Authority.CredSource; +import com.yahoo.athenz.auth.impl.CertificateAuthority; + +public class CertificateAuthorityTest { + + @Test + public void testGetDomain() { + CertificateAuthority authority = new CertificateAuthority(); + authority.initialize(); + assertNull(authority.getDomain()); + } + + @Test + public void testGetHeader() { + CertificateAuthority authority = new CertificateAuthority(); + authority.initialize(); + assertNull(authority.getHeader()); + } + + @Test + public void testGetCredSource() { + CertificateAuthority authority = new CertificateAuthority(); + authority.initialize(); + assertEquals(CredSource.CERTIFICATE, authority.getCredSource()); + } + + @Test + public void testHeaderAuthenticate() { + + CertificateAuthority authority = new CertificateAuthority(); + authority.initialize(); + assertNull(authority.authenticate("v=U1;d=domain;n=service;s=sig", null, "GET", null)); + } + + @Test + public void testExtractX509CertCN() throws Exception, IOException { + CertificateAuthority authority = new CertificateAuthority(); + authority.initialize(); + + try (InputStream inStream = new FileInputStream("src/test/resources/valid_cn_x509.cert")) { + CertificateFactory cf = CertificateFactory.getInstance("X.509"); + X509Certificate cert = (X509Certificate) cf.generateCertificate(inStream); + + String cn = authority.extractX509CertCN(cert); + assertEquals("athenz.syncer", cn); + } + } + + @Test + public void testAuthenticateCertificate() throws Exception, IOException { + CertificateAuthority authority = new CertificateAuthority(); + authority.initialize(); + + try (InputStream inStream = new FileInputStream("src/test/resources/valid_cn_x509.cert")) { + CertificateFactory cf = CertificateFactory.getInstance("X.509"); + X509Certificate cert = (X509Certificate) cf.generateCertificate(inStream); + + X509Certificate[] certs = new X509Certificate[1]; + certs[0] = cert; + Principal principal = authority.authenticate(certs, null); + assertNotNull(principal); + assertEquals("athenz", principal.getDomain()); + assertEquals("syncer", principal.getName()); + } + } + + @Test + public void testAuthenciateInvalidArray() { + + CertificateAuthority authority = new CertificateAuthority(); + authority.initialize(); + StringBuilder errMsg = new StringBuilder(512); + Principal principal = authority.authenticate(null, errMsg); + assertNull(principal); + + X509Certificate[] certs = new X509Certificate[1]; + certs[0] = null; + principal = authority.authenticate(certs, errMsg); + assertNull(principal); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/KerberosAuthorityTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/KerberosAuthorityTest.java new file mode 100644 index 00000000000..d13298bcbf5 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/KerberosAuthorityTest.java @@ -0,0 +1,382 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import javax.security.auth.login.AppConfigurationEntry; +import javax.security.auth.kerberos.KerberosPrincipal; +import javax.security.auth.kerberos.KerberosTicket; + +import org.testng.annotations.BeforeTest; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.KerberosAuthority; +import com.yahoo.athenz.auth.token.KerberosToken; + +import static org.testng.Assert.*; +import java.lang.reflect.Field; + +public class KerberosAuthorityTest { + + final static String KRB_LOGIN_CB_CLASS = "com.yahoo.athenz.auth.impl.TestLoginCallbackHandler"; + + @BeforeTest + private void beforeTest() { + + } + + @Test(groups="kerberos-tests") + public void testLoginConfig() { + + String keyTabConfFile = null; + String servicePrincipal = null; + KerberosAuthority.LoginConfig loginConfig = new KerberosAuthority.LoginConfig(keyTabConfFile, servicePrincipal); + assertEquals(loginConfig.isDebugEnabled(), false); + AppConfigurationEntry[] conf = loginConfig.getAppConfigurationEntry(null); + AppConfigurationEntry entry = conf[0]; + java.util.Map options = entry.getOptions(); + assertNull(options.get("principal")); + assertEquals(options.get("useKeyTab"), "false"); + assertEquals(options.get("useTicketCache"), "true"); + assertEquals(options.get("renewTGT"), "true"); + assertNull(options.get("debug")); + assertNull(options.get("ticketCache")); + + // set properties and remake the login config + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_RENEW_TGT, "false"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_USE_TKT_CACHE, "false"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_TKT_CACHE_NAME, "/tmp/cache"); + System.setProperty(KerberosAuthority.KRB_PROP_DEBUG, "TRUE"); + keyTabConfFile = "my.keytab"; + servicePrincipal = "juke"; + loginConfig = new KerberosAuthority.LoginConfig(keyTabConfFile, servicePrincipal); + assertEquals(loginConfig.isDebugEnabled(), true); + conf = loginConfig.getAppConfigurationEntry(null); + entry = conf[0]; + options = entry.getOptions(); + assertEquals(options.get("principal"), "juke"); + assertEquals(options.get("useKeyTab"), "true"); + assertEquals(options.get("useTicketCache"), "false"); + assertEquals(options.get("renewTGT"), "false"); + assertEquals(options.get("debug"), "true"); + assertNull(options.get("ticketCache")); + assertEquals(options.get("keyTab"), "my.keytab"); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_RENEW_TGT); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_USE_TKT_CACHE); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_TKT_CACHE_NAME); + System.clearProperty(KerberosAuthority.KRB_PROP_DEBUG); + } + + @Test(groups="kerberos-tests") + public void testKerberosAuthorityBadCreds() { + + KerberosAuthority authority = new KerberosAuthority("myserver", "src/test/resources/example.keytab", null); + authority.initialize(); + + assertNull(authority.getDomain()); + assertEquals(authority.getHeader(), KerberosAuthority.KRB_AUTH_HEADER); + + KerberosToken token = null; + String creds = "invalid_creds"; + String remoteAddr = "some.address"; + try { + token = new KerberosToken(creds, remoteAddr); + fail("new KerberosToken with bad creds"); + } catch (Exception exc) { + String msg = exc.getMessage(); + assertTrue(msg.contains("creds do not contain required Negotiate component")); + } + + creds = KerberosToken.KRB_AUTH_VAL_FLD + " YIGeBgYrBgEFBQKggZMwgZCgGjAYBgorBgEEAYI3AgIeBgorBgEEAYI3AgIKonIEcE5FR09FWFRTAAfakecreds"; + token = new KerberosToken(creds, remoteAddr); + + StringBuilder errMsg = new StringBuilder(); + Principal principal = authority.authenticate(token.getSignedToken(), null, "GET", errMsg); + assertNull(principal); + } + + @Test(groups="kerberos-tests") + public void testKerberosAuthorityMockPrivExcAction() throws Exception { + + System.setProperty(KerberosToken.KRB_PROP_TOKEN_PRIV_ACTION, "com.yahoo.athenz.auth.impl.MockPrivExcAction"); + System.setProperty(KerberosToken.KRB_PROP_TOKEN_PRIV_ACTION + "_TEST_REALM", "USER_REALM"); + String token = "YIGeBgYrBgEFBQKggZMwgZCgGjAYBgorBgEEAYI3AgIeBgorBgEEAYI3AgIKonIEcE5FR09FWFRTAAfakecreds"; + System.setProperty(KerberosAuthority.KRB_PROP_SVCPRPL, "myserver"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS, KRB_LOGIN_CB_CLASS); + System.setProperty(KerberosAuthority.KRB_PROP_KEYTAB, "src/test/resources/example.keytab"); + + KerberosAuthority authority = new KerberosAuthority(); + authority.initialize(); + + String creds = KerberosToken.KRB_AUTH_VAL_FLD + " " + token; + String remoteAddr = "localhost"; + KerberosToken ktoken = new KerberosToken(creds, remoteAddr); + boolean ret = ktoken.validate(null, null); + assertEquals(ret, true); + + StringBuilder errMsg = new StringBuilder(); + Principal principal = authority.authenticate(ktoken.getSignedToken(), null, "GET", errMsg); + assertNotNull(principal); + assertNotNull(principal.getAuthority()); + assertEquals(principal.getCredentials(), ktoken.getSignedToken()); + assertEquals(principal.getDomain(), ktoken.getDomain()); + assertEquals(principal.getDomain(), KerberosToken.USER_DOMAIN); + assertEquals(principal.getName(), ktoken.getUserName()); + assertTrue(principal.getName().indexOf('@') == -1); + + principal = authority.authenticate(ktoken.getSignedToken(), null, "GET", null); + assertNotNull(principal); + System.out.println("test mock priv action: got principal=" + principal ); + + // test with ygrid realm + System.setProperty(KerberosToken.KRB_PROP_TOKEN_PRIV_ACTION + "_TEST_REALM", KerberosToken.KRB_USER_REALM); + ktoken = new KerberosToken(creds, remoteAddr); + ret = ktoken.validate(null, null); + assertEquals(ret, true); + + errMsg = new StringBuilder(); + principal = authority.authenticate(ktoken.getSignedToken(), null, "GET", errMsg); + assertNotNull(principal); + assertNotNull(principal.getAuthority()); + assertEquals(principal.getCredentials(), ktoken.getSignedToken()); + assertEquals(principal.getDomain(), ktoken.getDomain()); + assertEquals(principal.getDomain(), KerberosToken.KRB_USER_DOMAIN); + assertEquals(principal.getName(), ktoken.getUserName()); + assertTrue(principal.getName().indexOf('@') == -1); + + principal = authority.authenticate(ktoken.getSignedToken(), null, "GET", null); + assertNotNull(principal); + System.out.println("test mock priv action: got principal=" + principal ); + + // test with invalid realm + System.setProperty(KerberosToken.KRB_PROP_TOKEN_PRIV_ACTION + "_TEST_REALM", "REALM.SOMECOMPANY.COM"); + ktoken = new KerberosToken(creds, remoteAddr); + ret = ktoken.validate(null, null); + assertEquals(ret, false); + + errMsg = new StringBuilder(); + principal = authority.authenticate(ktoken.getSignedToken(), null, "GET", errMsg); + assertNull(principal); + + principal = authority.authenticate(ktoken.getSignedToken(), null, "GET", null); + assertNull(principal); + System.out.println("test mock priv action: got principal=" + principal ); + + principal = authority.authenticate(null, null, "GET", null); + assertNull(principal); + + System.clearProperty(KerberosToken.KRB_PROP_TOKEN_PRIV_ACTION); + System.clearProperty(KerberosAuthority.KRB_PROP_SVCPRPL); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS); + System.clearProperty(KerberosAuthority.KRB_PROP_KEYTAB); + } + + @Test(groups="kerberos-tests") + public void testKerberosAuthorityJaas() { + + System.setProperty("java.security.auth.login.config", "src/test/resources/jaas.conf"); + System.setProperty("java.security.krb5.kdc", "localhost"); + System.setProperty( "sun.security.krb5.debug", "true"); + System.setProperty( "javax.security.auth.useSubjectCredsOnly", "true"); + System.setProperty(KerberosAuthority.KRB_PROP_JAASCFG, "Server"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS, KRB_LOGIN_CB_CLASS); + + KerberosAuthority kauth = new KerberosAuthority(); + kauth.initialize(); + Exception initState = kauth.getInitState(); + assertNotNull(initState); + assertTrue(initState instanceof javax.security.auth.login.LoginException); + + System.clearProperty("java.security.auth.login.config"); + System.clearProperty("java.security.krb5.kdc"); + System.clearProperty("sun.security.krb5.debug"); + System.clearProperty("javax.security.auth.useSubjectCredsOnly"); + System.clearProperty(KerberosAuthority.KRB_PROP_JAASCFG); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS); + } + + @Test(groups="kerberos-tests") + public void testKerberosAuthorityKeytab() { + + System.setProperty(KerberosAuthority.KRB_PROP_KEYTAB, "src/test/resources/example.keytab"); + System.setProperty(KerberosAuthority.KRB_PROP_SVCPRPL, "myserver"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS, KRB_LOGIN_CB_CLASS); + System.setProperty( "sun.security.krb5.debug", "true"); + System.setProperty( "java.security.krb5.realm", "EXAMPLE.COM"); + System.setProperty( "java.security.krb5.kdc", "localhost"); + + KerberosAuthority kauth = new KerberosAuthority(); + kauth.initialize(); + Exception initState = kauth.getInitState(); + assertNull(initState); + + System.clearProperty(KerberosAuthority.KRB_PROP_KEYTAB); + System.clearProperty(KerberosAuthority.KRB_PROP_SVCPRPL); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS); + System.clearProperty( "java.security.krb5.realm"); + System.clearProperty( "java.security.krb5.kdc"); + } + + @Test(groups="kerberos-tests") + public void testKerberosAuthorityIsOurPrincipal() { + System.setProperty(KerberosAuthority.KRB_PROP_KEYTAB, "src/test/resources/example.keytab"); + System.setProperty(KerberosAuthority.KRB_PROP_SVCPRPL, "myserver@EXAMPLE.COM"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS, KRB_LOGIN_CB_CLASS); + System.setProperty( "sun.security.krb5.debug", "true"); + + KerberosAuthority kauth = new KerberosAuthority(); + kauth.initialize(); + Exception initState = kauth.getInitState(); + assertNull(initState); + + KerberosPrincipal princ = new KerberosPrincipal("myserver@EXAMPLE.COM"); + String token = "YIIB6wYJKoZIhvcSAQICAQBuggHaMIIB1qADAgEFoQMCAQ6iBwMFAAAAAACjggEGYYIBAjCB/6ADAgEFoQ0bC0VYQU1QTEUuQ09NojAwLqADAgEAoScwJRsHZGF0YWh1YhsTZGF0YWh1Yi5leGFtcGxlLmNvbRsFYnVsbHmjgbYwgbOgAwIBA6KBqwSBqMJGf4H5nrRIdDyNxHp5fwxW6lsiFi+qUjryPvgiOAl/XldfwmKd9wXbQn00VBNhK+oVxmKv0V0J80e4oTdUnc+NlU/BJNCfsLPFTdYntc4A/ffdnsY7/U5HktTaWMfhvWxYocvhqISFTIFUT1+pH5742IWYNTgvFd5vkudibB3ijCanbMYv9CQXEjV+380rnf3gdLD2JGuxmaU78aJjDDKETL6Ck/qz8KSBtjCBs6ADAgEDooGrBIGoMrzLCTUi59wEoWX02+42K5m1MzW6HMNSuvfQeVGJdzPBsiFmZweNfJF6L9LdmLjQR4jSVUhVo3neFZmUN8G532wvZeKbHOtkXTnLRRdif+DoKyI8GOkbHu1CZlevcQZ0sgzyiH0wfQ/0nguE4kH7a2bM7HlV7N6MRGkC4DDkJZDNHxQr27FbZqrqEyw498HXPTtF93JGsKjXB8Z/wDaPs4PpdfoThTol"; + byte[] asn1Encoding = token.getBytes(); + byte[] sessionKey = "xyz".getBytes(); + long endMillis = System.currentTimeMillis() + 2000; + java.util.Date endDate = new java.util.Date(); + endDate.setTime(endMillis); + KerberosTicket ticket = new KerberosTicket(asn1Encoding, princ, princ, sessionKey, 0, null, null, null, endDate, null, null); + + boolean ours = kauth.isTargetPrincipal(ticket, "myserver@EXAMPLE.COM"); + assertTrue(ours); + + KerberosPrincipal clientPrinc = new KerberosPrincipal("myclient@EXAMPLE.COM"); + ticket = new KerberosTicket(asn1Encoding, princ, clientPrinc, sessionKey, 0, null, null, null, endDate, null, null); + + ours = kauth.isTargetPrincipal(ticket, "myservice@EXAPLE.COM"); + assertFalse(ours); + + System.clearProperty(KerberosAuthority.KRB_PROP_SVCPRPL); + System.clearProperty(KerberosAuthority.KRB_PROP_KEYTAB); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS); + } + + @Test(groups="kerberos-tests") + public void testKerberosAuthorityLogin() { + + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_WINDOW, "1000"); + System.setProperty(KerberosAuthority.KRB_PROP_KEYTAB, "src/test/resources/example.keytab"); + System.setProperty(KerberosAuthority.KRB_PROP_SVCPRPL, "myserver@EXAMPLE.COM"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS, KRB_LOGIN_CB_CLASS); + System.setProperty( "sun.security.krb5.debug", "true"); + + KerberosAuthority kauth = new KerberosAuthority(); + kauth.initialize(); + Exception initState = kauth.getInitState(); + assertNull(initState); + + kauth.login(false); + initState = kauth.getInitState(); + assertNull(initState); + + try { + Thread.sleep(2000); + } catch (Exception exc) { + System.out.println("testKerberosAuthorityLogin: sleep failed: continuing..."); + } + + kauth.login(true); + initState = kauth.getInitState(); + assertNull(initState); + + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_WINDOW); + System.clearProperty(KerberosAuthority.KRB_PROP_SVCPRPL); + System.clearProperty(KerberosAuthority.KRB_PROP_KEYTAB); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS); + } + + @Test(groups="kerberos-tests") + public void testKerberosAuthorityRefreshLogin() { + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_WINDOW, "1000"); + System.setProperty(KerberosAuthority.KRB_PROP_KEYTAB, "src/test/resources/example.keytab"); + System.setProperty(KerberosAuthority.KRB_PROP_SVCPRPL, "myserver@EXAMPLE.COM"); + System.setProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS, KRB_LOGIN_CB_CLASS); + System.setProperty("sun.security.krb5.debug", "true"); + + KerberosAuthority kauth = new KerberosAuthority(); + kauth.initialize(); + Exception initState = kauth.getInitState(); + assertNull(initState); + + long lastLogin = kauth.getLastLogin(); + long now = System.currentTimeMillis(); + assertTrue(lastLogin <= now); + + long loginWindow = kauth.getLoginWindow(); + assertEquals(loginWindow, 1000); + + boolean refreshed = kauth.refreshLogin("myserver@EXAMPLE.COM"); + assertEquals(refreshed, true); + initState = kauth.getInitState(); + assertNull(initState); + + try { + Thread.sleep(2000); + } catch (Exception exc) { + System.out.println("testKerberosAuthorityLogin: sleep failed: continuing..."); + } + + refreshed = kauth.refreshLogin("myserver@EXAMPLE.COM"); + assertEquals(refreshed, true); + initState = kauth.getInitState(); + assertNull(initState); + + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_WINDOW); + System.clearProperty(KerberosAuthority.KRB_PROP_SVCPRPL); + System.clearProperty(KerberosAuthority.KRB_PROP_KEYTAB); + System.clearProperty(KerberosAuthority.KRB_PROP_LOGIN_CB_CLASS); + } + + @Test(groups="kerberos-tests") + public void testSetInitState() throws NoSuchFieldException, SecurityException, + IllegalArgumentException, IllegalAccessException { + Class c = KerberosAuthority.class; + KerberosAuthority check = new KerberosAuthority(); + + Exception e = null; + + check.setInitState(e); + + Field f = c.getDeclaredField("initState"); + f.setAccessible(true); + Exception m = (Exception) f.get(check); + + assertNull(m); + } + + @Test(groups="kerberos-tests") + public void testSetLoginWindow() throws NoSuchFieldException, SecurityException, + IllegalArgumentException, IllegalAccessException { + Class c = KerberosAuthority.class; + KerberosAuthority check = new KerberosAuthority(); + + check.setLoginWindow((long)100); + + Field f = c.getDeclaredField("loginWindow"); + f.setAccessible(true); + long m = (long) f.get(check); + + assertEquals(m,100); + } + + @Test(groups="kerberos-tests") + public void testIsTargetPrincipalIlligal() { + KerberosAuthority check = new KerberosAuthority(); + + assertFalse(check.isTargetPrincipal(null,null)); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/KeyStoreMock.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/KeyStoreMock.java new file mode 100644 index 00000000000..cb2dee51b61 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/KeyStoreMock.java @@ -0,0 +1,88 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; + +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.impl.RoleAuthority; + +public class KeyStoreMock implements KeyStore { + + String servicePublicKeyStringK0; + String servicePublicKeyStringK1; + String ztsPublicKeyStringK0; + String ztsPublicKeyStringK1; + String hostPublic = null; + + public KeyStoreMock() throws IOException { + Path path = Paths.get("./src/test/resources/fantasy_public_k0.key"); + servicePublicKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_public_k1.key"); + servicePublicKeyStringK1 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/zts_public_k0.key"); + ztsPublicKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/zts_public_k1.key"); + ztsPublicKeyStringK1 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/host_public.key"); + hostPublic = new String(Files.readAllBytes(path)); + } + + @Override + public String getPublicKey(String domain, String service, String keyId) { + + // special case for host certs - no domain and service + + if (domain == null && service == null) { + return hostPublic; + } + + // handle rest of the cases for other authorities + + if ("sports".equals(domain) && "fantasy".equals(service) && "0".equals(keyId)) { + return servicePublicKeyStringK0; + } else if ("sports".equals(domain) && "fantasy".equals(service) && "1".equals(keyId)) { + return servicePublicKeyStringK1; + } else if ("sports".equals(domain) && "nfl".equals(service) && "0".equals(keyId)) { + return servicePublicKeyStringK0; + } else if ("sports".equals(domain) && "nfl".equals(service) && "1".equals(keyId)) { + return servicePublicKeyStringK1; + } else if ("cd.project".equals(domain) && "authority".equals(service) && "0".equals(keyId)) { + return servicePublicKeyStringK0; + } else if ("cd.step".equals(domain) && "authority".equals(service) && "0".equals(keyId)) { + return servicePublicKeyStringK0; + } else if (RoleAuthority.SYS_AUTH_DOMAIN.equals(domain) + && RoleAuthority.ZTS_SERVICE_NAME.equals(service) + && "0".equals(keyId)) { + return ztsPublicKeyStringK0; + } else if (RoleAuthority.SYS_AUTH_DOMAIN.equals(domain) + && RoleAuthority.ZTS_SERVICE_NAME.equals(service) + && "1".equals(keyId)) { + return ztsPublicKeyStringK1; + } else if ("sys.auth".equals(domain) && "zms".equals(service) && "0".equals(keyId)) { + return servicePublicKeyStringK0; + } + + return null; + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/MockPrivExcAction.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/MockPrivExcAction.java new file mode 100644 index 00000000000..bc033c1ab7d --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/MockPrivExcAction.java @@ -0,0 +1,40 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.security.PrivilegedExceptionAction; + +import com.yahoo.athenz.auth.token.KerberosToken; + +public class MockPrivExcAction implements PrivilegedExceptionAction { + + byte[] kerberosTicket; + String realm = System.getProperty(KerberosToken.KRB_PROP_TOKEN_PRIV_ACTION + "_TEST_REALM", KerberosToken.KRB_USER_REALM); + + public MockPrivExcAction(String kerberosTicket) { + this(kerberosTicket.getBytes()); + } + public MockPrivExcAction(byte[] kerberosTicket) { + this.kerberosTicket = kerberosTicket; + } + + @Override + public String run() throws Exception { + String user = "myclient" + "@" + realm; + System.out.println("MockPrivExcAction run: return=" + user); + return user; + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/PrincipalAuthorityTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/PrincipalAuthorityTest.java new file mode 100644 index 00000000000..ef046da8886 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/PrincipalAuthorityTest.java @@ -0,0 +1,598 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.lang.reflect.Field; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.List; + +import static org.testng.Assert.*; + +import org.mockito.Mockito; +import org.testng.annotations.BeforeTest; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.Authority.CredSource; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.PrincipalAuthority.IpCheckMode; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.auth.util.CryptoException; + +public class PrincipalAuthorityTest { + + private final String svcVersion = "S1"; + private final String svcDomain = "sports"; + private final String svcName = "fantasy"; + private final String host = "somehost.somecompany.com"; + private final String salt = "saltvalue"; + private final String testKeyVersionK0 = "0"; + private final String testKeyVersionK1 = "1"; + private final String usrVersion = "U1"; + private final String usrDomain = "user"; + private final String usrName = "john"; + + private final long expirationTime = 10; // 10 seconds + private String servicePrivateKeyStringK0 = null; + private String servicePrivateKeyStringK1 = null; + + @BeforeTest + private void loadKeys() throws IOException { + + Path path = Paths.get("./src/test/resources/fantasy_private_k0.key"); + servicePrivateKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_private_k1.key"); + servicePrivateKeyStringK1 = new String(Files.readAllBytes(path)); + } + + private String tamperWithServiceToken(String signedToken) { + String name = null; + String version = null; + String salt = null; + String domain = null; + String host = null; + String signature = null; + long timestamp = 0; + long expiryTime = 0; + + for (String item : signedToken.split(";")) { + String[] kv = item.split("="); + if (kv.length == 2) { + if ("n".equals(kv[0])) { + name = kv[1]; + } else if ("v".equals(kv[0])) { + version = kv[1]; + } else if ("a".equals(kv[0])) { + salt = kv[1]; + } else if ("d".equals(kv[0])) { + domain = kv[1]; + } else if ("h".equals(kv[0])) { + host = kv[1]; + } else if ("s".equals(kv[0])) { + signature = kv[1]; + } else if ("t".equals(kv[0])) { + timestamp = Long.parseLong(kv[1]); + } else if ("e".equals(kv[0])) { + expiryTime = Long.parseLong(kv[1]); + } + } + } + + name = "nfl"; // tamper here by changing the name + + String tamperedToken = new String("v=" + version + ";d=" + domain + + ";n=" + name + ";h=" + host + ";a=" + salt + ";t=" + + Long.toString(timestamp) + ";e=" + Long.toString(expiryTime) + + ";s=" + signature); + + return tamperedToken; + } + + @Test + public void testPrincipalAuthority() throws IOException, CryptoException { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + assertNull(serviceAuthority.getDomain()); + assertEquals(serviceAuthority.getHeader(), "Athenz-Principal-Auth"); + + // Create and sign token with no key version + PrincipalToken serviceToken = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).build(); + serviceToken.sign(servicePrivateKeyStringK0); + + StringBuilder errMsg = new StringBuilder(); + Principal principal = serviceAuthority.authenticate( + serviceToken.getSignedToken(), null, "GET", errMsg); + + assertNotNull(principal); + assertNotNull(principal.getAuthority()); + assertEquals(principal.getCredentials(), serviceToken.getSignedToken()); + assertEquals(principal.getDomain(), serviceToken.getDomain()); + assertEquals(principal.getName(), serviceToken.getName()); + + principal = serviceAuthority.authenticate( + serviceToken.getSignedToken(), null, "GET", null); + assertNotNull(principal); + + // Create and sign token with key version 0 + serviceToken = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime) + .keyId(testKeyVersionK0).build(); + serviceToken.sign(servicePrivateKeyStringK0); + + principal = serviceAuthority.authenticate(serviceToken.getSignedToken(), null, "GET", errMsg); + + assertNotNull(principal); + assertEquals(principal.getCredentials(), serviceToken.getSignedToken()); + + // Create and sign token with key version 1 + serviceToken = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).keyId(testKeyVersionK1).build(); + serviceToken.sign(servicePrivateKeyStringK1); + + principal = serviceAuthority.authenticate(serviceToken.getSignedToken(), null, "GET", errMsg); + + assertNotNull(principal); + assertEquals(principal.getCredentials(), serviceToken.getSignedToken()); + } + + @Test + public void testPrincipalAuthority_TamperedToken() throws IOException, + CryptoException { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + // Create and sign token + PrincipalToken serviceToken = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).build(); + serviceToken.sign(servicePrivateKeyStringK0); + + String tokenToTamper = serviceToken.getSignedToken(); + + StringBuilder errMsg = new StringBuilder(); + Principal principal = serviceAuthority.authenticate( + tamperWithServiceToken(tokenToTamper), null, "GET", errMsg); + + // Service Authority should return null when authenticate() fails + assertNull(principal); + assertTrue(!errMsg.toString().isEmpty()); + assertTrue(errMsg.toString().contains("authenticate")); + + principal = serviceAuthority.authenticate( + tamperWithServiceToken(tokenToTamper), null, "GET", null); + assertNull(principal); + } + + @Test + public void testPrincipalAuthorityWithAuthorizedService() throws IOException, CryptoException { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + // Create and sign token with key version 0 + + List authorizedServices = new ArrayList<>(); + authorizedServices.add("sports.fantasy"); + authorizedServices.add("sports.hockey"); + + long issueTime = System.currentTimeMillis() / 1000; + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).ip("127.0.0.2").issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + + userTokenToSign.signForAuthorizedService("sports.fantasy", "1", servicePrivateKeyStringK1); + + // we're going to pass a different IP so we get the authorized service checks + + StringBuilder errMsg = new StringBuilder(); + Principal principal = serviceAuthority.authenticate(userTokenToSign.getSignedToken(), + "127.0.0.3", "POST", errMsg); + + assertNotNull(principal); + assertEquals(principal.getAuthorizedService(), "sports.fantasy"); + } + + @Test + public void testValidateAuthorizedServiceSingle() throws IOException { + + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("sports.fantasy"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + + userTokenToSign.signForAuthorizedService("sports.fantasy", "1", servicePrivateKeyStringK1); + + // Create a token for validation using the signed data + assertEquals(serviceAuthority.validateAuthorizeService(userTokenToSign, null), "sports.fantasy"); + } + + @Test + public void testValidateAuthorizedServiceMultiple() throws IOException { + + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("sports.fantasy"); + authorizedServices.add("sports.hockey"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + + userTokenToSign.signForAuthorizedService("sports.fantasy", "1", servicePrivateKeyStringK1); + + // Create a token for validation using the signed data + StringBuilder errMsg = new StringBuilder(); + assertEquals(serviceAuthority.validateAuthorizeService(userTokenToSign, errMsg), "sports.fantasy"); + } + + @Test + public void testValidateAuthorizedServiceNoServices() throws IOException { + + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // Create a token for validation using the signed data + StringBuilder errMsg = new StringBuilder(); + assertNull(serviceAuthority.validateAuthorizeService(userTokenToSign, errMsg)); + } + + @Test + public void testValidateAuthorizedServiceNoSignature() throws IOException { + + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + authorizedServices.add("media.storage"); + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).authorizedServices(authorizedServices) + .expirationWindow(expirationTime).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // Create a token for validation using the signed data + StringBuilder errMsg = new StringBuilder(); + assertNull(serviceAuthority.validateAuthorizeService(userTokenToSign, errMsg)); + } + + @Test + public void testGetAuthorizedServiceNameMultipleServices() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + authorizedServices.add("media.storage"); + assertEquals(serviceAuthority.getAuthorizedServiceName(authorizedServices, null), null); + assertEquals(serviceAuthority.getAuthorizedServiceName(authorizedServices, "sports.storage"), null); + assertEquals(serviceAuthority.getAuthorizedServiceName(authorizedServices, "coretech.storage"), + "coretech.storage"); + } + + @Test + public void testGetAuthorizedServiceNameSingleServices() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + assertEquals(serviceAuthority.getAuthorizedServiceName(authorizedServices, null), "coretech.storage"); + assertEquals(serviceAuthority.getAuthorizedServiceName(authorizedServices, "sports.storage"), null); + assertEquals(serviceAuthority.getAuthorizedServiceName(authorizedServices, "coretech.storage"), + "coretech.storage"); + } + + @Test + public void testIsWriteOperation() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + assertTrue(serviceAuthority.isWriteOperation("PUT")); + assertTrue(serviceAuthority.isWriteOperation("put")); + assertTrue(serviceAuthority.isWriteOperation("Post")); + assertTrue(serviceAuthority.isWriteOperation("POST")); + assertTrue(serviceAuthority.isWriteOperation("DeLete")); + assertTrue(serviceAuthority.isWriteOperation("DELETE")); + assertFalse(serviceAuthority.isWriteOperation("GET")); + assertFalse(serviceAuthority.isWriteOperation("Get")); + assertFalse(serviceAuthority.isWriteOperation("HEAD")); + assertFalse(serviceAuthority.isWriteOperation(null)); + assertFalse(serviceAuthority.isWriteOperation("Unknown")); + assertFalse(serviceAuthority.isWriteOperation("")); + } + + @Test + public void testGetCredSource() { + PrincipalAuthority authority = new PrincipalAuthority(); + authority.initialize(); + assertEquals(CredSource.HEADER, authority.getCredSource()); + } + + @Test + public void testGetPublicKeyKeyServiceZms() { + + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + Mockito.when(keyStore.getPublicKey("sys.auth", "zms", "v1")).thenReturn("zms-key"); + Mockito.when(keyStore.getPublicKey("athenz", "svc", "v1")).thenReturn("athenz-key"); + + String key = serviceAuthority.getPublicKey("athenz", "svc", "zms", "v1", false); + assertEquals(key, "zms-key"); + } + + @Test + public void testGetPublicKeyKeyServiceZts() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + Mockito.when(keyStore.getPublicKey("sys.auth", "zms", "v1")).thenReturn("zms-key"); + Mockito.when(keyStore.getPublicKey("sys.auth", "zts", "v1")).thenReturn("zts-key"); + Mockito.when(keyStore.getPublicKey("athenz", "svc", "v1")).thenReturn("athenz-key"); + + String key = serviceAuthority.getPublicKey("athenz", "svc", "zts", "v1", false); + assertEquals(key, "zts-key"); + } + + @Test + public void testGetPublicKeyKeyServiceInvalid() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + Mockito.when(keyStore.getPublicKey("sys.auth", "zms", "v1")).thenReturn("zms-key"); + Mockito.when(keyStore.getPublicKey("sys.auth", "zts", "v1")).thenReturn("zts-key"); + Mockito.when(keyStore.getPublicKey("athenz", "svc", "v1")).thenReturn("athenz-key"); + + String key = serviceAuthority.getPublicKey("athenz", "svc", "bondo", "v1", false); + assertEquals(key, "athenz-key"); + } + + @Test + public void testGetPublicKeyKeyServiceEmpty() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + Mockito.when(keyStore.getPublicKey("sys.auth", "zms", "v1")).thenReturn("zms-key"); + Mockito.when(keyStore.getPublicKey("sys.auth", "zts", "v1")).thenReturn("zts-key"); + Mockito.when(keyStore.getPublicKey("athenz", "svc", "v1")).thenReturn("athenz-key"); + + String key = serviceAuthority.getPublicKey("athenz", "svc", "", "v1", false); + assertEquals(key, "athenz-key"); + } + + @Test + public void testGetPublicKeyUserToken() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + Mockito.when(keyStore.getPublicKey("sys.auth", "zms", "v1")).thenReturn("zms-key"); + Mockito.when(keyStore.getPublicKey("sys.auth", "zts", "v1")).thenReturn("zts-key"); + Mockito.when(keyStore.getPublicKey("athenz", "svc", "v1")).thenReturn("athenz-key"); + + String key = serviceAuthority.getPublicKey("athenz", "svc", null, "v1", true); + assertEquals(key, "zms-key"); + } + + @Test + public void testGetPublicKeyDefault() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + Mockito.when(keyStore.getPublicKey("sys.auth", "zms", "v1")).thenReturn("zms-key"); + Mockito.when(keyStore.getPublicKey("sys.auth", "zts", "v1")).thenReturn("zts-key"); + Mockito.when(keyStore.getPublicKey("cd.step", "sd10000", "v1")).thenReturn("cd-key"); + Mockito.when(keyStore.getPublicKey("athenz", "svc", "v1")).thenReturn("athenz-key"); + + String key = serviceAuthority.getPublicKey("athenz", "svc", null, "v1", false); + assertEquals(key, "athenz-key"); + } + + @Test + public void testRemoteIpCheckAll() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + serviceAuthority.ipCheckMode = IpCheckMode.OPS_ALL; + + PrincipalToken serviceToken = new PrincipalToken("v=S1;d=domain;n=service;i=10.11.12.23;s=sig"); + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", "GET", serviceToken, null)); + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", "PUT", serviceToken, null)); + assertFalse(serviceAuthority.remoteIpCheck("10.11.12.22", "GET", serviceToken, null)); + assertFalse(serviceAuthority.remoteIpCheck("10.11.12.22", "PUT", serviceToken, null)); + } + + @Test + public void testRemoteIpCheckWrite() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + serviceAuthority.ipCheckMode = IpCheckMode.OPS_WRITE; + + PrincipalToken serviceToken = new PrincipalToken("v=S1;d=user;n=user1;i=10.11.12.23;s=sig"); + + // first let's verify read operation with and without matches + + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", "GET", serviceToken, null)); + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", "GET", serviceToken, null)); + + // now let's try write operations without authorized service + + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", "PUT", serviceToken, null)); + assertFalse(serviceAuthority.remoteIpCheck("10.11.12.22", "PUT", serviceToken, null)); + + // finally mismatch operation with authorized service + + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", "PUT", serviceToken, "authz_service")); + } + + @Test + public void testRemoteIpCheckNone() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + serviceAuthority.ipCheckMode = IpCheckMode.OPS_NONE; + + PrincipalToken serviceToken = new PrincipalToken("v=S1;d=user;n=user1;i=10.11.12.23;s=sig"); + + // all operations must return true + + // first let's verify read operation with and without matches + + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", "GET", serviceToken, null)); + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", "GET", serviceToken, null)); + + // now let's try write operations without authorized service + + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.23", "PUT", serviceToken, null)); + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", "PUT", serviceToken, null)); + + // finally mismatch operation with authorized service + + assertTrue(serviceAuthority.remoteIpCheck("10.11.12.22", "PUT", serviceToken, "authz_service")); + } + + @Test + public void testAuthenticateIlligal() throws IOException { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + + Principal principal = serviceAuthority.authenticate("aaaa", null, "GET", null); + assertNull(principal); + } + + @Test + public void testInitialize() + throws NoSuchFieldException, SecurityException, IllegalArgumentException, IllegalAccessException { + Class c = PrincipalAuthority.class; + PrincipalAuthority principalAuthority = new PrincipalAuthority(); + System.setProperty(PrincipalAuthority.ATHENZ_PROP_TOKEN_OFFSET, "-1"); + + principalAuthority.initialize(); + Field f1 = c.getDeclaredField("allowedOffset"); + f1.setAccessible(true); + int m = (Integer) f1.get(principalAuthority); + + assertEquals(m, 300); + assertEquals(principalAuthority.userDomain, "user"); + } + + @Test + public void testValidateAuthorizedIlligalServiceName() throws IOException { + + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = new KeyStoreMock(); + serviceAuthority.setKeyStore(keyStore); + + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add(".fantasy"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + userTokenToSign.signForAuthorizedService(".fantasy", "1", servicePrivateKeyStringK1); + + // Create a token for validation using the signed data + StringBuilder errMsg = new StringBuilder(); + assertNull(serviceAuthority.validateAuthorizeService(userTokenToSign, errMsg)); + } + + @Test + public void testValidateAuthorizedIlligalForAuthorizedService() throws IOException { + + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + Mockito.when(keyStore.getPublicKey("sports", "fantasy", "1")).thenReturn(null); + + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("sports.fantasy"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + userTokenToSign.signForAuthorizedService("sports.fantasy", "1", servicePrivateKeyStringK1); + + // Create a token for validation using the signed data + StringBuilder errMsg = new StringBuilder(); + assertNull(serviceAuthority.validateAuthorizeService(userTokenToSign, errMsg)); + } + + @Test + public void testPrincipalAuthorityAuthenticateIlligal() throws IOException, CryptoException { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + KeyStore keyStore = Mockito.mock(KeyStore.class); + serviceAuthority.setKeyStore(keyStore); + + String t = "v=S1;d=domain;n=hoge;bs=aaaa;s=signatur"; + + Principal check = serviceAuthority.authenticate(t, "10", "10", null); + assertNull(check); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/RoleAuthorityTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/RoleAuthorityTest.java new file mode 100644 index 00000000000..3e2f126412f --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/RoleAuthorityTest.java @@ -0,0 +1,397 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.io.IOException; +import java.lang.reflect.Field; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; + +import static org.testng.Assert.*; +import org.testng.annotations.BeforeTest; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.RoleAuthority; +import com.yahoo.athenz.auth.token.RoleToken; +import com.yahoo.athenz.auth.util.CryptoException; + +public class RoleAuthorityTest { + + private final String rolVersion = "Z1"; + private final String svcDomain = "sports"; + private final String salt = "aAkjbbDMhnLX"; + private final String testKeyVersionK0 = "0"; + private final String testKeyVersionK1 = "1"; + + private final long expirationTime = 10; // 10 seconds + + private String ztsPrivateKeyStringK0 = null; + private String ztsPrivateKeyStringK1 = null; + private static final String ZMS_USER_DOMAIN = "athenz.user_domain"; + + static String userDomain = System.getProperty(ZMS_USER_DOMAIN, "user"); + + @BeforeTest + private void loadKeys() throws IOException { + + Path path = Paths.get("./src/test/resources/zts_private_k0.key"); + ztsPrivateKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/zts_private_k1.key"); + ztsPrivateKeyStringK1 = new String(Files.readAllBytes(path)); + } + + private String tamperWithRoleToken(String signedToken) { + String version = null; + String domain = null; + StringBuilder roleNames = null; + String signature = null; + long timestamp = 0; + long expiryTime = 0; + + for (String item : signedToken.split(";")) { + String[] kv = item.split("="); + if (kv.length == 2) { + if ("v".equals(kv[0])) { + version = kv[1]; + } else if ("d".equals(kv[0])) { + domain = kv[1]; + } else if ("r".equals(kv[0])) { + roleNames = new StringBuilder(kv[1]); + } else if ("t".equals(kv[0])) { + timestamp = Long.parseLong(kv[1]); + } else if ("e".equals(kv[0])) { + expiryTime = Long.parseLong(kv[1]); + } else if ("s".equals(kv[0])) { + signature = kv[1]; + } + } + } + + roleNames.append(",storage.tenant.weather.admin"); // tamper here by adding a role + + List roles = Arrays.asList(roleNames.toString().split(",")); + + StringBuilder flattenedRoles = new StringBuilder(); + + int i = 0; + for (String role : roles) { + if (++i == roles.size()) { + flattenedRoles.append(role); + } else { + flattenedRoles.append(role + ","); + } + } + + String tamperedToken = new String("v=" + version + ";d=" + domain + + ";r=" + flattenedRoles + ";t=" + Long.toString(timestamp) + + ";e=" + Long.toString(expiryTime) + ";s=" + signature); + + return tamperedToken; + } + + @Test + public void testRoleAuthority() throws IOException, CryptoException { + RoleAuthority rollAuthority = new RoleAuthority(); + KeyStore keyStore = new KeyStoreMock(); + rollAuthority.setKeyStore(keyStore); + + assertEquals(rollAuthority.getDomain(), "sys.auth"); + assertEquals(rollAuthority.getHeader(), "Athenz-Role-Auth"); + + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + roles.add("fantasy.tenant.sports.admin"); + roles.add("fantasy.tenant.sports.reader"); + roles.add("fantasy.tenant.sports.writer"); + roles.add("fantasy.tenant.sports.scanner"); + + // Create and sign token with no key version + RoleToken rollToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("coretech.storage").build(); + rollToken.sign(ztsPrivateKeyStringK0); + + StringBuilder errMsg = new StringBuilder(); + Principal principal = rollAuthority.authenticate(rollToken.getSignedToken(), + "127.0.0.1", "GET", errMsg); + + assertNotNull(principal); + assertNotNull(principal.getAuthority()); + assertEquals(principal.getCredentials(), + rollToken.getSignedToken()); + assertEquals(principal.getDomain(), rollToken.getDomain()); + + principal = rollAuthority.authenticate(rollToken.getSignedToken(), + "127.0.0.1", "GET", null); + assertNotNull(principal); + + List rolesToValidate = principal.getRoles(); + assertEquals(rolesToValidate.size(), roles.size()); + assertTrue(rolesToValidate.equals(roles)); + + // Create and sign token with keyVersion = 0 + rollToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("coretech.storage").keyId(testKeyVersionK0).build(); + rollToken.sign(ztsPrivateKeyStringK0); + + principal = rollAuthority.authenticate(rollToken.getSignedToken(), + "127.0.0.1", "GET", errMsg); + + assertNotNull(principal); + assertEquals(principal.getCredentials(), + rollToken.getSignedToken()); + + // Create and sign token with keyVersion = 1 + rollToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("coretech.storage").keyId(testKeyVersionK1).build(); + rollToken.sign(ztsPrivateKeyStringK1); + + principal = rollAuthority.authenticate(rollToken.getSignedToken(), + "127.0.0.1", "GET", errMsg); + + assertNotNull(principal); + assertEquals(principal.getCredentials(), + rollToken.getSignedToken()); + } + + @Test + public void testRoleAuthority_TamperedToken() throws IOException, + CryptoException { + RoleAuthority rollAuthority = new RoleAuthority(); + KeyStore keyStore = new KeyStoreMock(); + rollAuthority.setKeyStore(keyStore); + + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + roles.add("fantasy.tenant.sports.admin"); + roles.add("fantasy.tenant.sports.reader"); + roles.add("fantasy.tenant.sports.writer"); + roles.add("fantasy.tenant.sports.scanner"); + + // Create and sign token + RoleToken serviceToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("coretech.storage").keyId(testKeyVersionK1).build(); + serviceToken.sign(ztsPrivateKeyStringK0); + + String tokenToTamper = serviceToken.getSignedToken(); + + StringBuilder errMsg = new StringBuilder(); + Principal principal = rollAuthority.authenticate(tamperWithRoleToken(tokenToTamper), + "127.0.0.1", "GET", errMsg); + + // Role Authority should return null when authenticate() fails + assertNull(principal); + assertTrue(!errMsg.toString().isEmpty()); + assertTrue(errMsg.toString().contains("authenticate")); + + principal = rollAuthority.authenticate(tamperWithRoleToken(tokenToTamper), + "127.0.0.1", "GET", null); + assertNull(principal); + } + + @Test + public void testRoleAuthorityMismatchIPNonUser() throws IOException, CryptoException { + RoleAuthority rollAuthority = new RoleAuthority(); + KeyStore keyStore = new KeyStoreMock(); + rollAuthority.setKeyStore(keyStore); + + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + // Create and sign token with keyVersion = 0 + RoleToken roleToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("coretech.storage").keyId(testKeyVersionK0).build(); + roleToken.sign(ztsPrivateKeyStringK0); + + // mismatch IP but should be OK since it's not User + StringBuilder errMsg = new StringBuilder(); + Principal principal = rollAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.2", "GET", errMsg); + + assertNotNull(principal); + } + + @Test + public void testRoleAuthorityMismatchIPNonWrite() throws IOException, CryptoException { + RoleAuthority rollAuthority = new RoleAuthority(); + KeyStore keyStore = new KeyStoreMock(); + rollAuthority.setKeyStore(keyStore); + + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + // Create and sign token with keyVersion = 0 + RoleToken roleToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("" + userDomain + ".joe").keyId(testKeyVersionK0).build(); + roleToken.sign(ztsPrivateKeyStringK0); + + // mismatch IP but should be OK since it's not write operation + StringBuilder errMsg = new StringBuilder(); + Principal principal = rollAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.2", "GET", errMsg); + + assertNotNull(principal); + } + + @Test + public void testRoleAuthorityMismatchIP() throws IOException, CryptoException { + RoleAuthority rollAuthority = new RoleAuthority(); + KeyStore keyStore = new KeyStoreMock(); + rollAuthority.setKeyStore(keyStore); + + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + // Create and sign token with keyVersion = 0 + RoleToken roleToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("" + userDomain + ".joe").keyId(testKeyVersionK0).build(); + roleToken.sign(ztsPrivateKeyStringK0); + + // mismatch IP should fail + StringBuilder errMsg = new StringBuilder(); + Principal principal = rollAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.2", "DELETE", errMsg); + + assertNull(principal); + assertTrue(!errMsg.toString().isEmpty()); + assertTrue(errMsg.toString().contains("authenticate")); + + errMsg = new StringBuilder(); // get a fresh one + principal = rollAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.2", "PUT", errMsg); + + assertNull(principal); + assertTrue(!errMsg.toString().isEmpty()); + assertTrue(errMsg.toString().contains("authenticate")); + + // final check should be ok with valid IP + principal = rollAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.1", "DELETE", errMsg); + + assertNotNull(principal); + } + + @Test + public void testIsWriteOperation() { + PrincipalAuthority serviceAuthority = new PrincipalAuthority(); + assertTrue(serviceAuthority.isWriteOperation("PUT")); + assertTrue(serviceAuthority.isWriteOperation("put")); + assertTrue(serviceAuthority.isWriteOperation("Post")); + assertTrue(serviceAuthority.isWriteOperation("POST")); + assertTrue(serviceAuthority.isWriteOperation("DeLete")); + assertTrue(serviceAuthority.isWriteOperation("DELETE")); + assertFalse(serviceAuthority.isWriteOperation("GET")); + assertFalse(serviceAuthority.isWriteOperation("Get")); + assertFalse(serviceAuthority.isWriteOperation("HEAD")); + assertFalse(serviceAuthority.isWriteOperation(null)); + assertFalse(serviceAuthority.isWriteOperation("Unknown")); + assertFalse(serviceAuthority.isWriteOperation("")); + } + + @Test + public void testAuthenticateIlligal() throws IOException { + RoleAuthority roleAuthority = new RoleAuthority(); + roleAuthority.initialize(); + + Principal principal = roleAuthority.authenticate("", "10.72.118.45", "GET", null); + assertNull(principal); + + KeyStore keyStore = new KeyStoreMock(); + roleAuthority.setKeyStore(keyStore); + + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + // Create and sign token with keyVersion = 0 + RoleToken roleToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal(".").keyId(testKeyVersionK0).build(); + roleToken.sign(ztsPrivateKeyStringK0); + + principal = roleAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.2", "DELETE", null); + assertNull(principal); + + roleToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal("illigal.joe").keyId(testKeyVersionK0).build(); + roleToken.sign(ztsPrivateKeyStringK0); + + principal = roleAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.2", "DELETE", null); + assertNotNull(principal); + } + + @Test + public void testIsWriteOperationNull() throws IOException { + RoleAuthority roleAuthority = new RoleAuthority(); + roleAuthority.initialize(); + + KeyStore keyStore = new KeyStoreMock(); + roleAuthority.setKeyStore(keyStore); + + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + // Create and sign token with keyVersion = 0 + RoleToken roleToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).ip("127.0.0.1").expirationWindow(expirationTime) + .principal(".").keyId(testKeyVersionK0).build(); + roleToken.sign(ztsPrivateKeyStringK0); + + Principal principal = roleAuthority.authenticate(roleToken.getSignedToken(), + "127.0.0.2", null, null); + assertNotNull(principal); + } + + @Test + public void testInitialize() throws NoSuchFieldException, SecurityException, + IllegalArgumentException, IllegalAccessException { + Class c = RoleAuthority.class; + RoleAuthority roleAuthority = new RoleAuthority(); + System.setProperty(RoleAuthority.ATHENZ_PROP_TOKEN_OFFSET, "-1"); + + roleAuthority.initialize(); + + Field f1 = c.getDeclaredField("allowedOffset"); + f1.setAccessible(true); + int m = (Integer) f1.get(roleAuthority); + + assertEquals(m,300); + assertEquals(roleAuthority.userDomain,"user"); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/SimplePrincipalTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/SimplePrincipalTest.java new file mode 100644 index 00000000000..441b37fe593 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/SimplePrincipalTest.java @@ -0,0 +1,253 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import static org.testng.Assert.*; + +import java.util.ArrayList; +import java.util.List; + +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.impl.UserAuthority; + +public class SimplePrincipalTest { + + String fakeUnsignedCreds = "v=U1;d=user;n=jdoe"; + String fakeCreds = fakeUnsignedCreds + ";s=signature"; + + @Test + public void testSimplePrincipal() { + SimplePrincipal p = (SimplePrincipal) SimplePrincipal.create("user", "jdoe", fakeCreds, null); + assertNotNull(p); + p.setUnsignedCreds(fakeUnsignedCreds); + assertEquals(p.getName(), "jdoe"); + assertEquals(p.getDomain(), "user"); + assertEquals(p.getCredentials(), fakeCreds); + assertEquals(p.getUnsignedCredentials(), fakeUnsignedCreds); + } + + @Test + public void testSimplePrincipalNullUnsignedCred() { + Principal p = SimplePrincipal.create("user", "jdoe", fakeCreds, null); + assertNotNull(p); + assertEquals(p.getName(), "jdoe"); + assertEquals(p.getDomain(), "user"); + assertEquals(p.getCredentials(), fakeCreds); + assertNull(p.getUnsignedCredentials()); + } + + @Test + public void testYRN() { + Principal p = SimplePrincipal.create("user", "jdoe", fakeCreds, null); + assertEquals(p.getYRN(), "user.jdoe"); + + p = SimplePrincipal.create(null, "jdoe", fakeCreds); + assertEquals(p.getYRN(), "jdoe"); + + List roles = new ArrayList(); + roles.add("role1"); + + p = SimplePrincipal.create("user", fakeCreds, roles, null); + assertEquals(p.getYRN(), "user"); + + Authority a = null; + p = SimplePrincipal.create(null, null, a); + assertNull(p.getYRN()); + } + + @Test + public void testSimplePrincipalInvalidDomain() { + + // we output warning but still create a principal + + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + SimplePrincipal p = (SimplePrincipal) SimplePrincipal.create("user test invalid#$%", + fakeCreds, roles, userAuthority); + assertNotNull(p); + p.setUnsignedCreds(fakeUnsignedCreds); + assertEquals(p.getDomain(), "user test invalid#$%"); + assertEquals(p.getCredentials(), fakeCreds); + assertEquals(p.getUnsignedCredentials(), fakeUnsignedCreds); + } + + @Test + public void testSimplePrincipalNullRole() { + + // we output warning but still create a principal + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + SimplePrincipal p = (SimplePrincipal) SimplePrincipal.create("user", + fakeCreds, (List) null, userAuthority); + assertNotNull(p); + p.setUnsignedCreds(fakeUnsignedCreds); + assertEquals(p.getDomain(), "user"); + assertEquals(p.getCredentials(), fakeCreds); + assertEquals(p.getUnsignedCredentials(), fakeUnsignedCreds); + } + + @Test + public void testSimplePrincipalEmptyRole() { + + // we output warning but still create a principal + + List roles = new ArrayList(); + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + SimplePrincipal p = (SimplePrincipal) SimplePrincipal.create("user", fakeCreds, roles, userAuthority); + assertNotNull(p); + p.setUnsignedCreds(fakeUnsignedCreds); + assertEquals(p.getDomain(), "user"); + assertEquals(p.getCredentials(), fakeCreds); + assertEquals(p.getUnsignedCredentials(), fakeUnsignedCreds); + } + + @Test + public void testSimplePrincipalInvalidName() { + + // we output warning but still create a principal + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + SimplePrincipal p = (SimplePrincipal) SimplePrincipal.create("user", "jdoe invalid#$%", + fakeCreds, 0, userAuthority); + assertNotNull(p); + p.setUnsignedCreds(fakeUnsignedCreds); + assertEquals(p.getDomain(), "user"); + assertEquals(p.getName(), "jdoe invalid#$%"); + assertEquals(p.getCredentials(), fakeCreds); + assertEquals(p.getUnsignedCredentials(), fakeUnsignedCreds); + } + + @Test + public void testSimplePrincipalNullDomainAuthorityDomainNotNull() { + + // we output warning but still create a principal + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + Principal p = SimplePrincipal.create(null, "jdoe", fakeCreds, 0, userAuthority); + assertNull(p); + } + + @Test + public void testSimplePrincipalNullDomainAuthorityDomainNull() { + + // we output warning but still create a principal + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + Principal p = SimplePrincipal.create(null, "jdoe", fakeCreds, 0, null); + assertNull(p.getDomain()); + } + + @Test + public void testSimplePrincipalDomainNoMatch() { + + // we output warning but still create a principal + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + Principal p = SimplePrincipal.create("coretech", "jdoe", fakeCreds, 0, userAuthority); + assertNull(p); + } + + @Test + public void testSimplePrincipalIssueTime() { + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + Principal p = SimplePrincipal.create("user", "jdoe", fakeCreds, 101, userAuthority); + assertNotNull(p); + assertEquals(p.getIssueTime(), 101); + } + + @Test + public void testSimplePrincipalToStringZToken() { + + List roles = new ArrayList(); + roles.add("updater"); + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + Principal p = SimplePrincipal.create("user", fakeCreds, roles, userAuthority); + assertEquals(p.toString(), "ZToken_user~updater"); + } + + @Test + public void testSimplePrincipalToStringUser() { + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + Principal p = SimplePrincipal.create("user", "jdoe", fakeCreds, 101, userAuthority); + assertEquals(p.toString(), "user.jdoe"); + } + + @Test + public void testSimplePrincipalExtraFields() { + + UserAuthority userAuthority = new UserAuthority(); + userAuthority.initialize(); + + Principal p = SimplePrincipal.create("user", "jdoe", fakeCreds, 101, userAuthority); + ((SimplePrincipal) p).setOriginalRequestor("athenz.ci"); + ((SimplePrincipal) p).setKeyService("zts"); + + assertEquals(p.toString(), "user.jdoe"); + assertEquals(p.getOriginalRequestor(), "athenz.ci"); + assertEquals(p.getKeyService(), "zts"); + } + + @Test + public void testSimplePrincipalIP() { + SimplePrincipal check = (SimplePrincipal) SimplePrincipal.create("user", "jdoe", "hoge"); + + check.setIP("10.10.10.10"); + assertEquals(check.getIP(),"10.10.10.10"); + } + + @Test + public void testSimplePrincipalAuthorityCreate() { + Authority hoge = Mockito.mock(Authority.class); + + SimplePrincipal check = (SimplePrincipal) SimplePrincipal.create("user", "jdoe", hoge); + assertNotNull(check); + + Mockito.when(hoge.getDomain()).thenReturn(null); + check = (SimplePrincipal) SimplePrincipal.create(null, "jdoe","hoge", 0, hoge); + assertNotNull(check); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/SimpleServiceIdentityProviderTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/SimpleServiceIdentityProviderTest.java new file mode 100644 index 00000000000..a8d5e8f0626 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/SimpleServiceIdentityProviderTest.java @@ -0,0 +1,132 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimpleServiceIdentityProvider; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.auth.util.Crypto; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; + +import static org.testng.Assert.*; + +import org.testng.annotations.BeforeTest; +import org.testng.annotations.Test; + +public class SimpleServiceIdentityProviderTest { + + private String servicePublicKeyStringK0 = null; + private String servicePublicKeyStringK1 = null; + private String servicePrivateKeyStringK1 = null; + private File k0File = null; + private Authority authority = null; + + @BeforeTest + private void loadKeys() throws IOException { + Path path = Paths.get("./src/test/resources/fantasy_public_k0.key"); + servicePublicKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_private_k0.key"); + k0File = path.toFile(); + + path = Paths.get("./src/test/resources/fantasy_public_k1.key"); + servicePublicKeyStringK1 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_private_k1.key"); + servicePrivateKeyStringK1 = new String(Files.readAllBytes(path)); + + authority = new PrincipalAuthority(); + } + + @Test + public void testSimpleIdentityDefaultV0() { + + SimpleServiceIdentityProvider provider = new SimpleServiceIdentityProvider(authority, k0File); + Principal user = provider.getIdentity("coretech", "athenz"); + assertNotNull(user); + assertTrue(user.getIssueTime() != 0); + + String token = user.getCredentials(); + PrincipalToken prToken = new PrincipalToken(token); + assertTrue(prToken.validate(servicePublicKeyStringK0, 0)); + assertEquals(prToken.getKeyId(), "0"); + } + + @Test + public void testSimpleIdentityDefaultV1() { + + PrivateKey key = Crypto.loadPrivateKey(servicePrivateKeyStringK1); + SimpleServiceIdentityProvider provider = new SimpleServiceIdentityProvider(authority, key, "1", 3600); + Principal user = provider.getIdentity("coretech", "athenz"); + assertNotNull(user); + assertTrue(user.getIssueTime() != 0); + + String token = user.getCredentials(); + PrincipalToken prToken = new PrincipalToken(token); + assertTrue(prToken.validate(servicePublicKeyStringK1, 0)); + assertEquals(prToken.getKeyId(), "1"); + } + + @Test + public void testSimpleIdentityPrivateKey() { + + PrivateKey privateKey = Crypto.loadPrivateKey(k0File); + + SimpleServiceIdentityProvider provider = new SimpleServiceIdentityProvider(authority, privateKey); + Principal user = provider.getIdentity("coretech", "athenz"); + assertNotNull(user); + assertTrue(user.getIssueTime() != 0); + + String token = user.getCredentials(); + PrincipalToken prToken = new PrincipalToken(token); + assertTrue(prToken.validate(servicePublicKeyStringK0, 0)); + assertEquals(prToken.getKeyId(), "0"); + + provider = new SimpleServiceIdentityProvider(authority, privateKey, 3600); + user = provider.getIdentity("coretech", "athenz"); + assertNotNull(user); + assertTrue(user.getIssueTime() != 0); + + token = user.getCredentials(); + prToken = new PrincipalToken(token); + assertTrue(prToken.validate(servicePublicKeyStringK0, 0)); + assertEquals(prToken.getKeyId(), "0"); + } + + @Test + public void testGetHost() { + PrivateKey privateKey = Crypto.loadPrivateKey(k0File); + + SimpleServiceIdentityProvider provider = new SimpleServiceIdentityProvider(authority, privateKey); + + String name = provider.getHost(); + assertNotNull(name); + } + + @Test + public void testSimpleIdentityString() { + SimpleServiceIdentityProvider provider = new SimpleServiceIdentityProvider(authority, "aaaaaaaa"); + assertNotNull(provider); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/TestLoginCallbackHandler.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/TestLoginCallbackHandler.java new file mode 100644 index 00000000000..c9f284283bb --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/TestLoginCallbackHandler.java @@ -0,0 +1,75 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import java.io.IOException; + +import javax.security.auth.callback.Callback; +import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.callback.NameCallback; +import javax.security.auth.callback.PasswordCallback; +import javax.security.auth.callback.UnsupportedCallbackException; + +/** + * Password callback handler for resolving password/usernames for a JAAS login. + */ +public class TestLoginCallbackHandler implements CallbackHandler { + + public TestLoginCallbackHandler() { + super(); + } + + public TestLoginCallbackHandler(String name, String password) { + super(); + this.username = name; + if (password != null) { + this.password = password; + } + } + + public TestLoginCallbackHandler(String password) { + super(); + this.password = password; + } + + private String username; + private String password = "orange2"; + + /** + * Handles the callbacks, and sets the user/password detail. + * @param callbacks the callbacks to handle + * @throws Exception if an input or output error occurs. + */ + public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { + + for (Callback cback: callbacks) { + if (cback instanceof NameCallback && username != null) { + NameCallback nc = (NameCallback) cback; + nc.setName(username); + } else if (cback instanceof PasswordCallback) { + PasswordCallback pc = (PasswordCallback) cback; + pc.setPassword(password.toCharArray()); + } else { + // other callbacks: AuthorizeCallback, ChoiceCallback, ConfirmationCallback, + // LanguageCallback, RealmCallback, RealmChoiceCallback, TextInputCallback, TextOutputCallback + // what does our grid services usually do? + + throw new UnsupportedCallbackException(cback, "Unrecognized Callback"); + } + } + } +} + diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/UserAuthorityTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/UserAuthorityTest.java new file mode 100644 index 00000000000..0ed0356c8f8 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/impl/UserAuthorityTest.java @@ -0,0 +1,86 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.impl; + +import static org.testng.Assert.*; + +import org.jvnet.libpam.PAM; +import org.jvnet.libpam.PAMException; +import org.jvnet.libpam.UnixUser; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Principal; + +import org.mockito.Mockito; + +public class UserAuthorityTest { + private String testToken = "Basic dGVzdHVzZXI6dGVzdHB3ZA=="; + private String expectedDomain = "user"; + private String expectedHeader = "Authorization"; + private String expectedUserId = "testuser"; + + @Test + public void testUserAuthority() throws PAMException { + PAM pam = Mockito.mock(PAM.class); + UnixUser user = new UnixUser(System.getenv("USER")); + Mockito.when(pam.authenticate("testuser", "testpwd")).thenReturn(user); + UserAuthority userAuthority = new UserAuthority(); + userAuthority.setPAM(pam); + assertEquals(userAuthority.getDomain(), expectedDomain); + assertEquals(userAuthority.getHeader(), expectedHeader); + + StringBuilder errMsg = new StringBuilder(); + Principal principal = userAuthority.authenticate(testToken, "10.72.118.45", "GET", errMsg); + + assertNotNull(principal); + assertNotNull(principal.getAuthority()); + assertEquals(principal.getCredentials(), testToken); + assertEquals(principal.getDomain(), expectedDomain); + assertEquals(principal.getName(), expectedUserId); + } + + @Test + public void testUserAuthorityInvalidFormat() { + PAM pam = Mockito.mock(PAM.class); + UserAuthority userAuthority = new UserAuthority(); + userAuthority.setPAM(pam); + StringBuilder errMsg = new StringBuilder(); + Principal principal = userAuthority.authenticate("dGVzdHVzZXI6dGVzdHB3ZA==", "10.72.118.45", "GET", errMsg); + assertNull(principal); + } + + @Test + public void testAllowAuthorization() { + PAM pam = Mockito.mock(PAM.class); + UserAuthority userAuthority = new UserAuthority(); + userAuthority.setPAM(pam); + + assertFalse(userAuthority.allowAuthorization()); + } + + @Test + public void testAuthenticateException() throws PAMException { + PAM pam = Mockito.mock(PAM.class); + UserAuthority userAuthority = new UserAuthority(); + userAuthority.setPAM(pam); + Mockito.when(pam.authenticate("testuser", "testpwd")).thenReturn(null); + Principal principal = userAuthority.authenticate("Basic dGVzdHVzZXI6dGVzdHB3ZA==", "10.72.118.45", "GET", null); + + principal = userAuthority.authenticate("Basic ", "10.72.118.45", "GET", null); + + assertNull(principal); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/PrincipalTokenTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/PrincipalTokenTest.java new file mode 100644 index 00000000000..b47e1ecfa09 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/PrincipalTokenTest.java @@ -0,0 +1,724 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.token; + +import static org.testng.Assert.*; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.List; + +import org.testng.annotations.BeforeTest; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.CryptoException; + +public class PrincipalTokenTest { + + private final String svcVersion = "S1"; + private final String usrVersion = "U1"; + private final String svcDomain = "sports"; + private final String svcName = "fantasy"; + private final String usrDomain = "user"; + private final String usrName = "john"; + private final String host = "somehost.somecompany.com"; + private final String salt = "saltvalue"; + private final String testKeyVersionK1 = "1"; + + private final long expirationTime = 10; // 10 seconds + + private String servicePublicKeyStringK0 = null; + private String servicePrivateKeyStringK0 = null; + private String servicePublicKeyStringK1 = null; + private String servicePrivateKeyStringK1 = null; + + @BeforeTest + private void loadKeys() throws IOException { + Path path = Paths.get("./src/test/resources/fantasy_public_k0.key"); + servicePublicKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_private_k0.key"); + servicePrivateKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_public_k1.key"); + servicePublicKeyStringK1 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_private_k1.key"); + servicePrivateKeyStringK1 = new String(Files.readAllBytes(path)); + } + + //backwards compatibility + private PrincipalToken createServiceToken() throws CryptoException { + // Create and sign token + PrincipalToken serviceTokenToSign = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).build(); + + serviceTokenToSign.sign(servicePrivateKeyStringK0); + + // Create a token for validation using the signed data + return new PrincipalToken(serviceTokenToSign.getSignedToken()); + } + + private PrincipalToken createServiceToken(String keyVersion) throws CryptoException { + // Create and sign token + PrincipalToken serviceTokenToSign = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).keyId(keyVersion).build(); + + String privateKey = null; + if ("0".equals(keyVersion)) { + privateKey = servicePrivateKeyStringK0; + } else if ("1".equals(keyVersion)) { + privateKey = servicePrivateKeyStringK1; + } + + serviceTokenToSign.sign(privateKey); + + // Create a token for validation using the signed data + return new PrincipalToken(serviceTokenToSign.getSignedToken()); + } + + private PrincipalToken createUserToken(long issueTime) + throws CryptoException { + // Create and sign token + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // Create a token for validation using the signed data + return new PrincipalToken(userTokenToSign.getSignedToken()); + } + + @Test + public void testServiceToken() throws InterruptedException, CryptoException { + PrincipalToken serviceTokenToValidate = createServiceToken(testKeyVersionK1); + + // Validate all input data + assertEquals(serviceTokenToValidate.getVersion(), svcVersion); + assertEquals(serviceTokenToValidate.getDomain(), svcDomain); + assertEquals(serviceTokenToValidate.getName(), svcName); + assertEquals(serviceTokenToValidate.getHost(), host); + assertEquals(serviceTokenToValidate.getSalt(), salt); + assertEquals(serviceTokenToValidate.getKeyId(), testKeyVersionK1); + + // Validate the signature and that expiration time had not elapsed + assertTrue(serviceTokenToValidate.validate(servicePublicKeyStringK1, 300)); + + // Create ServiceToken with null keyVersion which should default to 0 + serviceTokenToValidate = createServiceToken(); + assertEquals(serviceTokenToValidate.getKeyId(), "0"); + + // Validate the signature using key(k0) and that expiration time had not elapsed + assertTrue(serviceTokenToValidate.validate(servicePublicKeyStringK0, 300)); + + PrincipalToken svcToken2 = new PrincipalToken(serviceTokenToValidate.getSignedToken()); + assertEquals(svcToken2.getSignedToken(), serviceTokenToValidate.getSignedToken()); + } + + + @Test + public void testUserToken() throws InterruptedException, CryptoException { + long issueTime = System.currentTimeMillis() / 1000; + PrincipalToken userTokenToValidate = createUserToken(issueTime); + + // Validate all input data + assertEquals(userTokenToValidate.getVersion(), usrVersion); + assertEquals(userTokenToValidate.getDomain(), usrDomain); + assertEquals(userTokenToValidate.getName(), usrName); + assertNull(userTokenToValidate.getHost()); + assertEquals(userTokenToValidate.getSalt(), salt); + + // Validate the signature and that expiration time had not elapsed + assertTrue(userTokenToValidate.validate(servicePublicKeyStringK0, 300)); + } + + @Test + public void testTokenStringConstructor() { + long issueTime = System.currentTimeMillis() / 1000; + PrincipalToken pToken = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime).build(); + + pToken.sign(servicePrivateKeyStringK0); // now its signed + String signedToken = pToken.getSignedToken(); + PrincipalToken sigToken1 = new PrincipalToken(signedToken); + assertEquals(sigToken1.getSignedToken(), signedToken); + + String unsignedTok = pToken.getUnsignedToken(); + String signature = pToken.getSignature(); + String newSignedToken = unsignedTok + ";s=" + signature; + assertEquals(newSignedToken, signedToken); + + // instantiate a Token with the unsigned token + signature + PrincipalToken sigToken2 = new PrincipalToken(newSignedToken); + assertEquals(sigToken2.getSignedToken(), signedToken); + assertEquals(sigToken2.getUnsignedToken(), unsignedTok); + assertEquals(sigToken2.getSignature(), signature); + } + + @Test + public void testUserToken_Expired() throws InterruptedException, + CryptoException { + long issueTime = System.currentTimeMillis() / 1000 - 10; + PrincipalToken userTokenToValidate = createUserToken(issueTime); + + // Let expiration time elapse + Thread.sleep(expirationTime * 1000); + + // Validate that the expiration time has elapsed + assertFalse(userTokenToValidate.validate(servicePublicKeyStringK0, 300)); + } + + @Test + public void testServiceToken_Expired() throws InterruptedException, + CryptoException { + PrincipalToken serviceTokenToValidate = createServiceToken("0"); + + // Let expiration time elapse + Thread.sleep((expirationTime + 10) * 1000); + + // Validate that the expiration time has elapsed + assertFalse(serviceTokenToValidate + .validate(servicePublicKeyStringK0, 300)); + } + + @Test + public void testEmptyToken() { + + try { + @SuppressWarnings("unused") + PrincipalToken token = new PrincipalToken(""); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testNullToken() { + + try { + @SuppressWarnings("unused") + PrincipalToken token = new PrincipalToken(null); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenDomainNull() { + + try { + @SuppressWarnings("unused") + PrincipalToken token = new PrincipalToken("v=S1;n=storage;s=sig"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenDomainEmpty() { + + try { + @SuppressWarnings("unused") + PrincipalToken token = new PrincipalToken("v=S1;d=;n=storage;s=sig"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void tesTokenNameNull() { + + try { + @SuppressWarnings("unused") + PrincipalToken token = new PrincipalToken("v=S1;d=coretech;s=sig"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenNameEmpty() { + + try { + @SuppressWarnings("unused") + PrincipalToken token = new PrincipalToken("v=S1;d=coretech;n=;s=sig"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenWithoutSignature() { + + PrincipalToken token = new PrincipalToken("v=S1;d=coretech;n=storage"); + assertEquals(token.getDomain(), "coretech"); + assertEquals(token.getName(), "storage"); + assertEquals(token.getVersion(), "S1"); + assertNull(token.getUnsignedToken()); + } + + @Test + public void testTokenInvalidVersionValue() { + + PrincipalToken token = new PrincipalToken("v=S1=S2;d=coretech;n=storage"); + assertEquals(token.getName(), "storage"); + assertEquals(token.getDomain(), "coretech"); + assertNull(token.getVersion()); + } + + @Test + public void testBuilderRequiredVersionNull() { + + try { + @SuppressWarnings("unused") + PrincipalToken.Builder builder = new PrincipalToken.Builder(null, svcDomain, svcName); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredVersionEmptyString() { + + try { + @SuppressWarnings("unused") + PrincipalToken.Builder builder = new PrincipalToken.Builder("", svcDomain, svcName); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredDomainNull() { + + try { + @SuppressWarnings("unused") + PrincipalToken.Builder builder = new PrincipalToken.Builder(svcVersion, null, svcName); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredDomainEmptyString() { + + try { + @SuppressWarnings("unused") + PrincipalToken.Builder builder = new PrincipalToken.Builder(svcVersion, "", svcName); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredNameNull() { + + try { + @SuppressWarnings("unused") + PrincipalToken.Builder builder = new PrincipalToken.Builder(svcVersion, svcDomain, null); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredNameEmptyString() { + + try { + @SuppressWarnings("unused") + PrincipalToken.Builder builder = new PrincipalToken.Builder(svcVersion, svcDomain, ""); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderDefaultOptionalValues() { + + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName).build(); + assertEquals(token.getVersion(), svcVersion); + assertEquals(token.getDomain(), svcDomain); + assertEquals(token.getName(), svcName); + assertNull(token.getHost()); + assertNotNull(token.getSalt()); + assertEquals(token.getKeyId(), "0"); + assertNull(token.getIP()); + long timestamp = token.getTimestamp(); + assertTrue(timestamp != 0); + assertEquals(token.getExpiryTime(), timestamp + 3600); + } + + @Test + public void testBuilderAllValues() { + + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").keyService("zts").originalRequestor("athenz.ci.service").build(); + + assertEquals(token.getVersion(), svcVersion); + assertEquals(token.getDomain(), svcDomain); + assertEquals(token.getName(), svcName); + assertEquals(token.getHost(), "localhost"); + assertEquals(token.getSalt(), "salt"); + assertEquals(token.getKeyId(), "zone1"); + assertEquals(token.getIP(), "127.0.0.1"); + assertEquals(token.getKeyService(), "zts"); + assertEquals(token.getOriginalRequestor(), "athenz.ci.service"); + assertEquals(token.getTimestamp(), 36000); + assertEquals(token.getExpiryTime(), 36000 + 100); + } + + @Test + public void testUserTokenWithSingleAuthorizedService() throws InterruptedException, CryptoException { + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + + userTokenToSign.signForAuthorizedService("coretech.storage", "1", servicePrivateKeyStringK1); + + // Create a token for validation using the signed data + + PrincipalToken userTokenToValidate = new PrincipalToken(userTokenToSign.getSignedToken()); + + // Validate all input data + assertEquals(userTokenToValidate.getVersion(), usrVersion); + assertEquals(userTokenToValidate.getDomain(), usrDomain); + assertEquals(userTokenToValidate.getName(), usrName); + assertNull(userTokenToValidate.getHost()); + assertEquals(userTokenToValidate.getSalt(), salt); + assertEquals(userTokenToValidate.getAuthorizedServices(), authorizedServices); + assertEquals(userTokenToValidate.getAuthorizedServiceKeyId(), "1"); + // authorized service name must be null since there is only 1 entry + // in the authorized services list so there must be a match + assertEquals(userTokenToValidate.getAuthorizedServiceName(), null); + + // Validate the signature and that expiration time had not elapsed + assertTrue(userTokenToValidate.validateForAuthorizedService(servicePublicKeyStringK1, null)); + } + + @Test + public void testUserTokenWithMultipleAuthorizedServices() throws InterruptedException, CryptoException { + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + authorizedServices.add("media.storage"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + + userTokenToSign.signForAuthorizedService("coretech.storage", "1", servicePrivateKeyStringK1); + + // Create a token for validation using the signed data + + PrincipalToken userTokenToValidate = new PrincipalToken(userTokenToSign.getSignedToken()); + + // Validate all input data + assertEquals(userTokenToValidate.getVersion(), usrVersion); + assertEquals(userTokenToValidate.getDomain(), usrDomain); + assertEquals(userTokenToValidate.getName(), usrName); + assertNull(userTokenToValidate.getHost()); + assertEquals(userTokenToValidate.getSalt(), salt); + assertEquals(userTokenToValidate.getAuthorizedServices(), authorizedServices); + assertEquals(userTokenToValidate.getAuthorizedServiceKeyId(), "1"); + // since we have 2 authorized services, the name must be specified that + // tells us which service is signing the token + assertEquals(userTokenToValidate.getAuthorizedServiceName(), "coretech.storage"); + + // Validate the signature and that expiration time had not elapsed + StringBuilder errMsg = new StringBuilder(); + assertTrue(userTokenToValidate.validateForAuthorizedService(servicePublicKeyStringK1, errMsg)); + } + + @Test + public void testUserTokenWithNullAuthorizedService() throws InterruptedException, CryptoException { + long issueTime = System.currentTimeMillis() / 1000; + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service. we must get + // back illegal argument exception + + try { + userTokenToSign.signForAuthorizedService("coretech.storage", "0", servicePrivateKeyStringK0); + fail(); + } catch (Exception ex) { + assertEquals(ex.getClass(), IllegalArgumentException.class); + } + } + + @Test + public void testUserTokenWithInvalidAuthorizedService() throws InterruptedException, CryptoException { + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service. we must get + // back illegal argument exception because of service name mismatch + + try { + userTokenToSign.signForAuthorizedService("weather.storage", "0", servicePrivateKeyStringK0); + fail(); + } catch (Exception ex) { + assertEquals(ex.getClass(), IllegalArgumentException.class); + } + + authorizedServices.add("media.storage"); + PrincipalToken userTokenToSign2 = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign2.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service. we must get + // back illegal argument exception because of service name mismatch + + try { + userTokenToSign2.signForAuthorizedService("weather.storage", "0", servicePrivateKeyStringK0); + fail(); + } catch (Exception ex) { + assertEquals(ex.getClass(), IllegalArgumentException.class); + } + } + + @Test + public void testValidateForAuthorizedServiceInvalidSignature() throws InterruptedException, CryptoException { + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // now let's sign the token for an authorized service + + userTokenToSign.signForAuthorizedService("coretech.storage", "1", servicePrivateKeyStringK1); + + // Create a token for validation using the signed data + + PrincipalToken userTokenToValidate = new PrincipalToken(userTokenToSign.getSignedToken()); + StringBuilder errMsg = new StringBuilder(); + assertTrue(userTokenToValidate.validateForAuthorizedService(servicePublicKeyStringK1, errMsg)); + + // now let's add a couple of extra characters to the signature + + String tamperedToken = userTokenToSign.getSignedToken(); + userTokenToValidate = new PrincipalToken(tamperedToken.replace(";bs=", ";bs=ab")); + errMsg = new StringBuilder(); + assertFalse(userTokenToValidate.validateForAuthorizedService(servicePublicKeyStringK1, errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + } + + @Test + public void testValidateForAuthorizedServiceNoSignature() throws InterruptedException, CryptoException { + long issueTime = System.currentTimeMillis() / 1000; + // Create and sign token + List authorizedServices = new ArrayList<>(); + authorizedServices.add("coretech.storage"); + + PrincipalToken userTokenToSign = new PrincipalToken.Builder(usrVersion, usrDomain, usrName) + .salt(salt).issueTime(issueTime).expirationWindow(expirationTime) + .authorizedServices(authorizedServices).build(); + + userTokenToSign.sign(servicePrivateKeyStringK0); + + // Create a token for validation using the signed data without + // signing for authorized service so there won't be bs field. + + PrincipalToken userTokenToValidate = new PrincipalToken(userTokenToSign.getSignedToken()); + StringBuilder errMsg = new StringBuilder(); + assertFalse(userTokenToValidate.validateForAuthorizedService(servicePublicKeyStringK1, errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + } + + @Test + public void testIsValidAuthorizedServiceTokenStandardToken() { + + // testing standard token + + String token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;s=signature"; + PrincipalToken svcToken = new PrincipalToken(token); + StringBuilder errMsg = new StringBuilder(); + assertTrue(svcToken.isValidAuthorizedServiceToken(errMsg)); + } + + @Test + public void testIsValidAuthorizedServiceTokenValidSvcToken() { + + // testing valid service token - we have multiple cases + // to consider: + // single service entry in list + service name + + String token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature;bk=0;bn=svc1;bs=signature"; + PrincipalToken svcToken = new PrincipalToken(token); + StringBuilder errMsg = new StringBuilder(); + assertTrue(svcToken.isValidAuthorizedServiceToken(errMsg)); + + // single service entry in list + no service name + + token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature;bk=0;bs=signature"; + svcToken = new PrincipalToken(token); + assertTrue(svcToken.isValidAuthorizedServiceToken(null)); + + // multiple service entries in list + service name + + token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1,svc2;s=signature;bk=0;bn=svc1;bs=signature"; + svcToken = new PrincipalToken(token); + assertTrue(svcToken.isValidAuthorizedServiceToken(errMsg)); + } + + @Test + public void testIsValidAuthorizedServiceTokenSvcYesSigNo() { + + // we're going to test where we have an authorized service + // name but no corresponding signature + + String token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature"; + PrincipalToken svcToken = new PrincipalToken(token); + StringBuilder errMsg = new StringBuilder(); + assertFalse(svcToken.isValidAuthorizedServiceToken(errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + } + + @Test + public void testIsValidAuthorizedServiceTokenSvcNoSigYes() { + + // we're going to test where we have an authorized + // service signature but no service name + + String token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;s=signature;bk=0;bs=signature"; + PrincipalToken svcToken = new PrincipalToken(token); + StringBuilder errMsg = new StringBuilder(); + assertFalse(svcToken.isValidAuthorizedServiceToken(errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + } + + @Test + public void testIsValidAuthorizedServiceTokenUnknownSvc() { + + // we're going to test where we have both service name + // and signature but the service name is not in the + // service list (single entry) + + String token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature;bk=0;bn=svc3;bs=signature"; + PrincipalToken svcToken = new PrincipalToken(token); + StringBuilder errMsg = new StringBuilder(); + assertFalse(svcToken.isValidAuthorizedServiceToken(errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + + // service list (multiple entries) + + token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1,svc2;s=signature;bk=0;bn=svc3;bs=signature"; + svcToken = new PrincipalToken(token); + errMsg = new StringBuilder(); + assertFalse(svcToken.isValidAuthorizedServiceToken(errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + } + + @Test + public void testIsValidAuthorizedServiceTokenNoSvcNotSingle() { + + // we're going to test where we have a service list + // and signature but no service name and our list + // contains multiple entries + + String token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1,svc2;s=signature;bk=0;bs=signature"; + PrincipalToken svcToken = new PrincipalToken(token); + StringBuilder errMsg = new StringBuilder(); + assertFalse(svcToken.isValidAuthorizedServiceToken(errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + } + + @Test + public void testPrincipalTokenParserKeyService() { + + String token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;z=zms;o=athenz.ci.service;h=host1;i=1.2.3.4;s=signature"; + PrincipalToken svcToken = new PrincipalToken(token); + + assertEquals(svcToken.getKeyService(), "zms"); + assertEquals(svcToken.getOriginalRequestor(), "athenz.ci.service"); + } + + @Test + public void testPrincipalTokenGenerationKeyService() { + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").keyService("zts").originalRequestor("athenz.ci.service").build(); + token.sign(servicePrivateKeyStringK0); + + String strToken = token.getSignedToken(); + int idx = strToken.indexOf(";z=zts;"); + assertTrue(idx != -1); + + idx = strToken.indexOf(";o=athenz.ci.service;"); + assertTrue(idx != -1); + } + + @Test + public void testValidateForAuthorizedServiceIlligal() { + PrincipalToken token = new PrincipalToken("bs=signature;v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature;bk=0;bn=svc1"); + assertFalse(token.validateForAuthorizedService(null, null)); + + token = new PrincipalToken("v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1;s=signature;bk=1;bn=svc1;bs=signature"); + assertFalse(token.validateForAuthorizedService(null, null)); + + assertFalse(token.validateForAuthorizedService(servicePublicKeyStringK1, null)); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/RoleTokenTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/RoleTokenTest.java new file mode 100644 index 00000000000..3dffddf6f29 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/RoleTokenTest.java @@ -0,0 +1,478 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.token; + +import static org.testng.Assert.*; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.List; + +import org.testng.annotations.BeforeTest; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.CryptoException; + +public class RoleTokenTest { + + private final String rolVersion = "Z1"; + private final String svcDomain = "sports"; + private final String salt = "aAkjbbDMhnLX"; + private final String testKeyVersionK0 = "0"; + private final String testKeyVersionK1 = "1"; + + private final long expirationTime = 10; // 10 seconds + + private String ztsPublicKeyStringK0 = null; + private String ztsPrivateKeyStringK0 = null; + private String ztsPublicKeyStringK1 = null; + private String ztsPrivateKeyStringK1 = null; + + @BeforeTest + private void loadKeys() throws IOException { + + Path path = Paths.get("./src/test/resources/zts_public_k0.key"); + ztsPublicKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/zts_public_k1.key"); + ztsPublicKeyStringK1 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/zts_private_k0.key"); + ztsPrivateKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/zts_private_k1.key"); + ztsPrivateKeyStringK1 = new String(Files.readAllBytes(path)); + } + + private RoleToken createRoleTokenToValidate(List roles) + throws CryptoException { + // Create token and sign + RoleToken rollTokenToSign = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).expirationWindow(expirationTime).build(); + + rollTokenToSign.sign(ztsPrivateKeyStringK0); + + return new RoleToken(rollTokenToSign.getSignedToken()); + } + + private RoleToken createRoleTokenToValidate(List roles, String keyVersion) + throws CryptoException { + // Create token and sign + RoleToken rollTokenToSign = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).expirationWindow(expirationTime).keyId(keyVersion).build(); + + String privateKey = null; + if ("0".equals(keyVersion)) { + privateKey = ztsPrivateKeyStringK0; + } else if ("1".equals(keyVersion)) { + privateKey = ztsPrivateKeyStringK1; + } + + rollTokenToSign.sign(privateKey); + + return new RoleToken(rollTokenToSign.getSignedToken()); + } + + @Test + public void testRoleToken() throws InterruptedException, CryptoException { + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + roles.add("fantasy.tenant.sports.admin"); + roles.add("fantasy.tenant.sports.reader"); + roles.add("fantasy.tenant.sports.writer"); + roles.add("fantasy.tenant.sports.scanner"); + + // Create a token for validation using the signed data + RoleToken rollTokenToValidate = createRoleTokenToValidate(roles, testKeyVersionK1); + assertNotNull(rollTokenToValidate.getSignedToken()); + + // Validate all input data + assertEquals(rollTokenToValidate.getVersion(), rolVersion); + assertEquals(rollTokenToValidate.getDomain(), svcDomain); + List rolesToValidate = rollTokenToValidate.getRoles(); + assertEquals(rolesToValidate.size(), roles.size()); + assertTrue(rolesToValidate.equals(roles)); + assertEquals(rollTokenToValidate.getKeyId(), testKeyVersionK1); + + // Validate the signature and that expiration time had not elapsed + assertTrue(rollTokenToValidate.validate(ztsPublicKeyStringK1, 300)); + + // Create ServiceToken with null keyVersion which should default to 0 + rollTokenToValidate = createRoleTokenToValidate(roles); + assertEquals(rollTokenToValidate.getKeyId(), "0"); + + // Validate the signature using key(k0) and that expiration time had not elapsed + assertTrue(rollTokenToValidate.validate(ztsPublicKeyStringK0, 300)); + } + + @Test + public void testRoleToken_Expired() throws InterruptedException, + CryptoException { + // Add some roles + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + roles.add("fantasy.tenant.sports.admin"); + roles.add("fantasy.tenant.sports.reader"); + roles.add("fantasy.tenant.sports.writer"); + roles.add("fantasy.tenant.sports.scanner"); + + // Create a token for validation using the signed data + RoleToken rollTokenToValidate = createRoleTokenToValidate(roles, testKeyVersionK0); + + // Let expiration time elapse + Thread.sleep((expirationTime + 10) * 1000); + + // Validate that the expiration time has elapsed + assertFalse(rollTokenToValidate.validate(ztsPublicKeyStringK0, 300)); + } + + @Test + public void testTokenStringConstructor() { + List roles = new ArrayList(); + roles.add("storage.tenant.activator.actionmap.w"); + RoleToken rToken = new RoleToken.Builder(rolVersion, svcDomain, roles) + .salt(salt).expirationWindow(expirationTime).build(); + + rToken.sign(ztsPrivateKeyStringK0); // now its signed + String signedToken = rToken.getSignedToken(); + RoleToken sigToken1 = new RoleToken(signedToken); + assertEquals(sigToken1.getSignedToken(), signedToken); + + String unsignedTok = rToken.getUnsignedToken(); + String signature = rToken.getSignature(); + String newSignedToken = unsignedTok + ";s=" + signature; + assertEquals(newSignedToken, signedToken); + + // instantiate a Token with the unsigned token + signature + RoleToken sigToken2 = new RoleToken(newSignedToken); + assertEquals(sigToken2.getSignedToken(), signedToken); + assertEquals(sigToken2.getUnsignedToken(), unsignedTok); + assertEquals(sigToken2.getSignature(), signature); + } + + @Test + public void testEmptyToken() { + + try { + @SuppressWarnings("unused") + RoleToken token = new RoleToken(""); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testNullToken() { + + try { + @SuppressWarnings("unused") + RoleToken token = new RoleToken(null); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenWithoutSignature() { + + RoleToken token = new RoleToken("v=S1;d=coretech;r=role1,role2"); + assertEquals(token.getDomain(), "coretech"); + assertNotNull(token.getRoles()); + assertEquals(token.getVersion(), "S1"); + assertNull(token.getUnsignedToken()); + } + + @Test + public void testTokenInvalidVersionValue() { + + RoleToken token = new RoleToken("v=S1=S2;d=coretech;r=role1,role2"); + assertNull(token.getVersion()); + } + + @Test + public void testTokenDomainNull() { + + try { + @SuppressWarnings("unused") + RoleToken token = new RoleToken("v=S1;r=role1,role2;s=signature"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenDomainEmpty() { + + try { + @SuppressWarnings("unused") + RoleToken token = new RoleToken("v=S1;d=;r=role1,role2;s=signature"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenRolesNull() { + + try { + @SuppressWarnings("unused") + RoleToken token = new RoleToken("v=S1;d=coretech;s=signature"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testTokenRolesEmpty() { + + try { + @SuppressWarnings("unused") + RoleToken token = new RoleToken("v=S1;d=coretech;r=;s=signature"); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredVersionNull() { + + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + try { + @SuppressWarnings("unused") + RoleToken.Builder builder = new RoleToken.Builder(null, svcDomain, roles); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredVersionEmptyString() { + + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + try { + @SuppressWarnings("unused") + RoleToken.Builder builder = new RoleToken.Builder("", svcDomain, roles); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredDomainNull() { + + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + try { + @SuppressWarnings("unused") + RoleToken.Builder builder = new RoleToken.Builder(rolVersion, null, roles); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredDomainEmptyString() { + + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + try { + @SuppressWarnings("unused") + RoleToken.Builder builder = new RoleToken.Builder(rolVersion, "", roles); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredRoleNull() { + + try { + @SuppressWarnings("unused") + RoleToken.Builder builder = new RoleToken.Builder(rolVersion, svcDomain, null); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderRequiredRoleEmptyString() { + + List roles = new ArrayList(); + try { + @SuppressWarnings("unused") + RoleToken.Builder builder = new RoleToken.Builder(rolVersion, svcDomain, roles); + fail(); + } catch (IllegalArgumentException ex) { + assertTrue(true); + } + } + + @Test + public void testBuilderDefaultOptionalValues() { + + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + RoleToken token = new RoleToken.Builder(rolVersion, svcDomain, roles).build(); + assertEquals(token.getVersion(), rolVersion); + assertEquals(token.getDomain(), svcDomain); + assertEquals(token.getRoles(), roles); + assertNull(token.getHost()); + assertNotNull(token.getSalt()); + assertEquals(token.getKeyId(), "0"); + assertNull(token.getIP()); + long timestamp = token.getTimestamp(); + assertTrue(timestamp != 0); + assertEquals(token.getExpiryTime(), timestamp + 3600); + } + + @Test + public void testBuilderAllValues() { + + List roles = new ArrayList(); + roles.add("storage.tenant.weather.updater"); + + RoleToken token = new RoleToken.Builder(rolVersion, svcDomain, roles) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").principal("user.joe").build(); + + assertEquals(token.getVersion(), rolVersion); + assertEquals(token.getDomain(), svcDomain); + assertEquals(token.getRoles(), roles); + assertEquals(token.getHost(), "localhost"); + assertEquals(token.getSalt(), "salt"); + assertEquals(token.getKeyId(), "zone1"); + assertEquals(token.getIP(), "127.0.0.1"); + assertEquals(token.getPrincipal(), "user.joe"); + assertEquals(token.getTimestamp(), 36000); + assertEquals(token.getExpiryTime(), 36000 + 100); + } + + @Test + public void testRoleTokenWithPrincipal() { + + List roles = new ArrayList(); + roles.add("reader"); + + RoleToken token = new RoleToken.Builder(rolVersion, svcDomain, roles) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").principal("coretech.storage").build(); + token.sign(ztsPrivateKeyStringK0); + + assertTrue(token.getSignedToken().contains(";p=coretech.storage;")); + } + + @Test + public void testRoleTokenWithNullPrincipal() { + + List roles = new ArrayList(); + roles.add("reader"); + + RoleToken token = new RoleToken.Builder(rolVersion, svcDomain, roles) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").principal(null).build(); + token.sign(ztsPrivateKeyStringK0); + + assertFalse(token.getSignedToken().contains(";p=")); + } + + @Test + public void testRoleTokenWithEmptyPrincipal() { + + List roles = new ArrayList(); + roles.add("reader"); + + RoleToken token = new RoleToken.Builder(rolVersion, svcDomain, roles) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").principal("").build(); + token.sign(ztsPrivateKeyStringK0); + + assertFalse(token.getSignedToken().contains(";p=")); + } + + @Test + public void testRoleTokenWithoutPrincipal() { + + List roles = new ArrayList(); + roles.add("reader"); + + RoleToken token = new RoleToken.Builder(rolVersion, svcDomain, roles) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").build(); + token.sign(ztsPrivateKeyStringK0); + + assertFalse(token.getSignedToken().contains(";p=")); + } + + @Test + public void testRoleTokenWithProxyUser() { + + List roles = new ArrayList(); + roles.add("reader"); + + RoleToken token = new RoleToken.Builder(rolVersion, svcDomain, roles) + .issueTime(36000).expirationWindow(100).host("localhost").ip("127.0.0.1") + .salt("salt").keyId("zone1").principal("coretech.storage") + .proxyUser("user.user3").domainCompleteRoleSet(true).build(); + token.sign(ztsPrivateKeyStringK0); + + assertTrue(token.getSignedToken().contains(";proxy=user.user3;")); + assertTrue(token.getSignedToken().contains(";c=1")); + } + + @Test + public void testRoleTokenParseWithProxyUser() { + + RoleToken token = new RoleToken("v=S1;d=coretech;r=role1,role2;proxy=user.user3;c=1;s=signature"); + assertEquals(token.getDomain(), "coretech"); + assertEquals(token.getProxyUser(), "user.user3"); + assertTrue(token.getDomainCompleteRoleSet()); + } + + @Test + public void testRoleTokenParseWithoutProxyUser() { + + RoleToken token = new RoleToken("v=S1;d=coretech;r=role1,role2;s=signature"); + assertEquals(token.getDomain(), "coretech"); + assertNull(token.getProxyUser()); + assertFalse(token.getDomainCompleteRoleSet()); + } + + @Test + public void testRoleTokenHost() { + + RoleToken token = new RoleToken("v=S1;d=coretech;h=host;r=role1,role2;s=signature"); + assertEquals(token.getHost(), "host"); + assertNull(token.getProxyUser()); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/TokenTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/TokenTest.java new file mode 100644 index 00000000000..a957c12d29e --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/token/TokenTest.java @@ -0,0 +1,181 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.token; + +import static org.testng.Assert.*; + +import java.security.PublicKey; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import org.mockito.Mockito; + +import org.testng.annotations.BeforeTest; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.CryptoException; + +public class TokenTest { + + private final String svcVersion = "S1"; + private final String svcDomain = "sports"; + private final String svcName = "fantasy"; + private final String host = "somehost.somecompany.com"; + private final String salt = "saltstring"; + private final String testKeyVersionK1 = "1"; + + private final long expirationTime = 10; // 10 seconds + + private String servicePrivateKeyStringK0 = null; + private String servicePrivateKeyStringK1 = null; + + @BeforeTest + private void loadKeys() throws IOException { + + Path path = Paths.get("./src/test/resources/fantasy_private_k0.key"); + servicePrivateKeyStringK0 = new String(Files.readAllBytes(path)); + + path = Paths.get("./src/test/resources/fantasy_private_k1.key"); + servicePrivateKeyStringK1 = new String(Files.readAllBytes(path)); + } + + @Test + public void testTokenValidateNullSignature() throws CryptoException { + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).build(); + + assertFalse(token.validate(servicePrivateKeyStringK0, 3600)); + + assertFalse(token.validate(servicePrivateKeyStringK0, 3600, null)); + + StringBuilder errMsg = new StringBuilder(); + assertFalse(token.validate(servicePrivateKeyStringK0, 3600, errMsg)); + assertTrue(!errMsg.toString().isEmpty()); + } + + @Test + public void testTokenValidateNullData() throws CryptoException { + + Token token = new Token(); + assertFalse(token.validate(servicePrivateKeyStringK0, 3600)); + } + + @Test + public void testTokenValidateFutureTimeStamp() throws CryptoException { + + long timestamp = System.currentTimeMillis() / 1000 + 4200; + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).issueTime(timestamp).expirationWindow(expirationTime).build(); + token.sign(servicePrivateKeyStringK0); + + assertFalse(token.validate(servicePrivateKeyStringK0, 3600)); + + timestamp = System.currentTimeMillis() + 1000000; + token.setTimeStamp(timestamp,1000000); + PublicKey pubkey = Mockito.mock(PublicKey.class); + assertFalse(token.validate(pubkey, 3600,null)); + } + + @Test + public void testTokenValidateInvalidKey() throws CryptoException { + + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).build(); + token.sign(servicePrivateKeyStringK0); + + assertFalse(token.validate("InvalidPublicKey", 3600)); + + assertFalse(token.validate((PublicKey)null, 3600, null)); + } + + @Test + public void testTokenValidateNullKey() throws CryptoException { + + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).salt(salt).expirationWindow(expirationTime).build(); + token.sign(servicePrivateKeyStringK0); + + assertFalse(token.validate(null, 3600)); + } + + @Test + public void testTokenGetters() throws InterruptedException, CryptoException { + + long timestamp = System.currentTimeMillis() / 1000; + PrincipalToken token = new PrincipalToken.Builder(svcVersion, svcDomain, svcName) + .host(host).ip("127.0.0.1").salt(salt).issueTime(timestamp) + .keyId(testKeyVersionK1).expirationWindow(expirationTime).build(); + token.sign(servicePrivateKeyStringK1); + + // Validate all input data + assertEquals(token.getVersion(), svcVersion); + assertEquals(token.getDomain(), svcDomain); + assertEquals(token.getName(), svcName); + assertEquals(token.getHost(), host); + assertEquals(token.getSalt(), salt); + assertEquals(token.getKeyId(), testKeyVersionK1); + assertEquals(token.getIP(), "127.0.0.1"); + assertEquals(token.getTimestamp(), timestamp); + assertEquals(token.getExpiryTime(), timestamp + expirationTime); + assertNotNull(token.getSignature()); + } + + @Test + public void testGetUnsignedTokenFromSignedToken() { + String [] signedTokens = { + // this is a RoleToken + "v=Z1;d=sports;r=storage.tenant.weather.updater;p=user.joe;a=aAkjbbDMhnLX;t=1447361682;e=1447361692;k=0;i=127.0.0.1;s=IKT3MhlfxMajh9KqvNFhuJwyHQB8M9qVmgok389wmcRZ_kqMKaf72sC3.u0Qh4VlWk.DReX8y17V.qV0wnGwNPwfUBKG9SR88SL_MBvSaVHst9wQN20v.gCzFf8IXzehEFID5tjCIFAmaLEn71bCS4oKMiPEx4FtP4OdYdeL_d4", + "v=Z1;d=sports;r=storage.tenant.weather.updater,fantasy.tenant.sports.admin,fantasy.tenant.sports.reader,fantasy.tenant.sports.writer,fantasy.tenant.sports.scanner;p=coretech.storage;a=aAkjbbDMhnLX;t=1447361682;e=1447361692;k=0;i=127.0.0.1;s=C68KMYxivWqTTg8YWGc1aXUkgbgHOQDH8iRePZWY9aLUidkEQSvBkveRFi4Sap6q800Qt1GVnF6aN1OMk6YNIc_0E_xdRj9LJriS6Qq6ss79y76J_OSGSIwBXNeDWP6fq1SPW_MlUiXPE3TJojG_W8C0lwtWRppP0UZGAjzs4bc-", + // this is a PrincipalToken + "v=S1;d=cd.project;n=nfl;h=somehost.somecompany.com;a=saltvalue;t=1447361732;e=1447361742;s=NlISFQqXz1ji8zdVdGKjKZHJBloo11S.tXLo6t.GmnCt9S6c8AATzzZ2XdMeRlX2b0ykRiS0yjmrXg.grMPin3cHiB_FdLL05.w29OUBgxJr71.11_09iOoqy0ivGqyXoSO2GQbtXJfQeJ6HFHWPef1xyNV0Fswd8e6HQtyxGLA-", + "v=S1;d=cd;n=12345;h=somehost.somecompany.com;a=saltvalue;t=1447361732;e=1447361742;k=0;s=lg5JMqJb9Hd5Vd12VdC2d.Pu0TSlynGtulV7GjT9RQsSFaTsvabLPIehNT7iJczVq_POzWTA7HYRe7ZNGfGTe6P26C_qECX._ylbYVznLnZSFW3IQFMMPc2yjiE_twFgXAVtT1sWHjcf8zxK4RVij_8vziTiUrqU_ExioO019XE-", + }; + + for (String signedToken: signedTokens) { + String unsignedToken = Token.getUnsignedToken(signedToken); + assertFalse(unsignedToken == signedToken); + assertTrue(unsignedToken.length() < signedToken.length()); + assertTrue(signedToken.startsWith(unsignedToken)); + } + } + + @Test + public void testGetUnsignedTokenFromUnsignedToken() { + String [] signedTokens = { + // this is a RoleToken + "v=Z1;d=sports;r=storage.tenant.weather.updater;p=user.joe;a=aAkjbbDMhnLX;t=1447361682;e=1447361692;k=0;i=127.0.0.1", + "v=Z1;d=sports;r=storage.tenant.weather.updater,fantasy.tenant.sports.admin,fantasy.tenant.sports.reader,fantasy.tenant.sports.writer,fantasy.tenant.sports.scanner;p=coretech.storage;a=aAkjbbDMhnLX;t=1447361682;e=1447361692;k=0;i=127.0.0.1", + // this is a PrincipalToken + "v=S1;d=cd.project;n=nfl;h=somehost.somecompany.com;a=saltvalue;t=1447361732;e=1447361742", + "v=S1;d=cd;n=12345;h=somehost.somecompany.com;a=saltvalue;t=1447361732;e=1447361742;k=0", + }; + + for (String signedToken: signedTokens) { + String unsignedToken = Token.getUnsignedToken(signedToken); + assertTrue(unsignedToken == signedToken); + } + } + + @Test + public void testValidateFail() { + Token token = new Token(); + + PublicKey pubkey = null; + + assertFalse(token.validate(pubkey, 3600,null)); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/CryptoTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/CryptoTest.java new file mode 100644 index 00000000000..fafbd9f2a52 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/CryptoTest.java @@ -0,0 +1,516 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.util; + +import java.io.File; +import java.io.FileInputStream; +import java.io.IOException; +import java.lang.reflect.InvocationTargetException; +import java.lang.reflect.Method; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.NoSuchAlgorithmException; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.cert.X509Certificate; +import java.util.Date; + +import static org.testng.Assert.*; + +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.auth.util.CryptoException; +import com.yahoo.rdl.Array; +import com.yahoo.rdl.Struct; + +public class CryptoTest { + + final File rsaPrivateKey = new File("./src/test/resources/rsa_private.key"); + final File rsaPublicKey = new File("./src/test/resources/rsa_public.key"); + final File rsaPublicX590Cert = new File("./src/test/resources/rsa_public_x509.cert"); + final File rsaPublicInvalidKey = new File("./src/test/resources/rsa_public_invalid.key"); + + final File ecPrivateKey = new File("./src/test/resources/ec_private.key"); + final File ecPublicKey = new File("./src/test/resources/ec_public.key"); + final File ecPublicX509Cert = new File("./src/test/resources/ec_public_x509.cert"); + final File ecPublicInvalidKey = new File("./src/test/resources/ec_public_invalid.key"); + final File ecPrivateParamPrime256v1Key = new File("./src/test/resources/ec_private_param_prime256v1.key"); + final File ecPublicParamPrime256v1Key = new File("./src/test/resources/ec_public_param_prime256v1.key"); + final File ecPrivateParamSecp384r1Key = new File("./src/test/resources/ec_private_param_secp384r1.key"); + final File ecPublicParamSecp384r1Key = new File("./src/test/resources/ec_public_param_secp384r1.key"); + final File ecPrivateParamsKey = new File("./src/test/resources/ec_private_params.key"); + final File ecPublicParamsKey = new File("./src/test/resources/ec_public_params.key"); + final File argFile = new File("./src/test/resources/arg_file"); + + final File privateEncryptedKey = new File("./src/test/resources/private_encrypted.key"); + final String encryptedKeyPassword = "athenz"; + + final String serviceToken = "v=S1;d=coretech;n=storage;t=1234567000;e=123456800;h=localhost"; + final String serviceRSASignature = "VsUlcNozK4as1FjPbowEE_DFDD8KWpQzphadfbt_TsMoCTLFpYrMzKTu_nHKemJmEi0bbPwj7hRLrIKEFu2VjQ--"; + final String serviceECSignature = "MEQCIEBnyNCxp5GSeua3K9OenyetmVs4F68VB.Md1JRaU4OXAiBWAxlJLe74ZV4QDqapsD4FJm.MA3mv0FMcq.LEevJa0g--"; + + @Test + public void testSignVerifyRSAKey() { + + PrivateKey privateKey = Crypto.loadPrivateKey(rsaPrivateKey); + assertNotNull(privateKey); + + String signature = Crypto.sign(serviceToken, privateKey); + assertEquals(signature, serviceRSASignature); + + PublicKey publicKey = Crypto.loadPublicKey(rsaPublicKey); + assertNotNull(publicKey); + + assertTrue(Crypto.verify(serviceToken, publicKey, signature)); + } + + @Test + public void testSignVerifyRSAKey_Invalid() { + + PublicKey publicKey = Crypto.loadPublicKey(rsaPublicInvalidKey); + assertNotNull(publicKey); + + assertFalse(Crypto.verify(serviceToken, publicKey, serviceRSASignature)); + } + + @Test + public void testSignVerifyRSAKey_X509() { + + PublicKey publicKey = Crypto.loadPublicKey(rsaPublicX590Cert); + assertNotNull(publicKey); + + assertTrue(Crypto.verify(serviceToken, publicKey, serviceRSASignature)); + } + + @Test + public void testSignVerifyECKey() { + + PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateKey); + assertNotNull(privateKey); + + String signature = Crypto.sign(serviceToken, privateKey); + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicKey); + assertNotNull(publicKey); + + assertTrue(Crypto.verify(serviceToken, publicKey, signature)); + } + + @Test + public void testSignVerifyECKey_Invalid() { + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicInvalidKey); + assertNotNull(publicKey); + + assertFalse(Crypto.verify(serviceToken, publicKey, serviceECSignature)); + } + + @Test + public void testSignVerifyECKey_X509() { + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicX509Cert); + assertNotNull(publicKey); + + assertTrue(Crypto.verify(serviceToken, publicKey, serviceECSignature)); + } + + @Test + public void testLoadX509CertificateFile() { + + X509Certificate cert = Crypto.loadX509Certificate(ecPublicX509Cert); + assertNotNull(cert); + + assertEquals(cert.getSubjectX500Principal().getName(), + "CN=athenz.syncer,O=My Test Company,L=Sunnyvale,ST=CA,C=US"); + } + + @Test + public void testLoadX509CertificateString() throws IOException { + + Path path = Paths.get("src/test/resources/valid_cn_x509.cert"); + String certStr = new String(Files.readAllBytes(path)); + X509Certificate cert = Crypto.loadX509Certificate(certStr); + assertNotNull(cert); + + assertEquals(cert.getSubjectX500Principal().getName(), + "CN=athenz.syncer,O=My Test Company,L=Sunnyvale,ST=CA,C=US"); + } + + @Test + public void testLoadX509CertificateInvalid() throws IOException { + + Path path = Paths.get("src/test/resources/invalid_x509.cert"); + String certStr = new String(Files.readAllBytes(path)); + try { + Crypto.loadX509Certificate(certStr); + fail(); + } catch (CryptoException ex) { + assertTrue(true, "Caught expected CryptoException"); + } + } + + @Test + public void testLoadPrivateEncryptedKey() { + PrivateKey privateKey = Crypto.loadPrivateKey(privateEncryptedKey, encryptedKeyPassword); + assertNotNull(privateKey); + } + + @Test + public void testLoadPrivateEncryptedKeyInvalidPassword() { + + // first try with no password + + try { + Crypto.loadPrivateKey(privateEncryptedKey, null); + fail(); + } catch (CryptoException ex) { + assertTrue(ex.getMessage().contains("No password specified")); + } + + // now let's try with invalid password + + try { + Crypto.loadPrivateKey(privateEncryptedKey, "InvalidPassword"); + fail(); + } catch (CryptoException ex) { + assertTrue(true, "Invalid password specified"); + } + } + + @Test + public void testSignVerifyECParamPrime256v1Key() { + + PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateParamPrime256v1Key); + assertNotNull(privateKey); + + String signature = Crypto.sign(serviceToken, privateKey); + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicParamPrime256v1Key); + assertNotNull(publicKey); + + assertTrue(Crypto.verify(serviceToken, publicKey, signature)); + } + + @Test + public void testSignVerifyECParamsKey() { + + PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateParamsKey); + assertNotNull(privateKey); + + String signature = Crypto.sign(serviceToken, privateKey); + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicParamsKey); + assertNotNull(publicKey); + + assertTrue(Crypto.verify(serviceToken, publicKey, signature)); + } + + @Test + public void testSignVerifyECParamSecp384r1Key() { + + PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateParamSecp384r1Key); + assertNotNull(privateKey); + + String signature = Crypto.sign(serviceToken, privateKey); + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicParamSecp384r1Key); + assertNotNull(publicKey); + + assertTrue(Crypto.verify(serviceToken, publicKey, signature)); + } + + @Test + public void testSignVerifyECParamMixCurvesFail() { + + PrivateKey privateKey = Crypto.loadPrivateKey(ecPrivateParamPrime256v1Key); + assertNotNull(privateKey); + + String signature = Crypto.sign(serviceToken, privateKey); + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicParamSecp384r1Key); + assertNotNull(publicKey); + + assertFalse(Crypto.verify(serviceToken, publicKey, signature)); + } + + @Test + public void testSignVerifyECParamKeyOpenssl() { + + PublicKey publicKey = Crypto.loadPublicKey(ecPublicParamPrime256v1Key); + assertNotNull(publicKey); + + // this test case is from ysecure using openssl + + String plainText = "This is a test of the ysecure public key interface. This is only a test."; + String signature = "MEUCIBjTLIhH_Rc3fkRXJ8CvzSqkIwxXqReg7nOe_q1t_C73AiEAky4NAP.CwlYKXlto93f_JTYOQqDpZSJeTYSe80fQ5vY-"; + + assertTrue(Crypto.verify(plainText, publicKey, signature)); + } + + @Test + public void testGetSignatureAlgorithmRSA() { + try { + assertEquals(Crypto.getSignatureAlgorithm("RSA"), "SHA256withRSA"); + assertEquals(Crypto.getSignatureAlgorithm("RSA", "SHA256"), "SHA256withRSA"); + assertEquals(Crypto.getSignatureAlgorithm("RSA", "SHA1"), "SHA1withRSA"); + } catch (NoSuchAlgorithmException e) { + fail(); + } + } + + @Test + public void testGetSignatureAlgorithmEC() { + try { + assertEquals(Crypto.getSignatureAlgorithm("ECDSA"), "SHA256withECDSA"); + assertEquals(Crypto.getSignatureAlgorithm("ECDSA", "SHA256"), "SHA256withECDSA"); + assertEquals(Crypto.getSignatureAlgorithm("ECDSA", "SHA1"), "SHA1withECDSA"); + } catch (NoSuchAlgorithmException e) { + fail(); + } + } + + @Test + public void testGetSignatureAlgorithmUnknown() { + + try { + assertEquals(Crypto.getSignatureAlgorithm("DSA", "SHA256"), "SHA256withDSA"); + assertEquals(Crypto.getSignatureAlgorithm("RSA", "SHA555"), "SHA555withRSA"); + assertEquals(Crypto.getSignatureAlgorithm("ECDSA", "SHA999"), "SHA999withECDSA"); + fail(); + } catch (NoSuchAlgorithmException e) { + assertTrue(true); + } + } + + @Test + public void testGetPKCS10CertRequest() throws IOException { + + Path path = Paths.get("src/test/resources/valid.csr"); + String certStr = new String(Files.readAllBytes(path)); + + PKCS10CertificationRequest req = Crypto.getPKCS10CertRequest(certStr); + assertNotNull(req); + assertEquals(req.getSubject().toString(), "C=US,ST=CA,L=Sunnyvale,O=My Test Company,CN=athenz.syncer"); + } + + @Test + public void testGetPKCS10CertRequestInvalid() throws IOException { + + // first try with empty values + + try { + Crypto.getPKCS10CertRequest(null); + fail(); + } catch (CryptoException ex) { + assertTrue(ex.getMessage().contains("CSR is null")); + } + + try { + Crypto.getPKCS10CertRequest(""); + fail(); + } catch (CryptoException ex) { + assertTrue(ex.getMessage().contains("CSR is null")); + } + + // now let's try with invalid csr + + Path path = Paths.get("src/test/resources/invalid.csr"); + String certStr = new String(Files.readAllBytes(path)); + + try { + Crypto.getPKCS10CertRequest(certStr); + fail(); + } catch (CryptoException ex) { + assertTrue(true, "Caught expected crypto exception"); + } + } + + @Test + public void testGenerateX509Certificate() throws IOException { + + Path path = Paths.get("src/test/resources/valid.csr"); + String certStr = new String(Files.readAllBytes(path)); + + PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(certStr); + X509Certificate caCertificate = Crypto.loadX509Certificate(ecPublicX509Cert); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(privateEncryptedKey, encryptedKeyPassword); + + X509Certificate cert = Crypto.generateX509Certificate(certReq, caPrivateKey, + caCertificate, 600, false); + assertNotNull(cert); + assertEquals(cert.getIssuerX500Principal().getName(), + "CN=athenz.syncer,O=My Test Company,L=Sunnyvale,ST=CA,C=US"); + + Date notAfter = cert.getNotAfter(); + long diff = notAfter.getTime() - System.currentTimeMillis(); + assertTrue(diff <= 600 * 60 * 1000); // convert minutes to milliseconds + + System.out.println("****** Generated Certificate *********"); + System.out.println(cert.toString()); + } + + @Test + public void testGenerateX509CertificateAltNames() throws IOException { + + Path path = Paths.get("src/test/resources/csr_altnames.csr"); + String certStr = new String(Files.readAllBytes(path)); + + PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(certStr); + X509Certificate caCertificate = Crypto.loadX509Certificate(ecPublicX509Cert); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(privateEncryptedKey, encryptedKeyPassword); + + X509Certificate cert = Crypto.generateX509Certificate(certReq, caPrivateKey, + caCertificate, 600, true); + assertNotNull(cert); + + System.out.println("****** Generated Certificate With Alternative Names *********"); + System.out.println(cert.toString()); + System.out.println("PEM format:"); + System.out.println(Crypto.x509CertificateToPem(cert)); + } + + @Test + public void testGenerateX509CertificateReqPrivateKey() throws IOException { + + Path path = Paths.get("src/test/resources/valid.csr"); + String certStr = new String(Files.readAllBytes(path)); + + PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(certStr); + X509Certificate caCertificate = Crypto.loadX509Certificate(ecPublicX509Cert); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(rsaPrivateKey); + + X509Certificate cert = Crypto.generateX509Certificate(certReq, caPrivateKey, + caCertificate, 600, false); + assertNotNull(cert); + assertEquals(cert.getIssuerX500Principal().getName(), + "CN=athenz.syncer,O=My Test Company,L=Sunnyvale,ST=CA,C=US"); + } + + @Test + public void testGenerateX509CertificateInvalid() throws IOException { + + Path path = Paths.get("src/test/resources/valid.csr"); + String certStr = new String(Files.readAllBytes(path)); + + PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(certStr); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(rsaPrivateKey); + + try { + Crypto.generateX509Certificate(certReq, caPrivateKey, null, 600, true); + fail(); + } catch (CryptoException ex) { + assertTrue(true, "Caught excepted exception"); + } + } + + @Test + public void testX509CertificateToPem() { + X509Certificate cert = Crypto.loadX509Certificate(ecPublicX509Cert); + String pem = Crypto.x509CertificateToPem(cert); + assertNotNull(pem); + assertTrue(pem.contains("BEGIN CERTIFICATE"), pem); + assertTrue(pem.contains("END CERTIFICATE"), pem); + } + + @Test + public void testLoadReaderPrivateKey() throws IOException{ + try (java.io.FileReader fileReader = new java.io.FileReader(rsaPrivateKey)) { + PrivateKey privateKey = Crypto.loadPrivateKey(fileReader); + assertNotNull(privateKey); + } catch (IOException e) { + fail(); + } + } + + @Test + public void testEnDecodedFile(){ + String encoded = Crypto.encodedFile(argFile); + assertNotNull(encoded); + + String decoded = Crypto.ybase64DecodeString(encoded); + assertEquals(decoded, "check\n"); + } + + @Test + public void testEncodedFileStream() throws Exception { + try (FileInputStream in = new FileInputStream(argFile)) { + String encoded = Crypto.encodedFile(in); + assertNotNull(encoded); + + String decoded = Crypto.ybase64DecodeString(encoded); + assertEquals(decoded, "check"); + } catch (Exception e){ + fail(); + } + } + + @Test + public void testSHA256() { + byte [] checkByte = Crypto.sha256("check"); + assertNotNull(checkByte); + } + + @Test + public void testHmac() throws Exception { + Struct argData = new Struct(3); + argData.append("00", 0); + argData.append("01", 1); + argData.append("02", 2); + + String hmac = Crypto.hmac(argData, "check"); + + assertNotNull(hmac); + + boolean checkStringNum = false; + if(hmac.length() == 44){ + checkStringNum = true; + } + assertTrue(checkStringNum); + } + + @Test + public void testSign(){ + Struct argData = new Struct(3); + argData.append("00", 0); + argData.append("01", 1); + argData.append("02", 2); + + PrivateKey privateKey = Crypto.loadPrivateKey(rsaPrivateKey); + String checkSign = Crypto.sign(argData,privateKey); + + assertNotNull(checkSign); + assertEquals(checkSign.length(),88); + } + + @Test + public void testCanonical() throws NoSuchMethodException, SecurityException, IllegalAccessException, IllegalArgumentException, InvocationTargetException { + Class c = Crypto.class; + Crypto check = new Crypto(); + + Method m = c.getDeclaredMethod("canonical", Object.class ); + m.setAccessible(true); + Array p = null; + Object a = (Object) m.invoke(check, p); + assertNull(a); + Array az = new Array(); + az.add("aa"); + a = (Object) m.invoke(check, az); + assertNotNull(a); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/ValidateTest.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/ValidateTest.java new file mode 100644 index 00000000000..22eb14075ff --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/ValidateTest.java @@ -0,0 +1,78 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.util; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.Validate; + +public class ValidateTest { + + @Test + public void testPrincipalNameValidationInvalid() { + + assertFalse(Validate.principalName("user:john%doe")); + assertFalse(Validate.principalName("user.user:john.doe.")); + assertFalse(Validate.principalName("user.user.:john.doe")); + assertFalse(Validate.principalName(".user:doe")); + assertFalse(Validate.principalName(".doe")); + assertFalse(Validate.principalName(":doe")); + assertFalse(Validate.principalName("doe:")); + assertFalse(Validate.principalName("::doe")); + assertFalse(Validate.principalName("doe::")); + assertFalse(Validate.principalName("user:john:doe")); + } + + @Test + public void testPrincipalNameValidationValid() { + + assertTrue(Validate.principalName("user:doe")); + assertTrue(Validate.principalName("user:doe")); + assertTrue(Validate.principalName("user:john.doe")); + assertTrue(Validate.principalName("user.user:doe")); + assertTrue(Validate.principalName("user.user:john.doe")); + assertTrue(Validate.principalName("user:john_doe")); + assertTrue(Validate.principalName("john-doe")); + assertTrue(Validate.principalName("user:john-doe")); + } + + @Test + public void testDomainNameValidationInvalid() { + + assertFalse(Validate.domainName("domain$sub")); + assertFalse(Validate.domainName("coretech:domain")); + assertFalse(Validate.domainName("55")); + assertFalse(Validate.domainName("3com.gov")); + } + + @Test + public void testDomainNameValidationValid() { + + assertTrue(Validate.domainName("domain")); + assertTrue(Validate.domainName("domain.sub.sub")); + assertTrue(Validate.domainName("domain_")); + assertTrue(Validate.domainName("_")); + assertTrue(Validate.domainName("_test._")); + assertTrue(Validate.domainName("sub1_sub2")); + assertTrue(Validate.domainName("sub1_sub2_sub3")); + assertTrue(Validate.domainName("sub1_sub2.sub3_sub4")); + assertTrue(Validate.domainName("sub1_sub2_.sub3_sub4_")); + assertTrue(Validate.domainName("sub1_sub2_.sub3_sub4_-")); + assertTrue(Validate.domainName("domain-part")); + assertTrue(Validate.domainName("com-test.gov")); + } +} diff --git a/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/YBase64Test.java b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/YBase64Test.java new file mode 100644 index 00000000000..d62117535b8 --- /dev/null +++ b/libs/java/auth_core/src/test/java/com/yahoo/athenz/auth/util/YBase64Test.java @@ -0,0 +1,160 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.auth.util; + +import static org.testng.Assert.*; + +import java.nio.charset.StandardCharsets; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.CryptoException; +import com.yahoo.athenz.auth.util.YBase64; + +public class YBase64Test { + + final static String DOUBLE_PADDING = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRW" + + "UlLb1pJemowREFRY0RRZ0FFeSszVEJJL281SzVwUFpQS2RYdk5YSmQ2L1hYYwpoMmNUQTgyRlVlcUVFU2QxUy9nTj" + + "IrY0daRnhZOWNJYlRCL01vbDFueU9uOHFGQmpkS1JnSUM5MDlnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg--"; + final static String NO_PADDING = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRW" + + "UlLb1pJemowREFRY0RRZ0FFa2Y5UzN3Q09tQ1BvbklQWTdGZHNHU05WQlAxOQorSlBMV2dST2hOV0pOMW1qZnNLa" + + "GJvZXZjNHNxeGdlb2xQaERCLzExeVFWSVdpcFlGanlYdFJVT0pnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t"; + final static String SINGLE_PADDING = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRU" + + "JCUUFEU3dBd1NBSkJBT0lRMlY1NURmQk93VjNBMTZ1andOcStKcCtMTURrNwpKUXZldThMT3J5R1pWc25aQmxFVit" + + "za05FYTJzNzBHNmM4blBoRVJyZVBtYUQ2cjd5Wk50MGVVQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + + final static String SINGLE_PAD_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\n" + + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOIQ2V55DfBOwV3A16ujwNq+Jp+LMDk7\n" + + "JQveu8LOryGZVsnZBlEV+skNEa2s70G6c8nPhERrePmaD6r7yZNt0eUCAwEAAQ==\n" + + "-----END PUBLIC KEY-----\n"; + final static String DOUBLE_PAD_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\n" + + "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEy+3TBI/o5K5pPZPKdXvNXJd6/XXc\n" + + "h2cTA82FUeqEESd1S/gN2+cGZFxY9cIbTB/Mol1nyOn8qFBjdKRgIC909g==\n" + + "-----END PUBLIC KEY-----\n"; + final static String NO_PAD_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\n" + + "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkf9S3wCOmCPonIPY7FdsGSNVBP19\n" + + "+JPLWgROhNWJN1mjfsKhboevc4sqxgeolPhDB/11yQVIWipYFjyXtRUOJg==\n" + + "-----END PUBLIC KEY-----"; + + @Test + public void testDecodeSinglePaddingCharacter() { + byte[] data = YBase64.decode(SINGLE_PADDING.getBytes(StandardCharsets.UTF_8)); + assertEquals(new String(data, StandardCharsets.UTF_8), SINGLE_PAD_PUBLIC_KEY); + } + + @Test + public void testDecodeDoublePaddingCharacter() { + byte[] data = YBase64.decode(DOUBLE_PADDING.getBytes(StandardCharsets.UTF_8)); + assertEquals(new String(data, StandardCharsets.UTF_8), DOUBLE_PAD_PUBLIC_KEY); + } + + @Test + public void testDecodeNoPaddingCharacter() { + byte[] data = YBase64.decode(NO_PADDING.getBytes(StandardCharsets.UTF_8)); + assertEquals(new String(data, StandardCharsets.UTF_8), NO_PAD_PUBLIC_KEY); + } + + @Test + public void testEncodeSinglePaddingCharacter() { + byte[] data = YBase64.encode(SINGLE_PAD_PUBLIC_KEY.getBytes(StandardCharsets.UTF_8)); + assertEquals(new String(data, StandardCharsets.UTF_8), SINGLE_PADDING); + } + + @Test + public void testEncodeDoublePaddingCharacter() { + byte[] data = YBase64.encode(DOUBLE_PAD_PUBLIC_KEY.getBytes(StandardCharsets.UTF_8)); + assertEquals(new String(data, StandardCharsets.UTF_8), DOUBLE_PADDING); + } + + @Test + public void testEncodeNoPaddingCharacter() { + byte[] data = YBase64.encode(NO_PAD_PUBLIC_KEY.getBytes(StandardCharsets.UTF_8)); + assertEquals(new String(data, StandardCharsets.UTF_8), NO_PADDING); + } + + @Test + public void testDecodeInvalidData() { + try { + YBase64.decode(null); + fail(); + } catch (NullPointerException ex) { + } + + try { + YBase64.decode("abcde\0".getBytes()); + fail(); + } catch (CryptoException ex) { + } + + try { + YBase64.decode("a-aa".getBytes()); + fail(); + } catch (CryptoException ex) { + } + + try { + byte[] a = new byte[] {(byte)0xff,(byte)0x97,(byte)0x97,(byte)0x97}; + YBase64.decode(a); + fail(); + } catch (CryptoException ex) { + } + + try { + byte[] b = new byte[] {(byte)0x97,(byte)0xff,(byte)0x97,(byte)0x97}; + YBase64.decode(b); + fail(); + } catch (CryptoException ex) { + } + + try { + byte[] c = new byte[] {(byte)0x97,(byte)0x97,(byte)0xff,(byte)0x97}; + YBase64.decode(c); + fail(); + } catch (CryptoException ex) { + } + + try { + byte[] d = new byte[] {(byte)0x97,(byte)0x97,(byte)0x97,(byte)0xff}; + YBase64.decode(d); + fail(); + } catch (CryptoException ex) { + } + + try { + YBase64.decode("aaa-".getBytes()); + fail(); + } catch (CryptoException ex) { + } + + try { + YBase64.decode("aa--".getBytes()); + fail(); + } catch (CryptoException ex) { + } + } + + @Test + public void testEncodeInvalidData() { + try { + YBase64.encode(null); + fail(); + } catch (NullPointerException ex) { + } + + byte[] data = new byte[0]; + assertNotNull(new String(YBase64.encode(data), StandardCharsets.UTF_8)); + } +} diff --git a/libs/java/auth_core/src/test/resources/arg_file b/libs/java/auth_core/src/test/resources/arg_file new file mode 100644 index 00000000000..f03fc12c17c --- /dev/null +++ b/libs/java/auth_core/src/test/resources/arg_file @@ -0,0 +1 @@ +check diff --git a/libs/java/auth_core/src/test/resources/aws_public.crt b/libs/java/auth_core/src/test/resources/aws_public.crt new file mode 100644 index 00000000000..7f8173633c7 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/aws_public.crt @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC7TCCAq0CCQCWukjZ5V4aZzAJBgcqhkjOOAQDMFwxCzAJBgNVBAYTAlVTMRkw +FwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYD +VQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAeFw0xMjAxMDUxMjU2MTJaFw0z +ODAxMDUxMjU2MTJaMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9u +IFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNl +cnZpY2VzIExMQzCCAbcwggEsBgcqhkjOOAQBMIIBHwKBgQCjkvcS2bb1VQ4yt/5e +ih5OO6kK/n1Lzllr7D8ZwtQP8fOEpp5E2ng+D6Ud1Z1gYipr58Kj3nssSNpI6bX3 +VyIQzK7wLclnd/YozqNNmgIyZecN7EglK9ITHJLP+x8FtUpt3QbyYXJdmVMegN6P +hviYt5JH/nYl4hh3Pa1HJdskgQIVALVJ3ER11+Ko4tP6nwvHwh6+ERYRAoGBAI1j +k+tkqMVHuAFcvAGKocTgsjJem6/5qomzJuKDmbJNu9Qxw3rAotXau8Qe+MBcJl/U +hhy1KHVpCGl9fueQ2s6IL0CaO/buycU1CiYQk40KNHCcHfNiZbdlx1E9rpUp7bnF +lRa2v1ntMX3caRVDdbtPEWmdxSCYsYFDk4mZrOLBA4GEAAKBgEbmeve5f8LIE/Gf +MNmP9CM5eovQOGx5ho8WqD+aTebs+k2tn92BBPqeZqpWRa5P/+jrdKml1qx4llHW +MXrs3IgIb6+hUIB+S8dz8/mmO0bpr76RoZVCXYab2CZedFut7qc3WUH9+EUAH5mw +vSeDCOUMYQR7R9LINYwouHIziqQYMAkGByqGSM44BAMDLwAwLAIUWXBlk40xTwSw +7HX32MxXYruse9ACFBNGmdX2ZBrVNGrN9N2f6ROk0k9K + -----END CERTIFICATE----- diff --git a/libs/java/auth_core/src/test/resources/csr_altnames.csr b/libs/java/auth_core/src/test/resources/csr_altnames.csr new file mode 100644 index 00000000000..da16e91f561 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/csr_altnames.csr @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIIDEzCCAfsCAQAwUzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1OMRQwEgYDVQQH +EwtNaW5uZWFwb2xpczEhMB8GA1UECxMYRG9tYWluIENvbnRyb2wgVmFsaWRhdGVk +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs8yLsdIRsMko/PS/M1QW +/Z4cqhmQ5k/hySCYCCzVYHaqBJScuNwE0lN9gmkIPhGBXwmsrliYGlb6f8vv1rhy +tV8dPrmJBrhQAQPfIMtMBJgNN3HfusrCzDvYDSErirGxWFDOOGPunpreKwrv/5m5 +PmlOtCRY/4qyXdu+ZLCSMjRXHGrIPQp4OwvopfKT8Iqsr0jj/R9I7kMtF2ckh3kB +t80j+hG0zQIJi7ksLUdE02n9zcgdVLfXD1kwtZi5A3UL50mGVKHmDHwnWxkkcjYn +o8eN7puuku7soQSx8cso4aghG2s0Stq/0pPa5smOkKOHuVdrAcmlO9DbR4sGo9hk +/wIDAQABoHsweQYJKoZIhvcNAQkOMWwwajAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF +4DBQBgNVHREESTBHgg5rYi5leGFtcGxlLmNvbYIUaGVscGRlc2suZXhhbXBsZS5v +cmeCE3N5c3RlbXMuZXhhbXBsZS5uZXSHBMCoAQGHBMCoRQ4wDQYJKoZIhvcNAQEF +BQADggEBAIPpnW59t0YnGMEZY1kbYJiHQ/9vl1DQyfbfGfLdLN9BKq4dVYBEyYJf +IIUZ1sS3LQ35D7RQ/ZK8SBlWnVhw0kitCq1S9L8I7l3E0FhmmlbXBUo55irEo5sL +fhpF92WNGqgLItPlmIQGckOhBqgV0b/ItuCutv8Tyc6IQrexOKOeCxG/T5mfvMr9 +QjZTasasqBpqj3eXZtnd14HAreUVCWLykljBLVi0C+d6YTDmWrOg2WT1TpH8Ax0B +hyP/ANt9TiMZkkxTgTcK/NswehxLFc+kK17mHybAQqEzK4TzPcWY9qd7meYOzuIW +xIA2JaOyehPaG95J4k8zVdFpJ+Rd6FU= +-----END CERTIFICATE REQUEST----- diff --git a/libs/java/auth_core/src/test/resources/ec_private.key b/libs/java/auth_core/src/test/resources/ec_private.key new file mode 100644 index 00000000000..3bd4d875a40 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_private.key @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEICPnaShdecLr05bWB6JpkN9FsQURwsjnFfDf6NUpj9WDoAoGCCqGSM49 +AwEHoUQDQgAEjTHrARSTlPSGyVpPzcM1XLmv3xecbscCNDKeMKtx0J4BN1XZ5ul5 ++oGWL9JdnC8vf7s6IPcxOvIZtH7NFIVn+w== +-----END EC PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_private_param_prime256v1.key b/libs/java/auth_core/src/test/resources/ec_private_param_prime256v1.key new file mode 100644 index 00000000000..2cbd7451c89 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_private_param_prime256v1.key @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIOVUPQXm03iv8HSPrhhTvo3VDbcsow8k6t/SAz0U3xkAoAoGCCqGSM49 +AwEHoUQDQgAE30K6pyN44ELKYoSFPlxeWMBpoqcZ092OKhHBXOOUBo9uSmMwHq6Z +wXkHZJclrPCbK3Y4Qxf/l/YW+v0T56A8vQ== +-----END EC PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_private_param_secp384r1.key b/libs/java/auth_core/src/test/resources/ec_private_param_secp384r1.key new file mode 100644 index 00000000000..4cbb7eb1303 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_private_param_secp384r1.key @@ -0,0 +1,9 @@ +-----BEGIN EC PARAMETERS----- +BgUrgQQAIg== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MIGkAgEBBDDfyvxnpfL5PQBl1eUlQ09dkIiRkoVyY6YYJI7DiwQi3epamZye2Kt1 +FJoRbp3UrN6gBwYFK4EEACKhZANiAATVBbfnk91BwVCBykodWJQcP1wrR2h/0Jgj +Phx3TCDZB8SARxu6xwD0Z5DZQ4QsMLAKRm2TvUjULhMjU3Wc/b2xX6j5TrhdisU5 +ekZmMQCIaXYm4gzbgDXY/HaHPUaCn9I= +-----END EC PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_private_params.key b/libs/java/auth_core/src/test/resources/ec_private_params.key new file mode 100644 index 00000000000..fded1e9e310 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_private_params.key @@ -0,0 +1,13 @@ +-----BEGIN EC PARAMETERS----- +MIH3AgEBMCwGByqGSM49AQECIQD/////AAAAAQAAAAAAAAAAAAAAAP////////// +/////zBbBCD/////AAAAAQAAAAAAAAAAAAAAAP///////////////AQgWsY12Ko6 +k+ez671VdpiGvGUdBrDMU7D2O848PifSYEsDFQDEnTYIhucEk2pmeOETnSa3gZ9+ +kARBBGsX0fLhLEJH+Lzm5WOkQPJ3A32BLeszoPShOUXYmMKWT+NC4v4af5uO5+tK +fA+eFivOM1drMV7Oy7ZAaDe/UfUCIQD/////AAAAAP//////////vOb6racXnoTz +ucrC/GMlUQIBAQ== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIOVUPQXm03iv8HSPrhhTvo3VDbcsow8k6t/SAz0U3xkAoAoGCCqGSM49 +AwEHoUQDQgAE30K6pyN44ELKYoSFPlxeWMBpoqcZ092OKhHBXOOUBo9uSmMwHq6Z +wXkHZJclrPCbK3Y4Qxf/l/YW+v0T56A8vQ== +-----END EC PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_public.key b/libs/java/auth_core/src/test/resources/ec_public.key new file mode 100644 index 00000000000..e3cf117cf63 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_public.key @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjTHrARSTlPSGyVpPzcM1XLmv3xec +bscCNDKeMKtx0J4BN1XZ5ul5+oGWL9JdnC8vf7s6IPcxOvIZtH7NFIVn+w== +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_public_invalid.key b/libs/java/auth_core/src/test/resources/ec_public_invalid.key new file mode 100644 index 00000000000..5aca0dfd8ac --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_public_invalid.key @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQMDMgAE+Y+qPqI3geo2hQH8eK7Rn+YWG09T +ejZ5QFoj9fmxFrUyYhFap6XmTdJtEi8myBmW +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_public_param_prime256v1.key b/libs/java/auth_core/src/test/resources/ec_public_param_prime256v1.key new file mode 100644 index 00000000000..e36acd1cc2d --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_public_param_prime256v1.key @@ -0,0 +1,7 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE30K6pyN44ELKYoSFPlxeWMBpoqcZ +092OKhHBXOOUBo9uSmMwHq6ZwXkHZJclrPCbK3Y4Qxf/l/YW+v0T56A8vQ== +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_public_param_secp384r1.key b/libs/java/auth_core/src/test/resources/ec_public_param_secp384r1.key new file mode 100644 index 00000000000..08404424b00 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_public_param_secp384r1.key @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BgUrgQQAIg== +-----END EC PARAMETERS----- +-----BEGIN PUBLIC KEY----- +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE1QW355PdQcFQgcpKHViUHD9cK0dof9CY +Iz4cd0wg2QfEgEcbuscA9GeQ2UOELDCwCkZtk71I1C4TI1N1nP29sV+o+U64XYrF +OXpGZjEAiGl2JuIM24A12Px2hz1Ggp/S +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_public_params.key b/libs/java/auth_core/src/test/resources/ec_public_params.key new file mode 100644 index 00000000000..8ec3b5d68ff --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_public_params.key @@ -0,0 +1,12 @@ +-----BEGIN EC PARAMETERS----- +MIH3AgEBMCwGByqGSM49AQECIQD/////AAAAAQAAAAAAAAAAAAAAAP////////// +/////zBbBCD/////AAAAAQAAAAAAAAAAAAAAAP///////////////AQgWsY12Ko6 +k+ez671VdpiGvGUdBrDMU7D2O848PifSYEsDFQDEnTYIhucEk2pmeOETnSa3gZ9+ +kARBBGsX0fLhLEJH+Lzm5WOkQPJ3A32BLeszoPShOUXYmMKWT+NC4v4af5uO5+tK +fA+eFivOM1drMV7Oy7ZAaDe/UfUCIQD/////AAAAAP//////////vOb6racXnoTz +ucrC/GMlUQIBAQ== +-----END EC PARAMETERS----- +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE30K6pyN44ELKYoSFPlxeWMBpoqcZ +092OKhHBXOOUBo9uSmMwHq6ZwXkHZJclrPCbK3Y4Qxf/l/YW+v0T56A8vQ== +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/ec_public_x509.cert b/libs/java/auth_core/src/test/resources/ec_public_x509.cert new file mode 100644 index 00000000000..c412de8a3ca --- /dev/null +++ b/libs/java/auth_core/src/test/resources/ec_public_x509.cert @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE----- +MIICejCCAiKgAwIBAgIJAKxhW5mQ2i8xMAkGByqGSM49BAEwYDELMAkGA1UEBhMC +VVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTdW5ueXZhbGUxGDAWBgNVBAoTD015 +IFRlc3QgQ29tcGFueTEWMBQGA1UEAxMNYXRoZW56LnN5bmNlcjAeFw0xNjEyMDky +MjA0NTdaFw0xNzEyMDkyMjA0NTdaMGAxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJD +QTESMBAGA1UEBxMJU3Vubnl2YWxlMRgwFgYDVQQKEw9NeSBUZXN0IENvbXBhbnkx +FjAUBgNVBAMTDWF0aGVuei5zeW5jZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC +AASNMesBFJOU9IbJWk/NwzVcua/fF5xuxwI0Mp4wq3HQngE3Vdnm6Xn6gZYv0l2c +Ly9/uzog9zE68hm0fs0UhWf7o4HFMIHCMB0GA1UdDgQWBBRzUG6PZe6W5zH0hYKu +OAFCNbpU6TCBkgYDVR0jBIGKMIGHgBRzUG6PZe6W5zH0hYKuOAFCNbpU6aFkpGIw +YDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTdW5ueXZhbGUx +GDAWBgNVBAoTD015IFRlc3QgQ29tcGFueTEWMBQGA1UEAxMNYXRoZW56LnN5bmNl +coIJAKxhW5mQ2i8xMAwGA1UdEwQFMAMBAf8wCQYHKoZIzj0EAQNHADBEAiBY+KCi +NMjkPod8Cx9Iufy9sfPjohEsWtjhAhLpDDgxxgIgaaKNCn7SIWYyelqyn41VMazv +4oAZqrR8bLL/qllF0bg= +-----END CERTIFICATE----- diff --git a/libs/java/auth_core/src/test/resources/example.keytab b/libs/java/auth_core/src/test/resources/example.keytab new file mode 100644 index 00000000000..9a515641106 Binary files /dev/null and b/libs/java/auth_core/src/test/resources/example.keytab differ diff --git a/libs/java/auth_core/src/test/resources/fantasy_private_k0.key b/libs/java/auth_core/src/test/resources/fantasy_private_k0.key new file mode 100644 index 00000000000..cc7d40de644 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/fantasy_private_k0.key @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXAIBAAKBgQCu0nOEra8WmmU91u2KrDdcKRDcZn3oSwsZD/55d0bkMwEiMzfQ ++xHVRFI1PPGjhG167oRhTRKE3a3uakMGmMDM5WWcDLbLo+PHZGqUyhJrvq5BF4VW +rUWpY+rppaklBTUPY0asmlObVpFBVoujkSyxMIXmOi9qK/O+Bs0BI4jo6QIDAQAB +AoGAS0MCxF3ZgMubRlIfFZIqixyKy7e8AKM99d4y2awF8vwaQtT19JwCA2RUV+MS +zCiY0VGZ4CHEFTsyQ++vR0m/xj88HtKPu7lRh+ITZ/FrF+7YAXCo/eQoLJaqbKFa +sU33eMj1QgMETvsfs1xWmXi5reuOtsRn8nIfbFK4mrGCyFkCQQDl3vqlDdWv2cXa +er+wPmApeAkxT0AAkIUyhgYCkZHIigBFY2Y6Qq1mcFHpWIIdGbQ1HnJ53clDpI6a +KB2GPWzjAkEAwrGaI9JHZ9wxKQB9wHaFehnHhuGOBGS0/6AzNrlnfybejSo4kBkv +tTxCoVrInJqq6PYDHuUHb/7qvJLD+66owwJAHGLdttYvhiixWxp/Y2dAfr54/CLa +N3ehSyzrvxN02jvYbrkonZcwTI8gPl2Uq71J2Klq34u41+aRSY4cn0AkmwJAJS6N +5XFvOaKPsOjrGyqHaz4pINVKrgQdnQQXQ8g8v8fIkOUTUFG/Drmnb/FKhr3zDfKN +vgS3WugwJDtTOmmsyQJBAN3gJq/JMvTeg3Oiecqd/hMgKxb82JmKpzaWXPh2+lN+ +oON8z+dgMRU266fTzAflANdDx9q5tlWkrySQJ9SK0Sg= +-----END RSA PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/fantasy_private_k1.key b/libs/java/auth_core/src/test/resources/fantasy_private_k1.key new file mode 100644 index 00000000000..289cecb9f24 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/fantasy_private_k1.key @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOwIBAAJBAJx5ylKcnuRVECR2qLEbEvfoUZ787Mu9qoKn3p8azR8iZ7jG09w/ +MDryxpdUeEUjK8pBU1v+c7MKwmJPLoA4rasCAwEAAQJABt592ESR4Rou3DrtSuES +Yxmqw5z81DDeVGAEMN3fVVd+vVy16m1VLJLWpYwsmRoFlLauz0W7oRGFwoxuzSpP +oQIhAMo3hlrumTIjOrmGHdmQJGUbPWc35m3j+iMdNAlfeR47AiEAxhfbiuPtZCmx +LguI03LTpfZEHt1OIdsQXtdJHguPh1ECIH0Q7ErPKPambUqTFWEa0jeqKkbtftnW +Vz1icW2em9VDAiEAsfZrAMsl0Q93otMv+C63n+ivaD8PW3EPsvScNobSShECIQCG +GNn+Twi8sQe22pyk65yyZ0wJNm+ioTpRgg6NHJJx0w== +-----END RSA PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/fantasy_public_k0.key b/libs/java/auth_core/src/test/resources/fantasy_public_k0.key new file mode 100644 index 00000000000..0a6117fb736 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/fantasy_public_k0.key @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCu0nOEra8WmmU91u2KrDdcKRDc +Zn3oSwsZD/55d0bkMwEiMzfQ+xHVRFI1PPGjhG167oRhTRKE3a3uakMGmMDM5WWc +DLbLo+PHZGqUyhJrvq5BF4VWrUWpY+rppaklBTUPY0asmlObVpFBVoujkSyxMIXm +Oi9qK/O+Bs0BI4jo6QIDAQAB +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/fantasy_public_k1.key b/libs/java/auth_core/src/test/resources/fantasy_public_k1.key new file mode 100644 index 00000000000..3ffe0c4a55a --- /dev/null +++ b/libs/java/auth_core/src/test/resources/fantasy_public_k1.key @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJx5ylKcnuRVECR2qLEbEvfoUZ787Mu9 +qoKn3p8azR8iZ7jG09w/MDryxpdUeEUjK8pBU1v+c7MKwmJPLoA4rasCAwEAAQ== +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/host_private.key b/libs/java/auth_core/src/test/resources/host_private.key new file mode 100644 index 00000000000..5d5faa50a71 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/host_private.key @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOwIBAAJBAPZrZC1zPa5pPfZ1iqmr7gYoXhuHliRPUnyKzYbYhQezTJReH0lu +hoUWPu6qydGJnxEU2NWMCXY/8n/UFIFojF0CAwEAAQJAALfZZ+SBFoQKATDggZQV +soDlnVDs2Bg/FkvVQ4JYCOi0ZqOGjsqplvw7vfML14zPbT7g7gnFCT5TXYzO8qYB +xQIhAPzUNTbMbiQCf5leOn5tLj5imgDtFfy185wbjIt1Sx/DAiEA+YKakkhvHqBP ++cJQaBRneLt5RJXDsEB7xc3uaER4AV8CIHYApYWaDJ4J/Hwcmrh/ROIhKzfbcDOu +yLDHuuUsLY/5AiEAt+LVYHIZ0wx7ZKsc71f6WjRwz2dA7ajYj5OR3S548ykCIQCC +W9QxTqfLoDGTj3Oe5rSyDquXyOz+45hfsZCuLniQkA== +-----END RSA PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/host_public.key b/libs/java/auth_core/src/test/resources/host_public.key new file mode 100644 index 00000000000..3c715a4b69d --- /dev/null +++ b/libs/java/auth_core/src/test/resources/host_public.key @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAPZrZC1zPa5pPfZ1iqmr7gYoXhuHliRP +UnyKzYbYhQezTJReH0luhoUWPu6qydGJnxEU2NWMCXY/8n/UFIFojF0CAwEAAQ== +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/invalid.csr b/libs/java/auth_core/src/test/resources/invalid.csr new file mode 100644 index 00000000000..1c91ec5d216 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/invalid.csr @@ -0,0 +1,12 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIIC1jCCAb4CAQAwgZAxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UE +BwwLUGxheWEgVmlzdGExDjAMBgNVBAoMBVlhaG9vMQ8wDQYDVQQLDAZBdGhlbnMx +GzAZBgNVBAMMEmlhYXMuYXRoZW5zLnN5bmNlcjEgMB4GCSqGSIb3DQEJARYRaGdh +V2sByaU70NtHiwaj2GT/AgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAnrauei1l +8RjvayD7bWzHRAWQJNV6LViMDSxZ1SG/6T0+U29g8aX1cFyV6BUnkRiqpYYjFSRG +vbHddRkbqRSMQTt5ceRgiPkdFILl99xHQk4XFOi8b2I4Jdo8pKh31+4p2b/l7BaK +4Dgum7RQ8y2l53oEm+u4Kc9jA0Pu8KtA7Mvr5bBzQnHk5MIKTkDx+/HYMcaX9atD +7GSpdKm/1/NwejCq21uhBiJ6/MXjtbNp4gYqNDz9VF/QxiXHaEBh+uE91Jpw9Z2b +1yc9CSuZK/MNxnu9LtHkVjoHXMFGk+0KAbBfLFABavxmdUQPpUVbi/KuwsaWjv5k +SZZG9SYopxApdQ== +-----END CERTIFICATE REQUEST----- diff --git a/libs/java/auth_core/src/test/resources/invalid_x509.cert b/libs/java/auth_core/src/test/resources/invalid_x509.cert new file mode 100644 index 00000000000..45a6c860720 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/invalid_x509.cert @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE----- +MIIDpDCCAowCCQCSBmRz8z0ZPjANBgkqhkiG9w0BAQsFADCBljELMAkGA1UEBhMC +VVMxCzAJBgNVBAgMAkNBMRQwEgYDVQQHDAtQbGF5YSBWaXN0YTEOMAwGA1UECgwF +WWFob28xDzANBgNVBAsMBkF0aGVuczEhMB8GA1UEAwwYZGV2Lnp0cy5hdGhlbnMu +eWFob28uY29tMSAwHgYJKoZIhvcNAQkBFhFoZ2FAeWFob28taW5jLmNvbTAeFw0x +NjA1MDMyMjMwNTBaFw0xNzA5MTUyMjMwNTBaMIGQMQswCQYDVQQGEwJVUzELMAkG +A1UECAwCQdExFDASBgNVBAcMC1BsYXlhIFZpc3RhMQ4wDAYDVQQKDAVZYWhvbzEP +MA0GA1UECwwGQXRoZW5zMRswGQYDVQQDDBJpYWFzLmF0aGVucy5zeW5jZXIxIDAe +G2s0Stq/0pPa5smOkKOHuVdrAcmlO9DbR4sGo9hk/wIDAQABMA0GCSqGSIb3DQEB +CwUAA4IBAQA0wzJiYmesbpyhsDYajZpNi8+9cVj8KRApPDbL8FKjiWCV6uw6dHck +cnzt+GtBnxmMKsb9peLX0PhXdrVJ45mHOQZBx6OlOuJUa0lf7JBx1090s6l29h26 +xnruQK4r4KUgC5vwRCMF4jTnkgPmg29ZLgv/lOS0oG5jdXVQ4jia5A8Kq5NeF9e2 +xImHe841c+ovp5iLZJiX/BY26tnNHB1U7t52cqaB+7Oykvhf5yztFle0f6twUihD +0ZH9MU3dKfVvydmNL1d+xGqWjqewS2UZx0byiqFxU94HsIrSKUdzYUt6Qz0Rh+Ym +yzjOd9NVpJl62Rekkhhg6YCLiaHNII3H +-----END CERTIFICATE----- diff --git a/libs/java/auth_core/src/test/resources/jaas.conf b/libs/java/auth_core/src/test/resources/jaas.conf new file mode 100644 index 00000000000..15d8f4842ce --- /dev/null +++ b/libs/java/auth_core/src/test/resources/jaas.conf @@ -0,0 +1,14 @@ + +Client { +com.sun.security.auth.module.Krb5LoginModule required +useTicketCache=false; +}; + +Server { +com.sun.security.auth.module.Krb5LoginModule required +useKeyTab=false +storeKey=true +useTicketCache=true +principal="myserver@LOCALHOST"; +}; + diff --git a/libs/java/auth_core/src/test/resources/logback.xml b/libs/java/auth_core/src/test/resources/logback.xml new file mode 100644 index 00000000000..c4a0357b8d5 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/logback.xml @@ -0,0 +1,17 @@ + + + + + System.out + + %-4relative [%thread] %-5level %class - %msg%n + + + + + + + + + + diff --git a/libs/java/auth_core/src/test/resources/private_encrypted.key b/libs/java/auth_core/src/test/resources/private_encrypted.key new file mode 100644 index 00000000000..dbefd0227b0 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/private_encrypted.key @@ -0,0 +1,10 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIBeTAbBgkqhkiG9w0BBQMwDgQITzfDOS9/ungCAggABIIBWEc5vdvKj55j5NRs +fFmvBeF/OoTJ2/M1yClq4D3RILOzwb8HQ2EN6YtlOxzQK9r/5FXUi9sgYPi9nrHG +4pQFFpQapZ7TbIYZ1As6WXHDaju1Dt+mO5See11TV8VW6SvAk1V8mWcGnwpaqH2g +ZdGb1tmOxky0kCr31rb0mpWp6kFccvkjX+dve2K4AWS59SeK5MVdjiBFRyQ2+qga +rFp4kCn15orSc2xrkyiAXiacUvs1ixp7poJCv2y7oAcItEJ1pAjV8UHEzau0rgHq +JJhJGD6d5o1Pt4dMtQhdxOvjpPfz6d3qFHIoYNwYAtkVxHowQ8Uv0I3sXjKFwMqU +zqztXXYH23BOq+OrxDNIiqnNtbOOhrv2SE2Tn342OGd001JfgXhyJSPugztN5NvB +L5o4dPYUp1wbBBoG52nzqd44LDy1v5tyzijhlyoo+YzVwfiMHK1rb8sEwO4U +-----END ENCRYPTED PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/rsa_private.key b/libs/java/auth_core/src/test/resources/rsa_private.key new file mode 100644 index 00000000000..81f117ed93b --- /dev/null +++ b/libs/java/auth_core/src/test/resources/rsa_private.key @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOwIBAAJBANImoEeD7LU+x6x5dAnNRFtrbab2yxrDXFXdwKQxlIs2PWfLeo3X +q0e2bOU6kQDgFz/IkMN3tEyDgQ/Nv0eAbckCAwEAAQJBAJnp3lPihHhOTbG9lkYj +h6ApMzso36JvWO4upovbID9AGyzOPstX9VsAFosgL0pTAJkqDKO2lawpkBclCtkS +xj0CIQD16P1g1oIlTVk9dCmyn94ZgXpHD6RMhfhOef8xYGVaSwIhANrGBpFY9cjH +k5rZy3vRyuWpeEzs1BYD5KH94grx2su7AiEA8QRnescjjb3uzk2RJNKNk4AUwZsy +FBJmWTw3A0UQcVsCIQDZuNX0dLo2lRg6taGimkj4gs3skI0JU9qHtKjvB38d3QIf +TVbliFn82h1AtxxlWrb5yWF4PtBtFgSz2D/aHVBkVQ== +-----END RSA PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/rsa_public.key b/libs/java/auth_core/src/test/resources/rsa_public.key new file mode 100644 index 00000000000..ed64f02f408 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/rsa_public.key @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANImoEeD7LU+x6x5dAnNRFtrbab2yxrD +XFXdwKQxlIs2PWfLeo3Xq0e2bOU6kQDgFz/IkMN3tEyDgQ/Nv0eAbckCAwEAAQ== +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/rsa_public_invalid.key b/libs/java/auth_core/src/test/resources/rsa_public_invalid.key new file mode 100644 index 00000000000..7b8773224ac --- /dev/null +++ b/libs/java/auth_core/src/test/resources/rsa_public_invalid.key @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKS0oEvv+u9VDzjTOwdjaUJoBVm9ess0 +GYl/xA0nhBgz/VJSIs4IcV++5UaW+rSDTn/8k+wy0sIJiVLsBIOMFGcCAwEAAQ== +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/rsa_public_x509.cert b/libs/java/auth_core/src/test/resources/rsa_public_x509.cert new file mode 100644 index 00000000000..805615e10e5 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/rsa_public_x509.cert @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE----- +MIICfzCCAimgAwIBAgIJAMIRugkwe7mwMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV +BAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU3Vubnl2YWxlMRgwFgYDVQQK +Ew9NeSBUZXN0IENvbXBhbnkxFjAUBgNVBAMTDWF0aGVuei5zeW5jZXIwHhcNMTYx +MjA5MjE1NDQ2WhcNMTcxMjA5MjE1NDQ2WjBgMQswCQYDVQQGEwJVUzELMAkGA1UE +CBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTEYMBYGA1UEChMPTXkgVGVzdCBDb21w +YW55MRYwFAYDVQQDEw1hdGhlbnouc3luY2VyMFwwDQYJKoZIhvcNAQEBBQADSwAw +SAJBANImoEeD7LU+x6x5dAnNRFtrbab2yxrDXFXdwKQxlIs2PWfLeo3Xq0e2bOU6 +kQDgFz/IkMN3tEyDgQ/Nv0eAbckCAwEAAaOBxTCBwjAdBgNVHQ4EFgQUBi0msMNX +iC2XLpKjXPz1DMf9PoEwgZIGA1UdIwSBijCBh4AUBi0msMNXiC2XLpKjXPz1DMf9 +PoGhZKRiMGAxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU3Vu +bnl2YWxlMRgwFgYDVQQKEw9NeSBUZXN0IENvbXBhbnkxFjAUBgNVBAMTDWF0aGVu +ei5zeW5jZXKCCQDCEboJMHu5sDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA +A0EAPnVkUdicQzk1809lHNyhSqb6p+kxjC52RfI8bZ+kACOppLLCpNu3nuuh+9yT +J1U2YLjE774n48u74k7EEmvJ3A== +-----END CERTIFICATE----- diff --git a/libs/java/auth_core/src/test/resources/valid.csr b/libs/java/auth_core/src/test/resources/valid.csr new file mode 100644 index 00000000000..6c6bbd517be --- /dev/null +++ b/libs/java/auth_core/src/test/resources/valid.csr @@ -0,0 +1,8 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIIBGjCBxQIBADBgMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcT +CVN1bm55dmFsZTEYMBYGA1UEChMPTXkgVGVzdCBDb21wYW55MRYwFAYDVQQDEw1h +dGhlbnouc3luY2VyMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrvfvBgXWqWAorw +5hYJu3dpOJe0gp3nTgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwm +Yw2uMK8CAwEAAaAAMA0GCSqGSIb3DQEBBQUAA0EANa7mSdMKoQc1OZPM6qhpp2Vi +49bRxbXLvRLE9f6rbIDkvjgPenpLw2xWgOdtwYcTy9TK0PCWB6dOSk4fkN+bBQ== +-----END CERTIFICATE REQUEST----- diff --git a/libs/java/auth_core/src/test/resources/valid_cn_x509.cert b/libs/java/auth_core/src/test/resources/valid_cn_x509.cert new file mode 100644 index 00000000000..805615e10e5 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/valid_cn_x509.cert @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE----- +MIICfzCCAimgAwIBAgIJAMIRugkwe7mwMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV +BAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU3Vubnl2YWxlMRgwFgYDVQQK +Ew9NeSBUZXN0IENvbXBhbnkxFjAUBgNVBAMTDWF0aGVuei5zeW5jZXIwHhcNMTYx +MjA5MjE1NDQ2WhcNMTcxMjA5MjE1NDQ2WjBgMQswCQYDVQQGEwJVUzELMAkGA1UE +CBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTEYMBYGA1UEChMPTXkgVGVzdCBDb21w +YW55MRYwFAYDVQQDEw1hdGhlbnouc3luY2VyMFwwDQYJKoZIhvcNAQEBBQADSwAw +SAJBANImoEeD7LU+x6x5dAnNRFtrbab2yxrDXFXdwKQxlIs2PWfLeo3Xq0e2bOU6 +kQDgFz/IkMN3tEyDgQ/Nv0eAbckCAwEAAaOBxTCBwjAdBgNVHQ4EFgQUBi0msMNX +iC2XLpKjXPz1DMf9PoEwgZIGA1UdIwSBijCBh4AUBi0msMNXiC2XLpKjXPz1DMf9 +PoGhZKRiMGAxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU3Vu +bnl2YWxlMRgwFgYDVQQKEw9NeSBUZXN0IENvbXBhbnkxFjAUBgNVBAMTDWF0aGVu +ei5zeW5jZXKCCQDCEboJMHu5sDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA +A0EAPnVkUdicQzk1809lHNyhSqb6p+kxjC52RfI8bZ+kACOppLLCpNu3nuuh+9yT +J1U2YLjE774n48u74k7EEmvJ3A== +-----END CERTIFICATE----- diff --git a/libs/java/auth_core/src/test/resources/zts_private_k0.key b/libs/java/auth_core/src/test/resources/zts_private_k0.key new file mode 100644 index 00000000000..cc7d40de644 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/zts_private_k0.key @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXAIBAAKBgQCu0nOEra8WmmU91u2KrDdcKRDcZn3oSwsZD/55d0bkMwEiMzfQ ++xHVRFI1PPGjhG167oRhTRKE3a3uakMGmMDM5WWcDLbLo+PHZGqUyhJrvq5BF4VW +rUWpY+rppaklBTUPY0asmlObVpFBVoujkSyxMIXmOi9qK/O+Bs0BI4jo6QIDAQAB +AoGAS0MCxF3ZgMubRlIfFZIqixyKy7e8AKM99d4y2awF8vwaQtT19JwCA2RUV+MS +zCiY0VGZ4CHEFTsyQ++vR0m/xj88HtKPu7lRh+ITZ/FrF+7YAXCo/eQoLJaqbKFa +sU33eMj1QgMETvsfs1xWmXi5reuOtsRn8nIfbFK4mrGCyFkCQQDl3vqlDdWv2cXa +er+wPmApeAkxT0AAkIUyhgYCkZHIigBFY2Y6Qq1mcFHpWIIdGbQ1HnJ53clDpI6a +KB2GPWzjAkEAwrGaI9JHZ9wxKQB9wHaFehnHhuGOBGS0/6AzNrlnfybejSo4kBkv +tTxCoVrInJqq6PYDHuUHb/7qvJLD+66owwJAHGLdttYvhiixWxp/Y2dAfr54/CLa +N3ehSyzrvxN02jvYbrkonZcwTI8gPl2Uq71J2Klq34u41+aRSY4cn0AkmwJAJS6N +5XFvOaKPsOjrGyqHaz4pINVKrgQdnQQXQ8g8v8fIkOUTUFG/Drmnb/FKhr3zDfKN +vgS3WugwJDtTOmmsyQJBAN3gJq/JMvTeg3Oiecqd/hMgKxb82JmKpzaWXPh2+lN+ +oON8z+dgMRU266fTzAflANdDx9q5tlWkrySQJ9SK0Sg= +-----END RSA PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/zts_private_k1.key b/libs/java/auth_core/src/test/resources/zts_private_k1.key new file mode 100644 index 00000000000..5d5faa50a71 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/zts_private_k1.key @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOwIBAAJBAPZrZC1zPa5pPfZ1iqmr7gYoXhuHliRPUnyKzYbYhQezTJReH0lu +hoUWPu6qydGJnxEU2NWMCXY/8n/UFIFojF0CAwEAAQJAALfZZ+SBFoQKATDggZQV +soDlnVDs2Bg/FkvVQ4JYCOi0ZqOGjsqplvw7vfML14zPbT7g7gnFCT5TXYzO8qYB +xQIhAPzUNTbMbiQCf5leOn5tLj5imgDtFfy185wbjIt1Sx/DAiEA+YKakkhvHqBP ++cJQaBRneLt5RJXDsEB7xc3uaER4AV8CIHYApYWaDJ4J/Hwcmrh/ROIhKzfbcDOu +yLDHuuUsLY/5AiEAt+LVYHIZ0wx7ZKsc71f6WjRwz2dA7ajYj5OR3S548ykCIQCC +W9QxTqfLoDGTj3Oe5rSyDquXyOz+45hfsZCuLniQkA== +-----END RSA PRIVATE KEY----- diff --git a/libs/java/auth_core/src/test/resources/zts_public_k0.key b/libs/java/auth_core/src/test/resources/zts_public_k0.key new file mode 100644 index 00000000000..0a6117fb736 --- /dev/null +++ b/libs/java/auth_core/src/test/resources/zts_public_k0.key @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCu0nOEra8WmmU91u2KrDdcKRDc +Zn3oSwsZD/55d0bkMwEiMzfQ+xHVRFI1PPGjhG167oRhTRKE3a3uakMGmMDM5WWc +DLbLo+PHZGqUyhJrvq5BF4VWrUWpY+rppaklBTUPY0asmlObVpFBVoujkSyxMIXm +Oi9qK/O+Bs0BI4jo6QIDAQAB +-----END PUBLIC KEY----- diff --git a/libs/java/auth_core/src/test/resources/zts_public_k1.key b/libs/java/auth_core/src/test/resources/zts_public_k1.key new file mode 100644 index 00000000000..3c715a4b69d --- /dev/null +++ b/libs/java/auth_core/src/test/resources/zts_public_k1.key @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAPZrZC1zPa5pPfZ1iqmr7gYoXhuHliRP +UnyKzYbYhQezTJReH0luhoUWPu6qydGJnxEU2NWMCXY/8n/UFIFojF0CAwEAAQ== +-----END PUBLIC KEY----- diff --git a/libs/java/client_common/README.md b/libs/java/client_common/README.md new file mode 100644 index 00000000000..39636ac199b --- /dev/null +++ b/libs/java/client_common/README.md @@ -0,0 +1,12 @@ +# Athenz Common Classes + +Common libs for clients and servers + +- monitoring metrics: Metric and MetricFactory interfaces with no-op implementation +- sign utilities: Provide canonical json representation of an object being signed + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/libs/java/client_common/pom.xml b/libs/java/client_common/pom.xml new file mode 100644 index 00000000000..9eb5b648356 --- /dev/null +++ b/libs/java/client_common/pom.xml @@ -0,0 +1,43 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../../pom.xml + + + client_common + client_common + Athenz Client Common Package + jar + + + + ${project.groupId} + zms_core + ${project.parent.version} + + + ${project.groupId} + zts_core + ${project.parent.version} + + + + diff --git a/libs/java/client_common/src/main/java/com/yahoo/athenz/common/config/AthenzConfig.java b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/config/AthenzConfig.java new file mode 100644 index 00000000000..0c2b0f70551 --- /dev/null +++ b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/config/AthenzConfig.java @@ -0,0 +1,54 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.config; + +import java.util.ArrayList; + +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.yahoo.athenz.zms.PublicKeyEntry; + +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class AthenzConfig { + private String zmsUrl; + private String ztsUrl; + private ArrayList zmsPublicKeys; + private ArrayList ztsPublicKeys; + + public String getZmsUrl() { + return zmsUrl; + } + public void setZmsUrl(String zmsUrl) { + this.zmsUrl = zmsUrl; + } + public String getZtsUrl() { + return ztsUrl; + } + public void setZtsUrl(String ztsUrl) { + this.ztsUrl = ztsUrl; + } + public ArrayList getZmsPublicKeys() { + return zmsPublicKeys; + } + public void setZmsPublicKeys(ArrayList zmsPublicKeys) { + this.zmsPublicKeys = zmsPublicKeys; + } + public ArrayList getZtsPublicKeys() { + return ztsPublicKeys; + } + public void setZtsPublicKeys(ArrayList ztsPublicKeys) { + this.ztsPublicKeys = ztsPublicKeys; + } +} diff --git a/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/Metric.java b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/Metric.java new file mode 100644 index 00000000000..7ddeb35cceb --- /dev/null +++ b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/Metric.java @@ -0,0 +1,77 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.metrics; + +public interface Metric { + + /** + * Increment the counter for the specified metric + * @param metric Name of the counter + */ + public void increment(String metric); + + /** + * Increment the counter for the specified metric for the given domainName + * @param metric Name of the counter + * @param domainName Name of the domain. domainName is optional can be + * passed as null to indicate that the counter is global and not per-domain + */ + public void increment(String metric, String domainName); + + /** + * Increment the sum by the specified count for the given metric against the domainName + * @param metric Name of the counter + * @param domainName Name of the domain. domainName is optional can be + * passed as null to indicate that the counter is global and not per-domain + * @param count amount inwhich to increment the metric sum + */ + public void increment(String metric, String domainName, int count); + + /** + * Start the latency timer for the specified metric for the given domainName. + * The implementation must be able to support simultaneous handling of + * multiple timer counters (but not the same metric). It's possible that + * the application/lib started a latency timer for a metric but will not call + * the stopTiming method of the request didn't complete successfully since + * we only want to keep track of average latency time for successfully + * completed requests. + * @param metric Name of the counter + * @param domainName Name of the domain. domainName is optional can be + * passed as null to indicate that the counter is global and not per-domain + * @return timer object. The server will use this as the argument to + * the stopTiming method to indicate that the operation has completed + * and the time must be recorded for the metric. + */ + public Object startTiming(String metric, String domainName); + + /** + * Stop the latency timer for the specified metric. + * @param timerMetric timer object that was returned by the startTiming + * method call. + */ + public void stopTiming(Object timerMetric); + + /** + * Flush any buffered metrics to destination. + */ + public void flush(); + + /** + * Flush buffers and shutdown any tasks. + */ + public void quit(); +} + diff --git a/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/MetricFactory.java b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/MetricFactory.java new file mode 100644 index 00000000000..01668efba22 --- /dev/null +++ b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/MetricFactory.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.metrics; + +public interface MetricFactory { + + /** + * Create and return a new Metric instance + * @return Metric instance + */ + public Metric create(); +} + diff --git a/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/impl/NoOpMetric.java b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/impl/NoOpMetric.java new file mode 100644 index 00000000000..72ff5cd08e7 --- /dev/null +++ b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/impl/NoOpMetric.java @@ -0,0 +1,57 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.metrics.impl; + +import com.yahoo.athenz.common.metrics.Metric; + +public class NoOpMetric implements Metric { + + /** + * Constructs a new NoOpMetric object in which all methods are stubs. + * No metrics are recorded with this implementation. + */ + public NoOpMetric() { + } + + @Override + public void increment(String metric) { + } + + @Override + public void increment(String metric, String domainName) { + } + + @Override + public void increment(String metric, String domainName, int count) { + } + + @Override + public Object startTiming(String metric, String domainName) { + return null; + } + + @Override + public void stopTiming(Object timerMetric) { + } + + @Override + public void flush() { + } + + @Override + public void quit() { + } +} diff --git a/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/impl/NoOpMetricFactory.java b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/impl/NoOpMetricFactory.java new file mode 100644 index 00000000000..33c9052f0a3 --- /dev/null +++ b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/metrics/impl/NoOpMetricFactory.java @@ -0,0 +1,27 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.metrics.impl; + +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.metrics.MetricFactory; + +public class NoOpMetricFactory implements MetricFactory { + + @Override + public Metric create() { + return new NoOpMetric(); + } +} diff --git a/libs/java/client_common/src/main/java/com/yahoo/athenz/common/utils/SignUtils.java b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/utils/SignUtils.java new file mode 100644 index 00000000000..181150b32e6 --- /dev/null +++ b/libs/java/client_common/src/main/java/com/yahoo/athenz/common/utils/SignUtils.java @@ -0,0 +1,286 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.utils; + +import java.util.List; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.DomainPolicies; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zms.SignedPolicies; +import com.yahoo.athenz.zts.PolicyData; +import com.yahoo.athenz.zts.SignedPolicyData; +import com.yahoo.rdl.Array; +import com.yahoo.rdl.Struct; + +public class SignUtils { + + private static final String ATTR_MODIFIED = "modified"; + private static final String ATTR_POLICIES = "policies"; + private static final String ATTR_DOMAIN = "domain"; + private static final String ATTR_EXPIRES = "expires"; + private static final String ATTR_POLICY_DATA = "policyData"; + private static final String ATTR_ZMS_SIGNATURE = "zmsSignature"; + private static final String ATTR_ZMS_KEY_ID = "zmsKeyId"; + private static final String ATTR_MEMBERS = "members"; + private static final String ATTR_NAME = "name"; + private static final String ATTR_ROLE = "role"; + private static final String ATTR_SERVICES = "services"; + private static final String ATTR_ID = "id"; + private static final String ATTR_PUBLIC_KEYS = "publicKeys"; + private static final String ATTR_ACCOUNT = "account"; + private static final String ATTR_PRODUCT_ID = "ypmId"; + private static final String ATTR_EFFECT = "effect"; + private static final String ATTR_ACTION = "action"; + private static final String ATTR_RESOURCE = "resource"; + private static final String ATTR_ASSERTIONS = "assertions"; + private static final String ATTR_EXECUTABLE = "executable"; + private static final String ATTR_TRUST = "trust"; + private static final String ATTR_GROUP = "group"; + private static final String ATTR_PROVIDER_ENDPOINT = "providerEndpoint"; + private static final String ATTR_USER = "user"; + private static final String ATTR_HOSTS = "hosts"; + private static final String ATTR_KEY = "key"; + private static final String ATTR_ROLES = "roles"; + private static final String ATTR_SIGNATURE = "signature"; + private static final String ATTR_KEYID = "keyId"; + private static final String ATTR_CONTENTS = "contents"; + + private static Struct asStruct(DomainPolicies domainPolicies) { + Struct struct = new Struct(); + struct.append(ATTR_DOMAIN, domainPolicies.getDomain()); + Array policiesArray = new Array(); + for (Policy policy : domainPolicies.getPolicies()) { + policiesArray.add(asStruct(policy)); + } + appendArray(struct, ATTR_POLICIES, policiesArray); + return struct; + } + + private static Struct asStruct(Policy policy) { + Struct struct = new Struct(); + struct.append(ATTR_NAME, policy.getName()); + struct.append(ATTR_MODIFIED, policy.getModified()); + List assertions = policy.getAssertions(); + if (assertions != null) { + Array assertionsArray = new Array(); + for (Assertion assertion : assertions) { + Struct structAssertion = new Struct(); + appendObject(structAssertion, ATTR_EFFECT, assertion.getEffect()); + structAssertion.append(ATTR_ACTION, assertion.getAction()); + structAssertion.append(ATTR_RESOURCE, assertion.getResource()); + structAssertion.append(ATTR_ROLE, assertion.getRole()); + assertionsArray.add(structAssertion); + } + appendArray(struct, ATTR_ASSERTIONS, assertionsArray); + } + return struct; + } + + private static Struct asStruct(com.yahoo.athenz.zts.Policy policy) { + Struct struct = new Struct(); + struct.append(ATTR_NAME, policy.getName()); + struct.append(ATTR_MODIFIED, policy.getModified()); + List assertions = policy.getAssertions(); + if (assertions != null) { + Array assertionsArray = new Array(); + for (com.yahoo.athenz.zts.Assertion assertion : assertions) { + Struct structAssertion = new Struct(); + appendObject(structAssertion, ATTR_EFFECT, assertion.getEffect()); + structAssertion.append(ATTR_ACTION, assertion.getAction()); + structAssertion.append(ATTR_RESOURCE, assertion.getResource()); + structAssertion.append(ATTR_ROLE, assertion.getRole()); + assertionsArray.add(structAssertion); + } + appendArray(struct, ATTR_ASSERTIONS, assertionsArray); + } + return struct; + } + + private static Struct asStruct(Role role) { + Struct struct = new Struct(); + struct.append(ATTR_NAME, role.getName()); + struct.append(ATTR_MODIFIED, role.getModified()); + appendObject(struct, ATTR_TRUST, role.getTrust()); + appendList(struct, ATTR_MEMBERS, role.getMembers()); + return struct; + } + + private static Struct asStruct(ServiceIdentity service) { + Struct struct = new Struct(); + struct.append(ATTR_NAME, service.getName()); + struct.append(ATTR_MODIFIED, service.getModified()); + appendObject(struct, ATTR_EXECUTABLE, service.getExecutable()); + appendObject(struct, ATTR_GROUP, service.getGroup()); + appendObject(struct, ATTR_PROVIDER_ENDPOINT, service.getProviderEndpoint()); + appendObject(struct, ATTR_USER, service.getUser()); + appendList(struct, ATTR_HOSTS, service.getHosts()); + List publicKeys = service.getPublicKeys(); + if (publicKeys != null) { + Array publicKeysArray = new Array(); + for (PublicKeyEntry publicKey : publicKeys) { + Struct structPublicKey = new Struct(); + structPublicKey.append(ATTR_ID, publicKey.getId()); + structPublicKey.append(ATTR_KEY, publicKey.getKey()); + publicKeysArray.add(structPublicKey); + } + appendArray(struct, ATTR_PUBLIC_KEYS, publicKeysArray); + } + return struct; + } + + private static void appendList(Struct struct, String name, List list) { + if (list == null) { + return; + } + Array items = new Array(); + for (String item : list) { + items.add(item); + } + appendArray(struct, name, items); + } + + private static void appendObject(Struct struct, String name, Object value) { + if (value == null) { + return; + } + if (value instanceof Struct) { + struct.append(name, value); + } else if (value instanceof String) { + struct.append(name, value); + } else { + struct.append(name, value.toString()); + } + } + + private static void appendArray(Struct struct, String name, Array array) { + if (array != null && !array.isEmpty()) { + struct.append(name, array); + } + } + + private static Object asStruct(PolicyData policyData) { + Struct struct = new Struct(); + struct.append(ATTR_DOMAIN, policyData.getDomain()); + List policies = policyData.getPolicies(); + if (policies != null) { + Array policiesArray = new Array(); + for (com.yahoo.athenz.zts.Policy policy : policies) { + policiesArray.add(asStruct(policy)); + } + appendArray(struct, ATTR_POLICIES, policiesArray); + } + return struct; + } + + private static Object asStruct(SignedPolicyData signedPolicyData) { + Struct struct = new Struct(); + struct.append(ATTR_MODIFIED, signedPolicyData.getModified()); + struct.append(ATTR_EXPIRES, signedPolicyData.getExpires()); + struct.append(ATTR_ZMS_KEY_ID, signedPolicyData.getZmsKeyId()); + struct.append(ATTR_ZMS_SIGNATURE, signedPolicyData.getZmsSignature()); + struct.append(ATTR_POLICY_DATA, asStruct(signedPolicyData.getPolicyData())); + return struct; + } + + private static Struct asStruct(DomainData domainData) { + Struct struct = new Struct(); + struct.append(ATTR_MODIFIED, domainData.getModified()); + appendObject(struct, ATTR_ACCOUNT, domainData.getAccount()); + appendObject(struct, ATTR_PRODUCT_ID, domainData.getYpmId()); + if (domainData.getRoles() != null) { + Array structRoles = new Array(); + for (Role role : domainData.getRoles()) { + structRoles.add(asStruct(role)); + } + appendArray(struct, ATTR_ROLES, structRoles); + } + if (domainData.getServices() != null) { + Array structServices = new Array(); + for (ServiceIdentity service : domainData.getServices()) { + structServices.add(asStruct(service)); + } + appendArray(struct, ATTR_SERVICES, structServices); + } + SignedPolicies signedPolicies = domainData.getPolicies(); + if (signedPolicies != null) { + Struct structSignedPolicies = new Struct(); + appendObject(structSignedPolicies, ATTR_SIGNATURE, signedPolicies.getSignature()); + appendObject(structSignedPolicies, ATTR_KEYID, signedPolicies.getKeyId()); + appendObject(structSignedPolicies, ATTR_CONTENTS, asStruct(signedPolicies.getContents())); + struct.append(ATTR_POLICIES, structSignedPolicies); + } + return struct; + } + + private static void appendSeparator(StringBuilder strBuffer) { + // if we have more than a single character + // (which is our initial {/[ character) + // in our buffer then we need to separate + // the item with a comma + if (strBuffer.length() != 1) { + strBuffer.append(','); + } + } + + private static String asCanonicalString(Object obj) { + StringBuilder strBuffer = new StringBuilder(); + if (obj instanceof Struct) { + Struct struct = (Struct) obj; + strBuffer.append('{'); + for (String name : struct.sortedNames()) { + appendSeparator(strBuffer); + strBuffer.append('"'); + strBuffer.append(name); + strBuffer.append("\":"); + strBuffer.append(asCanonicalString(struct.get(name))); + } + strBuffer.append('}'); + } else if (obj instanceof Array) { + strBuffer.append('['); + for (Object item : (Array) obj) { + appendSeparator(strBuffer); + strBuffer.append(asCanonicalString(item)); + } + strBuffer.append(']'); + } else if (obj instanceof String) { + strBuffer.append('"'); + strBuffer.append(obj); + strBuffer.append('"'); + } + return strBuffer.toString(); + } + + public static String asCanonicalString(PolicyData policyData) { + return asCanonicalString(asStruct(policyData)); + } + + public static String asCanonicalString(DomainData domainData) { + return asCanonicalString(asStruct(domainData)); + } + + public static String asCanonicalString(DomainPolicies domainPolicies) { + return asCanonicalString(asStruct(domainPolicies)); + } + + public static String asCanonicalString(SignedPolicyData signedPolicyData) { + return asCanonicalString(asStruct(signedPolicyData)); + } +} diff --git a/libs/java/client_common/src/test/java/com/yahoo/athenz/common/config/AthenzConfigTest.java b/libs/java/client_common/src/test/java/com/yahoo/athenz/common/config/AthenzConfigTest.java new file mode 100644 index 00000000000..a58d1421dac --- /dev/null +++ b/libs/java/client_common/src/test/java/com/yahoo/athenz/common/config/AthenzConfigTest.java @@ -0,0 +1,65 @@ +package com.yahoo.athenz.common.config; + +import static org.testng.Assert.*; + +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import java.util.ArrayList; + +import com.yahoo.athenz.zms.PublicKeyEntry; + +public class AthenzConfigTest { + + AthenzConfig chk_config = new AthenzConfig(); + + @Mock + ArrayList chk_zmsPubkey; + @Mock + ArrayList chk_ztsPubkey; + + @BeforeMethod + public void setUp(){ + MockitoAnnotations.initMocks(this); + } + + @Test + public void testZmsUrl(){ + String chk_zmsUrl = "check_zmsUrl"; + + chk_config.setZmsUrl(chk_zmsUrl); + + String check = chk_config.getZmsUrl(); + assertNotNull(check); + assertEquals(check,"check_zmsUrl"); + } + + @Test + public void testZtsUrl(){ + String chk_ztsUrl = "check_ztsUrl"; + + chk_config.setZtsUrl(chk_ztsUrl); + + String check = chk_config.getZtsUrl(); + assertNotNull(check); + assertEquals(check,"check_ztsUrl"); + } + + @Test + public void testZmsPrivateKey() { + chk_config.setZmsPublicKeys(chk_zmsPubkey); + + ArrayList check = chk_config.getZmsPublicKeys(); + assertNotNull(check); + } + + @Test + public void testZtsPrivateKey() { + chk_config.setZtsPublicKeys(chk_ztsPubkey); + + ArrayList check = chk_config.getZtsPublicKeys(); + assertNotNull(check); + } +} diff --git a/libs/java/client_common/src/test/java/com/yahoo/athenz/common/metrics/impl/MetricsTest.java b/libs/java/client_common/src/test/java/com/yahoo/athenz/common/metrics/impl/MetricsTest.java new file mode 100644 index 00000000000..7c6f519282d --- /dev/null +++ b/libs/java/client_common/src/test/java/com/yahoo/athenz/common/metrics/impl/MetricsTest.java @@ -0,0 +1,35 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.metrics.impl; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.metrics.MetricFactory; +import com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory; + +public class MetricsTest { + + @Test + public void testFactoryNoOpMetric() throws Exception { + + MetricFactory factory = new NoOpMetricFactory(); + Metric metric = factory.create(); + + assertEquals(metric.getClass().getName(), Class.forName("com.yahoo.athenz.common.metrics.impl.NoOpMetric").getName()); + } +} diff --git a/libs/java/client_common/src/test/java/com/yahoo/athenz/common/utils/SignUtilsTest.java b/libs/java/client_common/src/test/java/com/yahoo/athenz/common/utils/SignUtilsTest.java new file mode 100644 index 00000000000..3af75d2935a --- /dev/null +++ b/libs/java/client_common/src/test/java/com/yahoo/athenz/common/utils/SignUtilsTest.java @@ -0,0 +1,165 @@ +package com.yahoo.athenz.common.utils; + +import static org.testng.Assert.*; + +import java.util.ArrayList; +import java.util.List; + +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.DomainPolicies; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zms.SignedPolicies; +import com.yahoo.athenz.zts.PolicyData; +import com.yahoo.athenz.zts.SignedPolicyData; + +public class SignUtilsTest { + + @Mock + PolicyData mockPolicy; + @Mock + DomainData mockDomain; + @Mock + DomainPolicies mockPolicies; + @Mock + SignedPolicyData mockSignedPolicy; + + SignUtils chk_utils = new SignUtils(); + + @BeforeMethod + public void setUp(){ + MockitoAnnotations.initMocks(this); + } + + @Test + public void testAsCanonicalStringPolicyData() { + Mockito.when(mockPolicy.getPolicies()).thenReturn(null); + + String check = SignUtils.asCanonicalString(mockPolicy); + assertNotNull(check); + assertEquals(check,"{\"domain\":}"); + } + + @Test + public void testAsCanonicalStringDomainData() { + Mockito.when(mockDomain.getRoles()).thenReturn(null); + Mockito.when(mockDomain.getServices()).thenReturn(null); + + String check = SignUtils.asCanonicalString(mockDomain); + assertNotNull(check); + assertEquals(check,"{\"modified\":,\"ypmId\":\"0\"}"); + } + + @Test + public void testAsCanonicalStringDomainPolicies() { + String check = SignUtils.asCanonicalString(mockPolicies); + assertNotNull(check); + assertEquals(check,"{\"domain\":}"); + } + + @Test + public void testAsCanonicalStringSignedPolicyData() { + Mockito.when(mockSignedPolicy.getPolicyData()).thenReturn(mockPolicy); + + String check = SignUtils.asCanonicalString(mockSignedPolicy); + assertNotNull(check); + assertEquals(check,"{\"expires\":,\"modified\":,\"policyData\":{\"domain\":},\"zmsKeyId\":,\"zmsSignature\":}"); + } + + @Test + public void testAsStructPolicy() { + List policies = new ArrayList(); + Policy mPolicy = Mockito.mock(Policy.class); + policies.add(mPolicy); + + List assertions = new ArrayList(); + Assertion mAssertion = Mockito.mock(Assertion.class); + assertions.add(mAssertion); + + Mockito.when(mockPolicies.getPolicies()).thenReturn(policies); + Mockito.when(mPolicy.getAssertions()).thenReturn(assertions); + + String check = SignUtils.asCanonicalString(mockPolicies); + assertNotNull(check); + assertEquals(check,"{\"domain\":,\"policies\":[{\"assertions\":[{\"action\":,\"resource\":,\"role\":}],\"modified\":,\"name\":}]}"); + + Mockito.when(mPolicy.getAssertions()).thenReturn(null); + + check = SignUtils.asCanonicalString(mockPolicies); + assertNotNull(check); + assertEquals(check,"{\"domain\":,\"policies\":[{\"modified\":,\"name\":}]}"); + } + + @Test + public void testAsStructZTSPolicy() { + List policies = new ArrayList(); + com.yahoo.athenz.zts.Policy mPolicy = Mockito.mock(com.yahoo.athenz.zts.Policy.class); + policies.add(mPolicy); + + List assertions = new ArrayList(); + com.yahoo.athenz.zts.Assertion mAssertion = Mockito.mock(com.yahoo.athenz.zts.Assertion.class); + assertions.add(mAssertion); + + Mockito.when(mockPolicy.getPolicies()).thenReturn(policies); + Mockito.when(mPolicy.getAssertions()).thenReturn(assertions); + + String check = SignUtils.asCanonicalString(mockPolicy); + assertNotNull(check); + assertEquals(check,"{\"domain\":,\"policies\":[{\"assertions\":[{\"action\":,\"resource\":,\"role\":}],\"modified\":,\"name\":}]}"); + + Mockito.when(mPolicy.getAssertions()).thenReturn(null); + + check = SignUtils.asCanonicalString(mockPolicy); + assertNotNull(check); + assertEquals(check,"{\"domain\":,\"policies\":[{\"modified\":,\"name\":}]}"); + } + + @Test + public void testAsStructRoleService() { + List roles = new ArrayList(); + Role mRole = Mockito.mock(Role.class); + roles.add(mRole); + + List items = new ArrayList(); + String item = "check_item"; + items.add(item); + + List services = new ArrayList(); + ServiceIdentity mService = Mockito.mock(ServiceIdentity.class); + services.add(mService); + + List publicKeys = new ArrayList(); + PublicKeyEntry mPublicKey = Mockito.mock(PublicKeyEntry.class); + publicKeys.add(mPublicKey); + + SignedPolicies signedPolicies = Mockito.mock(SignedPolicies.class); + + Mockito.when(mockDomain.getAccount()).thenReturn("chk_string"); + Mockito.when(mockDomain.getRoles()).thenReturn(roles); + Mockito.when(mRole.getMembers()).thenReturn(items); + Mockito.when(mockDomain.getServices()).thenReturn(services); + Mockito.when(mService.getHosts()).thenReturn(null); + Mockito.when(mService.getPublicKeys()).thenReturn(publicKeys); + Mockito.when(mockDomain.getPolicies()).thenReturn(signedPolicies); + Mockito.when(signedPolicies.getContents()).thenReturn(mockPolicies); + + String check = SignUtils.asCanonicalString(mockDomain); + assertNotNull(check); + assertEquals(check,"{\"account\":\"chk_string\",\"modified\":,\"policies\":{\"contents\":{\"domain\":}},\"roles\":[{\"members\":[\"check_item\"],\"modified\":,\"name\":}],\"services\":[{\"modified\":,\"name\":,\"publicKeys\":[{\"id\":,\"key\":}]}],\"ypmId\":\"0\"}"); + + Mockito.when(mService.getPublicKeys()).thenReturn(null); + + check = SignUtils.asCanonicalString(mockDomain); + assertNotNull(check); + assertEquals(check,"{\"account\":\"chk_string\",\"modified\":,\"policies\":{\"contents\":{\"domain\":}},\"roles\":[{\"members\":[\"check_item\"],\"modified\":,\"name\":}],\"services\":[{\"modified\":,\"name\":}],\"ypmId\":\"0\"}"); + } +} diff --git a/libs/java/client_common/src/test/resources/logback.xml b/libs/java/client_common/src/test/resources/logback.xml new file mode 100644 index 00000000000..c4a0357b8d5 --- /dev/null +++ b/libs/java/client_common/src/test/resources/logback.xml @@ -0,0 +1,17 @@ + + + + + System.out + + %-4relative [%thread] %-5level %class - %msg%n + + + + + + + + + + diff --git a/libs/java/server_common/README.md b/libs/java/server_common/README.md new file mode 100644 index 00000000000..ccdd05a3f5f --- /dev/null +++ b/libs/java/server_common/README.md @@ -0,0 +1,15 @@ +Athenz Server Common Classes +============================ + +Common classes used throughout Athenz Server components. + +- logging classes: access, audit, et al +- filter classes: health and etag +- debug authorities (Kerberos, Principal, and Role) used by both ZMS and ZTS Servers. +- utils: StringUtils + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/libs/java/server_common/pom.xml b/libs/java/server_common/pom.xml new file mode 100644 index 00000000000..7b7bd5dde6a --- /dev/null +++ b/libs/java/server_common/pom.xml @@ -0,0 +1,108 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../../pom.xml + + + server_common + server_common + Athenz Server Common Packages + jar + + + + ${project.groupId} + auth_core + ${project.parent.version} + + + org.glassfish.jersey.containers + jersey-container-jdk-http + ${jersey.version} + true + + + org.glassfish.jersey.containers + jersey-container-servlet + ${jersey.version} + true + + + org.glassfish.jersey.media + jersey-media-json-jackson + ${jersey.version} + + + com.fasterxml.jackson.core + jackson-annotations + + + + + org.glassfish.jersey.core + jersey-client + ${jersey.version} + + + org.glassfish.jersey.core + jersey-common + ${jersey.version} + + + org.bouncycastle + bcpkix-jdk15on + ${bouncycastle.version} + + + com.fasterxml.jackson.core + jackson-databind + ${jackson.version} + + + com.fasterxml.jackson.core + jackson-annotations + + + + + com.fasterxml.jackson.jaxrs + jackson-jaxrs-json-provider + ${jackson.version} + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + com.fasterxml.jackson.core + jackson-databind + + + + + org.eclipse.jetty + jetty-servlet + ${jetty.version} + + + + diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugKerberosAuthority.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugKerberosAuthority.java new file mode 100644 index 00000000000..a2cb7513877 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugKerberosAuthority.java @@ -0,0 +1,82 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * An example com.yahoo.rest.Authority implementation that uses Kerberos ticket without real validation. + * This makes it easy to fake tickets for arbitrary users to test many different users. + * THIS IS FOR TESTING ONLY + */ +public class DebugKerberosAuthority implements Authority { + + private static final Logger LOG = LoggerFactory.getLogger(DebugKerberosAuthority.class); + + static final String KRB_HEADER = "Authorization"; + static final String TOKEN_PREFIX = "Negotiate"; + static final String USER_DOMAIN = "user"; + + // for setting default debug user name to be used in returned Principals + public static final String ATHENZ_PROP_USER_NAME = "athenz.common.server.debug.krb_tkt_user_name"; + public static final String ATHENZ_PROP_USER_DOMAIN = "athenz.user_domain"; + + // if Authorization header contains fake ticket with debug field, then use + // the suffix as the user name + // ex: "Negotiate debug:jamesdean" + // The user name returned in the principal would be "jamesdean" + static final String TOKEN_DEBUG_USER_FIELD = "debug:"; + + String defaultUserName = "anonymous"; + String userDomain = USER_DOMAIN; + + public String getDomain() { + return userDomain; + } + + public String getHeader() { + return KRB_HEADER; + }; + + public Principal authenticate(String creds, String remoteAddr, String httpMethod, StringBuilder errMsg) { + String uname = defaultUserName; + if (creds == null) { + LOG.debug("DebugKerberosAuthority:authenticate: Missing ticket"); + return null; + } else if (creds.startsWith(TOKEN_PREFIX) == false) { + LOG.debug("DebugKerberosAuthority:authenticate: bad format: Missing prefix=" + TOKEN_PREFIX + " in ticket=" + creds); + return null; + } else { + creds = creds.substring(TOKEN_PREFIX.length()).trim(); + if (creds.startsWith(TOKEN_DEBUG_USER_FIELD)) { + uname = creds.substring(TOKEN_DEBUG_USER_FIELD.length()).trim(); + } + } + return SimplePrincipal.create(getDomain(), uname, creds, this); + } + + @Override + public void initialize() { + defaultUserName = System.getProperty(ATHENZ_PROP_USER_NAME, "anonymous"); + userDomain = System.getProperty(ATHENZ_PROP_USER_DOMAIN, USER_DOMAIN); + } +} + diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugPrincipalAuthority.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugPrincipalAuthority.java new file mode 100644 index 00000000000..4d2dcda23ad --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugPrincipalAuthority.java @@ -0,0 +1,94 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.AuthorityKeyStore; +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +//this class does not verify the signature. +//to do that, it would need to get the public key from ZMS +public class DebugPrincipalAuthority implements Authority, AuthorityKeyStore { + + private static final Logger LOG = LoggerFactory.getLogger(DebugPrincipalAuthority.class); + private final String headerName = System.getProperty(PrincipalAuthority.ATHENZ_PROP_PRINCIPAL_HEADER, PrincipalAuthority.HTTP_HEADER); + + public String getDomain() { + return null; //services *are* a domain + } + + public String getHeader() { + return headerName; + } + + public Principal authenticate(String nToken, String remoteAddr, String httpMethod, StringBuilder errMsg) { + + if (nToken == null) { + if (LOG.isInfoEnabled()) { + LOG.info("Token was not specified for authentication"); + } + + return null; + } + + if (LOG.isInfoEnabled()) { + LOG.info("Principal Authority: authenticating token: " + nToken); + } + + String domainName = null; + String serviceName = null; + if (nToken.indexOf(';') > 0) { + for (String item : nToken.split(";")) { + String [] kv = item.split("="); + if (kv.length == 2) { + if ("d".equals(kv[0])) { + domainName = kv[1]; + } else if ("n".equals(kv[0])) { + serviceName = kv[1]; + } + } + } + } + + if (domainName == null || serviceName == null) { + if (LOG.isInfoEnabled()) { + LOG.info("Unable to extract domain or service names"); + } + + return null; + } + String fullName = domainName + "." + serviceName; + if (LOG.isInfoEnabled()) { + LOG.info("[debug-authenticated: " + fullName + "]"); + } + + return SimplePrincipal.create(domainName, serviceName, nToken, 0, this); + } + + @Override + public void initialize() { + } + + @Override + public void setKeyStore(KeyStore keyStore) { + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugRoleAuthority.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugRoleAuthority.java new file mode 100644 index 00000000000..8943b43ef5c --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugRoleAuthority.java @@ -0,0 +1,92 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.AuthorityKeyStore; +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.RoleAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; + +import java.util.Arrays; +import java.util.List; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +//this class does not verify the signature or the expiration times, +//just extracts what it needs for debugging purposes. +public class DebugRoleAuthority implements Authority, AuthorityKeyStore { + + private static final Logger LOG = LoggerFactory.getLogger(DebugRoleAuthority.class); + private final String headerName = System.getProperty(RoleAuthority.ATHENZ_PROP_ROLE_HEADER, RoleAuthority.HTTP_HEADER); + + public String getDomain() { + return null; //the domain is part of the principal for roles + } + + public String getHeader() { + return headerName; + } + + public Principal authenticate(String zToken, String remoteAddr, String httpMethod, StringBuilder errMsg) { + if (zToken == null) { + return null; + } + String domainName = null; + String roleNames = null; + String version = null; + if (zToken.indexOf(';') > 0) { + for (String item : zToken.split(";")) { + String [] kv = item.split("="); + if (kv.length == 2) { + if ("d".equals(kv[0])) { + domainName = kv[1]; + } else if ("r".equals(kv[0])) { + roleNames = kv[1]; + } else if ("v".equals(kv[0])) { + version = kv[1]; + } + } + } + } + if (!"Z1".equals(version)) { + return null; + } + if (domainName == null || roleNames == null) { + return null; + } + + //Expiration is not checked in this debugging class. + + List roles = Arrays.asList(roleNames.split(",")); + Principal p = SimplePrincipal.create(domainName, zToken, roles, this); + if (LOG.isInfoEnabled()) { + LOG.info("[debug-authenticated: '" + p + "']"); + } + + return p; + } + + @Override + public void initialize() { + } + + @Override + public void setKeyStore(KeyStore keyStore) { + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugUserAuthority.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugUserAuthority.java new file mode 100644 index 00000000000..a419402210c --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/debug/DebugUserAuthority.java @@ -0,0 +1,102 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import java.nio.charset.StandardCharsets; + +import org.bouncycastle.util.encoders.Base64; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; + +/** + * Implementation that performs validation of PAM. + */ +public class DebugUserAuthority implements Authority { + + private static final Logger LOG = LoggerFactory.getLogger(DebugUserAuthority.class); + + public DebugUserAuthority() { + } + + @Override + public void initialize() { + } + + @Override + public String getDomain() { + return "user"; + } + + @Override + public String getHeader() { + return "Authorization"; + }; + + /* + * we don't want the user to keep specifying their username and + * password as part of the request. instead, the user must first + * request a usertoken and then use that usertoken for all other + * requests against ZMS and ZTS servers. + * @see com.yahoo.athenz.auth.Authority#allowAuthorization() + */ + @Override + public boolean allowAuthorization() { + return false; + } + + @Override + public Principal authenticate(String creds, String remoteAddr, String httpMethod, StringBuilder errMsg) { + errMsg = errMsg == null ? new StringBuilder(512) : errMsg; + + // the HTTP Basic authorization format is: Basic base64(:) + + if (!creds.startsWith("Basic ")) { + errMsg.append("UserAuthority:authenticate: credentials do not start with 'Basic '"); + LOG.error(errMsg.toString()); + return null; + } + + // decode - need to skip the first 6 bytes for 'Basic ' + String decoded; + try { + decoded = new String(Base64.decode(creds.substring(6).getBytes(StandardCharsets.UTF_8))); + } catch (Exception e) { + errMsg.append("UserAuthority:authenticate: factory exc="); + LOG.error(errMsg.toString()); + return null; + } + + String[] userArray = decoded.split(":"); + String username = userArray[0]; + + if (LOG.isDebugEnabled()) { + LOG.debug("UserAuthority.authenticate: valid user=" + username); + } + + // all the role members in Athenz are normalized to lower case so we need to make + // sure our principal's name and domain are created with lower case as well + + long issueTime = 0; + SimplePrincipal princ = (SimplePrincipal) SimplePrincipal.create(getDomain().toLowerCase(), + userArray[0].toLowerCase(), creds, issueTime, this); + princ.setUnsignedCreds(creds); + return princ; + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/filters/DefaultMediaTypeFilter.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/filters/DefaultMediaTypeFilter.java new file mode 100644 index 00000000000..335564e42a3 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/filters/DefaultMediaTypeFilter.java @@ -0,0 +1,45 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.filters; + +import javax.ws.rs.container.ContainerRequestContext; +import javax.ws.rs.container.ContainerRequestFilter; +import javax.ws.rs.container.PreMatching; + +import static javax.ws.rs.core.HttpHeaders.ACCEPT; + +/* + * If requestor specified any type Accepted, this will reset it to a + * predictable default of application/json + */ + +@PreMatching +public class DefaultMediaTypeFilter implements ContainerRequestFilter { + + final static String MEDIA_TYPE_ANY = "*/*"; + final static String MEDIA_TYPE_JSON = "application/json"; + + @Override + public void filter(ContainerRequestContext reqCtx) { + + String acceptHdr = reqCtx.getHeaderString(ACCEPT); + if (acceptHdr == null || acceptHdr.contains(MEDIA_TYPE_ANY)) { + // replace it with JSON + javax.ws.rs.core.MultivaluedMap headers = reqCtx.getHeaders(); + headers.putSingle(ACCEPT, MEDIA_TYPE_JSON); + } + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/filters/ETagFilter.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/filters/ETagFilter.java new file mode 100644 index 00000000000..8c8089684a0 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/filters/ETagFilter.java @@ -0,0 +1,66 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.filters; + +import javax.ws.rs.core.Context; +import javax.ws.rs.core.EntityTag; +import javax.ws.rs.core.HttpHeaders; +import javax.ws.rs.ext.Provider; + +import com.yahoo.athenz.common.server.util.StringUtils; + +import javax.ws.rs.container.ContainerRequestContext; +import javax.ws.rs.container.ContainerResponseContext; +import javax.ws.rs.container.ContainerResponseFilter; + +@Provider +public class ETagFilter implements ContainerResponseFilter { + + @Context private javax.servlet.http.HttpServletResponse servletResponse; + + @Override + public void filter(ContainerRequestContext request, ContainerResponseContext response) { + + // if our response object has a string ETag header value we're going + // to replace it with its corresponding EntityTag object since the + // the jersey GZIPResponse handler expects that object. + + // We could be either setting the in the container response (this is when + // we're returning not-modified response since we're creating the container + // response directly) or in the servlet response (this is where we're just + // returning our data set with the header included). + + // So we'll check in the container response first and if we don't have + // anything there we'll check in the servlet response. If we find the + // header in the servlet response, we're going to remove it and set a new + // entity tag object in the container response + + String etagStr = null; + if (response.getHeaders().containsKey(HttpHeaders.ETAG)) { + etagStr = (String) response.getHeaders().getFirst(HttpHeaders.ETAG); + } + if (etagStr == null && servletResponse != null) { + etagStr = servletResponse.getHeader(HttpHeaders.ETAG); + if (etagStr != null) { + servletResponse.setHeader(HttpHeaders.ETAG, null); + } + } + if (etagStr != null) { + etagStr = StringUtils.removeLeadingAndTrailingQuotes(etagStr); + response.getHeaders().putSingle("ETag", new EntityTag(etagStr)); + } + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AthenzRequestLog.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AthenzRequestLog.java new file mode 100644 index 00000000000..dce039712fb --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AthenzRequestLog.java @@ -0,0 +1,133 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log; + +import java.util.regex.Matcher; +import java.util.regex.Pattern; + +import org.eclipse.jetty.server.NCSARequestLog; +import org.eclipse.jetty.server.Request; +import org.eclipse.jetty.server.Response; +import org.eclipse.jetty.util.log.Log; +import org.eclipse.jetty.util.log.Logger; + +import com.yahoo.athenz.common.server.util.ServletRequestUtil; + +public class AthenzRequestLog extends NCSARequestLog { + + protected static final Logger LOG = Log.getLogger(AthenzRequestLog.class); + + static final String AUDIT_CRED_ERROR_ATTR = "com.yahoo.athenz.auth.credential.error"; + static final String AUDIT_LOG_CRED_REF = "Authority Credential Error: Request Access Log"; + + static final Pattern AUDIT_CRED_ERROR_PAT_WHO = Pattern.compile(".*(credential=)(.*)"); + + private AuditLogger auditLogger = null; + + public AthenzRequestLog() { + } + + public AthenzRequestLog(String filename) { + this(filename, null); + } + + public AthenzRequestLog(String filename, AuditLogger auditLogger) { + super(filename); + this.auditLogger = auditLogger; + } + + /** + * Helper method useful for over-riding in test cases. + */ + protected Logger getBackupLogger() { + return LOG; + } + + @Override + public void log(final Request request, final Response response) { + + // first log our standard access entry + + super.log(request, response); + + // if this was a request that failed authentication and + // was never got to be processed by the server, let's + // add to our audit log before returning + + AuditLogMsgBuilder msgBldr = getAuditLogMsgBuilder(request); + if (msgBldr != null) { + if (auditLogger == null) { + getBackupLogger().warn(msgBldr.build()); + } else { + auditLogger.log(msgBldr); + } + } + } + + /* + * Parse authenticate credential error message for token string. + * If found, return the token string, else null. + */ + static String getWhoFromErrorMsg(String errMsg) { + // look for "credential=" + CharSequence charSeq = errMsg.subSequence(0, errMsg.length()); + Matcher pm = AUDIT_CRED_ERROR_PAT_WHO.matcher(charSeq); + if (pm.matches() && pm.groupCount() >= 2) { + // we want group number 2, see AUDIT_CRED_ERROR_PAT_WHO for defined groups + return pm.group(2); + } + return null; + } + + AuditLogMsgBuilder getAuditLogMsgBuilder(final Request request) { + Object credErr = request.getAttribute(AUDIT_CRED_ERROR_ATTR); + if (credErr == null) { + return null; + } + + AuditLogMsgBuilder msgBldr = AuditLogFactory.getMsgBuilder(); + String httpMethod = request.getMethod(); + msgBldr.whatMethod(httpMethod); + + String details = credErr.toString(); + String who = getWhoFromErrorMsg(details); + if (who != null) { + msgBldr.who(who); + } else { + msgBldr.who("UNKNOWN principal: please see WHAT details"); + } + + msgBldr.why(AUDIT_LOG_CRED_REF); + msgBldr.whatApi(request.getRequestURI()); + + msgBldr.when(ServletRequestUtil.getTimeStamp(request)); + msgBldr.clientIp(ServletRequestUtil.getRemoteAddress(request)); + + msgBldr.whereIp(request.getLocalName()); + msgBldr.whereHttpsPort(Integer.toString(request.getServerPort())); + msgBldr.whatEntity(AUDIT_CRED_ERROR_ATTR); + + StringBuilder sb = new StringBuilder(512); + sb.append("CRED_ERROR=(").append(details).append(");"); + String remoteUser = request.getRemoteUser(); + if (remoteUser != null) { + sb.append("REMOTEUSER=(").append(remoteUser).append(");"); + } + + msgBldr.whatDetails(sb.toString()); + return msgBldr; + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogFactory.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogFactory.java new file mode 100644 index 00000000000..753fef70807 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogFactory.java @@ -0,0 +1,96 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log; + +import com.yahoo.athenz.common.server.log.impl.DefaultAuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.impl.DefaultAuditLogger; + +/** + * Factory to produce Audit logging components. + */ +public class AuditLogFactory { + + /** + * Get the default AuditLogger implementation. + * @return default AuditLogger instance + */ + static public AuditLogger getLogger() { + return new DefaultAuditLogger(); + } + + /** + * Create the AuditLogger from the given class name using its default constructor. + * If the class name is null, then it returns the default AuditLogger. + * @param auditLoggerClassName is name of class to instantiate as the AuditLogger + * @return AuditLogger instance + * @throws Exception class instantiation errors, ie. ReflectiveOperationException + */ + static public AuditLogger getLogger(String auditLoggerClassName) throws Exception { + if (auditLoggerClassName == null) { + return getLogger(); + } + + AuditLogger impl = null; + impl = (AuditLogger) Class.forName(auditLoggerClassName).newInstance(); + + return impl; + } + + /** + * Create the AuditLogger from the given class name and provided parameter, using + * the classes constructor that will take the parameter. + * ex: AuditLogger logger = AuditLogFactory.getLogger("my_logger_class", new Integer(5)); + * @param auditLoggerClassName is name of class to instantiate as the AuditLogger + * @param param is a parameter passed to the constructor of the specified Logger class + * @return AuditLogger instance + * @throws Exception class instantiation errors, ie. ReflectiveOperationException + */ + @SuppressWarnings({ "rawtypes", "unchecked" }) + static public AuditLogger getLogger(String auditLoggerClassName, Object param) throws Exception { + if (param == null) { + return getLogger(auditLoggerClassName); + } + Class paramClass = param.getClass(); + Class loggerClass = Class.forName(auditLoggerClassName); + return (AuditLogger) loggerClass.getConstructor(new Class[] {paramClass}).newInstance(paramClass.cast(param)); + } + + /** + * Get the default AuditLogMsgBuilder implementation. + * @return default AuditLogMsgBuilder instance + */ + static public AuditLogMsgBuilder getMsgBuilder() { + return new DefaultAuditLogMsgBuilder(); + } + + /** + * Create the AuditLogMsgBuilder from the given class name using its default constructor. + * If the class name is null, return the default AuditLogMsgBuilder. + * @param auditLogMsgBuilderClassName is name of class to instantiate as an AuditLogMsgBuilder + * @return AuditLogMsgBuilder instance + * @throws Exception class instantiation errors, ie. ReflectiveOperationException + */ + static public AuditLogMsgBuilder getMsgBuilder(String auditLogMsgBuilderClassName) throws Exception { + if (auditLogMsgBuilderClassName == null) { + return getMsgBuilder(); + } + + AuditLogMsgBuilder impl = null; + impl = (AuditLogMsgBuilder) Class.forName(auditLogMsgBuilderClassName).newInstance(); + + return impl; + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogMsgBuilder.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogMsgBuilder.java new file mode 100644 index 00000000000..994fe45fe14 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogMsgBuilder.java @@ -0,0 +1,166 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log; + +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.Timestamp; + +public interface AuditLogMsgBuilder { + + /** + * Return a tag with the version of the msg builder used to build the message. + * Ex: "VERS(athenz-2.1);" + * @return version tag all ready to set in a log message + */ + public abstract String versionTag(); + + /** + * who made the authorization change + * @param whoVal typically contains a token (user, role) + * The calling client/user requesting the change. + * @return this + */ + public abstract AuditLogMsgBuilder who(String whoVal); + + public abstract String who(); + + /** + * why was this change requested - justification via SOX ticket number + * @param whyVal typically a ticket number or some identifier for reference + * The SOX ticket number. + * @return this + */ + public abstract AuditLogMsgBuilder why(String whyVal); + + public abstract String why(); + + public abstract AuditLogMsgBuilder when(Timestamp ts); + + public abstract AuditLogMsgBuilder when(String whenVal); + + public abstract String when(); + + /** + * IP address of requesting client + * @param clientIpAddr address of the calling client + * The IP address of the calling client(who). + * @return this + */ + public abstract AuditLogMsgBuilder clientIp(String clientIpAddr); + + public abstract String clientIp(); + + /** + * This is where the change request was received - server endpoint. + * @param whereVal is the server address where the request was received + * The IP address and ports of the server where it receives the + * requests at. + * Ex: '{"server-ip":"198.177.62.9","server-https-port":"4453","server-http-port":"10080"}' + * @return this + */ + public abstract AuditLogMsgBuilder whereIp(String whereVal); + + public abstract AuditLogMsgBuilder whereHttpsPort(String whereVal); + + public abstract AuditLogMsgBuilder whereHttpPort(String whereVal); + + // Ex: '{"server-ip":"198.177.62.9","server-https-port":"4453","server-http-port":"10080"}' + public abstract String where(); + + /** + * The REST methods required to be reported are PUT, POST, DELETE. + * @param whatMethodVal is the typical REST method + * This is the REST method, ie. "PUT" or "POST", etc + * @return this + */ + public abstract AuditLogMsgBuilder whatMethod(String whatMethodVal); + + public abstract String whatMethod(); + + /** + * The publicly exported API receiving the change request. + * @param whatApiVal names the API that received the request + * This is the server public method serving the request, ex: "putRole" + * @return this + */ + public abstract AuditLogMsgBuilder whatApi(String whatApiVal); + + public abstract String whatApi(); + + /** + * Name of the domain that is affected by the change. + * @param whatDomainVal is the name of the domain being affected + * This is the Athenz domain being changed, ex: "xobni" + * @return this + */ + public abstract AuditLogMsgBuilder whatDomain(String whatDomainVal); + + public abstract String whatDomain(); + + /** + * Name of the entity being changed. An entity is a policy, role, service, et al. + * @param whatEntityVal is the name of the particular entity + * This is the entity in the Athenz domain being changed. + * So for example, if the role called "admin" is changed, then entity is "admin". + * @return this + */ + public abstract AuditLogMsgBuilder whatEntity(String whatEntityVal); + + public abstract String whatEntity(); + + /** + * @param whatDetailsVal specific details of the changes + * The caller will specify the entity(whatEntity) that was + * changed. If the entity is a role, and members were added, then + * the details will specify that members were added. + * Ex: '{"members-removed":["user.manning"],"members-added"=["user.brady"]}' + * See the whatDetails() helper that takes Set's. It can be used with + * method to sort out the changes to enhance the details message. + * Usage can be: + * Builder bldr = bldr.whatDetails("members-changed"); + * bldr = bldr.whatDetails(oldAttrSet, newAttrSet); + * @return this + */ + public abstract AuditLogMsgBuilder whatDetails(String whatDetailsVal); + + public abstract String whatDetails(); + + /** + * Performs 'diff' of the attributes and sets it in the details part of the + * message accordingly. + * This method will sort out what attributes have been REMOVED, and which have + * been ADDED based on the old original attributes and the new set of attrs. + * @param tag used to label the details + * @param origFields Set of current attributes + * @param newFields Set of replacement attributes + * @return this + */ + public abstract AuditLogMsgBuilder whatDetails(String tag, + Struct origFields, Struct newFields); + + /** + * Call this to build the string representation of the data fields set herein. + * @return String representation of the message to be logged + */ + public abstract String build(); + + /** + * Parse the given log message and return a Struct. + * @param logMsgBldrMsg string returned from AuditLogMsgBuilder.build() + * @return struct representation of the log message + */ + public abstract Struct parse(String logMsgBldrMsg); +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogger.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogger.java new file mode 100644 index 00000000000..f02288ae2fa --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/AuditLogger.java @@ -0,0 +1,38 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log; + +/** + * Interface to perform audit logging. + * See {@link com.yahoo.athenz.common.server.log.AuditLogFactory#getLogger()} + * + */ +public interface AuditLogger { + /** + * Perform logging of the given message. + * @param logMsg message to be logged + * @param msgVersionTag optional version tag of the message - may be null + * If the message must be split into chunks then msgVersionTag + * will be used prefixed to each chunk/partition. + */ + public void log(String logMsg, String msgVersionTag); + + /** + * Log the message as built by the provided msgBldr. + * @param msgBldr constructs message to be logged, contains version tag of the message + */ + public void log(AuditLogMsgBuilder msgBldr); +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/impl/DefaultAuditLogMsgBuilder.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/impl/DefaultAuditLogMsgBuilder.java new file mode 100644 index 00000000000..5d8cffb12e0 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/impl/DefaultAuditLogMsgBuilder.java @@ -0,0 +1,683 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log.impl; + +import java.util.Set; +import java.util.HashSet; +import java.util.Iterator; +import java.util.regex.Pattern; +import java.util.regex.Matcher; + +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.Timestamp; +import com.yahoo.rdl.Value; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.rdl.Array; + +/* + * Default implementation that can be inherited from. + * Builds the Audit logging message to be passed to the AuditLog interface. + * The log message built by this class can be parsed into a Struct (see parse()). + * Example string built: + * VERS=(athenz-def-1.0);WHEN=(2015-04-02T18:30:58.441Z);WHO=(v=U1;d=user;n=jdoe); + * WHY=(audittest);WHERE=(server-ip=localhost,server-https-port=0,server-http-port=10080); + * CLIENT-IP=(MOCKCLIENT_HOST_NAME);WHAT-method=(PUT);WHAT-api=(puttenancy); + * WHAT-domain=(AddTenancyDom1);WHAT-entity=(tenancy.coretech.storage.reader); + * WHAT-details=({assertions: [{role: "AddTenancyDom1:role.admin", action: "ASSUME_ROLE", resource: "coretech:role.storage.tenant.AddTenancyDom1.reader"}], modified: "2015-04-02T18:30:58.441Z", name: "AddTenancyDom1:policy.tenancy.coretech.storage.reader"}); + */ +public class DefaultAuditLogMsgBuilder implements AuditLogMsgBuilder { + + // Keys used in Struct returned by parse() method + // + // These keys will contain a String value + public static final String PARSE_VERS = "VERS"; + public static final String PARSE_WHEN = "WHEN"; + public static final String PARSE_WHO = "WHO"; + public static final String PARSE_WHY = "WHY"; + public static final String PARSE_WHERE = "WHERE"; + public static final String PARSE_CLIENT_IP = "CLIENT-IP"; + public static final String PARSE_WHAT_METH = "WHAT-method"; + public static final String PARSE_WHAT_API = "WHAT-api"; + public static final String PARSE_WHAT_DOM = "WHAT-domain"; + public static final String PARSE_WHAT_ENT = "WHAT-entity"; + + // This key will contain a Struct value + public static final String PARSE_WHAT_DETAILS = "WHAT-details"; + + // These fields are found in the embedded Struct keyed by "WHAT-details" + // + // These fields contain a String + public static final String PARSE_DETAILS_ADDED = "ADDED"; + public static final String PARSE_DETAILS_REMOVED = "REMOVED"; + public static final String PARSE_DETAILS_CHANGED = "CHANGED"; + // + // Each of these fields is an Array of Strings. + // + public static final String PARSE_DETAILS_ADDEDVALS = "ADDED-VALUES"; + public static final String PARSE_DETAILS_REMOVEDVALS = "REMOVED-VALUES"; + public static final String PARSE_DETAILS_FROMTOVALS = "FROM-TO-VALUES"; + public static final String PARSE_DETAILS_EMB_ADDEDVALS = "EMBEDDED-ADDED"; + public static final String PARSE_DETAILS_EMB_REMOVEDVALS = "EMBEDDED-REMOVED"; + + // log message contains these fields - which parse combines into one field + // + public static final String PARSE_FROM = "FROM"; + public static final String PARSE_TO = "TO"; + + // data members used for log message fields + // + protected String who = null; // The calling client/user requesting the change. Ex: "user.roger" + protected String why = null; // The audit reference or SOX ticket number. + protected String clientIp = null; // The IP address of the calling client(who). + protected String when = null; // date-time in UTC + protected String whereIp = null; // The IP address and ports of the server where it receives the requests at. + protected String whereHttpsPort = null; // The server https port endpoint + protected String whereHttpPort = null; // The server http port endpoint + protected String whatMethod = null; // This is the REST method, ie. "PUT" or "POST", etc + protected String whatApi = null; // This is the server public method serving the request, ex: "putRole" + protected String whatDomain = null; // This is the Athenz domain being changed, ex: "xobni" + protected String whatEntity = null; // This is the entity in the Athenz domain being changed. + protected String whatDetails = null; // This will contain specifics of the entity(whatEntity) that was changed. + + // Version of the log message produced. In case newer versions of the message creation + // are implemented later. + // + protected String messageVersion = "athenz-def-1.0"; + protected String versionTag = null; + + static final String NULL_STR = "null"; // place holder key word used for missing values + static final int SB_MIN_SIZE_INIT = 128; + static final int SB_MED_SIZE_INIT = 512; + static final int SB_MAX_SIZE_INIT = 1024; + + // setup for parsing log messages + // + static final String GEN_FLD_PAT = "=\\(([^\\)]+)\\);.*"; + static final Pattern PAT_VERS = Pattern.compile(".*(" + PARSE_VERS + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHEN = Pattern.compile(".*(" + PARSE_WHEN + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHO = Pattern.compile(".*(" + PARSE_WHO + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHY = Pattern.compile(".*(" + PARSE_WHY + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHERE = Pattern.compile(".*(" + PARSE_WHERE + ")" + GEN_FLD_PAT); + static final Pattern PAT_CLTIP = Pattern.compile(".*(" + PARSE_CLIENT_IP + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHAT_METH = Pattern.compile(".*(" + PARSE_WHAT_METH + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHAT_API = Pattern.compile(".*(" + PARSE_WHAT_API + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHAT_DOM = Pattern.compile(".*(" + PARSE_WHAT_DOM + ")" + GEN_FLD_PAT); + static final Pattern PAT_WHAT_ENT = Pattern.compile(".*(" + PARSE_WHAT_ENT + ")" + GEN_FLD_PAT); + + public DefaultAuditLogMsgBuilder() { + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#versionTag() + */ + public String versionTag() { + if (versionTag == null) { + StringBuilder sb = new StringBuilder(SB_MIN_SIZE_INIT); + sb.append(PARSE_VERS).append("=(").append(messageVersion).append(");"); + versionTag = sb.toString(); + } + return versionTag; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#who(java.lang.String) + */ + @Override + public AuditLogMsgBuilder who(String whoVal) { + this.who = whoVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#who() + */ + @Override + public String who() { + if (who == null) { + return NULL_STR; + } + return who; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#why(java.lang.String) + */ + @Override + public AuditLogMsgBuilder why(String whyVal) { + this.why = whyVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#why() + */ + @Override + public String why() { + if (why == null) { + return NULL_STR; + } + return why; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#when(com.yahoo.data.Timestamp) + */ + @Override + public AuditLogMsgBuilder when(Timestamp ts) { + return when(ts.toString()); + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#when(java.lang.String) + */ + @Override + public AuditLogMsgBuilder when(String whenVal) { + this.when = whenVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#when() + */ + @Override + public String when() { + if (when == null) { + return NULL_STR; + } + return when; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#clientIp(java.lang.String) + */ + @Override + public AuditLogMsgBuilder clientIp(String clientIpAddr) { + this.clientIp = clientIpAddr; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#clientIp() + */ + @Override + public String clientIp() { + if (clientIp == null) { + return NULL_STR; + } + return clientIp; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whereIp(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whereIp(String whereVal) { + this.whereIp = whereVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whereHttpsPort(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whereHttpsPort(String whereVal) { + this.whereHttpsPort = whereVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whereHttpPort(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whereHttpPort(String whereVal) { + this.whereHttpPort = whereVal; + return this; + } + + // Ex: '{"server-ip":"198.177.62.9","server-https-port":"4453","server-http-port":"10080"}' + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#where() + */ + @Override + public String where() { + if (whereIp == null) { + whereIp = NULL_STR; + } + StringBuilder sb = new StringBuilder(SB_MIN_SIZE_INIT); + sb.append("server-ip=").append(whereIp); + + if (whereHttpsPort == null) { + whereHttpsPort = NULL_STR; + } + sb.append(",server-https-port=").append(whereHttpsPort); + + if (whereHttpPort == null) { + whereHttpPort = NULL_STR; + } + sb.append(",server-http-port=").append(whereHttpPort); + + return sb.toString(); + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatMethod(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whatMethod(String whatMethodVal) { + this.whatMethod = whatMethodVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatMethod() + */ + @Override + public String whatMethod() { + if (whatMethod == null) { + return NULL_STR; + } + return whatMethod; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatApi(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whatApi(String whatApiVal) { + this.whatApi = whatApiVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatApi() + */ + @Override + public String whatApi() { + if (whatApi == null) { + return NULL_STR; + } + return whatApi; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatDomain(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whatDomain(String whatDomainVal) { + this.whatDomain = whatDomainVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatDomain() + */ + @Override + public String whatDomain() { + if (whatDomain == null) { + return NULL_STR; + } + return whatDomain; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatEntity(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whatEntity(String whatEntityVal) { + this.whatEntity = whatEntityVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatEntity() + */ + @Override + public String whatEntity() { + if (whatEntity == null) { + return NULL_STR; + } + return whatEntity; + } + + /* Set/replace the whatDetails field. + * (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatDetails(java.lang.String) + */ + @Override + public AuditLogMsgBuilder whatDetails(String whatDetailsVal) { + this.whatDetails = whatDetailsVal; + return this; + } + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatDetails() + */ + @Override + public String whatDetails() { + if (whatDetails == null) { + return NULL_STR; + } + return whatDetails; + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#whatDetails(java.lang.String, com.yahoo.data.Struct, com.yahoo.data.Struct) + */ + @Override + public AuditLogMsgBuilder whatDetails(String tag, Struct origFields, Struct newFields) { + return whatDetails(whatSubDetails(tag, origFields, newFields)); + } + + // Determines all differences between the Struct of original fields and the new one. + // If the Struct contains a Struct field, this method will recur into that field. + // + String whatSubDetails(String tag, Struct origFields, Struct newFields) { + + Set setChanged = origFields.keySet(); + Set setOldDiff = new HashSet(setChanged); + Set setNew = newFields.keySet(); + Set setNewDiff = new HashSet(setNew); + setOldDiff.removeAll(setNewDiff); // gets a diff - contains Removed elements + + Set setOld = origFields.keySet(); + setNewDiff.removeAll(setOld); // gets a diff - contains Added elements + // HAVE: partial diff, all removed and added elements + + // for the intersection of set of keys, find any changes to the values + // + StringBuilder changedSb = new StringBuilder(SB_MED_SIZE_INIT); + changedSb.append(PARSE_DETAILS_CHANGED).append("=("); + setChanged.retainAll(setNew); // the intersection of the 2 sets + // if we have common keys, are the values different? + boolean changedValsFound = false; + for (Iterator it = setChanged.iterator(); it != null && it.hasNext();) { + String key = it.next(); + Object origVal = origFields.get(key); + if (origVal instanceof Timestamp) { + continue; // ignore timestamp fields + } + Object newVal = newFields.get(key); + if (Value.equals(origVal, newVal) == false) { + // the values have changed for this key + changedValsFound = true; + if (origVal instanceof Array) { + StringBuilder addedSetSb = new StringBuilder(SB_MED_SIZE_INIT); + addedSetSb.append(key + "=(").append(PARSE_DETAILS_ADDEDVALS).append("=("); + StringBuilder removedSetSb = new StringBuilder(SB_MED_SIZE_INIT); + removedSetSb.append(key + "=(").append(PARSE_DETAILS_REMOVEDVALS).append("=("); + + buildDiffArray((Array) origVal, (Array) newVal, addedSetSb, removedSetSb); + addedSetSb.append("));"); // end-of-= + removedSetSb.append("));"); // end-of-= + changedSb.append(addedSetSb.toString()); + changedSb.append(removedSetSb.toString()); + } else if (origVal instanceof Struct) { + String subDetails = whatSubDetails(key, (Struct) origVal, (Struct) newVal); + changedSb.append(subDetails); + } else { + changedSb.append(key + "=(").append(PARSE_FROM).append("=(").append(origVal); + changedSb.append(");").append(PARSE_TO).append("=(").append(newVal); + changedSb.append("));"); // end-of-= + } + } + } + // HAVE: full diff, elements with changed values, removed elements, added elements + + // if user didnt specify a tag, we will use a default to keep syntax + // consistent in the built string + String prefix = tag == null ? "TAG=(" : tag + "=("; + StringBuilder sb = new StringBuilder(SB_MED_SIZE_INIT); + sb.append(prefix); + + if (setChanged.size() > 0) { // HAVE: values were replaced + if (!changedValsFound) { + changedSb.append(NULL_STR); + } + } + changedSb.append(");"); // end-of-CHANGED= + sb.append(changedSb); + + sb.append(prefix).append(PARSE_DETAILS_REMOVED + "=("); + buildDiffKeys(setOldDiff, origFields, sb); + sb.append("));"); + + sb.append(prefix).append(PARSE_DETAILS_ADDED + "=("); + buildDiffKeys(setNewDiff, newFields, sb); + sb.append("));"); + + return sb.toString(); + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#build() + */ + @Override + public String build() { + StringBuilder sb = new StringBuilder(SB_MAX_SIZE_INIT); + sb.append(versionTag()).append(PARSE_WHEN).append("=(").append(when()). + append(");"). append(PARSE_WHO).append("=(").append(who()). + append(");").append(PARSE_WHY).append("=(").append(why()). + append(");").append(PARSE_WHERE).append("=(").append(where()). + append(");").append(PARSE_CLIENT_IP).append("=(").append(clientIp()); + sb.append(");").append(PARSE_WHAT_METH).append("=(").append(whatMethod()).append(");").append(PARSE_WHAT_API).append("=("); + sb.append(whatApi()).append(");").append(PARSE_WHAT_DOM).append("=(").append(whatDomain()).append(");").append(PARSE_WHAT_ENT).append("=("); + sb.append(whatEntity()).append(");").append(PARSE_WHAT_DETAILS).append("=(").append(whatDetails()).append(");"); + return sb.toString(); + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogMsgBuilder#parse(java.lang.String) + */ + @Override + public Struct parse(String logMsgBldrMsg) { + // reverse what build() does, and pull out each component of the string + CharSequence charSeq = logMsgBldrMsg.subSequence(0, logMsgBldrMsg.length()); + Struct msg = new Struct().with(PARSE_VERS, getMatchedGroup(PAT_VERS, 2, logMsgBldrMsg)); + msg.with(PARSE_WHEN, getMatchedGroup(PAT_WHEN, 2, charSeq)). + with(PARSE_WHO, getMatchedGroup(PAT_WHO, 2, charSeq)). + with(PARSE_WHY, getMatchedGroup(PAT_WHY, 2, charSeq)). + with(PARSE_WHERE, getMatchedGroup(PAT_WHERE, 2, charSeq)). + with(PARSE_CLIENT_IP, getMatchedGroup(PAT_CLTIP, 2, charSeq)). + with(PARSE_WHAT_METH, getMatchedGroup(PAT_WHAT_METH, 2, charSeq)). + with(PARSE_WHAT_API, getMatchedGroup(PAT_WHAT_API, 2, charSeq)). + with(PARSE_WHAT_DOM, getMatchedGroup(PAT_WHAT_DOM, 2, charSeq)). + with(PARSE_WHAT_ENT, getMatchedGroup(PAT_WHAT_ENT, 2, charSeq)); + + // now get the WHAT-details + int index = logMsgBldrMsg.indexOf(PARSE_WHAT_DETAILS + "=("); + if (index != -1) { + Struct details = new Struct(); + msg.with(PARSE_WHAT_DETAILS, details); + + String parseRemovedField = PARSE_DETAILS_REMOVED + "=("; + String parseAddedField = PARSE_DETAILS_ADDED + "=("; + + // first level entities of WHAT-details are: CHANGED, REMOVED, ADDED + // + int removedIndex = logMsgBldrMsg.lastIndexOf(parseRemovedField); + int addedIndex = logMsgBldrMsg.indexOf(parseAddedField, removedIndex); + if (removedIndex != -1) { + int removedValIndex = removedIndex + parseRemovedField.length(); + int endOfRemIndex = addedIndex; + if (addedIndex == -1) { + endOfRemIndex = logMsgBldrMsg.length(); + } + endOfRemIndex = logMsgBldrMsg.lastIndexOf(')', endOfRemIndex); + String removed = logMsgBldrMsg.substring(removedValIndex, addedIndex); + details.with(PARSE_DETAILS_REMOVED, removed); + } + + if (addedIndex != -1) { + String added = logMsgBldrMsg.substring(addedIndex + parseAddedField.length()); + details.with(PARSE_DETAILS_ADDED, added); + } + + // process the CHANGED section - which can contain embedded Struct's + // + int changedIndex = logMsgBldrMsg.indexOf(PARSE_DETAILS_CHANGED + "=", index); + if (changedIndex != -1) { + int endingIndex = removedIndex != -1 ? + removedIndex : + (addedIndex != -1 ? addedIndex : logMsgBldrMsg.length()); + String changed = logMsgBldrMsg.substring(changedIndex, endingIndex); + details.with(PARSE_DETAILS_CHANGED, changed); + + // CHANGED can contain multiple ADDED-VALUES, REMOVED-VALUES, {FROM,TO} pairs + // make lists for each of these and add to details + + Array addedValues = new Array(); + findChangedValues(addedValues, changed, PARSE_DETAILS_ADDEDVALS + "=(", "));", true); + if (addedValues.size() > 0) { + details.with(PARSE_DETAILS_ADDEDVALS, addedValues); + } + + Array removedValues = new Array(); + findChangedValues(removedValues, changed, PARSE_DETAILS_REMOVEDVALS + "=(", "));", true); + if (removedValues.size() > 0) { + details.with(PARSE_DETAILS_REMOVEDVALS, removedValues); + } + + // FROM/TO pairs + Array fromToValues = new Array(); + findChangedValues(fromToValues, changed, PARSE_FROM + "=(", "));", true); + if (fromToValues.size() > 0) { + details.with(PARSE_DETAILS_FROMTOVALS, fromToValues); + } + + // look for embedded Struct - ADDED/REMOVED fields + // if there are embedded Struct's in the original entity, then + // due to recursion there can be multiple REMOVED and ADDED entries + // puttenantroles is one of those ZMS api that can cause this + Array removedFields = new Array(); + findChangedValues(removedFields, changed, parseRemovedField, "));", true); + if (removedFields.size() > 0) { + details.with(PARSE_DETAILS_EMB_REMOVEDVALS, removedFields); + } + + Array addedFields = new Array(); + findChangedValues(addedFields, changed, parseAddedField, "));", true); + if (addedFields.size() > 0) { + details.with(PARSE_DETAILS_EMB_ADDEDVALS, addedFields); + } + } + } + return msg; + } + + void findChangedValues(Array values, String changed, String fieldName, String endFieldStr, boolean wantPrefix) { + int endOfArrayIndex = 0; + for (int valIndex = changed.indexOf(fieldName, endOfArrayIndex); + valIndex != -1; + valIndex = changed.indexOf(fieldName, endOfArrayIndex)) { + + endOfArrayIndex = changed.indexOf(endFieldStr, valIndex); + if (endOfArrayIndex == -1) { + break; + } + + String value = ""; + if (wantPrefix && (valIndex - 3 > 0)) { + // ex: ";org=(FROM=", "CHANGED=(modified=(FROM=(" + // go backwards from valIndex to either ';', or '(' + for (int cnt = valIndex - 2; cnt > -1; --cnt) { + char endChar = changed.charAt(cnt) ; + if (endChar == ';' || endChar == '(') { + valIndex = cnt + 1; + break; + } + } + } + + int addOffset = changed.length() > endOfArrayIndex ? 1 : 0; + value = changed.substring(valIndex, endOfArrayIndex + addOffset); + values.add(value); + } + } + + String getMatchedGroup(Pattern patty, int groupNum, CharSequence logMsg) { + Matcher pm = patty.matcher(logMsg); + if (pm.matches() && pm.groupCount() >= groupNum) { + return pm.group(groupNum); + } + return null; + } + + // Set the diff between the Arrays into the added set and/or the removed set StringBuilder. + // If the Array elements are Struct, it will set them appropriately but not recur into them. + // + void buildDiffArray(Array origVal, Array newVal, StringBuilder addedSetSb, StringBuilder removedSetSb) { + + // create set for each Array of elements + // + Set origValSet = new HashSet(); + Iterator elems = origVal.iterator(); + for (; elems != null && elems.hasNext(); ) { + Object obj = elems.next(); + StringBuilder sb = new StringBuilder(SB_MIN_SIZE_INIT); + Value.appendToString(obj, sb, null); + origValSet.add(sb.toString()); + } + + Set newValSet = new HashSet(); + for (elems = newVal.iterator(); elems != null && elems.hasNext(); ) { + Object obj = elems.next(); + StringBuilder sb = new StringBuilder(SB_MIN_SIZE_INIT); + Value.appendToString(obj, sb, null); + newValSet.add(sb.toString()); + } + // HAVE: set of serialized elements for original and new set of elements + + // Build the diff sets now + // + Set removedValSet = new HashSet(origValSet); + removedValSet.removeAll(newValSet); // gets a diff - contains Removed elements + newValSet.removeAll(origValSet); // gets a diff - contains Added elements + // HAVE: set of serialized elements for added and removed elements + + // print the set of removed elements + buildDiffValueSet(removedValSet, removedSetSb); + // print the set of added elements + buildDiffValueSet(newValSet, addedSetSb); + } + + // Set all the elements of the value Set into the StringBuilder + // + void buildDiffValueSet(Set valSet, StringBuilder sb) { + if (valSet.isEmpty()) { + sb.append(NULL_STR); + return; + } + for (Iterator elems = valSet.iterator(); elems != null && elems.hasNext();) { + sb.append(elems.next()); + if (elems.hasNext()) { + sb.append(","); + } + } + } + + // Set only the key/value pairs specified in the set of key names into the StringBuilder + // + void buildDiffKeys(Set setDiffKeyNames, Struct dataStruct, StringBuilder sb) { + + if (setDiffKeyNames.isEmpty()) { + sb.append(NULL_STR); + return; + } + Iterator it = setDiffKeyNames.iterator(); + while (it != null && it.hasNext()) { + String key = it.next(); + sb.append(key + "="); + Object val = dataStruct.get(key); + if (val == null) { + val = NULL_STR; + } + Value.appendToString(val, sb, null); + if (it.hasNext()) { + sb.append(","); + } + } + } + +} + diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/impl/DefaultAuditLogger.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/impl/DefaultAuditLogger.java new file mode 100644 index 00000000000..8d562512815 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/log/impl/DefaultAuditLogger.java @@ -0,0 +1,61 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log.impl; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; + +/** + * This default implementation uses log4j API. + * The default constructor depends on a logger named "AuditSoxLogger" specified in the logback.xml + * The second constructor takes a name of the logger the caller wants to use. + */ +public class DefaultAuditLogger implements AuditLogger { + + // Configured logger named "AuditSoxLogger" + // + private static Logger AUDITLOGGER = LoggerFactory.getLogger("AuditSoxLogger"); + + public DefaultAuditLogger() { + } + + // Override the default logger with one named loggerName + // + public DefaultAuditLogger(String loggerName) { + AUDITLOGGER = LoggerFactory.getLogger(loggerName); + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogger#log(java.lang.String, java.lang.String) + */ + @Override + public void log(String logMsg, String msgVersionTag) { + AUDITLOGGER.info(logMsg); // ignore msgVersionTag for this logger implementation + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogger#log(com.yahoo.athenz.common.server.log.AuditLogMsgBuilder) + */ + @Override + public void log(AuditLogMsgBuilder msgBldr) { + if (msgBldr != null) { + log(msgBldr.build(), msgBldr.versionTag()); + } + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/Http.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/Http.java new file mode 100644 index 00000000000..1f128c900e1 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/Http.java @@ -0,0 +1,175 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import java.util.List; +import java.util.ArrayList; +import java.security.cert.X509Certificate; + +import javax.servlet.http.HttpServletRequest; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.Principal; + +public class Http { + + public static final String INVALID_CRED_ATTR = "com.yahoo.athenz.auth.credential.error"; + public static final String LOOPBACK_ADDRESS = "127.0.0.1"; + public static final String XFF_HEADER = "X-Forwarded-For"; + public static final String JAVAX_CERT_ATTR = "javax.servlet.request.X509Certificate"; + + public static class AuthorityList { + List authorities; + + public AuthorityList() { + authorities = new ArrayList(); + } + + public void add(Authority a) { + authorities.add(a); + } + + public List getAuthorities() { + return authorities; + } + } + + static String getCookieValue(HttpServletRequest hreq, String name) { + + javax.servlet.http.Cookie[] cookies = hreq.getCookies(); + if (cookies == null) { + return null; + } + for (javax.servlet.http.Cookie cookie : cookies) { + if (name.equals(cookie.getName())) { + return cookie.getValue(); + } + } + return null; + } + + private static String authenticatingCredentials(HttpServletRequest request, + Authority authority) { + String header = authority.getHeader(); + String creds = header.startsWith("Cookie.") ? getCookieValue(request, + header.substring(7)) : request.getHeader(header); + return creds; + } + + public static String authenticatingCredentials(HttpServletRequest request, + AuthorityList authorities) { + if (authorities == null) { + return null; + } + for (Authority authority : authorities.authorities) { + String creds = authenticatingCredentials(request, authority); + if (creds != null) { + return creds; + } + } + return null; + } + + /** + * Return the remote client IP address. + * Detect if connection is from ATS by looking at XFF header. + * If XFF header, return the last address therein since it was added by ATS. + **/ + static String getRemoteAddress(final HttpServletRequest request) { + String addr = request.getRemoteAddr(); + if (addr.equals(LOOPBACK_ADDRESS)) { + String xff = request.getHeader(XFF_HEADER); + if (xff != null) { + String[] addrs = xff.split(","); + addr = addrs[addrs.length - 1].trim(); + } + } + return addr; + } + + public static Principal authenticate(HttpServletRequest request, + AuthorityList authorities) { + if (authorities == null) { + throw new ResourceException (ResourceException.INTERNAL_SERVER_ERROR, + "No authorities configured"); + } + + StringBuilder authErrMsg = new StringBuilder(512); + for (Authority authority : authorities.authorities) { + Principal principal = null; + StringBuilder errMsg = new StringBuilder(512); + switch (authority.getCredSource()) { + case HEADER: + String creds = authenticatingCredentials(request, authority); + if (creds != null) { + principal = authority.authenticate(creds, getRemoteAddress(request), request.getMethod(), errMsg); + } + break; + case CERTIFICATE: + X509Certificate[] certs = (X509Certificate[]) request.getAttribute(JAVAX_CERT_ATTR); + if (certs != null) { + principal = authority.authenticate(certs, errMsg); + } + break; + } + + if (principal != null) { + return principal; + } else { + authErrMsg.append(":error: ").append(errMsg); + } + } + // set the error message as a request attribute + request.setAttribute(INVALID_CRED_ATTR, authErrMsg.toString()); + throw new ResourceException (ResourceException.UNAUTHORIZED, "Invalid credentials"); + } + + public static String authenticatedUser(HttpServletRequest request, + AuthorityList authorities) { + Principal principal = authenticate(request, authorities); + return principal.getYRN(); + } + + public static String authorizedUser(HttpServletRequest request, + AuthorityList authorities, Authorizer authorizer, String action, + String resource, String otherDomain) { + Principal principal = authenticate(request, authorities); + authorize(authorizer, principal, action, resource, otherDomain); + if (principal == null) { + return null; + } + return principal.getYRN(); + } + + public static Principal authorize(Authorizer authorizer, Principal principal, + String action, String resource, String otherDomain) { + + if (action == null || resource == null) { + throw new ResourceException(ResourceException.BAD_REQUEST, + "Missing 'action' and/or 'resource' pararameters"); + } + if (authorizer != null) { + if (!authorizer.access(action, resource, principal, otherDomain)) { + throw new ResourceException(ResourceException.FORBIDDEN, "Forbidden"); + } + } else { + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "No authorizer configured in service"); + } + return principal; + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/HttpContainer.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/HttpContainer.java new file mode 100644 index 00000000000..116cfda56d7 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/HttpContainer.java @@ -0,0 +1,202 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import java.util.HashSet; + +import org.eclipse.jetty.server.Server; +import org.eclipse.jetty.server.handler.HandlerCollection; +import org.eclipse.jetty.util.thread.QueuedThreadPool; +import org.glassfish.hk2.utilities.binding.AbstractBinder; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; + +public class HttpContainer { + + protected Server server = null; + protected String banner = null; + private HandlerCollection handlers = null; + protected Http.AuthorityList authorities = null; + protected Authorizer authorizer = null; + + /** Currently not a public class. Use JettyContainer */ + protected HttpContainer() { + } + + protected HashSet> resources = new HashSet>(); + protected HashSet singletons = new HashSet(); + protected HashSet> singletonsCheck = new HashSet>(); + + /** + * registers the resource classes with the jersey server. + * @param classes the resource classes to register + * @return this container, so calls may be chained + */ + public HttpContainer resource(Class... classes) { + for (Class classObject : classes) { + resources.add(classObject); + } + return this; + } + + /** + * Inject the specified object as a singleton corresponding to the specified + * target type. Any registered resource can access this with the @Context + * injector. + * @param Describes the container type + * @param targetType the type of the target injection (often an interface class object) + * @param obj the object to use as a singleton for that type + * @return this container, so calls may be chained + */ + public HttpContainer injectSingleton(final Class targetType, final Object obj) { + + AbstractBinder binder = new AbstractBinder() { + Class type = targetType; + Object singleton = obj; + + @Override + protected void configure() { + bind(type).in(javax.inject.Singleton.class); + bind(type.cast(singleton)).to(type); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(256); + sb.append("Binder: contains type=").append(type).append(" and object=").append(singleton); + return sb.toString(); + } + }; + + try { + Class componentClass = binder.getClass(); + if (singletonsCheck.contains(componentClass)) { + throw new RuntimeException("Cannot create new registration for component type class " + + componentClass + ": Existing previous registration found for the type."); + } else { + singletonsCheck.add(componentClass); + } + singletons.add(binder); + return this; + } catch (RuntimeException e) { + throw e; + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + /* + * Register javax.ws.rs.container.ContainerRequestFilter's with this method. + */ + public HttpContainer addContainerRequestFilter(final Class targetType) { + + AbstractBinder binder = new AbstractBinder() { + Class type = targetType; + + @Override + protected void configure() { + bind(type).to(javax.ws.rs.container.ContainerRequestFilter.class); + } + }; + + try { + singletons.add(binder); + return this; + } catch (RuntimeException e) { + throw e; + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + public HttpContainer authority(Authority a) { + if (authorities == null) { + authorities = new Http.AuthorityList(); + } + authorities.add(a); + return this; + } + + public HttpContainer authorizer(Authorizer a) { + authorizer = a; + return this; + } + + public HttpContainer delegate(Class targetType, Object singleton) { + return injectSingleton(targetType, singleton); + } + + public HttpContainer delegate(AbstractBinder abstractBinder) { + return injectSingleton(abstractBinder); + } + + public HttpContainer injectSingleton(AbstractBinder abstractBinder) { + singletons.add(abstractBinder); + return this; + } + + /** + * Set the banner that get displayed when server is started up. + * @param banner Banner text to be displayed + */ + public void setBanner(String banner) { + this.banner = banner; + } + + public void createServer(int maxThreads) { + + // Setup Thread pool + + QueuedThreadPool threadPool = new QueuedThreadPool(); + threadPool.setMaxThreads(maxThreads); + + server = new Server(threadPool); + setHandlers(new HandlerCollection()); + server.setHandler(getHandlers()); + } + + public Server getServer() { + return server; + } + + public void run(String base) { + try { + server.start(); + System.out.println("Jetty server running at " + banner); + server.join(); + } catch (Exception e) { + e.printStackTrace(); + throw new RuntimeException(e.getMessage()); + } + } + + public void stop() { + try { + server.stop(); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public HandlerCollection getHandlers() { + return handlers; + } + + public void setHandlers(HandlerCollection handlers) { + this.handlers = handlers; + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/ResourceContext.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/ResourceContext.java new file mode 100644 index 00000000000..25620ce0eb8 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/ResourceContext.java @@ -0,0 +1,69 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.Principal; + +public class ResourceContext { + private final HttpServletRequest request; + private final HttpServletResponse response; + private final Http.AuthorityList authorities; + private final Authorizer authorizer; + + protected Principal principal; + protected boolean checked; + + public ResourceContext(HttpServletRequest request, HttpServletResponse response, + Http.AuthorityList authorities, Authorizer authorizer) { + this.request = request; + this.response = response; + this.authorities = authorities; + this.authorizer = authorizer; + this.principal = null; + this.checked = false; + } + + public HttpServletRequest request() { + return request; + } + + public HttpServletResponse response() { + return response; + } + + public Principal principal() { + return principal; + } + + //throws an exception if it cannot authenticate + public Principal authenticate() { + if (!checked) { + checked = true; + principal = Http.authenticate(request, authorities); + } + return principal; + } + + //throws an exception if it cannot authorize + public void authorize(String action, String resource, String trustedDomain) { + principal = authenticate(); + Http.authorize(authorizer, principal, action, resource, trustedDomain); + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/ResourceException.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/ResourceException.java new file mode 100644 index 00000000000..5f636334de9 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/ResourceException.java @@ -0,0 +1,164 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +public class ResourceException extends RuntimeException { + + private static final long serialVersionUID = 2289910486634456175L; + + public final static int OK = 200; + public final static int CREATED = 201; + public final static int ACCEPTED = 202; + public final static int NO_CONTENT = 204; + public final static int MOVED_PERMANENTLY = 301; + public final static int FOUND = 302; + public final static int SEE_OTHER = 303; + public final static int NOT_MODIFIED = 304; + public final static int TEMPORARY_REDIRECT = 307; + public final static int BAD_REQUEST = 400; + public final static int UNAUTHORIZED = 401; + public final static int FORBIDDEN = 403; + public final static int NOT_FOUND = 404; + public final static int CONFLICT = 409; + public final static int GONE = 410; + public final static int PRECONDITION_FAILED = 412; + public final static int UNSUPPORTED_MEDIA_TYPE = 415; + public final static int INTERNAL_SERVER_ERROR = 500; + public final static int NOT_IMPLEMENTED = 501; + public final static int SERVICE_UNAVAILABLE = 503; + + public static int codeForSymbol(String sym) { + String symbol = sym.toUpperCase(); + if (symbol.contains("OK")) { + return OK; + } else if ("CREATED".equals(symbol)) { + return CREATED; + } else if ("ACCEPTED".equals(symbol)) { + return ACCEPTED; + } else if ("NO_CONTENT".equals(symbol)) { + return NO_CONTENT; + } else if ("MOVED_PERMANENTLY".equals(symbol)) { + return MOVED_PERMANENTLY; + } else if ("FOUND".equals(symbol)) { + return FOUND; + } else if ("SEE_OTHER".equals(symbol)) { + return SEE_OTHER; + } else if ("NOT_MODIFIED".equals(symbol)) { + return NOT_MODIFIED; + } else if ("TEMPORARY_REDIRECT".equals(symbol)) { + return TEMPORARY_REDIRECT; + } else if ("BAD_REQUEST".equals(symbol)) { + return BAD_REQUEST; + } else if ("UNAUTHORIZED".equals(symbol)) { + return UNAUTHORIZED; + } else if ("FORBIDDEN".equals(symbol)) { + return FORBIDDEN; + } else if ("NOT_FOUND".equals(symbol)) { + return NOT_FOUND; + } else if ("CONFLICT".equals(symbol)) { + return CONFLICT; + } else if ("GONE".equals(symbol)) { + return GONE; + } else if ("PRECONDITION_FAILED".equals(symbol)) { + return PRECONDITION_FAILED; + } else if ("INTERNAL_SERVER_ERROR".equals(symbol)) { + return INTERNAL_SERVER_ERROR; + } else if ("NOT_IMPLEMENTED".equals(symbol)) { + return NOT_IMPLEMENTED; + } else if ("UNSUPPORTED_MEDIA_TYPE".equals(symbol)) { + return UNSUPPORTED_MEDIA_TYPE; + } else if ("SERVICE_UNAVAILABLE".equals(symbol)) { + return SERVICE_UNAVAILABLE; + } else { + try { + return Integer.parseInt(sym); + } catch (NumberFormatException e) { + } + } + return 0; + } + + public static String symbolForCode(int code) { + switch (code) { + case OK: + return "OK"; + case CREATED: + return "CREATED"; + case ACCEPTED: + return "ACCEPTED"; + case NO_CONTENT: + return "NO_CONTENT"; + case MOVED_PERMANENTLY: + return "MOVED_PERMANENTLY"; + case FOUND: + return "FOUND"; + case SEE_OTHER: + return "SEE_OTHER"; + case NOT_MODIFIED: + return "NOT_MODIFIED"; + case TEMPORARY_REDIRECT: + return "TEMPORARY_REDIRECT"; + case BAD_REQUEST: + return "BAD_REQUEST"; + case UNAUTHORIZED: + return "UNAUTHORIZED"; + case FORBIDDEN: + return "FORBIDDEN"; + case NOT_FOUND: + return "NOT_FOUND"; + case CONFLICT: + return "CONFLICT"; + case GONE: + return "GONE"; + case PRECONDITION_FAILED: + return "PRECONDITION_FAILED"; + case INTERNAL_SERVER_ERROR: + return "INTERNAL_SERVER_ERROR"; + case NOT_IMPLEMENTED: + return "NOT_IMPLEMENTED"; + case UNSUPPORTED_MEDIA_TYPE: + return "UNSUPPORTED_MEDIA_TYPE"; + case SERVICE_UNAVAILABLE: + return "SERVICE_UNAVAILABLE"; + } + return null; + } + + int code; + Object data; + + public ResourceException(int code) { + this(code, symbolForCode(code)); + } + + public ResourceException(int code, Object data) { + super("ResourceException (" + code + "): " + data); + this.code = code; + this.data = data; + } + + public int getCode() { + return code; + } + + public Object getData() { + return data; + } + + public T getData(Class cl) { + return cl.cast(data); + } +} diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/RestCoreResourceConfig.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/RestCoreResourceConfig.java new file mode 100644 index 00000000000..7d101da9077 --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/rest/RestCoreResourceConfig.java @@ -0,0 +1,123 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import java.util.HashSet; +import java.util.HashMap; + +import org.glassfish.jersey.server.ResourceConfig; +import org.glassfish.jersey.jackson.JacksonFeature; +import org.glassfish.hk2.utilities.binding.AbstractBinder; + +/* + * This is used to setup the application configuration for authorities, + * authorizer, supported content-providers, and delegate. + */ +public class RestCoreResourceConfig extends ResourceConfig { + + // map of authorizer and authority objects + @SuppressWarnings("rawtypes") + HashMap authObjMap = new HashMap(); + + // typically contains delegate binding (AbstractBinder) + // + HashSet singletons; + + + public RestCoreResourceConfig(HashSet> resources, HashSet singletonSet) { + if (resources == null || resources.isEmpty()) { + throw new ResourceException(ResourceException.BAD_REQUEST, "Missing required parameter: resources"); + } + + StringBuilder packageList = new StringBuilder(256); + int pkgCnt = 0; + for (Class klass: resources) { + Package pkg = klass.getPackage(); + if (pkg == null) { + continue; + } + + String pkgName = pkg.getName(); + if (pkgName == null || pkgName.length() == 0) { + continue; + } + + if (pkgCnt > 0) { + packageList.append(";"); + } + packageList.append(pkgName); + ++pkgCnt; + } + + setupPackages(packageList.toString()); + + setSingletons(singletonSet); + } + + void setupPackages(String packageList) { + packages(packageList) + .register(JacksonFeature.class); + } + + public void setSingletons(HashSet singletonSet) { + if (singletonSet == null) { + return; + } else if (singletons == null) { + singletons = singletonSet; + } else { + for (Object singletonObj : singletonSet) { + singletons.add(singletonObj); + } + } + } + + // for setting Authority list and Authorizer + @SuppressWarnings("rawtypes") + public void setAuthorityObject(Class klassType, Object authObj) { + authObjMap.put(klassType, authObj); + } + + @SuppressWarnings({ "unchecked", "rawtypes" }) + public void registerAll() { + // register the authority objects + if (authObjMap.isEmpty()) { + throw new ResourceException(ResourceException.BAD_REQUEST, "Missing required parameter: authorizer or authorities"); + } + + AbstractBinder binder = new AbstractBinder() { + final HashMap authMap = authObjMap; + + @Override + protected void configure() { + for (Class klass: authMap.keySet()) { + bind(klass).in(javax.inject.Singleton.class); + bind(klass.cast(authMap.get(klass))).to(klass); + } + } + }; + registerInstances(binder); + + if (singletons == null || singletons.isEmpty()) { + throw new ResourceException(ResourceException.BAD_REQUEST, "Missing required parameter: singletons (delegate for the resource)"); + } + + // register the singletons + for (Object singletonObj : singletons) { + registerInstances(singletonObj); + } + } +} + diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/ServletRequestUtil.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/ServletRequestUtil.java new file mode 100644 index 00000000000..544ef5b545e --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/ServletRequestUtil.java @@ -0,0 +1,55 @@ + +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.util; + +import javax.servlet.http.HttpServletRequest; +import org.eclipse.jetty.server.Request; + +import com.yahoo.rdl.Timestamp; + +public class ServletRequestUtil { + + public static final String LOOPBACK_ADDRESS = "127.0.0.1"; + public static final String XFF_HEADER = "X-Forwarded-For"; + + /** + * Return the remote client IP address. + * Detect if connection is from ATS by looking at XFF header. + * If XFF header, return the last address therein since it was added by ATS. + **/ + public static String getRemoteAddress(final HttpServletRequest request) { + String addr = request.getRemoteAddr(); + if (LOOPBACK_ADDRESS.equals(addr)) { + String xff = request.getHeader(XFF_HEADER); + if (xff != null) { + String[] addrs = xff.split(","); + addr = addrs[addrs.length - 1].trim(); + } + } + return addr; + } + + /** + * Returns RFC3339 based time stamp String. + **/ + public static String getTimeStamp(final Request request) { + Timestamp ts = Timestamp.fromMillis(request.getTimeStamp()); + return ts.toString(); + } + +} + diff --git a/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/StringUtils.java b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/StringUtils.java new file mode 100644 index 00000000000..2fc2662284d --- /dev/null +++ b/libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/StringUtils.java @@ -0,0 +1,67 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.util; + +public class StringUtils { + + public static String removeLeadingAndTrailingQuotes(String value) { + if (value.startsWith("\"")) { + value = value.substring(1, value.length()); + } + if (value.endsWith("\"")) { + value = value.substring(0, value.length() - 1); + } + return value; + } + + public static boolean isRegexMetaCharacter(char regexChar) { + switch (regexChar) { + case '^': + case '$': + case '.': + case '|': + case '[': + case '+': + case '\\': + case '(': + case ')': + case '{': + return true; + default: + return false; + } + } + + public static String patternFromGlob(String glob) { + StringBuilder sb = new StringBuilder("^"); + int len = glob.length(); + for (int i = 0; i < len; i++) { + char c = glob.charAt(i); + if (c == '*') { + sb.append(".*"); + } else if (c == '?') { + sb.append('.'); + } else { + if (isRegexMetaCharacter(c)) { + sb.append('\\'); + } + sb.append(c); + } + } + sb.append("$"); + return sb.toString(); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugKerberosAuthorityTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugKerberosAuthorityTest.java new file mode 100644 index 00000000000..70038ce530e --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugKerberosAuthorityTest.java @@ -0,0 +1,95 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.common.server.debug.DebugKerberosAuthority; + +import static org.testng.Assert.*; + +public class DebugKerberosAuthorityTest { + + static final String KRB_TOKEN = "YIIB6wYJKoZIhvcSAQICAQBuggHaMIIB1qADAgEFoQMCAQ6iBwMFAAAAAACjggEGYYIBAjCB/6ADAgEFoQ0bC0VYQU1QTEUuQ09NojAwLqADAgEAoScwJRsHZGF0YWh1YhsTZGF0YWh1Yi5leGFtcGxlLmNvbRsFYnVsbHmjgbYwgbOgAwIBA6KBqwSBqMJGf4H5nrRIdDyNxHp5fwxW6lsiFi+qUjryPvgiOAl/XldfwmKd9wXbQn00VBNhK+oVxmKv0V0J80e4oTdUnc+NlU/BJNCfsLPFTdYntc4A/ffdnsY7/U5HktTaWMfhvWxYocvhqISFTIFUT1+pH5742IWYNTgvFd5vkudibB3ijCanbMYv9CQXEjV+380rnf3gdLD2JGuxmaU78aJjDDKETL6Ck/qz8KSBtjCBs6ADAgEDooGrBIGoMrzLCTUi59wEoWX02+42K5m1MzW6HMNSuvfQeVGJdzPBsiFmZweNfJF6L9LdmLjQR4jSVUhVo3neFZmUN8G532wvZeKbHOtkXTnLRRdif+DoKyI8GOkbHu1CZlevcQZ0sgzyiH0wfQ/0nguE4kH7a2bM7HlV7N6MRGkC4DDkJZDNHxQr27FbZqrqEyw498HXPTtF93JGsKjXB8Z/wDaPs4PpdfoThTol"; + private static final String ATHENZ_USER_DOMAIN = "athenz.user_domain"; + private static final String USER_DOMAIN = System.getProperty(ATHENZ_USER_DOMAIN, "user"); + + @Test + public void testDebugKerberosAuthority() { + + Authority authority = new DebugKerberosAuthority(); + assertNotNull(authority); + + authority.initialize(); + + assertEquals(authority.getDomain(), USER_DOMAIN); + assertEquals(authority.getHeader(), DebugKerberosAuthority.KRB_HEADER); + + // invalid authenticate values + assertNull(authority.authenticate(null, "6.21.20.16", "GET", null)); + assertNull(authority.authenticate("abc", "6.21.20.16", "GET", null)); + assertNull(authority.authenticate(KRB_TOKEN, "6.21.20.16", "GET", null)); + + // valid values + Principal prnc = authority.authenticate(DebugKerberosAuthority.TOKEN_PREFIX + " " + KRB_TOKEN, "6.21.20.16", "GET", null); + assertNotNull(prnc); + assertEquals(prnc.getDomain(), USER_DOMAIN); + assertEquals(prnc.getName(), "anonymous"); + assertEquals(prnc.getCredentials(), KRB_TOKEN); + assertNull(prnc.getRoles()); + } + + @Test + public void testDebugKerberosAuthoritySysProp() { + + System.setProperty(DebugKerberosAuthority.ATHENZ_PROP_USER_NAME, "tiesto"); + + Authority authority = new DebugKerberosAuthority(); + assertNotNull(authority); + + authority.initialize(); + + assertEquals(authority.getDomain(), USER_DOMAIN); + assertEquals(authority.getHeader(), DebugKerberosAuthority.KRB_HEADER); + + // invalid authenticate values + assertNull(authority.authenticate(null, "6.21.20.16", "GET", null)); + assertNull(authority.authenticate("abc", "6.21.20.16", "GET", null)); + assertNull(authority.authenticate(KRB_TOKEN, "6.21.20.16", "GET", null)); + + // valid values + Principal prnc = authority.authenticate(DebugKerberosAuthority.TOKEN_PREFIX + " " + KRB_TOKEN, "6.21.20.16", "GET", null); + assertNotNull(prnc); + assertEquals(prnc.getDomain(), USER_DOMAIN); + assertEquals(prnc.getName(), "tiesto"); + assertEquals(prnc.getCredentials(), KRB_TOKEN); + assertNull(prnc.getRoles()); + + // now use debug token that contains user name + String token = DebugKerberosAuthority.TOKEN_PREFIX + " " + DebugKerberosAuthority.TOKEN_DEBUG_USER_FIELD + "jamesdean"; + prnc = authority.authenticate(token, "6.21.20.16", "GET", null); + assertNotNull(prnc); + assertEquals(prnc.getDomain(), USER_DOMAIN); + assertEquals(prnc.getName(), "jamesdean"); + assertEquals(prnc.getCredentials(), DebugKerberosAuthority.TOKEN_DEBUG_USER_FIELD + "jamesdean"); + assertNull(prnc.getRoles()); + + System.clearProperty(DebugKerberosAuthority.ATHENZ_PROP_USER_NAME); + } +} + diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugPrincipalAuthorityTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugPrincipalAuthorityTest.java new file mode 100644 index 00000000000..35536eb68cd --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugPrincipalAuthorityTest.java @@ -0,0 +1,57 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority; + +import static org.testng.Assert.*; + +public class DebugPrincipalAuthorityTest { + + @Test + public void testPrincipalAuthority() { + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + assertNotNull(principalAuthority); + + principalAuthority.initialize(); + ((DebugPrincipalAuthority) principalAuthority).setKeyStore(null); + + assertNull(principalAuthority.getDomain()); + assertEquals(principalAuthority.getHeader(), "Athenz-Principal-Auth"); + + // invalid authenticate values + + assertNull(principalAuthority.authenticate(null, "10.11.12.13", "GET", null)); + assertNull(principalAuthority.authenticate("abc", "10.11.12.13", "GET", null)); + assertNull(principalAuthority.authenticate("v=S1;d=coretech;s=signature", "10.11.12.13", "GET", null)); + assertNull(principalAuthority.authenticate("v=S1;n=storage;s=signature", "10.11.12.13", "GET", null)); + + // valid values + + String token = "v=S1;d=coretech;n=storage;s=signature"; + Principal p = principalAuthority.authenticate(token, "10.11.12.13", "GET", null); + assertNotNull(p); + assertEquals(p.getDomain(), "coretech"); + assertEquals(p.getName(), "storage"); + assertEquals(p.getCredentials(), token); + assertNull(p.getRoles()); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugRoleAuthorityTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugRoleAuthorityTest.java new file mode 100644 index 00000000000..3b1d7f07593 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugRoleAuthorityTest.java @@ -0,0 +1,65 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import java.util.List; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.common.server.debug.DebugRoleAuthority; + +import static org.testng.Assert.*; + +public class DebugRoleAuthorityTest { + + @Test + public void testRoleAuthority() { + + Authority roleAuthority = new com.yahoo.athenz.common.server.debug.DebugRoleAuthority(); + assertNotNull(roleAuthority); + + roleAuthority.initialize(); + ((DebugRoleAuthority) roleAuthority).setKeyStore(null); + + assertNull(roleAuthority.getDomain()); + assertEquals(roleAuthority.getHeader(), "Athenz-Role-Auth"); + + // invalid authenticate values + assertNull(roleAuthority.authenticate(null, "10.11.12.13", "GET", null)); + assertNull(roleAuthority.authenticate("abc", "10.11.12.13", "GET", null)); + assertNull(roleAuthority.authenticate("v=Z1;d=coretech;s=signature", "10.11.12.13", "GET", null)); + assertNull(roleAuthority.authenticate("v=Z1;r=role1,role2,role3;s=signature", "10.11.12.13", "GET", null)); + assertNull(roleAuthority.authenticate("v=U1;d=coretech;r=role1,role2,role3;s=signature", "10.11.12.13", "GET", null)); + + // valid values + + String token = "v=Z1;d=coretech;r=role1,role2,role3;s=signature"; + Principal p = roleAuthority.authenticate(token, "10.11.12.13", "GET", null); + assertNotNull(p); + assertEquals(p.getDomain(), "coretech"); + assertEquals(p.getCredentials(), token); + + assertNull(p.getName()); + + List roles = p.getRoles(); + assertEquals(roles.size(), 3); + assertTrue(roles.contains("role1")); + assertTrue(roles.contains("role2")); + assertTrue(roles.contains("role3")); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugUserAuthorityTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugUserAuthorityTest.java new file mode 100644 index 00000000000..7e8bf55d555 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/debug/DebugUserAuthorityTest.java @@ -0,0 +1,52 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.debug; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; + +import static org.testng.Assert.*; + +public class DebugUserAuthorityTest { + + @Test + public void testUserAuthority() { + + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + assertNotNull(userAuthority); + + userAuthority.initialize(); + + assertEquals(userAuthority.getDomain(), "user"); + assertEquals(userAuthority.getHeader(), "Authorization"); + assertFalse(userAuthority.allowAuthorization()); + + // invalid authenticate values + assertNull(userAuthority.authenticate("Test Creds", "10.11.12.13", "GET", null)); + assertNull(userAuthority.authenticate("Basic !@#$#!@$#", "10.11.12.13", "GET", null)); + assertNull(userAuthority.authenticate("BasicdGVzdHVzZXI6dGVzdHB3ZA==", "10.11.12.13", "GET", null)); + + // valid values + + String token = "Basic dGVzdHVzZXI6dGVzdHB3ZA=="; + Principal p = userAuthority.authenticate(token, "10.11.12.13", "GET", null); + assertNotNull(p); + assertEquals(p.getDomain(), "user"); + assertEquals(p.getName(), "testuser"); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/ETagFilterTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/ETagFilterTest.java new file mode 100644 index 00000000000..1a085a0a861 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/ETagFilterTest.java @@ -0,0 +1,64 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.filters; + +import static org.testng.Assert.*; + +import javax.ws.rs.core.EntityTag; +import javax.ws.rs.core.HttpHeaders; +import javax.ws.rs.core.MultivaluedMap; +import javax.ws.rs.core.MultivaluedHashMap; +import javax.ws.rs.container.ContainerResponseContext; + +import org.mockito.Mockito; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.filters.ETagFilter; + +public class ETagFilterTest { + + ContainerResponseContext getContext(String tag) { + ContainerResponseContext context = Mockito.mock(ContainerResponseContext.class); + MultivaluedMap mvMap = new MultivaluedHashMap(); + mvMap.add(HttpHeaders.ETAG, tag); + Mockito.when(context.getHeaders()).thenReturn(mvMap); + return context; + } + + @Test + public void testFilterContainerETagSet() { + + ContainerResponseContext containerResponse = getContext("etag"); + + ETagFilter eTagFilter = new ETagFilter(); + eTagFilter.filter(null, containerResponse); + EntityTag eTag = (EntityTag) containerResponse.getHeaders().getFirst(HttpHeaders.ETAG); + assertNotNull(eTag); + assertEquals(eTag.getValue(), "etag"); + } + + @Test + public void testFilterContainerETagNotSet() { + + ContainerResponseContext containerResponse = getContext(null); + + ETagFilter eTagFilter = new ETagFilter(); + eTagFilter.filter(null, containerResponse); + EntityTag eTag = (EntityTag) containerResponse.getHeaders().getFirst(HttpHeaders.ETAG); + assertNull(eTag); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/MockHttpServletRequest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/MockHttpServletRequest.java new file mode 100644 index 00000000000..ecd95c6e5ee --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/MockHttpServletRequest.java @@ -0,0 +1,398 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.filters; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.UnsupportedEncodingException; +import java.security.Principal; +import java.util.Collection; +import java.util.Enumeration; +import java.util.Locale; +import java.util.Map; + +import javax.servlet.AsyncContext; +import javax.servlet.DispatcherType; +import javax.servlet.RequestDispatcher; +import javax.servlet.ServletContext; +import javax.servlet.ServletException; +import javax.servlet.ServletInputStream; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import javax.servlet.http.HttpUpgradeHandler; +import javax.servlet.http.Part; + +public class MockHttpServletRequest implements HttpServletRequest { + + private String method; + private String uri; + + @Override + public AsyncContext getAsyncContext() { + return null; + } + + @Override + public Object getAttribute(String arg0) { + return null; + } + + @Override + public Enumeration getAttributeNames() { + return null; + } + + @Override + public String getCharacterEncoding() { + return null; + } + + @Override + public int getContentLength() { + return 0; + } + + @Override + public long getContentLengthLong() { + return 0; + } + + @Override + public String getContentType() { + return null; + } + + @Override + public DispatcherType getDispatcherType() { + return null; + } + + @Override + public ServletInputStream getInputStream() throws IOException { + return null; + } + + @Override + public String getLocalAddr() { + return null; + } + + @Override + public String getLocalName() { + return null; + } + + @Override + public int getLocalPort() { + return 0; + } + + @Override + public Locale getLocale() { + return null; + } + + @Override + public Enumeration getLocales() { + return null; + } + + @Override + public String getParameter(String arg0) { + return null; + } + + @Override + public Map getParameterMap() { + return null; + } + + @Override + public Enumeration getParameterNames() { + return null; + } + + @Override + public String[] getParameterValues(String arg0) { + return null; + } + + @Override + public String getProtocol() { + return null; + } + + @Override + public BufferedReader getReader() throws IOException { + return null; + } + + @Override + public String getRealPath(String arg0) { + return null; + } + + @Override + public String getRemoteAddr() { + return null; + } + + @Override + public String getRemoteHost() { + return null; + } + + @Override + public int getRemotePort() { + return 0; + } + + @Override + public RequestDispatcher getRequestDispatcher(String arg0) { + return null; + } + + @Override + public String getScheme() { + return null; + } + + @Override + public String getServerName() { + return null; + } + + @Override + public int getServerPort() { + return 0; + } + + @Override + public ServletContext getServletContext() { + return null; + } + + @Override + public boolean isAsyncStarted() { + return false; + } + + @Override + public boolean isAsyncSupported() { + return false; + } + + @Override + public boolean isSecure() { + return false; + } + + @Override + public void removeAttribute(String arg0) { + } + + @Override + public void setAttribute(String arg0, Object arg1) { + } + + @Override + public void setCharacterEncoding(String arg0) + throws UnsupportedEncodingException { + } + + @Override + public AsyncContext startAsync() throws IllegalStateException { + return null; + } + + @Override + public AsyncContext startAsync(ServletRequest arg0, ServletResponse arg1) + throws IllegalStateException { + return null; + } + + @Override + public boolean authenticate(HttpServletResponse arg0) + throws IOException, ServletException { + return false; + } + + @Override + public String changeSessionId() { + return null; + } + + @Override + public String getAuthType() { + return null; + } + + @Override + public String getContextPath() { + return null; + } + + @Override + public Cookie[] getCookies() { + return null; + } + + @Override + public long getDateHeader(String arg0) { + return 0; + } + + @Override + public String getHeader(String arg0) { + return null; + } + + @Override + public Enumeration getHeaderNames() { + return null; + } + + @Override + public Enumeration getHeaders(String arg0) { + return null; + } + + @Override + public int getIntHeader(String arg0) { + return 0; + } + + @Override + public String getMethod() { + return method; + } + + @Override + public Part getPart(String arg0) throws IOException, ServletException { + return null; + } + + @Override + public Collection getParts() throws IOException, ServletException { + return null; + } + + @Override + public String getPathInfo() { + return null; + } + + @Override + public String getPathTranslated() { + return null; + } + + @Override + public String getQueryString() { + return null; + } + + @Override + public String getRemoteUser() { + return null; + } + + @Override + public String getRequestURI() { + return uri; + } + + @Override + public StringBuffer getRequestURL() { + return null; + } + + @Override + public String getRequestedSessionId() { + return null; + } + + @Override + public String getServletPath() { + return null; + } + + @Override + public HttpSession getSession() { + return null; + } + + @Override + public HttpSession getSession(boolean arg0) { + return null; + } + + @Override + public Principal getUserPrincipal() { + return null; + } + + @Override + public boolean isRequestedSessionIdFromCookie() { + return false; + } + + @Override + public boolean isRequestedSessionIdFromURL() { + return false; + } + + @Override + public boolean isRequestedSessionIdFromUrl() { + return false; + } + + @Override + public boolean isRequestedSessionIdValid() { + return false; + } + + @Override + public boolean isUserInRole(String arg0) { + return false; + } + + @Override + public void login(String arg0, String arg1) throws ServletException { + } + + @Override + public void logout() throws ServletException { + } + + @Override + public T upgrade(Class arg0) + throws IOException, ServletException { + return null; + } + + public void setMethod(String method) { + this.method = method; + } + + public void setRequestURI(String uri) { + this.uri = uri; + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/MockHttpServletResponse.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/MockHttpServletResponse.java new file mode 100644 index 00000000000..403d78cccb0 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/filters/MockHttpServletResponse.java @@ -0,0 +1,215 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.filters; + +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.PrintWriter; +import java.nio.charset.StandardCharsets; +import java.util.Collection; +import java.util.Locale; + +import javax.servlet.ServletOutputStream; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletResponse; + + +public class MockHttpServletResponse implements HttpServletResponse { + + private int contentLength = 0; + private int status = 0; + private ByteArrayOutputStream byteOutputStream = new ByteArrayOutputStream(); + private PrintWriter writer = new PrintWriter(byteOutputStream); + + public String getWriterData() throws IOException { + writer.flush(); + byteOutputStream.flush(); + return new String(byteOutputStream.toByteArray(), StandardCharsets.UTF_8); + } + + @Override + public void flushBuffer() throws IOException { + } + + @Override + public int getBufferSize() { + return 0; + } + + public int getContentLength() { + return contentLength; + } + + @Override + public String getCharacterEncoding() { + return null; + } + + @Override + public String getContentType() { + return null; + } + + @Override + public Locale getLocale() { + return null; + } + + @Override + public ServletOutputStream getOutputStream() throws IOException { + return null; + } + + @Override + public PrintWriter getWriter() throws IOException { + return writer; + } + + @Override + public boolean isCommitted() { + return false; + } + + @Override + public void reset() { + + } + + @Override + public void resetBuffer() { + + } + + @Override + public void setBufferSize(int arg0) { + } + + @Override + public void setCharacterEncoding(String arg0) { + } + + @Override + public void setContentLength(int length) { + contentLength = length; + } + + @Override + public void setContentLengthLong(long arg0) { + } + + @Override + public void setContentType(String arg0) { + } + + @Override + public void setLocale(Locale arg0) { + } + + @Override + public void addCookie(Cookie arg0) { + } + + @Override + public void addDateHeader(String arg0, long arg1) { + } + + @Override + public void addHeader(String arg0, String arg1) { + } + + @Override + public void addIntHeader(String arg0, int arg1) { + } + + @Override + public boolean containsHeader(String arg0) { + return false; + } + + @Override + public String encodeRedirectURL(String arg0) { + return null; + } + + @Override + public String encodeRedirectUrl(String arg0) { + return null; + } + + @Override + public String encodeURL(String arg0) { + return null; + } + + @Override + public String encodeUrl(String arg0) { + return null; + } + + @Override + public String getHeader(String arg0) { + return null; + } + + @Override + public Collection getHeaderNames() { + return null; + } + + @Override + public Collection getHeaders(String arg0) { + return null; + } + + @Override + public int getStatus() { + return status; + } + + @Override + public void sendError(int arg0) throws IOException { + } + + @Override + public void sendError(int arg0, String arg1) throws IOException { + } + + @Override + public void sendRedirect(String arg0) throws IOException { + } + + @Override + public void setDateHeader(String arg0, long arg1) { + } + + @Override + public void setHeader(String arg0, String arg1) { + } + + @Override + public void setIntHeader(String arg0, int arg1) { + } + + @Override + public void setStatus(int arg0) { + status = arg0; + } + + @Override + public void setStatus(int arg0, String arg1) { + status = arg0; + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/AthenzRequestLogTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/AthenzRequestLogTest.java new file mode 100644 index 00000000000..5434c93361d --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/AthenzRequestLogTest.java @@ -0,0 +1,216 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log; + +import org.eclipse.jetty.server.Request; +import org.eclipse.jetty.server.Response; + +import org.mockito.Mockito; +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; + +import org.testng.annotations.Test; +import org.testng.annotations.BeforeClass; + +import static org.testng.Assert.*; + +import com.yahoo.athenz.common.server.log.AthenzRequestLog; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.rdl.Timestamp; + +public class AthenzRequestLogTest { + + @Mock Request mockRequest; + + long currentTimeMillis = System.currentTimeMillis(); + java.util.Enumeration testHeadersEnum = null; + + final static String CRED_IN_ERROR = "v=S1;d=cd.project;n=nfl;h=somehost.somecompany.com;a=saltvalue;t=1447361732;e=1447361742"; + + final static String CRED_ATTR_ERROR = ":error: PrincipalAuthority:authenticate: service token validation failure: Token:validate: token=v=S1;d=cd.project;n=nfl;h=somehost.somecompany.com;a=saltvalue;t=1447361732;e=1447361742 : has expired time=1447361742 : current time=1447465088 : credential=" + CRED_IN_ERROR; + + final static java.util.Set auditLogMsgs = new java.util.HashSet(); + final static java.util.Set jettyLogMsgs = new java.util.HashSet(); + + static AuditLogger auditLogger; + + static org.eclipse.jetty.util.log.Logger jettyLogger; + + @BeforeClass + public void setUp() throws Exception { + MockitoAnnotations.initMocks(this); + Mockito.when(mockRequest.getRemoteAddr()).thenReturn("11.16.20.15"); + Mockito.when(mockRequest.getLocalName()).thenReturn("FakeTestHostName"); + Mockito.when(mockRequest.getServerPort()).thenReturn(4666); + Mockito.when(mockRequest.getRequestURI()).thenReturn("/domain/jupiter/moons"); + Mockito.when(mockRequest.getRemoteUser()).thenReturn("FakeUserId"); + Mockito.when(mockRequest.getMethod()).thenReturn("GET"); + Mockito.when(mockRequest.getAttribute("com.yahoo.athenz.auth.credential.error")).thenReturn(CRED_ATTR_ERROR); + Mockito.when(mockRequest.getTimeStamp()).thenReturn(currentTimeMillis); + + java.util.Hashtable reqHeaders = new java.util.Hashtable<>(); + testHeadersEnum = reqHeaders.keys(); + Mockito.when(mockRequest.getHeaderNames()).thenReturn(testHeadersEnum); + org.eclipse.jetty.http.HttpURI httpUri = new org.eclipse.jetty.http.HttpURI(); + Mockito.when(mockRequest.getHttpURI()).thenReturn(httpUri); + + auditLogger = new AuditLogger() { + @Override + public void log(String msg, String msgVersion) { + auditLogMsgs.add(msg); + } + + @Override + public void log(AuditLogMsgBuilder msgBldr) { + auditLogMsgs.add(msgBldr.build()); + } + + }; + + jettyLogger = new org.eclipse.jetty.util.log.Logger() { + public String getName() { return "TestLogger"; } + public void warn(String msg, Object... args) { + jettyLogMsgs.add(msg); + } + public void warn(Throwable thrown) { } + public void warn(String msg, Throwable thrown) {} + public void info(String msg, Object... args) {} + public void info(Throwable thrown) {} + public void info(String msg, Throwable thrown) {} + public boolean isDebugEnabled() { return true; } + public void setDebugEnabled(boolean enabled) {} + public void debug(String msg, Object... args) {} + public void debug(String msg, long value) {} + public void debug(Throwable thrown) {} + public void debug(String msg, Throwable thrown) {} + public org.eclipse.jetty.util.log.Logger getLogger(String name) { return this; } + public void ignore(Throwable ignored) {} + }; + + } + + @Test + public void testGetAuditLogMsgBuilder() { + AthenzRequestLog log = new AthenzRequestLog(); + AuditLogMsgBuilder msgBldr = log.getAuditLogMsgBuilder(mockRequest); + + String httpMethod = msgBldr.whatMethod(); + assertTrue(httpMethod.equals("GET"), httpMethod); + + String who = msgBldr.who(); + assertTrue(who.equals(CRED_IN_ERROR), who); + + String why = msgBldr.why(); + assertTrue(why.equals(AthenzRequestLog.AUDIT_LOG_CRED_REF), why); + + String api = msgBldr.whatApi(); + assertTrue(api.equals("/domain/jupiter/moons"), api); + + String when = msgBldr.when(); + Timestamp ts = Timestamp.fromMillis(currentTimeMillis); + assertTrue(ts.toString().equals(when), when); + + String remoteAddr = msgBldr.clientIp(); + assertTrue(remoteAddr.equals("11.16.20.15"), remoteAddr); + + String where = msgBldr.where(); + assertTrue(where.contains("FakeTestHostName"), where); + assertTrue(where.contains("4666"), where); + + String entity = msgBldr.whatEntity(); + assertTrue(entity.equals(AthenzRequestLog.AUDIT_CRED_ERROR_ATTR), entity); + + String credErr = msgBldr.whatDetails(); + assertTrue(credErr.equals("CRED_ERROR=(" + CRED_ATTR_ERROR + ");REMOTEUSER=(FakeUserId);"), credErr); + } + + @Test + public void testLogWithAuditLogger() { + + long bytesSent = 4 * 1024 * 1024; + String contentType = "text/html; charset=iso-8859-1"; + int responseCode = 401; + String reason = "bad credential"; + + Response mockResponse = Mockito.mock(Response.class); + Mockito.when(mockResponse.getLongContentLength()).thenReturn(bytesSent); + Mockito.when(mockResponse.getContentType()).thenReturn(contentType); + Mockito.when(mockResponse.getStatus()).thenReturn(responseCode); + Mockito.when(mockResponse.getReason()).thenReturn(reason); + + Timestamp ts = Timestamp.fromMillis(currentTimeMillis); + String when = ts.toString(); + + AthenzRequestLog log = new AthenzRequestLog("/dev/null", auditLogger); + log.log(mockRequest, mockResponse); + + for (String val: auditLogMsgs) { + assertTrue(val.contains("WHEN=(" + when), val); + assertTrue(val.contains("WHO=(" + CRED_IN_ERROR + ")"), val); + assertTrue(val.contains("WHY=(" + AthenzRequestLog.AUDIT_LOG_CRED_REF), val); + assertTrue(val.contains("WHERE=(server-ip=FakeTestHostName"), val); + assertTrue(val.contains("CLIENT-IP=(11.16.20.15)"), val); + assertTrue(val.contains("WHAT-method=(GET)"), val); + assertTrue(val.contains("WHAT-api=(/domain/jupiter/moons)"), val); + assertTrue(val.contains("WHAT-entity=(" + AthenzRequestLog.AUDIT_CRED_ERROR_ATTR), val); + assertTrue(val.contains("WHAT-details=(CRED_ERROR=(" + CRED_ATTR_ERROR + ");REMOTEUSER=(FakeUserId);"), val); + } + } + + @Test + public void testLogWithoutAuditLogger() throws Exception { + + long bytesSent = 4 * 1024 * 1024; + String contentType = "text/html; charset=iso-8859-1"; + int responseCode = 401; + String reason = "bad credential"; + + Response mockResponse = Mockito.mock(Response.class); + Mockito.when(mockResponse.getLongContentLength()).thenReturn(bytesSent); + Mockito.when(mockResponse.getContentType()).thenReturn(contentType); + Mockito.when(mockResponse.getStatus()).thenReturn(responseCode); + Mockito.when(mockResponse.getReason()).thenReturn(reason); + + Timestamp ts = Timestamp.fromMillis(currentTimeMillis); + String when = ts.toString(); + + AthenzRequestLog log = new AthenzRequestLog() { + protected org.eclipse.jetty.util.log.Logger getBackupLogger() { + return jettyLogger; + } + }; + log.log(mockRequest, mockResponse); + + for (String val: jettyLogMsgs) { + assertTrue(val.contains("WHEN=(" + when), val); + assertTrue(val.contains("WHO=(" + CRED_IN_ERROR + ")"), val); + assertTrue(val.contains("WHY=(" + AthenzRequestLog.AUDIT_LOG_CRED_REF), val); + assertTrue(val.contains("WHERE=(server-ip=FakeTestHostName"), val); + assertTrue(val.contains("CLIENT-IP=(11.16.20.15)"), val); + assertTrue(val.contains("WHAT-method=(GET)"), val); + assertTrue(val.contains("WHAT-api=(/domain/jupiter/moons)"), val); + assertTrue(val.contains("WHAT-entity=(" + AthenzRequestLog.AUDIT_CRED_ERROR_ATTR), val); + assertTrue(val.contains("WHAT-details=(CRED_ERROR=(" + CRED_ATTR_ERROR + ");REMOTEUSER=(FakeUserId);"), val); + } + } + + @Test + public void testGetAuditLogMsgBuilderFileNameOnly() { + AthenzRequestLog log = new AthenzRequestLog("/dev/null"); + assertNotNull(log); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/AuditLogMsgBuilderTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/AuditLogMsgBuilderTest.java new file mode 100644 index 00000000000..9e3ecf3ad89 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/AuditLogMsgBuilderTest.java @@ -0,0 +1,664 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log.impl; + +import java.util.Arrays; +import java.util.List; +import java.util.Set; +import java.util.HashSet; +import java.util.regex.Pattern; + +import org.testng.Assert; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.impl.DefaultAuditLogMsgBuilder; +import com.yahoo.rdl.*; + +/** + * Test all API of AuditLogMsgBuilder. + * Test the getMsgBuilder() API of AuditLogFactory. + */ +public class AuditLogMsgBuilderTest { + + private static final String ZMS_USER_DOMAIN = "athenz.user_domain"; + private static final String USER_DOMAIN = System.getProperty(ZMS_USER_DOMAIN, "user"); + + static String TOKEN_STR = "v=U1;d=" + USER_DOMAIN + ";n=roger;h=somehost.somecompany.com;a=666;t=1492;e=2493;s=signature;"; + + static Array assertsOrig = null; + static Array assertsNew = null; + + DefaultAuditLogMsgBuilder starter(final String whatApi) { + AuditLogMsgBuilder msgBldr = AuditLogFactory.getMsgBuilder(); + msgBldr.who(TOKEN_STR).when(Timestamp.fromCurrentTime()).clientIp("12.12.12.12").whatApi(whatApi); + return (DefaultAuditLogMsgBuilder)msgBldr; + } + + Struct setupEntity(final String [] keys, final Object [] vals) { + Struct entity = new Struct().with(keys[0], vals[0]); + for (int cnt = 1; cnt < keys.length; ++cnt) { + entity.with(keys[cnt], vals[cnt]); + } + return entity; + } + + @BeforeClass + public static synchronized void setUp() throws Exception { + Struct assert1 = new Struct().with("role", "worker").with("resource", "potatoes").with("action", "eat"); + Struct assert2 = new Struct().with("role", "worker").with("resource", "yams").with("action", "eat"); + Struct assert3 = new Struct().with("role", "child").with("resource", "cereal").with("action", "slurp"); + assertsOrig = new Array().with(assert1).with(assert2).with(assert3); + + Struct assert1n = new Struct().with("role", "worker").with("resource", "apples").with("action", "eat"); + Struct assert2n = new Struct().with("role", "worker").with("resource", "yams").with("action", "eat"); + Struct assert3n = new Struct().with("role", "child").with("resource", "cereal").with("action", "chomp"); + assertsNew = new Array().with(assert1n).with(assert2n).with(assert3n); + } + + @Test + public void testGetMsgBuilderClassName() { + String auditLogMsgBuilderClassName = "com.yahoo.athenz.common.server.log.impl.TestMsgBuilder"; + try { + AuditLogMsgBuilder msgBldr = AuditLogFactory.getMsgBuilder(auditLogMsgBuilderClassName); + String dataStr = "getMsgBuilder"; + msgBldr.whatApi(dataStr); + Assert.assertTrue(msgBldr.whatApi().equals(dataStr), "whatApi string=" + msgBldr.whatApi()); + dataStr = msgBldr.getClass().getName(); + Assert.assertTrue(dataStr.equals(auditLogMsgBuilderClassName), "classname=" + dataStr); + } catch (Exception exc) { + Assert.fail("Should have created the AuditLogMsgBuilder=TestMsgBuilder", exc); + } + } + + @Test + public void testWho() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWho"); + String dataStr = "me?"; + msgBldr.who(dataStr); + Assert.assertTrue(msgBldr.who().equals(dataStr), "who string=" + msgBldr.who()); + } + + @Test + public void testWhy() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhy"); + String dataStr = "not?"; + msgBldr.why(dataStr); + Assert.assertTrue(msgBldr.why().equals(dataStr), "why string=" + msgBldr.why()); + } + + @Test + public void testWhenTimestamp() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhenTimestamp"); + Timestamp ts = Timestamp.fromCurrentTime(); + msgBldr.when(ts); + String dataStr = ts.toString(); + Assert.assertTrue(msgBldr.when().equals(dataStr), "when string=" + msgBldr.when()); + } + + @Test + public void testWhenString() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhenString"); + String dataStr = "now?"; + msgBldr.when(dataStr); + Assert.assertTrue(msgBldr.when().equals(dataStr), "when string=" + msgBldr.when()); + } + + @Test + public void testClientIp() { + DefaultAuditLogMsgBuilder msgBldr = starter("testClientIp"); + String dataStr = "99.77.22.hup"; + msgBldr.clientIp(dataStr); + Assert.assertTrue(msgBldr.clientIp().equals(dataStr), "clientIp string=" + msgBldr.clientIp()); + } + + @Test + public void testWhereIp() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhereIp"); + String dataStr = "128.33.42.76"; + msgBldr.whereIp(dataStr); + Assert.assertTrue(msgBldr.where().contains("server-ip=" + dataStr), "whereIp string=" + msgBldr.where()); + } + + @Test + public void testWhereHttpsPort() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhereHttpsPort"); + String dataStr = "4443"; + msgBldr.whereHttpsPort(dataStr); + Assert.assertTrue(msgBldr.where().contains("server-https-port=" + dataStr), "whereHttpsPort string=" + msgBldr.where()); + } + + @Test + public void testWhereHttpPort() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhereHttpPort"); + String dataStr = "80"; + msgBldr.whereHttpPort(dataStr); + Assert.assertTrue(msgBldr.where().contains("server-http-port=" + dataStr), "whereHttpPort string=" + msgBldr.where()); + } + + @Test + public void testWhereIpPortHttpsPort() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhereIpPortHttpsPort"); + String ipStr = "128.33.42.76"; + msgBldr.whereIp(ipStr); + String httpsPortStr = "4443"; + msgBldr.whereHttpsPort(httpsPortStr); + String httpPortStr = "80"; + msgBldr.whereHttpPort(httpPortStr); + + Assert.assertTrue(msgBldr.where().contains("server-ip=" + ipStr), "where string=" + msgBldr.where()); + Assert.assertTrue(msgBldr.where().contains("server-https-port=" + httpsPortStr), "where string=" + msgBldr.where()); + Assert.assertTrue(msgBldr.where().contains("server-http-port=" + httpPortStr), "where string=" + msgBldr.where()); + } + + @Test + public void testWhatMethod() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatMethod"); + String dataStr = "PUT"; + msgBldr.whatMethod(dataStr); + Assert.assertTrue(msgBldr.whatMethod().equals(dataStr), "whatMethod string=" + msgBldr.whatMethod()); + } + + @Test + public void testWhatApi() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatApi"); + String dataStr = "putRole"; + msgBldr.whatApi(dataStr); + Assert.assertTrue(msgBldr.whatApi().equals(dataStr), "whatApi string=" + msgBldr.whatApi()); + } + + @Test + public void testWhatDomain() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatDomain"); + String dataStr = "sys.auth"; + msgBldr.whatDomain(dataStr); + Assert.assertTrue(msgBldr.whatDomain().equals(dataStr), "whatDomain string=" + msgBldr.whatDomain()); + } + + @Test + public void testWhatEntity() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatEntity"); + String dataStr = "readers"; + msgBldr.whatEntity(dataStr); + Assert.assertTrue(msgBldr.whatEntity().equals(dataStr), "whatEntity string=" + msgBldr.whatEntity()); + } + + /** + * Test method for {@link com.yahoo.athenz.common.server.log.impl.DefaultAuditLogMsgBuilder#buildDiffKeys(java.util.Set, com.yahoo.data.Struct, java.lang.StringBuilder)}. + */ + @Test + public void testBuildDiffKeys() { + String []keyNames = new String[] { "alpha", "beta" }; + String []vals = new String[] { "Apple", "Banana" }; + Struct entity = setupEntity(keyNames, vals); + Set keys = entity.keySet(); + + DefaultAuditLogMsgBuilder msgBldr = starter("testBuildDiffKeys"); + StringBuilder sb = new StringBuilder(""); + msgBldr.buildDiffKeys(keys, entity, sb); + String diff = sb.toString(); + Assert.assertTrue(diff.contains("alpha=\"Apple\""), "Test string=" + diff); + Assert.assertTrue(diff.contains("beta=\"Banana\""), "Test string=" + diff); + } + + @Test + public void testBuildDiffValueSet() { + + String []svals = new String[] { "Apple", "Banana", "PawPaw" }; + List vals = Arrays.asList( svals ); + Set valSet = new HashSet(vals); + + DefaultAuditLogMsgBuilder msgBldr = starter("testBuildDiffValueSet"); + StringBuilder sb = new StringBuilder(""); + msgBldr.buildDiffValueSet(valSet, sb); + String diff = sb.toString(); + Assert.assertTrue(diff.contains("Apple") && diff.contains("Banana") && diff.contains("PawPaw"), "Test string=" + diff); + } + + @Test + public void testBuildDiffArray() { + + DefaultAuditLogMsgBuilder msgBldr = starter("testBuildArrayDiff"); + StringBuilder addedSetSb = new StringBuilder(); + StringBuilder removedSetSb = new StringBuilder(); + msgBldr.buildDiffArray(assertsOrig, assertsNew, addedSetSb, removedSetSb); + + // Added-str={role: "child", resource: "cereal", action: "chomp"},{role: "worker", resource: "apples", action: "eat"} + // Removed-str={role: "worker", resource: "potatoes", action: "eat"},{role: "child", resource: "cereal", action: "slurp"} + boolean match = addedSetSb.indexOf("child") != -1 && + addedSetSb.indexOf("cereal") != -1 && addedSetSb.indexOf("chomp") != -1 && + addedSetSb.indexOf("slurp") == -1; + Assert.assertTrue(match, "Added-str for child=" + addedSetSb); + match = addedSetSb.indexOf("worker") != -1 && + addedSetSb.indexOf("apples") != -1 && addedSetSb.indexOf("eat") != -1 && + addedSetSb.indexOf("yams") == -1; + Assert.assertTrue(match, "Added-str for worker=" + addedSetSb); + + match = removedSetSb.indexOf("child") != -1 && + removedSetSb.indexOf("cereal") != -1 && removedSetSb.indexOf("slurp") != -1 && + removedSetSb.indexOf("chomp") == -1; + Assert.assertTrue(match, "Removed-str for child=" + removedSetSb); + match = removedSetSb.indexOf("worker") != -1 && + removedSetSb.indexOf("potatoes") != -1 && removedSetSb.indexOf("eat") != -1 && + removedSetSb.indexOf("yams") == -1; + Assert.assertTrue(match, "Removed-str for worker=" + removedSetSb); + } + + @Test + public void testWhatSubDetailsEntityStruct() { + // test Struct inside of Struct + // Entity from ZMS schema: contains 'name' as String and 'value' as Struct + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatDetailsEntityStruct"); + Struct origValue = new Struct().with("field", "of_dreams").with("champ", "de_reve").with("same", "thing"); + Struct newValue = new Struct().with("field", "hockey").with("champ", "bailey").with("same", "thing"); + String [] origKeys = new String[] { "name", "value" }; + Object [] origVals = new Object[] { "policyAlpha", origValue }; + String [] newKeys = new String[] { "name", "value" }; + Object [] newVals = new Object[] { "policyAlpha", newValue }; + Struct origFields = setupEntity(origKeys, origVals); + Struct newFields = setupEntity(newKeys, newVals); + + String details = msgBldr.whatSubDetails("entity", origFields, newFields); + // details=entity=( + // CHANGED=( + // value=( + // CHANGED=( + // field=(FROM=(of_dreams);TO=(hockey)); + // champ=(FROM=(de_reve);TO=(bailey));); + // REMOVED=(null); + // ADDED=(null);)); + // REMOVED=(null); + // ADDED=(null);) + + int drindex = details.indexOf("field=(FROM=(of_dreams);TO=(hockey))"); + Assert.assertTrue(drindex != -1, "dreams-index=" + drindex + " details=" + details); + + int rindex = details.indexOf("champ=(FROM=(de_reve);TO=(bailey))"); + Assert.assertTrue(rindex != -1, "de_reve-index=" + rindex + " details=" + details); + } + + @Test + public void testWhatDetailsNoChanges() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatDetails"); + String [] origKeys = new String[] { "alpha", "beta", "gamma" }; + String [] origVals = new String[] { "Aval", "Bval", "Gval" }; + String [] newKeys = new String[] { "alpha", "beta", "gamma" }; + String [] newVals = new String[] { "Aval", "Bval", "Gval" }; + Struct origFields = setupEntity(origKeys, origVals); + Struct newFields = setupEntity(newKeys, newVals); + msgBldr.whatDetails("Bsame", origFields, newFields); + + String msg = msgBldr.whatDetails(); + Assert.assertTrue(msg.contains("CHANGED=(null)"), "Test string=" + msg); + Assert.assertTrue(msg.contains("REMOVED=(null)"), "Test string=" + msg); + Assert.assertTrue(msg.contains("ADDED=(null)"), "Test string=" + msg); + } + + @Test + public void testWhatDetailsAdded() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatDetails"); + String [] origKeys = new String[] { "alpha", "beta", "gamma" }; + String [] origVals = new String[] { "Aval", "Bval", "Gval" }; + String [] newKeys = new String[] { "alpha", "beta", "gamma", "delta" }; + String [] newVals = new String[] { "Aval", "Bval", "Gval", "Dval" }; + Struct origFields = setupEntity(origKeys, origVals); + Struct newFields = setupEntity(newKeys, newVals); + msgBldr.whatDetails("Bsame", origFields, newFields); + + String msg = msgBldr.whatDetails(); + Assert.assertTrue(msg.contains("CHANGED=(null)"), "Test string=" + msg); + Assert.assertTrue(msg.contains("REMOVED=(null)"), "Test string=" + msg); + Assert.assertTrue(msg.contains("ADDED=(delta=\"Dval\")"), "Test string=" + msg); + } + + @Test + public void testWhatDetailsRemoved() { + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatDetails"); + String [] origKeys = new String[] { "alpha", "beta", "gamma" }; + String [] origVals = new String[] { "Aval", "Bval", "Gval" }; + String [] newKeys = new String[] { "alpha", "gamma" }; + String [] newVals = new String[] { "Aval", "Gval" }; + Struct origFields = setupEntity(origKeys, origVals); + Struct newFields = setupEntity(newKeys, newVals); + msgBldr.whatDetails("Bsame", origFields, newFields); + + String msg = msgBldr.whatDetails(); + Assert.assertTrue(msg.contains("CHANGED=(null)"), "Test string=" + msg); + Assert.assertTrue(msg.contains("REMOVED=(beta=\"Bval\")"), "Test string=" + msg); + Assert.assertTrue(msg.contains("ADDED=(null)"), "Test string=" + msg); + } + + /** + * Test method for {@link com.yahoo.athenz.common.server.log.impl.DefaultAuditLogMsgBuilder#whatDetails(java.lang.String, com.yahoo.data.Struct, com.yahoo.data.Struct)}. + */ + @Test + public void testWhatDetailsChangedRemovedAdded() { + AuditLogMsgBuilder msgBldr = starter("testWhatDetailsChangedRemovedAdded"); + + String [] origKeys = new String[] { "alpha", "beta", "gamma" }; + String [] origVals = new String[] { "Aval", "Bval", "Gval" }; + String [] newKeys = new String[] { "beta", "gamma", "delta" }; + String [] newVals = new String[] { "Bval", "Gammaval", "Dval" }; + Struct origFields = setupEntity(origKeys, origVals); + Struct newFields = setupEntity(newKeys, newVals); + msgBldr.whatDetails("Bsame", origFields, newFields); + + String msg = msgBldr.whatDetails(); + Assert.assertTrue(msg.contains("gamma=(FROM=(Gval);TO=(Gammaval))"), "Test string=" + msg); + Assert.assertTrue(msg.contains("REMOVED=(alpha=\"Aval\")"), "Test string=" + msg); + Assert.assertTrue(msg.contains("ADDED=(delta=\"Dval\")"), "Test string=" + msg); + } + + @Test + public void testWhatDetailsPolicyStructs() { + // test Array inside of Struct + // Policy from ZMS schema: contains 'name' as String, 'modified' as Timestamp, + // 'assertions' as Array of Struct + DefaultAuditLogMsgBuilder msgBldr = starter("testWhatDetailsPolicyStructs"); + Timestamp tsOrig = Timestamp.fromCurrentTime(); + long millis = tsOrig.millis() + 1000; + Timestamp tsNew = Timestamp.fromMillis(millis); + String [] origKeys = new String[] { "name", "modified", "assertions" }; + Object [] origVals = new Object[] { "policyAlpha", tsOrig, assertsOrig }; + String [] newKeys = new String[] { "name", "modified", "assertions" }; + Object [] newVals = new Object[] { "policyAlpha", tsNew, assertsNew }; + Struct origFields = setupEntity(origKeys, origVals); + Struct newFields = setupEntity(newKeys, newVals); + msgBldr.whatDetails("policies", origFields, newFields); + + String details = msgBldr.whatDetails(); + // details=policies= + // (CHANGED= + // (ADDED-VALUES= + // ({role: "child", resource: "cereal", action: "chomp"},{role: "worker", resource: "apples", action: "eat"}); + // REMOVED-VALUES=({role: "child", resource: "cereal", action: "slurp"},{role: "worker", resource: "potatoes", action: "eat"}); + // (FROM=(null); + // TO=(null);); + // REMOVED=(null); + // ADDED=(null);) + int aindex = details.indexOf("ADDED-VALUES=("); + Assert.assertTrue(aindex != -1, "details=" + details); + int rindex = details.indexOf("REMOVED-VALUES=("); + Assert.assertTrue(rindex != -1, "details=" + details); + + int addedVals = details.indexOf("chomp", aindex); + Assert.assertTrue(addedVals != -1 && addedVals < rindex, "details=" + details); + addedVals = details.indexOf("apples", aindex); + Assert.assertTrue(addedVals != -1 && addedVals < rindex, "details=" + details); + + addedVals = details.indexOf("slurp", rindex); + Assert.assertTrue(addedVals > rindex, "details=" + details); + addedVals = details.indexOf("potatoes", rindex); + Assert.assertTrue(addedVals > rindex, "details=" + details); + } + + /** + * Test method for {@link com.yahoo.athenz.common.server.log.impl.DefaultAuditLogMsgBuilder#build()}. + */ + @Test + public void testBuild() { + AuditLogMsgBuilder msgBldr = starter("testBuild"); + + String msg = msgBldr.build(); + Assert.assertTrue(msg.contains("WHAT-api=(testBuild)"), "Test string=" + msg); + } + + @Test + public void testBuildChangedRemovedAdded() { + AuditLogMsgBuilder msgBldr = starter("testBuildChangedRemovedAdded"); + String [] origKeys = new String[] { "alpha", "beta", "gamma", "epsilon" }; + String [] origVals = new String[] { "Aval", "Bval", "Gval", "Eval" }; + String [] newKeys = new String[] { "beta", "gamma", "delta" }; + String [] newVals = new String[] { "Bval", "Gammaval", "Dval" }; + Struct origFields = setupEntity(origKeys, origVals); + Struct newFields = setupEntity(newKeys, newVals); + msgBldr.whatDetails("Bsame", origFields, newFields); + + String msg = msgBldr.build(); + Assert.assertTrue(msg.contains("WHAT-api=(testBuildChangedRemovedAdded)"), "Test string=" + msg); + Assert.assertTrue(msg.contains("CHANGED=(gamma=(FROM=(Gval);TO=(Gammaval))"), "Test string=" + msg); + Assert.assertTrue(msg.contains("ADDED=(delta=\"Dval\")"), "Test string=" + msg); + + // order not important + boolean removedAlpha = msg.contains("REMOVED=(alpha=\"Aval\",epsilon=\"Eval\")"); + boolean removedEpsilon = msg.contains("REMOVED=(epsilon=\"Eval\",alpha=\"Aval\")"); + Assert.assertTrue(removedAlpha | removedEpsilon, "Test string=" + msg); + + } + + @Test + public void testFindChangedValues() { + String changed = "CHANGED=(org=(FROM=(testOrg);TO=(NewOrg));description=(FROM=(Test Domain1);TO=(Test2 Domain)););"; + DefaultAuditLogMsgBuilder msgBldr = new DefaultAuditLogMsgBuilder(); + + // get value without prefix + Array noPrefixValues = new Array(); + msgBldr.findChangedValues(noPrefixValues, changed, "FROM=(", "));", false); + Assert.assertTrue(noPrefixValues.size() == 2, "values size=" + noPrefixValues.size()); + String fromToVal1 = "org=(FROM=(testOrg);TO=(NewOrg"; + String fromToVal2 = "description=(FROM=(Test Domain1);TO=(Test2 Domain"; + String noPrefFromToVal1 = "FROM=(testOrg);TO=(NewOrg"; + String noPrefFromToVal2 = "FROM=(Test Domain1);TO=(Test2 Domain"; + for (int cnt = 0; cnt < noPrefixValues.size(); ++cnt) { + String fromToVal = (String) noPrefixValues.get(cnt); + Assert.assertFalse(fromToVal.contains(fromToVal1) || fromToVal.contains(fromToVal2), "From/To=" + fromToVal); + Assert.assertTrue(fromToVal.contains(noPrefFromToVal1) || fromToVal.contains(noPrefFromToVal2), "From/To=" + fromToVal); + } + + // get value with prefix + Array prefixValues = new Array(); + msgBldr.findChangedValues(prefixValues, changed, "FROM=(", "));", true); + Assert.assertTrue(prefixValues.size() == 2, "values size=" + prefixValues.size()); + for (int cnt = 0; cnt < prefixValues.size(); ++cnt) { + String fromToVal = (String) prefixValues.get(cnt); + Assert.assertTrue(fromToVal.contains(fromToVal1) || fromToVal.contains(fromToVal2), "From/To=" + fromToVal); + } + } + + @Test + public void testGetMatchedGroup() { + String GEN_FLD_PAT = "=\\(([^\\)]+)\\);.*"; + Pattern PAT_VERS = Pattern.compile(".*(VERS)" + GEN_FLD_PAT); + + String logMsg = "VERS=(test-0.1);WHEN=(2015-03-26T20:30:34.457Z);WHO=(who-name=testadminuser,who-domain=" + USER_DOMAIN + + ",who-yrn=" + USER_DOMAIN + ".testadminuser);WHY=(zmsjcltest);WHERE=(server-ip=somehost.somecompany.com,server-https-port=0,server-http-port=10080);CLIENT-IP=(127.0.0.1);WHAT-method=(PUT);WHAT-api=(putdomainmeta);WHAT-domain=(MetaDom1);WHAT-entity=(meta);WHAT-details=(meta-attrs=(CHANGED=(org=(FROM=(testOrg);TO=(NewOrg));description=(FROM=(Test Domain1);TO=(Test2 Domain)););REMOVED=(null);ADDED=(auditEnabled=true);));"; + CharSequence charSeq = logMsg.subSequence(0, logMsg.length()); + DefaultAuditLogMsgBuilder msgBldr = new DefaultAuditLogMsgBuilder(); + String group = msgBldr.getMatchedGroup(PAT_VERS, 2, charSeq); + Assert.assertNotNull(group); + Assert.assertEquals(group, "test-0.1"); + + // choose bad group number + group = msgBldr.getMatchedGroup(PAT_VERS, 3, charSeq); + Assert.assertNull(group); + + // choose group number 0 - whole string + group = msgBldr.getMatchedGroup(PAT_VERS, 0, charSeq); + Assert.assertNotNull(group); + Assert.assertEquals(group, logMsg); + } + + @Test + public void testParse() { + String logMsg = "WHEN=(2015-03-26T20:30:34.457Z);WHO=(who-name=testadminuser,who-domain=" + USER_DOMAIN + + ",who-yrn=" + USER_DOMAIN + ".testadminuser);WHY=(zmsjcltest);WHERE=(server-ip=somehost.somecompany.com,server-https-port=0,server-http-port=10080);CLIENT-IP=(127.0.0.1);WHAT-method=(PUT);WHAT-api=(putdomainmeta);WHAT-domain=(MetaDom1);WHAT-entity=(meta);WHAT-details=(meta-attrs=(CHANGED=(metattrs=(ADDED-VALUES=(\"" + USER_DOMAIN + ".doe\"));metattrs=(REMOVED-VALUES=(\"" + USER_DOMAIN + ".dough\"));org=(FROM=(testOrg);TO=(NewOrg));description=(FROM=(Test Domain1);TO=(Test2 Domain)););REMOVED=(null);ADDED=(auditEnabled=true);));"; + AuditLogMsgBuilder msgBldr = new DefaultAuditLogMsgBuilder(); + Struct parsed = msgBldr.parse(logMsg); + Assert.assertNotNull(parsed); + Assert.assertTrue(parsed.containsKey("WHEN")); + String val = parsed.getString("WHEN"); + Assert.assertTrue(val.contains("2015-03-26T20:30:34.457Z")); + Assert.assertTrue(parsed.containsKey("WHO")); + val = parsed.getString("WHO"); + Assert.assertTrue(val.contains("who-name=testadminuser,who-domain=" + USER_DOMAIN + ",who-yrn=" + USER_DOMAIN + ".testadminuser")); + Assert.assertTrue(parsed.containsKey("WHY")); + val = parsed.getString("WHY"); + Assert.assertTrue(val.contains("zmsjcltest")); + Assert.assertTrue(parsed.containsKey("WHERE")); + val = parsed.getString("WHERE"); + Assert.assertTrue(val.contains("server-ip=somehost.somecompany.com,server-https-port=0,server-http-port=10080")); + Assert.assertTrue(parsed.containsKey("CLIENT-IP")); + val = parsed.getString("CLIENT-IP"); + Assert.assertTrue(val.contains("127.0.0.1")); + Assert.assertTrue(parsed.containsKey("WHAT-method")); + val = parsed.getString("WHAT-method"); + Assert.assertTrue(val.contains("PUT")); + Assert.assertTrue(parsed.containsKey("WHAT-api")); + val = parsed.getString("WHAT-api"); + Assert.assertTrue(val.contains("putdomainmeta")); + Assert.assertTrue(parsed.containsKey("WHAT-domain")); + val = parsed.getString("WHAT-domain"); + Assert.assertTrue(val.contains("MetaDom1")); + Assert.assertTrue(parsed.containsKey("WHAT-entity")); + val = parsed.getString("WHAT-entity"); + Assert.assertTrue(val.contains("meta")); + + Assert.assertTrue(parsed.containsKey("WHAT-details")); + Struct details = parsed.getStruct("WHAT-details"); + Assert.assertNotNull(details); + Assert.assertTrue(details.containsKey("CHANGED")); + val = details.getString("CHANGED"); + Assert.assertTrue(val.contains("CHANGED=(metattrs=(ADDED-VALUES=(\"" + USER_DOMAIN + ".doe\"));metattrs=(REMOVED-VALUES=(\"" + USER_DOMAIN + ".dough\"));org=(FROM=(testOrg);TO=(NewOrg))"), val); + + Assert.assertTrue(details.containsKey("REMOVED")); + val = details.getString("REMOVED"); + Assert.assertTrue(val.contains("null")); + Assert.assertTrue(details.containsKey("ADDED")); + val = details.getString("ADDED"); + Assert.assertTrue(val.contains("auditEnabled=true")); + + Assert.assertTrue(details.containsKey("ADDED-VALUES")); + Array values = (Array) details.get("ADDED-VALUES"); + Assert.assertNotNull(values); + Assert.assertTrue(values.size() == 1, "values size=" + values.size()); + for (int cnt = 0; cnt < values.size(); ++cnt) { + String addedVal = (String) values.get(cnt); + Assert.assertTrue(addedVal.contains("" + USER_DOMAIN + ".doe")); + } + + Assert.assertTrue(details.containsKey("REMOVED-VALUES")); + values = (Array) details.get("REMOVED-VALUES"); + Assert.assertNotNull(values); + Assert.assertTrue(values.size() == 1, "values size=" + values.size()); + for (int cnt = 0; cnt < values.size(); ++cnt) { + String removedVal = (String) values.get(cnt); + Assert.assertTrue(removedVal.contains("" + USER_DOMAIN + ".dough")); + } + + Assert.assertTrue(details.containsKey("FROM-TO-VALUES")); + values = (Array) details.get("FROM-TO-VALUES"); + Assert.assertNotNull(values); + Assert.assertTrue(values.size() == 2, "values size=" + values.size()); + String fromToVal1 = "org=(FROM=(testOrg);TO=(NewOrg"; + String fromToVal2 = "description=(FROM=(Test Domain1);TO=(Test2 Domain"; + for (int cnt = 0; cnt < values.size(); ++cnt) { + String fromToVal = (String) values.get(cnt); + Assert.assertTrue(fromToVal.contains(fromToVal1) || fromToVal.contains(fromToVal2), "From/To=" + fromToVal); + } + } + + @Test + public void testParseChangesAddedRemovedValues() { + String logMsg = "VERS=(athenz-def-1.0);WHEN=(2015-04-02T17:09:31.387Z);WHO=(v=U1;d=user;n=jdoe);WHY=(audittest);WHERE=(server-ip=localhost,server-https-port=0,server-http-port=10080);CLIENT-IP=(MOCKCLIENT_HOST_NAME);WHAT-method=(PUT);WHAT-api=(putpolicy);WHAT-domain=(CrossDomainAccessDom1);WHAT-entity=(tenancy.coretech.storage.writer);WHAT-details=(policy-attrs=(CHANGED=(modified=(FROM=(2015-04-02T17:09:31.354Z);TO=(2015-04-02T17:09:31.387Z));assertions=(ADDED-VALUES=({role: \"CrossDomainAccessDom1:role.writer\", action: \"ASSUME_ROLE\", effect: \"ALLOW\", resource: \"coretech:role.storage.tenant.CrossDomainAccessDom1.writer\"}));assertions=(REMOVED-VALUES=({role: \"CrossDomainAccessDom1:role.admin\", action: \"ASSUME_ROLE\", resource: \"coretech:role.storage.tenant.CrossDomainAccessDom1.writer\"})););REMOVED=(null);ADDED=(null);));"; + + AuditLogMsgBuilder msgBldr = new DefaultAuditLogMsgBuilder(); + Struct parsed = msgBldr.parse(logMsg); + Assert.assertNotNull(parsed); + Assert.assertTrue(parsed.containsKey("WHEN")); + String val = parsed.getString("WHEN"); + Assert.assertTrue(val.contains("2015-04-02T17:09:31.387Z")); + + Assert.assertTrue(parsed.containsKey("WHAT-details")); + Struct details = parsed.getStruct("WHAT-details"); + Assert.assertNotNull(details); + Assert.assertTrue(details.containsKey("CHANGED")); + val = details.getString("CHANGED"); + Assert.assertTrue(val.contains("CHANGED=(modified=(FROM=(2015-04-02T17:09:31.354Z);"), val); + + Assert.assertTrue(details.containsKey("REMOVED-VALUES")); + Array values = (Array) details.get("REMOVED-VALUES"); + Assert.assertNotNull(values); + Assert.assertTrue(values.size() == 1, "values size=" + values.size()); + for (int cnt = 0; cnt < values.size(); ++cnt) { + String removedVal = (String) values.get(cnt); + Assert.assertTrue(removedVal.contains("assertions=(REMOVED-VALUES=({role: \"CrossDomainAccessDom1:role.admin\", action: \"ASSUME_ROLE\", resource: \"coretech:role.storage.tenant.CrossDomainAccessDom1.writer\"})"), val); + } + + Assert.assertTrue(details.containsKey("ADDED-VALUES")); + values = (Array) details.get("ADDED-VALUES"); + Assert.assertNotNull(values); + Assert.assertTrue(values.size() == 1, "values size=" + values.size()); + for (int cnt = 0; cnt < values.size(); ++cnt) { + String addedVal = (String) values.get(cnt); + Assert.assertTrue(addedVal.contains("assertions=(ADDED-VALUES=({role: \"CrossDomainAccessDom1:role.writer\", action: \"ASSUME_ROLE\", effect: \"ALLOW\", resource: \"coretech:role.storage.tenant.CrossDomainAccessDom1.writer\"})"), val); + } + } + + @Test + public void testParseChangesAddedRemovedEmbedded() { + String logMsg = "VERS=(athenz-def-1.0);WHEN=(2015-04-02T18:30:58.451Z);WHO=(v=U1;d=user;n=jdoe);WHY=(audittest);WHERE=(server-ip=localhost,server-https-port=0,server-http-port=10080);CLIENT-IP=(MOCKCLIENT_HOST_NAME);WHAT-method=(PUT);WHAT-api=(puttenantroles);WHAT-domain=(coretech);WHAT-entity=(storage:AddTenancyDom1);WHAT-details=(AddTenancyDom1=(CHANGED=(role=(CHANGED=(null);role=(REMOVED=(null));role=(ADDED=(storage.tenant.AddTenancyDom1.reader={trust: \"AddTenancyDom1\", modified: \"2015-04-02T18:30:58.451Z\", name: \"coretech:role.storage.tenant.AddTenancyDom1.reader\"},storage.tenant.AddTenancyDom1.admin={trust: \"AddTenancyDom1\", modified: \"2015-04-02T18:30:58.451Z\", name: \"coretech:role.storage.tenant.AddTenancyDom1.admin\"},storage.tenant.AddTenancyDom1.writer={trust: \"AddTenancyDom1\", modified: \"2015-04-02T18:30:58.451Z\", name: \"coretech:role.storage.tenant.AddTenancyDom1.writer\"}));policy=(CHANGED=(null);policy=(REMOVED=(null));policy=(ADDED=(storage.tenant.AddTenancyDom1.reader={assertions: [{role: \"coretech:role.storage.tenant.AddTenancyDom1.reader\", action: \"READ\", resource: \"coretech:service.storage.tenant.AddTenancyDom1.*\"}], modified: \"2015-04-02T18:30:58.451Z\", name: \"coretech:policy.storage.tenant.AddTenancyDom1.reader\"},storage.tenant.AddTenancyDom1.admin={assertions: [{role: \"coretech:role.storage.tenant.AddTenancyDom1.admin\", action: \"*\", resource: \"coretech:service.storage.tenant.AddTenancyDom1.*\"}], modified: \"2015-04-02T18:30:58.451Z\", name: \"coretech:policy.storage.tenant.AddTenancyDom1.admin\"},storage.tenant.AddTenancyDom1.writer={assertions: [{role: \"coretech:role.storage.tenant.AddTenancyDom1.writer\", action: \"WRITE\", resource: \"coretech:service.storage.tenant.AddTenancyDom1.*\"}], modified: \"2015-04-02T18:30:58.451Z\", name: \"coretech:policy.storage.tenant.AddTenancyDom1.writer\"})););AddTenancyDom1=(REMOVED=(null));AddTenancyDom1=(ADDED=(null)););"; + + AuditLogMsgBuilder msgBldr = new DefaultAuditLogMsgBuilder(); + Struct parsed = msgBldr.parse(logMsg); + Assert.assertNotNull(parsed); + Assert.assertTrue(parsed.containsKey("WHO")); + String val = parsed.getString("WHO"); + Assert.assertTrue(val.contains("v=U1;d=user;n=jdoe")); + + Assert.assertTrue(parsed.containsKey("WHAT-details")); + Struct details = parsed.getStruct("WHAT-details"); + Assert.assertNotNull(details); + + Assert.assertTrue(details.containsKey("REMOVED")); + val = details.getString("REMOVED"); + Assert.assertTrue(val.contains("null")); + Assert.assertTrue(details.containsKey("ADDED")); + val = details.getString("ADDED"); + Assert.assertTrue(val.contains("null")); + + Assert.assertTrue(details.containsKey("CHANGED")); + val = details.getString("CHANGED"); + Assert.assertTrue(val.contains("CHANGED=(role=(CHANGED=(null);"), val); + + // get all the embedded ADDED/REMOVED from changes + Assert.assertTrue(details.containsKey("EMBEDDED-REMOVED")); + Array values = (Array) details.get("EMBEDDED-REMOVED"); + Assert.assertNotNull(values); + Assert.assertTrue(values.size() == 2, "values size=" + values.size()); + String removedEmbeddedVal1 = "role=(REMOVED=(null)"; + String removedEmbeddedVal2 = "policy=(REMOVED=(null)"; + for (int cnt = 0; cnt < values.size(); ++cnt) { + String removedVal = (String) values.get(cnt); + boolean matched = removedVal.contains(removedEmbeddedVal1) || removedVal.contains(removedEmbeddedVal2); + Assert.assertTrue(matched, removedVal); + } + + Assert.assertTrue(details.containsKey("EMBEDDED-ADDED")); + values = (Array) details.get("EMBEDDED-ADDED"); + Assert.assertNotNull(values); + Assert.assertTrue(values.size() == 2, "values size=" + values.size()); + String addedEmbeddedVal1 = "role=(ADDED=(storage.tenant.AddTenancyDom1.reader={trust: \"AddTenancyDom1\","; + String addedEmbeddedVal2 = "policy=(ADDED=(storage.tenant.AddTenancyDom1.reader={assertions: [{role: \"coretech:role.storage.tenant.AddTenancyDom1.reader\", action: \"READ\","; + for (int cnt = 0; cnt < values.size(); ++cnt) { + String addedVal = (String) values.get(cnt); + boolean matched = addedVal.contains(addedEmbeddedVal1) || addedVal.contains(addedEmbeddedVal2); + Assert.assertTrue(matched, addedVal); + } + + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/AuditLoggerTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/AuditLoggerTest.java new file mode 100644 index 00000000000..3ee78cb980e --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/AuditLoggerTest.java @@ -0,0 +1,106 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log.impl; + +import org.testng.Assert; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; + +import org.testng.annotations.BeforeClass; + + +public class AuditLoggerTest { + + protected static AuditLogger auditLogger; + + final static String MSGVERS = "VERS=(test);"; + + @BeforeClass + public static synchronized void setUp() throws Exception { + auditLogger = new AuditLogger() { + @Override + public void log(String msg, String msgVersion) { + Assert.assertTrue(msg != null); + } + + @Override + public void log(AuditLogMsgBuilder msgBldr) { + Assert.assertTrue(msgBldr.build() != null); + } + + }; + } + + @Test + public void testLogFactoryDefault() { + AuditLogger logger = AuditLogFactory.getLogger(); + logger.log("Default logger succeeds", MSGVERS); + } + + @Test + public void testLogFactoryString() { + String auditLoggerClassName = "com.yahoo.athenz.common.server.log.impl.TestLogger"; + try { + AuditLogger logger = AuditLogFactory.getLogger(auditLoggerClassName); + logger.log("TestLogger succeeds", null); + String dataStr = logger.getClass().getName(); + Assert.assertTrue(dataStr.equals(auditLoggerClassName), "classname=" + dataStr); + } catch (Exception exc) { + Assert.fail("Should have created the Logger=TestLogger with default constructor", exc); + } + } + + @Test + public void testLogFactoryFalseParam() { + String auditLoggerClassName = "com.yahoo.athenz.common.server.log.impl.TestLogger"; + Object param = new Boolean(false); + try { + AuditLogger logger = AuditLogFactory.getLogger(auditLoggerClassName, param); + logger.log("TestLogger succeeds", MSGVERS); + String dataStr = logger.getClass().getName(); + Assert.assertTrue(dataStr.equals(auditLoggerClassName), "classname=" + dataStr); + } catch (Exception exc) { + Assert.fail("Should have created the Logger=TestLogger with constructor taking param=" + param, exc); + } + } + + @Test + public void testLogFactoryTrueParam() { + String auditLoggerClassName = "com.yahoo.athenz.common.server.log.impl.TestLogger"; + Object param = new Boolean(true); + try { + AuditLogger logger = AuditLogFactory.getLogger(auditLoggerClassName, param); + logger.log("TestLogger should not succeed", null); + Assert.fail("Should have thrown exception, Logger=TestLogger for param=" + param); + } catch (Exception exc) { + Assert.assertTrue(exc.getMessage().contains("TestLogger should not succeed"), "Should have thrown exception, Logger=TestLogger with constructor taking param=" + param); + } + } + + @Test + public void testLogString() { + auditLogger.log("testLog", null); + } + + @Test + public void testLogMsgBuilder() { + AuditLogMsgBuilder msgBldr = AuditLogFactory.getMsgBuilder(); + auditLogger.log(msgBldr); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/TestLogger.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/TestLogger.java new file mode 100644 index 00000000000..e5495b96d91 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/TestLogger.java @@ -0,0 +1,57 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log.impl; + +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; + +/** + * Used for testing AuditLogFactory. + */ +public class TestLogger implements AuditLogger { + + Boolean throwException = false; + + public TestLogger() { + } + + public TestLogger(Boolean throwExc) { + if (throwExc != null) { + throwException = throwExc; + } + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogger#log(java.lang.String, java.lang.String) + */ + @Override + public void log(String logMsg, String msgVersionTag) { + if (throwException.booleanValue()) { + throw new RuntimeException(logMsg); + } + } + + /* (non-Javadoc) + * @see com.yahoo.athenz.common.server.log.AuditLogger#log(com.yahoo.athenz.common.server.log.AuditLogMsgBuilder) + */ + @Override + public void log(AuditLogMsgBuilder msgBldr) { + if (throwException.booleanValue()) { + throw new RuntimeException(msgBldr.build()); + } + } + +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/TestMsgBuilder.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/TestMsgBuilder.java new file mode 100644 index 00000000000..5bfef5bea5a --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/log/impl/TestMsgBuilder.java @@ -0,0 +1,24 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.log.impl; + +import com.yahoo.athenz.common.server.log.impl.DefaultAuditLogMsgBuilder; + +/** + * Test implementation for AuditLogMsgBuilder. + */ +public class TestMsgBuilder extends DefaultAuditLogMsgBuilder { +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/HttpContainerTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/HttpContainerTest.java new file mode 100644 index 00000000000..dad3ed7c9d7 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/HttpContainerTest.java @@ -0,0 +1,77 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; + +import org.glassfish.hk2.utilities.binding.AbstractBinder; + +import org.mockito.Mockito; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +public class HttpContainerTest { + + @Test + public void testAuthority() { + Authority authority = Mockito.mock(Authority.class); + HttpContainer extend = new HttpContainer(); + assertNotNull(extend.authority(authority)); + } + + @Test + public void testAuthorizer() { + Authorizer authorizer = Mockito.mock(Authorizer.class); + HttpContainer extend = new HttpContainer(); + assertNotNull(extend.authorizer(authorizer)); + } + + @Test + public void testAbstractBinder() { + AbstractBinder abstractBinder = Mockito.mock(AbstractBinder.class); + HttpContainer extend = new HttpContainer(); + assertNotNull(extend.delegate(abstractBinder)); + } + + @Test + public void testSetBanner() { + HttpContainer extend = new HttpContainer(); + extend.setBanner("hoge"); + assertEquals(extend.banner, "hoge"); + } + + @Test + public void testGetServer() { + HttpContainer extend = new HttpContainer(); + assertNull(extend.getServer()); + } + + @Test + public void testGetHandlers() { + HttpContainer extend = new HttpContainer(); + assertNull(extend.getHandlers()); + } + + @Test + public void testStop() { + HttpContainer extend = new HttpContainer(); + extend.createServer(20); + assertNotNull(extend.getHandlers()); + extend.stop(); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/HttpTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/HttpTest.java new file mode 100644 index 00000000000..28d5ca150f4 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/HttpTest.java @@ -0,0 +1,147 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import javax.servlet.http.HttpServletRequest; + +import org.mockito.Mockito; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.Authority.CredSource; + +public class HttpTest { + + @Test + public void testAuthenticatingCredentialsNull() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + assertNull(Http.authenticatingCredentials(httpServletRequest, null)); + } + + @Test + public void testAuthenticatingCredentials() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + Authority authority = Mockito.mock(Authority.class); + Mockito.when(authority.getHeader()).thenReturn("hogehoge"); + authorities.add(authority); + assertNull(Http.authenticatingCredentials(httpServletRequest, authorities)); + } + + @Test + public void testAuthoritiesNotNull() { + Http.AuthorityList authorities = new Http.AuthorityList(); + assertNotNull(authorities.getAuthorities()); + } + + @Test + public void testAuthenticateInternalServerError() throws Exception { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + try { + Http.authenticate(httpServletRequest, null); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 500); + } + } + + @Test + public void testAuthenticateCertificate() throws Exception { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + Authority authority = Mockito.mock(Authority.class); + Mockito.when(authority.getCredSource()).thenReturn(CredSource.CERTIFICATE); + authorities.add(authority); + try { + Http.authenticate(httpServletRequest, authorities); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 401); + } + } + + @Test + public void testAuthenticateHeader() throws Exception { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + Authority authority = Mockito.mock(Authority.class); + Mockito.when(authority.getCredSource()).thenReturn(CredSource.HEADER); + Mockito.when(authority.getHeader()).thenReturn("Cookie.hogehoge"); + authorities.add(authority); + try { + Http.authenticate(httpServletRequest, authorities); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 401); + } + } + + @Test + public void testAuthenticatedUserInvalidCredentials() throws Exception { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + try { + Http.authenticatedUser(httpServletRequest, authorities); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 401); + } + } + + @Test + public void testAuthorizedUserUserInvalidCredentials() throws Exception { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Authorizer authorizer = Mockito.mock(Authorizer.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + try { + Http.authorizedUser(httpServletRequest, authorities, authorizer, "action", null, null); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 401); + } + } + + @Test + public void testAuthorizedBadRequest() throws Exception { + Authorizer authorizer = Mockito.mock(Authorizer.class); + Principal principal = Mockito.mock(Principal.class); + try { + Http.authorize(authorizer, principal, "action", null, null); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 400); + } + } + + @Test + public void testAuthorizedInternalServerError() throws Exception { + Principal principal = Mockito.mock(Principal.class); + try { + Http.authorize(null, principal, "action", "resource", null); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 500); + } + } + + @Test + public void testAuthorizedForbidden() throws Exception { + Authorizer authorizer = Mockito.mock(Authorizer.class); + Principal principal = Mockito.mock(Principal.class); + try { + Http.authorize(authorizer, principal, "action", "resource", null); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 403); + } + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/ResourceContextTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/ResourceContextTest.java new file mode 100644 index 00000000000..67d7cb90d9d --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/ResourceContextTest.java @@ -0,0 +1,66 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.mockito.Mockito; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authorizer; + +public class ResourceContextTest { + + @Test + public void testResourceContext() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + HttpServletResponse httpServletResponse = Mockito.mock(HttpServletResponse.class); + Authorizer authorizer = Mockito.mock(Authorizer.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + ResourceContext context = new ResourceContext(httpServletRequest, httpServletResponse, authorities, authorizer); + assertEquals(context.request(), httpServletRequest); + assertEquals(context.response(), httpServletResponse); + assertNull(context.principal()); + } + + @Test + public void testAuthenticate() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + HttpServletResponse httpServletResponse = Mockito.mock(HttpServletResponse.class); + Authorizer authorizer = Mockito.mock(Authorizer.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + ResourceContext context = new ResourceContext(httpServletRequest, httpServletResponse, authorities, authorizer); + context.checked = true; + assertNull(context.authenticate()); + } + + @Test + public void testAuthorize() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + HttpServletResponse httpServletResponse = Mockito.mock(HttpServletResponse.class); + Authorizer authorizer = Mockito.mock(Authorizer.class); + Http.AuthorityList authorities = new Http.AuthorityList(); + ResourceContext context = new ResourceContext(httpServletRequest, httpServletResponse, authorities, authorizer); + try { + context.authorize("action", "resource", "domain"); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 401); + } + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/ResourceExceptionTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/ResourceExceptionTest.java new file mode 100644 index 00000000000..a6924638175 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/ResourceExceptionTest.java @@ -0,0 +1,81 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import static org.testng.Assert.*; +import org.testng.annotations.*; + +public class ResourceExceptionTest { + + @Test + public void testCodeForSymbol() { + assertEquals(ResourceException.codeForSymbol("ok"), 200); + assertEquals(ResourceException.codeForSymbol("CREATED"), 201); + assertEquals(ResourceException.codeForSymbol("ACCEPTED"), 202); + assertEquals(ResourceException.codeForSymbol("NO_CONTENT"), 204); + assertEquals(ResourceException.codeForSymbol("MOVED_PERMANENTLY"), 301); + assertEquals(ResourceException.codeForSymbol("FOUND"), 302); + assertEquals(ResourceException.codeForSymbol("SEE_OTHER"), 303); + assertEquals(ResourceException.codeForSymbol("NOT_MODIFIED"), 304); + assertEquals(ResourceException.codeForSymbol("TEMPORARY_REDIRECT"), 307); + assertEquals(ResourceException.codeForSymbol("BAD_REQUEST"), 400); + assertEquals(ResourceException.codeForSymbol("FORBIDDEN"), 403); + assertEquals(ResourceException.codeForSymbol("UNAUTHORIZED"), 401); + assertEquals(ResourceException.codeForSymbol("NOT_FOUND"), 404); + assertEquals(ResourceException.codeForSymbol("CONFLICT"), 409); + assertEquals(ResourceException.codeForSymbol("GONE"), 410); + assertEquals(ResourceException.codeForSymbol("PRECONDITION_FAILED"), 412); + assertEquals(ResourceException.codeForSymbol("UNSUPPORTED_MEDIA_TYPE"), 415); + assertEquals(ResourceException.codeForSymbol("INTERNAL_SERVER_ERROR"), 500); + assertEquals(ResourceException.codeForSymbol("NOT_IMPLEMENTED"), 501); + assertEquals(ResourceException.codeForSymbol("SERVICE_UNAVAILABLE"), 503); + assertEquals(ResourceException.codeForSymbol("UNAUTHORIZED"), 401); + assertEquals(ResourceException.codeForSymbol("1111"), 1111); + } + + @Test + public void testSymbolForCode() { + assertEquals(ResourceException.symbolForCode(200), "OK"); + assertEquals(ResourceException.symbolForCode(201), "CREATED"); + assertEquals(ResourceException.symbolForCode(202), "ACCEPTED"); + assertEquals(ResourceException.symbolForCode(204), "NO_CONTENT"); + assertEquals(ResourceException.symbolForCode(301), "MOVED_PERMANENTLY"); + assertEquals(ResourceException.symbolForCode(302), "FOUND"); + assertEquals(ResourceException.symbolForCode(303), "SEE_OTHER"); + assertEquals(ResourceException.symbolForCode(304), "NOT_MODIFIED"); + assertEquals(ResourceException.symbolForCode(307), "TEMPORARY_REDIRECT"); + assertEquals(ResourceException.symbolForCode(400), "BAD_REQUEST"); + assertEquals(ResourceException.symbolForCode(403), "FORBIDDEN"); + assertEquals(ResourceException.symbolForCode(401), "UNAUTHORIZED"); + assertEquals(ResourceException.symbolForCode(404), "NOT_FOUND"); + assertEquals(ResourceException.symbolForCode(409), "CONFLICT"); + assertEquals(ResourceException.symbolForCode(410), "GONE"); + assertEquals(ResourceException.symbolForCode(412), "PRECONDITION_FAILED"); + assertEquals(ResourceException.symbolForCode(415), "UNSUPPORTED_MEDIA_TYPE"); + assertEquals(ResourceException.symbolForCode(500), "INTERNAL_SERVER_ERROR"); + assertEquals(ResourceException.symbolForCode(501), "NOT_IMPLEMENTED"); + assertEquals(ResourceException.symbolForCode(503), "SERVICE_UNAVAILABLE"); + assertEquals(ResourceException.symbolForCode(401), "UNAUTHORIZED"); + assertNull(ResourceException.symbolForCode(1111)); + } + + @Test + public void testResourceException() { + ResourceException exception = new ResourceException(200); + assertEquals(exception.getCode(), 200); + assertEquals(exception.getData(), "OK"); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/RestCoreResourceConfigTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/RestCoreResourceConfigTest.java new file mode 100644 index 00000000000..74276aa66d8 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/rest/RestCoreResourceConfigTest.java @@ -0,0 +1,56 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.rest; + +import java.util.HashSet; + +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.rest.ResourceException; +import com.yahoo.athenz.common.server.rest.RestCoreResourceConfig; + +import static org.testng.Assert.*; + +/* + * This is used to setup the application configuration for authorities, + * authorizer, supported content-providers, and delegate. + */ +public class RestCoreResourceConfigTest { + + @SuppressWarnings({ "rawtypes", "unchecked", "unused" }) + @Test + public void testRestCoreResourceConfigBadRequest() { + HashSet hashSet = Mockito.mock(HashSet.class); + try { + RestCoreResourceConfig restCoreResourceConfig = new RestCoreResourceConfig(null, hashSet); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 400); + } + } + + @SuppressWarnings("unused") + @Test + public void testsetSingletonsNull() { + HashSet> resources = new HashSet>(); + HashSet singletons = new HashSet(); + try { + RestCoreResourceConfig restCoreResourceConfig = new RestCoreResourceConfig(resources, singletons); + } catch (ResourceException expected) { + assertEquals(expected.getCode(), 400); + } + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/ServletRequestUtilTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/ServletRequestUtilTest.java new file mode 100644 index 00000000000..88c5f5478b0 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/ServletRequestUtilTest.java @@ -0,0 +1,65 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.util; + +import javax.servlet.http.HttpServletRequest; + +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.util.ServletRequestUtil; + +import static org.testng.Assert.*; + +public class ServletRequestUtilTest { + + @Test + public void testGetRemoteAddressNoLoopBack() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(httpServletRequest.getRemoteAddr()).thenReturn("1.2.3.4"); + assertEquals(ServletRequestUtil.getRemoteAddress(httpServletRequest), "1.2.3.4"); + } + + @Test + public void testGetRemoteAddressNull() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(httpServletRequest.getRemoteAddr()).thenReturn(null); + assertNull(ServletRequestUtil.getRemoteAddress(httpServletRequest)); + } + + @Test + public void testGetRemoteAddressLoopBackNoXFF() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(httpServletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + assertEquals(ServletRequestUtil.getRemoteAddress(httpServletRequest), "127.0.0.1"); + } + + @Test + public void testGetRemoteAddressLoopBackSingleXFF() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(httpServletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + Mockito.when(httpServletRequest.getHeader("X-Forwarded-For")).thenReturn("1.2.3.4"); + assertEquals(ServletRequestUtil.getRemoteAddress(httpServletRequest), "1.2.3.4"); + } + + @Test + public void testGetRemoteAddressLoopBackMultipleXFF() { + HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(httpServletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + Mockito.when(httpServletRequest.getHeader("X-Forwarded-For")).thenReturn("1.2.3.4, 1.3.4.5, 1.4.5.6"); + assertEquals(ServletRequestUtil.getRemoteAddress(httpServletRequest), "1.4.5.6"); + } +} diff --git a/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/StringUtilsTest.java b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/StringUtilsTest.java new file mode 100644 index 00000000000..c1468d39dd8 --- /dev/null +++ b/libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/StringUtilsTest.java @@ -0,0 +1,48 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.common.server.util; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.util.StringUtils; + +public class StringUtilsTest { + + @Test + public void testRemoveLeadingAndTrailingQuotes() { + + assertEquals(StringUtils.removeLeadingAndTrailingQuotes("abc"), "abc"); + assertEquals(StringUtils.removeLeadingAndTrailingQuotes("\"abc"), "abc"); + assertEquals(StringUtils.removeLeadingAndTrailingQuotes("abc\""), "abc"); + assertEquals(StringUtils.removeLeadingAndTrailingQuotes("\"abc\""), "abc"); + assertEquals(StringUtils.removeLeadingAndTrailingQuotes("\"a\"bc\""), "a\"bc"); + } + + @Test + public void testPatternFromGlob() { + assertEquals("^abc$", StringUtils.patternFromGlob("abc")); + assertEquals("^abc.*$", StringUtils.patternFromGlob("abc*")); + assertEquals("^abc.$", StringUtils.patternFromGlob("abc?")); + assertEquals("^.*abc.$", StringUtils.patternFromGlob("*abc?")); + assertEquals("^abc\\.abc:.*$", StringUtils.patternFromGlob("abc.abc:*")); + assertEquals("^ab\\[a-c]c$", StringUtils.patternFromGlob("ab[a-c]c")); + assertEquals("^ab.*\\.\\(\\)\\^\\$c$", StringUtils.patternFromGlob("ab*.()^$c")); + assertEquals("^abc\\\\test\\\\$", StringUtils.patternFromGlob("abc\\test\\")); + assertEquals("^ab\\{\\|c\\+$", StringUtils.patternFromGlob("ab{|c+")); + assertEquals("^\\^\\$\\[\\(\\)\\\\\\+\\{\\..*.\\|$", StringUtils.patternFromGlob("^$[()\\+{.*?|")); + } +} diff --git a/libs/java/server_common/src/test/resources/logback.xml b/libs/java/server_common/src/test/resources/logback.xml new file mode 100644 index 00000000000..c4a0357b8d5 --- /dev/null +++ b/libs/java/server_common/src/test/resources/logback.xml @@ -0,0 +1,17 @@ + + + + + System.out + + %-4relative [%thread] %-5level %class - %msg%n + + + + + + + + + + diff --git a/pom.xml b/pom.xml new file mode 100644 index 00000000000..ef26677812f --- /dev/null +++ b/pom.xml @@ -0,0 +1,193 @@ + + + + + 4.0.0 + + com.yahoo.athenz + athenz + pom + 1.0-SNAPSHOT + + AthenZ + + AthenZ is a set of services and libraries supporting + role-based authorization for provisioning and configuration + (centralized authorization) use cases as well as serving/runtime + (decentralized authorization) use cases. + + https://github.com/yahoo/athenz + + + Yahoo Inc. + https://www.yahoo.com/ + + 2016 + + + + Yahoo Inc. + https://www.yahoo.com/ + + + + + + Apache License, Version 2.0 + https://www.apache.org/licenses/LICENSE-2.0.txt + repo + + + + + https://github.com/yahoo/athenz + scm:git:https://github.com/yahoo/athenz.git + scm:git:ssh://git@github.com:yahoo/athenz.git + + + + Github + https://github.com/yahoo/athenz/issues + + + + Travis + https://travis-ci.org/yahoo/athenz + + + + 9.3.15.v20161220 + 2.23.2 + 2.5.4 + 1.55 + UTF-8 + UTF-8 + + + + core/zms + core/zts + libs/java/auth_core + libs/java/client_common + libs/java/server_common + clients/java/sia + clients/java/zms + clients/java/zts + clients/java/zpe + servers/zms + servers/zts + utils/zpe_policy_updater + + + + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.5.1 + + 1.8 + 1.8 + + + + + + + + + com.yahoo.rdl + rdl-java + 1.4.8-2 + + + com.fasterxml.jackson.core + jackson-databind + + + com.fasterxml.jackson.core + jackson-core + + + com.fasterxml.jackson.core + jackson-annotations + + + + + org.slf4j + slf4j-api + 1.7.5 + + + ch.qos.logback + logback-classic + 1.1.3 + test + + + org.testng + testng + 6.3.1 + test + + + org.mockito + mockito-all + 1.9.5 + test + + + + + + + false + + bintray-yahoo-maven + bintray + http://yahoo.bintray.com/maven + + + + + + coverage + + + coverage + + + + + + com.atlassian.maven.plugins + maven-clover2-plugin + 4.0.4 + + 1.8 + ${HOME}/license/clover.license + + + + + + + + diff --git a/servers/zms/README.md b/servers/zms/README.md new file mode 100644 index 00000000000..e375da1931d --- /dev/null +++ b/servers/zms/README.md @@ -0,0 +1,14 @@ +ZMS Server +======================= + +ZMS is where domains, roles, and policies are defined. This is Athenz’s centralized authorization system and is likely part of a larger management system. In addition to allowing CRUD operations on the basic entities, ZMS provides an API to replicate the entities, per domain, to ZTS. It also can directly support the access check, both for internal management system checks, as well as a simple centralized deployment. + +ZMS is the source of truth for domains, roles, and policies for centralized authorization. ZMS supports a centralized call to check if a principal has access to a resource. Because ZMS supports service identities, ZMS can authenticate services. + +For centralized authorization, ZMS may be the only Athenz subsystem that you need to interact with. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/servers/zms/conf/authorized_services.json b/servers/zms/conf/authorized_services.json new file mode 100644 index 00000000000..00814ed301b --- /dev/null +++ b/servers/zms/conf/authorized_services.json @@ -0,0 +1,37 @@ +{ + "services" : { + "athenz.ci": { + "allowedOperations": [ + { "name": "putrole" }, + { "name": "putmembership", + "items": { + "role" : [ + "athenz_dev_test_role", + "athenz_eng_test_role" + ] + } + } + ] + }, + "athenz.ui": { + "allowedOperations": [ + { "name":"putmembership" }, + { "name":"deletemembership" }, + { "name":"postuserdomain" }, + { "name":"postsubdomain" }, + { "name":"deletesubdomain" }, + { "name":"deleterole" }, + { "name":"putrole" }, + { "name":"putpolicy" }, + { "name":"deletepolicy" }, + { "name":"putassertion" }, + { "name":"deleteassertion" }, + { "name":"putserviceidentity" }, + { "name":"deleteserviceidentity" }, + { "name":"putpublickeyentry" }, + { "name":"deletepublickeyentry" }, + { "name":"putdomainmeta" } + ] + } + } +} diff --git a/servers/zms/conf/container_settings b/servers/zms/conf/container_settings new file mode 100644 index 00000000000..d5efcc8803c --- /dev/null +++ b/servers/zms/conf/container_settings @@ -0,0 +1,78 @@ +#!/usr/bin/env bash + +# ** list of authorities for authenticating principals +CONTAINER_AUTHORITY_CLASSES="com.yahoo.athenz.auth.impl.PrincipalAuthority,com.yahoo.athenz.auth.impl.UserAuthority" + +# ** admin user for new installations - defaults to current user +CONTAINER_ADMINUSER="user.${USER}" + +# ** private/public key pair for zms instance - must be generated +# ** using with default key id of 0 +CONTAINER_PRIVKEY="${ROOT}/var/zms_server/keys/zms_private.pem" +CONTAINER_PUBKEY="${ROOT}/var/zms_server/keys/zms_public.pem" +CONTAINER_PRIVKEY_ID="0" + +# ** default ports for zms server. http support is disabled +# ** https support enabled - must provide certificate for server +CONTAINER_TLS_PORT="4443" +CONTAINER_PORT="0" + +# ** logback configuration file +CONTAINER_LOG_CONFIG="${ROOT}/conf/zms_server/logback.xml" + +# ** read only mode +CONTAINER_READ_ONLY_MODE="false" + +# ** authorized service and solution template file names +CONTAINER_AUTHZ_SERVICE_FNAME="${ROOT}/conf/zms_server/authorized_services.json" +CONTAINER_SOLUTION_TEMPLATES_FNAME="${ROOT}/conf/zms_server/solution_templates.json" + +# ** setup the keystore in pkcs12 format that includes our +# ** server's private key and x509 cert +CONTAINER_SSL_KEYSTORE="file://${ROOT}/var/zms_server/certs/zms_keystore.pkcs12" +CONTAINER_SSL_KEYSTORE_TYPE="PKCS12" +CONTAINER_SSL_KEYSTORE_PASSWORD="athenz" + +# ** truststore settings +# CONTAINER_SSL_TRUSTSTORE= +# CONTAINER_SSL_TRUSTSTORE_TYPE= +# CONTAINER_SSL_TRUSTSTORE_PASSWORD= + +# CONTAINER_SSL_KEYMANAGER_PASSWORD= +# CONTAINER_SSL_EXCLUDED_CIPHER_SUITES= +# CONTAINER_SSL_EXCLUDED_PROTOCOLS= + +# ** pam service name for user authority if we don't want to +# ** use the default login service +# CONTAINER_AUTH_PAM_SERVICE="login" + +# ** timeout sttings +# CONTAINER_CONFLICT_RETRY_TIMEOUT= +# CONTAINER_RETRY_DELAY_TIMEOUT= +# CONTAINER_USER_TOKEN_TIMEOUT= +# CONTAINER_SIGNED_POLICY_TIMEOUT= + +# ** virtual domain support +# CONTAINER_VIRTUAL_DOMAIN_SUPPORT= +# CONTAINER_VIRTUAL_DOMAIN_LIMIT= + +# ** max supported domain name length +# CONTAINER_DOMAIN_NAME_MAX_LEN=128 + +# ** jdbc settings +# CONTAINER_JDBCSTORE=jdbc:mysql://localhost:3306/zms" +# CONTAINER_JDBCUSER=zms_admin" +# CONTAINER_JDBCPASSWD= +# CONTAINER_JDBCTABLE="zms_root" +# CONTAINER_DBPOOL_MAX_TOTAL= +# CONTAINER_DBPOOL_MAX_IDLE= +# CONTAINER_DBPOOL_MIN_IDLE= +# CONTAINER_DBPOOL_MAX_WAIT= +# CONTAINER_DBPOOL_EVICT_IDLE_TIMEOUT= +# CONTAINER_DBPOOL_EVICT_IDLE_INTERVAL= +# CONTAINER_DBPOOL_MAX_TTL= + +# ** access log settings +# CONTAINER_ACCESS_LOG_DIR="logs/zms_server" +# CONTAINER_ACCESS_LOG_NAME= +# CONTAINER_ACCESS_LOG_RETAIN_DAYS= diff --git a/servers/zms/conf/logback.xml b/servers/zms/conf/logback.xml new file mode 100755 index 00000000000..50be080d710 --- /dev/null +++ b/servers/zms/conf/logback.xml @@ -0,0 +1,49 @@ + + + + + + + + + ${LOG_DIR}/server.log + true + + + ${LOG_DIR}/server.%d.log + 7 + true + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n + + + + + + + ${LOG_DIR}/audit.log + true + + + ${LOG_DIR}/audit.%d.log + 30 + true + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n + + + + + + + + + + + + + diff --git a/servers/zms/conf/solution_templates.json b/servers/zms/conf/solution_templates.json new file mode 100644 index 00000000000..9b312a7c483 --- /dev/null +++ b/servers/zms/conf/solution_templates.json @@ -0,0 +1,61 @@ +{ + "templates" : { + "user_provisioning": { + "roles": [ + { + "name": "_domain_:role.user", + "modified": "1970-01-01T00:00:00.000Z" + }, + { + "name": "_domain_:role.superuser", + "modified": "1970-01-01T00:00:00.000Z" + }, + { + "name": "_domain_:role.builders", + "members": [ "sys.builder" ], + "modified": "1970-01-01T00:00:00.000Z" + } + ], + "policies": [ + { + "name": "_domain_:policy.user", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:node.*", + "role": "_domain_:role.user", + "action": "node_user" + } + ] + }, + { + "name": "_domain_:policy.superuser", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:node.*", + "role": "_domain_:role.superuser", + "action": "node_sudo" + } + ] + }, + { + "name": "_domain_:policy.builders", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:build", + "role": "_domain_:role.builders", + "action": "read" + }, + { + "resource": "_domain_:build", + "role": "_domain_:role.builders", + "action": "delete" + } + ] + } + ] + } + } +} diff --git a/servers/zms/pom.xml b/servers/zms/pom.xml new file mode 100644 index 00000000000..36b1a0efd73 --- /dev/null +++ b/servers/zms/pom.xml @@ -0,0 +1,226 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../pom.xml + + + zms_server + zms_server + Athenz ZMS Server + jar + + + + ${project.groupId} + zms_core + ${project.parent.version} + + + ${project.groupId} + server_common + ${project.parent.version} + + + ${project.groupId} + client_common + ${project.parent.version} + + + ${project.groupId} + auth_core + ${project.parent.version} + + + org.glassfish.jersey.media + jersey-media-json-jackson + ${jersey.version} + + + com.fasterxml.jackson.core + jackson-annotations + + + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + commons-daemon + commons-daemon + 1.0.15 + + + mysql + mysql-connector-java + 5.1.6 + + + com.google.guava + guava + 18.0 + + + org.apache.commons + commons-dbcp2 + 2.0.1 + + + org.apache.commons + commons-pool2 + 2.2 + + + commons-logging + commons-logging + 1.1.3 + + + org.glassfish.jersey.containers + jersey-container-servlet + ${jersey.version} + + + org.eclipse.jetty + jetty-servlet + ${jetty.version} + + + org.eclipse.jetty + jetty-rewrite + ${jetty.version} + + + org.eclipse.jetty + jetty-util + ${jetty.version} + + + org.eclipse.jetty + jetty-server + ${jetty.version} + + + org.eclipse.jetty + jetty-security + ${jetty.version} + + + org.xerial + sqlite-jdbc + 3.7.2 + + + org.bouncycastle + bcprov-jdk15on + ${bouncycastle.version} + + + org.bouncycastle + bcpkix-jdk15on + ${bouncycastle.version} + + + ch.qos.logback + logback-classic + 1.1.3 + + + + + + coverage + + + coverage + + + + + + com.atlassian.maven.plugins + maven-clover2-plugin + 4.0.4 + + 1.8 + ${HOME}/license/clover.license + + + **/provider/ProviderClient.java + **/provider/ResourceError.java + **/provider/ResourceException.java + **/zms/GetSignedDomainsResult.java + **/zms/ResourceContext.java + **/zms/ResourceError.java + **/zms/ResourceException.java + **/zms/ZMSHandler.java + **/zms/ZMSResources.java + + + + + + + + + + + + org.codehaus.mojo + exec-maven-plugin + 1.1.1 + + + + exec + + generate-sources + + + + bash + + scripts/make_stubs.sh + + + + + org.apache.maven.plugins + maven-dependency-plugin + 3.0.0 + + + copy-dependencies + package + + copy-dependencies + + + runtime + + + + + + + + diff --git a/servers/zms/schema/zms_server.mwb b/servers/zms/schema/zms_server.mwb new file mode 100644 index 00000000000..01cedee5fae Binary files /dev/null and b/servers/zms/schema/zms_server.mwb differ diff --git a/servers/zms/schema/zms_server.sql b/servers/zms/schema/zms_server.sql new file mode 100644 index 00000000000..aecf4ff7cc9 --- /dev/null +++ b/servers/zms/schema/zms_server.sql @@ -0,0 +1,266 @@ +-- MySQL Script generated by MySQL Workbench +-- Tue May 17 17:40:32 2016 +-- Model: New Model Version: 1.0 +-- MySQL Workbench Forward Engineering + +SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0; +SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0; +SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='TRADITIONAL,ALLOW_INVALID_DATES'; + +-- ----------------------------------------------------- +-- Schema zms_server +-- ----------------------------------------------------- + +-- ----------------------------------------------------- +-- Schema zms_server +-- ----------------------------------------------------- +CREATE SCHEMA IF NOT EXISTS `zms_server` DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci ; +USE `zms_server` ; + +-- ----------------------------------------------------- +-- Table `zms_server`.`domain` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`domain` ( + `domain_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, + `name` VARCHAR(512) NOT NULL, + `description` VARCHAR(4096) NOT NULL DEFAULT '', + `org` VARCHAR(1024) NOT NULL DEFAULT '', + `uuid` VARCHAR(128) NOT NULL DEFAULT '', + `enabled` TINYINT(1) NOT NULL DEFAULT 1, + `audit_enabled` TINYINT(1) NOT NULL DEFAULT 0, + `ypm_id` INT UNSIGNED NOT NULL DEFAULT 0, + `account` VARCHAR(128) NOT NULL DEFAULT '', + `modified` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + `created` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + PRIMARY KEY (`domain_id`), + UNIQUE INDEX `uq_name` (`name` ASC), + INDEX `idx_modified` (`modified` ASC), + INDEX `idx_account` (`account` ASC), + INDEX `idx_ypmid` (`ypm_id` ASC)) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`role` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`role` ( + `role_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, + `domain_id` INT UNSIGNED NOT NULL, + `name` VARCHAR(512) NOT NULL, + `trust` VARCHAR(512) NOT NULL DEFAULT '', + `modified` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + `created` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + PRIMARY KEY (`role_id`), + UNIQUE INDEX `uq_domain_role` (`domain_id` ASC, `name` ASC), + CONSTRAINT `fk_role_domain` + FOREIGN KEY (`domain_id`) + REFERENCES `zms_server`.`domain` (`domain_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`principal` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`principal` ( + `principal_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, + `name` VARCHAR(512) NOT NULL, + PRIMARY KEY (`principal_id`), + UNIQUE INDEX `uq_name` (`name` ASC)) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`policy` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`policy` ( + `policy_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, + `domain_id` INT UNSIGNED NOT NULL, + `name` VARCHAR(512) NOT NULL, + `modified` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + `created` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + PRIMARY KEY (`policy_id`), + INDEX `fk_policy_domain_idx` (`domain_id` ASC), + UNIQUE INDEX `uq_domain_policy` (`name` ASC, `domain_id` ASC), + CONSTRAINT `fk_policy_domain` + FOREIGN KEY (`domain_id`) + REFERENCES `zms_server`.`domain` (`domain_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`assertion` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`assertion` ( + `assertion_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, + `policy_id` INT UNSIGNED NOT NULL, + `role` VARCHAR(512) NOT NULL, + `resource` VARCHAR(1024) NOT NULL, + `action` VARCHAR(128) NOT NULL, + `effect` VARCHAR(16) NOT NULL DEFAULT 'ALLOW', + PRIMARY KEY (`assertion_id`), + INDEX `fk_assertion_policy_idx` (`policy_id` ASC), + INDEX `idx_role` (`role` ASC), + INDEX `idx_resource` (`resource` ASC), + INDEX `idx_action` (`action` ASC), + INDEX `idx_effect` (`effect` ASC), + CONSTRAINT `fk_policy_assertion_policy` + FOREIGN KEY (`policy_id`) + REFERENCES `zms_server`.`policy` (`policy_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`service` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`service` ( + `service_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, + `domain_id` INT UNSIGNED NOT NULL, + `name` VARCHAR(512) NOT NULL, + `provider_endpoint` VARCHAR(512) NOT NULL DEFAULT '', + `executable` VARCHAR(256) NOT NULL DEFAULT '', + `svc_user` VARCHAR(256) NOT NULL DEFAULT '', + `svc_group` VARCHAR(256) NOT NULL DEFAULT '', + `modified` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + `created` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + PRIMARY KEY (`service_id`), + INDEX `fk_service_domain_idx` (`domain_id` ASC), + UNIQUE INDEX `uq_domain_service` (`name` ASC, `domain_id` ASC), + CONSTRAINT `fk_service_domain` + FOREIGN KEY (`domain_id`) + REFERENCES `zms_server`.`domain` (`domain_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`public_key` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`public_key` ( + `service_id` INT UNSIGNED NOT NULL, + `key_id` VARCHAR(128) NOT NULL, + `key_value` TEXT(65535) NOT NULL, + PRIMARY KEY (`service_id`, `key_id`), + CONSTRAINT `fk_service_public_key_service` + FOREIGN KEY (`service_id`) + REFERENCES `zms_server`.`service` (`service_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`host` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`host` ( + `host_id` INT UNSIGNED NOT NULL AUTO_INCREMENT, + `name` VARCHAR(512) NOT NULL, + PRIMARY KEY (`host_id`), + UNIQUE INDEX `uq_name` (`name` ASC)) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`service_host` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`service_host` ( + `service_id` INT UNSIGNED NOT NULL, + `host_id` INT UNSIGNED NOT NULL, + INDEX `idx_host` (`host_id` ASC, `service_id` ASC), + PRIMARY KEY (`service_id`, `host_id`), + CONSTRAINT `fk_service_host_host` + FOREIGN KEY (`host_id`) + REFERENCES `zms_server`.`host` (`host_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION, + CONSTRAINT `fk_service_host_service` + FOREIGN KEY (`service_id`) + REFERENCES `zms_server`.`service` (`service_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`entity` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`entity` ( + `name` VARCHAR(256) NOT NULL, + `domain_id` INT UNSIGNED NOT NULL, + `value` TEXT(65536) NOT NULL, + `modified` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3), + `created` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + PRIMARY KEY (`name`, `domain_id`), + CONSTRAINT `fk_entity_domain` + FOREIGN KEY (`domain_id`) + REFERENCES `zms_server`.`domain` (`domain_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`role_member` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`role_member` ( + `role_id` INT UNSIGNED NOT NULL, + `principal_id` INT UNSIGNED NOT NULL, + PRIMARY KEY (`role_id`, `principal_id`), + INDEX `idx_principal` (`principal_id` ASC, `role_id` ASC), + CONSTRAINT `fk_role_member_role` + FOREIGN KEY (`role_id`) + REFERENCES `zms_server`.`role` (`role_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION, + CONSTRAINT `fk_role_member_principal` + FOREIGN KEY (`principal_id`) + REFERENCES `zms_server`.`principal` (`principal_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`domain_template` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`domain_template` ( + `domain_id` INT UNSIGNED NOT NULL, + `template` VARCHAR(64) NOT NULL, + UNIQUE INDEX `uq_domain_template` (`template` ASC, `domain_id` ASC), + PRIMARY KEY (`domain_id`, `template`), + CONSTRAINT `fk_domain_template_domain` + FOREIGN KEY (`domain_id`) + REFERENCES `zms_server`.`domain` (`domain_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +-- ----------------------------------------------------- +-- Table `zms_server`.`role_audit_log` +-- ----------------------------------------------------- +CREATE TABLE IF NOT EXISTS `zms_server`.`role_audit_log` ( + `role_id` INT UNSIGNED NOT NULL, + `admin` VARCHAR(512) NOT NULL, + `member` VARCHAR(512) NOT NULL, + `created` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP, + `action` VARCHAR(32) NOT NULL, + `audit_ref` VARCHAR(512) NOT NULL, + INDEX `fk_role_audit_log_role_id_idx` (`role_id` ASC), + CONSTRAINT `fk_role_audit_log_role` + FOREIGN KEY (`role_id`) + REFERENCES `zms_server`.`role` (`role_id`) + ON DELETE CASCADE + ON UPDATE NO ACTION) +ENGINE = InnoDB; + + +SET SQL_MODE=@OLD_SQL_MODE; +SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS; +SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS; diff --git a/servers/zms/scripts/make_stubs.sh b/servers/zms/scripts/make_stubs.sh new file mode 100755 index 00000000000..f83647a3d9e --- /dev/null +++ b/servers/zms/scripts/make_stubs.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +# If the zms_core dependency has been updated, then this script should be run +# manually to pick up the latest rdl to generate the appropriate server stubs. + +# Note this script is dependent on the rdl utility. +# go get github.com/ardielle/ardielle-tools/... + +command -v rdl >/dev/null 2>&1 || { + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "SOURCE WARNING"; + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "Please install rdl utility: go get github.com/ardielle/ardielle-tools/..."; + echo >&2 "Skipping source generation..."; + exit 0; +} + +RDL_ZMS_FILE=src/main/rdl/ZMS.rdl +RDL_PROVIDER_FILE=../../core/zms/src/main/rdl/Provider.rdl + +echo "Generate the server stubs" +rdl -s generate -o src/main/java java-server $RDL_ZMS_FILE + +echo "Generate the provier client library" +rdl -s generate -o src/main/java java-client $RDL_PROVIDER_FILE + +echo "Removing not needed ZMS Server file..." +rm src/main/java/com/yahoo/athenz/zms/ZMSServer.java + +# Copyright 2016 Yahoo Inc. +# Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. diff --git a/servers/zms/scripts/zms_debug.sh b/servers/zms/scripts/zms_debug.sh new file mode 100755 index 00000000000..6474828e845 --- /dev/null +++ b/servers/zms/scripts/zms_debug.sh @@ -0,0 +1,37 @@ +#!/bin/bash + +# setup ZMS settings for debug run + +export ZMS_OPTS="${ZMS_OPTS} -Dlogback.configurationFile=src/test/resources/logback.xml" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.domain_admin=user.$USER,user.zms_test_admin,user.user_admin" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.authority_classes=com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority,com.yahoo.athenz.common.server.debug.DebugUserAuthority,com.yahoo.athenz.common.server.debug.DebugRoleAuthority,com.yahoo.athenz.common.server.debug.DebugKerberosAuthority" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.home=./" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.jdbcstore=./" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.port=4080" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.private_key_store_class=com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.privatekey=src/test/resources/zms_private.pem" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.privatekey.version=0" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.publickey=src/test/resources/zms_public.pem" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.access_log_dir=./zms_logs" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.enable_stats=false" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.virtual_domain_support=true" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.virtual_domain_limit=0" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.solution_templates_fname=src/test/resources/solution_templates.json" +export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.authz_service_fname=src/test/resources/authorized_services.json" + +if [ "$1" == "-ssl" ]; then + export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.tls_port=4443" + export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.ssl_key_store_password=password" + export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.ssl_key_store=file://$HOME/.keystore" + export ZMS_OPTS="${ZMS_OPTS} -Dathenz.zms.ssl_key_store_type=PKCS12" +fi + + +# make sure the access log directory exits + +mkdir -p ./zms_logs + +mvn exec:java -Dexec.mainClass="com.yahoo.athenz.zms.ZMS" ${ZMS_OPTS} + +# Copyright 2016 Yahoo Inc. +# Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. diff --git a/servers/zms/scripts/zms_start.sh b/servers/zms/scripts/zms_start.sh new file mode 100644 index 00000000000..98b07c16e08 --- /dev/null +++ b/servers/zms/scripts/zms_start.sh @@ -0,0 +1,196 @@ +#!/bin/bash + +if [ -z "${ROOT}" ]; then + ROOT="/home/athenz" +fi + +CONTAINER_NAME=zms_server + +# pick up our service settings which should override +# some of the default values set by the code +if [ ! -f ${ROOT}/conf/${CONTAINER_NAME}/container_settings ]; then + echo "Unable to find container settings: ${ROOT}/conf/${CONTAINER_NAME}/container_settings aborting" + exit -1 +fi + +. "${ROOT}/conf/${CONTAINER_NAME}/container_settings" + +CONTAINER_RUN_PATH=${ROOT}/var/run/zms_server +CONTAINER_CLASSPATH=${ROOT}/lib/jar/zms_server*.jar:${ROOT}/lib/jars/* +CONTAINER_BOOTSTRAP_CLASS=com.yahoo.athenz.zms.ZMS + +if [ "${CONTAINER_READ_ONLY_MODE}" == "true" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.read_only_mode=true" +fi + +if [ "${CONTAINER_VIRTUAL_DOMAIN_SUPPORT}" == "true" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.virtual_domain_support=true" +fi + +if [ "x${CONTAINER_VIRTUAL_DOMAIN_LIMIT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.virtual_domain_limit=${CONTAINER_VIRTUAL_DOMAIN_LIMIT}" +fi + +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.port=${CONTAINER_PORT}" +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.tls_port=${CONTAINER_TLS_PORT}" +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.logs=${ROOT}/logs/${CONTAINER_NAME}" + +if [ "x${CONTAINER_LOG_CONFIG}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dlogback.configurationFile=${CONTAINER_LOG_CONFIG}" +fi + +if [ "x{$CONTAINER_PRIVKEY}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.privatekey=${CONTAINER_PRIVKEY}" +fi + +if [ "x${CONTAINER_PRIVKEY_ID}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.privatekey_id=${CONTAINER_PRIVKEY_ID}" +fi + +if [ "x${CONTAINER_PUBKEY}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.publickey=${CONTAINER_PUBKEY}" +fi + +if [ "x${CONTAINER_HOSTNAME}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.hostname=${CONTAINER_HOSTNAME}" +fi + +if [ "x${CONTAINER_CONFLICT_RETRY_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.conflict_retry_timeout=${CONTAINER_CONFLICT_RETRY_TIMEOUT}" +fi + +if [ "x${CONTAINER_RETRY_DELAY_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.retry_delay_timeout=${CONTAINER_RETRY_DELAY_TIMEOUT}" +fi + +if [ "x${CONTAINER_USER_TOKEN_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.user_token_timeout=${CONTAINER_USER_TOKEN_TIMEOUT}" +fi + +if [ "x${CONTAINER_SIGNED_POLICY_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.signed_policy_timeout=${CONTAINER_SIGNED_POLICY_TIMEOUT}" +fi + +if [ "x${CONTAINER_ADMINUSER}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.domain_admin=${CONTAINER_ADMINUSER}" +fi + +if [ "x${CONTAINER_JDBCSTORE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.jdbcstore=${CONTAINER_JDBCSTORE}" +fi + +if [ "x${CONTAINER_JDBCUSER}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.jdbc_user=${CONTAINER_JDBCUSER}" +fi + +if [ "x${CONTAINER_JDBCPASSWD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.jdbc_password=${CONTAINER_JDBCPASSWD}" +fi + +if [ "x${CONTAINER_JDBCTABLE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.zms_dbtable=${CONTAINER_JDBCTABLE}" +fi + +if [ "x${CONTAINER_DBPOOL_MAX_TOTAL}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.db_pool_max_total=${CONTAINER_DBPOOL_MAX_TOTAL}" +fi + +if [ "x${CONTAINER_DBPOOL_MAX_IDLE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.db_pool_max_idle=${CONTAINER_DBPOOL_MAX_IDLE}" +fi + +if [ "x${CONTAINER_DBPOOL_MIN_IDLE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.db_pool_min_idle=${CONTAINER_DBPOOL_MIN_IDLE}" +fi + +if [ "x${CONTAINER_DBPOOL_MAX_WAIT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.db_pool_max_wait=${CONTAINER_DBPOOL_MAX_WAIT}" +fi + +if [ "x${CONTAINER_DBPOOL_EVICT_IDLE_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.db_pool_evict_idle_timeout=${CONTAINER_DBPOOL_EVICT_IDLE_TIMEOUT}" +fi + +if [ "x${CONTAINER_DBPOOL_EVICT_IDLE_INTERVAL}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.db_pool_evict_idle_interval=${CONTAINER_DBPOOL_EVICT_IDLE_INTERVAL}" +fi + +if [ "x${CONTAINER_DBPOOL_MAX_TTL}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.db_pool_max_ttl=${CONTAINER_DBPOOL_MAX_TTL}" +fi + +if [ "x${CONTAINER_SSL_KEYSTORE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_key_store=${CONTAINER_SSL_KEYSTORE}" +fi + +if [ "x${CONTAINER_SSL_KEYSTORE_TYPE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_key_store_type=${CONTAINER_SSL_KEYSTORE_TYPE}" +fi + +if [ "x${CONTAINER_SSL_KEYSTORE_PASSWORD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_key_store_password=${CONTAINER_SSL_KEYSTORE_PASSWORD}" +fi + +if [ "x${CONTAINER_SSL_TRUSTSTORE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_trust_store=${CONTAINER_SSL_TRUSTSTORE}" +fi + +if [ "x${CONTAINER_SSL_TRUSTSTORE_TYPE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_trust_store_type=${CONTAINER_SSL_TRUSTSTORE_TYPE}" +fi + +if [ "x${CONTAINER_SSL_TRUSTSTORE_PASSWORD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_trust_store_password=${CONTAINER_SSL_TRUSTSTORE_PASSWORD}" +fi + +if [ "x${CONTAINER_SSL_KEYMANAGER_PASSWORD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_key_manager_password=${CONTAINER_SSL_KEYMANAGER_PASSWORD}" +fi + +if [ "x${CONTAINER_SSL_EXCLUDED_CIPHER_SUITES}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_excluded_cipher_suites=${CONTAINER_SSL_EXCLUDED_CIPHER_SUITES}" +fi + +if [ "x${CONTAINER_SSL_EXCLUDED_PROTOCOLS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.ssl_excluded_protocols=${CONTAINER_SSL_EXCLUDED_PROTOCOLS}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_DIR}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.access_log_dir=${CONTAINER_ACCESS_LOG_DIR}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_NAME}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.access_log_name=${CONTAINER_ACCESS_LOG_NAME}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_RETAIN_DAYS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.access_log_retain_days=${CONTAINER_ACCESS_LOG_RETAIN_DAYS}" +fi + +if [ "x${CONTAINER_LISTEN_HOST}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.listen_host=${CONTAINER_LISTEN_HOST}" +fi + +if [ "x${CONTAINER_AUTHZ_SERVICE_FNAME}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.authz_service_fname=${CONTAINER_AUTHZ_SERVICE_FNAME}" +fi + +if [ "x${CONTAINER_SOLUTION_TEMPLATES_FNAME}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.solution_templates_fname=${CONTAINER_SOLUTION_TEMPLATES_FNAME}" +fi + +if [ "x${CONTAINER_DOMAIN_NAME_MAX_LEN}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.domain_name_max_len=${CONTAINER_DOMAIN_NAME_MAX_LEN}" +fi + +if [ "x${CONTAINER_AUTHORITY_CLASSES}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zms.authority_classes=${CONTAINER_AUTHORITY_CLASSES}" +fi + +if [ "x${CONTAINER_AUTH_PAM_SERVICE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.auth.user.pam_service_name=${CONTAINER_AUTH_PAM_SERVICE}" +fi + +echo "Executing: java -classpath ${CONTAINER_CLASSPATH} ${JAVA_OPTS} ${CONTAINER_BOOTSTRAP_CLASS}" + +java -classpath ${CONTAINER_CLASSPATH} ${JAVA_OPTS} ${CONTAINER_BOOTSTRAP_CLASS} 2>&1 < /dev/null diff --git a/servers/zms/src/main/java/com/yahoo/athenz/provider/ProviderClient.java b/servers/zms/src/main/java/com/yahoo/athenz/provider/ProviderClient.java new file mode 100644 index 00000000000..15439eef36f --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/provider/ProviderClient.java @@ -0,0 +1,154 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.provider; + +import com.yahoo.rdl.*; +import javax.ws.rs.client.*; +import javax.ws.rs.*; +import javax.ws.rs.core.*; +import javax.net.ssl.HostnameVerifier; + +public class ProviderClient { + Client client; + WebTarget base; + String credsHeader; + String credsToken; + + public ProviderClient(String url) { + client = ClientBuilder.newClient(); + base = client.target(url); + } + + public ProviderClient(String url, HostnameVerifier hostnameVerifier) { + client = ClientBuilder.newBuilder() + .hostnameVerifier(hostnameVerifier) + .build(); + base = client.target(url); + } + + public void close() { + client.close(); + } + + public ProviderClient setProperty(String name, Object value) { + client = client.property(name, value); + return this; + } + + public ProviderClient addCredentials(String header, String token) { + credsHeader = header; + credsToken = token; + return this; + } + + public Tenant putTenant(String service, String tenant, String auditRef, Tenant template) { + WebTarget target = base.path("/service/{service}/tenant/{tenant}") + .resolveTemplate("service", service) + .resolveTemplate("tenant", tenant); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(template, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Tenant.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Tenant getTenant(String service, String tenant) { + WebTarget target = base.path("/service/{service}/tenant/{tenant}") + .resolveTemplate("service", service) + .resolveTemplate("tenant", tenant); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + Response response = invocationBuilder.get(); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(Tenant.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public Tenant deleteTenant(String service, String tenant, String auditRef) { + WebTarget target = base.path("/service/{service}/tenant/{tenant}") + .resolveTemplate("service", service) + .resolveTemplate("tenant", tenant); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantResourceGroup putTenantResourceGroup(String service, String tenant, String resourceGroup, String auditRef, TenantResourceGroup template) { + WebTarget target = base.path("/service/{service}/tenant/{tenant}/resourceGroup/{resourceGroup}") + .resolveTemplate("service", service) + .resolveTemplate("tenant", tenant) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.put(javax.ws.rs.client.Entity.entity(template, "application/json")); + int code = response.getStatus(); + switch (code) { + case 200: + return response.readEntity(TenantResourceGroup.class); + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + + public TenantResourceGroup deleteTenantResourceGroup(String service, String tenant, String resourceGroup, String auditRef) { + WebTarget target = base.path("/service/{service}/tenant/{tenant}/resourceGroup/{resourceGroup}") + .resolveTemplate("service", service) + .resolveTemplate("tenant", tenant) + .resolveTemplate("resourceGroup", resourceGroup); + Invocation.Builder invocationBuilder = target.request("application/json"); + if (credsHeader != null) { + invocationBuilder = invocationBuilder.header(credsHeader, credsToken); + } + if (auditRef != null) { + invocationBuilder = invocationBuilder.header("Y-Audit-Ref", auditRef); + } + Response response = invocationBuilder.delete(); + int code = response.getStatus(); + switch (code) { + case 204: + return null; + default: + throw new ResourceException(code, response.readEntity(ResourceError.class)); + } + + } + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/provider/ResourceError.java b/servers/zms/src/main/java/com/yahoo/athenz/provider/ResourceError.java new file mode 100644 index 00000000000..ee389104bb2 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/provider/ResourceError.java @@ -0,0 +1,24 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.provider; + +public class ResourceError { + + public int code; + public String message; + + public ResourceError code(int code) { + this.code = code; + return this; + } + public ResourceError message(String message) { + this.message = message; + return this; + } + + public String toString() { + return "{code: " + code + ", message: \"" + message + "\"}"; + } + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/provider/ResourceException.java b/servers/zms/src/main/java/com/yahoo/athenz/provider/ResourceException.java new file mode 100644 index 00000000000..ded276d615a --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/provider/ResourceException.java @@ -0,0 +1,79 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.provider; + +public class ResourceException extends RuntimeException { + public final static int OK = 200; + public final static int CREATED = 201; + public final static int ACCEPTED = 202; + public final static int NO_CONTENT = 204; + public final static int MOVED_PERMANENTLY = 301; + public final static int FOUND = 302; + public final static int SEE_OTHER = 303; + public final static int NOT_MODIFIED = 304; + public final static int TEMPORARY_REDIRECT = 307; + public final static int BAD_REQUEST = 400; + public final static int UNAUTHORIZED = 401; + public final static int FORBIDDEN = 403; + public final static int NOT_FOUND = 404; + public final static int CONFLICT = 409; + public final static int GONE = 410; + public final static int PRECONDITION_FAILED = 412; + public final static int UNSUPPORTED_MEDIA_TYPE = 415; + public final static int INTERNAL_SERVER_ERROR = 500; + public final static int NOT_IMPLEMENTED = 501; + + public final static int SERVICE_UNAVAILABLE = 503; + + public static String codeToString(int code) { + switch (code) { + case OK: return "OK"; + case CREATED: return "Created"; + case ACCEPTED: return "Accepted"; + case NO_CONTENT: return "No Content"; + case MOVED_PERMANENTLY: return "Moved Permanently"; + case FOUND: return "Found"; + case SEE_OTHER: return "See Other"; + case NOT_MODIFIED: return "Not Modified"; + case TEMPORARY_REDIRECT: return "Temporary Redirect"; + case BAD_REQUEST: return "Bad Request"; + case UNAUTHORIZED: return "Unauthorized"; + case FORBIDDEN: return "Forbidden"; + case NOT_FOUND: return "Not Found"; + case CONFLICT: return "Conflict"; + case GONE: return "Gone"; + case PRECONDITION_FAILED: return "Precondition Failed"; + case UNSUPPORTED_MEDIA_TYPE: return "Unsupported Media Type"; + case INTERNAL_SERVER_ERROR: return "Internal Server Error"; + case NOT_IMPLEMENTED: return "Not Implemented"; + default: return "" + code; + } + } + + int code; + Object data; + + public ResourceException(int code) { + this(code, new ResourceError().code(code).message(codeToString(code))); + } + + public ResourceException(int code, Object data) { + super("ResourceException (" + code + "): " + data); + this.code = code; + this.data = data; + } + + public int getCode() { + return code; + } + + public Object getData() { + return data; + } + + public T getData(Class cl) { + return cl.cast(data); + } + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/DBService.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/DBService.java new file mode 100644 index 00000000000..2281c81dd46 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/DBService.java @@ -0,0 +1,2579 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.Collection; +import java.util.HashMap; +import java.util.HashSet; +import java.util.Iterator; +import java.util.List; +import java.util.Map; +import java.util.Set; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.google.common.cache.Cache; +import com.google.common.cache.CacheBuilder; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.util.StringUtils; +import com.yahoo.athenz.zms.store.AthenzDomain; +import com.yahoo.athenz.zms.store.ObjectStore; +import com.yahoo.athenz.zms.store.ObjectStoreConnection; +import com.yahoo.athenz.zms.utils.ZMSUtils; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Timestamp; +import com.yahoo.rdl.UUID; + +public class DBService { + + ObjectStore store; + String userDomain; + AuditLogger auditLogger; + Cache cacheStore; + int retrySleepTime = 250; + int defaultRetryCount = 120; + + private static final Logger LOG = LoggerFactory.getLogger(DBService.class); + + private static final String ROLE_PREFIX = "role."; + private static final String POLICY_PREFIX = "policy."; + private static final String TEMPLATE_DOMAIN_NAME = "_domain_"; + + public DBService(ObjectStore store, AuditLogger auditLogger, String userDomain) { + + this.store = store; + this.userDomain = userDomain; + this.auditLogger = auditLogger; + cacheStore = CacheBuilder.newBuilder().concurrencyLevel(25).build(); + + // retrieve the concurrent update retry count. If we're given an invalid negative + // value for count, we'll default back to our default configured value of 120 retries + // which would result up to 30 seconds sleeping 250ms each time + + defaultRetryCount = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_CONFLICT_RETRY_COUNT, "120")); + if (defaultRetryCount < 0) { + defaultRetryCount = 120; + } + + retrySleepTime = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_CONFLICT_RETRY_SLEEP_TIME, "250")); + if (retrySleepTime < 0) { + retrySleepTime = 250; + } + } + + private static class DataCache { + AthenzDomain athenzDomain; + long modTime; + + DataCache(AthenzDomain athenzDomain, long modTime) { + this.athenzDomain = athenzDomain; + this.modTime = modTime; + } + + AthenzDomain getAthenzDomain() { + return athenzDomain; + } + + long getModTime() { + return modTime; + } + } + + AthenzDomain getAthenzDomainFromCache(String domainName) { + + // if we have a match for a given domain name then we're going + // to check if the last modified domain timestamp matches to what's + // in the db: So if there is no match, then we'll take the hit + // of extra db read, however, in most cases the domain data is not + // changed that often so we'll satisfy the request with just + // verifying the last modification time as oppose to reading the + // full domain data from db + + DataCache data = cacheStore.getIfPresent(domainName); + if (data == null) { + return null; + } + + long modTime = 0; + try (ObjectStoreConnection con = store.getConnection(true)) { + modTime = con.getDomainModTimestamp(domainName); + } + + if (modTime == data.getModTime()) { + return data.getAthenzDomain(); + } + + cacheStore.invalidate(domainName); + return null; + } + + String getPrincipalYrn(ResourceContext ctx) { + if (ctx == null) { + return null; + } + Principal principal = ((ZMSImpl.RsrcCtxWrapper) ctx).principal(); + if (principal == null) { + return null; + } + return principal.getYRN(); + } + + void saveChanges(ObjectStoreConnection con, String domainName) { + + // we're first going to commit our changes which will + // also set the connection in auto-commit mode. we are + // going to change the domain timestamp in auto-commit + // mode so that we don't have a contention + + con.commitChanges(); + con.updateDomainModTimestamp(domainName); + cacheStore.invalidate(domainName); + } + + void auditLogRequest(ResourceContext ctx, String domainName, String auditRef, + String caller, String operation, String entityName, String auditDetails) { + + AuditLogMsgBuilder msgBldr = ZMSImpl.getAuditLogMsgBuilder(ctx, domainName, auditRef, + caller, operation); + msgBldr.when(Timestamp.fromCurrentTime()).whatEntity(entityName); + if (auditDetails != null) { + msgBldr.whatDetails(auditDetails); + } + auditLogger.log(msgBldr); + } + + Domain makeDomain(ResourceContext ctx, String domainName, String description, String org, + Boolean auditEnabled, List adminUsers, String account, int productId, + List solutionTemplates, String auditRef) { + + final String caller = "makedomain"; + + Domain domain = new Domain() + .setName(domainName) + .setAuditEnabled(auditEnabled) + .setDescription(description) + .setOrg(org) + .setId(UUID.fromCurrentTime()) + .setAccount(account) + .setYpmId(productId) + .setModified(Timestamp.fromCurrentTime()); + + // get our connection object + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + boolean objectsInserted = con.insertDomain(domain); + if (!objectsInserted) { + con.rollbackChanges(); + throw ZMSUtils.requestError("makeDomain: Cannot create domain: " + + domainName + " - already exists", caller); + } + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{domain: "); + auditLogDomain(auditDetails, domain); + + // first create and process the admin role + + Role adminRole = ZMSUtils.makeAdminRole(domainName, adminUsers); + auditDetails.append(", role: "); + if (!processRole(con, null, domainName, ZMSConsts.ADMIN_ROLE_NAME, adminRole, + getPrincipalYrn(ctx), auditRef, false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("makeDomain: Cannot process role: '" + + adminRole.getName(), caller); + } + + // now create and process the admin policy + + Policy adminPolicy = ZMSUtils.makeAdminPolicy(domainName, adminRole); + auditDetails.append(", policy: "); + if (!processPolicy(con, null, domainName, ZMSConsts.ADMIN_POLICY_NAME, adminPolicy, + false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("makeDomain: Cannot process policy: '" + + adminPolicy.getName(), caller); + } + + // go through our list of templates and add the specified + // roles and polices to our domain + + if (solutionTemplates != null) { + for (String templateName : solutionTemplates) { + auditDetails.append(", template: "); + Template template = ZMSImpl.serverSolutionTemplates.get(templateName); + if (!applySolutionTemplate(con, domainName, templateName, template, true, + getPrincipalYrn(ctx), auditRef, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("makeDomain: Cannot apply templates: '" + + domain, caller); + } + } + } + auditDetails.append("}"); + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log entry + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_POST, + domainName, auditDetails.toString()); + + return domain; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + + return null; + } + + boolean processPolicy(ObjectStoreConnection con, Policy originalPolicy, String domainName, + String policyName, Policy policy, boolean ignoreDeletes, StringBuilder auditDetails) { + + // check to see if we need to insert the policy or update it + + boolean requestSuccess = false; + if (originalPolicy == null) { + requestSuccess = con.insertPolicy(domainName, policy); + } else { + requestSuccess = con.updatePolicy(domainName, policy); + } + + // if we didn't update any policies then we need to return failure + + if (!requestSuccess) { + return false; + } + + // open our audit record + + auditDetails.append("{name: \"").append(policyName).append('\"'); + + // now we need process our policy assertions depending this is + // a new insert operation or an update + + List newAssertions = policy.getAssertions(); + if (originalPolicy == null) { + + // we're just going to process our new assertions + + if (newAssertions != null) { + for (Assertion assertion : newAssertions) { + if (!con.insertAssertion(domainName, policyName, assertion)) { + return false; + } + } + auditLogAssertions(auditDetails, "added-assertions", newAssertions); + } + + } else { + + // first we need to retrieve the current set of assertions + + List curAssertions = originalPolicy.getAssertions(); + if (curAssertions == null) { + curAssertions = new ArrayList<>(); + } + List addAssertions = new ArrayList<>(); + List delAssertions = new ArrayList<>(); + policyAssertionChanges(newAssertions, curAssertions, addAssertions, delAssertions); + + if (!ignoreDeletes) { + for (Assertion assertion : delAssertions) { + if (!con.deleteAssertion(domainName, policyName, assertion.getId())) { + return false; + } + } + auditLogAssertions(auditDetails, "deleted-assertions", delAssertions); + } + + for (Assertion assertion : addAssertions) { + if (!con.insertAssertion(domainName, policyName, assertion)) { + return false; + } + } + auditLogAssertions(auditDetails, "added-assertions", addAssertions); + } + + auditDetails.append('}'); + return true; + } + + boolean removeMatchedAssertion(Assertion assertion, List assertions, List matchedAssertions) { + + AssertionEffect effect = AssertionEffect.ALLOW; + if (assertion.getEffect() != null) { + effect = assertion.getEffect(); + } + + Iterator itr = assertions.iterator(); + while (itr.hasNext()) { + + Assertion checkAssertion = (Assertion) itr.next(); + + if (!assertion.getAction().equals(checkAssertion.getAction())) { + continue; + } + if (!assertion.getResource().equals(checkAssertion.getResource())) { + continue; + } + if (!assertion.getRole().equals(checkAssertion.getRole())) { + continue; + } + + AssertionEffect checkEffect = AssertionEffect.ALLOW; + if (checkAssertion.getEffect() != null) { + checkEffect = checkAssertion.getEffect(); + } + + if (effect != checkEffect) { + continue; + } + + itr.remove(); + matchedAssertions.add(checkAssertion); + return true; + } + + return false; + } + + void policyAssertionChanges(List newAssertions, List curAssertions, + List addAssertions, List delAssertions) { + + // let's iterate through the new list and the ones that are + // not in the current list should be added to the add list + + List matchedAssertions = new ArrayList(); + if (newAssertions != null) { + for (Assertion assertion : newAssertions) { + if (!removeMatchedAssertion(assertion, curAssertions, matchedAssertions)) { + addAssertions.add(assertion); + } + } + } + + // now our current list has been updated as well and + // all the assertions that were present moved to the + // matched assertion list so whatever left in the + // current list must be deleted + + delAssertions.addAll(curAssertions); + + // now let's go back and re-add the matched assertions + // back to our list so we can get the right audit data + + curAssertions.addAll(matchedAssertions); + } + + boolean processRole(ObjectStoreConnection con, Role originalRole, String domainName, String roleName, + Role role, String admin, String auditRef, boolean ignoreDeletes, StringBuilder auditDetails) { + + // check to see if we need to insert the role or update it + + boolean requestSuccess = false; + if (originalRole == null) { + requestSuccess = con.insertRole(domainName, role); + } else { + requestSuccess = con.updateRole(domainName, role); + } + + // if we didn't update any roles then we need to return failure + + if (!requestSuccess) { + return false; + } + + // open our audit record and log our trust field if one is available + + auditDetails.append("{name: \"").append(roleName) + .append("\", trust: \"").append(role.getTrust()).append('\"'); + + // now we need process our role members depending this is + // a new insert operation or an update + + List members = role.getMembers(); + if (originalRole == null) { + + // we are just going to process all members as new inserts + + if (members != null) { + + for (String member : members) { + if (!con.insertRoleMember(domainName, roleName, member, admin, auditRef)) { + return false; + } + } + auditLogStrings(auditDetails, "added-members", members); + } + + } else { + + // first we need to retrieve the current set of members + + List originalMembers = originalRole.getMembers(); + if (originalMembers == null) { + originalMembers = new ArrayList<>(); + } + Set curMembers = new HashSet<>(originalMembers); + Set delMembers = new HashSet<>(curMembers); + if (members == null) { + members = new ArrayList<>(); + } + Set newMembers = new HashSet<>(members); + newMembers.removeAll(curMembers); + delMembers.removeAll(members); + + if (!ignoreDeletes) { + for (String member : delMembers) { + if (!con.deleteRoleMember(domainName, roleName, member, admin, auditRef)) { + return false; + } + } + auditLogStrings(auditDetails, "deleted-members", delMembers); + } + + for (String member : newMembers) { + if (!con.insertRoleMember(domainName, roleName, member, admin, auditRef)) { + return false; + } + } + auditLogStrings(auditDetails, "added-members", newMembers); + + } + + auditDetails.append('}'); + return true; + } + + boolean processServiceIdentity(ObjectStoreConnection con, ServiceIdentity originalService, String domainName, + String serviceName, ServiceIdentity service, StringBuilder auditDetails) { + + boolean requestSuccess = false; + if (originalService == null) { + requestSuccess = con.insertServiceIdentity(domainName, service); + } else { + requestSuccess = con.updateServiceIdentity(domainName, service); + } + + // if we didn't update any services then we need to return failure + + if (!requestSuccess) { + return false; + } + + // open our audit record and log our service details + + auditDetails.append("{name: \"").append(serviceName).append('\"') + .append(", executable: \"").append(service.getExecutable()).append('\"') + .append(", user: \"").append(service.getUser()).append('\"') + .append(", group: \"").append(service.getGroup()).append('\"') + .append(", providerEndpoint: \"").append(service.getProviderEndpoint()).append('\"'); + + // now we need process our public keys depending this is + // a new insert operation or an update + + List publicKeys = service.getPublicKeys(); + if (originalService == null) { + + // we are just going to process all public keys as new inserts + + if (publicKeys != null) { + + for (PublicKeyEntry publicKey : publicKeys) { + if (!con.insertPublicKeyEntry(domainName, serviceName, publicKey)) { + return false; + } + } + auditLogPublicKeyEntries(auditDetails, "added-publickeys", publicKeys); + } + + } else { + + // first we need to retrieve the current set of public keys + + List curPublicKeys = originalService.getPublicKeys(); + Map curPublicKeysMap = new HashMap<>(); + if (curPublicKeys != null) { + for (PublicKeyEntry publicKey : curPublicKeys) { + curPublicKeysMap.put(publicKey.getId(), publicKey); + } + } + Map publicKeysMap = new HashMap<>(); + if (publicKeys != null) { + for (PublicKeyEntry publicKey : publicKeys) { + publicKeysMap.put(publicKey.getId(), publicKey); + } + } + Set curPublicKeysSet = new HashSet<>(curPublicKeysMap.keySet()); + Set delPublicKeysSet = new HashSet<>(curPublicKeysSet); + Set newPublicKeysSet = new HashSet<>(publicKeysMap.keySet()); + newPublicKeysSet.removeAll(curPublicKeysSet); + delPublicKeysSet.removeAll(new HashSet<>(publicKeysMap.keySet())); + + for (String publicKey : delPublicKeysSet) { + if (!con.deletePublicKeyEntry(domainName, serviceName, publicKey)) { + return false; + } + } + auditLogPublicKeyEntries(auditDetails, "deleted-publickeys", delPublicKeysSet); + + for (String publicKey : newPublicKeysSet) { + if (!con.insertPublicKeyEntry(domainName, serviceName, publicKeysMap.get(publicKey))) { + return false; + } + } + auditLogPublicKeyEntries(auditDetails, "added-publickeys", newPublicKeysSet, publicKeysMap); + } + + // now we need to process the hosts defined for this service + + Set curHosts = null; + if (originalService != null && originalService.getHosts() != null) { + curHosts = new HashSet<>(originalService.getHosts()); + } else { + curHosts = new HashSet<>(); + } + + Set newHosts = null; + if (service.getHosts() != null) { + newHosts = new HashSet<>(service.getHosts()); + } else { + newHosts = new HashSet<>(); + } + + Set delHosts = new HashSet<>(curHosts); + delHosts.removeAll(newHosts); + newHosts.removeAll(curHosts); + + for (String host : delHosts) { + if (!con.deleteServiceHost(domainName, serviceName, host)) { + return false; + } + } + auditLogStrings(auditDetails, "deleted-hosts", delHosts); + + for (String host : newHosts) { + if (!con.insertServiceHost(domainName, serviceName, host)) { + return false; + } + } + auditLogStrings(auditDetails, "added-hosts", newHosts); + + auditDetails.append('}'); + return true; + } + + boolean shouldRetryOperation(ResourceException ex, int retryCount) { + + // before doing anything else let's check to see if + // we still have the option to retry the operation + + if (retryCount <= 1) { + return false; + } + + // if we got a conflict result it means we either had + // no connection or deadlock was detected and as such + // the changes were aborted + + boolean retry = false; + switch (ex.getCode()) { + + case ResourceException.CONFLICT: + + retry = true; + break; + + case ResourceException.GONE: + + // this error indicates that the server is reporting is in + // read-only mode which indicates a fail-over has taken place + // and we need to clear all connections and start new ones + + store.clearConnections(); + retry = true; + break; + } + + // if we're asked to retry then we're going to + // wait for a short period of time to allow the other + // connection to finish its work + + if (retry) { + + if (LOG.isDebugEnabled()) { + LOG.debug(": possible deadlock, retries available: " + retryCount); + } + + try { + Thread.sleep(retrySleepTime); + } catch (InterruptedException exc) { + } + } + + // return our response + + return retry; + } + + void executePutPolicy(ResourceContext ctx, String domainName, String policyName, Policy policy, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // retrieve our original policy + + Policy originalPolicy = getPolicy(con, domainName, policyName); + + // now process the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + if (!processPolicy(con, originalPolicy, domainName, policyName, policy, false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put policy: " + policy.getName(), caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + policyName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executePutRole(ResourceContext ctx, String domainName, String roleName, Role role, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // retrieve our original role + + Role originalRole = getRole(con, domainName, roleName, false, false); + + // now process the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + if (!processRole(con, originalRole, domainName, roleName, role, + getPrincipalYrn(ctx), auditRef, false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put role: " + role.getName(), caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + roleName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executePutServiceIdentity(ResourceContext ctx, String domainName, String serviceName, + ServiceIdentity service, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // retrieve our original service identity object + + ServiceIdentity originalService = getServiceIdentity(con, domainName, serviceName); + + // now process the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + if (!processServiceIdentity(con, originalService, domainName, serviceName, service, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put service: " + service.getName(), caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + serviceName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executePutPublicKeyEntry(ResourceContext ctx, String domainName, String serviceName, + PublicKeyEntry keyEntry, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // check to see if this key already exists or not + + PublicKeyEntry originalKeyEntry = con.getPublicKeyEntry(domainName, serviceName, keyEntry.getId()); + + // now process the request + + boolean requestSuccess = false; + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + + if (originalKeyEntry == null) { + requestSuccess = con.insertPublicKeyEntry(domainName, serviceName, keyEntry); + auditDetails.append("{added-publicKeys: ["); + } else { + requestSuccess = con.updatePublicKeyEntry(domainName, serviceName, keyEntry); + auditDetails.append("{updated-publicKeys: ["); + } + + if (!requestSuccess) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put public key: " + keyEntry.getId() + + " in service " + ZMSUtils.serviceResourceName(domainName, serviceName), caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogPublicKeyEntry(auditDetails, keyEntry, true); + auditDetails.append("]}"); + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + serviceName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeletePublicKeyEntry(ResourceContext ctx, String domainName, String serviceName, + String keyId, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // verify that we don't want to delete the last public key + + List publicKeys = con.listPublicKeys(domainName, serviceName); + if (publicKeys.size() == 1 && publicKeys.get(0).getId().equals(keyId)) { + throw ZMSUtils.requestError("cannot remove last public key from service", caller); + } + + // now process the request + + if (!con.deletePublicKeyEntry(domainName, serviceName, keyId)) { + con.rollbackChanges(); + throw ZMSUtils.notFoundError("unable to delete public key: " + keyId + + " in service " + ZMSUtils.serviceResourceName(domainName, serviceName), caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{deleted-publicKeys: [{id: \"").append(keyId).append("\"}]}"); + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + serviceName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + boolean isTrustRole(Role role) { + + if (role == null) { + return false; + } + + if (role.getTrust() == null || role.getTrust().isEmpty()) { + return false; + } + + return true; + } + + void executePutMembership(ResourceContext ctx, String domainName, String roleName, + String normalizedMember, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(true)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // before inserting a member we need to verify that + // this is a group role and not a delegated one. + + if (isTrustRole(con.getRole(domainName, roleName))) { + con.rollbackChanges(); + throw ZMSUtils.requestError(caller + ": " + roleName + + "is a delegated role", caller); + } + + // process our insert role member support. since this is a "single" + // operation, we are not using any transactions. + + if (!con.insertRoleMember(domainName, roleName, normalizedMember, + getPrincipalYrn(ctx), auditRef)) { + con.rollbackChanges(); + throw ZMSUtils.requestError(caller + ": unable to insert role member: " + + normalizedMember + " to role: " + roleName, caller); + } + + // update our role and domain time-stamps, and invalidate local cache entry + + con.updateRoleModTimestamp(domainName, roleName); + con.updateDomainModTimestamp(domainName); + cacheStore.invalidate(domainName); + + // audit log the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{member: \"").append(normalizedMember).append("\"}"); + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + roleName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + + // otherwise check if we need to retry or return failure + + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executePutEntity(ResourceContext ctx, String domainName, String entityName, Entity entity, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // check to see if this key already exists or not + + Entity originalEntity = con.getEntity(domainName, entityName); + + // now process the request + + boolean requestSuccess = false; + if (originalEntity == null) { + requestSuccess = con.insertEntity(domainName, entity); + } else { + requestSuccess = con.updateEntity(domainName, entity); + } + + if (!requestSuccess) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put entity: " + entity.getName(), caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + entity.getName(), JSON.string(entity.getValue())); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeleteMembership(ResourceContext ctx, String domainName, String roleName, + String normalizedMember, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(true)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // if this is the admin role then we need to make sure + // the admin is not himself who happens to be the last + // member in the role + + if (ZMSConsts.ADMIN_ROLE_NAME.equals(roleName)) { + List members = con.listRoleMembers(domainName, roleName); + if (members.size() == 1 && members.get(0).equals(normalizedMember)) { + throw ZMSUtils.forbiddenError(caller + ": Cannot delete last member of 'admin' role", caller); + } + } + + // process our delete role member operation + + if (!con.deleteRoleMember(domainName, roleName, normalizedMember, + getPrincipalYrn(ctx), auditRef)) { + con.rollbackChanges(); + throw ZMSUtils.notFoundError(caller + ": unable to delete role member: " + + normalizedMember + " from role: " + roleName, caller); + } + + // update our role and domain time-stamps, and invalidate local cache entry + + con.updateRoleModTimestamp(domainName, roleName); + con.updateDomainModTimestamp(domainName); + cacheStore.invalidate(domainName); + + // audit log the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{member: \"").append(normalizedMember).append("\"}"); + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + roleName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeleteServiceIdentity(ResourceContext ctx, String domainName, String serviceName, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // process our delete service request + + if (!con.deleteServiceIdentity(domainName, serviceName)) { + con.rollbackChanges(); + throw ZMSUtils.notFoundError(caller + ": unable to delete service: " + serviceName, caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + serviceName, null); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeleteEntity(ResourceContext ctx, String domainName, String entityName, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // process our delete role request + + if (!con.deleteEntity(domainName, entityName)) { + con.rollbackChanges(); + throw ZMSUtils.notFoundError(caller + ": unable to delete entity: " + entityName, caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + entityName, null); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeleteRole(ResourceContext ctx, String domainName, String roleName, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // process our delete role request + + if (!con.deleteRole(domainName, roleName)) { + con.rollbackChanges(); + throw ZMSUtils.notFoundError(caller + ": unable to delete role: " + roleName, caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + roleName, null); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeletePolicy(ResourceContext ctx, String domainName, String policyName, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // process our delete policy request + + if (!con.deletePolicy(domainName, policyName)) { + con.rollbackChanges(); + throw ZMSUtils.notFoundError(caller + ": unable to delete policy: " + policyName, caller); + } + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + policyName, null); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + /** + * If the domain has audit enabled, and user did not provide the auditRef, + * an exception will be thrown. This is the first check before any write + * operation is carried out so we don't really have anything to roll-back + **/ + Domain checkDomainAuditEnabled(ObjectStoreConnection con, String domainName, String auditRef, String caller) { + + Domain domain = con.getDomain(domainName); + if (domain == null) { + con.rollbackChanges(); + throw ZMSUtils.notFoundError(caller + ": Unknown domain: " + domainName, caller); + } + + if (domain.getAuditEnabled() && (auditRef == null || auditRef.length() == 0)) { + con.rollbackChanges(); + throw ZMSUtils.requestError(caller + ": Audit reference required for domain: " + domainName, caller); + } + + return domain; + } + + Domain executeDeleteDomain(ResourceContext ctx, String domainName, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + Domain domain = checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // now process the request + + con.deleteDomain(domainName); + con.commitChanges(); + cacheStore.invalidate(domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + domainName, null); + + return domain; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + + return null; + } + + ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return getServiceIdentity(con, domainName, serviceName); + } + } + + DomainTemplateList listDomainTemplates(String domainName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + DomainTemplateList domainTemplateList = new DomainTemplateList(); + domainTemplateList.setTemplateNames(con.listDomainTemplates(domainName)); + return domainTemplateList; + } + } + + ServiceIdentity getServiceIdentity(ObjectStoreConnection con, String domainName, String serviceName) { + + ServiceIdentity service = con.getServiceIdentity(domainName, serviceName); + if (service != null) { + service.setPublicKeys(con.listPublicKeys(domainName, serviceName)); + List hosts = con.listServiceHosts(domainName, serviceName); + if (hosts != null && !hosts.isEmpty()) { + service.setHosts(hosts); + } + } + return service; + } + + PublicKeyEntry getServicePublicKeyEntry(String domainName, String serviceName, String keyId) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.getPublicKeyEntry(domainName, serviceName, keyId); + } + } + + public ResourceAccessList getResourceAccessList(String principal, String action) { + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.listResourceAccess(principal, action, userDomain); + } + } + + Domain getDomain(String domainName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.getDomain(domainName); + } + } + + List listDomains(String prefix, long modifiedSince) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.listDomains(prefix, modifiedSince); + } + } + + DomainList lookupDomainById(String account, int productId) { + + DomainList domList = new DomainList(); + try (ObjectStoreConnection con = store.getConnection(true)) { + String domain = con.lookupDomainById(account, productId); + if (domain != null) { + List list = Arrays.asList(domain); + domList.setNames(list); + } + } + return domList; + } + + DomainList lookupDomainByAccount(String account) { + return lookupDomainById(account, 0); + } + + DomainList lookupDomainByProductId(Integer productId) { + return lookupDomainById(null, productId); + } + + DomainList lookupDomainByRole(String roleMember, String roleName) { + + DomainList domList = new DomainList(); + try (ObjectStoreConnection con = store.getConnection(true)) { + List domains = con.lookupDomainByRole(roleMember, roleName); + if (domains != null) { + domList.setNames(domains); + } + } + return domList; + } + + List listRoles(String domainName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.listRoles(domainName); + } + } + + Membership getMembership(String domainName, String roleName, String principal) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.getRoleMember(domainName, roleName, principal); + } + } + + Role getRole(String domainName, String roleName, Boolean auditLog, Boolean expand) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return getRole(con, domainName, roleName, auditLog, expand); + } + } + + Role getRole(ObjectStoreConnection con, String domainName, String roleName, + Boolean auditLog, Boolean expand) { + + Role role = con.getRole(domainName, roleName); + if (role != null) { + + if (role.getTrust() == null) { + + // if we have no trust field specified then we need to + // retrieve our standard group role members + + role.setMembers(con.listRoleMembers(domainName, roleName)); + if (auditLog != null && auditLog.booleanValue()) { + role.setAuditLog(con.listRoleAuditLogs(domainName, roleName)); + } + + } else if (expand != null && expand.booleanValue()) { + + // otherwise, if asked, let's expand the delegated + // membership and return the list of members + + role.setMembers(getDelegatedRoleMembers(domainName, role.getTrust(), roleName)); + } + } + return role; + } + + List getDelegatedRoleMembers(String domainName, String trustDomain, String roleName) { + + // verify that the domain and trust domain are not the same + + if (domainName.equals(trustDomain)) { + return null; + } + + // retrieve our trust domain + + AthenzDomain domain = null; + try { + domain = getAthenzDomain(trustDomain); + } catch (ResourceException ex) { + } + + if (domain == null) { + return null; + } + + // we need to use a set since we might be matching + // multiple assertions and we want to automatically + // skip any duplicate members + + Set roleMembers = new HashSet<>(); + + // generate our full role name + + String fullRoleName = ZMSUtils.roleResourceName(domainName, roleName); + + // iterate through all policies to see which one has the + // assume_role assertion for the given role + + for (Policy policy : domain.getPolicies()) { + + List assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + + for (Assertion assertion : assertions) { + + if (!ZMSUtils.assumeRoleResourceMatch(fullRoleName, assertion)) { + continue; + } + + String rolePattern = StringUtils.patternFromGlob(assertion.getRole()); + for (Role role : domain.getRoles()) { + + // make sure we have members before trying to match the name + + List members = role.getMembers(); + if (members == null || members.isEmpty()) { + continue; + } + + if (!role.getName().matches(rolePattern)) { + continue; + } + + roleMembers.addAll(role.getMembers()); + } + } + } + + return new ArrayList(roleMembers); + } + + Policy getPolicy(String domainName, String policyName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return getPolicy(con, domainName, policyName); + } + } + + Assertion getAssertion(String domainName, String policyName, Long assertionId) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.getAssertion(domainName, policyName, assertionId); + } + } + + public void executePutAssertion(ResourceContext ctx, String domainName, String policyName, + Assertion assertion, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(true)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // process our insert assertion. since this is a "single" + // operation, we are not using any transactions. + + if (!con.insertAssertion(domainName, policyName, assertion)) { + throw ZMSUtils.requestError(caller + ": unable to insert assertion: " + + " to policy: " + policyName, caller); + } + + // update our policy and domain time-stamps, and invalidate local cache entry + + con.updatePolicyModTimestamp(domainName, policyName); + con.updateDomainModTimestamp(domainName); + cacheStore.invalidate(domainName); + + // audit log the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditLogAssertion(auditDetails, assertion, true); + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + policyName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + + // otherwise check if we need to retry or return failure + + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + public void executeDeleteAssertion(ResourceContext ctx, String domainName, String policyName, + Long assertionId, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(true)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // process our delete assertion. since this is a "single" + // operation, we are not using any transactions. + + if (!con.deleteAssertion(domainName, policyName, assertionId)) { + throw ZMSUtils.requestError(caller + ": unable to delete assertion: " + + assertionId + " from policy: " + policyName, caller); + } + + // update our policy and domain time-stamps, and invalidate local cache entry + + con.updatePolicyModTimestamp(domainName, policyName); + con.updateDomainModTimestamp(domainName); + cacheStore.invalidate(domainName); + + // audit log the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("assertionId=(").append(assertionId).append(')'); + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + policyName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + + // otherwise check if we need to retry or return failure + + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + List listEntities(String domainName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.listEntities(domainName); + } + } + + Entity getEntity(String domainName, String entityName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.getEntity(domainName, entityName); + } + } + + Policy getPolicy(ObjectStoreConnection con, String domainName, String policyName) { + + Policy policy = con.getPolicy(domainName, policyName); + if (policy != null) { + policy.setAssertions(con.listAssertions(domainName, policyName)); + } + return policy; + } + + List listPolicies(String domainName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.listPolicies(domainName, null); + } + } + + List listServiceIdentities(String domainName) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.listServiceIdentities(domainName); + } + } + + void executePutDomainMeta(ResourceContext ctx, String domainName, DomainMeta meta, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + Domain domain = null; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + domain = checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // now process the request + + Domain updatedDomain = new Domain() + .setName(domain.getName()) + .setEnabled(domain.getEnabled()) + .setId(domain.getId()) + .setAuditEnabled(meta.getAuditEnabled()) + .setDescription(meta.getDescription()) + .setOrg(meta.getOrg()); + + // we'll only update aws/product ids if the meta + // object does not contain nulls + + if (meta.getAccount() == null && meta.getYpmId() == null) { + updatedDomain.setAccount(domain.getAccount()); + updatedDomain.setYpmId(domain.getYpmId()); + } else { + updatedDomain.setYpmId(meta.getYpmId()); + updatedDomain.setAccount(meta.getAccount()); + } + + con.updateDomain(updatedDomain); + con.commitChanges(); + cacheStore.invalidate(domainName); + + // audit log the request + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditLogDomain(auditDetails, updatedDomain); + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + domainName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executePutDomainTemplate(ResourceContext ctx, String domainName, List templateNames, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // go through our list of templates and add the specified + // roles and polices to our domain + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{add-templates: "); + boolean firstEntry = true; + + for (String templateName : templateNames) { + Template template = ZMSImpl.serverSolutionTemplates.get(templateName); + firstEntry = auditLogSeparator(auditDetails, firstEntry); + if (!applySolutionTemplate(con, domainName, templateName, template, true, + getPrincipalYrn(ctx), auditRef, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put domain templates: " + domainName, caller); + } + } + auditDetails.append("}"); + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_PUT, + domainName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeleteDomainTemplate(ResourceContext ctx, String domainName, String templateName, + String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, domainName, auditRef, caller); + + // go through our list of templates and add the specified + // roles and polices to our domain + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{templates: "); + + Template template = ZMSImpl.serverSolutionTemplates.get(templateName); + if (!applySolutionTemplate(con, domainName, templateName, template, false, + getPrincipalYrn(ctx), auditRef, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to delete domain template: " + domainName, caller); + } + + auditDetails.append("}"); + + // update our domain time-stamp and save changes + + saveChanges(con, domainName); + + // audit log the request + + auditLogRequest(ctx, domainName, auditRef, caller, ZMSConsts.HTTP_DELETE, + domainName, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + boolean applySolutionTemplate(ObjectStoreConnection con, String domainName, String templateName, + Template template, boolean addTemplate, String admin, String auditRef, StringBuilder auditDetails) { + + auditDetails.append("{name: \"").append(templateName).append('\"'); + + // we have already verified that our template is valid but + // we'll just double check to make sure it's not null + + if (template == null) { + auditDetails.append("}"); + return true; + } + + boolean firstEntry = true; + + // iterate through roles in the list. + // When adding a template, if the role does not exist in our domain + // then insert it otherwise only apply the changes to the member list. + // otherwise for delete request, we just the delete role + + List templateRoles = template.getRoles(); + if (templateRoles != null) { + for (Role role : templateRoles) { + String roleName = ZMSUtils.removeDomainPrefix(role.getName(), + TEMPLATE_DOMAIN_NAME, ROLE_PREFIX); + + if (!addTemplate) { + con.deleteRole(domainName, roleName); + firstEntry = auditLogSeparator(auditDetails, firstEntry); + auditDetails.append(" delete-role: \"").append(roleName).append('\"'); + continue; + } + + // retrieve our original role + + Role originalRole = getRole(con, domainName, roleName, false, false); + + // now process the request + + Role templateRole = updateTemplateRole(role, domainName, roleName); + firstEntry = auditLogSeparator(auditDetails, firstEntry); + auditDetails.append(" add-role: "); + if (!processRole(con, originalRole, domainName, roleName, templateRole, + admin, auditRef, true, auditDetails)) { + return false; + } + } + } + + // iterate through policies in the list. + // When adding a template, if the policy does not exist in our domain + // then insert it otherwise only apply the changes to the assertions + // otherwise for delete requests, we just delete the policy + + List templatePolicies = template.getPolicies(); + if (templatePolicies != null) { + for (Policy policy : templatePolicies) { + String policyName = ZMSUtils.removeDomainPrefix(policy.getName(), + TEMPLATE_DOMAIN_NAME, POLICY_PREFIX); + + if (!addTemplate) { + con.deletePolicy(domainName, policyName); + firstEntry = auditLogSeparator(auditDetails, firstEntry); + auditDetails.append(" delete-policy: \"").append(policyName).append('\"'); + continue; + } + + // retrieve our original policy + + Policy originalPolicy = getPolicy(con, domainName, policyName); + + // now process the request + + Policy templatePolicy = updateTemplatePolicy(policy, domainName, policyName); + firstEntry = auditLogSeparator(auditDetails, firstEntry); + auditDetails.append(" add-policy: "); + if (!processPolicy(con, originalPolicy, domainName, policyName, templatePolicy, + true, auditDetails)) { + return false; + } + } + } + + // if deleting a template, delete it from the current list + // if adding a template, only add if it is not in our current list + + if (!addTemplate) { + con.deleteDomainTemplate(domainName, templateName, null); + } else { + // check to see if the template is already listed for the domain + + List currentTemplateList = con.listDomainTemplates(domainName); + if (!currentTemplateList.contains(templateName)) { + con.insertDomainTemplate(domainName, templateName, null); + } + } + + auditDetails.append("}"); + return true; + } + + Role updateTemplateRole(Role role, String domainName, String roleName) { + + Role templateRole = new Role() + .setName(ZMSUtils.roleResourceName(domainName, roleName)) + .setTrust(role.getTrust()); + List roleMembers = role.getMembers(); + List newMembers = new ArrayList<>(); + if (roleMembers != null && !roleMembers.isEmpty()) { + newMembers.addAll(roleMembers); + } + templateRole.setMembers(newMembers); + return templateRole; + } + + Policy updateTemplatePolicy(Policy policy, String domainName, String policyName) { + + Policy templatePolicy = new Policy().setName(ZMSUtils.policyResourceName(domainName, policyName)); + List assertions = policy.getAssertions(); + List newAssertions = new ArrayList<>(); + if (assertions != null && !assertions.isEmpty()) { + for (Assertion assertion : assertions) { + Assertion newAssertion = new Assertion(); + newAssertion.setAction(assertion.getAction()); + newAssertion.setEffect(assertion.getEffect()); + newAssertion.setResource(assertion.getResource().replace(TEMPLATE_DOMAIN_NAME, domainName)); + newAssertion.setRole(assertion.getRole().replace(TEMPLATE_DOMAIN_NAME, domainName)); + newAssertions.add(newAssertion); + } + } + templatePolicy.setAssertions(newAssertions); + return templatePolicy; + } + + void setupTenantAdminPolicy(ResourceContext ctx, String tenantDomain, String provSvcDomain, + String provSvcName, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, tenantDomain, auditRef, caller); + + String domainAdminRole = ZMSUtils.roleResourceName(tenantDomain, ZMSConsts.ADMIN_ROLE_NAME); + String serviceRoleYRN = ZMSUtils.getTrustedResourceGroupRolePrefix(provSvcDomain, provSvcName, + tenantDomain, null) + ZMSConsts.ADMIN_ROLE_NAME; + + // our tenant admin role/policy name + + StringBuilder tenancyResourceBuilder = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + tenancyResourceBuilder.append("tenancy.").append(provSvcDomain).append('.').append(provSvcName); + String tenancyResource = tenancyResourceBuilder.toString(); + + String adminName = tenancyResource + ".admin"; + String tenantAdminRole = ZMSUtils.roleResourceName(tenantDomain, adminName); + + // tenant admin role - if it already exists then we skip it + // by default it has no members. + + if (con.getRole(tenantDomain, adminName) == null) { + con.insertRole(tenantDomain, new Role().setName(tenantAdminRole)); + } + + // tenant admin policy - check to see if this already exists. If it does + // then we don't have anything to do + + if (con.getPolicy(tenantDomain, adminName) == null) { + + Policy adminPolicy = new Policy().setName(ZMSUtils.policyResourceName(tenantDomain, adminName)); + con.insertPolicy(tenantDomain, adminPolicy); + + // we are going to create 2 assertions - one for the domain admin role + // and another for the tenant admin role + + Assertion assertion = new Assertion().setRole(domainAdminRole) + .setResource(serviceRoleYRN).setAction(ZMSConsts.ACTION_ASSUME_ROLE) + .setEffect(AssertionEffect.ALLOW); + con.insertAssertion(tenantDomain, adminName, assertion); + + assertion = new Assertion().setRole(tenantAdminRole) + .setResource(serviceRoleYRN).setAction(ZMSConsts.ACTION_ASSUME_ROLE) + .setEffect(AssertionEffect.ALLOW); + con.insertAssertion(tenantDomain, adminName, assertion); + + // the tenant admin role must have the capability to provision + // new resource groups in the domain which requires update + // action capability on resource tenancy.. + + String tenantResourceYRN = tenantDomain + ":" + tenancyResource; + assertion = new Assertion().setRole(tenantAdminRole) + .setResource(tenantResourceYRN).setAction(ZMSConsts.ACTION_UPDATE) + .setEffect(AssertionEffect.ALLOW); + con.insertAssertion(tenantDomain, adminName, assertion); + } + + // update our domain time-stamp and save changes + + saveChanges(con, tenantDomain); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executePutTenantRoles(ResourceContext ctx, String provSvcDomain, String provSvcName, String tenantDomain, + String resourceGroup, List roles, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, provSvcDomain, auditRef, caller); + + String trustedRolePrefix = ZMSUtils.getTrustedResourceGroupRolePrefix(provSvcDomain, + provSvcName, tenantDomain, resourceGroup); + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{put-tenant-roles: ["); + boolean firstEntry = true; + + for (TenantRoleAction ra : roles) { + + String tenantRole = ra.getRole(); + String tenantAction = ra.getAction(); + String trustedRole = trustedRolePrefix + tenantRole; + String trustedName = trustedRole.substring((provSvcDomain + ":role.").length()); + + Role role = new Role().setName(trustedRole).setTrust(tenantDomain); + + if (LOG.isInfoEnabled()) { + LOG.info(caller + ": add trusted Role to domain " + provSvcDomain + + ": " + trustedRole + " -> " + role); + } + + // retrieve our original role in case one exists + + Role originalRole = getRole(con, provSvcDomain, trustedRole, false, false); + + // now process the request + + firstEntry = auditLogSeparator(auditDetails, firstEntry); + + auditDetails.append("{role: "); + if (!processRole(con, originalRole, provSvcDomain, trustedName, role, + getPrincipalYrn(ctx), auditRef, false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put role: " + trustedRole, caller); + } + + String policyYRN = ZMSUtils.policyResourceName(provSvcDomain, trustedName); + StringBuilder resourceYRN = new StringBuilder(256); + resourceYRN.append(provSvcDomain).append(":service.") + .append(ZMSUtils.getTenantResourceGroupRolePrefix(provSvcName, tenantDomain, resourceGroup)) + .append('*'); + List assertions = Arrays.asList( + new Assertion().setRole(trustedRole) + .setResource(resourceYRN.toString()) + .setAction(tenantAction)); + + Policy policy = new Policy().setName(policyYRN).setAssertions(assertions); + + if (LOG.isInfoEnabled()) { + LOG.info(caller + ": add trust policy to domain " + provSvcDomain + + ": " + trustedRole + " -> " + policy); + } + + // retrieve our original policy + + Policy originalPolicy = getPolicy(con, provSvcDomain, policyYRN); + + // now process the request + + auditDetails.append(", policy: "); + if (!processPolicy(con, originalPolicy, provSvcDomain, trustedName, policy, false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put policy: " + policy.getName(), caller); + } + auditDetails.append('}'); + } + + // update our domain time-stamp and save changes + + saveChanges(con, provSvcDomain); + + // audit log the request + + auditLogRequest(ctx, provSvcDomain, auditRef, caller, ZMSConsts.HTTP_PUT, + tenantDomain, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void addAssumeRolePolicy(ObjectStoreConnection con, String rolePrefix, String trustedRolePrefix, String role, + List roleMembers, String tenantDomain, String admin, String auditRef, + StringBuilder auditDetails, String caller) { + + // first create the role in the domain. We're going to create it + // only if the role does not already exist + + String roleName = rolePrefix + role; + String roleYRN = ZMSUtils.roleResourceName(tenantDomain, roleName); + + // retrieve our original role in case one exists + + Role originalRole = getRole(con, tenantDomain, roleName, false, false); + + // we need to add the original role members to the new one + + if (originalRole != null && originalRole.getMembers() != null) { + roleMembers.addAll(originalRole.getMembers()); + } + + // now process the request + + Role roleObj = new Role().setName(roleYRN).setMembers(roleMembers); + auditDetails.append("{role: "); + if (!processRole(con, originalRole, tenantDomain, roleName, roleObj, + admin, auditRef, false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put role: " + roleName, caller); + } + + // now create the corresponding policy. We're going to create it + // only if the policy does not exist otherwise we'll just + // add a new assertion + + String policyName = "tenancy." + roleName; + String policyYRN = ZMSUtils.policyResourceName(tenantDomain, policyName); + String serviceRoleYRN = trustedRolePrefix + role; + Assertion assertion = new Assertion().setRole(roleYRN) + .setResource(serviceRoleYRN).setAction(ZMSConsts.ACTION_ASSUME_ROLE) + .setEffect(AssertionEffect.ALLOW); + + if (LOG.isInfoEnabled()) { + LOG.info("executePutProviderRoles: ---- ASSUME_ROLE policyName is " + policyName); + } + + // retrieve our original policy + + Policy originalPolicy = getPolicy(con, tenantDomain, policyName); + + // we need to add the original policy assertions to the new one + + List newAssertions = new ArrayList<>(); + newAssertions.add(assertion); + if (originalPolicy != null && originalPolicy.getAssertions() != null) { + newAssertions.addAll(originalPolicy.getAssertions()); + } + + // now process the request + + Policy assumeRolePolicy = new Policy().setName(policyYRN).setAssertions(newAssertions); + + auditDetails.append(", policy: "); + if (!processPolicy(con, originalPolicy, tenantDomain, policyName, assumeRolePolicy, + false, auditDetails)) { + con.rollbackChanges(); + throw ZMSUtils.internalServerError("unable to put policy: " + + assumeRolePolicy.getName(), caller); + } + auditDetails.append('}'); + } + + void executePutProviderRoles(ResourceContext ctx, String tenantDomain, String provSvcDomain, + String provSvcName, String resourceGroup, List roles, String auditRef, String caller) { + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, tenantDomain, auditRef, caller); + + // we're going to create a separate role for each one of tenant roles returned + // based on its action and set the caller as a member in each role + + String principalYrn = getPrincipalYrn(ctx); + List roleMembers = new ArrayList<>(); + if (principalYrn != null) { + roleMembers.add(principalYrn); + } + + // now set up the roles and policies for all the provider roles returned. + + String rolePrefix = ZMSUtils.getProviderResourceGroupRolePrefix(provSvcDomain, provSvcName, + resourceGroup); + String trustedRolePrefix = ZMSUtils.getTrustedResourceGroupRolePrefix(provSvcDomain, + provSvcName, tenantDomain, resourceGroup); + + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{put-provider-roles: ["); + boolean firstEntry = true; + + for (String role : roles) { + + role = role.toLowerCase(); + + if (LOG.isInfoEnabled()) { + LOG.info("executePutProviderRoles: provision ASSUME_ROLE policy for access remote role in " + + provSvcDomain + "." + provSvcName + ": " + resourceGroup + "." + role); + } + + firstEntry = auditLogSeparator(auditDetails, firstEntry); + + addAssumeRolePolicy(con, rolePrefix, trustedRolePrefix, role, roleMembers, + tenantDomain, principalYrn, auditRef, auditDetails, caller); + } + + auditDetails.append("]}"); + + // update our domain time-stamp and save changes + + saveChanges(con, tenantDomain); + + // audit log the request + + auditLogRequest(ctx, tenantDomain, auditRef, caller, ZMSConsts.HTTP_PUT, + provSvcDomain, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeleteTenancy(ResourceContext ctx, String tenantDomain, String provSvcDomain, + String provSvcName, String resourceGroup, String auditRef, String caller) { + + // create list of policies and delete them from the tenant domain + // have to get all policies that match "tenant..*" + // ex: tenancy.weather.storage.admin + + String rnamePrefix = ZMSUtils.getProviderResourceGroupRolePrefix(provSvcDomain, provSvcName, + resourceGroup); + + StringBuilder pnamePrefixBuilder = new StringBuilder(256); + pnamePrefixBuilder.append("tenancy.").append(rnamePrefix); + String pnamePrefix = pnamePrefixBuilder.toString(); + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, tenantDomain, auditRef, caller); + + // first let's process and remove any policies that start with our + // provider prefix + + List pnames = con.listPolicies(tenantDomain, null); + for (String pname : pnames) { + if (!pname.startsWith(pnamePrefix)) { + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": --ignore policy " + pname); + } + continue; + } + + if (LOG.isInfoEnabled()) { + LOG.info(caller + ": --delete policy " + pname); + } + + con.deletePolicy(tenantDomain, pname); + } + + // now we're going to find any roles that have the provider prefix as + // well but we're going to be careful about removing them. We'll check + // and if we have no more policies referencing them then we'll remove + + List rnames = con.listRoles(tenantDomain); + for (String rname : rnames) { + if (!rname.startsWith(rnamePrefix)) { + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": --ignore role " + rname); + } + continue; + } + + if (!con.listPolicies(tenantDomain, rname).isEmpty()) { + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": --ignore role " + rname + " due to active references"); + } + continue; + } + + if (LOG.isInfoEnabled()) { + LOG.info(caller + ": --delete role " + rname); + } + + con.deleteRole(tenantDomain, rname); + } + + // update our domain time-stamp and save changes + + saveChanges(con, tenantDomain); + + // audit log the request + + auditLogRequest(ctx, tenantDomain, auditRef, caller, ZMSConsts.HTTP_DELETE, + ZMSUtils.entityResourceName(provSvcDomain, provSvcName), null); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + void executeDeleteTenantRoles(ResourceContext ctx, String provSvcDomain, String provSvcName, + String tenantDomain, String resourceGroup, String auditRef, String caller) { + + // look for this tenants roles, ex: storage.tenant.sports.reader + + String rolePrefix = ZMSUtils.getTenantResourceGroupRolePrefix(provSvcName, tenantDomain, resourceGroup); + + int retryCount = defaultRetryCount; + do { + try (ObjectStoreConnection con = store.getConnection(false)) { + + // first verify that auditing requirements are met + + checkDomainAuditEnabled(con, provSvcDomain, auditRef, caller); + + // find roles and policies matching the prefix + + List rnames = con.listRoles(provSvcDomain); + StringBuilder auditDetails = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + auditDetails.append("{tenant-roles: ["); + boolean firstEntry = true; + for (String rname: rnames) { + if (isTrustRoleForTenant(con, provSvcDomain, rname, rolePrefix, tenantDomain)) { + + // good, its exactly what we are looking for + + con.deleteRole(provSvcDomain, rname); + con.deletePolicy(provSvcDomain, rname); + firstEntry = auditLogString(auditDetails, rname, firstEntry); + } + } + auditDetails.append("]}"); + + // update our domain time-stamp and save changes + + saveChanges(con, provSvcDomain); + + // audit log the request + + auditLogRequest(ctx, tenantDomain, auditRef, caller, ZMSConsts.HTTP_DELETE, + provSvcDomain, auditDetails.toString()); + + return; + + } catch (ResourceException ex) { + if (!shouldRetryOperation(ex, retryCount)) { + throw ex; + } + } + retryCount -= 1; + } while (retryCount > 0); + } + + boolean isTrustRoleForTenant(ObjectStoreConnection con, String provSvcDomain, String roleName, + String rolePrefix, String tenantDomain) { + + // first make sure the role name starts with the given prefix + + if (!isTenantRolePrefixMatch(con, roleName, rolePrefix, tenantDomain)) { + return false; + } + + Role role = con.getRole(provSvcDomain, roleName); + if (role == null) { + return false; + } + + // ensure it is a trust role for the tenant + + String trustDom = role.getTrust(); + if (trustDom != null && trustDom.equals(tenantDomain)) { + return true; + } + + return false; + } + + boolean isTrustRoleForTenant(String provSvcDomain, String roleName, String rolePrefix, + String tenantDomain) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return isTrustRoleForTenant(con, provSvcDomain, roleName, rolePrefix, tenantDomain); + } + } + + boolean isTenantRolePrefixMatch(String roleName, String rolePrefix, String tenantDomain) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return isTenantRolePrefixMatch(con, roleName, rolePrefix, tenantDomain); + } + } + + boolean isTenantRolePrefixMatch(ObjectStoreConnection con, String roleName, String rolePrefix, String tenantDomain) { + + if (LOG.isDebugEnabled()) { + LOG.debug("isTenantRolePrefixMatch: role-name=" + roleName + ", role-prefix=" + + rolePrefix + ", tenant-domain=" + tenantDomain); + } + + // first make sure the role name starts with the given prefix + + if (!roleName.startsWith(rolePrefix)) { + return false; + } + + // also make sure that the last part after the prefix + // does not include other components which could + // indicate support for subdomains and resource groups + // this check is only done if we have no tenantDomain + // specified since that indicates we're processing a resource + // group operation + + if (tenantDomain == null) { + if (roleName.indexOf('.', rolePrefix.length()) != -1) { + return false; + } + } else { + + // otherwise we're going to split the remaining value + // into components. If we have 2 components then we'll + // check if we have a domain for the first component + // if we don't then it's a resource group and as such + // it can be removed otherwise, we'll leave it alone + + String[] comps = roleName.substring(rolePrefix.length()).split("\\."); + if (comps.length == 2) { + + // check to see if we have a subdomain - if we do then + // we're not going to include this role as we don't know + // for sure if this for a resource group or not + + String subDomain = tenantDomain + "." + comps[0]; + + if (LOG.isDebugEnabled()) { + LOG.debug("isTenantRolePrefixMatch: verifying tenant subdomain: " + subDomain); + } + + if (con.getDomain(subDomain) != null) { + return false; + } + } else if (comps.length > 2) { + + // if we have more than 2 subcomponents then we're + // definitely not dealing with resource groups + + return false; + } + } + + return true; + } + + AthenzDomain getAthenzDomain(String domainName) { + + // first check to see if we our data is in the cache + + AthenzDomain athenzDomain = getAthenzDomainFromCache(domainName); + if (athenzDomain != null) { + return athenzDomain; + } + + try (ObjectStoreConnection con = store.getConnection(true)) { + athenzDomain = con.getAthenzDomain(domainName); + } + + if (athenzDomain != null) { + DataCache dataCache = new DataCache(athenzDomain, athenzDomain.getDomain().getModified().millis()); + cacheStore.put(domainName, dataCache); + } + + return athenzDomain; + } + + DomainModifiedList listModifiedDomains(long modifiedSince) { + + try (ObjectStoreConnection con = store.getConnection(true)) { + return con.listModifiedDomains(modifiedSince); + } + } + + boolean auditLogSeparator(StringBuilder auditDetails, boolean firstEntry) { + if (!firstEntry) { + auditDetails.append(','); + } + // regardless of the current state, the new state is no + // longer the first entry so we return false + return false; + } + + void auditLogStrings(StringBuilder auditDetails, String label, Collection values) { + auditDetails.append(", ").append(label).append(": ["); + boolean firstEntry = true; + for (String value : values) { + firstEntry = auditLogString(auditDetails, value, firstEntry); + } + auditDetails.append(']'); + } + + boolean auditLogString(StringBuilder auditDetails, String value, boolean firstEntry) { + firstEntry = auditLogSeparator(auditDetails, firstEntry); + auditDetails.append('\"').append(value).append('\"'); + return firstEntry; + } + + void auditLogPublicKeyEntries(StringBuilder auditDetails, String label, List values) { + auditDetails.append(", ").append(label).append(": ["); + boolean firstEntry = true; + for (PublicKeyEntry value : values) { + firstEntry = auditLogPublicKeyEntry(auditDetails, value, firstEntry); + } + auditDetails.append(']'); + } + + void auditLogPublicKeyEntries(StringBuilder auditDetails, String label, Set values, + Map publicKeysMap) { + auditDetails.append(", ").append(label).append(": ["); + boolean firstEntry = true; + for (String value : values) { + firstEntry = auditLogPublicKeyEntry(auditDetails, publicKeysMap.get(value), firstEntry); + } + auditDetails.append(']'); + } + + void auditLogPublicKeyEntries(StringBuilder auditDetails, String label, Set values) { + auditDetails.append(", ").append(label).append(": ["); + boolean firstEntry = true; + for (String value : values) { + firstEntry = auditLogPublicKeyEntry(auditDetails, value, firstEntry); + } + auditDetails.append(']'); + } + + boolean auditLogPublicKeyEntry(StringBuilder auditDetails, PublicKeyEntry publicKey, boolean firstEntry) { + firstEntry = auditLogSeparator(auditDetails, firstEntry); + auditDetails.append("{key: \"").append(publicKey.getKey()) + .append("\", id: \"").append(publicKey.getId()).append("\"}"); + return firstEntry; + } + + boolean auditLogPublicKeyEntry(StringBuilder auditDetails, String publicKeyId, boolean firstEntry) { + firstEntry = auditLogSeparator(auditDetails, firstEntry); + auditDetails.append("{id: \"").append(publicKeyId).append("\"}"); + return firstEntry; + } + + void auditLogAssertions(StringBuilder auditDetails, String label, Collection values) { + auditDetails.append(", ").append(label).append(": ["); + boolean firstEntry = true; + for (Assertion value : values) { + firstEntry = auditLogAssertion(auditDetails, value, firstEntry); + } + auditDetails.append(']'); + } + + boolean auditLogAssertion(StringBuilder auditDetails, Assertion assertion, boolean firstEntry) { + firstEntry = auditLogSeparator(auditDetails, firstEntry); + String assertionEffect = "ALLOW"; + if (assertion.getEffect() != null) { + assertionEffect = assertion.getEffect().toString(); + } + auditDetails.append("{role: \"").append(assertion.getRole()) + .append("\", action: \"").append(assertion.getAction()) + .append("\", effect: \"").append(assertionEffect) + .append("\", resource: \"").append(assertion.getResource()) + .append("\"}"); + return firstEntry; + } + + void auditLogDomain(StringBuilder auditDetails, Domain domain) { + auditDetails.append("{description: \"").append(domain.getDescription()) + .append("\", org: \"").append(domain.getOrg()) + .append("\", auditEnabled: \"").append(domain.getAuditEnabled()) + .append("\", enabled: \"").append(domain.getEnabled()) + .append("\"}"); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/GetSignedDomainsResult.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/GetSignedDomainsResult.java new file mode 100644 index 00000000000..ca453e35c77 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/GetSignedDomainsResult.java @@ -0,0 +1,48 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +import com.yahoo.rdl.*; +import java.util.*; +import javax.ws.rs.core.Response; +import javax.ws.rs.WebApplicationException; + +public final class GetSignedDomainsResult { + private ResourceContext context; + private int code; //normal result + + GetSignedDomainsResult(ResourceContext context) { + this.context = context; + this.code = 0; + } + + public boolean isAsync() { + return false; + } + + public void done(int code, SignedDomains signedDomains, String tag) { + Response resp = Response.status(code).entity(signedDomains) + .header("ETag", tag) + .build(); + throw new WebApplicationException(resp); + } + + public void done(int code) { + done(code, new ResourceError().code(code).message(ResourceException.codeToString(code)), ""); + } + + public void done(int code, String tag) { + done(code, new ResourceError().code(code).message(ResourceException.codeToString(code)), tag); + } + + public void done(int code, Object entity, String tag) { + this.code = code; + //to do: check if the exception is declared, and that the entity is of the declared type + WebApplicationException err = new WebApplicationException(Response.status(code).entity(entity) + .header("ETag", tag) + .build()); + throw err; //not optimal + } + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceContext.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceContext.java new file mode 100644 index 00000000000..7842050e29f --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceContext.java @@ -0,0 +1,17 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +// +// ResourceContext +// +public interface ResourceContext { + public HttpServletRequest request(); + public HttpServletResponse response(); + public void authenticate(); + public void authorize(String action, String resource, String trustedDomain); +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceError.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceError.java new file mode 100644 index 00000000000..231c7abdf9d --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceError.java @@ -0,0 +1,24 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +public class ResourceError { + + public int code; + public String message; + + public ResourceError code(int code) { + this.code = code; + return this; + } + public ResourceError message(String message) { + this.message = message; + return this; + } + + public String toString() { + return "{code: " + code + ", message: \"" + message + "\"}"; + } + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceException.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceException.java new file mode 100644 index 00000000000..a76e476ac22 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ResourceException.java @@ -0,0 +1,79 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +public class ResourceException extends RuntimeException { + public final static int OK = 200; + public final static int CREATED = 201; + public final static int ACCEPTED = 202; + public final static int NO_CONTENT = 204; + public final static int MOVED_PERMANENTLY = 301; + public final static int FOUND = 302; + public final static int SEE_OTHER = 303; + public final static int NOT_MODIFIED = 304; + public final static int TEMPORARY_REDIRECT = 307; + public final static int BAD_REQUEST = 400; + public final static int UNAUTHORIZED = 401; + public final static int FORBIDDEN = 403; + public final static int NOT_FOUND = 404; + public final static int CONFLICT = 409; + public final static int GONE = 410; + public final static int PRECONDITION_FAILED = 412; + public final static int UNSUPPORTED_MEDIA_TYPE = 415; + public final static int INTERNAL_SERVER_ERROR = 500; + public final static int NOT_IMPLEMENTED = 501; + + public final static int SERVICE_UNAVAILABLE = 503; + + public static String codeToString(int code) { + switch (code) { + case OK: return "OK"; + case CREATED: return "Created"; + case ACCEPTED: return "Accepted"; + case NO_CONTENT: return "No Content"; + case MOVED_PERMANENTLY: return "Moved Permanently"; + case FOUND: return "Found"; + case SEE_OTHER: return "See Other"; + case NOT_MODIFIED: return "Not Modified"; + case TEMPORARY_REDIRECT: return "Temporary Redirect"; + case BAD_REQUEST: return "Bad Request"; + case UNAUTHORIZED: return "Unauthorized"; + case FORBIDDEN: return "Forbidden"; + case NOT_FOUND: return "Not Found"; + case CONFLICT: return "Conflict"; + case GONE: return "Gone"; + case PRECONDITION_FAILED: return "Precondition Failed"; + case UNSUPPORTED_MEDIA_TYPE: return "Unsupported Media Type"; + case INTERNAL_SERVER_ERROR: return "Internal Server Error"; + case NOT_IMPLEMENTED: return "Not Implemented"; + default: return "" + code; + } + } + + int code; + Object data; + + public ResourceException(int code) { + this(code, new ResourceError().code(code).message(codeToString(code))); + } + + public ResourceException(int code, Object data) { + super("ResourceException (" + code + "): " + data); + this.code = code; + this.data = data; + } + + public int getCode() { + return code; + } + + public Object getData() { + return data; + } + + public T getData(Class cl) { + return cl.cast(data); + } + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMS.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMS.java new file mode 100644 index 00000000000..54ae6b52667 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMS.java @@ -0,0 +1,241 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zms; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.eclipse.jetty.server.HttpConfiguration; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.common.metrics.MetricFactory; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.rest.Http.AuthorityList; +import com.yahoo.athenz.zms.pkey.PrivateKeyStoreFactory; + +import java.net.InetAddress; + +public class ZMS { + + private static final Logger LOG = LoggerFactory.getLogger(ZMS.class); + + private static final String ZMS_PRINCIPAL_AUTHORITY_CLASS = "com.yahoo.athenz.auth.impl.PrincipalAuthority"; + private static final String ZMS_PKEY_STORE_CLASS = "com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory"; + + // This String is used to create the desired AuditLogMsgBuilder object. + // Its OK if its null, we will just get the default msg builder. + // + private static String AUDIT_LOG_MSG_BLDR_CLASS; + static { + try { + AUDIT_LOG_MSG_BLDR_CLASS = System.getProperty(ZMSConsts.ZMS_PROP_AUDIT_LOG_MSG_BLDR_CLASS); + // test the class to ensure it is valid + try { + @SuppressWarnings("unused") + AuditLogMsgBuilder msgBldr = AuditLogFactory.getMsgBuilder(AUDIT_LOG_MSG_BLDR_CLASS); + } catch (Exception exc) { + LOG.warn("AuditLogMsgBuilder: Cannot instantiate message builder class from=" + + AUDIT_LOG_MSG_BLDR_CLASS + ", therefore will use default log message builder class instead.", exc); + AUDIT_LOG_MSG_BLDR_CLASS = null; + } + } catch (Exception exc) { + LOG.warn("Failed to get the audit log message builder class using property=" + + ZMSConsts.ZMS_PROP_AUDIT_LOG_MSG_BLDR_CLASS + + ", ZMS will use the default log message builder class instead.", exc); + AUDIT_LOG_MSG_BLDR_CLASS = null; + } + } + + private static final AuditLogger AUDITLOG = getAuditLogger(); + + // Create an AuditLogger + // + static AuditLogger getAuditLogger() { + String auditLoggerClassName = System.getProperty(ZMSConsts.ZMS_PROP_AUDIT_LOGGER_CLASS); + String auditLoggerClassNameParam = System.getProperty(ZMSConsts.ZMS_PROP_AUDIT_LOGGER_CLASS_PARAM); + AuditLogger auditLog = null; + try { + if (auditLoggerClassNameParam != null) { + auditLog = AuditLogFactory.getLogger(auditLoggerClassName, auditLoggerClassNameParam); + } else { + auditLog = AuditLogFactory.getLogger(auditLoggerClassName); + } + } catch (Exception exc) { + LOG.warn("Failed to create audit logger from class=" + + auditLoggerClassName + ", ZMS will use the default logger instead.", exc); + auditLog = AuditLogFactory.getLogger(); + } + return auditLog; + } + + static String getServerHostName() { + + String serverHostName = System.getProperty(ZMSConsts.ZMS_PROP_HOSTNAME); + if (serverHostName == null || serverHostName.isEmpty()) { + try { + InetAddress localhost = java.net.InetAddress.getLocalHost(); + serverHostName = localhost.getCanonicalHostName(); + } catch (java.net.UnknownHostException e) { + LOG.info("Unable to determine local hostname: " + e.getMessage()); + serverHostName = "localhost"; + } + } + + return serverHostName; + } + + static Authority getAuthority(String className) { + + LOG.debug("Loading authority {}...", className); + + Authority authority = null; + try { + authority = (Authority) Class.forName(className).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid Authority class: " + className + " error: " + e.getMessage()); + return null; + } + return authority; + } + + static int getPortNumber(String property, int defaultValue) { + + String propValue = System.getProperty(property); + if (propValue == null) { + return defaultValue; + } + + int port = defaultValue; + try { + + // first try to convert the string property to integer + + port = Integer.parseInt(propValue); + + // now verify that it's a valid port number + + if (port < 0 || port > 65535) { + throw new NumberFormatException(); + } + + } catch (NumberFormatException ex) { + LOG.info("invalid port: " + propValue + ". Using default port: " + defaultValue); + port = defaultValue; + } + + return port; + } + + public static ZMSJettyContainer createJettyContainer() { + + ZMSJettyContainer container = null; + + String root = System.getenv("ROOT"); + if (root == null) { + root = "/home/athenz"; + } + + String homeDir = System.getProperty(ZMSConsts.ZMS_PROP_HOME, root + "/var/zms_server"); + String jdbcStore = System.getProperty(ZMSConsts.ZMS_PROP_JDBC_STORE); + String dataStoreContext = jdbcStore == null ? homeDir : jdbcStore; + + // retrieve our http and https port numbers + + int httpPort = getPortNumber(ZMSConsts.ZMS_PROP_HTTP_PORT, ZMSConsts.ZMS_HTTP_PORT_DEFAULT); + int httpsPort = getPortNumber(ZMSConsts.ZMS_PROP_HTTPS_PORT, ZMSConsts.ZMS_HTTPS_PORT_DEFAULT); + + String serverHostName = getServerHostName(); + + // get our authorities + + String authListConfig = System.getProperty(ZMSConsts.ZMS_PROP_AUTHORITY_CLASSES, ZMS_PRINCIPAL_AUTHORITY_CLASS); + AuthorityList authorities = new AuthorityList(); + + String[] authorityList = authListConfig.split(","); + for (int idx = 0; idx < authorityList.length; idx++) { + Authority authority = getAuthority(authorityList[idx]); + if (authority == null) { + return null; + } + authority.initialize(); + authorities.add(authority); + } + + String pkeyFactoryClass = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_STORE_CLASS, ZMS_PKEY_STORE_CLASS); + PrivateKeyStoreFactory pkeyFactory = null; + try { + pkeyFactory = (PrivateKeyStoreFactory) Class.forName(pkeyFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid PrivateKeyStoreFactory class: " + pkeyFactoryClass + + " error: " + e.getMessage()); + return null; + } + + String metricFactoryClass = System.getProperty(ZMSConsts.ZMS_PROP_METRIC_FACTORY_CLASS, ZMSConsts.ZMS_METRIC_FACTORY_CLASS); + boolean statsEnabled = Boolean.parseBoolean(System.getProperty(ZMSConsts.ZMS_PROP_STATS_ENABLED, "false")); + if (!statsEnabled && !metricFactoryClass.equals(ZMSConsts.ZMS_METRIC_FACTORY_CLASS)) { + LOG.warn("Override users metric factory property with default since stats are disabled"); + metricFactoryClass = ZMSConsts.ZMS_METRIC_FACTORY_CLASS; + } + + MetricFactory metricFactory = null; + try { + metricFactory = (MetricFactory) Class.forName(metricFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid MetricFactory class: " + metricFactoryClass + + " error: " + e.getMessage()); + return null; + } + + ZMSServerImpl core = new ZMSServerImpl(serverHostName, dataStoreContext, + pkeyFactory, metricFactory, AUDITLOG, AUDIT_LOG_MSG_BLDR_CLASS, authorities); + + container = new ZMSJettyContainer(AUDITLOG); + container.resource(ZMSResources.class); + container.delegate(ZMSHandler.class, core.getInstance()); + container.authorizer(core.getAuthorizer()); + container.setBanner("http://" + serverHostName + " http port: " + httpPort + " https port: " + httpsPort); + + int maxThreads = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_MAX_THREADS, "1024")); + container.createServer(maxThreads); + + HttpConfiguration httpConfig = container.newHttpConfiguration(httpsPort); + container.addHTTPConnectors(httpConfig, httpPort, httpsPort); + container.addServletHandlers(homeDir, serverHostName); + + container.addRequestLogHandler(root); + + return container; + } + + public static void main(String [] args) throws Exception { + + System.getProperties().remove("socksProxyHost"); + + try { + ZMSJettyContainer container = createJettyContainer(); + container.run(null); + } catch (Exception exc) { + + // log that we are shutting down, re-throw the exception + + LOG.error("Startup failure. Shutting down: " + exc.getMessage()); + throw exc; + } + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSConsts.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSConsts.java new file mode 100644 index 00000000000..26f0b05dded --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSConsts.java @@ -0,0 +1,184 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +/** + * Contains constants shared by classes throughout the service. + **/ +public final class ZMSConsts { + + // System property names with defaults(where applicable) + // + public static final String ZMS_PROP_HOME = "athenz.zms.home"; + public static final String ZMS_PROP_HOSTNAME = "athenz.zms.hostname"; + public static final String ZMS_PROP_DOMAIN_ADMIN = "athenz.zms.domain_admin"; + public static final String ZMS_PROP_HTTPS_PORT = "athenz.zms.tls_port"; + public static final String ZMS_PROP_HTTP_PORT = "athenz.zms.port"; + + public static final String ZMS_PROP_ACCESS_LOG_DIR = "athenz.zms.access_log_dir"; + public static final String ZMS_PROP_STATS_ENABLED = "athenz.zms.enable_stats"; + public static final String ZMS_PROP_VIRTUAL_DOMAIN = "athenz.zms.virtual_domain_support"; + public static final String ZMS_PROP_VIRTUAL_DOMAIN_LIMIT = "athenz.zms.virtual_domain_limit"; + public static final String ZMS_PROP_READ_ONLY_MODE = "athenz.zms.read_only_mode"; + public static final String ZMS_PROP_DOMAIN_NAME_MAX_SIZE = "athenz.zms.domain_name_max_len"; + public static final String ZMS_PROP_METRIC_FACTORY_CLASS = "athenz.zms.metric_class"; + + public static final String ZMS_PROP_CONFLICT_RETRY_COUNT = "athenz.zms.request_conflict_retry_count"; + public static final String ZMS_PROP_CONFLICT_RETRY_SLEEP_TIME = "athenz.zms.request_conflict_retry_sleep_time"; + + public static final String ZMS_PROP_PRIVATE_KEY = "athenz.zms.privatekey"; + public static final String ZMS_PROP_PRIVATE_KEY_ID = "athenz.zms.privatekey_id"; + public static final String ZMS_PROP_PRIVATE_KEY_NAME = "athenz.zms.privatekey_name"; + public static final String ZMS_PROP_PUBLIC_KEY = "athenz.zms.publickey"; + public static final String ZMS_PROP_PUBLIC_KEY_NAME = "athenz.zms.publickey_name"; + + public static final String ZMS_PROP_JDBC_STORE = "athenz.zms.jdbcstore"; + public static final String ZMS_PROP_MAX_THREADS = "athenz.zms.http_max_threads"; + public static final String ZMS_PROP_AUTHORITY_CLASSES = "athenz.zms.authority_classes"; + + public static final String ZMS_PROP_TIMEOUT = "athenz.zms.user_token_timeout"; + public static final String ZMS_PROP_SIGNED_POLICY_TIMEOUT = "athenz.zms.signed_policy_timeout"; + public static final String ZMS_PROP_AUTHZ_SERVICE_FNAME = "athenz.zms.authz_service_fname"; + public static final String ZMS_PROP_SOLUTION_TEMPLATE_FNAME = "athenz.zms.solution_templates_fname"; + + public static final String ZMS_PROP_USER_DOMAIN = "athenz.user_domain"; + + public static final String ZMS_PROP_ACCESS_LOG_RETAIN_DAYS = "athenz.zms.access_log_retain_days"; + public static final String ZMS_PROP_ACCESS_LOG_NAME = "athenz.zms.access_log_name"; + public static final String ZMS_PROP_ACCESS_SLF4J_LOGGER = "athenz.zms.access_slf4j_logger"; + + public static final String ZMS_PROP_KEYSTORE_PASSWORD = "athenz.zms.ssl_key_store_password"; + public static final String ZMS_PROP_KEYMANAGER_PASSWORD = "athenz.zms.ssl_key_manager_password"; + public static final String ZMS_PROP_TRUSTSTORE_PASSWORD = "athenz.zms.ssl_trust_store_password"; + public static final String ZMS_PROP_KEYSTORE_PATH = "athenz.zms.ssl_key_store"; + public static final String ZMS_PROP_KEYSTORE_TYPE = "athenz.zms.ssl_key_store_type"; + public static final String ZMS_PROP_TRUSTSTORE_PATH = "athenz.zms.ssl_trust_store"; + public static final String ZMS_PROP_TRUSTSTORE_TYPE = "athenz.zms.ssl_trust_store_type"; + public static final String ZMS_PROP_EXCLUDED_CIPHER_SUITES = "athenz.zms.ssl_excluded_cipher_suites"; + public static final String ZMS_PROP_EXCLUDED_PROTOCOLS = "athenz.zms.ssl_excluded_protocols"; + public static final String ZMS_PROP_IDLE_TIMEOUT = "athenz.zms.http_idle_timeout"; + public static final String ZMS_PROP_SEND_SERVER_VERSION = "athenz.zms.http_send_server_version"; + public static final String ZMS_PROP_SEND_DATE_HEADER = "athenz.zms.http_send_date_header"; + public static final String ZMS_PROP_OUTPUT_BUFFER_SIZE = "athenz.zms.http_output_buffer_size"; + public static final String ZMS_PROP_REQUEST_HEADER_SIZE = "athenz.zms.http_reqeust_header_size"; + public static final String ZMS_PROP_RESPONSE_HEADER_SIZE = "athenz.zms.http_response_header_size"; + public static final String ZMS_PROP_LISTEN_HOST = "athenz.zms.listen_host"; + public static final String ZMS_PROP_KEEP_ALIVE = "athenz.zms.keep_alive"; + public static final String ZMS_PROP_DB_TABLE = "athenz.zms.zms_dbtable"; + public static final String ZMS_PROP_PROVIDER_ENDPOINTS = "athenz.zms.provider_endpoints"; + public static final String ZMS_PROP_PRODUCT_ID_SUPPORT = "athenz.zms.product_id_support"; + + // properties used to over-ride default Audit logger + + public static final String ZMS_PROP_AUDIT_LOGGER_CLASS = "athenz.zms.audit_logger_class"; + public static final String ZMS_PROP_AUDIT_LOGGER_CLASS_PARAM = "athenz.zms.audit_logger_class_param"; + public static final String ZMS_PROP_AUDIT_LOG_MSG_BLDR_CLASS = "athenz.zms.audit_log_msg_builder_class"; + + public static final String ZMS_PROP_PRIVATE_KEY_STORE_CLASS = "athenz.zms.private_key_store_class"; + + public static final String ZMS_METRIC_FACTORY_CLASS = "com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory"; + + public static final String ZMS_UNKNOWN_DOMAIN = "unknown_domain"; + public static final String ZMS_INVALID_DOMAIN = "invalid_domain"; + + public static final int ZMS_HTTPS_PORT_DEFAULT = 0; + public static final int ZMS_HTTP_PORT_DEFAULT = 10080; + public static final String ZMS_STATS_SCOREBOARD = "zms_core"; + + public static final String ZMS_DOMAIN_NAME_MAX_SIZE_DEFAULT = "128"; + + public static final String USER_DOMAIN = "user"; + public static final String USER_DOMAIN_PREFIX = "user."; + + public static final String HTTP_ORIGIN = "Origin"; + public static final String HTTP_RFC1123_DATE_FORMAT = "EEE, d MMM yyyy HH:mm:ss zzz"; + public static final String HTTP_DATE_GMT_ZONE = "GMT"; + + public static final String HTTP_ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin"; + public static final String HTTP_ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods"; + public static final String HTTP_ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers"; + public static final String HTTP_ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials"; + public static final String HTTP_ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age"; + public static final String HTTP_ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers"; + + public static final String LOCALHOST = "localhost"; + public static final String HTTP_SCHEME = "http"; + public static final String HTTPS_SCHEME = "https"; + + public static final String DB_COLUMN_DESCRIPTION = "description"; + public static final String DB_COLUMN_ORG = "org"; + public static final String DB_COLUMN_UUID = "uuid"; + public static final String DB_COLUMN_ENABLED = "enabled"; + public static final String DB_COLUMN_AUDIT_ENABLED = "audit_enabled"; + public static final String DB_COLUMN_MODIFIED = "modified"; + public static final String DB_COLUMN_NAME = "name"; + public static final String DB_COLUMN_TRUST = "trust"; + public static final String DB_COLUMN_MEMBER = "member"; + public static final String DB_COLUMN_ROLE = "role"; + public static final String DB_COLUMN_RESOURCE = "resource"; + public static final String DB_COLUMN_ACTION = "action"; + public static final String DB_COLUMN_EFFECT = "effect"; + public static final String DB_COLUMN_KEY_VALUE = "key_value"; + public static final String DB_COLUMN_KEY_ID = "key_id"; + public static final String DB_COLUMN_SVC_USER = "svc_user"; + public static final String DB_COLUMN_SVC_GROUP = "svc_group"; + public static final String DB_COLUMN_EXECTUABLE = "executable"; + public static final String DB_COLUMN_PROVIDER_ENDPOINT = "provider_endpoint"; + public static final String DB_COLUMN_VALUE = "value"; + public static final String DB_COLUMN_DOMAIN_ID = "domain_id"; + public static final String DB_COLUMN_DOMAIN = "domain"; + public static final String DB_COLUMN_ACCOUNT = "account"; + public static final String DB_COLUMN_PRODUCT_ID = "ypm_id"; + public static final String DB_COLUMN_ADMIN = "admin"; + public static final String DB_COLUMN_CREATED = "created"; + public static final String DB_COLUMN_AUDIT_REF = "audit_ref"; + public static final String DB_COLUMN_ROLE_NAME = "role_name"; + public static final String DB_COLUMN_ASSERT_DOMAIN_ID = "assert_domain_id"; + public static final String DB_COLUMN_ASSERT_ID = "assertion_id"; + + public static final String ADMIN_POLICY_NAME = "admin"; + public static final String ADMIN_ROLE_NAME = "admin"; + + public static final String ROLE_PREFIX = "role."; + public static final String POLICY_PREFIX = "policy."; + + public static final String ASSERTION_EFFECT_ALLOW = "ALLOW"; + public static final String ACTION_ASSUME_ROLE = "assume_role"; + public static final String ACTION_ASSUME_AWS_ROLE = "assume_aws_role"; + public static final String ACTION_UPDATE = "update"; + + public static final String OBJECT_DOMAIN = "domain"; + public static final String OBJECT_ROLE = "role"; + public static final String OBJECT_POLICY = "policy"; + public static final String OBJECT_SERVICE = "service"; + public static final String OBJECT_PRINCIPAL = "principal"; + public static final String OBJECT_HOST = "host"; + + // HTTP operation types used in metrics + public static final String HTTP_GET = "GET"; + public static final String HTTP_PUT = "PUT"; + public static final String HTTP_POST = "POST"; + public static final String HTTP_DELETE = "DELETE"; + public static final String HTTP_OPTIONS = "OPTIONS"; + public static final String HTTP_REQUEST = "REQUEST"; + + public static final String STR_DEF_ROOT = "/home/athenz"; + public static final String STR_ENV_ROOT = "ROOT"; + public static final String STR_JAR_RESOURCE = "JAR_RESOURCE:"; + + public static final int STRING_BLDR_SIZE_DEFAULT = 512; +} + diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSDaemon.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSDaemon.java new file mode 100644 index 00000000000..1d50296a145 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSDaemon.java @@ -0,0 +1,40 @@ +package com.yahoo.athenz.zms; +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import org.apache.commons.daemon.Daemon; +import org.apache.commons.daemon.DaemonContext; + +public class ZMSDaemon implements Daemon { + + private String[] args = null; + + public void init(DaemonContext context) throws Exception { + args = context.getArguments(); + } + + public void start() throws Exception { + if (args == null) { + return; + } + ZMS.main(args); + } + + public void stop() throws Exception { + } + + public void destroy() { + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSHandler.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSHandler.java new file mode 100644 index 00000000000..b70a94eb508 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSHandler.java @@ -0,0 +1,82 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +import com.yahoo.rdl.*; +import java.util.*; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +// +// ZMSHandler is the interface that the service implementation must implement +// +public interface ZMSHandler { + public Domain getDomain(ResourceContext context, String domain); + public DomainList getDomainList(ResourceContext context, Integer limit, String skip, String prefix, Integer depth, String account, Integer productId, String roleMember, String roleName, String modifiedSince); + public Domain postTopLevelDomain(ResourceContext context, String auditRef, TopLevelDomain detail); + public Domain postSubDomain(ResourceContext context, String parent, String auditRef, SubDomain detail); + public Domain postUserDomain(ResourceContext context, String name, String auditRef, UserDomain detail); + public TopLevelDomain deleteTopLevelDomain(ResourceContext context, String name, String auditRef); + public SubDomain deleteSubDomain(ResourceContext context, String parent, String name, String auditRef); + public UserDomain deleteUserDomain(ResourceContext context, String name, String auditRef); + public Domain putDomainMeta(ResourceContext context, String name, String auditRef, DomainMeta detail); + public DomainTemplate putDomainTemplate(ResourceContext context, String name, String auditRef, DomainTemplate template); + public DomainTemplateList getDomainTemplateList(ResourceContext context, String name); + public DomainTemplate deleteDomainTemplate(ResourceContext context, String name, String template, String auditRef); + public DomainDataCheck getDomainDataCheck(ResourceContext context, String domainName); + public Entity putEntity(ResourceContext context, String domainName, String entityName, String auditRef, Entity entity); + public Entity getEntity(ResourceContext context, String domainName, String entityName); + public Entity deleteEntity(ResourceContext context, String domainName, String entityName, String auditRef); + public EntityList getEntityList(ResourceContext context, String domainName); + public RoleList getRoleList(ResourceContext context, String domainName, Integer limit, String skip); + public Roles getRoles(ResourceContext context, String domainName, Boolean members); + public Role getRole(ResourceContext context, String domainName, String roleName, Boolean auditLog, Boolean expand); + public Role putRole(ResourceContext context, String domainName, String roleName, String auditRef, Role role); + public Role deleteRole(ResourceContext context, String domainName, String roleName, String auditRef); + public Membership getMembership(ResourceContext context, String domainName, String roleName, String memberName); + public Membership putMembership(ResourceContext context, String domainName, String roleName, String memberName, String auditRef, Membership membership); + public Membership deleteMembership(ResourceContext context, String domainName, String roleName, String memberName, String auditRef); + public DefaultAdmins putDefaultAdmins(ResourceContext context, String domainName, String auditRef, DefaultAdmins defaultAdmins); + public PolicyList getPolicyList(ResourceContext context, String domainName, Integer limit, String skip); + public Policies getPolicies(ResourceContext context, String domainName, Boolean assertions); + public Policy getPolicy(ResourceContext context, String domainName, String policyName); + public Policy putPolicy(ResourceContext context, String domainName, String policyName, String auditRef, Policy policy); + public Policy deletePolicy(ResourceContext context, String domainName, String policyName, String auditRef); + public Assertion getAssertion(ResourceContext context, String domainName, String policyName, Long assertionId); + public Assertion putAssertion(ResourceContext context, String domainName, String policyName, String auditRef, Assertion assertion); + public Assertion deleteAssertion(ResourceContext context, String domainName, String policyName, Long assertionId, String auditRef); + public ServiceIdentity putServiceIdentity(ResourceContext context, String domain, String service, String auditRef, ServiceIdentity detail); + public ServiceIdentity getServiceIdentity(ResourceContext context, String domain, String service); + public ServiceIdentity deleteServiceIdentity(ResourceContext context, String domain, String service, String auditRef); + public ServiceIdentities getServiceIdentities(ResourceContext context, String domainName, Boolean publickeys, Boolean hosts); + public ServiceIdentityList getServiceIdentityList(ResourceContext context, String domainName, Integer limit, String skip); + public PublicKeyEntry getPublicKeyEntry(ResourceContext context, String domain, String service, String id); + public PublicKeyEntry putPublicKeyEntry(ResourceContext context, String domain, String service, String id, String auditRef, PublicKeyEntry publicKeyEntry); + public PublicKeyEntry deletePublicKeyEntry(ResourceContext context, String domain, String service, String id, String auditRef); + public Tenancy putTenancy(ResourceContext context, String domain, String service, String auditRef, Tenancy detail); + public Tenancy getTenancy(ResourceContext context, String domain, String service); + public Tenancy deleteTenancy(ResourceContext context, String domain, String service, String auditRef); + public TenancyResourceGroup putTenancyResourceGroup(ResourceContext context, String domain, String service, String resourceGroup, String auditRef, TenancyResourceGroup detail); + public TenancyResourceGroup deleteTenancyResourceGroup(ResourceContext context, String domain, String service, String resourceGroup, String auditRef); + public TenantRoles putTenantRoles(ResourceContext context, String domain, String service, String tenantDomain, String auditRef, TenantRoles detail); + public TenantRoles getTenantRoles(ResourceContext context, String domain, String service, String tenantDomain); + public TenantRoles deleteTenantRoles(ResourceContext context, String domain, String service, String tenantDomain, String auditRef); + public TenantResourceGroupRoles putTenantResourceGroupRoles(ResourceContext context, String domain, String service, String tenantDomain, String resourceGroup, String auditRef, TenantResourceGroupRoles detail); + public TenantResourceGroupRoles getTenantResourceGroupRoles(ResourceContext context, String domain, String service, String tenantDomain, String resourceGroup); + public TenantResourceGroupRoles deleteTenantResourceGroupRoles(ResourceContext context, String domain, String service, String tenantDomain, String resourceGroup, String auditRef); + public ProviderResourceGroupRoles putProviderResourceGroupRoles(ResourceContext context, String tenantDomain, String provDomain, String provService, String resourceGroup, String auditRef, ProviderResourceGroupRoles detail); + public ProviderResourceGroupRoles getProviderResourceGroupRoles(ResourceContext context, String tenantDomain, String provDomain, String provService, String resourceGroup); + public ProviderResourceGroupRoles deleteProviderResourceGroupRoles(ResourceContext context, String tenantDomain, String provDomain, String provService, String resourceGroup, String auditRef); + public Access getAccess(ResourceContext context, String action, String resource, String domain, String checkPrincipal); + public Access getAccessExt(ResourceContext context, String action, String resource, String domain, String checkPrincipal); + public ResourceAccessList getResourceAccessList(ResourceContext context, String principal, String action); + public void getSignedDomains(ResourceContext context, String domain, String metaOnly, String matchingTag, GetSignedDomainsResult result); + public UserToken getUserToken(ResourceContext context, String userName, String serviceNames); + public UserToken optionsUserToken(ResourceContext context, String userName, String serviceNames); + public ServicePrincipal getServicePrincipal(ResourceContext context); + public ServerTemplateList getServerTemplateList(ResourceContext context); + public Template getTemplate(ResourceContext context, String template); + public Schema getRdlSchema(ResourceContext context); + public ResourceContext newResourceContext(HttpServletRequest request, HttpServletResponse response); +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSImpl.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSImpl.java new file mode 100644 index 00000000000..36abcb46d97 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSImpl.java @@ -0,0 +1,6208 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Schema; +import com.yahoo.rdl.Timestamp; +import com.yahoo.rdl.Validator; +import com.yahoo.rdl.Validator.Result; +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.rest.Http; +import com.yahoo.athenz.common.server.util.ServletRequestUtil; +import com.yahoo.athenz.common.server.util.StringUtils; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.provider.ProviderClient; +import com.yahoo.athenz.provider.Tenant; +import com.yahoo.athenz.provider.TenantResourceGroup; +import com.yahoo.athenz.zms.config.AllowedOperation; +import com.yahoo.athenz.zms.config.AuthorizedService; +import com.yahoo.athenz.zms.config.AuthorizedServices; +import com.yahoo.athenz.zms.config.SolutionTemplates; +import com.yahoo.athenz.zms.store.AthenzDomain; +import com.yahoo.athenz.zms.store.ObjectStore; +import com.yahoo.athenz.zms.utils.ZMSUtils; + +import java.util.HashSet; +import java.util.List; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.Date; +import java.util.ListIterator; +import java.util.Map; +import java.util.HashMap; +import java.util.Set; +import java.util.TimeZone; +import java.util.concurrent.ConcurrentHashMap; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.text.ParseException; +import java.text.SimpleDateFormat; + +import java.io.File; +import java.io.IOException; +import java.net.URISyntaxException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; + +import javax.ws.rs.core.EntityTag; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * A reference implementation of ZMS. Uses a StructStore for domain information. + * This class is not public - use the ZMSCore class to access it. + */ +public class ZMSImpl implements Authorizer, KeyStore, ZMSHandler { + + private static final Logger LOG = LoggerFactory.getLogger(ZMSImpl.class); + + private static final String SERVICE_PREFIX = "service."; + private static final String ROLE_PREFIX = "role."; + private static final String POLICY_PREFIX = "policy."; + + private static final String ADMIN_POLICY_NAME = "admin"; + private static final String ADMIN_ROLE_NAME = "admin"; + + private static final String ROLE_FIELD = "role"; + private static final String POLICY_FIELD = "policy"; + private static final String SERVICE_FIELD = "service"; + private static final String TEMPLATE_FIELD = "template"; + private static final String META_FIELD = "meta"; + private static final String DOMAIN_FIELD = "domain"; + + private static final String SYS_AUTH = "sys.auth"; + private static final String ZMS = "zms"; + private static final String USER_TOKEN_DEFAULT_NAME = "_self_"; + + // data validation types + private static final String TYPE_DOMAIN_NAME = "DomainName"; + private static final String TYPE_ENTITY_NAME = "EntityName"; + private static final String TYPE_SIMPLE_NAME = "SimpleName"; + private static final String TYPE_COMPOUND_NAME = "CompoundName"; + private static final String TYPE_RESOURCE_NAME = "ResourceName"; + private static final String TYPE_SERVICE_NAME = "ServiceName"; + private static final String TYPE_ROLE = "Role"; + private static final String TYPE_POLICY = "Policy"; + private static final String TYPE_ASSERTION = "Assertion"; + private static final String TYPE_SERVICE_IDENTITY = "ServiceIdentity"; + private static final String TYPE_TOP_LEVEL_DOMAIN = "TopLevelDomain"; + private static final String TYPE_SUB_DOMAIN = "SubDomain"; + private static final String TYPE_USER_DOMAIN = "UserDomain"; + private static final String TYPE_DOMAIN_META = "DomainMeta"; + private static final String TYPE_DOMAIN_TEMPLATE = "DomainTemplate"; + private static final String TYPE_TENANT_ROLES = "TenantRoles"; + private static final String TYPE_TENANT_RESOURCE_GROUP_ROLES = "TenantResourceGroupRoles"; + private static final String TYPE_PROVIDER_RESOURCE_GROUP_ROLES = "ProviderResourceGroupRoles"; + private static final String TYPE_YRN = "YRN"; + private static final String TYPE_PUBLIC_KEY_ENTRY = "PublicKeyEntry"; + + public static Metric metric; + protected ObjectStore dbStore = null; + protected DBService dbService = null; + protected Class providerClass = null; + protected Schema schema = null; + protected String publicKey = null; + protected PrivateKey privateKey = null; + protected String privateKeyId = "0"; + protected int userTokenTimeout = 3600; + protected boolean virtualDomainSupport = true; + protected boolean productIdSupport = false; + protected int virtualDomainLimit = 2; + protected long signedPolicyTimeout; + protected static String serverHostName = null; + protected static String serverHttpsPort = null; + protected static String serverHttpPort = null; + protected int domainNameMaxLen; + protected AuthorizedServices serverAuthorizedServices = null; + protected static SolutionTemplates serverSolutionTemplates = null; + protected Map serverPublicKeyMap = null; + protected boolean readOnlyMode = false; + protected static Validator validator; + protected static String userDomain; + protected static String userDomainPrefix; + protected String zmsRootDir = null; + protected Http.AuthorityList authorities = null; + protected List providerEndpoints = null; + + // enum to represent our access response since in some cases we want to + // handle domain not founds differently instead of just returning failure + + enum AccessStatus { + ALLOWED, + DENIED, + DENIED_DOMAIN_NOT_FOUND, + DENIED_INVALID_ROLE_TOKEN + } + + enum AthenzObject { + ASSERTION { + void convertToLowerCase(Object obj) { + Assertion assertion = (Assertion) obj; + assertion.setAction(assertion.getAction().toLowerCase()); + assertion.setResource(assertion.getResource().toLowerCase()); + assertion.setRole(assertion.getRole().toLowerCase()); + } + }, + DEFAULT_ADMINS { + void convertToLowerCase(Object obj) { + DefaultAdmins defaultAdmins = (DefaultAdmins) obj; + LIST.convertToLowerCase(defaultAdmins.getAdmins()); + } + }, + DOMAIN_TEMPLATE_LIST { + void convertToLowerCase(Object obj) { + DomainTemplateList templates = (DomainTemplateList) obj; + if (templates != null) { + LIST.convertToLowerCase(templates.getTemplateNames()); + } + } + }, + DOMAIN_TEMPLATE { + void convertToLowerCase(Object obj) { + DomainTemplate template = (DomainTemplate) obj; + if (template != null) { + LIST.convertToLowerCase(template.getTemplateNames()); + } + } + }, + ENTITY { + void convertToLowerCase(Object obj) { + Entity entity = (Entity) obj; + entity.setName(entity.getName().toLowerCase()); + } + }, + LIST { + void convertToLowerCase(Object obj) { + @SuppressWarnings("unchecked") + List list = (List) obj; + if (list != null) { + ListIterator iter = list.listIterator(); + while (iter.hasNext()) { + iter.set(iter.next().toLowerCase()); + } + } + } + }, + MEMBERSHIP { + void convertToLowerCase(Object obj) { + Membership membership = (Membership) obj; + membership.setMemberName(membership.getMemberName().toLowerCase()); + if (membership.getRoleName() != null) { + membership.setRoleName(membership.getRoleName().toLowerCase()); + } + } + }, + POLICY { + void convertToLowerCase(Object obj) { + Policy policy = (Policy) obj; + policy.setName(policy.getName().toLowerCase()); + if (policy.getAssertions() != null) { + for (Assertion assertion : policy.getAssertions()) { + ASSERTION.convertToLowerCase(assertion); + } + } + } + }, + PROVIDER_RESOURCE_GROUP_ROLES { + void convertToLowerCase(Object obj) { + ProviderResourceGroupRoles tenantRoles = (ProviderResourceGroupRoles) obj; + tenantRoles.setDomain(tenantRoles.getDomain().toLowerCase()); + tenantRoles.setService(tenantRoles.getService().toLowerCase()); + tenantRoles.setTenant(tenantRoles.getTenant().toLowerCase()); + tenantRoles.setResourceGroup(tenantRoles.getResourceGroup().toLowerCase()); + if (tenantRoles.getRoles() != null) { + for (TenantRoleAction roleAction : tenantRoles.getRoles()) { + TENANT_ROLE_ACTION.convertToLowerCase(roleAction); + } + } + } + }, + PUBLIC_KEY_ENTRY { + void convertToLowerCase(Object obj) { + PublicKeyEntry keyEntry = (PublicKeyEntry) obj; + keyEntry.setId(keyEntry.getId().toLowerCase()); + } + }, + ROLE { + void convertToLowerCase(Object obj) { + Role role = (Role) obj; + role.setName(role.getName().toLowerCase()); + if (role.getTrust() != null) { + role.setTrust(role.getTrust().toLowerCase()); + } + LIST.convertToLowerCase(role.getMembers()); + } + }, + SERVICE_IDENTITY { + void convertToLowerCase(Object obj) { + ServiceIdentity service = (ServiceIdentity) obj; + service.setName(service.getName().toLowerCase()); + LIST.convertToLowerCase(service.getHosts()); + if (service.getPublicKeys() != null) { + for (PublicKeyEntry key : service.getPublicKeys()) { + PUBLIC_KEY_ENTRY.convertToLowerCase(key); + } + } + } + }, + SUB_DOMAIN { + void convertToLowerCase(Object obj) { + SubDomain subdomain = (SubDomain) obj; + subdomain.setName(subdomain.getName().toLowerCase()); + subdomain.setParent(subdomain.getParent().toLowerCase()); + LIST.convertToLowerCase(subdomain.getAdminUsers()); + DOMAIN_TEMPLATE_LIST.convertToLowerCase(subdomain.getTemplates()); + } + }, + TENANCY { + void convertToLowerCase(Object obj) { + Tenancy tenancy = (Tenancy) obj; + tenancy.setDomain(tenancy.getDomain().toLowerCase()); + tenancy.setService(tenancy.getService().toLowerCase()); + LIST.convertToLowerCase(tenancy.getResourceGroups()); + } + }, + TENANCY_RESOURCE_GROUP { + void convertToLowerCase(Object obj) { + TenancyResourceGroup tenancyResourceGroup = (TenancyResourceGroup) obj; + tenancyResourceGroup.setDomain(tenancyResourceGroup.getDomain().toLowerCase()); + tenancyResourceGroup.setService(tenancyResourceGroup.getService().toLowerCase()); + tenancyResourceGroup.setResourceGroup(tenancyResourceGroup.getResourceGroup().toLowerCase()); + } + }, + TENANT_RESOURCE_GROUP_ROLES { + void convertToLowerCase(Object obj) { + TenantResourceGroupRoles tenantRoles = (TenantResourceGroupRoles) obj; + tenantRoles.setDomain(tenantRoles.getDomain().toLowerCase()); + tenantRoles.setService(tenantRoles.getService().toLowerCase()); + tenantRoles.setTenant(tenantRoles.getTenant().toLowerCase()); + tenantRoles.setResourceGroup(tenantRoles.getResourceGroup().toLowerCase()); + if (tenantRoles.getRoles() != null) { + for (TenantRoleAction roleAction : tenantRoles.getRoles()) { + TENANT_ROLE_ACTION.convertToLowerCase(roleAction); + } + } + } + }, + TENANT_ROLE_ACTION { + void convertToLowerCase(Object obj) { + TenantRoleAction roleAction = (TenantRoleAction) obj; + roleAction.setAction(roleAction.getAction().toLowerCase()); + roleAction.setRole(roleAction.getRole().toLowerCase()); + } + }, + TENANT_ROLES { + void convertToLowerCase(Object obj) { + TenantRoles tenantRoles = (TenantRoles) obj; + tenantRoles.setDomain(tenantRoles.getDomain().toLowerCase()); + tenantRoles.setService(tenantRoles.getService().toLowerCase()); + tenantRoles.setTenant(tenantRoles.getTenant().toLowerCase()); + if (tenantRoles.getRoles() != null) { + for (TenantRoleAction roleAction : tenantRoles.getRoles()) { + TENANT_ROLE_ACTION.convertToLowerCase(roleAction); + } + } + } + }, + TOP_LEVEL_DOMAIN { + void convertToLowerCase(Object obj) { + TopLevelDomain domain = (TopLevelDomain) obj; + domain.setName(domain.getName().toLowerCase()); + LIST.convertToLowerCase(domain.getAdminUsers()); + DOMAIN_TEMPLATE_LIST.convertToLowerCase(domain.getTemplates()); + } + }, + USER_DOMAIN { + void convertToLowerCase(Object obj) { + UserDomain userDomain = (UserDomain) obj; + userDomain.setName(userDomain.getName().toLowerCase()); + DOMAIN_TEMPLATE_LIST.convertToLowerCase(userDomain.getTemplates()); + } + }; + + abstract void convertToLowerCase(Object obj); + } + + AuditLogger auditLogger = null; + static String auditLoggerMsgBldrClass = null; + + public ZMSImpl(String serverHostName, ObjectStore dbStore, Metric metric, + PrivateKey privateKey, String privateKeyId, String publicKey, + AuditLogger auditLog, String auditLogMsgBldrClass) { + + auditLogger = auditLog; + auditLoggerMsgBldrClass = auditLogMsgBldrClass; + + // first determine our root directory + + zmsRootDir = System.getenv("ROOT"); + if (zmsRootDir == null) { + zmsRootDir = "/home/athenz"; + } + + this.publicKey = publicKey; + this.privateKey = privateKey; + this.privateKeyId = privateKeyId; + this.schema = ZMSSchema.instance(); + validator = new Validator(schema); + userDomain = System.getProperty(ZMSConsts.ZMS_PROP_USER_DOMAIN, ZMSConsts.USER_DOMAIN); + userDomainPrefix = userDomain + "."; + + ZMSImpl.serverHostName = serverHostName; + ZMSImpl.metric = metric; + this.dbStore = dbStore; + dbService = new DBService(dbStore, auditLogger, userDomain); + userTokenTimeout = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_TIMEOUT, "3600")); + + // check if we need to run in maintenance read only mode + + readOnlyMode = Boolean.parseBoolean(System.getProperty(ZMSConsts.ZMS_PROP_READ_ONLY_MODE, "false")); + + // check to see if we need to support product ids as required + // for top level domains + + productIdSupport = Boolean.parseBoolean(System.getProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT, "false")); + + // get the list of valid provider endpoints + + String endPoints = System.getProperty(ZMSConsts.ZMS_PROP_PROVIDER_ENDPOINTS); + if (endPoints != null) { + providerEndpoints = Arrays.asList(endPoints.split(",")); + } + // retrieve virtual domain support and limit. If we're given an invalid negative + // value for limit, we'll default back to our configured value of 2 + + virtualDomainSupport = Boolean.parseBoolean(System.getProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "true")); + virtualDomainLimit = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "2")); + if (virtualDomainLimit < 0) { + virtualDomainLimit = 2; + } + + // signedPolicyTimeout is in milliseconds but the config setting should be in seconds + // to be consistent with other configuration properties (Default 7 days) + + signedPolicyTimeout = 1000 * Long.parseLong(System.getProperty(ZMSConsts.ZMS_PROP_SIGNED_POLICY_TIMEOUT, "604800")); + if (signedPolicyTimeout < 0) { + signedPolicyTimeout = 1000 * 604800; + } + + // get the ports the server is configured to listen on + + serverHttpsPort = System.getProperty(ZMSConsts.ZMS_PROP_HTTPS_PORT, Integer.toString(ZMSConsts.ZMS_HTTPS_PORT_DEFAULT)); + serverHttpPort = System.getProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, Integer.toString(ZMSConsts.ZMS_HTTP_PORT_DEFAULT)); + + // get the maximum length allowed for a top level domain name + + domainNameMaxLen = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_DOMAIN_NAME_MAX_SIZE, + ZMSConsts.ZMS_DOMAIN_NAME_MAX_SIZE_DEFAULT)); + if (domainNameMaxLen < 10) { // 10 is arbitrary + int domNameMaxDefault = Integer.parseInt(ZMSConsts.ZMS_DOMAIN_NAME_MAX_SIZE_DEFAULT); + LOG.warn("init: Warning: maximum domain name length specified is too small: " + + domainNameMaxLen + " : reverting to default: " + domNameMaxDefault); + domainNameMaxLen = domNameMaxDefault; + } + LOG.info("init: using maximum domain name length: " + domainNameMaxLen); + + // load the list of authorized services + + loadAuthorizedServices(); + + // load the Solution templates + + loadSolutionTemplates(); + + // this should only happen when running ZMS in local/debug mode + // otherwise the store should have been initialized by now + + initObjectStore(); + + // retrieve our public keys + + loadServerPublicKeys(); + } + + void loadServerPublicKeys() { + + // initialize our public key map + + serverPublicKeyMap = new ConcurrentHashMap(); + + // retrieve our zms service identity object + + ServiceIdentity identity = dbService.getServiceIdentity(SYS_AUTH, ZMS); + if (identity != null) { + + // process all the public keys and add them to the map + + List publicKeyList = identity.getPublicKeys(); + if (publicKeyList != null) { + for (PublicKeyEntry entry : publicKeyList) { + serverPublicKeyMap.put(entry.getId(), entry.getKey()); + } + } + } + + // this should never happen but just in case we'll just + // use the public key we retrieved ourselves to the map + + if (serverPublicKeyMap.isEmpty()) { + serverPublicKeyMap.put(privateKeyId, publicKey); + } + } + + public void setProviderClientClass(Class providerClass) { + this.providerClass = providerClass; + } + + public void putAuthorityList(Http.AuthorityList authList) { + authorities = authList; + } + + void loadSolutionTemplates() { + + // get the configured path for the list of service templates + + String solutionTemplatesFname = System.getProperty(ZMSConsts.ZMS_PROP_SOLUTION_TEMPLATE_FNAME, + zmsRootDir + "/conf/zms_server/solution_templates.json"); + + Path path = Paths.get(solutionTemplatesFname); + try { + serverSolutionTemplates = JSON.fromBytes(Files.readAllBytes(path), SolutionTemplates.class); + } catch (IOException e) { + LOG.info("Unable to parse service templates file " + solutionTemplatesFname); + return; + } + + if (serverSolutionTemplates == null) { + LOG.info("Unable to parse service templates file " + solutionTemplatesFname); + return; + } + } + + void loadAuthorizedServices() { + + // get the configured path for the list of authorized services and what operations + // those services are allowed to process + + String authzServiceFname = System.getProperty(ZMSConsts.ZMS_PROP_AUTHZ_SERVICE_FNAME, + zmsRootDir + "/conf/zms_server/authorized_services.json"); + + // let's read our authorized list into a local struct + + File file = new File(authzServiceFname); + if (file.exists() == false) { + LOG.info("Authorized Service File " + authzServiceFname + " not found"); + return; + } + + Path path = Paths.get(file.toURI()); + try { + serverAuthorizedServices = JSON.fromBytes(Files.readAllBytes(path), AuthorizedServices.class); + } catch (IOException e) { + LOG.info("Unable to parse authorized service file " + authzServiceFname); + } + } + + void initObjectStore() { + + final String caller = "initstore"; + + List domains = dbService.listDomains(null, 0); + if (domains.size() > 0) { + return; + } + + String adminUserList = System.getProperty(ZMSConsts.ZMS_PROP_DOMAIN_ADMIN); + if (adminUserList == null) { + throw ZMSUtils.internalServerError("init: No ZMS admin user specified", caller); + } + + String[] users = adminUserList.split(","); + ArrayList adminUsers = new ArrayList(); + for (int i = 0; i < users.length; i++) { + String adminUser = users[i].trim(); + if (!adminUser.startsWith(userDomainPrefix)) { + throw ZMSUtils.internalServerError("init: Bad domain user name(" + adminUser + + "), must begin with (" + userDomainPrefix + ")", caller); + } + adminUsers.add(adminUser); + } + + if (!ZMSConsts.USER_DOMAIN.equals(userDomain)) { + createTopLevelDomain(null, userDomain, "The reserved domain for user authentication", + null, null, adminUsers, null, 0, null, null); + } + createTopLevelDomain(null, userDomain, "The reserved domain for user authentication", + null, null, adminUsers, null, 0, null, null); + createTopLevelDomain(null, "sys", "The reserved domain for system related information", + null, null, adminUsers, null, 0, null, null); + createSubDomain(null, "sys", "auth", "The AuthNG domain", null, null, adminUsers, + null, 0, null, null, caller); + + if (publicKey != null) { + List pubKeys = new ArrayList<>(); + pubKeys.add(new PublicKeyEntry().setId(privateKeyId).setKey(publicKey)); + ServiceIdentity id = new ServiceIdentity().setName("sys.auth.zms").setPublicKeys(pubKeys); + dbService.executePutServiceIdentity(null, SYS_AUTH, ZMS, id, null, caller); + } else { + if (LOG.isWarnEnabled()) { + LOG.warn("init: Warning: no public key, cannot register sys.auth.zms identity"); + } + } + } + + /** + * @return the ZMS Schema object, describing its API and types. + */ + public Schema schema() { + return schema; + } + + /** + * Setup a new AuditLogMsgBuilder object with common values. + **/ + static AuditLogMsgBuilder getAuditLogMsgBuilder(ResourceContext ctx, String domainName, String auditRef, + String caller, String method) { + + AuditLogMsgBuilder msgBldr = null; + try { + msgBldr = AuditLogFactory.getMsgBuilder(auditLoggerMsgBldrClass); + } catch (Exception exc) { + LOG.error("getAuditLogMsgBuilder: failed to get an AuditLogMsgBuilder. Get the default instead.", exc); + msgBldr = AuditLogFactory.getMsgBuilder(); + } + + // get the where - which means where this server is running + + msgBldr.whereIp(serverHostName).whereHttpsPort(serverHttpsPort).whereHttpPort(serverHttpPort); + msgBldr.whatDomain(domainName).why(auditRef).whatApi(caller).whatMethod(method); + + // get the 'who' and set it + + if (ctx != null) { + Principal princ = ((RsrcCtxWrapper) ctx).principal(); + if (princ != null) { + String unsignedCreds = princ.getUnsignedCredentials(); + if (unsignedCreds == null) { + StringBuilder sb = new StringBuilder(); + sb.append("who-name=").append(princ.getName()); + sb.append(",who-domain=").append(princ.getDomain()); + sb.append(",who-yrn=").append(princ.getYRN()); + List roles = princ.getRoles(); + if (roles != null && roles.size() > 0) { + sb.append(",who-roles=").append(roles.toString()); + } + unsignedCreds = sb.toString(); + } + msgBldr.who(unsignedCreds); + } + + // get the client IP + + msgBldr.clientIp(ServletRequestUtil.getRemoteAddress(ctx.request())); + } + + return msgBldr; + } + + // ----------------- the Domain interface { + + public DomainList getDomainList(ResourceContext ctx, Integer limit, String skip, String prefix, + Integer depth, String account, Integer productId, String roleMember, String roleName, + String modifiedSince) { + + final String caller = "getdomainlist"; + metric.increment(ZMSConsts.HTTP_GET); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("getdomainlist_timing", null); + + if (LOG.isDebugEnabled()) { + LOG.debug("getDomainList: limit: " + limit + " skip: " + skip + + " prefix: " + prefix + " depth: " + depth + " modifiedSince: " + modifiedSince); + } + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + if (skip != null) { + skip = skip.toLowerCase(); + } + if (prefix != null) { + prefix = prefix.toLowerCase(); + } + if (roleMember != null) { + roleMember = roleMember.toLowerCase(); + validate(roleMember, TYPE_ENTITY_NAME, caller); + } + if (roleName != null) { + roleName = roleName.toLowerCase(); + validate(roleName, TYPE_ENTITY_NAME, caller); + } + if (limit != null && limit <= 0) { + throw ZMSUtils.requestError("getDomainList: limit must be positive: " + limit, caller); + } + + long modTime = 0; + if (modifiedSince != null) { + // we only support RFC1123 format for if-modified-since format + + SimpleDateFormat dateFmt = new SimpleDateFormat(ZMSConsts.HTTP_RFC1123_DATE_FORMAT); + dateFmt.setTimeZone(TimeZone.getTimeZone(ZMSConsts.HTTP_DATE_GMT_ZONE)); + try { + Date date = dateFmt.parse(modifiedSince); + modTime = date.getTime(); + } catch (ParseException ex) { + throw ZMSUtils.requestError("getDomainList: If-Modified-Since header value must be valid RFC1123 date" + + ex.getMessage(), caller); + } + } + + // if we have account specified then we're going to ignore all + // other fields since there should only be one domain that + // matches the specified account. Otherwise, we're going to do + // the same thing for product id since there should also be one + // domain with that id. If neither one is present, then we'll + // do our regular domain list + + DomainList dlist = null; + if (account != null && !account.isEmpty()) { + dlist = dbService.lookupDomainByAccount(account); + } else if (productId != null && productId.intValue() != 0) { + dlist = dbService.lookupDomainByProductId(productId); + } else if (roleMember != null || roleName != null) { + dlist = dbService.lookupDomainByRole(roleMember, roleName); + } else { + dlist = listDomains(limit, skip, prefix, depth, modTime); + } + + metric.stopTiming(timerMetric); + return dlist; + } + + public Domain getDomain(ResourceContext ctx, String domainName) { + + final String caller = "getdomain"; + metric.increment(ZMSConsts.HTTP_GET); + + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + Object timerMetric = metric.startTiming("getdomain_timing", domainName); + + Domain domain = dbService.getDomain(domainName); + if (domain == null) { + throw ZMSUtils.notFoundError("getDomain: Domain not found: " + domainName, caller); + } + + metric.stopTiming(timerMetric); + return domain; + } + + public Domain postTopLevelDomain(ResourceContext ctx, String auditRef, TopLevelDomain detail) { + + final String caller = "posttopleveldomain"; + metric.increment(ZMSConsts.HTTP_POST); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + Domain domain = null; + try { + validate(detail, TYPE_TOP_LEVEL_DOMAIN, caller); + + String domainName = detail.getName(); + validate(domainName, TYPE_DOMAIN_NAME, caller); + + domainName = domainName.toLowerCase(); + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("posttopleveldomain_timing", domainName); + + if (domainName.indexOf('_') != -1 && !isSysAdminUser(((RsrcCtxWrapper) ctx).principal())) { + throw ZMSUtils.requestError("Domain name cannot contain underscores", caller); + } + + // verify length of domain name + + if (domainName.length() > domainNameMaxLen) { + throw ZMSUtils.requestError("Invalid Domain name: " + domainName + + " : name length cannot exceed: " + domainNameMaxLen, caller); + } + + // verify that request is properly authenticated for this request + + Principal principal = ((RsrcCtxWrapper) ctx).principal(); + verifyAuthorizedServiceOperation(principal.getAuthorizedService(), caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + AthenzObject.TOP_LEVEL_DOMAIN.convertToLowerCase(detail); + + List solutionTemplates = null; + DomainTemplateList templates = detail.getTemplates(); + if (templates != null) { + solutionTemplates = templates.getTemplateNames(); + validateSolutionTemplates(solutionTemplates, caller); + } + + // check to see if we need to validate our product id for the top + // level domains. The server code assumes that product id with + // 0 indicates no enforcement + + int productId = 0; + if (productIdSupport) { + if (detail.getYpmId() != null) { + if ((productId = detail.getYpmId().intValue()) <= 0) { + throw ZMSUtils.requestError("Product Id must be a positive integer", caller); + } + } else { + throw ZMSUtils.requestError("Product Id is required when creating top level domain", caller); + } + } + + domain = createTopLevelDomain(ctx, domainName, detail.getDescription(), + detail.getOrg(), detail.getAuditEnabled(), detail.getAdminUsers(), + detail.getAccount(), productId, solutionTemplates, auditRef); + + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + String domainName = (detail != null) ? detail.getName() : null; + auditRequestFailure(ctx, exc, domainName, domainName, caller, + ZMSConsts.HTTP_POST, null, auditRef); + throw exc; + } + + return domain; + } + + public TopLevelDomain deleteTopLevelDomain(ResourceContext ctx, String domainName, String auditRef) { + + final String caller = "deletetopleveldomain"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + domainName = domainName.toLowerCase(); + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deletetopleveldomain_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + deleteDomain(ctx, auditRef, domainName, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, domainName, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + + return null; + } + + Domain deleteDomain(ResourceContext ctx, String auditRef, String domainName, String caller) { + + DomainList subDomainList = listDomains(null, null, domainName + ".", null, 0); + if (subDomainList.getNames().size() > 0) { + throw ZMSUtils.requestError(caller + ": Cannot delete domain " + + domainName + ": " + subDomainList.getNames().size() + " subdomains of it exist", caller); + } + + Domain domain = dbService.executeDeleteDomain(ctx, domainName, auditRef, caller); + return domain; + } + + boolean isVirtualDomain(String domain) { + + // all virtual domains start with our user domain + + return domain.startsWith(userDomainPrefix); + } + + boolean hasExceededVirtualSubDomainLimit(String domain) { + + // we need to find our username which is our second + // component in the domain name - e.g. user.joe[.subdomain] + // when counting we need to make to include the trailing . + // since we're counting subdomains and we need to make sure + // not to match other users who have the same prefix + + String userDomain = null; + int idx = domain.indexOf(".", userDomainPrefix.length()); + if (idx == -1) { + userDomain = domain + "."; + } else { + userDomain = domain.substring(0, idx + 1); + } + + // retrieve the number of domains with this prefix + + DomainList dlist = listDomains(null, null, userDomain, null, 0); + if (dlist.getNames().size() < virtualDomainLimit) { + return false; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("hasExceededVirtualSubDomainLimit: subdomains with prefix " + userDomain + + ": " + dlist.getNames().size() + " while limit is: " + virtualDomainLimit); + } + + return true; + } + + public Domain postUserDomain(ResourceContext ctx, String name, String auditRef, UserDomain detail) { + + final String caller = "postuserdomain"; + metric.increment(ZMSConsts.HTTP_POST); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + validate(detail, TYPE_USER_DOMAIN, caller); + validate(name, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + name = name.toLowerCase(); + AthenzObject.USER_DOMAIN.convertToLowerCase(detail); + + metric.increment(ZMSConsts.HTTP_REQUEST, name); + metric.increment(caller, name); + Object timerMetric = metric.startTiming("postuserdomain_timing", name); + + if (detail.getName().indexOf('_') != -1 && !isSysAdminUser(((RsrcCtxWrapper) ctx).principal())) { + throw ZMSUtils.requestError("Domain name cannot contain underscores", caller); + } + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (!name.equals(detail.getName())) { + throw ZMSUtils.forbiddenError("postUserDomain: Request and detail domain names do not match", caller); + } + + // we're dealing with user's top level domain so the parent is going + // to be the user domain and the admin of the domain is the user + + List adminUsers = new ArrayList<>(); + adminUsers.add(userDomainPrefix + name); + + List solutionTemplates = null; + DomainTemplateList templates = detail.getTemplates(); + if (templates != null) { + solutionTemplates = templates.getTemplateNames(); + validateSolutionTemplates(solutionTemplates, caller); + } + + Domain domain = createSubDomain(ctx, userDomain, detail.getName(), detail.getDescription(), + detail.getOrg(), detail.getAuditEnabled(), adminUsers, detail.getAccount(), 0, + solutionTemplates, auditRef, caller); + + metric.stopTiming(timerMetric); + return domain; + } + + public Domain postSubDomain(ResourceContext ctx, String parent, String auditRef, SubDomain detail) { + + final String caller = "postsubdomain"; + metric.increment(ZMSConsts.HTTP_POST); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + validate(detail, TYPE_SUB_DOMAIN, caller); + validate(parent, TYPE_DOMAIN_NAME, caller); + validate(detail.getName(), TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + parent = parent.toLowerCase(); + AthenzObject.SUB_DOMAIN.convertToLowerCase(detail); + + metric.increment(ZMSConsts.HTTP_REQUEST, parent); + metric.increment(caller, parent); + Object timerMetric = metric.startTiming("postsubdomain_timing", parent); + + if (detail.getName().indexOf('_') != -1 && !isSysAdminUser(((RsrcCtxWrapper) ctx).principal())) { + throw ZMSUtils.requestError("Domain name cannot contain underscores", caller); + } + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (!parent.equals(detail.getParent())) { + throw ZMSUtils.forbiddenError("postSubDomain: Request and detail parent domains do not match", caller); + } + + // if we're dealing with virtual/home domains (in the user's own namespace) + // and we don't have unlimited support for virtual domains then we need to + // make sure we don't exceed our configured number of virtual subdomains + // allowed per user + + if (virtualDomainLimit != 0 && isVirtualDomain(parent) && hasExceededVirtualSubDomainLimit(parent)) { + throw ZMSUtils.forbiddenError("postSubDomain: Exceeding the configured number of virtual subdomains", caller); + } + + List solutionTemplates = null; + DomainTemplateList templates = detail.getTemplates(); + if (templates != null) { + solutionTemplates = templates.getTemplateNames(); + validateSolutionTemplates(solutionTemplates, caller); + } + + // while it's not required for sub domains to have product ids + // we're going to store it in case there is a requirement to + // generate reports based on product ids even for subdomains + // unlike top level domains, passing 0 is ok here as it indicates + // that there is no product id + + int productId = 0; + if (productIdSupport) { + if (detail.getYpmId() != null) { + if ((productId = detail.getYpmId().intValue()) < 0) { + throw ZMSUtils.requestError("Product Id must be a positive integer", caller); + } + } + } + + Domain domain = createSubDomain(ctx, detail.getParent(), detail.getName(), detail.getDescription(), + detail.getOrg(), detail.getAuditEnabled(), detail.getAdminUsers(), detail.getAccount(), + productId, solutionTemplates, auditRef, caller); + + metric.stopTiming(timerMetric); + return domain; + } + + boolean isSysAdminUser(Principal principal) { + + // verify we're dealing with system administrator + // authorize ("CREATE", "sys.auth:domain"); + + AthenzDomain domain = getAthenzDomain(SYS_AUTH, true); + if (domain == null) { + return false; + } + + // evaluate our domain's roles and policies to see if access + // is allowed or not for the given operation and resource + // our action are always converted to lowercase + + String resource = SYS_AUTH + ":domain"; + AccessStatus accessStatus = evaluateAccess(domain, principal.getYRN(), "create", + resource, null, null); + + if (accessStatus == AccessStatus.ALLOWED) { + return true; + } else { + return false; + } + } + + boolean isAllowedResourceLookForAllUsers(Principal principal) { + + // the authorization policy resides in offical sys.auth domain + + AthenzDomain domain = getAthenzDomain(SYS_AUTH, true); + if (domain == null) { + return false; + } + + // evaluate our domain's roles and policies to see if access + // is allowed or not for the given operation and resource + // our action are always converted to lowercase + + String resource = SYS_AUTH + ":resource-lookup-all"; + AccessStatus accessStatus = evaluateAccess(domain, principal.getYRN(), "access", + resource, null, null); + + if (accessStatus == AccessStatus.ALLOWED) { + return true; + } else { + return false; + } + } + + public SubDomain deleteSubDomain(ResourceContext ctx, String parent, String name, String auditRef) { + + final String caller = "deletesubdomain"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + parent = parent.toLowerCase(); + name = name.toLowerCase(); + String domainName = parent + "." + name; + + metric.increment(ZMSConsts.HTTP_REQUEST, parent); + metric.increment(caller, parent); + Object timerMetric = metric.startTiming("deletesubdomain_timing", parent); + + try { + validate(parent, TYPE_DOMAIN_NAME, caller); + validate(name, TYPE_SIMPLE_NAME, caller); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + deleteDomain(ctx, auditRef, domainName, caller); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, domainName, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + + metric.stopTiming(timerMetric); + return null; + } + + public UserDomain deleteUserDomain(ResourceContext ctx, String name, String auditRef) { + + final String caller = "deleteuserdomain"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(name, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + name = name.toLowerCase(); + metric.increment(ZMSConsts.HTTP_REQUEST, name); + metric.increment(caller, name); + Object timerMetric = metric.startTiming("deleteuserdomain_timing", name); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + String domainName = userDomainPrefix + name; + deleteDomain(ctx, auditRef, domainName, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, name, name, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + + return null; + } + + public Domain putDomainMeta(ResourceContext ctx, String domainName, String auditRef, DomainMeta meta) { + + final String caller = "putdomainmeta"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(meta, TYPE_DOMAIN_META, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putdomainmeta_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (LOG.isDebugEnabled()) { + LOG.debug("putDomainMeta: name=" + domainName + ", meta=" + meta); + } + + // for top level domains, verify the meta data has a product id and that it is not used by + // any other domain(other than this one) + + if (productIdSupport && domainName.indexOf('.') == -1) { + + // if this productId is already used by any domain it will be + // seen in dbService and exception thrown + + Integer productId = meta.getYpmId(); + if (productId == null) { + throw ZMSUtils.requestError("Unique Product Id must be specified for top level domain", caller); + } + } + + dbService.executePutDomainMeta(ctx, domainName, meta, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, domainName, caller, ZMSConsts.HTTP_PUT, null, auditRef); + throw exc; + } + + return null; + } + + void validateSolutionTemplates(List templateNames, String caller) { + for (String templateName : templateNames) { + if (!serverSolutionTemplates.contains(templateName)) { + throw ZMSUtils.notFoundError("validateSolutionTemplates: Template not found: " + templateName, caller); + } + } + } + + public DomainTemplateList getDomainTemplateList(ResourceContext ctx, String domainName) { + + final String caller = "getdomaintemplatelist"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getdomaintemplatelist_timing", domainName); + + DomainTemplateList domainTemplateList = dbService.listDomainTemplates(domainName); + if (domainTemplateList == null) { + throw ZMSUtils.notFoundError("getDomainTemplateList: Domain not found: '" + domainName + "'", caller); + } + + metric.stopTiming(timerMetric); + return domainTemplateList; + } + + public DomainTemplate putDomainTemplate(ResourceContext ctx, String domainName, String auditRef, + DomainTemplate templates) { + + final String caller = "putdomaintemplate"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(templates, TYPE_DOMAIN_TEMPLATE, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + AthenzObject.DOMAIN_TEMPLATE.convertToLowerCase(templates); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putdomaintemplate_timing", domainName); + + // verify that all template names are valid + + List templateNames = templates.getTemplateNames(); + if (templateNames == null || templateNames.size() == 0) { + throw ZMSUtils.requestError("putDomainTemplate: No templates specified", caller); + } + validateSolutionTemplates(templateNames, caller); + + // verify that request is properly authenticated for this request + // Make sure each template name is verified + + for (String templateName : templates.getTemplateNames()) { + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), + caller, "name", templateName); + } + + dbService.executePutDomainTemplate(ctx, domainName, templateNames, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + String auditDetails = auditListItems("caller specified templates", templates.getTemplateNames()); + auditRequestFailure(ctx, exc, domainName, domainName, caller, ZMSConsts.HTTP_PUT, + auditDetails, auditRef); + throw exc; + } + + return null; + } + + public DomainTemplate deleteDomainTemplate(ResourceContext ctx, String domainName, String templateName, String auditRef) { + + final String caller = "deletedomaintemplate"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deletedomaintemplate_timing", domainName); + + if (LOG.isDebugEnabled()) { + LOG.debug("deleteDomainTemplate: domain=" + domainName + ", template=" + templateName); + } + + // verify the template name is valid + + if (templateName == null || templateName.length() == 0) { + throw ZMSUtils.requestError("deleteDomainTemplate: No template specified", caller); + } + + templateName = templateName.toLowerCase(); + List templateNames = new ArrayList(); + templateNames.add(templateName); + validateSolutionTemplates(templateNames, caller); + + dbService.executeDeleteDomainTemplate(ctx, domainName, templateName, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified templatename=(").append(templateName).append(")"); + auditRequestFailure(ctx, exc, domainName, domainName, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + // ----------------- end of the Domain interface } + + Principal createPrincipalForName(String principalName) { + + String domain = null; + String name = null; + + /* if we have no . in the principal name we're going to default to standard user */ + + int idx = principalName.lastIndexOf('.'); + if (idx == -1) { + domain = userDomain; + name = principalName; + } else { + domain = principalName.substring(0, idx); + name = principalName.substring(idx + 1); + } + + return SimplePrincipal.create(domain, name, (String) null); + } + + boolean validRoleTokenAccess(String trustDomain, String domainYRN, String principalYRN) { + + if (trustDomain != null) { + if (LOG.isWarnEnabled()) { + LOG.warn("validRoleTokenAccess: Cannot access cross-domain resources with RoleToken"); + } + return false; + } + + // for Role tokens we don't have a name component in the principal + // so the principalYRN should be the same as the domain value + // thus it must match the domainYRN from the resource + + if (!domainYRN.equalsIgnoreCase(principalYRN)) { + if (LOG.isWarnEnabled()) { + LOG.warn("validRoleTokenAccess: resource domain YRN does not match RoleToken domain"); + } + return false; + } + + return true; + } + + AthenzDomain getAthenzDomain(String domainName, boolean ignoreExceptions) { + + AthenzDomain domain = null; + try { + domain = dbService.getAthenzDomain(domainName); + } catch (ResourceException ex) { + + if (LOG.isDebugEnabled()) { + LOG.debug("getAthenzDomain failure: " + ex.getMessage()); + } + + if (!ignoreExceptions) { + if (ex.getCode() != ResourceException.NOT_FOUND) { + throw ex; + } + } + } + return domain; + } + + AthenzDomain retrieveAccessDomain(String domainName, Principal principal) { + + if (LOG.isDebugEnabled()) { + LOG.debug("retrieveAccessDomain: identityYRN: " + principal.getYRN() + + " domain: " + domainName); + } + + AthenzDomain domain = getAthenzDomain(domainName, false); + if (domain != null) { + return domain; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("retrieveAccessDomain: domain not found, looking for virtual domain"); + } + + // if we don't have virtual/home domains enabled then no need + // to continue further + + if (!virtualDomainSupport) { + return null; + } + + if (principal.getDomain() == null) { + return null; + } + + if (!principal.getYRN().equals(domainName)) { + return null; + } + + return virtualHomeDomain(principal); + } + + AccessStatus evaluateAccess(AthenzDomain domain, String identityYRN, String action, String resource, + List authenticatedRoles, String trustDomain) { + + AccessStatus accessStatus = AccessStatus.DENIED; + + List policies = domain.getPolicies(); + List roles = domain.getRoles(); + + for (Policy policy : policies) { + + if (LOG.isDebugEnabled()) { + LOG.debug("evaluateAccess: processing policy: " + policy.getName()); + } + + // we are going to process all the assertions defined in this + // policy. As soon as we get a match for an assertion that + // denies access, we're going to return that result. If we + // get a match for an assertion that allows access we're + // going to remember that result and continue looking at + // all the assertions in case there is something else that + // explicitly denies access + + List assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + + for (Assertion assertion : assertions) { + + // get the effect for the assertion which is set + // as allowed by default + + AssertionEffect effect = assertion.getEffect(); + if (effect == null) { + effect = AssertionEffect.ALLOW; + } + + // if we have already matched an allow assertion then + // we'll automatically skip any assertion that has + // allow effect since there is no point of matching it + + if (accessStatus == AccessStatus.ALLOWED && effect == AssertionEffect.ALLOW) { + continue; + } + + // if no match then process the next assertion + + if (!assertionMatch(assertion, identityYRN, action, resource, roles, authenticatedRoles, trustDomain)) { + continue; + } + + // if the assertion has matched and the effect is deny + // then we're going to return right away otherwise we'll + // set our return allow matched flag to true and continue + // processing other assertions + + if (effect == AssertionEffect.DENY) { + return AccessStatus.DENIED; + } + + accessStatus = AccessStatus.ALLOWED; + } + } + + return accessStatus; + } + + public boolean access(String action, String resource, Principal principal, String trustDomain) { + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + resource = resource.toLowerCase(); + if (trustDomain != null) { + trustDomain = trustDomain.toLowerCase(); + } + action = action.toLowerCase(); + + // if the resource starts with the user domain and the environment is using + // a different domain name we'll dynamically update the resource value + + if (!userDomain.equals(ZMSConsts.USER_DOMAIN) && resource.startsWith(ZMSConsts.USER_DOMAIN_PREFIX)) { + resource = userDomain + resource.substring(ZMSConsts.USER_DOMAIN_PREFIX.length()); + } + + if (LOG.isDebugEnabled()) { + LOG.debug("access:(" + action + ", " + resource + ", " + principal + ", " + trustDomain + ")"); + } + + // check to see if the authority is allowed to be processed in + // authorization checks. If this value is false then the principal + // must get a usertoken from ZMS first and the submit the request + // with that token + + if (!authorityAuthorizationAllowed(principal)) { + LOG.error("Authority is not allowed to support authorization checks"); + return false; + } + + // retrieve our domain based on resource and action/trustDomain pair + // we want to provider better error reporting to the users so if we get a + // request where the domain is not found instead of just returning 403 + // forbidden (which is confusing since it assumes the user doesn't have + // access as oppose to possible mistype of the domain name by the user) + // we want to return 404 not found. The athenz server common has special handling + // for rest.ResourceExceptions so we'll throw that exception in this + // special case of not found domains. + + String domainName = retrieveResourceDomain(resource, action, trustDomain); + if (domainName == null) { + throw new com.yahoo.athenz.common.server.rest.ResourceException(ResourceException.NOT_FOUND, "Domain not found"); + } + AthenzDomain domain = retrieveAccessDomain(domainName, principal); + if (domain == null) { + throw new com.yahoo.athenz.common.server.rest.ResourceException(ResourceException.NOT_FOUND, "Domain not found"); + } + + AccessStatus accessStatus = hasAccess(domain, domainName, action, resource, principal, trustDomain); + if (accessStatus == AccessStatus.ALLOWED) { + return true; + } + + return false; + } + + boolean authorityAuthorizationAllowed(Principal principal) { + + Authority authority = principal.getAuthority(); + if (authority == null) { + return true; + } + + return authority.allowAuthorization(); + } + + String retrieveResourceDomain(String resource, String op, String trustDomain) { + + // special handling for ASSUME_ROLE assertions. Since any assertion with + // that action refers to a resource in another domain, there is no point + // to retrieve the domain name from the resource. In these cases the caller + // must specify the trust domain attribute so we'll use that instead and + // if one is not specified then we'll fall back to using the domain name + // from the resource + + String domainName = null; + if (ZMSConsts.ACTION_ASSUME_ROLE.equalsIgnoreCase(op) && trustDomain != null) { + domainName = trustDomain; + } else { + domainName = yrnDomain(resource); + } + return domainName; + } + + AccessStatus hasAccess(AthenzDomain domain, String domainName, String action, String resource, + Principal principal, String trustDomain) { + + String identityYRN = principal.getYRN(); + + // if we're dealing with an access check based on a Role token then + // make sure it's valid before processing it + + List authenticatedRoles = principal.getRoles(); + if (authenticatedRoles != null && !validRoleTokenAccess(trustDomain, domainName, identityYRN)) { + return AccessStatus.DENIED_INVALID_ROLE_TOKEN; + } + + // evaluate our domain's roles and policies to see if access + // is allowed or not for the given operation and resource + + return evaluateAccess(domain, identityYRN, action, resource, authenticatedRoles, trustDomain); + } + + public Access getAccessExt(ResourceContext ctx, String action, String resource, String trustDomain, + String checkPrincipal) { + + // for now we'll just fall back to our constraind version + + return getAccess(ctx, action, resource, trustDomain, checkPrincipal); + } + + public Access getAccess(ResourceContext ctx, String action, String resource, String trustDomain, + String checkPrincipal) { + + final String caller = "getaccess"; + metric.increment(ZMSConsts.HTTP_GET); + + Principal principal = ((RsrcCtxWrapper) ctx).principal(); + if (LOG.isDebugEnabled()) { + LOG.debug("getAccess:(" + action + ", " + resource + ", " + principal + + ", " + trustDomain + ", " + checkPrincipal + ")"); + } + + validate(action, TYPE_COMPOUND_NAME, caller); + validate(resource, TYPE_YRN, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + action = action.toLowerCase(); + resource = resource.toLowerCase(); + if (checkPrincipal != null) { + checkPrincipal = checkPrincipal.toLowerCase(); + } + if (trustDomain != null) { + trustDomain = trustDomain.toLowerCase(); + } + + // retrieve the domain based on our resource and action/trustDomain pair + + String domainName = retrieveResourceDomain(resource, action, trustDomain); + if (domainName == null) { + metric.increment(ZMSConsts.HTTP_REQUEST, ZMSConsts.ZMS_INVALID_DOMAIN); + metric.increment(caller, ZMSConsts.ZMS_INVALID_DOMAIN); + throw ZMSUtils.notFoundError("getAccess: Unable to extract resource domain", caller); + } + AthenzDomain domain = retrieveAccessDomain(domainName, principal); + if (domain == null) { + metric.increment(ZMSConsts.HTTP_REQUEST, ZMSConsts.ZMS_UNKNOWN_DOMAIN); + metric.increment(caller, ZMSConsts.ZMS_UNKNOWN_DOMAIN); + throw ZMSUtils.notFoundError("getAccess: Resource Domain not found: '" + domainName + "'", caller); + } + + // start our counter with domain dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getaccess_timing", domainName); + + /* if the check principal is given then we need to carry out the access + * check against that principal */ + + if (checkPrincipal != null) { + principal = createPrincipalForName(checkPrincipal); + if (principal == null) { + throw ZMSUtils.unauthorizedError("getAccess: Invalid check principal value specified", caller); + } + } + + boolean accessAllowed = false; + AccessStatus accessStatus = hasAccess(domain, domainName, action, resource, principal, trustDomain); + if (accessStatus == AccessStatus.ALLOWED) { + accessAllowed = true; + } + Access access = new Access().setGranted(accessAllowed); + + metric.stopTiming(timerMetric); + return access; + } + + // ----------------- the Entity interface + + boolean equalToOrPrefixedBy(String pattern, String name) { + if (name.equals(pattern)) { + return true; + } + if (name.startsWith(pattern + ".")) { + return true; + } + return false; + } + + void validateEntity(String entityName, Entity entity) { + + final String caller = "validateentity"; + + if (!entityName.equals(entity.getName())) { + throw ZMSUtils.requestError("validateEntity: Entity name mismatch: " + entityName + " != " + entity.getName(), caller); + } + if (entity.getValue() == null) { + throw ZMSUtils.requestError("validateEntity: Entity value is empty: " + entityName, caller); + } + } + + void checkReservedEntityName(String en) { + + final String caller = "checkreservedentityname"; + + final String [] reservedList = {META_FIELD, DOMAIN_FIELD, ROLE_FIELD, POLICY_FIELD, SERVICE_FIELD, TEMPLATE_FIELD}; + for (String reservedName : reservedList) { + if (equalToOrPrefixedBy(reservedName, en)) { + throw ZMSUtils.requestError("checkReservedEntityName: Bad entity name: reserved name or prefix: " + en, caller); + } + } + } + + public Entity putEntity(ResourceContext ctx, String domainName, String entityName, String auditRef, Entity resource) { + + final String caller = "putentity"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(entityName, TYPE_ENTITY_NAME, caller); + checkReservedEntityName(entityName); + validateEntity(entityName, resource); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + entityName = entityName.toLowerCase(); + AthenzObject.ENTITY.convertToLowerCase(resource); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putentity_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + dbService.executePutEntity(ctx, domainName, entityName, resource, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, entityName, caller, ZMSConsts.HTTP_PUT, null, auditRef); + throw exc; + } + + return null; + } + + @Override + public EntityList getEntityList(ResourceContext ctx, String domainName) { + + final String caller = "getentitylist"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getentitylist_timing", domainName); + + EntityList result = new EntityList(); + List names = dbService.listEntities(domainName); + result.setNames(names); + + metric.stopTiming(timerMetric); + return result; + } + + public Entity getEntity(ResourceContext ctx, String domainName, String entityName) { + + final String caller = "getentity"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(entityName, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + entityName = entityName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getentity_timing", null); + + Entity entity = dbService.getEntity(domainName, entityName); + if (entity == null) { + throw ZMSUtils.notFoundError("getEntity: Entity not found: '" + + ZMSUtils.entityResourceName(domainName, entityName) + "'", caller); + } + + metric.stopTiming(timerMetric); + return entity; + } + + public Entity deleteEntity(ResourceContext ctx, String domainName, String entityName, String auditRef) { + + final String caller = "deleteentity"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(entityName, TYPE_ENTITY_NAME, caller); + checkReservedEntityName(entityName); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + entityName = entityName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deleteentity_timing", null); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + dbService.executeDeleteEntity(ctx, domainName, entityName, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, entityName, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + return null; + } + + public ServerTemplateList getServerTemplateList(ResourceContext ctx) { + + final String caller = "getservertemplatelist"; + metric.increment(ZMSConsts.HTTP_GET); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("getservertemplatelist_timing", null); + + ServerTemplateList result = new ServerTemplateList(); + result.setTemplateNames(new ArrayList(serverSolutionTemplates.names())); + + metric.stopTiming(timerMetric); + return result; + } + + public Template getTemplate(ResourceContext ctx, String templateName) { + + final String caller = "gettemplate"; + metric.increment(ZMSConsts.HTTP_GET); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("gettemplate_timing", null); + + validate(templateName, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + templateName = templateName.toLowerCase(); + Template template = serverSolutionTemplates.get(templateName); + if (template == null) { + throw ZMSUtils.notFoundError("getTemplate: Template not found: '" + templateName + "'", caller); + } + + metric.stopTiming(timerMetric); + return template; + } + + // ----------------- the Role interface + + public RoleList getRoleList(ResourceContext ctx, String domainName, Integer limit, String skip) { + + final String caller = "getrolelist"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + if (skip != null) { + skip = skip.toLowerCase(); + } + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getrolelist_timing", domainName); + + RoleList result = new RoleList(); + + List names = new ArrayList(); + String next = processListRequest(domainName, AthenzObject.ROLE, limit, skip, names); + result.setNames(names); + if (next != null) { + result.setNext(next); + } + + metric.stopTiming(timerMetric); + return result; + } + + List setupRoleList(AthenzDomain domain, Boolean members) { + + // if we're asked to return the members as well then we + // just need to return the data as is without any modifications + + List roles = null; + if (members != null && members.booleanValue()) { + roles = domain.getRoles(); + } else { + roles = new ArrayList<>(); + for (Role role : domain.getRoles()) { + Role newRole = new Role() + .setName(role.getName()) + .setModified(role.getModified()) + .setTrust(role.getTrust()); + roles.add(newRole); + } + } + + return roles; + } + + public Roles getRoles(ResourceContext ctx, String domainName, Boolean members) { + + final String caller = "getroles"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getroles_timing", domainName); + + Roles result = new Roles(); + + AthenzDomain domain = getAthenzDomain(domainName, false); + if (domain == null) { + throw ZMSUtils.notFoundError("getRoles: Domain not found: '" + domainName + "'", caller); + } + + result.setList(setupRoleList(domain, members)); + metric.stopTiming(timerMetric); + return result; + } + + @Override + public Role getRole(ResourceContext ctx, String domainName, String roleName, + Boolean auditLog, Boolean expand) { + + final String caller = "getrole"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getrole_timing", domainName); + + Role role = dbService.getRole(domainName, roleName, auditLog, expand); + if (role == null) { + throw ZMSUtils.notFoundError("getRole: Role not found: '" + + ZMSUtils.roleResourceName(domainName, roleName) + "'", caller); + } + + metric.stopTiming(timerMetric); + return role; + } + + String getNormalizedMember(String member) { + + String[] yrnParts = member.split(":"); + if (yrnParts.length != 2) { + return member; + } + + // we are going we normalize and use the common name to + // represent our principals. The changes are: + // user:hga will be replaced with user.hga + // coretech:service.storage will be replaced with coretech.storage + + String normalizedMember = member; + if (yrnParts[0].equalsIgnoreCase(userDomain)) { + normalizedMember = userDomainPrefix + yrnParts[1]; + } else if (yrnParts[1].startsWith(SERVICE_PREFIX)) { + normalizedMember = yrnParts[0] + yrnParts[1].substring(SERVICE_PREFIX.length() - 1); + } + + return normalizedMember; + } + + void normalizeRoleMembers(Role role) { + + List members = role.getMembers(); + if (members == null || members.size() == 0) { + return; + } + + Set normalizedMembers = new HashSet<>(); + String normalizedMember = null; + for (String member : members) { + + normalizedMember = getNormalizedMember(member); + + // we'll automatically ignore any duplicates + + normalizedMembers.add(normalizedMember); + } + + role.setMembers(new ArrayList(normalizedMembers)); + return; + } + + boolean isConsistentRoleName(final String domainName, final String roleName, Role role) { + + String yrn = ZMSUtils.roleResourceName(domainName, roleName); + + // first lets assume we have the expected name specified in the role + + if (yrn.equals(role.getName())) { + return true; + } + + // if not check to see if the role contains the relative local name + // part only instead of the expected yrn and update accordingly + + if (roleName.equals(role.getName())) { + role.setName(yrn); + return true; + } + + // we have a mismatch + + return false; + } + + public Role putRole(ResourceContext ctx, String domainName, String roleName, String auditRef, Role role) { + + final String caller = "putrole"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + validate(role, TYPE_ROLE, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + AthenzObject.ROLE.convertToLowerCase(role); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putrole_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // verify the role name in the URI and request are consistent + + if (!isConsistentRoleName(domainName, roleName, role)) { + throw ZMSUtils.requestError("putRole: Inconsistent role names - expected: " + + ZMSUtils.roleResourceName(domainName, roleName) + ", actual: " + + role.getName(), caller); + } + + // if this is a delegated role then validate that it's not + // delegated back to itself and there are no members since + // those 2 fields are mutually exclusive + + if (role.getTrust() != null && !role.getTrust().isEmpty()) { + + if (role.getMembers() != null && !role.getMembers().isEmpty()) { + throw ZMSUtils.requestError("putRole: Role cannot have both members and delegated domain set", caller); + } + + if (domainName.equals(role.getTrust())) { + throw ZMSUtils.requestError("putRole: Role cannot be delegated to itself", caller); + } + } + + // normalize and remove duplicate members + + normalizeRoleMembers(role); + + // process our request + + dbService.executePutRole(ctx, domainName, roleName, role, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, roleName, caller, ZMSConsts.HTTP_PUT, null, auditRef); + throw exc; + } + + return null; + } + + public Role deleteRole(ResourceContext ctx, String domainName, String roleName, String auditRef) { + + final String caller = "deleterole"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deleterole_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + /* we are not going to allow any user to delete + * the admin role and policy since those are required + * for standard domain operations */ + + if (roleName.equalsIgnoreCase(ADMIN_ROLE_NAME)) { + throw ZMSUtils.requestError("deleteRole: admin role cannot be deleted", caller); + } + + dbService.executeDeleteRole(ctx, domainName, roleName, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, roleName, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + + return null; + } + + boolean isMemberOfRole(Role role, String member) { + + if (role.getMembers() == null) { + return false; + } + + Set members = new HashSet(role.getMembers()); + return members.contains(member); + } + + public Membership getMembership(ResourceContext ctx, String domainName, String roleName, String memberName) { + + final String caller = "getmembership"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + validate(memberName, TYPE_RESOURCE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + memberName = memberName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getmembership_timing", domainName); + + Membership result = dbService.getMembership(domainName, roleName, memberName); + + metric.stopTiming(timerMetric); + return result; + } + + public Membership putMembership(ResourceContext ctx, String domainName, String roleName, + String memberName, String auditRef, Membership membership) { + + final String caller = "putmembership"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + validate(memberName, TYPE_RESOURCE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + memberName = memberName.toLowerCase(); + AthenzObject.MEMBERSHIP.convertToLowerCase(membership); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putmembership_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), + caller, "role", roleName); + + // verify that the member name in the URI and object provided match + + if (!memberName.equals(membership.getMemberName())) { + throw ZMSUtils.requestError("putMembership: Member name in URI and Membership object do not match", caller); + } + + // role name is optional so we'll verify only if the value is present in the object + + if (membership.getRoleName() != null && !roleName.equals(membership.getRoleName())) { + throw ZMSUtils.requestError("putMembership: Role name in URI and Membership object do not match", caller); + } + + // add the member to the specified role + + dbService.executePutMembership(ctx, domainName, roleName, getNormalizedMember(memberName), auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified memberName=(").append(memberName).append(')'); + auditRequestFailure(ctx, exc, domainName, roleName, caller, ZMSConsts.HTTP_PUT, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + public Membership deleteMembership(ResourceContext ctx, String domainName, String roleName, + String memberName, String auditRef) { + + final String caller = "deletemembership"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + validate(memberName, TYPE_RESOURCE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + memberName = memberName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deletemembership_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + String normalizedMember = getNormalizedMember(memberName); + dbService.executeDeleteMembership(ctx, domainName, roleName, normalizedMember, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified memberName=(").append(memberName).append(')'); + auditRequestFailure(ctx, exc, domainName, roleName, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + boolean hasExceededListLimit(Integer limit, int count) { + + if (limit == null) { + return false; + } + + if (limit > 0 && count > limit) { + return true; + } else { + return false; + } + } + + /** + * process the list request for the given object type - e.g. role, policy, etc + * if the limit is specified and we have reached that limit then return + * the name of the object that should be set at the next item for the + * subsequent list operation. + */ + String processListRequest(String domainName, AthenzObject objType, Integer limit, + String skip, List names) { + + switch (objType) { + case ROLE: + names.addAll(dbService.listRoles(domainName)); + break; + case POLICY: + names.addAll(dbService.listPolicies(domainName)); + break; + case SERVICE_IDENTITY: + names.addAll(dbService.listServiceIdentities(domainName)); + break; + default: + return null; + } + + int count = names.size(); + if (skip != null) { + for (int i = 0; i < count; i++) { + String name = names.get(i); + if (skip.equals(name)) { + names.subList(0, i + 1).clear(); + count = names.size(); + break; + } + } + } + + String next = null; + if (hasExceededListLimit(limit, count)) { + names.subList(limit, count).clear(); + next = names.get(limit - 1); + } + + return next; + } + + // ----------------- the Policy interface + + public PolicyList getPolicyList(ResourceContext ctx, String domainName, Integer limit, String skip) { + + final String caller = "getpolicylist"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + if (skip != null) { + skip = skip.toLowerCase(); + } + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getpolicylist_timing", domainName); + + List names = new ArrayList(); + String next = processListRequest(domainName, AthenzObject.POLICY, limit, skip, names); + PolicyList result = new PolicyList().setNames(names); + if (next != null) { + result.setNext(next); + } + + metric.stopTiming(timerMetric); + return result; + } + + List setupPolicyList(AthenzDomain domain, Boolean assertions) { + + // if we're asked to return the assertions as well then we + // just need to return the data as is without any modifications + + List policies = null; + if (assertions != null && assertions.booleanValue()) { + policies = domain.getPolicies(); + } else { + policies = new ArrayList<>(); + for (Policy policy : domain.getPolicies()) { + Policy newPolicy = new Policy() + .setName(policy.getName()) + .setModified(policy.getModified()); + policies.add(newPolicy); + } + } + + return policies; + } + + public Policies getPolicies(ResourceContext ctx, String domainName, Boolean assertions) { + + final String caller = "getpolicies"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getpolicies_timing", domainName); + + Policies result = new Policies(); + + AthenzDomain domain = getAthenzDomain(domainName, false); + if (domain == null) { + throw ZMSUtils.notFoundError("getPolicies: Domain not found: '" + domainName + "'", caller); + } + + result.setList(setupPolicyList(domain, assertions)); + metric.stopTiming(timerMetric); + return result; + } + + public Policy getPolicy(ResourceContext ctx, String domainName, String policyName) { + + final String caller = "getpolicy"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(policyName, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + policyName = policyName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getpolicy_timing", domainName); + + Policy policy = dbService.getPolicy(domainName, policyName); + if (policy == null) { + throw ZMSUtils.notFoundError("getPolicy: Policy not found: '" + + ZMSUtils.policyResourceName(domainName, policyName) + "'", caller); + } + + metric.stopTiming(timerMetric); + return policy; + } + + public Assertion getAssertion(ResourceContext ctx, String domainName, String policyName, + Long assertionId) { + + final String caller = "getassertion"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(policyName, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + policyName = policyName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getassertion_timing", domainName); + + Assertion assertion = dbService.getAssertion(domainName, policyName, assertionId); + if (assertion == null) { + throw ZMSUtils.notFoundError("getAssertion: Assertion not found: '" + + ZMSUtils.policyResourceName(domainName, policyName) + "' Assertion: '" + + assertionId + "'", caller); + } + + metric.stopTiming(timerMetric); + return assertion; + } + + public Assertion putAssertion(ResourceContext ctx, String domainName, String policyName, + String auditRef, Assertion assertion) { + + final String caller = "putassertion"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(policyName, TYPE_COMPOUND_NAME, caller); + validate(assertion, TYPE_ASSERTION, caller); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + policyName = policyName.toLowerCase(); + AthenzObject.ASSERTION.convertToLowerCase(assertion); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putassertion_timing", domainName); + + // we are not going to allow any user to update + // the admin policy since that is required + // for standard domain operations */ + + if (policyName.equalsIgnoreCase(ADMIN_POLICY_NAME)) { + throw ZMSUtils.requestError("putAssertion: admin policy cannot be modified", caller); + } + + // validate to make sure we have expected values for assertion fields + + validatePolicyAssertion(assertion, caller); + + dbService.executePutAssertion(ctx, domainName, policyName, assertion, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, policyName, caller, ZMSConsts.HTTP_PUT, null, auditRef); + throw exc; + } + + return assertion; + } + + public Assertion deleteAssertion(ResourceContext ctx, String domainName, String policyName, + Long assertionId, String auditRef) { + + final String caller = "deleteassertion"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(policyName, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + policyName = policyName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deleteassertion_timing", domainName); + + // we are not going to allow any user to update + // the admin policy since that is required + // for standard domain operations */ + + if (policyName.equalsIgnoreCase(ADMIN_POLICY_NAME)) { + throw ZMSUtils.requestError("deleteAssertion: admin policy cannot be modified", caller); + } + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + dbService.executeDeleteAssertion(ctx, domainName, policyName, assertionId, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append("assertionId=(").append(assertionId).append(')'); + auditRequestFailure(ctx, exc, domainName, policyName, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + void validatePolicyAssertions(List assertions, String caller) { + + if (assertions == null) { + return; + } + + for (Assertion assertion : assertions) { + validatePolicyAssertion(assertion, caller); + } + } + + void validatePolicyAssertion(Assertion assertion, String caller) { + + // extract the domain name from the resource + + String resource = assertion.getResource(); + int idx = resource.indexOf(':'); + if (idx == -1) { + throw ZMSUtils.requestError("Missing domain name from assertion resource: " + + resource, caller); + } + + // we need to validate our domain name with special + // case of * that is allowed to match any domain + + String domainName = resource.substring(0, idx); + if (!domainName.equals("*")) { + validate(domainName, TYPE_DOMAIN_NAME, caller); + } + } + + boolean isConsistentPolicyName(final String domainName, final String policyName, Policy policy) { + + String yrn = ZMSUtils.policyResourceName(domainName, policyName); + + // first lets assume we have the expected name specified in the policy + + if (yrn.equals(policy.getName())) { + return true; + } + + // if not check to see if the policy contains the relative local name + // part only instead of the expected yrn and update accordingly + + if (policyName.equals(policy.getName())) { + policy.setName(yrn); + return true; + } + + // we have a mismatch + + return false; + } + + public Policy putPolicy(ResourceContext ctx, String domainName, String policyName, String auditRef, Policy policy) { + + final String caller = "putpolicy"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(policyName, TYPE_COMPOUND_NAME, caller); + validate(policy, TYPE_POLICY, caller); + + // verify that request is properly authenticated for this request + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + policyName = policyName.toLowerCase(); + AthenzObject.POLICY.convertToLowerCase(policy); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putpolicy_timing", domainName); + + // we are not going to allow any user to update + // the admin policy since that is required + // for standard domain operations */ + + if (policyName.equalsIgnoreCase(ADMIN_POLICY_NAME)) { + throw ZMSUtils.requestError("putPolicy: admin policy cannot be modified", caller); + } + + // verify the policy name in the URI and request are consistent + + if (!isConsistentPolicyName(domainName, policyName, policy)) { + throw ZMSUtils.requestError("putPolicy: Inconsistent policy names - expected: " + + ZMSUtils.policyResourceName(domainName, policyName) + ", actual: " + + policy.getName(), caller); + } + + // validate to make sure we have expected values for assertion fields + + validatePolicyAssertions(policy.getAssertions(), caller); + + dbService.executePutPolicy(ctx, domainName, policyName, policy, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, policyName, caller, ZMSConsts.HTTP_PUT, null, auditRef); + throw exc; + } + + return null; + } + + String auditListItems(String heading, List items) { + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(':').append(heading).append("=("); + boolean firstEntry = true; + if (items != null) { + for (String item : items) { + if (!firstEntry) { + sb.append(','); + } else { + firstEntry = false; + } + sb.append('\"').append(item).append('\"'); + } + } + sb.append(')'); + return sb.toString(); + } + + void auditRequestFailure(ResourceContext ctx, Exception exc, String domainName, String resourceName, + String caller, String method, String addlDetails, String auditRef) { + + AuditLogMsgBuilder msgBldr = getAuditLogMsgBuilder(ctx, domainName, auditRef, caller, method); + Timestamp when = Timestamp.fromCurrentTime(); + msgBldr.when(when.toString()).whatEntity(resourceName); + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append("ERROR=("); + if (exc instanceof ResourceException) { + ResourceError err = (ResourceError) ((ResourceException) exc).getData(); + sb.append(err.message); + } else { + sb.append(exc.getMessage()); + } + sb.append(')'); + if (addlDetails != null) { + sb.append(';').append(addlDetails); + } + msgBldr.whatDetails(sb.toString()); + auditLogger.log(msgBldr); + } + + public Policy deletePolicy(ResourceContext ctx, String domainName, String policyName, String auditRef) { + + final String caller = "deletepolicy"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(policyName, TYPE_ENTITY_NAME, caller); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + policyName = policyName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deletepolicy_timing", domainName); + + // we are not going to allow any user to delete + // the admin role and policy since those are required + // for standard domain operations */ + + if (policyName.equalsIgnoreCase(ADMIN_POLICY_NAME)) { + throw ZMSUtils.requestError("deletePolicy: admin policy cannot be deleted", caller); + } + + dbService.executeDeletePolicy(ctx, domainName, policyName, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, policyName, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + + return null; + } + + boolean matchDelegatedTrustAssertion(Assertion assertion, String roleName, + String roleMember, List roles) { + + if (!ZMSUtils.assumeRoleResourceMatch(roleName, assertion)) { + return false; + } + + String rolePattern = StringUtils.patternFromGlob(assertion.getRole()); + for (Role role : roles) { + String name = role.getName(); + if (!name.matches(rolePattern)) { + continue; + } + + if (isMemberOfRole(role, roleMember)) { + return true; + } + } + + return false; + } + + boolean matchDelegatedTrustPolicy(Policy policy, String roleName, String roleMember, List roles) { + + List assertions = policy.getAssertions(); + if (assertions == null) { + return false; + } + + for (Assertion assertion : assertions) { + if (matchDelegatedTrustAssertion(assertion, roleName, roleMember, roles)) { + return true; + } + } + + return false; + } + + boolean delegatedTrust(String domainName, String roleName, String roleMember) { + + AthenzDomain domain = getAthenzDomain(domainName, true); + if (domain == null) { + return false; + } + + for (Policy policy : domain.getPolicies()) { + if (matchDelegatedTrustPolicy(policy, roleName, roleMember, domain.getRoles())) { + return true; + } + } + + return false; + } + + boolean matchRole(String domain, List roles, String rolePattern, List authenticatedRoles) { + + if (LOG.isDebugEnabled()) { + LOG.debug("matchRole domain: " + domain + " rolePattern: " + rolePattern); + } + + String prefix = domain + ":role."; + int prefixLen = prefix.length(); + for (Role role : roles) { + String name = role.getName(); + if (!name.matches(rolePattern)) { + continue; + } + + String shortName = name.substring(prefixLen); + if (authenticatedRoles.contains(shortName)) { + return true; + } + } + return false; + } + + boolean shouldRunDelegatedTrustCheck(String trust, String trustDomain) { + + // if no trust field field then no delegated trust check + + if (trust == null) { + return false; + } + + // if no specific trust domain specifies then we need + // run the delegated trust check for this domain + + if (trustDomain == null) { + return true; + } + + // otherwise we'll run the delegated trust check only if + // domain name matches + + return trust.equalsIgnoreCase(trustDomain); + } + + boolean matchPrincipalInRole(Role role, String roleName, String fullUser, String trustDomain) { + + // if we have members in the role then we're going to check + // against that list only + + if (role.getMembers() != null) { + return isMemberOfRole(role, fullUser); + } + + // no members so let's check if this is a trust domain + + String trust = role.getTrust(); + if (!shouldRunDelegatedTrustCheck(trust, trustDomain)) { + return false; + } + + // delegate to another domain. + + if (LOG.isDebugEnabled()) { + LOG.debug("matchPrincipal: [delegated trust. Checking with: " + trust + "]"); + } + + return delegatedTrust(trust, roleName, fullUser); + } + + boolean matchPrincipal(List roles, String rolePattern, String fullUser, String trustDomain) { + + if (LOG.isDebugEnabled()) { + LOG.debug("matchPrincipal - rolePattern: " + rolePattern + " user: " + fullUser + + " trust: " + trustDomain); + } + + for (Role role : roles) { + + String name = role.getName(); + if (!name.matches(rolePattern)) { + continue; + } + + if (matchPrincipalInRole(role, name, fullUser, trustDomain)) { + if (LOG.isDebugEnabled()) { + LOG.debug("assertionMatch: -> OK (by principal)"); + } + return true; + } + } + return false; + } + + AthenzDomain virtualHomeDomain(Principal principal) { + + if (LOG.isDebugEnabled()) { + LOG.debug("homeDomain: home domain detected. Create on the fly."); + } + + String name = principal.getYRN(); + AthenzDomain athenzDomain = new AthenzDomain(name); + + List adminUsers = new ArrayList<>(); + adminUsers.add(name); + + Role role = ZMSUtils.makeAdminRole(name, adminUsers); + athenzDomain.getRoles().add(role); + + Policy policy = ZMSUtils.makeAdminPolicy(name, role); + athenzDomain.getPolicies().add(policy); + + return athenzDomain; + } + + boolean assertionMatch(Assertion assertion, String identityYRN, String action, String resource, + List roles, List authenticatedRoles, String trustDomain) { + + String actionPattern = StringUtils.patternFromGlob(assertion.getAction()); + if (!action.matches(actionPattern)) { + return false; + } + + String rezPattern = StringUtils.patternFromGlob(assertion.getResource()); + if (!resource.matches(rezPattern)) { + return false; + } + + boolean matchResult = false; + String rolePattern = StringUtils.patternFromGlob(assertion.getRole()); + if (authenticatedRoles != null) { + matchResult = matchRole(trustDomain, roles, rolePattern, authenticatedRoles); + } else { + matchResult = matchPrincipal(roles, rolePattern, identityYRN, trustDomain); + } + + if (LOG.isDebugEnabled()) { + LOG.debug("assertionMatch: -> " + matchResult + + " (effect: " + assertion.getEffect() + ")"); + } + + return matchResult; + } + + boolean verifyProviderEndpoint(String providerEndpoint) { + + // verify that we have a valid endpoint that ends in + // yahoo domain. if it's not present or an empty + // value then there is no field to verify + + if (providerEndpoint == null) { + return true; + } + + if (providerEndpoint.isEmpty()) { + return true; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("verifyProviderEndpoint: verifying endpoint: " + providerEndpoint); + } + + java.net.URI uri = null; + try { + uri = new java.net.URI(providerEndpoint); + } catch (URISyntaxException ex) { + return false; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("verifyProviderEndpoint: host: " + uri.getHost() + " scheme: " + uri.getScheme()); + } + + // we're going to allow localhost as a special case since + // that's often used for dev testing + + String host = uri.getHost(); + if (host == null) { + return false; + } + host = host.toLowerCase(); + + boolean valid = host.equals(ZMSConsts.LOCALHOST); + if (!valid && providerEndpoints != null) { + for (String endpoint : providerEndpoints) { + valid = host.endsWith(endpoint); + if (valid) { + break; + } + } + } + + if (valid) { + String scheme = uri.getScheme(); + if (scheme == null) { + return false; + } + valid = scheme.equalsIgnoreCase(ZMSConsts.HTTP_SCHEME) || + scheme.equalsIgnoreCase(ZMSConsts.HTTPS_SCHEME); + } + + return valid; + } + + boolean verifyServicePublicKey(String key) { + try { + PublicKey pub = Crypto.loadPublicKey(Crypto.ybase64DecodeString(key)); + if (LOG.isDebugEnabled()) { + LOG.debug("verifyServicePublicKey: public key looks valid: " + pub); + } + } catch (Exception ex) { + LOG.error("verifyServicePublicKey: Invalid Public Key: " + ex.getMessage()); + return false; + } + return true; + } + + boolean verifyServicePublicKeys(ServiceIdentity service) { + + // verify that the public keys specified are valid public + // key and we require that at least one key is provided + + List publicKeyList = service.getPublicKeys(); + if (publicKeyList == null || publicKeyList.size() == 0) { + return false; + } + for (PublicKeyEntry entry : publicKeyList) { + if (!verifyServicePublicKey(entry.getKey())) { + return false; + } + } + return true; + } + + // ----------------- the ServiceIdentity interface + + public ServiceIdentity putServiceIdentity(ResourceContext ctx, String domainName, String serviceName, + String auditRef, ServiceIdentity service) { + + final String caller = "putserviceidentity"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + validate(service, TYPE_SERVICE_IDENTITY, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + AthenzObject.SERVICE_IDENTITY.convertToLowerCase(service); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putserviceidentity_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (!ZMSUtils.serviceResourceName(domainName, serviceName).equals(service.getName())) { + throw ZMSUtils.requestError("putServiceIdentity: Inconsistent service/domain names", caller); + } + + if (!verifyServicePublicKeys(service)) { + throw ZMSUtils.requestError("putServiceIdentity: No valid public key found or provided public key is invalid", caller); + } + + if (!verifyProviderEndpoint(service.getProviderEndpoint())) { + throw ZMSUtils.requestError("putServiceIdentity: Invalid endpoint: " + + service.getProviderEndpoint() + " - must be http/https and in yahoo domain", caller); + } + + dbService.executePutServiceIdentity(ctx, domainName, serviceName, service, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, serviceName, caller, ZMSConsts.HTTP_PUT, null, auditRef); + throw exc; + } + + return null; + } + + public ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName) { + + final String caller = "getserviceidentity"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getserviceidentity_timing", domainName); + + ServiceIdentity service = dbService.getServiceIdentity(domainName, serviceName); + if (service == null) { + throw ZMSUtils.notFoundError("getServiceIdentity: Service not found: '" + + ZMSUtils.serviceResourceName(domainName, serviceName) + "'", caller); + } + + metric.stopTiming(timerMetric); + return service; + } + + public ServiceIdentity deleteServiceIdentity(ResourceContext ctx, String domainName, + String serviceName, String auditRef) { + + final String caller = "deleteserviceidentity"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deleteserviceidentity_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + dbService.executeDeleteServiceIdentity(ctx, domainName, serviceName, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, domainName, serviceName, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + + return null; + } + + List setupServiceIdentityList(AthenzDomain domain, Boolean publicKeys, Boolean hosts) { + + // if we're asked to return the public keys and hosts as well then we + // just need to return the data as is without any modifications + + List services = null; + if (publicKeys != null && publicKeys.booleanValue() && hosts != null && hosts.booleanValue()) { + services = domain.getServices(); + } else { + services = new ArrayList<>(); + for (ServiceIdentity service : domain.getServices()) { + ServiceIdentity newService = new ServiceIdentity() + .setName(service.getName()) + .setModified(service.getModified()) + .setExecutable(service.getExecutable()) + .setGroup(service.getGroup()) + .setUser(service.getUser()) + .setProviderEndpoint(service.getProviderEndpoint()); + if (publicKeys != null && publicKeys.booleanValue()) { + newService.setPublicKeys(service.getPublicKeys()); + } else if (hosts != null && hosts.booleanValue()) { + newService.setHosts(service.getHosts()); + } + services.add(newService); + } + } + + return services; + } + + public ServiceIdentities getServiceIdentities(ResourceContext ctx, String domainName, + Boolean publicKeys, Boolean hosts) { + + final String caller = "getserviceidentities"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getserviceidentities_timing", domainName); + + ServiceIdentities result = new ServiceIdentities(); + + AthenzDomain domain = getAthenzDomain(domainName, false); + if (domain == null) { + throw ZMSUtils.notFoundError("getServiceIdentities: Domain not found: '" + + domainName + "'", caller); + } + + result.setList(setupServiceIdentityList(domain, publicKeys, hosts)); + metric.stopTiming(timerMetric); + return result; + } + + public ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName, + Integer limit, String skip) { + + final String caller = "getserviceidentitylist"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + if (skip != null) { + skip = skip.toLowerCase(); + } + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getserviceidentitylist_timing", domainName); + + List names = new ArrayList(); + String next = processListRequest(domainName, AthenzObject.SERVICE_IDENTITY, limit, skip, names); + ServiceIdentityList result = new ServiceIdentityList().setNames(names); + if (next != null) { + result.setNext(next); + } + + metric.stopTiming(timerMetric); + return result; + } + + public PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName, String serviceName, String keyId) { + + final String caller = "getpublickeyentry"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + keyId = keyId.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getpublickeyentry_timing", domainName); + + PublicKeyEntry entry = dbService.getServicePublicKeyEntry(domainName, serviceName, keyId); + if (entry == null) { + throw ZMSUtils.notFoundError("getPublicKeyEntry: PublicKey " + keyId + " in service " + + ZMSUtils.serviceResourceName(domainName, serviceName) + " not found", caller); + } + + metric.stopTiming(timerMetric); + return entry; + } + + public PublicKeyEntry deletePublicKeyEntry(ResourceContext ctx, String domainName, String serviceName, + String keyId, String auditRef) { + + final String caller = "deletepublickeyentry"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + keyId = keyId.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("deletepublickeyentry_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + dbService.executeDeletePublicKeyEntry(ctx, domainName, serviceName, keyId, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified keyId=(").append(keyId).append(')'); + auditRequestFailure(ctx, exc, domainName, serviceName, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + public PublicKeyEntry putPublicKeyEntry(ResourceContext ctx, String domainName, String serviceName, + String keyId, String auditRef, PublicKeyEntry keyEntry) { + + final String caller = "putpublickeyentry"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + validate(keyEntry, TYPE_PUBLIC_KEY_ENTRY, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + keyId = keyId.toLowerCase(); + AthenzObject.PUBLIC_KEY_ENTRY.convertToLowerCase(keyEntry); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("putpublickeyentry_timing", domainName); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // verify that key id specified in request and object do match + + if (!keyId.equals(keyEntry.getId())) { + throw ZMSUtils.requestError("putPublicKeyEntry: keyId in URI and PublicKeyEntry object do not match", caller); + } + + // verify we have a valid public key specified + + if (!verifyServicePublicKey(keyEntry.getKey())) { + throw ZMSUtils.requestError("putPublicKeyEntry: Invalid public key", caller); + } + + dbService.executePutPublicKeyEntry(ctx, domainName, serviceName, keyEntry, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified keyId=(").append(keyId).append(')'); + auditRequestFailure(ctx, exc, domainName, serviceName, caller, ZMSConsts.HTTP_PUT, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + String removeQuotes(String value) { + if (value.startsWith("\"")) { + value = value.substring(1, value.length()); + } + if (value.endsWith("\"")) { + value = value.substring(0, value.length() - 1); + } + return value; + } + + long getModTimestamp(String matchingTag) { + + long timestamp = 0; + if (matchingTag == null) { + return timestamp; + } + + matchingTag = removeQuotes(matchingTag); + + if (LOG.isDebugEnabled()) { + LOG.debug("getModTimestamp: matching tag (" + matchingTag + ")"); + } + + try { + Timestamp tagStamp = Timestamp.fromString(matchingTag); + if (tagStamp == null) { + throw new IllegalArgumentException("Timestamp failed"); + } + timestamp = tagStamp.millis(); + } catch (IllegalArgumentException exc) { + if (LOG.isWarnEnabled()) { + LOG.warn("getModTimestamp: matching tag(" + matchingTag + ") has bad format. Return -1L by default."); + } + } + + return timestamp; + } + + // SignedDomains interface + public void getSignedDomains(ResourceContext context, String domain, String metaOnly, + String matchingTag, GetSignedDomainsResult result) { + + final String caller = "getsigneddomains"; + metric.increment(ZMSConsts.HTTP_GET); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("getsigneddomains_timing", null); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + if (domain != null) { + domain = domain.toLowerCase(); + } + + boolean setMetaDataOnly = false; + if (metaOnly != null) { + // only true or false is valid + setMetaDataOnly = metaOnly.trim().equalsIgnoreCase("true"); + if (LOG.isDebugEnabled()) { + LOG.debug("getSignedDomains: metaonly: " + metaOnly, caller); + } + } + + long timestamp = getModTimestamp(matchingTag); + + // we should get our matching tag before calling get modified list + // in case we get a domain added/updated right after an empty domain list + // was returned and before the matchingTag was set to a value + + if (matchingTag == null) { + EntityTag eTag = new EntityTag(Timestamp.fromMillis(0).toString()); + matchingTag = eTag.toString(); + } + + DomainModifiedList dmlist = dbService.listModifiedDomains(timestamp); + List modlist = dmlist.getNameModList(); + if (modlist == null || modlist.size() == 0) { + result.done(304, matchingTag); + } + + Long youngestDomMod = -1L; + List sdList = new ArrayList(); + + // now we can iterate through our list and retrieve each domain + + boolean domainFilterDone = false; + for (DomainModified dmod : modlist) { + + // if we were processing only our given domain then + // we can stop iterating through the list if the + // filter done flag has been set + + if (domainFilterDone) { + break; + } + + // if we're given a specific domain then ignore all others + + if (domain != null && !domain.isEmpty()) { + if (domain.compareToIgnoreCase(dmod.getName()) != 0) { + continue; + } + domainFilterDone = true; + } + + Long domModMillis = dmod.getModified(); + if (domModMillis.compareTo(youngestDomMod) > 0) { + youngestDomMod = domModMillis; + } + + // generate our signed domain object + + SignedDomain signedDomain = new SignedDomain(); + DomainData domainData = new DomainData().setName(dmod.getName()); + signedDomain.setDomain(domainData); + domainData.setModified(Timestamp.fromMillis(dmod.getModified())); + + // check if we're asked to only return the meta data which + // we already have - name and last modified time, so we can + // add the domain to our return list and continue with the + // next domain + + if (setMetaDataOnly) { + sdList.add(signedDomain); + continue; + } + + // get the policies, roles, and service identities to create the + // DomainData + + if (LOG.isDebugEnabled()) { + LOG.debug("getSignedDomains: retrieving domain " + dmod.getName()); + } + + AthenzDomain athenzDomain = getAthenzDomain(dmod.getName(), true); + + // it's possible that our domain was deleted by another + // thread while we were processing this request so + // if we get a null object, we'll just skip this + // item and continue with the next one + + if (athenzDomain == null) { + continue; + } + + // we have a valid domain so first we need to add + // our object to the return list + + sdList.add(signedDomain); + + // set domain attributes + + domainData.setAccount(athenzDomain.getDomain().getAccount()); + domainData.setYpmId(athenzDomain.getDomain().getYpmId()); + domainData.setRoles(athenzDomain.getRoles()); + domainData.setServices(athenzDomain.getServices()); + + // generate the domain policy object that includes the domain + // name and all policies. Then we'll sign this struct using + // server's private key to get signed policy object + + DomainPolicies domainPolicies = new DomainPolicies().setDomain(dmod.getName()); + domainPolicies.setPolicies(getPolicyListWithoutAssertionId(athenzDomain.getPolicies())); + SignedPolicies signedPolicies = new SignedPolicies(); + signedPolicies.setContents(domainPolicies); + domainData.setPolicies(signedPolicies); + + String signature = Crypto.sign(SignUtils.asCanonicalString(signedDomain.getDomain().getPolicies().getContents()), privateKey); + signedDomain.getDomain().getPolicies().setSignature(signature).setKeyId(privateKeyId); + + // then sign the data and set the data and signature in a SignedDomain + + signature = Crypto.sign(SignUtils.asCanonicalString(signedDomain.getDomain()), privateKey); + signedDomain.setSignature(signature).setKeyId(privateKeyId); + } + + SignedDomains sdoms = new SignedDomains(); + sdoms.setDomains(sdList); + + Timestamp youngest = Timestamp.fromMillis(youngestDomMod); + EntityTag eTag = new EntityTag(youngest.toString()); + + metric.stopTiming(timerMetric); + result.done(200, sdoms, eTag.toString()); + } + + List getPolicyListWithoutAssertionId(List policies) { + + if (policies == null) { + return null; + } + + // we are going to remove the assertion id from our assertions + // since the data is signed and the clients don't need to be + // updated due to this new attribute being returned + + List policyList = new ArrayList<>(); + + for (Policy policy : policies) { + Policy newPolicy = new Policy() + .setModified(policy.getModified()) + .setName(policy.getName()); + if (policy.getAssertions() != null) { + List assertions = new ArrayList<>(); + for (Assertion assertion : policy.getAssertions()) { + Assertion newAssertion = new Assertion() + .setAction(assertion.getAction()) + .setResource(assertion.getResource()) + .setRole(assertion.getRole()); + if (assertion.getEffect() != null) { + newAssertion.setEffect(assertion.getEffect()); + } else { + newAssertion.setEffect(AssertionEffect.ALLOW); + } + assertions.add(newAssertion); + } + newPolicy.setAssertions(assertions); + } + policyList.add(newPolicy); + } + return policyList; + } + + boolean isValidUserTokenRequest(Principal principal, String userName) { + + if (principal == null) { + return false; + } + + Authority authority = principal.getAuthority(); + if (authority == null) { + return false; + } + + // if authority allowed to carry out authorization checks there + // is no need to request user tokens + + if (authority.allowAuthorization()) { + if (LOG.isDebugEnabled()) { + LOG.debug("User Token request - Authority cannot request user tokens"); + } + return false; + } + + String authDomain = authority.getDomain(); + if (authDomain == null || !authDomain.equalsIgnoreCase(userDomain)) { + if (LOG.isDebugEnabled()) { + LOG.debug("User Token request - not authenticated by User Authority"); + } + return false; + } + + // if the username is not our pre-defined skip value we are going + // to verify that it matches to the principal's name + + if (userName.equalsIgnoreCase(USER_TOKEN_DEFAULT_NAME)) { + return true; + } + + if (!userName.equalsIgnoreCase(principal.getName())) { + if (LOG.isDebugEnabled()) { + LOG.debug("User Token request - mismatch between request user name and userid"); + } + return false; + } + + return true; + } + + public UserToken getUserToken(ResourceContext ctx, String userName, String authorizedServices) { + + final String caller = "getusertoken"; + metric.increment(ZMSConsts.HTTP_GET); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("getusertoken_timing", null); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + userName = userName.toLowerCase(); + + Principal principal = ((RsrcCtxWrapper) ctx).principal(); + if (!isValidUserTokenRequest(principal, userName)) { + throw ZMSUtils.unauthorizedError("getUserToken: Invalid request - missing User credentials or userName mismatch", caller); + } + + // if the user is requesting authorized services we need to verify that + // all the service names are valid + + List services = null; + if (authorizedServices != null && !authorizedServices.isEmpty()) { + services = Arrays.asList(authorizedServices.split(",")); + for (String service : services) { + if (!serverAuthorizedServices.contains(service)) { + throw ZMSUtils.unauthorizedError("getUserToken: Service " + service + " is not authorized in ZMS", caller); + } + } + } + + PrincipalToken token = new PrincipalToken.Builder("U1", userDomain, principal.getName()) + .expirationWindow(userTokenTimeout).keyId(privateKeyId).host(serverHostName) + .ip(ServletRequestUtil.getRemoteAddress(ctx.request())).authorizedServices(services).build(); + + token.sign(privateKey); + UserToken userToken = new UserToken().setToken(token.getSignedToken()); + + // set our standard CORS headers in our response if we're processing + // a get user token for an authorized service + + if (services != null) { + setStandardCORSHeaders(ctx); + } + + metric.stopTiming(timerMetric); + return userToken; + } + + public UserToken optionsUserToken(ResourceContext ctx, String userName, String authorizedServices) { + + final String caller = "optionsusertoken"; + metric.increment(ZMSConsts.HTTP_OPTIONS); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("optionsusertoken_timing", null); + + // if the user must be requesting authorized service token + + if (authorizedServices == null || authorizedServices.isEmpty()) { + throw ZMSUtils.requestError("optionsUserToken: No authorized services specified in the request", caller); + } + + // verify that all specified services are valid + + List services = Arrays.asList(authorizedServices.split(",")); + for (String service : services) { + if (!serverAuthorizedServices.contains(service)) { + throw ZMSUtils.requestError("optionsUserToken: Service " + service + " is not authorized in ZMS", caller); + } + } + + // set our standard CORS headers in our response + + setStandardCORSHeaders(ctx); + + // since this is the preflight request we are going to report that + // we only allow GET method and configure the user-agent to cache + // this request results for up-to 30 days + + ctx.response().addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_METHODS, ZMSConsts.HTTP_GET); + ctx.response().addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_MAX_AGE, "2592000"); + + metric.stopTiming(timerMetric); + return null; + } + + void setStandardCORSHeaders(ResourceContext ctx) { + + // if we get an Origin header in our request then we're going to return + // the same value in the Allow-Origin header otherwise we'll just + // return * value to match everything + + String origin = ctx.request().getHeader(ZMSConsts.HTTP_ORIGIN); + if (origin != null && !origin.isEmpty()) { + ctx.response().addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_ORIGIN, origin); + } else { + ctx.response().addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_ORIGIN, "*"); + } + + // we must allow credentials to be passed by the client + + ctx.response().addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); + + // if the client is asking us to allow any headers then we're going + // to return that set back as allowed + + String allowHeaders = ctx.request().getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_REQUEST_HEADERS); + if (allowHeaders != null && !allowHeaders.isEmpty()) { + ctx.response().addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_HEADERS, allowHeaders); + } + } + + // Tenancy interface + + String providerServiceDomain(String provider) { + int n = provider.lastIndexOf('.'); + if (n <= 0 || n == provider.length() - 1) { + return null; + } + return provider.substring(0, n); + } + + String providerServiceName(String provider) { + int n = provider.lastIndexOf('.'); + if (n <= 0 || n == provider.length() - 1) { + return null; + } + return provider.substring(n + 1); + } + + ProviderClient getProviderClient(String url, Principal tenantAdmin) { + + final String caller = "getproviderclient"; + + ProviderClient prov = null; + if (providerClass == null) { + prov = new ProviderClient(url); + prov.addCredentials(tenantAdmin.getAuthority().getHeader(), tenantAdmin.getCredentials()); + } else { + try { + prov = providerClass.getConstructor(new Class[] { String.class, Principal.class }) + .newInstance(url, tenantAdmin); + } catch (Exception e) { + throw ZMSUtils.requestError("getProviderClient: Provider Class does not have the appropriate constructor", caller); + } + } + + return prov; + } + + public Tenancy putTenancy(ResourceContext ctx, String tenantDomain, String provider, + String auditRef, Tenancy detail) { + + final String caller = "puttenancy"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(provider, TYPE_SERVICE_NAME, caller); //the fully qualified service name to provision on + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + tenantDomain = tenantDomain.toLowerCase(); + provider = provider.toLowerCase(); + AthenzObject.TENANCY.convertToLowerCase(detail); + + metric.increment(ZMSConsts.HTTP_REQUEST, tenantDomain); + metric.increment(caller, tenantDomain); + Object timerMetric = metric.startTiming("puttenancy_timing", tenantDomain); + + // verify that request is properly authenticated for this request + + String authorizedService = ((RsrcCtxWrapper) ctx).principal().getAuthorizedService(); + verifyAuthorizedServiceOperation(authorizedService, caller); + + final String logPrefix = "putTenancy: tenant domain(" + tenantDomain + "): "; + + if (LOG.isInfoEnabled()) { + LOG.info("---- BEGIN put Tenant on provider(" + provider + ", ...)"); + } + + String provSvcDomain = providerServiceDomain(provider); // provider service domain + String provSvcName = providerServiceName(provider); // provider service name + + ServiceIdentity ent = dbService.getServiceIdentity(provSvcDomain, provSvcName); + if (ent == null) { + throw ZMSUtils.requestError(logPrefix + "Unable to retrieve service=" + provider, caller); + } + + if (LOG.isDebugEnabled()) { + LOG.debug("serviceIdentity: provider=" + ent); + } + + // we are going to allow the authorize service token owner to call + // put tenancy on its own service without configuring a controller + // end point + + boolean authzServiceTokenOperation = isAuthorizedProviderService(authorizedService, + provSvcDomain, provSvcName, tenantDomain, auditRef); + + String url = ent.getProviderEndpoint(); + if ((url == null || url.isEmpty()) && !authzServiceTokenOperation) { + throw ZMSUtils.requestError(logPrefix + "Cannot put tenancy on provider service=" + + provider + " -- not a provider service", caller); + } + + if (LOG.isInfoEnabled()) { + LOG.info("let's talk to the provider on this endpoint: " + url); + } + + //ok, set up the policy for trust so the provider can check it + + if (LOG.isInfoEnabled()) { + LOG.info("---- set up the ASSUME_ROLE for admin, so provider can check I'm an admin"); + } + + // set up our tenant admin policy so provider can check admin's access + + dbService.setupTenantAdminPolicy(ctx, tenantDomain, provSvcDomain, + provSvcName, auditRef, caller); + + // if this is an authorized service token request then we're going to create + // the corresponding admin role in the provider domain since that's been + // authenticated already. otherwise, we're going to continue and process + // a standard provider controller based implementation when we contact the + // controller to complete the tenancy request + + if (authzServiceTokenOperation) { + + List roles = new ArrayList<>(); + TenantRoleAction roleAction = new TenantRoleAction().setAction("*").setRole(ADMIN_ROLE_NAME); + roles.add(roleAction); + dbService.executePutTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, null, + roles, auditRef, caller); + + } else { + + Principal tenantAdmin = ((RsrcCtxWrapper) ctx).principal(); + if (LOG.isInfoEnabled()) { + LOG.info("---- now tell the provider to setTenant, as " + tenantAdmin.getYRN() + + ", creds = " + tenantAdmin.getCredentials()); + } + + Tenant tenant = new Tenant().setService(provSvcName).setName(tenantDomain); + Tenant tenantWithRoles = null; + try { + ProviderClient prov = getProviderClient(url, tenantAdmin); + tenantWithRoles = prov.putTenant(provSvcName, tenantDomain, auditRef, tenant); + } catch (Exception exc) { + throw ZMSUtils.requestError(logPrefix + "Failed to put tenant on provider service(" + + provider + "): " + exc.getMessage(), caller); + } + + if (LOG.isInfoEnabled()) { + LOG.info("---- result of provider.putTenant: " + tenantWithRoles); + } + + // now set up the roles and policies for all the provider roles returned + // if the provider supports resource groups, during the putTenant call + // we're just setting up tenancy and as such we won't get back any roles + + List providerRoles = tenantWithRoles.getRoles(); + if (providerRoles != null && !providerRoles.isEmpty()) { + + // we're going to create a separate role for each one of tenant roles returned + // based on its action and set the caller as a member in each role + + dbService.executePutProviderRoles(ctx, tenantDomain, provSvcDomain, provSvcName, null, + providerRoles, auditRef, caller); + } + } + + if (LOG.isInfoEnabled()) { + LOG.info("---- END put Tenant -> " + detail); + } + + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified tenant-domain-(").append(tenantDomain).append(')'); + auditRequestFailure(ctx, exc, tenantDomain, provider, caller, ZMSConsts.HTTP_PUT, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + public TenancyResourceGroup putTenancyResourceGroup(ResourceContext ctx, String tenantDomain, String provider, + String resourceGroup, String auditRef, TenancyResourceGroup detail) { + + final String caller = "puttenancyresourcegroup"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(provider, TYPE_SERVICE_NAME, caller); //the fully qualified service name to provision on + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + tenantDomain = tenantDomain.toLowerCase(); + provider = provider.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + AthenzObject.TENANCY_RESOURCE_GROUP.convertToLowerCase(detail); + + metric.increment(ZMSConsts.HTTP_REQUEST, tenantDomain); + metric.increment(caller, tenantDomain); + Object timerMetric = metric.startTiming("puttenancyresourcegroup_timing", tenantDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (LOG.isDebugEnabled()) { + LOG.debug("putTenancyResourceGroup: tenant domain(" + tenantDomain + + ") resourceGroup(" + resourceGroup + ")"); + } + + String provSvcDomain = providerServiceDomain(provider); // provider service domain + String provSvcName = providerServiceName(provider); // provider service name + + ServiceIdentity ent = dbService.getServiceIdentity(provSvcDomain, provSvcName); + if (ent == null) { + throw ZMSUtils.requestError("Unable to retrieve service=" + provider, caller); + } + + if (LOG.isDebugEnabled()) { + LOG.debug("serviceIdentity: provider=" + ent); + } + String url = ent.getProviderEndpoint(); + if (url == null || url.isEmpty()) { + throw ZMSUtils.requestError("Cannot put tenancy resource group on provider service=" + + provider + " -- not a provider service", caller); + } + + Principal tenantAdmin = ((RsrcCtxWrapper) ctx).principal(); + + TenantResourceGroup tenantResourceGroup = new TenantResourceGroup(); + tenantResourceGroup.setService(provSvcName).setName(tenantDomain).setResourceGroup(resourceGroup); + + TenantResourceGroup tenantWithRoles = null; + try { + ProviderClient prov = getProviderClient(url, tenantAdmin); + tenantWithRoles = prov.putTenantResourceGroup(provSvcName, tenantDomain, resourceGroup, + auditRef, tenantResourceGroup); + } catch (Exception exc) { + throw ZMSUtils.requestError("Failed to put tenant resource group(" + resourceGroup + + ") on provider service(" + provider + "): " + exc.getMessage(), caller); + } + + if (LOG.isInfoEnabled()) { + LOG.info("---- result of provider.putTenantResourceGroup: " + tenantWithRoles); + } + + List providerRoles = tenantWithRoles.getRoles(); + if (providerRoles == null || providerRoles.isEmpty()) { + throw ZMSUtils.requestError("Provider Controller did not return any roles to provision", caller); + } + + // we're going to create a separate role for each one of tenant roles returned + // based on its action and set the caller as a member in each role + + dbService.executePutProviderRoles(ctx, tenantDomain, provSvcDomain, provSvcName, resourceGroup, + providerRoles, auditRef, caller); + + if (LOG.isInfoEnabled()) { + LOG.info("---- END put Tenant Resource Group -> " + detail); + } + + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified resource-group=(").append(resourceGroup).append(')'); + auditRequestFailure(ctx, exc, tenantDomain, provider, caller, ZMSConsts.HTTP_PUT, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + boolean verifyTenancyPolicies(String tenantDomain, List tenantPolicies, Set providerPolicies, + String provSvcDomain, String provSvcName, String resourceGroup) { + + // generate the tenant policy name + + StringBuilder nameBuilder = new StringBuilder(256); + nameBuilder.append("tenancy.") + .append(ZMSUtils.getProviderResourceGroupRolePrefix(provSvcDomain, provSvcName, resourceGroup)); + String pnamePrefix = nameBuilder.toString(); + String rsrcMatchStr = ":role."; + int rsrcMatchStrLen = rsrcMatchStr.length(); + + String provPolName = null; + for (String pname : tenantPolicies) { + if (pname.startsWith(pnamePrefix)) { + Policy pol = dbService.getPolicy(tenantDomain, pname); + if (pol == null) { + break; + } + List assertions = pol.getAssertions(); + if (assertions != null) { + for (Assertion assertion : assertions) { + if (ZMSConsts.ACTION_ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { + String rsrc = assertion.getResource(); + // parse rsrc, ex: "weather:role.storage.tenant.sports.deleter" + int index = rsrc.indexOf(rsrcMatchStr); + if (index > -1) { + rsrc = rsrc.substring(index + rsrcMatchStrLen); + } + provPolName = rsrc; + break; + } + } + } + } + } + + if (provPolName == null) { + if (LOG.isDebugEnabled()) { + LOG.debug("verifyTenancyPolicies: No ASSUME_ROLE with policy prefix: " + pnamePrefix); + } + return false; + } + + // verify the tenant is in the provider too + // look for the policy in the provider + + if (!providerPolicies.contains(provPolName)) { + if (LOG.isDebugEnabled()) { + LOG.debug("verifyTenancyPolicies: No tenant policy in provider: " + provPolName); + } + return false; + } + + return true; + } + + public Tenancy getTenancy(ResourceContext ctx, String tenantDomain, String providerService) { + + final String caller = "gettenancy"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(providerService, TYPE_SERVICE_NAME, caller); // fully qualified provider's service name + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + tenantDomain = tenantDomain.toLowerCase(); + providerService = providerService.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, tenantDomain); + metric.increment(caller, tenantDomain); + Object timerMetric = metric.startTiming("gettenancy_timing", tenantDomain); + + // first verify that we have a valid tenant domain with policies + + Domain domain = dbService.getDomain(tenantDomain); + if (domain == null) { + throw ZMSUtils.notFoundError("getTenancy: No such tenant domain: " + tenantDomain, caller); + } + + // we need to contact the provider to retrieve tenancy details + // since we don't know if the provider supports resource groups + // and as such the policies we have are for tenant's subdomains + // or for tenant's domain with resource groups. + + String provSvcDomain = providerServiceDomain(providerService); + String provSvcName = providerServiceName(providerService); + + Domain providerDomain = dbService.getDomain(provSvcDomain); + if (providerDomain == null) { + throw ZMSUtils.requestError("getTenancy: No such provider domain: " + provSvcDomain, caller); + } + + // now retrieve our provider service object + + ServiceIdentity service = dbService.getServiceIdentity(provSvcDomain, provSvcName); + if (service == null) { + throw ZMSUtils.requestError("getTenancy: unable to retrieve service=" + providerService, caller); + } + + if (LOG.isDebugEnabled()) { + LOG.debug("getTenancy: serviceIdentity: provider=" + service); + } + + // contact the provider and get the tenant object + + String url = service.getProviderEndpoint(); + if (url == null || url.isEmpty()) { + throw ZMSUtils.requestError("getTenancy: cannot get tenancy on provider service=" + + providerService + " -- not a provider service", caller); + } + + Principal tenantAdmin = ((RsrcCtxWrapper) ctx).principal(); + Tenant tenant = null; + try { + ProviderClient prov = getProviderClient(url, tenantAdmin); + tenant = prov.getTenant(provSvcName, tenantDomain); + } catch (ResourceException exc) { + // if we have a ZMS ResourceException then let's throw it + // as is so that the client knows that the provider returned + throw exc; + } catch (Exception exc) { + throw ZMSUtils.requestError("getTenancy: failed to get tenant on provider service(" + + providerService + "): " + exc.getMessage(), caller); + } + + if (tenant == null) { + throw ZMSUtils.notFoundError("getTenancy: Provider reports no such tenant: " + tenantDomain, caller); + } + + if (LOG.isInfoEnabled()) { + LOG.info("getTenancy: ---- result of provider.getTenant: " + tenant); + } + + // now we are going to verify to make sure that both tenant + // and provider domains have the appropriate policies. however we + // are not going to reject any requests because of missing policies + // and instead for resource group support we'll just not report + // the resource group as a valid provisioned one. + + Tenancy tenancy = new Tenancy(); + tenancy.setDomain(tenantDomain).setService(providerService); + List resourceGroups = tenant.getResourceGroups(); + if (resourceGroups != null) { + List tenantPolicies = dbService.listPolicies(tenantDomain); + Set providerPolicies = new HashSet<>(dbService.listPolicies(provSvcDomain)); + List tenancyResouceGroups = new ArrayList<>(); + for (String resourceGroup : resourceGroups) { + if (!verifyTenancyPolicies(tenantDomain, tenantPolicies, providerPolicies, + provSvcDomain, provSvcName, resourceGroup)) { + if (LOG.isInfoEnabled()) { + LOG.info("getTenancy: Invalid Resource Group: " + resourceGroup + + " for tenant: " + tenantDomain); + } + } else { + tenancyResouceGroups.add(resourceGroup); + } + } + tenancy.setResourceGroups(tenancyResouceGroups); + } + + metric.stopTiming(timerMetric); + return tenancy; + } + + public Tenancy deleteTenancy(ResourceContext ctx, String tenantDomain, String provider, String auditRef) { + + final String caller = "deletetenancy"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(provider, TYPE_SERVICE_NAME, caller); // fully qualified provider's service name + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + tenantDomain = tenantDomain.toLowerCase(); + provider = provider.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, tenantDomain); + metric.increment(caller, tenantDomain); + Object timerMetric = metric.startTiming("deletetenancy_timing", tenantDomain); + + // verify that request is properly authenticated for this request + + String authorizedService = ((RsrcCtxWrapper) ctx).principal().getAuthorizedService(); + verifyAuthorizedServiceOperation(authorizedService, caller); + + // for delete tenant operation we're going to go through the steps of + // lookup up provider's service object and make sure it has an endpoint + // configured and we can talk to it and request the tenant to be deleted + // if any of these operations fail, we're not going to reject the request + // but rather continue on and do the local cleanup. However, at the end + // we're going to return an exception with an error message stating exactly + // what failed so the administrator can go ahead and contact the provider + // manually, if necessary, to complete the delete tenancy process + + String errorMessage = null; + + // before local clean-up, we're going to contact the provider at their + // configured endpoint and request the tenant to be deleted. We need + // to do this before the local cleanup in ZMS because provider rdl + // has an authorize statement to validate that the specified domain + // is a valid tenant for the given provider. + + String provSvcDomain = providerServiceDomain(provider); + String provSvcName = providerServiceName(provider); + + // we are going to allow the authorize service token owner to call + // delete tenancy on its own service without configuring a controller + // end point + + boolean authzServiceTokenOperation = isAuthorizedProviderService(authorizedService, + provSvcDomain, provSvcName, tenantDomain, auditRef); + + // if this is an authorized service token operation there is no + // need to go through the provider check since the provider + // already handled that part + + if (authzServiceTokenOperation) { + + dbService.executeDeleteTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, null, + auditRef, caller); + + } else { + + ServiceIdentity provSvcId = dbService.getServiceIdentity(provSvcDomain, provSvcName); + if (provSvcId == null) { + errorMessage = "service does not exist"; + } else { + if (LOG.isDebugEnabled()) { + LOG.debug("provider serviceIdentity(" + provSvcId + ")"); + } + + String url = provSvcId.getProviderEndpoint(); + if (url == null || url.isEmpty()) { + errorMessage = "service does not have endpoint configured"; + } else { + if (LOG.isInfoEnabled()) { + LOG.info("Tenant will contact provider at endpoint: " + url); + } + + try { + Principal tenantAdmin = ((RsrcCtxWrapper) ctx).principal(); + ProviderClient prov = getProviderClient(url, tenantAdmin); + prov.deleteTenant(provSvcName, tenantDomain, auditRef); + } catch (Exception exc) { + errorMessage = "failed to delete tenant. Error: " + exc.getMessage(); + } + } + } + } + + // now clean-up local domain roles and policies for this tenant + + dbService.executeDeleteTenancy(ctx, tenantDomain, provSvcDomain, provSvcName, + null, auditRef, caller); + + metric.stopTiming(timerMetric); + + // so if we have an error message then we're going to throw an exception + // otherwise the operation was completed successfully + + if (errorMessage != null) { + final String tenantCleanupMsg = "deleteTenancy: Tenant cleanup in(" + tenantDomain + "): "; + throw ZMSUtils.requestError(tenantCleanupMsg + "completed successfully. However, there " + + "was an error when contacting the Provider Service: " + provider + ":" + + errorMessage + ". Please contact the Provider administrator directly " + + "to complete this delete tenancy request", caller); + } + + } catch (Exception exc) { + + auditRequestFailure(ctx, exc, tenantDomain, provider, caller, ZMSConsts.HTTP_DELETE, null, auditRef); + throw exc; + } + + return null; + } + + public TenancyResourceGroup deleteTenancyResourceGroup(ResourceContext ctx, String tenantDomain, + String provider, String resourceGroup, String auditRef) { + + final String caller = "deletetenancyresourcegroup"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(provider, TYPE_SERVICE_NAME, caller); // fully qualified provider's service name + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + tenantDomain = tenantDomain.toLowerCase(); + provider = provider.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, tenantDomain); + metric.increment(caller, tenantDomain); + Object timerMetric = metric.startTiming("deletetenancyresourcegroup_timing", tenantDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // for delete tenant resource group operation we're going to go through + // the steps of lookup up provider's service object and make sure it has + // an endpoint configured and we can talk to it and request the tenant + // resource group to be deleted. if any of these operations fail, we're not + // going to reject the request but rather continue on and do the local cleanup. + // However, at the end we're going to return an exception with an error message + // stating exactly what failed so the administrator can go ahead and contact + // the provider manually, if necessary, to complete the delete tenancy + // resource group process + + String errorMessage = null; + + // before local clean-up, we're going to contact the provider at their + // configured endpoint and request the tenant resource group to be deleted. + + String provSvcDomain = providerServiceDomain(provider); + String provSvcName = providerServiceName(provider); + + ServiceIdentity provSvcId = dbService.getServiceIdentity(provSvcDomain, provSvcName); + if (provSvcId == null) { + errorMessage = "service does not exist"; + } else { + if (LOG.isDebugEnabled()) { + LOG.debug("provider serviceIdentity(" + provSvcId + ")"); + } + + String url = provSvcId.getProviderEndpoint(); + if (url == null) { + errorMessage = "service does not have endpoint configured"; + } else { + if (LOG.isInfoEnabled()) { + LOG.info("Tenant will contact provider at endpoint: " + url); + } + + try { + Principal tenantAdmin = ((RsrcCtxWrapper) ctx).principal(); + ProviderClient prov = getProviderClient(url, tenantAdmin); + prov.deleteTenantResourceGroup(provSvcName, tenantDomain, resourceGroup, auditRef); + } catch (Exception exc) { + errorMessage = "failed to delete tenant resource group. Error: " + exc.getMessage(); + } + } + } + + // now clean-up local domain roles and policies for this tenant + + dbService.executeDeleteTenancy(ctx, tenantDomain, provSvcDomain, provSvcName, + resourceGroup, auditRef, caller); + + metric.stopTiming(timerMetric); + + // so if we have an error message then we're going to throw an exception + // otherwise the operation was completed successfully + + if (errorMessage != null) { + final String tenantCleanupMsg = "Tenant cleanup in(" + tenantDomain + "): "; + throw ZMSUtils.requestError(tenantCleanupMsg + "completed successfully. However, there " + + "was an error when contacting the Provider Service: " + provider + ":" + + errorMessage + ". Please contact the Provider administrator directly " + + "to complete this delete tenancy resource group request", caller); + } + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified resource-group=(").append(resourceGroup).append(')'); + auditRequestFailure(ctx, exc, tenantDomain, provider, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + long sleepBeforeRetryingRequest(long millisToExpire, long sleepTimeout, String caller) { + + // before sleeping we're going to check to see if it makes + // sense since if the while loop is going to break out then + // there is no point of us sleeping now + + if (millisToExpire <= 0) { + return sleepTimeout; + } + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": concurrent update exception, retry after " + sleepTimeout + "ms"); + } + + try { + Thread.sleep(sleepTimeout); + } catch (InterruptedException e) { + } + + // since we know we're going to retry our operation next + // lets increment our domain update retry counter + + metric.increment("domainupdateretry"); + + // we're going to sleep a bit longer after each iteration + // so our next timeout is twice as long + + return (2 * sleepTimeout); + } + + public TenantRoles putTenantRoles(ResourceContext ctx, String provSvcDomain, String provSvcName, + String tenantDomain, String auditRef, TenantRoles detail) { + + final String caller = "puttenantroles"; + metric.increment(ZMSConsts.HTTP_PUT); + + try { + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); //not including the domain, this is the domain's service + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(detail, TYPE_TENANT_ROLES, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + AthenzObject.TENANT_ROLES.convertToLowerCase(detail); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("puttenantroles_timing", provSvcDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (LOG.isInfoEnabled()) { + LOG.info("putTenantRoles: ==== putTenantRoles(domain=" + provSvcDomain + ", service=" + + provSvcName + ", tenant-domain=" + tenantDomain + ", detail=" + detail + ")"); + } + + List roles = detail.getRoles(); + if (roles == null || roles.size() == 0) { + throw ZMSUtils.requestError("putTenantRoles: must include at least one role", caller); + } + + dbService.executePutTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, null, + roles, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified provider-service=(").append(provSvcName).append(')'); + auditRequestFailure(ctx, exc, provSvcDomain, tenantDomain, caller, ZMSConsts.HTTP_PUT, + sb.toString(), auditRef); + throw exc; + } + + return detail; + } + + // put the trust roles into provider domain + // + public TenantResourceGroupRoles putTenantResourceGroupRoles(ResourceContext ctx, String provSvcDomain, + String provSvcName, String tenantDomain, String resourceGroup, String auditRef, + TenantResourceGroupRoles detail) { + + final String caller = "puttenantresourcegrouproles"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); //not including the domain, this is the domain's service + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(detail, TYPE_TENANT_RESOURCE_GROUP_ROLES, caller); + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + AthenzObject.TENANT_RESOURCE_GROUP_ROLES.convertToLowerCase(detail); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("puttenantresourcegrouproles_timing", provSvcDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (LOG.isInfoEnabled()) { + LOG.info("putTenantResourceGroupRoles: ==== putTenantRoles(domain=" + provSvcDomain + ", service=" + + provSvcName + ", tenant-domain=" + tenantDomain + ", resource-group=" + resourceGroup + + ", detail=" + detail + ")"); + } + + List roles = detail.getRoles(); + if (roles == null || roles.size() == 0) { + throw ZMSUtils.requestError("putTenantResourceGroupRoles: must include at least one role", caller); + } + + dbService.executePutTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, + resourceGroup, roles, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified resource-group=(").append(resourceGroup).append(')'); + auditRequestFailure(ctx, exc, provSvcDomain, tenantDomain, caller, ZMSConsts.HTTP_PUT, + sb.toString(), auditRef); + throw exc; + } + + return detail; + } + + public DomainDataCheck getDomainDataCheck(ResourceContext ctx, String domainName) { + + final String caller = "getdomaindatacheck"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + domainName = domainName.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + Object timerMetric = metric.startTiming("getdomaindatacheck_timing", domainName); + + if (LOG.isDebugEnabled()) { + LOG.debug("getDomainDataCheck: domain=" + domainName); + } + + AthenzDomain domain = getAthenzDomain(domainName, false); + if (domain == null) { + throw ZMSUtils.notFoundError("getDomainDataCheck: Domain not found: '" + domainName + "'", caller); + } + + // build set of roles + // iterate them to look for trust roles - in case this is a provider domain + + Set roleSet = new HashSet<>(); + Set trustRoleSet = new HashSet<>(); + + // map per trust/tenant domain that contains the trust roles + + Map> trustRoleMap = new HashMap>(); + for (Role role : domain.getRoles()) { + if (LOG.isDebugEnabled()) { + LOG.debug("getDomainDataCheck: processing role - " + role.getName()); + } + roleSet.add(role.getName()); + String roleName = ZMSUtils.removeDomainPrefix(role.getName(), domainName, ROLE_PREFIX); + String trustDomain = role.getTrust(); + if (trustDomain != null) { + if (LOG.isDebugEnabled()) { + LOG.debug("trust role for domain: " + trustDomain); + } + trustRoleSet.add(trustDomain); + Set tset = trustRoleMap.get(trustDomain); + if (tset == null) { + tset = new HashSet(); + trustRoleMap.put(trustDomain, tset); + } + tset.add(roleName); + } + } + + // look for dangling roles and policies + // + int assertionCount = 0; + int roleWildcardCount = 0; + Set usedRoleSet = new HashSet<>(); // keep track of roles used by policies + Set providerSet = new HashSet<>(); // keep track of providers from assume_role policies + + // assume_role resources are placed into the set per provider service domain + + Map> svcRoleMap = new HashMap>(); + List danglingPolicies = new ArrayList<>(); + List policies = domain.getPolicies(); + for (Policy policy : policies) { + String pname = ZMSUtils.removeDomainPrefix(policy.getName(), domainName, POLICY_PREFIX); + if (LOG.isDebugEnabled()) { + LOG.debug("getDomainDataCheck: processing policy=" + pname + " in domain=" + domainName); + } + + List assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + + for (Assertion assertion : assertions) { + assertionCount++; + if (ZMSConsts.ACTION_ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { + // get provider domain+service name and add to set of providers + // Note there may be a resource appended - to be dealt with later + // ex: testgetdomaindatacheck:policy.tenancy.testgetdomaindatacheckprovider.storage.reader + // ex: testgetdomaindatacheck:policy.tenancy.testgetdomaindatacheckprovider.sub.storage.res_group.ravers.reader + // index after "tenancy." and index of last dot + int index = pname.indexOf("tenancy."); + if (index == -1) { + continue; + } + int lindex = pname.lastIndexOf('.'); + if (lindex == -1) { + continue; + } + String provSvcDomain = pname.substring(index + "tenancy.".length(), lindex); + providerSet.add(provSvcDomain); + + // lets collect the resource field that is name of role in provider + // ex: testgetdomaindatacheckprovider.sub:role.storage.tenant.testgetdomaindatacheck.reader + // ex: testgetdomaindatacheckprovider.sub:role.storage.tenant.testgetdomaindatacheck.res_group.ravers.reader + String rsrc = assertion.getResource(); + Set rset = svcRoleMap.get(provSvcDomain); + if (rset == null) { + rset = new HashSet(); + svcRoleMap.put(provSvcDomain, rset); + } + rset.add(rsrc); + } + + String roleName = assertion.getRole(); + + // check for wildcard role + if (roleName.lastIndexOf('*') != -1) { + roleWildcardCount++; + // make sure there is at least 1 role that can match + // this wildcard - else its a dangling policy + String rolePattern = StringUtils.patternFromGlob(roleName); + boolean wildCardMatch = false; + for (String role: roleSet) { + if (role.matches(rolePattern)) { + wildCardMatch = true; + break; + } + } + if (wildCardMatch == false) { // dangling policy + DanglingPolicy dp = new DanglingPolicy(); + // we need to remove the domain:role. and domain:policy prefixes + // according to RDL definitions for role and policy names + dp.setRoleName(ZMSUtils.removeDomainPrefix(roleName, domainName, ROLE_PREFIX)); + dp.setPolicyName(ZMSUtils.removeDomainPrefix(pname, domainName, POLICY_PREFIX)); + danglingPolicies.add(dp); + } + } else if (roleSet.contains(roleName)) { + usedRoleSet.add(roleName); + } else { // dangling policy + DanglingPolicy dp = new DanglingPolicy(); + // we need to remove the domain:role. and domain:policy prefixes + // according to RDL definitions for role and policy names + dp.setRoleName(ZMSUtils.removeDomainPrefix(roleName, domainName, ROLE_PREFIX)); + dp.setPolicyName(ZMSUtils.removeDomainPrefix(pname, domainName, POLICY_PREFIX)); + danglingPolicies.add(dp); + } + } + } + + DomainDataCheck ddc = new DomainDataCheck(); + ddc.setPolicyCount(policies.size()); + ddc.setAssertionCount(assertionCount); + ddc.setRoleWildCardCount(roleWildcardCount); + if (!danglingPolicies.isEmpty()) { + ddc.setDanglingPolicies(danglingPolicies); + } + + if (roleSet.size() != usedRoleSet.size()) { + // ohoh, some roles are unused - need to subtract the usedRoleSet + // from roleSet - the leftovers are the unused roles + roleSet.removeAll(usedRoleSet); + // we need to remove the domain:role. prefix according to + // RDL definition for dangling role names + List danglingRoleList = new ArrayList(); + for (String roleName : roleSet) { + danglingRoleList.add(ZMSUtils.removeDomainPrefix(roleName, domainName, ROLE_PREFIX)); + } + ddc.setDanglingRoles(danglingRoleList); + } + + if (LOG.isDebugEnabled()) { + LOG.debug("getDomainDataCheck: domain=" + domainName + + " policy-count=" + policies.size() + " assertion-count=" + + assertionCount + " wildcard-count==" + roleWildcardCount + + " dangling-policies=" + danglingPolicies.size() + + " dangling-roles=" + roleSet.size()); + } + + // Tenant Domain Check: does each provider fully support this tenant? + // collect Service names (domain.service) for domains that don't contain + // trust role + List provsWithoutTrust = new ArrayList<>(); + for (String provSvc : providerSet) { + if (LOG.isDebugEnabled()) { + LOG.debug("getDomainDataCheck: domain=" + domainName + + " provider-service=" + provSvc); + } + + // 2 cases to resolve, one with resource group, one without + // ex: iaas.stuff.storage.read + // ex: iaas.stuff.storage.res_group.my_resource_group.read + + int idx = provSvc.indexOf(".res_group."); + String provSvcDomain = null; + if (idx == -1) { + provSvcDomain = providerServiceDomain(provSvc); + } else { + provSvcDomain = providerServiceDomain(provSvc.substring(0, idx)); + } + + AthenzDomain providerDomain = getAthenzDomain(provSvcDomain, true); + Set rset = svcRoleMap.get(provSvc); + if (rset == null || rset.isEmpty() || providerDomain == null) { + provsWithoutTrust.add(provSvc); + continue; + } + + // find trust role in the provider that contains the tenant domain + int foundTrust = 0; + for (Role role : providerDomain.getRoles()) { + String trustDomain = role.getTrust(); + if (trustDomain != null) { + if (domainName.equals(trustDomain)) { + // is this role a match for an assume role in the tenant + // look for the role in the role set for this service + if (rset.contains(role.getName())) { + foundTrust++; + } + } + } + } + if (foundTrust != rset.size()) { + provsWithoutTrust.add(provSvc); + } + } + if (!provsWithoutTrust.isEmpty()) { + ddc.setProvidersWithoutTrust(provsWithoutTrust); + } + + // Provider Domain Check: does each tenant have all the assume_role + // assertions to match each trust role. + + // tenantsWithoutProv: names of Tenant domains that dont contain assume + // role assertions if this is a provider domain + List tenantsWithoutProv = new ArrayList<>(); + + // tenantDomMap: optimize reading tenant domains once already read + // This is optimizing for Providers with lots of tenants. + Map tenantDomMap = new HashMap<>(); + for (String trustRole: trustRoleSet) { + + if (LOG.isDebugEnabled()) { + LOG.debug("getDomainDataCheck: processing trust role: " + trustRole); + } + + AthenzDomain tenantDomain = tenantDomMap.get(trustRole); + if (tenantDomain == null) { + tenantDomain = getAthenzDomain(trustRole, true); + if (tenantDomain == null) { + tenantsWithoutProv.add(trustRole); + continue; + } else { + tenantDomMap.put(trustRole, tenantDomain); + } + } + + // Get set of providers trust roles for trust/tenant domain. + Set tset = trustRoleMap.get(trustRole); + if (tset == null || tset.isEmpty()) { + tenantsWithoutProv.add(trustRole); + continue; + } + + int foundProviderCnt = 0; + + // Check for assume_role containing the provider in the tenantDomain + for (Policy policy : tenantDomain.getPolicies()) { + List assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + for (Assertion assertion : assertions) { + if (ZMSConsts.ACTION_ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { + String rsrc = assertion.getResource(); + // If the provider domain contains a role that matches + // the tenant domain resource - then the tenant is supported + if (roleSet.contains(rsrc)) { + // HAVE: an assume_role with resource pointing at the provider + foundProviderCnt++; + } + } + } + } + if (foundProviderCnt < tset.size()) { + // didnt find all required matching provider trust-role to assume_role-resource pairs + tenantsWithoutProv.add(trustRole); + } + } + if (!tenantsWithoutProv.isEmpty()) { + ddc.setTenantsWithoutAssumeRole(tenantsWithoutProv); + } + + metric.stopTiming(timerMetric); + return ddc; + } + + public ProviderResourceGroupRoles deleteProviderResourceGroupRoles(ResourceContext ctx, String tenantDomain, + String provSvcDomain, String provSvcName, String resourceGroup, String auditRef) { + + final String caller = "deleteproviderresourcegrouproles"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("deleteproviderresourcegrouproles_timing", provSvcDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // first clean-up local domain roles and policies for this tenant + + dbService.executeDeleteTenancy(ctx, tenantDomain, provSvcDomain, provSvcName, + resourceGroup, auditRef, caller); + + // at this point the tenant side is complete. If the token was a chained + // token signed by the provider service then we're going to process the + // provider side as well thus complete the tenancy delete process + + String authorizedService = ((RsrcCtxWrapper) ctx).principal().getAuthorizedService(); + if (isAuthorizedProviderService(authorizedService, provSvcDomain, provSvcName, + tenantDomain, auditRef)) { + + dbService.executeDeleteTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, + resourceGroup, auditRef, caller); + } + + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified provider-service=(").append(provSvcName) + .append(");resource-group=(").append(resourceGroup).append(")"); + auditRequestFailure(ctx, exc, tenantDomain, provSvcDomain, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + public ProviderResourceGroupRoles getProviderResourceGroupRoles(ResourceContext ctx, String tenantDomain, + String provSvcDomain, String provSvcName, String resourceGroup) { + + final String caller = "getproviderresourcegrouproles"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("getproviderresourcegrouproles_timing", provSvcDomain); + + Domain domain = dbService.getDomain(tenantDomain); + if (domain == null) { + throw ZMSUtils.notFoundError("No such domain: " + tenantDomain, caller); + } + + // look for this provider roles, ex: storage.tenant.sports.reader + + String rolePrefix = ZMSUtils.getProviderResourceGroupRolePrefix(provSvcDomain, provSvcName, resourceGroup); + ProviderResourceGroupRoles provRoles = new ProviderResourceGroupRoles().setDomain(provSvcDomain) + .setService(provSvcName).setTenant(tenantDomain).setResourceGroup(resourceGroup); + + List tralist = new ArrayList(); + + // find roles matching the prefix + + List rcollection = dbService.listRoles(tenantDomain); + for (String rname: rcollection) { + + if (dbService.isTenantRolePrefixMatch(rname, rolePrefix, null)) { + + // for provider roles we don't have the action, that's + // for the provider domain only so we're just going + // to return the list of roles without any actions + // for the role name we must return the SimpleName + // part only so we'll remove the prefix section + + TenantRoleAction tra = new TenantRoleAction() + .setRole(rname.substring(rolePrefix.length())) + .setAction("n/a"); + tralist.add(tra); + } + } + provRoles.setRoles(tralist); + + metric.stopTiming(timerMetric); + return provRoles; + } + + boolean isAuthorizedProviderService(String authorizedService, String provSvcDomain, + String provSvcName, String tenantDomain, String auditRef) { + + // make sure we have a service provided and it matches to our provider + + if (authorizedService == null) { + return false; + } + + if (!authorizedService.equals(provSvcDomain + "." + provSvcName)) { + return false; + } + + // verify that provider service does indeed have access to provision + // its own tenants. the authorize statement for the putTenantRole + // command is defined in the RDL as: + // authorize ("UPDATE", "{domain}:tenant.{tenantDomain}"); + + AthenzDomain domain = getAthenzDomain(provSvcDomain, true); + if (domain == null) { + return false; + } + + // evaluate our domain's roles and policies to see if access + // is allowed or not for the given operation and resource + + String resource = provSvcDomain + ":tenant." + tenantDomain; + AccessStatus accessStatus = evaluateAccess(domain, authorizedService, "update", + resource, null, null); + + if (accessStatus == AccessStatus.ALLOWED) { + return true; + } else { + return false; + } + } + + /** + * This sets up the assume roles in the tenant. If the tenants admin user + * token has been authorized by the provider, the providers domain will be + * updated as well, thus completing the tenancy on-boarding in a single step. + **/ + public ProviderResourceGroupRoles putProviderResourceGroupRoles(ResourceContext ctx, String tenantDomain, + String provSvcDomain, String provSvcName, String resourceGroup, String auditRef, + ProviderResourceGroupRoles detail) { + + final String caller = "putproviderresourcegrouproles"; + metric.increment(ZMSConsts.HTTP_PUT); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); //not including the domain, this is the domain's service + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(detail, TYPE_PROVIDER_RESOURCE_GROUP_ROLES, caller); + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + AthenzObject.PROVIDER_RESOURCE_GROUP_ROLES.convertToLowerCase(detail); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("putproviderresourcegrouproles_timing", provSvcDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + if (LOG.isInfoEnabled()) { + LOG.info("putProviderResourceGroupRoles: domain=" + provSvcDomain + ", service=" + + provSvcName + ", tenant-domain=" + tenantDomain + ", resource-group=" + resourceGroup + + ", detail=" + detail); + } + + // set up our tenant admin policy so provider can check admin's access + + dbService.setupTenantAdminPolicy(ctx, tenantDomain, provSvcDomain, provSvcName, auditRef, caller); + + // now we're going to setup our roles + + List roleActions = detail.getRoles(); + if (roleActions == null || roleActions.size() == 0) { + throw ZMSUtils.requestError("putProviderResourceGroupRoles: must include at least one role", caller); + } + + List roles = new ArrayList<>(); + for (TenantRoleAction roleAction : roleActions) { + roles.add(roleAction.getRole()); + } + + // we're going to create a separate role for each one of tenant roles returned + // based on its action and set the caller as a member in each role + + dbService.executePutProviderRoles(ctx, tenantDomain, provSvcDomain, provSvcName, resourceGroup, + roles, auditRef, caller); + + // at this point the tenant side is complete. If the token was a chained + // token signed by the provider service then we're going to process the + // provider side as well thus complete the tenancy on-boarding process + + String authorizedService = ((RsrcCtxWrapper) ctx).principal().getAuthorizedService(); + if (isAuthorizedProviderService(authorizedService, provSvcDomain, provSvcName, + tenantDomain, auditRef)) { + + dbService.executePutTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, + resourceGroup, roleActions, auditRef, caller); + } + + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified provider-service=(").append(provSvcName) + .append(");resource-group=(").append(resourceGroup).append(")"); + auditRequestFailure(ctx, exc, tenantDomain, provSvcDomain, caller, ZMSConsts.HTTP_PUT, + sb.toString(), auditRef); + throw exc; + } + + return detail; + } + + String getProviderRoleAction(String provSvcDomain, String roleName) { + + // if no match then we're going to default action of empty string + + Policy policy = dbService.getPolicy(provSvcDomain, roleName); // policy has same name + if (policy == null) { + return ""; + } + + List assertions = policy.getAssertions(); + if (assertions == null) { + return ""; + } + + for (Assertion assertion : assertions) { + if (!assertion.getRole().endsWith(roleName)) { + continue; + } + + return assertion.getAction(); + } + + return ""; + } + + public TenantRoles getTenantRoles(ResourceContext ctx, String provSvcDomain, String provSvcName, + String tenantDomain) { + + final String caller = "gettenantroles"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); // not including the domain, this is the domain's service type + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("gettenantroles_timing", provSvcDomain); + + // look for this tenants roles, ex: storage.tenant.sports.reader + String rolePrefix = ZMSUtils.getTenantResourceGroupRolePrefix(provSvcName, tenantDomain, null); + TenantRoles troles = new TenantRoles().setDomain(provSvcDomain).setService(provSvcName) + .setTenant(tenantDomain); + + Domain domain = dbService.getDomain(provSvcDomain); + if (domain == null) { + throw ZMSUtils.notFoundError("getTenantRoles: No such domain: " + provSvcDomain, caller); + } + + List tralist = new ArrayList(); + + // find roles matching the prefix + List rcollection = dbService.listRoles(provSvcDomain); + for (String rname: rcollection) { + if (dbService.isTrustRoleForTenant(provSvcDomain, rname, rolePrefix, tenantDomain)) { + // good, its exactly what we are looking for, but + // now we want the ACTION that was set in the provider + + String action = getProviderRoleAction(provSvcDomain, rname); + + // for the role name we must return the SimpleName + // part only so we'll remove the prefix section + + TenantRoleAction tra = new TenantRoleAction() + .setRole(rname.substring(rolePrefix.length())) + .setAction(action); + tralist.add(tra); + } + } + troles.setRoles(tralist); + + metric.stopTiming(timerMetric); + return troles; + } + + public TenantResourceGroupRoles getTenantResourceGroupRoles(ResourceContext ctx, String provSvcDomain, + String provSvcName, String tenantDomain, String resourceGroup) { + + final String caller = "gettenantresourcegrouproles"; + metric.increment(ZMSConsts.HTTP_GET); + + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); // not including the domain, this is the domain's service type + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("gettenantresourcegrouproles_timing", provSvcDomain); + + // look for this tenants roles, ex: storage.tenant.sports.reader + + String rolePrefix = ZMSUtils.getTenantResourceGroupRolePrefix(provSvcName, tenantDomain, resourceGroup); + TenantResourceGroupRoles troles = new TenantResourceGroupRoles().setDomain(provSvcDomain) + .setService(provSvcName).setTenant(tenantDomain).setResourceGroup(resourceGroup); + + Domain domain = dbService.getDomain(provSvcDomain); + if (domain == null) { + throw ZMSUtils.notFoundError("getTenantResourceGroupRoles: No such domain: " + provSvcDomain, caller); + } + + List tralist = new ArrayList(); + + // find roles matching the prefix + + List rcollection = dbService.listRoles(provSvcDomain); + for (String rname: rcollection) { + if (dbService.isTrustRoleForTenant(provSvcDomain, rname, rolePrefix, tenantDomain)) { + + // good, its exactly what we are looking for, but + // now we want the ACTION that was set in the provider + + String action = getProviderRoleAction(provSvcDomain, rname); + + // for the role name we must return the SimpleName + // part only so we'll remove the prefix section + + TenantRoleAction tra = new TenantRoleAction() + .setRole(rname.substring(rolePrefix.length())) + .setAction(action); + tralist.add(tra); + } + } + troles.setRoles(tralist); + + metric.stopTiming(timerMetric); + return troles; + } + + public TenantRoles deleteTenantRoles(ResourceContext ctx, String provSvcDomain, String provSvcName, + String tenantDomain, String auditRef) { + + final String caller = "deletetenantroles"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); // not including the domain, this is the domain's service type + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("deletetenantroles_timing", provSvcDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + dbService.executeDeleteTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, + null, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified provider-service=(").append(provSvcName).append(')'); + auditRequestFailure(ctx, exc, provSvcDomain, tenantDomain, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + public TenantResourceGroupRoles deleteTenantResourceGroupRoles(ResourceContext ctx, String provSvcDomain, + String provSvcName, String tenantDomain, String resourceGroup, String auditRef) { + + final String caller = "deletetenantresourcegrouproles"; + metric.increment(ZMSConsts.HTTP_DELETE); + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(provSvcDomain, TYPE_DOMAIN_NAME, caller); + validate(provSvcName, TYPE_SIMPLE_NAME, caller); // not including the domain, this is the domain's service type + validate(tenantDomain, TYPE_DOMAIN_NAME, caller); + validate(resourceGroup, TYPE_COMPOUND_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + provSvcDomain = provSvcDomain.toLowerCase(); + provSvcName = provSvcName.toLowerCase(); + tenantDomain = tenantDomain.toLowerCase(); + resourceGroup = resourceGroup.toLowerCase(); + + metric.increment(ZMSConsts.HTTP_REQUEST, provSvcDomain); + metric.increment(caller, provSvcDomain); + Object timerMetric = metric.startTiming("deletetenantresourcegrouproles_timing", provSvcDomain); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + dbService.executeDeleteTenantRoles(ctx, provSvcDomain, provSvcName, tenantDomain, + resourceGroup, auditRef, caller); + metric.stopTiming(timerMetric); + + } catch (Exception exc) { + + StringBuilder sb = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + sb.append(":caller specified provider-service=(").append(provSvcName).append(')'); + auditRequestFailure(ctx, exc, provSvcDomain, tenantDomain, caller, ZMSConsts.HTTP_DELETE, + sb.toString(), auditRef); + throw exc; + } + + return null; + } + + String yrnDomain(String yrn) { + //"yrn:service:location:domain:entity" or "domain:entity" + String [] s = yrn.split(":"); + if (s.length <= 2) { + return s[0]; + } else if (s.length == 5) { + return s[3]; + } else { + if (LOG.isDebugEnabled()) { + LOG.debug("yrnDomain: missing domain name: " + yrn); + } + return null; + } + } + + void validate(Object val, String type, String caller) { + if (val == null) { + throw ZMSUtils.requestError("Missing or malformed " + type, caller); + } + + Result result = validator.validate(val, type); + if (!result.valid) { + throw ZMSUtils.requestError("Invalid " + type + " error: " + result.error, caller); + } + } + + List validatedAdminUsers(List lst) { + + final String caller = "validatedadminusers"; + + if (lst == null || lst.size() == 0) { + throw ZMSUtils.requestError("validatedAdminUsers: Missing adminUsers", caller); + } + Set users = new HashSet<>(); + for (String user : lst) { + validate(user, TYPE_RESOURCE_NAME, caller); + users.add(user); + } + return new ArrayList(users); + } + + Domain createTopLevelDomain(ResourceContext ctx, String domainName, String description, + String org, Boolean auditEnabled, List adminUsers, String account, + int productId, List solutionTemplates, String auditRef) { + List users = validatedAdminUsers(adminUsers); + return dbService.makeDomain(ctx, domainName, description, org, auditEnabled, + users, account, productId, solutionTemplates, auditRef); + } + + Domain createSubDomain(ResourceContext ctx, String parentName, String name, String description, + String org, Boolean auditEnabled, List adminUsers, String account, + int productId, List solutionTemplates, String auditRef, String caller) { + + // verify length of full sub domain name + String fullSubDomName = parentName + "." + name; + if (fullSubDomName.length() > domainNameMaxLen) { + throw ZMSUtils.requestError("Invalid SubDomain name: " + fullSubDomName + " : name length cannot exceed: " + domainNameMaxLen, caller); + } + + List users = validatedAdminUsers(adminUsers); + return dbService.makeDomain(ctx, fullSubDomName, description, org, auditEnabled, + users, account, productId, solutionTemplates, auditRef); + } + + int countDots(String str) { + int count = 0; + int i = str.indexOf('.'); + while (i >= 0) { + count++; + i = str.indexOf('.', i + 1); + } + return count; + } + + boolean hasExceededDepthLimit(Integer depth, String name) { + + if (depth == null) { + return false; + } + + // depth=0 means only top level + + if (countDots(name) > depth) { + return true; + } else { + return false; + } + } + + DomainList listDomains(Integer limit, String skip, String prefix, Integer depth, long modTime) { + + //note: we don't use the store's options, because we also need to filter on depth + + List allDomains = dbService.listDomains(prefix, modTime); + List names = new ArrayList(); + + for (String name : allDomains) { + if (hasExceededDepthLimit(depth, name)) { + continue; + } + names.add(name); + } + + int count = names.size(); + if (skip != null) { + for (int i = 0; i < count; i++) { + String name = names.get(i); + if (skip.equals(name)) { + names = names.subList(i + 1, count); + count = names.size(); + break; + } + } + } + + DomainList result = new DomainList(); + + // if we have exceeded our requested list then + // set the next skip entry in our result + + if (hasExceededListLimit(limit, count)) { + names = names.subList(0, limit); + result.setNext(names.get(limit - 1)); + } + + result.setNames(names); + return result; + } + + boolean isZMSService(String domain, String service) { + return (SYS_AUTH.equalsIgnoreCase(domain) && ZMS.equalsIgnoreCase(service)); + } + + /** + * implements KeyStore getPublicKey + * @return String with PEM encoded key, which should be ybase64decoded prior + * to return if ybase64encoded + **/ + @Override + public String getPublicKey(String domain, String service, String keyId) { + + if (LOG.isDebugEnabled()) { + LOG.debug("getPublicKey: service=" + domain + "." + service + " key-id=" + keyId); + } + + if (service == null || keyId == null) { + return null; + } + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domain = domain.toLowerCase(); + service = service.toLowerCase(); + keyId = keyId.toLowerCase(); + + // special handling for service sys.auth.zms which is ourselves + // so we'll just lookup our key in our map + + String pubKey = null; + if (isZMSService(domain, service)) { + pubKey = serverPublicKeyMap.get(keyId); + } + + // if it's not the ZMS Server public key then lookup the + // public key from ZMS data + + if (pubKey == null) { + try { + PublicKeyEntry keyEntry = dbService.getServicePublicKeyEntry(domain, service, keyId); + if (keyEntry != null) { + pubKey = keyEntry.getKey(); + } + } catch (ResourceException ex) { + if (LOG.isDebugEnabled()) { + LOG.debug("getPublicKey: unable to get public key: " + ex.getMessage()); + } + return null; + } + } + + if (pubKey == null) { + if (LOG.isWarnEnabled()) { + LOG.warn("getPublicKey: service=" + domain + "." + service + " has no public key registered"); + } + return null; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("getPublicKey: service public key: " + pubKey); + } + + return Crypto.ybase64DecodeString(pubKey); + } + + @Override + public DefaultAdmins putDefaultAdmins(ResourceContext ctx, String domainName, String auditRef, + DefaultAdmins defaultAdmins) { + + final String caller = "putdefaultadmins"; + metric.increment(ZMSConsts.HTTP_PUT); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("putdefaultadmins_timing", null); + + if (LOG.isDebugEnabled()) { + LOG.debug("putDefaultAdmins: domain = " + domainName); + } + + if (readOnlyMode) { + throw ZMSUtils.requestError("Server in Maintenance Read-Only mode. Please try your request later", caller); + } + + try { + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // verify that request is properly authenticated for this request + + verifyAuthorizedServiceOperation(((RsrcCtxWrapper) ctx).principal().getAuthorizedService(), caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + AthenzObject.DEFAULT_ADMINS.convertToLowerCase(defaultAdmins); + + AthenzDomain domain = getAthenzDomain(domainName, false); + if (domain == null) { + throw ZMSUtils.notFoundError("putDefaultAdmins: Domain not found: '" + domainName + "'", caller); + } + + Role adminRole = null; + for (Role role : domain.getRoles()) { + if (ADMIN_ROLE_NAME.equals(ZMSUtils.removeDomainPrefix(role.getName(), domainName, ROLE_PREFIX))) { + adminRole = role; + break; + } + } + if (adminRole == null) { + // if the admin role does not exist in the role section then add it + // this typically should never happen since we have added the + // check to disallow deletion of the admin role but we'll keep + // the logic in place + + if (LOG.isInfoEnabled()) { + LOG.info("putDefaultAdmins: Adding domain admin role because no domain admin role was found for domain: " + domainName); + } + adminRole = ZMSUtils.makeAdminRole(domainName, new ArrayList()); + dbService.executePutRole(ctx, domainName, ADMIN_ROLE_NAME, adminRole, auditRef, caller); + } + + Policy adminPolicy = null; + for (Policy policy : domain.getPolicies()) { + if (ADMIN_POLICY_NAME.equals(ZMSUtils.removeDomainPrefix(policy.getName(), domainName, POLICY_PREFIX))) { + adminPolicy = policy; + break; + } + } + if (adminPolicy == null) { + // if the admin policy does not exist in the policy section then add it + // this typically should never happen since we have added the + // check to disallow deletion of the admin policy but we'll keep + // the logic in place + + if (LOG.isInfoEnabled()) { + LOG.info("putDefaultAdmins: Adding domain admin policy because no domain admin policy was found for domain: " + domainName); + } + //Create and add the admin policy + adminPolicy = ZMSUtils.makeAdminPolicy(domainName, adminRole); + dbService.executePutPolicy(ctx, domainName, ADMIN_POLICY_NAME, adminPolicy, auditRef, caller); + } + + addDefaultAdminAssertion(ctx, domainName, adminPolicy, auditRef, caller); + + removeAdminDenyAssertions(ctx, domainName, domain.getPolicies(), domain.getRoles(), adminRole, + defaultAdmins, auditRef, caller); + + addDefaultAdminMembers(ctx, domainName, adminRole, defaultAdmins, auditRef, caller); + + } catch (Exception exc) { + + String auditDetails = auditListItems("caller specified default-admins", defaultAdmins.getAdmins()); + auditRequestFailure(ctx, exc, domainName, domainName, caller, ZMSConsts.HTTP_PUT, + auditDetails, auditRef); + throw exc; + } + + metric.stopTiming(timerMetric); + return null; + } + + void addDefaultAdminAssertion(ResourceContext ctx, String domainName, Policy adminPolicy, + String auditRef, String caller) { + + if (LOG.isDebugEnabled()) { + LOG.debug("addDefaultAdminAssertion"); + } + + String domainAllResources = domainName + ":*"; + String domainAdminRole = ZMSUtils.roleResourceName(domainName, ADMIN_ROLE_NAME); + + List assertions = adminPolicy.getAssertions(); + if (assertions != null) { + + for (Assertion assertion : assertions) { + String resource = assertion.getResource(); + if (resource == null) { + continue; + } + + String action = assertion.getAction(); + if (action == null) { + continue; + } + + String role = assertion.getRole(); + if (role == null) { + continue; + } + + // default effect is no value is ALLOW + AssertionEffect effect = assertion.getEffect(); + if (effect == null) { + effect = AssertionEffect.ALLOW; + } + + if (resource.equals(domainAllResources) && action.equals("*") && + role.equals(domainAdminRole) && (effect == AssertionEffect.ALLOW)) { + // found an assertion for resource = :*, with action = "*", + // for role = :role.admin and effect = "ALLOW" + // (if effect is null then defaults to ALLOW) so no need to add it + return; + } + } + } + + if (LOG.isInfoEnabled()) { + LOG.info("Adding default admin assertion to admin policy because no default admin assertion was found for admin policy for domain: " + domainName); + } + + ZMSUtils.addAssertion(adminPolicy, domainAllResources, "*", domainAdminRole, AssertionEffect.ALLOW); + dbService.executePutPolicy(ctx, domainName, ADMIN_POLICY_NAME, adminPolicy, auditRef, caller); + } + + void removeAdminDenyAssertions(ResourceContext ctx, String domainName, List policies, + List roles, Role adminRole, DefaultAdmins defaultAdmins, String auditRef, String caller) { + + if (LOG.isDebugEnabled()) { + LOG.debug("removeAdminDenyAssertions"); + } + + for (Policy policy : policies) { + + if (LOG.isDebugEnabled()) { + LOG.debug("access: processing policy: " + policy.getName()); + } + + // Process all the assertions defined in this policy + // As soon as match for an assertion that + // denies access to the admin role is detected, remove it + + List assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + List assertionsToDelete = new ArrayList<>(); + + for (Assertion assertion : assertions) { + + // If there is no "effect" in the assertion then default is ALLOW + // so continue because logic is looking for DENY + AssertionEffect effect = assertion.getEffect(); + if (effect == null || effect != AssertionEffect.DENY) { + continue; + } + + // If there is no role in the assertion then admin is not being denied + String assertionRole = assertion.getRole(); + if (assertionRole == null) { + continue; + } + + if (LOG.isDebugEnabled()) { + LOG.debug("Found DENY assertion for role " + assertionRole); + } + + // role matches admin role then remove it + if (assertionRole.equals(adminRole.getName())) { + assertionsToDelete.add(assertion); + } else { + removeAdminMembers(ctx, domainName, roles, assertionRole, defaultAdmins, auditRef, caller); + } + } + + if (assertionsToDelete.isEmpty()) { + continue; + } + + if (LOG.isInfoEnabled()) { + LOG.info("Removing assertion from policy: " + policy.getName() + " because it was for the domain admin role."); + } + + for (Assertion assertion : assertionsToDelete) { + assertions.remove(assertion); + } + + String policyName = ZMSUtils.removeDomainPrefix(policy.getName(), domainName, POLICY_PREFIX); + if (assertions.size() == 0) { + if (LOG.isInfoEnabled()) { + LOG.info("Removing policy: " + policyName + + " because it did not have any assertions after removing a DENY" + + " assertion for the domain admin role."); + } + + dbService.executeDeletePolicy(ctx, domainName, policyName, auditRef, caller); + } else { + dbService.executePutPolicy(ctx, domainName, policyName, policy, auditRef, caller); + } + } + } + + void removeAdminMembers(ResourceContext ctx, String domainName, List roles, + String assertionRole, DefaultAdmins defaultAdmins, String auditRef, String caller) { + + + for (Role role : roles) { + + if (LOG.isDebugEnabled()) { + LOG.debug("removeAdminMembers: Removing admin members from role: " + role.getName()); + } + + if (!assertionRole.equals(role.getName())) { + continue; + } + + String roleName = ZMSUtils.removeDomainPrefix(role.getName(), domainName, ROLE_PREFIX); + for (String adminName : defaultAdmins.getAdmins()) { + if (isMemberOfRole(role, adminName)) { + if (LOG.isInfoEnabled()) { + LOG.info("removeAdminMembers: removing member: " + adminName + " from role: " + + roleName + " because there is a DENY assertion for this role in this domain."); + } + + dbService.executeDeleteMembership(ctx, domainName, roleName, adminName, auditRef, caller); + } + } + } + } + + void addDefaultAdminMembers(ResourceContext ctx, String domainName, Role adminRole, + DefaultAdmins defaultAdmins, String auditRef, String caller) { + + if (LOG.isDebugEnabled()) { + LOG.debug("addDefaultAdminMembers"); + } + + for (String adminName : defaultAdmins.getAdmins()) { + if (!isMemberOfRole(adminRole, adminName)) { + if (LOG.isInfoEnabled()) { + LOG.info("Adding member: " + adminName + " to admin role for domain: " + domainName); + } + dbService.executePutMembership(ctx, domainName, ADMIN_ROLE_NAME, + adminName, auditRef, caller); + } + } + } + + public ServicePrincipal getServicePrincipal(ResourceContext ctx) { + + final String caller = "getserviceprincipal"; + metric.increment(ZMSConsts.HTTP_GET); + + // we need to make sure we're only validating service/user tokens + // so any thing that's been authenticated by the PrincipalAuthority + // and/or authorities that do not support authorization + + ServicePrincipal servicePrincipal = null; + Principal principal = ((RsrcCtxWrapper) ctx).principal(); + Authority authority = principal.getAuthority(); + + metric.increment(ZMSConsts.HTTP_REQUEST, principal.getDomain()); + metric.increment(caller, principal.getDomain()); + Object timerMetric = metric.startTiming("getserviceprincipal_timing", principal.getDomain()); + + // If the authority is our PrincipalAuthority, then we're not making + // any changes and sending the authenticated token as is. However, + // if the authority does not support authorization then we're going to + // generate a new ServiceToken signed by ZMS and send that back. + + if (authority instanceof com.yahoo.athenz.auth.impl.PrincipalAuthority) { + + servicePrincipal = new ServicePrincipal(); + servicePrincipal.setDomain(principal.getDomain()); + servicePrincipal.setService(principal.getName()); + servicePrincipal.setToken(principal.getCredentials()); + + } else if (!authority.allowAuthorization()) { + + PrincipalToken sdToken = new PrincipalToken(principal.getCredentials()); + PrincipalToken zmsToken = new PrincipalToken.Builder("S1", sdToken.getDomain(), sdToken.getName()) + .issueTime(sdToken.getTimestamp()) + .expirationWindow(sdToken.getExpiryTime() - sdToken.getTimestamp()) + .ip(sdToken.getIP()).keyId(privateKeyId).host(serverHostName) + .keyService(ZMS).build(); + zmsToken.sign(privateKey); + servicePrincipal = new ServicePrincipal(); + servicePrincipal.setDomain(principal.getDomain()); + servicePrincipal.setService(principal.getName()); + servicePrincipal.setToken(zmsToken.getSignedToken()); + + } else { + throw ZMSUtils.requestError("getServicePrincipal: Provided Token is not a Service/User Token", caller); + } + + metric.stopTiming(timerMetric); + return servicePrincipal; + } + + void verifyAuthorizedServiceOperation(String authorizedService, String operationName) { + verifyAuthorizedServiceOperation(authorizedService, operationName, null, null); + } + + /** + * If opItemType and value are not defined in the authorized_services JSON file, + * you can simply pass NULL for these two values. + */ + void verifyAuthorizedServiceOperation(String authorizedService, String operationName, + String opItemType, String opItemVal) { + + // only process this request if we have an authorized service specified + + if (authorizedService == null) { + return; + } + + // lookup the authorized services struct and see if we have the + // service specified in the allowed list + + AuthorizedService authzService = serverAuthorizedServices.get(authorizedService); + if (authzService == null) { + throw ZMSUtils.forbiddenError("Unauthorized Service " + authorizedService, operationName); + } + + // if the list is empty then we allow all the operations + ArrayList ops = authzService.getAllowedOperations(); + if (ops == null || ops.isEmpty()) { + return; + } + + // otherwise make sure the operation is allowed for this service + boolean opAllowed = false; + for (AllowedOperation op : ops) { + if (!op.getName().equalsIgnoreCase(operationName)) { + continue; + } + + opAllowed = op.isOperationAllowedOn(opItemType, opItemVal); + break; + } + + if (!opAllowed) { + throw ZMSUtils.forbiddenError("Unauthorized Operation (" + operationName + + ") for Service " + authorizedService + + (opItemType != null && opItemType != "" ? " on opItemKey " + opItemType + " and opItemVal " + opItemVal : ""), operationName); + } + } + + @Override + public ResourceAccessList getResourceAccessList(ResourceContext ctx, String principal, String action) { + + final String caller = "getresourceaccesslist"; + metric.increment(ZMSConsts.HTTP_GET); + metric.increment(ZMSConsts.HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming("getresourceaccesslist_timing", null); + + Principal ctxPrincipal = ((RsrcCtxWrapper) ctx).principal(); + if (LOG.isDebugEnabled()) { + LOG.debug("getResourceAccessList:(" + ctxPrincipal + ", " + principal + ", " + action + ")"); + } + + if (principal != null) { + validate(principal, TYPE_ENTITY_NAME, caller); + principal = principal.toLowerCase(); + } + if (action != null) { + validate(action, TYPE_COMPOUND_NAME, caller); + action = action.toLowerCase(); + } + + // if principal is null then we it's a special case + // so we need to make sure the caller is authorized + // to make this request + + if (principal == null || principal.isEmpty()) { + if (!isAllowedResourceLookForAllUsers(ctxPrincipal)) { + throw ZMSUtils.forbiddenError("Principal: " + ctxPrincipal.getYRN() + + " not authorized to lookup resources for all users in Athenz", caller); + } + } + + ResourceAccessList rsrcAccessList = dbService.getResourceAccessList(principal, action); + + metric.stopTiming(timerMetric); + return rsrcAccessList; + } + + static class RsrcCtxWrapper implements ResourceContext { + + com.yahoo.athenz.common.server.rest.ResourceContext ctx = null; + + RsrcCtxWrapper(HttpServletRequest request, + HttpServletResponse response, + Http.AuthorityList authList, Authorizer authorizer) { + ctx = new com.yahoo.athenz.common.server.rest.ResourceContext(request, response, authList, authorizer); + } + + com.yahoo.athenz.common.server.rest.ResourceContext context() { + return ctx; + } + + Principal principal() { + return ctx.principal(); + } + + @Override + public HttpServletRequest request() { + return ctx.request(); + } + + @Override + public HttpServletResponse response() { + return ctx.response(); + } + + @Override + public void authenticate() { + try { + ctx.authenticate(); + } catch (com.yahoo.athenz.common.server.rest.ResourceException restExc) { + throwZmsException(restExc); + } + } + + @Override + public void authorize(String action, String resource, String trustedDomain) { + try { + ctx.authorize(action, resource, trustedDomain); + } catch (com.yahoo.athenz.common.server.rest.ResourceException restExc) { + throwZmsException(restExc); + } + } + + void throwZmsException(com.yahoo.athenz.common.server.rest.ResourceException restExc) { + String msg = null; + Object data = restExc.getData(); + if (data instanceof String) { + msg = (String) data; + } + if (msg == null) { + msg = restExc.getMessage(); + } + throw new com.yahoo.athenz.zms.ResourceException(restExc.getCode(), + new ResourceError().code(restExc.getCode()).message(msg)); + } + } + + public ResourceContext newResourceContext(HttpServletRequest request, HttpServletResponse response) { + return new RsrcCtxWrapper(request, response, authorities, this); + } + + @Override + public Schema getRdlSchema(ResourceContext context) { + return schema; + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSJettyContainer.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSJettyContainer.java new file mode 100644 index 00000000000..36149f4edbc --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSJettyContainer.java @@ -0,0 +1,275 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zms; + +import java.io.File; + +import org.eclipse.jetty.http.HttpHeader; +import org.eclipse.jetty.http.HttpHeaderValue; +import org.eclipse.jetty.http.HttpVersion; +import org.eclipse.jetty.server.HttpConfiguration; +import org.eclipse.jetty.server.HttpConnectionFactory; +import org.eclipse.jetty.server.SecureRequestCustomizer; +import org.eclipse.jetty.server.ServerConnector; +import org.eclipse.jetty.server.Slf4jRequestLog; +import org.eclipse.jetty.server.SslConnectionFactory; +import org.eclipse.jetty.server.handler.RequestLogHandler; +import org.eclipse.jetty.servlet.ServletContextHandler; +import org.eclipse.jetty.servlet.ServletHolder; +import org.eclipse.jetty.util.ssl.SslContextFactory; +import org.eclipse.jetty.rewrite.handler.HeaderPatternRule; +import org.eclipse.jetty.rewrite.handler.RewriteHandler; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import org.glassfish.jersey.servlet.ServletContainer; + +import com.yahoo.athenz.common.server.filters.DefaultMediaTypeFilter; +import com.yahoo.athenz.common.server.log.AthenzRequestLog; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.rest.Http; +import com.yahoo.athenz.common.server.rest.HttpContainer; + +public class ZMSJettyContainer extends HttpContainer { + + AuditLogger auditLogger = null; + + private static final Logger LOG = LoggerFactory.getLogger(ZMSJettyContainer.class); + + static final String ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES = "SSL_RSA_WITH_DES_CBC_SHA," + + "SSL_DHE_RSA_WITH_DES_CBC_SHA,SSL_DHE_DSS_WITH_DES_CBC_SHA," + + "SSL_RSA_EXPORT_WITH_RC4_40_MD5,SSL_RSA_EXPORT_WITH_DES40_CBC_SHA," + + "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"; + static final String ZMS_DEFAULT_EXCLUDED_PROTOCOLS = "SSLv2,SSLv3"; + + public ZMSJettyContainer(AuditLogger auditLog) { + + auditLogger = auditLog; + authorities = new Http.AuthorityList(); + } + + public void addRequestLogHandler(String rootDir) { + + RequestLogHandler requestLogHandler = new RequestLogHandler(); + + // check to see if have a slf4j logger name specified. if we don't + // then we'll just use our NCSARequestLog extended Athenz logger + // when using the slf4j logger we don't have the option to pass + // our audit logger to keep track of unauthenticated requests + + String accessSlf4jLogger = System.getProperty(ZMSConsts.ZMS_PROP_ACCESS_SLF4J_LOGGER); + if (accessSlf4jLogger != null && !accessSlf4jLogger.isEmpty()) { + + Slf4jRequestLog requestLog = new Slf4jRequestLog(); + requestLog.setLoggerName(accessSlf4jLogger); + requestLog.setExtended(true); + requestLog.setPreferProxiedForAddress(true); + requestLog.setLogTimeZone("GMT"); + requestLogHandler.setRequestLog(requestLog); + + } else { + + String logDir = System.getProperty(ZMSConsts.ZMS_PROP_ACCESS_LOG_DIR, rootDir + "/logs/zms_server"); + String logName = System.getProperty(ZMSConsts.ZMS_PROP_ACCESS_LOG_NAME, "access.yyyy_MM_dd.log"); + + AthenzRequestLog requestLog = new AthenzRequestLog(logDir + File.separator + logName, auditLogger); + requestLog.setAppend(true); + requestLog.setExtended(true); + requestLog.setPreferProxiedForAddress(true); + requestLog.setLogTimeZone("GMT"); + + String retainDays = System.getProperty(ZMSConsts.ZMS_PROP_ACCESS_LOG_RETAIN_DAYS, "31"); + int days = Integer.parseInt(retainDays); + if (days > 0) { + requestLog.setRetainDays(days); + } + requestLogHandler.setRequestLog(requestLog); + } + + getHandlers().addHandler(requestLogHandler); + } + + public void addServletHandlers(String homeDir, String serverHostName) { + + RewriteHandler rewriteHandler = new RewriteHandler(); + + // Check whether or not to disable Keep-Alive support in Jetty. + // This will be the first handler in our array so we always set + // the appropriate header in response. However, since we're now + // behind ATS, we want to keep the connections alive so ATS + // can re-use them as necessary + + boolean keepAlive = Boolean.parseBoolean(System.getProperty(ZMSConsts.ZMS_PROP_KEEP_ALIVE, "true")); + + if (!keepAlive) { + HeaderPatternRule disableKeepAliveRule = new HeaderPatternRule(); + disableKeepAliveRule.setPattern("/*"); + disableKeepAliveRule.setName(HttpHeader.CONNECTION.asString()); + disableKeepAliveRule.setValue(HttpHeaderValue.CLOSE.asString()); + rewriteHandler.addRule(disableKeepAliveRule); + } + + // Return a Host field in the response so during debugging + // we know what server was handling request + + HeaderPatternRule hostNameRule = new HeaderPatternRule(); + hostNameRule.setPattern("/*"); + hostNameRule.setName(HttpHeader.HOST.asString()); + hostNameRule.setValue(serverHostName); + rewriteHandler.addRule(hostNameRule); + + getHandlers().addHandler(rewriteHandler); + + // this sets up the default return media type when client accepts + // any type of media + addContainerRequestFilter(DefaultMediaTypeFilter.class); + + // setup application configuration for authorities, content-providers + // et al + // + com.yahoo.athenz.common.server.rest.RestCoreResourceConfig rconf = + new com.yahoo.athenz.common.server.rest.RestCoreResourceConfig(resources, singletons); + rconf.setAuthorityObject(com.yahoo.athenz.auth.Authorizer.class, authorizer); + rconf.setAuthorityObject(Http.AuthorityList.class, authorities); + rconf.registerAll(); + + // now setup our servlet handler + // + ServletContextHandler servletCtxHandler = new ServletContextHandler(ServletContextHandler.SESSIONS); + servletCtxHandler.setContextPath("/"); + + ServletHolder holder = new ServletHolder(new ServletContainer(rconf)); + servletCtxHandler.addServlet(holder, "/*"); + + getHandlers().addHandler(servletCtxHandler); + } + + public HttpConfiguration newHttpConfiguration(int httpsPort) { + + // HTTP Configuration + + boolean sendServerVersion = Boolean.parseBoolean(System.getProperty(ZMSConsts.ZMS_PROP_SEND_SERVER_VERSION, "false")); + boolean sendDateHeader = Boolean.parseBoolean(System.getProperty(ZMSConsts.ZMS_PROP_SEND_DATE_HEADER, "false")); + int outputBufferSize = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_OUTPUT_BUFFER_SIZE, "32768")); + int requestHeaderSize = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_REQUEST_HEADER_SIZE, "8192")); + int responseHeaderSize = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_RESPONSE_HEADER_SIZE, "8192")); + + HttpConfiguration httpConfig = new HttpConfiguration(); + + if (httpsPort > 0) { + httpConfig.setSecureScheme("https"); + httpConfig.setSecurePort(httpsPort); + } + + httpConfig.setOutputBufferSize(outputBufferSize); + httpConfig.setRequestHeaderSize(requestHeaderSize); + httpConfig.setResponseHeaderSize(responseHeaderSize); + httpConfig.setSendServerVersion(sendServerVersion); + httpConfig.setSendDateHeader(sendDateHeader); + + return httpConfig; + } + + SslContextFactory createSSLContextObject() { + + String keyStorePath = System.getProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PATH); + String keyStorePassword = System.getProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PASSWORD); + String keyStoreType = System.getProperty(ZMSConsts.ZMS_PROP_KEYSTORE_TYPE, "PKCS12"); + String keyManagerPassword = System.getProperty(ZMSConsts.ZMS_PROP_KEYMANAGER_PASSWORD); + String trustStorePath = System.getProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PATH); + String trustStorePassword = System.getProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PASSWORD); + String trustStoreType = System.getProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + String excludedCipherSuites = System.getProperty(ZMSConsts.ZMS_PROP_EXCLUDED_CIPHER_SUITES, + ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES); + String excludedProtocols = System.getProperty(ZMSConsts.ZMS_PROP_EXCLUDED_PROTOCOLS, + ZMS_DEFAULT_EXCLUDED_PROTOCOLS); + + SslContextFactory sslContextFactory = new SslContextFactory(); + if (keyStorePath != null) { + LOG.info("Using SSL KeyStore path: " + keyStorePath); + sslContextFactory.setKeyStorePath(keyStorePath); + } + if (keyStorePassword != null) { + sslContextFactory.setKeyStorePassword(keyStorePassword); + } + sslContextFactory.setKeyStoreType(keyStoreType); + + if (keyManagerPassword != null) { + sslContextFactory.setKeyManagerPassword(keyManagerPassword); + } + if (trustStorePath != null) { + LOG.info("Using SSL TrustStore path: " + trustStorePath); + sslContextFactory.setTrustStorePath(trustStorePath); + } + if (trustStorePassword != null) { + sslContextFactory.setTrustStorePassword(trustStorePassword); + } + sslContextFactory.setTrustStoreType(trustStoreType); + + if (excludedCipherSuites.length() != 0) { + sslContextFactory.setExcludeCipherSuites(excludedCipherSuites.split(",")); + } + + if (excludedProtocols.length() != 0) { + sslContextFactory.setExcludeProtocols(excludedProtocols.split(",")); + } + + return sslContextFactory; + } + + public void addHTTPConnectors(HttpConfiguration httpConfig, int httpPort, int httpsPort) { + + int idleTimeout = Integer.parseInt(System.getProperty(ZMSConsts.ZMS_PROP_IDLE_TIMEOUT, "30000")); + String listenHost = System.getProperty(ZMSConsts.ZMS_PROP_LISTEN_HOST); + + // HTTP Connector + + if (httpPort > 0) { + ServerConnector connector = new ServerConnector(server, new HttpConnectionFactory(httpConfig)); + if (listenHost != null) { + connector.setHost(listenHost); + } + connector.setPort(httpPort); + connector.setIdleTimeout(idleTimeout); + server.addConnector(connector); + } + + // HTTPS Connector + + if (httpsPort > 0) { + + // SSL Context Factory + + SslContextFactory sslContextFactory = createSSLContextObject(); + + // SSL HTTP Configuration + + HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig); + httpsConfig.addCustomizer(new SecureRequestCustomizer()); + + // SSL Connector + + ServerConnector sslConnector = new ServerConnector(server, + new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.asString()), + new HttpConnectionFactory(httpsConfig)); + sslConnector.setPort(httpsPort); + sslConnector.setIdleTimeout(idleTimeout); + server.addConnector(sslConnector); + } + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSResources.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSResources.java new file mode 100644 index 00000000000..969be24340d --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSResources.java @@ -0,0 +1,1843 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zms; + +import com.yahoo.rdl.*; +import java.util.*; +import javax.ws.rs.*; +import javax.ws.rs.core.*; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.inject.Inject; + +@Path("/zms/v1") +public class ZMSResources { + + @GET + @Path("/domain/{domain}") + @Produces(MediaType.APPLICATION_JSON) + public Domain getDomain(@PathParam("domain") String domain) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Domain e = this.delegate.getDomain(context, domain); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getDomain"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain") + @Produces(MediaType.APPLICATION_JSON) + public DomainList getDomainList(@QueryParam("limit") Integer limit, @QueryParam("skip") String skip, @QueryParam("prefix") String prefix, @QueryParam("depth") Integer depth, @QueryParam("account") String account, @QueryParam("ypmid") Integer productId, @QueryParam("member") String roleMember, @QueryParam("role") String roleName, @HeaderParam("If-Modified-Since") String modifiedSince) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + DomainList e = this.delegate.getDomainList(context, limit, skip, prefix, depth, account, productId, roleMember, roleName, modifiedSince); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getDomainList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/domain") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Domain postTopLevelDomain(@HeaderParam("Y-Audit-Ref") String auditRef, TopLevelDomain detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("create", "sys.auth:domain", null); + Domain e = this.delegate.postTopLevelDomain(context, auditRef, detail); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postTopLevelDomain"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/subdomain/{parent}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Domain postSubDomain(@PathParam("parent") String parent, @HeaderParam("Y-Audit-Ref") String auditRef, SubDomain detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("create", "" + parent + ":domain", null); + Domain e = this.delegate.postSubDomain(context, parent, auditRef, detail); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postSubDomain"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/userdomain/{name}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Domain postUserDomain(@PathParam("name") String name, @HeaderParam("Y-Audit-Ref") String auditRef, UserDomain detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("create", "user." + name + ":domain", null); + Domain e = this.delegate.postUserDomain(context, name, auditRef, detail); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postUserDomain"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{name}") + @Produces(MediaType.APPLICATION_JSON) + public TopLevelDomain deleteTopLevelDomain(@PathParam("name") String name, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "sys.auth:domain", null); + TopLevelDomain e = this.delegate.deleteTopLevelDomain(context, name, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteTopLevelDomain"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/subdomain/{parent}/{name}") + @Produces(MediaType.APPLICATION_JSON) + public SubDomain deleteSubDomain(@PathParam("parent") String parent, @PathParam("name") String name, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + parent + ":domain", null); + SubDomain e = this.delegate.deleteSubDomain(context, parent, name, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteSubDomain"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/userdomain/{name}") + @Produces(MediaType.APPLICATION_JSON) + public UserDomain deleteUserDomain(@PathParam("name") String name, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "user." + name + ":domain", null); + UserDomain e = this.delegate.deleteUserDomain(context, name, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteUserDomain"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{name}/meta") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Domain putDomainMeta(@PathParam("name") String name, @HeaderParam("Y-Audit-Ref") String auditRef, DomainMeta detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + name + ":", null); + Domain e = this.delegate.putDomainMeta(context, name, auditRef, detail); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putDomainMeta"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{name}/template") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public DomainTemplate putDomainTemplate(@PathParam("name") String name, @HeaderParam("Y-Audit-Ref") String auditRef, DomainTemplate template) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + name + ":", null); + DomainTemplate e = this.delegate.putDomainTemplate(context, name, auditRef, template); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putDomainTemplate"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{name}/template") + @Produces(MediaType.APPLICATION_JSON) + public DomainTemplateList getDomainTemplateList(@PathParam("name") String name) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + DomainTemplateList e = this.delegate.getDomainTemplateList(context, name); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getDomainTemplateList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{name}/template/{template}") + @Produces(MediaType.APPLICATION_JSON) + public DomainTemplate deleteDomainTemplate(@PathParam("name") String name, @PathParam("template") String template, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + name + ":", null); + DomainTemplate e = this.delegate.deleteDomainTemplate(context, name, template, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteDomainTemplate"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/check") + @Produces(MediaType.APPLICATION_JSON) + public DomainDataCheck getDomainDataCheck(@PathParam("domainName") String domainName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + DomainDataCheck e = this.delegate.getDomainDataCheck(context, domainName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getDomainDataCheck"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domainName}/entity/{entityName}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Entity putEntity(@PathParam("domainName") String domainName, @PathParam("entityName") String entityName, @HeaderParam("Y-Audit-Ref") String auditRef, Entity entity) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domainName + ":" + entityName + "", null); + Entity e = this.delegate.putEntity(context, domainName, entityName, auditRef, entity); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putEntity"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/entity/{entityName}") + @Produces(MediaType.APPLICATION_JSON) + public Entity getEntity(@PathParam("domainName") String domainName, @PathParam("entityName") String entityName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Entity e = this.delegate.getEntity(context, domainName, entityName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getEntity"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domainName}/entity/{entityName}") + @Produces(MediaType.APPLICATION_JSON) + public Entity deleteEntity(@PathParam("domainName") String domainName, @PathParam("entityName") String entityName, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + domainName + ":" + entityName + "", null); + Entity e = this.delegate.deleteEntity(context, domainName, entityName, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteEntity"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/entity") + @Produces(MediaType.APPLICATION_JSON) + public EntityList getEntityList(@PathParam("domainName") String domainName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + EntityList e = this.delegate.getEntityList(context, domainName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getEntityList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/role") + @Produces(MediaType.APPLICATION_JSON) + public RoleList getRoleList(@PathParam("domainName") String domainName, @QueryParam("limit") Integer limit, @QueryParam("skip") String skip) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + RoleList e = this.delegate.getRoleList(context, domainName, limit, skip); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getRoleList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/roles") + @Produces(MediaType.APPLICATION_JSON) + public Roles getRoles(@PathParam("domainName") String domainName, @QueryParam("members") @DefaultValue("false") Boolean members) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Roles e = this.delegate.getRoles(context, domainName, members); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/role/{roleName}") + @Produces(MediaType.APPLICATION_JSON) + public Role getRole(@PathParam("domainName") String domainName, @PathParam("roleName") String roleName, @QueryParam("auditLog") @DefaultValue("false") Boolean auditLog, @QueryParam("expand") @DefaultValue("false") Boolean expand) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Role e = this.delegate.getRole(context, domainName, roleName, auditLog, expand); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getRole"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domainName}/role/{roleName}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Role putRole(@PathParam("domainName") String domainName, @PathParam("roleName") String roleName, @HeaderParam("Y-Audit-Ref") String auditRef, Role role) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domainName + ":role." + roleName + "", null); + Role e = this.delegate.putRole(context, domainName, roleName, auditRef, role); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putRole"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domainName}/role/{roleName}") + @Produces(MediaType.APPLICATION_JSON) + public Role deleteRole(@PathParam("domainName") String domainName, @PathParam("roleName") String roleName, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + domainName + ":role." + roleName + "", null); + Role e = this.delegate.deleteRole(context, domainName, roleName, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteRole"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/role/{roleName}/member/{memberName}") + @Produces(MediaType.APPLICATION_JSON) + public Membership getMembership(@PathParam("domainName") String domainName, @PathParam("roleName") String roleName, @PathParam("memberName") String memberName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Membership e = this.delegate.getMembership(context, domainName, roleName, memberName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getMembership"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domainName}/role/{roleName}/member/{memberName}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Membership putMembership(@PathParam("domainName") String domainName, @PathParam("roleName") String roleName, @PathParam("memberName") String memberName, @HeaderParam("Y-Audit-Ref") String auditRef, Membership membership) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domainName + ":role." + roleName + "", null); + Membership e = this.delegate.putMembership(context, domainName, roleName, memberName, auditRef, membership); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putMembership"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domainName}/role/{roleName}/member/{memberName}") + @Produces(MediaType.APPLICATION_JSON) + public Membership deleteMembership(@PathParam("domainName") String domainName, @PathParam("roleName") String roleName, @PathParam("memberName") String memberName, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domainName + ":role." + roleName + "", null); + Membership e = this.delegate.deleteMembership(context, domainName, roleName, memberName, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteMembership"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domainName}/admins") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public DefaultAdmins putDefaultAdmins(@PathParam("domainName") String domainName, @HeaderParam("Y-Audit-Ref") String auditRef, DefaultAdmins defaultAdmins) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "sys.auth:domain", null); + DefaultAdmins e = this.delegate.putDefaultAdmins(context, domainName, auditRef, defaultAdmins); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putDefaultAdmins"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/policy") + @Produces(MediaType.APPLICATION_JSON) + public PolicyList getPolicyList(@PathParam("domainName") String domainName, @QueryParam("limit") Integer limit, @QueryParam("skip") String skip) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + PolicyList e = this.delegate.getPolicyList(context, domainName, limit, skip); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getPolicyList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/policies") + @Produces(MediaType.APPLICATION_JSON) + public Policies getPolicies(@PathParam("domainName") String domainName, @QueryParam("assertions") @DefaultValue("false") Boolean assertions) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Policies e = this.delegate.getPolicies(context, domainName, assertions); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getPolicies"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/policy/{policyName}") + @Produces(MediaType.APPLICATION_JSON) + public Policy getPolicy(@PathParam("domainName") String domainName, @PathParam("policyName") String policyName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Policy e = this.delegate.getPolicy(context, domainName, policyName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getPolicy"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domainName}/policy/{policyName}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Policy putPolicy(@PathParam("domainName") String domainName, @PathParam("policyName") String policyName, @HeaderParam("Y-Audit-Ref") String auditRef, Policy policy) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domainName + ":policy." + policyName + "", null); + Policy e = this.delegate.putPolicy(context, domainName, policyName, auditRef, policy); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putPolicy"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domainName}/policy/{policyName}") + @Produces(MediaType.APPLICATION_JSON) + public Policy deletePolicy(@PathParam("domainName") String domainName, @PathParam("policyName") String policyName, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + domainName + ":policy." + policyName + "", null); + Policy e = this.delegate.deletePolicy(context, domainName, policyName, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deletePolicy"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + @Produces(MediaType.APPLICATION_JSON) + public Assertion getAssertion(@PathParam("domainName") String domainName, @PathParam("policyName") String policyName, @PathParam("assertionId") Long assertionId) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Assertion e = this.delegate.getAssertion(context, domainName, policyName, assertionId); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getAssertion"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domainName}/policy/{policyName}/assertion") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Assertion putAssertion(@PathParam("domainName") String domainName, @PathParam("policyName") String policyName, @HeaderParam("Y-Audit-Ref") String auditRef, Assertion assertion) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domainName + ":policy." + policyName + "", null); + Assertion e = this.delegate.putAssertion(context, domainName, policyName, auditRef, assertion); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.CREATED: + throw typedException(code, e, Assertion.class); + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putAssertion"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domainName}/policy/{policyName}/assertion/{assertionId}") + @Produces(MediaType.APPLICATION_JSON) + public Assertion deleteAssertion(@PathParam("domainName") String domainName, @PathParam("policyName") String policyName, @PathParam("assertionId") Long assertionId, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domainName + ":policy." + policyName + "", null); + Assertion e = this.delegate.deleteAssertion(context, domainName, policyName, assertionId, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteAssertion"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domain}/service/{service}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public ServiceIdentity putServiceIdentity(@PathParam("domain") String domain, @PathParam("service") String service, @HeaderParam("Y-Audit-Ref") String auditRef, ServiceIdentity detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":service", null); + ServiceIdentity e = this.delegate.putServiceIdentity(context, domain, service, auditRef, detail); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putServiceIdentity"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domain}/service/{service}") + @Produces(MediaType.APPLICATION_JSON) + public ServiceIdentity getServiceIdentity(@PathParam("domain") String domain, @PathParam("service") String service) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ServiceIdentity e = this.delegate.getServiceIdentity(context, domain, service); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getServiceIdentity"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domain}/service/{service}") + @Produces(MediaType.APPLICATION_JSON) + public ServiceIdentity deleteServiceIdentity(@PathParam("domain") String domain, @PathParam("service") String service, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + domain + ":service", null); + ServiceIdentity e = this.delegate.deleteServiceIdentity(context, domain, service, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteServiceIdentity"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/services") + @Produces(MediaType.APPLICATION_JSON) + public ServiceIdentities getServiceIdentities(@PathParam("domainName") String domainName, @QueryParam("publickeys") @DefaultValue("false") Boolean publickeys, @QueryParam("hosts") @DefaultValue("false") Boolean hosts) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ServiceIdentities e = this.delegate.getServiceIdentities(context, domainName, publickeys, hosts); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getServiceIdentities"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/service") + @Produces(MediaType.APPLICATION_JSON) + public ServiceIdentityList getServiceIdentityList(@PathParam("domainName") String domainName, @QueryParam("limit") Integer limit, @QueryParam("skip") String skip) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ServiceIdentityList e = this.delegate.getServiceIdentityList(context, domainName, limit, skip); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getServiceIdentityList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domain}/service/{service}/publickey/{id}") + @Produces(MediaType.APPLICATION_JSON) + public PublicKeyEntry getPublicKeyEntry(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("id") String id) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + PublicKeyEntry e = this.delegate.getPublicKeyEntry(context, domain, service, id); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getPublicKeyEntry"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domain}/service/{service}/publickey/{id}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public PublicKeyEntry putPublicKeyEntry(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("id") String id, @HeaderParam("Y-Audit-Ref") String auditRef, PublicKeyEntry publicKeyEntry) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":service." + service + "", null); + PublicKeyEntry e = this.delegate.putPublicKeyEntry(context, domain, service, id, auditRef, publicKeyEntry); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putPublicKeyEntry"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domain}/service/{service}/publickey/{id}") + @Produces(MediaType.APPLICATION_JSON) + public PublicKeyEntry deletePublicKeyEntry(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("id") String id, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":service." + service + "", null); + PublicKeyEntry e = this.delegate.deletePublicKeyEntry(context, domain, service, id, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deletePublicKeyEntry"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domain}/tenancy/{service}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Tenancy putTenancy(@PathParam("domain") String domain, @PathParam("service") String service, @HeaderParam("Y-Audit-Ref") String auditRef, Tenancy detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":tenancy", null); + Tenancy e = this.delegate.putTenancy(context, domain, service, auditRef, detail); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putTenancy"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domain}/tenancy/{service}") + @Produces(MediaType.APPLICATION_JSON) + public Tenancy getTenancy(@PathParam("domain") String domain, @PathParam("service") String service) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Tenancy e = this.delegate.getTenancy(context, domain, service); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getTenancy"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domain}/tenancy/{service}") + @Produces(MediaType.APPLICATION_JSON) + public Tenancy deleteTenancy(@PathParam("domain") String domain, @PathParam("service") String service, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + domain + ":tenancy", null); + Tenancy e = this.delegate.deleteTenancy(context, domain, service, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteTenancy"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public TenancyResourceGroup putTenancyResourceGroup(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("resourceGroup") String resourceGroup, @HeaderParam("Y-Audit-Ref") String auditRef, TenancyResourceGroup detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":tenancy." + service + "", null); + TenancyResourceGroup e = this.delegate.putTenancyResourceGroup(context, domain, service, resourceGroup, auditRef, detail); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putTenancyResourceGroup"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domain}/tenancy/{service}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + public TenancyResourceGroup deleteTenancyResourceGroup(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("resourceGroup") String resourceGroup, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":tenancy." + service + "", null); + TenancyResourceGroup e = this.delegate.deleteTenancyResourceGroup(context, domain, service, resourceGroup, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteTenancyResourceGroup"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domain}/service/{service}/tenant/{tenantDomain}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public TenantRoles putTenantRoles(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("tenantDomain") String tenantDomain, @HeaderParam("Y-Audit-Ref") String auditRef, TenantRoles detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":tenant." + tenantDomain + "", null); + TenantRoles e = this.delegate.putTenantRoles(context, domain, service, tenantDomain, auditRef, detail); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.CREATED: + throw typedException(code, e, TenantRoles.class); + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putTenantRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domain}/service/{service}/tenant/{tenantDomain}") + @Produces(MediaType.APPLICATION_JSON) + public TenantRoles getTenantRoles(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("tenantDomain") String tenantDomain) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + TenantRoles e = this.delegate.getTenantRoles(context, domain, service, tenantDomain); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getTenantRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domain}/service/{service}/tenant/{tenantDomain}") + @Produces(MediaType.APPLICATION_JSON) + public TenantRoles deleteTenantRoles(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("tenantDomain") String tenantDomain, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("delete", "" + domain + ":tenant." + tenantDomain + "", null); + TenantRoles e = this.delegate.deleteTenantRoles(context, domain, service, tenantDomain, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteTenantRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public TenantResourceGroupRoles putTenantResourceGroupRoles(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("tenantDomain") String tenantDomain, @PathParam("resourceGroup") String resourceGroup, @HeaderParam("Y-Audit-Ref") String auditRef, TenantResourceGroupRoles detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":tenant." + tenantDomain + "", null); + TenantResourceGroupRoles e = this.delegate.putTenantResourceGroupRoles(context, domain, service, tenantDomain, resourceGroup, auditRef, detail); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.CREATED: + throw typedException(code, e, TenantResourceGroupRoles.class); + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putTenantResourceGroupRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + public TenantResourceGroupRoles getTenantResourceGroupRoles(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("tenantDomain") String tenantDomain, @PathParam("resourceGroup") String resourceGroup) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + TenantResourceGroupRoles e = this.delegate.getTenantResourceGroupRoles(context, domain, service, tenantDomain, resourceGroup); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getTenantResourceGroupRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{domain}/service/{service}/tenant/{tenantDomain}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + public TenantResourceGroupRoles deleteTenantResourceGroupRoles(@PathParam("domain") String domain, @PathParam("service") String service, @PathParam("tenantDomain") String tenantDomain, @PathParam("resourceGroup") String resourceGroup, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + domain + ":tenant." + tenantDomain + "", null); + TenantResourceGroupRoles e = this.delegate.deleteTenantResourceGroupRoles(context, domain, service, tenantDomain, resourceGroup, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteTenantResourceGroupRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @PUT + @Path("/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public ProviderResourceGroupRoles putProviderResourceGroupRoles(@PathParam("tenantDomain") String tenantDomain, @PathParam("provDomain") String provDomain, @PathParam("provService") String provService, @PathParam("resourceGroup") String resourceGroup, @HeaderParam("Y-Audit-Ref") String auditRef, ProviderResourceGroupRoles detail) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + tenantDomain + ":tenancy." + provDomain + "." + provService + "", null); + ProviderResourceGroupRoles e = this.delegate.putProviderResourceGroupRoles(context, tenantDomain, provDomain, provService, resourceGroup, auditRef, detail); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.CREATED: + throw typedException(code, e, ProviderResourceGroupRoles.class); + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource putProviderResourceGroupRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + public ProviderResourceGroupRoles getProviderResourceGroupRoles(@PathParam("tenantDomain") String tenantDomain, @PathParam("provDomain") String provDomain, @PathParam("provService") String provService, @PathParam("resourceGroup") String resourceGroup) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ProviderResourceGroupRoles e = this.delegate.getProviderResourceGroupRoles(context, tenantDomain, provDomain, provService, resourceGroup); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getProviderResourceGroupRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @DELETE + @Path("/domain/{tenantDomain}/provDomain/{provDomain}/provService/{provService}/resourceGroup/{resourceGroup}") + @Produces(MediaType.APPLICATION_JSON) + public ProviderResourceGroupRoles deleteProviderResourceGroupRoles(@PathParam("tenantDomain") String tenantDomain, @PathParam("provDomain") String provDomain, @PathParam("provService") String provService, @PathParam("resourceGroup") String resourceGroup, @HeaderParam("Y-Audit-Ref") String auditRef) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authorize("update", "" + tenantDomain + ":tenancy." + provDomain + "." + provService + "", null); + ProviderResourceGroupRoles e = this.delegate.deleteProviderResourceGroupRoles(context, tenantDomain, provDomain, provService, resourceGroup, auditRef); + return null; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.CONFLICT: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource deleteProviderResourceGroupRoles"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/access/{action}/{resource}") + @Produces(MediaType.APPLICATION_JSON) + public Access getAccess(@PathParam("action") String action, @PathParam("resource") String resource, @QueryParam("domain") String domain, @QueryParam("principal") String checkPrincipal) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Access e = this.delegate.getAccess(context, action, resource, domain, checkPrincipal); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getAccess"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/access/{action}") + @Produces(MediaType.APPLICATION_JSON) + public Access getAccessExt(@PathParam("action") String action, @QueryParam("resource") String resource, @QueryParam("domain") String domain, @QueryParam("principal") String checkPrincipal) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Access e = this.delegate.getAccessExt(context, action, resource, domain, checkPrincipal); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getAccessExt"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/resource") + @Produces(MediaType.APPLICATION_JSON) + public ResourceAccessList getResourceAccessList(@QueryParam("principal") String principal, @QueryParam("action") String action) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ResourceAccessList e = this.delegate.getResourceAccessList(context, principal, action); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getResourceAccessList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/sys/modified_domains") + @Produces(MediaType.APPLICATION_JSON) + public void getSignedDomains(@QueryParam("domain") String domain, @QueryParam("metaonly") String metaOnly, @HeaderParam("If-None-Match") String matchingTag) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + GetSignedDomainsResult result = new GetSignedDomainsResult(context); + this.delegate.getSignedDomains(context, domain, metaOnly, matchingTag, result); + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.NOT_MODIFIED: + throw typedException(code, e, void.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getSignedDomains"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/user/{userName}/token") + @Produces(MediaType.APPLICATION_JSON) + public UserToken getUserToken(@PathParam("userName") String userName, @QueryParam("services") String serviceNames) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + UserToken e = this.delegate.getUserToken(context, userName, serviceNames); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getUserToken"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @OPTIONS + @Path("/user/{userName}/token") + @Produces(MediaType.APPLICATION_JSON) + public UserToken optionsUserToken(@PathParam("userName") String userName, @QueryParam("services") String serviceNames) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + UserToken e = this.delegate.optionsUserToken(context, userName, serviceNames); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource optionsUserToken"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/principal") + @Produces(MediaType.APPLICATION_JSON) + public ServicePrincipal getServicePrincipal() { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ServicePrincipal e = this.delegate.getServicePrincipal(context); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getServicePrincipal"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/template") + @Produces(MediaType.APPLICATION_JSON) + public ServerTemplateList getServerTemplateList() { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ServerTemplateList e = this.delegate.getServerTemplateList(context); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getServerTemplateList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/template/{template}") + @Produces(MediaType.APPLICATION_JSON) + public Template getTemplate(@PathParam("template") String template) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Template e = this.delegate.getTemplate(context, template); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getTemplate"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/schema") + @Produces(MediaType.APPLICATION_JSON) + public Schema getRdlSchema() { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + Schema e = this.delegate.getRdlSchema(context); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getRdlSchema"); + throw typedException(code, e, ResourceError.class); + } + } + } + + + WebApplicationException typedException(int code, ResourceException e, Class eClass) { + Object data = e.getData(); + Object entity = eClass.isInstance(data) ? data : null; + if (entity != null) { + return new WebApplicationException(Response.status(code).entity(entity).build()); + } else { + return new WebApplicationException(code); + } + } + + @Inject private ZMSHandler delegate; + @Context private HttpServletRequest request; + @Context private HttpServletResponse response; + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSServerImpl.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSServerImpl.java new file mode 100644 index 00000000000..b52812206a2 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSServerImpl.java @@ -0,0 +1,109 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.AuthorityKeyStore; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.metrics.MetricFactory; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.rest.Http.AuthorityList; +import com.yahoo.athenz.zms.pkey.PrivateKeyStore; +import com.yahoo.athenz.zms.pkey.PrivateKeyStoreFactory; +import com.yahoo.athenz.zms.store.ObjectStore; +import com.yahoo.athenz.zms.store.file.FileObjectStore; +import com.yahoo.athenz.zms.store.jdbc.DataSourceFactory; +import com.yahoo.athenz.zms.store.jdbc.JDBCObjectStore; +import com.yahoo.athenz.zms.store.jdbc.PoolableDataSource; + +import java.io.File; +import java.security.PrivateKey; + +public class ZMSServerImpl { + + ZMSImpl instance = null; + + AuditLogger auditLogger = null; + String auditLoggerMsgBldrClass = null; + + public ZMSServerImpl(String serverHostName, String db_context, + PrivateKeyStoreFactory pkeyStoreFactory, MetricFactory metricFactory, + AuditLogger auditLog, String auditLogMsgBldrClass, AuthorityList authList) { + + auditLogger = auditLog; + auditLoggerMsgBldrClass = auditLogMsgBldrClass; + + // extract the private key and public keys for our service + + StringBuilder privKeyId = new StringBuilder(256); + PrivateKeyStore keyStore = pkeyStoreFactory.create(serverHostName); + PrivateKey pkey = keyStore.getPrivateKey(privKeyId); + String publicKey = keyStore.getPEMPublicKey(); + + // create our metric and increment our startup count + + Metric metric = metricFactory.create(); + metric.increment("zms_sa_startup"); + + ObjectStore store = null; + if (db_context != null && db_context.startsWith("jdbc:")) { + PoolableDataSource src = DataSourceFactory.create(db_context); + store = new JDBCObjectStore(src); + } else { + String fileDirName = System.getProperty(ZMSConsts.ZMS_PROP_DB_TABLE, "zms_root"); + String path = getFileStructPath(db_context, fileDirName); + store = new FileObjectStore(new File(path)); + } + + try { + instance = new ZMSImpl(serverHostName, store, metric, pkey, privKeyId.toString(), + publicKey, auditLogger, auditLoggerMsgBldrClass); + instance.putAuthorityList(authList); + } catch (Exception ex) { + metric.increment("zms_startup_fail_sum"); + throw ex; + } + + // make sure to set the keystore for any instance that requires it + + for (Authority authority : authList.getAuthorities()) { + if (AuthorityKeyStore.class.isInstance(authority)) { + ((AuthorityKeyStore) authority).setKeyStore(instance); + } + } + } + + String getFileStructPath(String db_context, String name) { + + String path = db_context; + if (path == null) { + path = name; + } else if (name != null) { + path = path + File.separator + name; + } + + return path; + } + + public Authorizer getAuthorizer() { + return instance; + } + + public ZMSHandler getInstance() { + return instance; + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AllowedOperation.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AllowedOperation.java new file mode 100644 index 00000000000..63ba549a171 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AllowedOperation.java @@ -0,0 +1,94 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.config; + +import java.util.Set; +import java.util.Map; + +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class AllowedOperation { + private String name; + private Map> items; + + public Map> getItems() { + return items; + } + + public void setItems(Map> items) { + this.items = items; + } + + public String getName() { + return name; + } + + public void setName(String name) { + this.name = name; + } + + public boolean isOperationAllowedOn(String opItemType, String opItemValue) { + + // if no operationItems are defined, always allow all + if (this.items == null || this.items.isEmpty()) { + return true; + } + + // if there are operations defined, and opItemType or opItemValue are empty, return false + if (opItemType == null || opItemValue == null) { + return false; + } + + // if not empty, check and make sure the opItem type + value is found. + opItemType = opItemType.toLowerCase(); + opItemValue = opItemValue.toLowerCase(); + Set opItems = this.items.get(opItemType); + return opItems != null && opItems.contains(opItemValue); + } + + @Override + public int hashCode() { + return items.hashCode(); + } + + @Override + public boolean equals(Object obj) { + if (this == obj) { + return true; + } + + if (obj == null) { + return false; + } + + if (getClass() != obj.getClass()) { + return false; + } + + AllowedOperation other = (AllowedOperation) obj; + + if (name == null) { + if (other.name != null) { + return false; + } + } else if (!name.equals(other.name)) { + return false; + } + + return true; + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AuthorizedService.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AuthorizedService.java new file mode 100644 index 00000000000..1524dacb09c --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AuthorizedService.java @@ -0,0 +1,34 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.config; + +import java.util.ArrayList; + +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class AuthorizedService { + + private ArrayList allowedOperations; + + public ArrayList getAllowedOperations() { + return allowedOperations; + } + + public void setAllowedOperations(ArrayList allowedOperations) { + this.allowedOperations = allowedOperations; + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AuthorizedServices.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AuthorizedServices.java new file mode 100644 index 00000000000..5cac2337021 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/AuthorizedServices.java @@ -0,0 +1,46 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.config; + +import java.util.HashMap; +import java.util.Set; + +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class AuthorizedServices { + private HashMap services; + + public HashMap getServices() { + return services; + } + + public void setTemplates(HashMap services) { + this.services = services; + } + + public AuthorizedService get(String name) { + return services.get(name); + } + + public boolean contains(String name) { + return services.containsKey(name); + } + + public Set names() { + return services.keySet(); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/config/SolutionTemplates.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/SolutionTemplates.java new file mode 100644 index 00000000000..a1d9435ab06 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/config/SolutionTemplates.java @@ -0,0 +1,47 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.config; + +import java.util.HashMap; +import java.util.Set; + +import com.fasterxml.jackson.databind.annotation.JsonSerialize; +import com.yahoo.athenz.zms.Template; + +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class SolutionTemplates { + private HashMap templates; + + public HashMap getTemplates() { + return templates; + } + + public void setTemplates(HashMap templates) { + this.templates = templates; + } + + public Template get(String name) { + return templates.get(name); + } + + public boolean contains(String name) { + return templates.containsKey(name); + } + + public Set names() { + return templates.keySet(); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/PrivateKeyStore.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/PrivateKeyStore.java new file mode 100644 index 00000000000..0845c8d4dfc --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/PrivateKeyStore.java @@ -0,0 +1,41 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.pkey; + +import java.security.PrivateKey; + +public interface PrivateKeyStore { + + /** + * Retrieve private key for this ZMS Server instance to sign its tokens + * The private key identifier must be updated in the privateKeyId out + * StringBuilder field. The Private Key Store Factory has the knowledge + * which hostname we're processing this request for. + * @param privateKeyId - out argument - must be updated to include key id + * @return private key for this ZMS Server instance. + */ + default PrivateKey getPrivateKey(StringBuilder privateKeyId) { + return null; + } + + /** + * Retrieve server's corresponding public key in PEM format. + * @return public key in PEM format + */ + default String getPEMPublicKey() { + return null; + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/PrivateKeyStoreFactory.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/PrivateKeyStoreFactory.java new file mode 100644 index 00000000000..9812795cb9e --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/PrivateKeyStoreFactory.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.pkey; + +public interface PrivateKeyStoreFactory { + + /** + * Create and return a new PrivateKeyStore instance + * @param serverHostName hostname of the ZMS Server instance + * @return PrivateKeyStore instance + */ + public PrivateKeyStore create(String serverHostName); +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStore.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStore.java new file mode 100644 index 00000000000..b5cd9f98b35 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStore.java @@ -0,0 +1,131 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.pkey.file; + +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.security.PrivateKey; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.zms.ResourceException; +import com.yahoo.athenz.zms.ZMSConsts; +import com.yahoo.athenz.zms.pkey.PrivateKeyStore; + +public class FilePrivateKeyStore implements PrivateKeyStore { + + private static final Logger LOG = LoggerFactory.getLogger(FilePrivateKeyStore.class); + + String rootDir = null; + + public FilePrivateKeyStore() { + + // get the system root directory + + rootDir = System.getenv(ZMSConsts.STR_ENV_ROOT); + if (rootDir == null) { + rootDir = ZMSConsts.STR_DEF_ROOT; + } + } + + @Override + public PrivateKey getPrivateKey(StringBuilder privateKeyId) { + String privKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, + rootDir + "/share/athenz/sys.auth/zms.key"); + + if (LOG.isDebugEnabled()) { + LOG.debug("FilePrivateKeyStore: private key file=" + privKeyName); + } + + // check to see if this is running in dev mode and thus it's + // a resource in our jar file + + String privKey = null; + if (privKeyName.startsWith(ZMSConsts.STR_JAR_RESOURCE)) { + privKey = retrieveKeyFromResource(privKeyName.substring(ZMSConsts.STR_JAR_RESOURCE.length())); + } else { + File privKeyFile = new File(privKeyName); + privKey = Crypto.encodedFile(privKeyFile); + } + + PrivateKey pkey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + if (pkey == null) { + throw new ResourceException(500, "Unable to retrieve ZMS Server private key"); + } + + privateKeyId.append(System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_ID, "0")); + return pkey; + } + + @Override + public String getPEMPublicKey() { + + String pubKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, + rootDir + "/share/athenz/pubkeys/zms.key"); + + if (LOG.isDebugEnabled()) { + LOG.debug("FilePrivateKeyStore: public key file=" + pubKeyName); + } + + // check to see if this is running in dev mode and thus it's + // a resource in our jar file + + String pubKey = null; + if (pubKeyName.startsWith(ZMSConsts.STR_JAR_RESOURCE)) { + pubKey = retrieveKeyFromResource(pubKeyName.substring(ZMSConsts.STR_JAR_RESOURCE.length())); + } else { + File pubKeyFile = new File(pubKeyName); + pubKey = Crypto.encodedFile(pubKeyFile); + } + + return pubKey; + } + + String retrieveKeyFromResource(String resourceName) { + + String key = null; + try (InputStream is = getClass().getResourceAsStream(resourceName)) { + String resourceData = getString(is); + if (resourceData != null) { + key = Crypto.ybase64(resourceData.getBytes("UTF-8")); + } + } catch (IOException e) { + if (LOG.isDebugEnabled()) { + LOG.debug("FilePrivateKeyStore: Unable to read key from resource: " + resourceName); + } + } + + return key; + } + + String getString(InputStream is) throws IOException { + + if (is == null) { + return null; + } + + int ch; + StringBuilder sb = new StringBuilder(); + while ((ch = is.read()) != -1) { + sb.append((char) ch); + } + return sb.toString(); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStoreFactory.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStoreFactory.java new file mode 100644 index 00000000000..e1f67458dbb --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStoreFactory.java @@ -0,0 +1,27 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.pkey.file; + +import com.yahoo.athenz.zms.pkey.PrivateKeyStore; +import com.yahoo.athenz.zms.pkey.PrivateKeyStoreFactory; + +public class FilePrivateKeyStoreFactory implements PrivateKeyStoreFactory { + + @Override + public PrivateKeyStore create(String serverHostName) { + return new FilePrivateKeyStore(); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/AthenzDomain.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/AthenzDomain.java new file mode 100644 index 00000000000..1fc0d8acf57 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/AthenzDomain.java @@ -0,0 +1,80 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store; + +import java.util.ArrayList; +import java.util.List; + +import com.yahoo.athenz.zms.Domain; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; + +public class AthenzDomain { + + String name; + List roles; + List policies; + List services; + Domain domain = null; + + public AthenzDomain(String name) { + this.name = name; + roles = new ArrayList<>(); + policies = new ArrayList<>(); + services = new ArrayList<>(); + } + + public void setName(String name) { + this.name = name; + } + + public void setRoles(List roles) { + this.roles = roles; + } + + public void setServices(List services) { + this.services = services; + } + + public void setPolicies(List policies) { + this.policies = policies; + } + + public void setDomain(Domain domain) { + this.domain = domain; + } + + public String getName() { + return name; + } + + public List getRoles() { + return roles; + } + + public List getPolicies() { + return policies; + } + + public List getServices() { + return services; + } + + public Domain getDomain() { + return domain; + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/ObjectStore.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/ObjectStore.java new file mode 100644 index 00000000000..56fe6ebbf36 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/ObjectStore.java @@ -0,0 +1,22 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store; + +public interface ObjectStore { + + ObjectStoreConnection getConnection(boolean autoCommit); + void clearConnections(); +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/ObjectStoreConnection.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/ObjectStoreConnection.java new file mode 100644 index 00000000000..30e4c39323b --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/ObjectStoreConnection.java @@ -0,0 +1,117 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store; + +import java.io.Closeable; +import java.util.List; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.Domain; +import com.yahoo.athenz.zms.DomainModifiedList; +import com.yahoo.athenz.zms.Entity; +import com.yahoo.athenz.zms.Membership; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.ResourceAccessList; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.RoleAuditLog; +import com.yahoo.athenz.zms.ServiceIdentity; + +public interface ObjectStoreConnection extends Closeable { + + // Transaction commands + + void commitChanges(); + void rollbackChanges(); + void close(); + + // Domain commands + + Domain getDomain(String domainName); + boolean insertDomain(Domain domain); + boolean updateDomain(Domain domain); + boolean deleteDomain(String domainName); + long getDomainModTimestamp(String domainName); + boolean updateDomainModTimestamp(String domainName); + List listDomains(String prefix, long modifiedSince); + String lookupDomainById(String account, int productId); + List lookupDomainByRole(String roleMember, String roleName); + + AthenzDomain getAthenzDomain(String domainName); + DomainModifiedList listModifiedDomains(long modifiedSince); + + // Template commands + + boolean insertDomainTemplate(String domainName, String templateName, String params); + boolean deleteDomainTemplate(String domainName, String templateName, String params); + List listDomainTemplates(String domainName); + + // Role commands + + Role getRole(String domainName, String roleName); + boolean insertRole(String domainName, Role role); + boolean updateRole(String domainName, Role role); + boolean deleteRole(String domainName, String roleName); + boolean updateRoleModTimestamp(String domainName, String roleName); + List listRoles(String domainName); + List listRoleAuditLogs(String domainName, String roleName); + + List listRoleMembers(String domainName, String roleName); + Membership getRoleMember(String domainName, String roleName, String member); + boolean insertRoleMember(String domainName, String roleName, String member, String principal, String auditRef); + boolean deleteRoleMember(String domainName, String roleName, String member, String principal, String auditRef); + + // Policy commands + + Policy getPolicy(String domainName, String policyName); + boolean insertPolicy(String domainName, Policy policy); + boolean updatePolicy(String domainName, Policy policy); + boolean deletePolicy(String domainName, String policyName); + List listPolicies(String domainName, String assertionRoleName); + boolean updatePolicyModTimestamp(String domainName, String policyName); + + Assertion getAssertion(String domainName, String policyName, Long assertionId); + boolean insertAssertion(String domainName, String policyName, Assertion assertion); + boolean deleteAssertion(String domainName, String policyName, Long assertionId); + List listAssertions(String domainName, String policyName); + ResourceAccessList listResourceAccess(String principal, String action, String userDomain); + + // Service commands + + ServiceIdentity getServiceIdentity(String domainName, String serviceName); + boolean insertServiceIdentity(String domainName, ServiceIdentity service); + boolean updateServiceIdentity(String domainName, ServiceIdentity service); + boolean deleteServiceIdentity(String domainName, String serviceName); + List listServiceIdentities(String domainName); + + PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, String keyId); + boolean insertPublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey); + boolean updatePublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey); + boolean deletePublicKeyEntry(String domainName, String serviceName, String keyId); + List listPublicKeys(String domainName, String serviceName); + + List listServiceHosts(String domainName, String serviceName); + boolean insertServiceHost(String domainName, String serviceName, String hostName); + boolean deleteServiceHost(String domainName, String serviceName, String hostName); + + // Entity commands + + Entity getEntity(String domainName, String entityName); + boolean insertEntity(String domainName, Entity entity); + boolean updateEntity(String domainName, Entity entity); + boolean deleteEntity(String domainName, String entityName); + List listEntities(String domainName); +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/DomainStruct.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/DomainStruct.java new file mode 100644 index 00000000000..1c8cd8e67ad --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/DomainStruct.java @@ -0,0 +1,96 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.file; + +import java.util.ArrayList; +import java.util.HashMap; + +import com.yahoo.athenz.zms.DomainMeta; +import com.yahoo.athenz.zms.Entity; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.rdl.Timestamp; +import com.yahoo.rdl.UUID; + +public class DomainStruct { + + private String name; + private DomainMeta meta; + private UUID id; + private Timestamp modified; + private HashMap roles; + private HashMap policies; + private HashMap services; + private HashMap entities; + private ArrayList templates; + + public String getName() { + return name; + } + public void setName(String name) { + this.name = name; + } + public DomainMeta getMeta() { + return meta; + } + public void setMeta(DomainMeta meta) { + this.meta = meta; + } + public UUID getId() { + return id; + } + public void setId(UUID id) { + this.id = id; + } + public Timestamp getModified() { + return modified; + } + public void setModified(Timestamp modified) { + this.modified = modified; + } + public HashMap getRoles() { + return roles; + } + public void setRoles(HashMap roles) { + this.roles = roles; + } + public HashMap getPolicies() { + return policies; + } + public void setPolicies(HashMap policies) { + this.policies = policies; + } + public HashMap getServices() { + return services; + } + public void setServices(HashMap services) { + this.services = services; + } + public HashMap getEntities() { + return entities; + } + public void setEntities(HashMap entities) { + this.entities = entities; + } + public ArrayList getTemplates() { + return templates; + } + public void setTemplates(ArrayList templates) { + this.templates = templates; + } + +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/FileConnection.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/FileConnection.java new file mode 100644 index 00000000000..cddfd6680a7 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/FileConnection.java @@ -0,0 +1,1197 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.file; + +import java.util.List; +import java.util.Set; +import java.io.File; +import java.io.FileWriter; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.ArrayList; +import java.util.Collections; +import java.util.HashMap; +import java.util.HashSet; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.Domain; +import com.yahoo.athenz.zms.DomainMeta; +import com.yahoo.athenz.zms.DomainModified; +import com.yahoo.athenz.zms.DomainModifiedList; +import com.yahoo.athenz.zms.Entity; +import com.yahoo.athenz.zms.Membership; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.ResourceAccessList; +import com.yahoo.athenz.zms.ResourceException; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.RoleAuditLog; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zms.store.AthenzDomain; +import com.yahoo.athenz.zms.store.ObjectStoreConnection; +import com.yahoo.athenz.zms.utils.ZMSUtils; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Timestamp; + +public class FileConnection implements ObjectStoreConnection { + + File rootDir; + public FileConnection(File rootDir) { + this.rootDir = rootDir; + } + + @Override + public void commitChanges() { + } + + @Override + public void rollbackChanges() { + } + + @Override + public void close() { + } + + @Override + public Domain getDomain(String domainName) { + + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + return null; + } + return getDomain(domainStruct); + } + + private Domain getDomain(DomainStruct domainStruct) { + Domain domain = new Domain() + .setAccount(domainStruct.getMeta().getAccount()) + .setDescription(domainStruct.getMeta().getDescription()) + .setId(domainStruct.getId()) + .setModified(domainStruct.getModified()) + .setName(domainStruct.getName()) + .setOrg(domainStruct.getMeta().getOrg()) + .setYpmId(domainStruct.getMeta().getYpmId()); + if (domainStruct.getMeta().getAuditEnabled() != null) { + domain.setAuditEnabled(domainStruct.getMeta().getAuditEnabled()); + } else { + domain.setAuditEnabled(false); + } + if (domainStruct.getMeta().getEnabled() != null) { + domain.setEnabled(domainStruct.getMeta().getEnabled()); + } else { + domain.setEnabled(true); + } + return domain; + } + + @Override + public long getDomainModTimestamp(String domainName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + return 0; + } + return domainStruct.getModified().millis(); + } + + @Override + public boolean insertDomain(Domain domain) { + + DomainStruct domainStruct = getDomainStruct(domain.getName()); + if (domainStruct != null) { + return false; + } + + verifyDomainProductIdUniqueness(domain.getName(), domain.getYpmId(), "insertDomain"); + + domainStruct = new DomainStruct(); + domainStruct.setId(domain.getId()); + domainStruct.setName(domain.getName()); + domainStruct.setModified(Timestamp.fromCurrentTime()); + + DomainMeta meta = new DomainMeta() + .setAccount(domain.getAccount()) + .setAuditEnabled(domain.getAuditEnabled()) + .setDescription(domain.getDescription()) + .setEnabled(domain.getEnabled()) + .setOrg(domain.getOrg()) + .setYpmId(domain.getYpmId()); + domainStruct.setMeta(meta); + + putDomainStruct(domain.getName(), domainStruct); + return true; + } + + void verifyDomainProductIdUniqueness(String name, Integer productId, String caller) { + + if (productId == null || productId.intValue() == 0) { + return; + } + String domName = lookupDomainById(null, productId); + if (domName != null && !domName.equals(name)) { + throw ZMSUtils.requestError("Product Id: " + productId + + " is already assigned to domain: " + domName, caller); + } + } + + @Override + public boolean updateDomain(Domain domain) { + + DomainStruct domainStruct = getDomainStruct(domain.getName()); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updateDomain"); + } + + verifyDomainProductIdUniqueness(domain.getName(), domain.getYpmId(), "updateDomain"); + + domainStruct.setId(domain.getId()); + domainStruct.setName(domain.getName()); + domainStruct.setModified(Timestamp.fromCurrentTime()); + DomainMeta meta = new DomainMeta() + .setAccount(domain.getAccount()) + .setAuditEnabled(domain.getAuditEnabled()) + .setDescription(domain.getDescription()) + .setEnabled(domain.getEnabled()) + .setOrg(domain.getOrg()) + .setYpmId(domain.getYpmId()); + domainStruct.setMeta(meta); + + putDomainStruct(domain.getName(), domainStruct); + return true; + } + + @Override + public boolean deleteDomain(String domainName) { + File domainFile = new File(rootDir, domainName); + delete(domainFile); + return true; + } + + @Override + public boolean updateDomainModTimestamp(String domainName) { + + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updateDomainModTimestamp"); + } + domainStruct.setModified(Timestamp.fromCurrentTime()); + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public List listDomains(String prefix, long modifiedSince) { + + String[] fnames = rootDir.list(); + List slist = new ArrayList<>(java.util.Arrays.asList(fnames)); + java.util.Collections.sort(slist); + List domainList = new ArrayList<>(); + for (String name : slist) { + if (prefix != null) { + if (name.startsWith(prefix)) { + domainList.add(name); + } + } else { + domainList.add(name); + } + } + return domainList; + } + + @Override + public List lookupDomainByRole(String roleMember, String roleName) { + + boolean memberPresent = (roleMember != null && !roleMember.isEmpty()); + boolean rolePresent = (roleName != null && !roleName.isEmpty()); + + // first get the list of domains + + Set uniqueDomains = new HashSet<>(); + List domainNames = listDomains(null, 0); + for (String domainName : domainNames) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + continue; + } + if (rolePresent || memberPresent) { + if (rolePresent) { + Role role = getRoleObject(domainStruct, roleName); + if (role == null) { + continue; + } + if (memberPresent) { + if (role.getMembers().contains(roleMember)) { + uniqueDomains.add(domainName); + } + } else { + uniqueDomains.add(domainName); + } + } else { + HashMap roles = domainStruct.getRoles(); + if (roles != null) { + for (Role role : roles.values()) { + if (role.getMembers().contains(roleMember)) { + uniqueDomains.add(domainName); + break; + } + } + } + + } + } else { + uniqueDomains.add(domainName); + } + } + + List matchedDomains = new ArrayList<>(uniqueDomains); + Collections.sort(matchedDomains); + return matchedDomains; + } + + @Override + public String lookupDomainById(String account, int productId) { + + // first get the list of domains + + List domainNames = listDomains(null, 0); + for (String domainName : domainNames) { + Domain domain = getDomain(domainName); + if (domain == null) { + continue; + } + if (account != null) { + if (domain.getAccount() != null && account.equals(domain.getAccount())) { + return domainName; + } + } else if (productId != 0) { + if (domain.getYpmId() != null && domain.getYpmId() == productId) { + return domainName; + } + } + } + + return null; + } + + @Override + public AthenzDomain getAthenzDomain(String domainName) { + + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getAthenzDomain"); + } + AthenzDomain athenzDomain = new AthenzDomain(domainName); + athenzDomain.setDomain(getDomain(domainStruct)); + if (domainStruct.getRoles() != null) { + athenzDomain.setRoles(new ArrayList(domainStruct.getRoles().values())); + } + if (domainStruct.getPolicies() != null) { + athenzDomain.setPolicies(new ArrayList(domainStruct.getPolicies().values())); + } + if (domainStruct.getServices() != null) { + athenzDomain.setServices(new ArrayList(domainStruct.getServices().values())); + } + + return athenzDomain; + } + + @Override + public DomainModifiedList listModifiedDomains(long modifiedSince) { + + DomainModifiedList domainModifiedList = new DomainModifiedList(); + List nameMods = new ArrayList(); + + List domainList = listDomains(null, modifiedSince); + + // Now set the dest for the returned domain names + + String dirName = rootDir.getAbsolutePath() + File.separator; + for (String dname : domainList) { + long ts = 0; + try { + File dfile = new File(dirName + dname); + ts = dfile.lastModified(); + if (ts <= modifiedSince) { + continue; + } + } catch (Exception exc) { + System.out.println("FileStructStore: FAILED to get timestamp for file " + dname); + exc.printStackTrace(); + } + DomainModified dm = new DomainModified().setName(dname).setModified(ts); + nameMods.add(dm); + } + + domainModifiedList.setNameModList(nameMods); + return domainModifiedList; + } + + @Override + public boolean insertDomainTemplate(String domainName, String templateName, String params) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "insertDomainTemplate"); + } + + if (domainStruct.getTemplates() == null) { + domainStruct.setTemplates(new ArrayList()); + } + ArrayList templates = domainStruct.getTemplates(); + if (!templates.contains(templateName)) { + templates.add(templateName); + } + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public boolean deleteDomainTemplate(String domainName, String templateName, String params) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deleteDomainTemplate"); + } + ArrayList templates = domainStruct.getTemplates(); + if (templates == null) { + return true; + } + templates.remove(templateName); + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public List listDomainTemplates(String domainName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listDomainTemplates"); + } + ArrayList list = new ArrayList<>(); + if (domainStruct.getTemplates() != null) { + list.addAll(domainStruct.getTemplates()); + } + return list; + } + + Role getRoleObject(DomainStruct domain, String roleName) { + HashMap roles = domain.getRoles(); + if (roles == null) { + return null; + } + return roles.get(roleName); + } + + Policy getPolicyObject(DomainStruct domain, String policyName) { + HashMap policies = domain.getPolicies(); + if (policies == null) { + return null; + } + return policies.get(policyName); + } + + ServiceIdentity getServiceObject(DomainStruct domain, String serviceName) { + HashMap services = domain.getServices(); + if (services == null) { + return null; + } + return services.get(serviceName); + } + + Entity getEntityObject(DomainStruct domain, String entityName) { + HashMap entities = domain.getEntities(); + if (entities == null) { + return null; + } + return entities.get(entityName); + } + + @Override + public Role getRole(String domainName, String roleName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getRole"); + } + return getRoleObject(domainStruct, roleName); + } + + @Override + public boolean insertRole(String domainName, Role role) { + updateRole(domainName, role); + return true; + } + + @Override + public boolean updateRole(String domainName, Role role) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updateRole"); + } + if (domainStruct.getRoles() == null) { + domainStruct.setRoles(new HashMap()); + } + HashMap roles = domainStruct.getRoles(); + + String roleName = extractRoleName(domainName, role.getName()); + if (roleName == null) { + throw ZMSUtils.error(ResourceException.BAD_REQUEST, "invalid role name", "updateRole"); + } + + // here we only need to update the main attrs and not + // the members + + Role originalRole = getRoleObject(domainStruct, roleName); + List members = role.getMembers(); + if (originalRole != null) { + role.setMembers(originalRole.getMembers()); + } else { + role.setMembers(null); + } + role.setModified(Timestamp.fromCurrentTime()); + roles.put(roleName, role); + putDomainStruct(domainName, domainStruct); + role.setMembers(members); + return true; + } + + @Override + public boolean updateRoleModTimestamp(String domainName, String roleName) { + + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updateRoleModTimestamp"); + } + Role role = getRoleObject(domainStruct, roleName); + role.setModified(Timestamp.fromCurrentTime()); + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public boolean deleteRole(String domainName, String roleName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deleteRole"); + } + HashMap roles = domainStruct.getRoles(); + + if (roles != null) { + roles.remove(roleName); + putDomainStruct(domainName, domainStruct); + } + return true; + } + + @Override + public List listEntities(String domainName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listEntities"); + } + HashMap entities = domainStruct.getEntities(); + ArrayList list = new ArrayList<>(); + if (entities != null) { + list.addAll(entities.keySet()); + } + Collections.sort(list); + return list; + } + + @Override + public List listRoles(String domainName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listRoles"); + } + HashMap roles = domainStruct.getRoles(); + ArrayList list = new ArrayList<>(); + if (roles != null) { + list.addAll(roles.keySet()); + } + Collections.sort(list); + return list; + } + + @Override + public List listRoleMembers(String domainName, String roleName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listRoleMembers"); + } + Role role = getRoleObject(domainStruct, roleName); + if (role == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "role not found", "listRoleMembers"); + } + return role.getMembers(); + } + + @Override + public Membership getRoleMember(String domainName, String roleName, String principal) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getRoleMember"); + } + Role role = getRoleObject(domainStruct, roleName); + if (role == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "role not found", "getRoleMember"); + } + Membership membership = new Membership() + .setMemberName(principal) + .setRoleName(ZMSUtils.roleResourceName(domainName, roleName)) + .setIsMember(false); + if (role.getMembers() != null) { + Set members = new HashSet<>(role.getMembers()); + membership.setIsMember(members.contains(principal)); + } + return membership; + } + + @Override + public boolean insertRoleMember(String domainName, String roleName, String principal, + String admin, String auditRef) { + + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "insertRoleMember"); + } + Role role = getRoleObject(domainStruct, roleName); + if (role == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "role not found", "insertRoleMember"); + } + if (!validatePrincipalDomain(principal)) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "principal domain not found", "insertRoleMember"); + } + // make sure our existing role as the member array + // and if it doesn't exist then create one + if (role.getMembers() == null) { + role.setMembers(new ArrayList()); + } + role.getMembers().add(principal); + putDomainStruct(domainName, domainStruct); + return true; + } + + boolean validatePrincipalDomain(String principal) { + int idx = principal.lastIndexOf('.'); + if (idx == -1 || idx == 0 || idx == principal.length() - 1) { + return false; + } + if (getDomainStruct(principal.substring(0, idx)) == null) { + return false; + } + return true; + } + + @Override + public boolean deleteRoleMember(String domainName, String roleName, String principal, + String admin, String auditRef) { + + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deleteRoleMember"); + } + Role role = getRoleObject(domainStruct, roleName); + if (role == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "role not found", "deleteRoleMember"); + } + if (role.getMembers() != null) { + role.getMembers().remove(principal); + } + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public Policy getPolicy(String domainName, String policyName) { + + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getPolicy"); + } + return getPolicyObject(domainStruct, policyName); + } + + @Override + public boolean insertPolicy(String domainName, Policy policy) { + return updatePolicy(domainName, policy); + } + + @Override + public boolean updatePolicy(String domainName, Policy policy) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updatePolicy"); + } + + if (domainStruct.getPolicies() == null) { + domainStruct.setPolicies(new HashMap()); + } + HashMap policies = domainStruct.getPolicies(); + + String policyName = extractPolicyName(domainName, policy.getName()); + + // here we only need to update the main attrs and not + // the assertions + + List assertions = policy.getAssertions(); + Policy originalPolicy = getPolicyObject(domainStruct, policyName); + if (originalPolicy != null) { + policy.setAssertions(originalPolicy.getAssertions()); + } else { + policy.setAssertions(null); + } + policy.setModified(Timestamp.fromCurrentTime()); + policies.put(policyName, policy); + putDomainStruct(domainName, domainStruct); + policy.setAssertions(assertions); + return true; + } + + @Override + public boolean deletePolicy(String domainName, String policyName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deletePolicy"); + } + if (domainStruct.getPolicies() != null) { + domainStruct.getPolicies().remove(policyName); + putDomainStruct(domainName, domainStruct); + } + return true; + } + + @Override + public List listPolicies(String domainName, String assertionRoleName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listPolicies"); + } + ArrayList list = new ArrayList<>(); + if (assertionRoleName == null) { + HashMap policies = domainStruct.getPolicies(); + if (policies != null) { + list.addAll(policies.keySet()); + } + } else { + List assertions = null; + HashMap policies = domainStruct.getPolicies(); + for (Policy policy : policies.values()) { + assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + for (Assertion assertion : assertions) { + if (assertionRoleName.compareToIgnoreCase(assertion.getRole()) == 0) { + list.add(policy.getName()); + break; + } + } + } + } + Collections.sort(list); + return list; + } + + @Override + public boolean insertAssertion(String domainName, String policyName, Assertion assertion) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "insertAssertion"); + } + Policy policy = getPolicyObject(domainStruct, policyName); + if (policy == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "policy not found", "insertAssertion"); + } + List assertions = policy.getAssertions(); + if (assertions == null) { + assertions = new ArrayList<>(); + policy.setAssertions(assertions); + } + assertions.add(assertion); + assertion.setId(System.nanoTime()); + putDomainStruct(domainName, domainStruct); + return true; + } + + boolean assertionMatch(Assertion assertion1, Assertion assertion2) { + + if (!assertion1.getAction().equals(assertion2.getAction())) { + return false; + } + if (!assertion1.getResource().equals(assertion2.getResource())) { + return false; + } + if (!assertion1.getRole().equals(assertion2.getRole())) { + return false; + } + AssertionEffect effect1 = AssertionEffect.ALLOW; + if (assertion1.getEffect() != null) { + effect1 = assertion1.getEffect(); + } + AssertionEffect effect2 = AssertionEffect.ALLOW; + if (assertion2.getEffect() != null) { + effect2 = assertion2.getEffect(); + } + if (effect1 != effect2) { + return false; + } + return true; + } + + @Override + public boolean deleteAssertion(String domainName, String policyName, Long assertionId) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deleteAssertion"); + } + Policy policy = getPolicyObject(domainStruct, policyName); + if (policy == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "policy not found", "insertAssertion"); + } + List assertions = policy.getAssertions(); + boolean deleted = false; + for (int i = 0; i < assertions.size(); i++) { + if (assertions.get(i).getId().equals(assertionId)) { + assertions.remove(i); + deleted = true; + break; + } + } + putDomainStruct(domainName, domainStruct); + return deleted; + } + + @Override + public List listAssertions(String domainName, String policyName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listAssertions"); + } + Policy policy = getPolicyObject(domainStruct, policyName); + if (policy == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "policy not found", "listAssertions"); + } + return policy.getAssertions(); + } + + @Override + public ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getServiceIdentity"); + } + return getServiceObject(domainStruct, serviceName); + } + + @Override + public boolean insertServiceIdentity(String domainName, ServiceIdentity service) { + return updateServiceIdentity(domainName, service); + } + + @Override + public boolean updateServiceIdentity(String domainName, ServiceIdentity service) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updateServiceIdentity"); + } + + if (domainStruct.getServices() == null) { + domainStruct.setServices(new HashMap()); + } + HashMap services = domainStruct.getServices(); + + service.setModified(Timestamp.fromCurrentTime()); + String serviceName = extractServiceName(domainName, service.getName()); + + // here we only need to update the main attrs and not + // the public keys and hosts + + List publicKeys = service.getPublicKeys(); + List hosts = service.getHosts(); + ServiceIdentity originalService = getServiceObject(domainStruct, serviceName); + if (originalService != null) { + service.setPublicKeys(originalService.getPublicKeys()); + service.setHosts(originalService.getHosts()); + } else { + service.setPublicKeys(null); + service.setHosts(null); + } + service.setModified(Timestamp.fromCurrentTime()); + services.put(serviceName, service); + putDomainStruct(domainName, domainStruct); + service.setPublicKeys(publicKeys); + service.setHosts(hosts); + return true; + } + + @Override + public boolean deleteServiceIdentity(String domainName, String serviceName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deleteServiceIdentity"); + } + HashMap services = domainStruct.getServices(); + if (services != null) { + services.remove(serviceName); + putDomainStruct(domainName, domainStruct); + } + return true; + } + + @Override + public List listServiceIdentities(String domainName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listServiceIdentities"); + } + HashMap services = domainStruct.getServices(); + ArrayList list = new ArrayList<>(); + if (services != null) { + list.addAll(services.keySet()); + } + Collections.sort(list); + return list; + } + + @Override + public PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, String keyId) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getPublicKeyEntry"); + } + ServiceIdentity service = getServiceObject(domainStruct, serviceName); + if (service == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "service not found", "getPublicKeyEntry"); + } + List publicKeys = service.getPublicKeys(); + if (publicKeys == null) { + return null; + } + for (PublicKeyEntry keyEntry : publicKeys) { + if (keyId.equals(keyEntry.getId())) { + return keyEntry; + } + } + return null; + } + + @Override + public boolean insertPublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey) { + return updatePublicKeyEntry(domainName, serviceName, publicKey); + } + + boolean removePublicKeyEntry(List keyList, String keyId) { + + if (keyList == null) { + return false; + } + + for (int idx = 0; idx < keyList.size(); idx++) { + if (keyId.equals(keyList.get(idx).getId())) { + keyList.remove(idx); + return true; + } + } + + return false; + } + + void updatePublicKeyEntry(ServiceIdentity service, PublicKeyEntry keyEntry) { + + // first we are going to remove the key from our array + // if one already exists. If the keyList is null, then + // we're going to create and set an empty list so + // later we can add the new key entry object to that list + + if (service.getPublicKeys() == null) { + service.setPublicKeys(new ArrayList()); + } + List keyList = service.getPublicKeys(); + removePublicKeyEntry(keyList, keyEntry.getId()); + + // now let's add our new key to the list + + keyList.add(keyEntry); + } + + @Override + public boolean updatePublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updatePublicKeyEntry"); + } + ServiceIdentity service = getServiceObject(domainStruct, serviceName); + if (service == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "service not found", "updatePublicKeyEntry"); + } + updatePublicKeyEntry(service, publicKey); + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public boolean deletePublicKeyEntry(String domainName, String serviceName, String keyId) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deletePublicKeyEntry"); + } + ServiceIdentity service = getServiceObject(domainStruct, serviceName); + if (service == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "service not found", "deletePublicKeyEntry"); + } + List keyList = service.getPublicKeys(); + boolean keyRemoved = removePublicKeyEntry(keyList, keyId); + if (!keyRemoved) { + return false; + } + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public List listPublicKeys(String domainName, String serviceName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listPublicKeys"); + } + ServiceIdentity service = getServiceObject(domainStruct, serviceName); + if (service == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "service not found", "deletePublicKeyEntry"); + } + return service.getPublicKeys(); + } + + @Override + public List listServiceHosts(String domainName, String serviceName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "listServiceHosts"); + } + ServiceIdentity service = getServiceObject(domainStruct, serviceName); + if (service == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "service not found", "deletePublicKeyEntry"); + } + return service.getHosts(); + } + + @Override + public boolean insertServiceHost(String domainName, String serviceName, String hostName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "insertServiceHost"); + } + ServiceIdentity service = getServiceObject(domainStruct, serviceName); + if (service == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "service not found", "insertServiceHost"); + } + if (service.getHosts() == null) { + service.setHosts(new ArrayList()); + } + List hosts = service.getHosts(); + hosts.add(hostName); + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public boolean deleteServiceHost(String domainName, String serviceName, String hostName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deleteServiceHost"); + } + ServiceIdentity service = getServiceObject(domainStruct, serviceName); + if (service == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "service not found", "deleteServiceHost"); + } + List hosts = service.getHosts(); + if (hosts == null) { + return false; + } + hosts.remove(hostName); + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public Entity getEntity(String domainName, String entityName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getEntity"); + } + return getEntityObject(domainStruct, entityName); + } + + @Override + public boolean insertEntity(String domainName, Entity entity) { + return updateEntity(domainName, entity); + } + + @Override + public boolean updateEntity(String domainName, Entity entity) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updateEntity"); + } + if (domainStruct.getEntities() == null) { + domainStruct.setEntities(new HashMap()); + } + HashMap entities = domainStruct.getEntities(); + entities.put(entity.getName(), entity); + putDomainStruct(domainName, domainStruct); + return true; + } + + @Override + public boolean deleteEntity(String domainName, String entityName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "deleteEntity"); + } + HashMap entities = domainStruct.getEntities(); + if (entities != null) { + entities.remove(entityName); + putDomainStruct(domainName, domainStruct); + } + return true; + } + + public synchronized DomainStruct getDomainStruct(String name) { + File f = new File(rootDir, name); + if (!f.exists()) { + return null; + } + DomainStruct domainStruct = null; + try { + Path path = Paths.get(f.toURI()); + domainStruct = JSON.fromBytes(Files.readAllBytes(path), DomainStruct.class); + } catch (IOException e) { + e.printStackTrace(); + } + return domainStruct; + } + + public synchronized void putDomainStruct(String name, DomainStruct data) { + + File f = new File(rootDir, name); + String policydata = JSON.string(data); + try { + FileWriter fileWriter = new FileWriter(f); + fileWriter.write(policydata); + fileWriter.flush(); + fileWriter.close(); + } catch (IOException e) { + e.printStackTrace(); + } + } + + private static void delete(File f) { + if (f.exists()) { + if (f.isDirectory()) { + + File[] fileList = f.listFiles(); + if (fileList != null) { + for (File ff : fileList) { + delete(ff); + } + } + } + if (!f.delete()) { + throw new RuntimeException("Cannot delete file: " + f); + } + } + } + + public static void deleteDirectory(File f) { + delete(f); + } + + public synchronized void delete(String name) { + File f = new File(rootDir, name); + delete(f); + } + + String extractObjectName(String domainName, String fullName, String objType) { + + // generate prefix to compare with + + StringBuilder prefixBuffer = new StringBuilder(512).append(domainName).append(objType); + String prefix = prefixBuffer.toString(); + if (!fullName.startsWith(prefix)) { + return null; + } + return fullName.substring(prefix.length()); + } + + String extractRoleName(String domainName, String fullRoleName) { + return extractObjectName(domainName, fullRoleName, ":role."); + } + + String extractPolicyName(String domainName, String fullPolicyName) { + return extractObjectName(domainName, fullPolicyName, ":policy."); + } + + String extractServiceName(String domainName, String fullServiceName) { + return extractObjectName(domainName, fullServiceName, "."); + } + + @Override + public List listRoleAuditLogs(String domainName, String roleName) { + List list = new ArrayList<>(); + return list; + } + + @Override + public ResourceAccessList listResourceAccess(String principal, String action, String userDomain) { + throw ZMSUtils.error(ResourceException.INTERNAL_SERVER_ERROR, "Not Implemented", "listResourceAccess"); + } + + @Override + public Assertion getAssertion(String domainName, String policyName, Long assertionId) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "getAssertion"); + } + Policy policy = getPolicyObject(domainStruct, policyName); + if (policy == null) { + return null; + } + List assertions = policy.getAssertions(); + if (assertions == null) { + return null; + } + for (Assertion assertion : assertions) { + if (assertion.getId().equals(assertionId)) { + return assertion; + } + } + return null; + } + + @Override + public boolean updatePolicyModTimestamp(String domainName, String policyName) { + DomainStruct domainStruct = getDomainStruct(domainName); + if (domainStruct == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "domain not found", "updatePolicyModTimestamp"); + } + Policy policy = getPolicyObject(domainStruct, policyName); + if (policy == null) { + throw ZMSUtils.error(ResourceException.NOT_FOUND, "policy not found", "updatePolicyModTimestamp"); + } + policy.setModified(Timestamp.fromCurrentTime()); + putDomainStruct(domainName, domainStruct); + return true; + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/FileObjectStore.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/FileObjectStore.java new file mode 100644 index 00000000000..63c6466c665 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/file/FileObjectStore.java @@ -0,0 +1,52 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.file; + +import java.io.File; + +import com.yahoo.athenz.zms.store.ObjectStore; +import com.yahoo.athenz.zms.store.ObjectStoreConnection; + +public class FileObjectStore implements ObjectStore { + + File rootDir; + + public FileObjectStore(File rootDirectory) { + if (!rootDirectory.exists()) { + if (!rootDirectory.mkdirs()) { + error("cannot create specified root: " + rootDirectory); + } + } else { + if (!rootDirectory.isDirectory()) { + error("specified root is not a directory: " + rootDirectory); + } + } + this.rootDir = rootDirectory; + } + + @Override + public ObjectStoreConnection getConnection(boolean autoCommit) { + return new FileConnection(rootDir); + } + + @Override + public void clearConnections() { + } + + static void error(String msg) { + throw new RuntimeException("FileObjectStore: " + msg); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/DataSourceFactory.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/DataSourceFactory.java new file mode 100644 index 00000000000..79f4fee6cd1 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/DataSourceFactory.java @@ -0,0 +1,267 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import java.io.PrintWriter; +import java.util.concurrent.TimeUnit; +import java.sql.DriverManager; +import java.sql.Connection; +import java.sql.SQLFeatureNotSupportedException; +import java.sql.SQLException; + +import org.apache.commons.dbcp2.ConnectionFactory; +import org.apache.commons.dbcp2.DriverManagerConnectionFactory; +import org.apache.commons.dbcp2.PoolableConnection; +import org.apache.commons.dbcp2.PoolableConnectionFactory; +import org.apache.commons.pool2.ObjectPool; +import org.apache.commons.pool2.impl.GenericObjectPool; +import org.apache.commons.pool2.impl.GenericObjectPoolConfig; +import org.apache.commons.pool2.impl.BaseObjectPoolConfig; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +// a simple factory for datasources +// typically, the datasource configuration would be done by the container (i.e. spring) +public class DataSourceFactory { + + private static final Logger LOG = LoggerFactory.getLogger(DataSourceFactory.class); + + static final String ZMS_PROP_DBUSER = "athenz.zms.jdbc_user"; + static final String ZMS_PROP_DBPASS = "athenz.zms.jdbc_password"; + + static final String ZMS_PROP_DBPOOL_MAX_TOTAL = "athenz.zms.db_pool_max_total"; + static final String ZMS_PROP_DBPOOL_MAX_IDLE = "athenz.zms.db_pool_max_idle"; + static final String ZMS_PROP_DBPOOL_MIN_IDLE = "athenz.zms.db_pool_min_idle"; + static final String ZMS_PROP_DBPOOL_MAX_WAIT = "athenz.zms.db_pool_max_wait"; + static final String ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT = "athenz.zms.db_pool_evict_idle_timeout"; + static final String ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL = "athenz.zms.db_pool_evict_idle_interval"; + static final String ZMS_PROP_DBPOOL_MAX_TTL = "athenz.zms.db_pool_max_ttl"; + + static final long MAX_TTL_CONN_MS = TimeUnit.MILLISECONDS.convert(10L, TimeUnit.MINUTES); + + public static PoolableDataSource create(String url) { + String userName = System.getProperty(ZMS_PROP_DBUSER); + String driver = "?"; + try { + if (url.indexOf("sqlite") > 0) { + driver = "org.sqlite.JDBC"; + Class.forName(driver); + return new SimpleDataSource(driver, url); + } else if (url.indexOf(":mysql:") > 0) { + driver = "com.mysql.jdbc.Driver"; + Class.forName(driver); + + String password = System.getProperty(ZMS_PROP_DBPASS, ""); + ConnectionFactory connectionFactory = + new DriverManagerConnectionFactory(url, userName, password); + + return create(connectionFactory); + } else { + throw new RuntimeException("Cannot figure out how to instantiate this data source: " + url); + } + } catch (ClassNotFoundException e) { + throw new RuntimeException("Cannot load driver class: " + driver); + } catch (Exception exc) { + throw new RuntimeException("Failed to create database source(" + + url + ") with driver(" + driver + ")", exc); + } + } + + static long retrieveConfigSetting(String propName, long defaultValue) { + + final String errPrefix = "Using default instead. Ignoring Invalid number("; + + String propValue = System.getProperty(propName); + if (propValue == null) { + return defaultValue; + } + + long value = defaultValue; + try { + value = Long.parseLong(propValue); + } catch (NumberFormatException ex) { + if (LOG.isWarnEnabled()) { + LOG.warn(errPrefix + propValue + ") set in system property(" + propName + "): " + ex.getMessage()); + } + } + + return value; + } + + static int retrieveConfigSetting(String propName, int defaultValue) { + + final String errPrefix = "Using default instead. Ignoring Invalid number("; + + String propValue = System.getProperty(propName); + if (propValue == null) { + return defaultValue; + } + + int value = defaultValue; + try { + value = Integer.parseInt(propValue); + } catch (NumberFormatException ex) { + if (LOG.isWarnEnabled()) { + LOG.warn(errPrefix + propValue + ") set in system property(" + propName + "): " + ex.getMessage()); + } + } + + return value; + } + + public static GenericObjectPoolConfig setupPoolConfig() { + + // setup config vars for the object pool + // ie. min and max idle instances, and max total instances of arbitrary objects + + GenericObjectPoolConfig config = new GenericObjectPoolConfig(); + + // The maximum number of active connections that can be allocated from + // this pool at the same time, or negative for no limit. Default: 8 + config.setMaxTotal(retrieveConfigSetting(ZMS_PROP_DBPOOL_MAX_TOTAL, GenericObjectPoolConfig.DEFAULT_MAX_TOTAL)); + if (config.getMaxTotal() == 0) { + config.setMaxTotal(-1); // -1 means no limit + } + + // The maximum number of connections that can remain idle in the pool, + // without extra ones being released, or negative for no limit. Default 8 + config.setMaxIdle(retrieveConfigSetting(ZMS_PROP_DBPOOL_MAX_IDLE, GenericObjectPoolConfig.DEFAULT_MAX_IDLE)); + if (config.getMaxIdle() == 0) { + config.setMaxIdle(-1); // -1 means no limit + } + + // The minimum number of connections that can remain idle in the pool, + // without extra ones being created, or zero to create none. Default 0 + config.setMinIdle(retrieveConfigSetting(ZMS_PROP_DBPOOL_MIN_IDLE, GenericObjectPoolConfig.DEFAULT_MIN_IDLE)); + + // The maximum number of milliseconds that the pool will wait (when + // there are no available connections) for a connection to be returned + // before throwing an exception, or -1 to wait indefinitely. Default -1 + config.setMaxWaitMillis(retrieveConfigSetting(ZMS_PROP_DBPOOL_MAX_WAIT, + GenericObjectPoolConfig.DEFAULT_MAX_WAIT_MILLIS)); + + // setup the configuration to cleanup idle connections + // + // Minimum time an object can be idle in the pool before being eligible + // for eviction by the idle object evictor. + // The default value is 30 minutes (1000 * 60 * 30). + config.setMinEvictableIdleTimeMillis(retrieveConfigSetting(ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT, + BaseObjectPoolConfig.DEFAULT_MIN_EVICTABLE_IDLE_TIME_MILLIS)); + + // Number of milliseconds to sleep between runs of idle object evictor thread. + // Not using DEFAULT_TIME_BETWEEN_EVICTION_RUNS_MILLIS since it is -1 + // meaning it will not run the evictor thread and instead we're using + // the default min value for evictable idle connections (Default 30 minutes) + config.setTimeBetweenEvictionRunsMillis(retrieveConfigSetting(ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL, + BaseObjectPoolConfig.DEFAULT_MIN_EVICTABLE_IDLE_TIME_MILLIS)); + + if (LOG.isDebugEnabled()) { + LOG.debug("Config settings for idle object eviction: " + + "time interval between eviction thread runs(" + + config.getTimeBetweenEvictionRunsMillis() + + " millis): minimum timeout for idle objects(" + + config.getMinEvictableIdleTimeMillis() + " millis)"); + } + + // Validate objects by the idle object evictor. If invalid, gets dropped + // from the pool. + config.setTestWhileIdle(true); + + // Validate object before borrowing from pool. If invalid, gets dropped + // from the pool and an attempt to borrow another one will occur. + config.setTestOnBorrow(true); + return config; + } + + static PoolableDataSource create(ConnectionFactory connectionFactory) { + + // setup our pool config object + + GenericObjectPoolConfig config = setupPoolConfig(); + + PoolableConnectionFactory poolableConnectionFactory = + new PoolableConnectionFactory(connectionFactory, null); + + // Set max lifetime of a connection in milli-secs, after which it will + // always fail activation, passivation, and validation. + // Value of -1 means infinite life time. The default value + // defined in this class is 10 minutes. + long connTtlMillis = retrieveConfigSetting(ZMS_PROP_DBPOOL_MAX_TTL, MAX_TTL_CONN_MS); + poolableConnectionFactory.setMaxConnLifetimeMillis(connTtlMillis); + if (LOG.isInfoEnabled()) { + LOG.info("Setting Time-To-Live interval for live connections(" + + connTtlMillis + ")milli-secs"); + } + + ObjectPool connectionPool = new GenericObjectPool<>(poolableConnectionFactory, config); + poolableConnectionFactory.setPool(connectionPool); + + ZMSDataSource dataSource = new ZMSDataSource(connectionPool); + return dataSource; + } + + static class SimpleDataSource implements PoolableDataSource { + PrintWriter logger; + String className; + String url; + + SimpleDataSource(String className, String url) { + this.className = className; + this.url = url; + this.logger = new PrintWriter(System.out); + } + + public Connection getConnection() { + try { + Class.forName(className); + return DriverManager.getConnection(url); + } catch (ClassNotFoundException e) { + throw new RuntimeException("Cannot load class: " + className); + } catch (SQLException e) { + throw new RuntimeException("Cannot connect to database " + url); + } + } + public Connection getConnection(String user, String pass) { + return getConnection(); //use a real datasource if you want this + } + public int getLoginTimeout() { + return 0; + } + public void setLoginTimeout(int seconds) { + } + public void setLogWriter(PrintWriter out) { + logger = out; + } + public PrintWriter getLogWriter() { + return logger; + } + public java.util.logging.Logger getParentLogger() throws SQLFeatureNotSupportedException { + throw new SQLFeatureNotSupportedException(); + } + public boolean isWrapperFor(Class iface) { + return false; + } + public T unwrap(Class iface) throws SQLException { + throw new SQLException("Not implemented"); + } + + @Override + public void clearPoolConnections() { + } + } +} + diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/JDBCConnection.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/JDBCConnection.java new file mode 100644 index 00000000000..1c855ffe420 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/JDBCConnection.java @@ -0,0 +1,2987 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import java.sql.Connection; +import java.sql.PreparedStatement; +import java.sql.ResultSet; +import java.sql.SQLException; +import java.util.ArrayList; +import java.util.Calendar; +import java.util.Collections; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.TimeZone; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.Domain; +import com.yahoo.athenz.zms.DomainModified; +import com.yahoo.athenz.zms.DomainModifiedList; +import com.yahoo.athenz.zms.Entity; +import com.yahoo.athenz.zms.Membership; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.ResourceAccess; +import com.yahoo.athenz.zms.ResourceAccessList; +import com.yahoo.athenz.zms.ResourceException; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.RoleAuditLog; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zms.ZMSConsts; +import com.yahoo.athenz.zms.store.AthenzDomain; +import com.yahoo.athenz.zms.store.ObjectStoreConnection; +import com.yahoo.athenz.zms.utils.ZMSUtils; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.Timestamp; +import com.yahoo.rdl.UUID; + +public class JDBCConnection implements ObjectStoreConnection { + + private static final Logger LOG = LoggerFactory.getLogger(JDBCConnection.class); + + private static final int MYSQL_ER_OPTION_PREVENTS_STATEMENT = 1290; + private static final int MYSQL_ER_OPTION_DUPLICATE_ENTRY = 1062; + + private static final String SQL_DELETE_DOMAIN = "DELETE FROM domain WHERE name=?;"; + private static final String SQL_GET_DOMAIN = "SELECT * FROM domain WHERE name=?;"; + private static final String SQL_GET_DOMAIN_ID = "SELECT domain_id FROM domain WHERE name=?;"; + private static final String SQL_GET_DOMAIN_WITH_ACCOUNT = "SELECT name FROM domain WHERE account=?;"; + private static final String SQL_GET_DOMAIN_WITH_PRODUCT_ID = "SELECT name FROM domain WHERE ypm_id=?;"; + private static final String SQL_INSERT_DOMAIN = "INSERT INTO domain " + + "(name, description, org, uuid, enabled, audit_enabled, account, ypm_id) VALUES (?,?,?,?,?,?,?,?);"; + private static final String SQL_UPDATE_DOMAIN = "UPDATE domain " + + "SET description=?, org=?, uuid=?, enabled=?, audit_enabled=?, account=?, ypm_id=? WHERE name=?;"; + private static final String SQL_UPDATE_DOMAIN_MOD_TIMESTAMP = "UPDATE domain " + + "SET modified=CURRENT_TIMESTAMP(3) WHERE name=?;"; + private static final String SQL_GET_DOMAIN_MOD_TIMESTAMP = "SELECT modified FROM domain WHERE name=?;"; + private static final String SQL_LIST_DOMAIN = "SELECT name, modified FROM domain;"; + private static final String SQL_LIST_DOMAIN_PREFIX = "SELECT name, modified FROM domain WHERE name>=? AND name?;"; + private static final String SQL_LIST_DOMAIN_PREFIX_MODIFIED = "SELECT name, modified FROM domain " + + "WHERE name>=? AND name?;"; + private static final String SQL_LIST_DOMAIN_ROLE_NAME_MEMBER = "SELECT domain.name FROM domain " + + "JOIN role ON role.domain_id=domain.domain_id " + + "JOIN role_member ON role_member.role_id=role.role_id " + + "JOIN principal ON principal.principal_id=role_member.principal_id " + + "WHERE principal.name=? AND role.name=?;"; + private static final String SQL_LIST_DOMAIN_ROLE_MEMBER = "SELECT domain.name FROM domain " + + "JOIN role ON role.domain_id=domain.domain_id " + + "JOIN role_member ON role_member.role_id=role.role_id " + + "JOIN principal ON principal.principal_id=role_member.principal_id " + + "WHERE principal.name=?;"; + private static final String SQL_LIST_DOMAIN_ROLE_NAME = "SELECT domain.name FROM domain " + + "JOIN role ON role.domain_id=domain.domain_id WHERE role.name=?;"; + private static final String SQL_LIST_DOMAIN_AWS = "SELECT name, account FROM domain WHERE account!='';"; + private static final String SQL_GET_ROLE = "SELECT * FROM role " + + "JOIN domain ON domain.domain_id=role.domain_id " + + "WHERE domain.name=? AND role.name=?;"; + private static final String SQL_GET_ROLE_ID = "SELECT role_id FROM role WHERE domain_id=? AND name=?;"; + private static final String SQL_INSERT_ROLE = "INSERT INTO role (name, domain_id, trust) VALUES (?,?,?);"; + private static final String SQL_UPDATE_ROLE = "UPDATE role SET trust=? WHERE role_id=?;"; + private static final String SQL_DELETE_ROLE = "DELETE FROM role WHERE domain_id=? AND name=?;"; + private static final String SQL_UPDATE_ROLE_MOD_TIMESTAMP = "UPDATE role " + + "SET modified=CURRENT_TIMESTAMP(3) WHERE role_id=?;"; + private static final String SQL_LIST_ROLE = "SELECT name FROM role WHERE domain_id=?;"; + private static final String SQL_GET_ROLE_MEMBER = "SELECT principal.principal_id FROM principal " + + "JOIN role_member ON role_member.principal_id=principal.principal_id " + + "JOIN role ON role.role_id=role_member.role_id " + + "WHERE role.role_id=? AND principal.name=?;"; + private static final String SQL_LIST_ROLE_MEMBERS = "SELECT principal.name FROM principal " + + "JOIN role_member ON role_member.principal_id=principal.principal_id " + + "JOIN role ON role.role_id=role_member.role_id " + + "WHERE role.role_id=?;"; + private static final String SQL_GET_PRINCIPAL_ID = "SELECT principal_id FROM principal WHERE name=?;"; + private static final String SQL_INSERT_PRINCIPAL = "INSERT INTO principal (name) VALUES (?);"; + private static final String SQL_LAST_INSERT_ID = "SELECT LAST_INSERT_ID();"; + private static final String SQL_INSERT_ROLE_MEMBER = "INSERT INTO role_member (role_id, principal_id) VALUES (?,?);"; + private static final String SQL_DELETE_ROLE_MEMBER = "DELETE FROM role_member WHERE role_id=? AND principal_id=?;"; + private static final String SQL_INSERT_ROLE_AUDIT_LOG = "INSERT INTO role_audit_log " + + "(role_id, admin, member, action, audit_ref) VALUES (?,?,?,?,?);"; + private static final String SQL_LIST_ROLE_AUDIT_LOGS = "SELECT * FROM role_audit_log WHERE role_id=?;"; + private static final String SQL_GET_POLICY = "SELECT * FROM policy " + + "JOIN domain ON domain.domain_id=policy.domain_id WHERE domain.name=? AND policy.name=?;"; + private static final String SQL_INSERT_POLICY = "INSERT INTO policy (name, domain_id) VALUES (?,?);"; + private static final String SQL_UPDATE_POLICY = "UPDATE policy SET name=? WHERE policy_id=?;"; + private static final String SQL_UPDATE_POLICY_MOD_TIMESTAMP = "UPDATE policy " + + "SET modified=CURRENT_TIMESTAMP(3) WHERE policy_id=?;"; + private static final String SQL_GET_POLICY_ID = "SELECT policy_id FROM policy WHERE domain_id=? AND name=?;"; + private static final String SQL_DELETE_POLICY = "DELETE FROM policy WHERE domain_id=? AND name=?;"; + private static final String SQL_LIST_POLICY = "SELECT name FROM policy WHERE domain_id=?"; + private static final String SQL_LIST_ASSERTION = "SELECT * FROM assertion WHERE policy_id=?"; + private static final String SQL_GET_ASSERTION = "SELECT * FROM assertion " + + "JOIN policy ON assertion.policy_id=policy.policy_id " + + "JOIN domain ON policy.domain_id=domain.domain_id " + + "WHERE assertion.assertion_id=? AND domain.name=? AND policy.name=?;"; + private static final String SQL_CHECK_ASSERTION = "SELECT assertion_id FROM assertion " + + "WHERE policy_id=? AND role=? AND resource=? AND action=? AND effect=?;"; + private static final String SQL_INSERT_ASSERTION = "INSERT INTO assertion " + + "(policy_id, role, resource, action, effect) VALUES (?,?,?,?,?);"; + private static final String SQL_DELETE_ASSERTION = "DELETE FROM assertion " + + "WHERE policy_id=? AND assertion_id=?;"; + private static final String SQL_GET_SERVICE = "SELECT * FROM service " + + "JOIN domain ON domain.domain_id=service.domain_id WHERE domain.name=? AND service.name=?;"; + private static final String SQL_INSERT_SERVICE = "INSERT INTO service " + + "(name, provider_endpoint, executable, svc_user, svc_group, domain_id) VALUES (?,?,?,?,?,?);"; + private static final String SQL_UPDATE_SERVICE = "UPDATE service SET " + + "provider_endpoint=?, executable=?, svc_user=?, svc_group=? WHERE service_id=?;"; + private static final String SQL_DELETE_SERVICE = "DELETE FROM service WHERE domain_id=? AND name=?;"; + private static final String SQL_GET_SERVICE_ID = "SELECT service_id FROM service WHERE domain_id=? AND name=?;"; + private static final String SQL_LIST_SERVICE = "SELECT name FROM service WHERE domain_id=?;"; + private static final String SQL_LIST_PUBLIC_KEY = "SELECT * FROM public_key WHERE service_id=?;"; + private static final String SQL_GET_PUBLIC_KEY = "SELECT key_value FROM public_key WHERE service_id=? AND key_id=?;"; + private static final String SQL_INSERT_PUBLIC_KEY = "INSERT INTO public_key " + + "(service_id, key_id, key_value) VALUES (?,?,?);"; + private static final String SQL_UPDATE_PUBLIC_KEY = "UPDATE public_key SET key_value=? WHERE service_id=? AND key_id=?;"; + private static final String SQL_DELETE_PUBLIC_KEY = "DELETE FROM public_key WHERE service_id=? AND key_id=?;"; + private static final String SQL_LIST_SERVICE_HOST = "SELECT host.name FROM host " + + "JOIN service_host ON service_host.host_id=host.host_id " + + "WHERE service_host.service_id=?;"; + private static final String SQL_INSERT_SERVICE_HOST = "INSERT INTO service_host (service_id, host_id) VALUES (?,?);"; + private static final String SQL_DELETE_SERVICE_HOST = "DELETE FROM service_host WHERE service_id=? AND host_id=?;"; + private static final String SQL_GET_HOST_ID = "SELECT host_id FROM host WHERE name=?;"; + private static final String SQL_INSERT_HOST = "INSERT INTO host (name) VALUES (?);"; + private static final String SQL_INSERT_ENTITY = "INSERT INTO entity (domain_id, name, value) VALUES (?,?,?);"; + private static final String SQL_UPDATE_ENTITY = "UPDATE entity SET value=? WHERE domain_id=? AND name=?;"; + private static final String SQL_DELETE_ENTITY = "DELETE FROM entity WHERE domain_id=? AND name=?;"; + private static final String SQL_GET_ENTITY = "SELECT value FROM entity WHERE domain_id=? AND name=?;"; + private static final String SQL_LIST_ENTITY = "SELECT name FROM entity WHERE domain_id=?;"; + private static final String SQL_INSERT_DOMAIN_TEMPLATE = "INSERT INTO domain_template (domain_id, template) VALUES (?,?);"; + private static final String SQL_DELETE_DOMAIN_TEMPLATE = "DELETE FROM domain_template WHERE domain_id=? AND template=?;"; + private static final String SQL_LIST_DOMAIN_TEMPLATE = "SELECT template FROM domain_template " + + "JOIN domain ON domain_template.domain_id=domain.domain_id " + + "WHERE domain.name=?;"; + private static final String SQL_GET_DOMAIN_ROLES = "SELECT * FROM role WHERE domain_id=?;"; + private static final String SQL_GET_DOMAIN_ROLE_MEMBERS = "SELECT role.name, principal.name FROM principal " + + "JOIN role_member ON role_member.principal_id=principal.principal_id " + + "JOIN role ON role.role_id=role_member.role_id " + + "WHERE role.domain_id=?;"; + private static final String SQL_GET_DOMAIN_POLICIES = "SELECT * FROM policy WHERE domain_id=?;"; + private static final String SQL_GET_DOMAIN_POLICY_ASSERTIONS = "SELECT policy.name, " + + "assertion.effect, assertion.action, assertion.role, assertion.resource, " + + "assertion.assertion_id FROM assertion " + + "JOIN policy ON policy.policy_id=assertion.policy_id " + + "WHERE policy.domain_id=?;"; + private static final String SQL_GET_DOMAIN_SERVICES = "SELECT * FROM service WHERE domain_id=?;"; + private static final String SQL_GET_DOMAIN_SERVICES_HOSTS = "SELECT service.name, host.name FROM host " + + "JOIN service_host ON host.host_id=service_host.host_id " + + "JOIN service ON service.service_id=service_host.service_id " + + "WHERE service.domain_id=?;"; + private static final String SQL_GET_DOMAIN_SERVICES_PUBLIC_KEYS = "SELECT service.name, " + + "public_key.key_id, public_key.key_value FROM public_key " + + "JOIN service ON service.service_id=public_key.service_id " + + "WHERE service.domain_id=?;"; + private static final String SQL_LIST_POLICY_REFERENCING_ROLE = "SELECT name FROM policy " + + "JOIN assertion ON policy.policy_id=assertion.policy_id " + + "WHERE policy.domain_id=? AND assertion.role=?;"; + private static final String SQL_LIST_ROLE_ASSERTIONS = "SELECT assertion.role, assertion.resource, " + + "assertion.action, assertion.effect, assertion.assertion_id, policy.domain_id, domain.name FROM assertion " + + "JOIN policy ON assertion.policy_id=policy.policy_id " + + "JOIN domain ON policy.domain_id=domain.domain_id"; + private static final String SQL_LIST_ROLE_ASSERTION_QUERY_ACTION = " WHERE assertion.action=?;"; + private static final String SQL_LIST_ROLE_ASSERTION_NO_ACTION = " WHERE assertion.action!='assume_role';"; + private static final String SQL_LIST_ROLE_PRINCIPALS = "SELECT principal.name, role.domain_id, " + + "role.name AS role_name FROM principal " + + "JOIN role_member ON principal.principal_id=role_member.principal_id " + + "JOIN role ON role_member.role_id=role.role_id"; + private static final String SQL_LIST_ROLE_PRINCIPALS_YBY_ONLY = " WHERE principal.name LIKE 'yby.%';"; + private static final String SQL_LIST_ROLE_PRINCIPALS_QUERY = " WHERE principal.name=?;"; + private static final String SQL_LIST_TRUSTED_ROLES = "SELECT role.domain_id, role.name, " + + "policy.domain_id AS assert_domain_id, assertion.role FROM role " + + "JOIN domain ON domain.domain_id=role.domain_id " + + "JOIN assertion ON (assertion.resource=CONCAT(domain.name, \":role.\", role.name) OR assertion.resource=CONCAT(\"*:role.\", role.name)) " + + "JOIN policy ON policy.policy_id=assertion.policy_id " + + "WHERE assertion.action='assume_role';"; + + private static final String CACHE_DOMAIN = "d:"; + private static final String CACHE_ROLE = "r:"; + private static final String CACHE_POLICY = "p:"; + private static final String CACHE_SERVICE = "s:"; + private static final String CACHE_PRINCIPAL = "u:"; + private static final String CACHE_HOST = "h:"; + + Connection con = null; + boolean transactionCompleted = true; + Map objectMap = null; + + public JDBCConnection(Connection con, boolean autoCommit) throws SQLException { + this.con = con; + con.setAutoCommit(autoCommit); + transactionCompleted = autoCommit; + objectMap = new HashMap<>(); + } + + @Override + public void close() { + + if (con == null) { + return; + } + + // the client is always responsible for properly committing + // all changes before closing the connection, but in case + // we missed it, we're going to be safe and commit all + // changes before closing the connection + + try { + commitChanges(); + } catch (Exception ex) { + // error is already logged but we have to continue + // processing so we can close our connection + } + + try { + con.close(); + con = null; + } catch (SQLException ex) { + LOG.error("close: state - " + ex.getSQLState() + + ", code - " + ex.getErrorCode() + ", message - " + ex.getMessage()); + } + } + + @Override + public void rollbackChanges() { + + if (LOG.isDebugEnabled()) { + LOG.debug("rollback transaction changes..."); + } + + if (transactionCompleted) { + return; + } + + try { + con.rollback(); + } catch (SQLException ex) { + LOG.error("rollbackChanges: state - " + ex.getSQLState() + + ", code - " + ex.getErrorCode() + ", message - " + ex.getMessage()); + } + transactionCompleted = true; + try { + con.setAutoCommit(true); + } catch (SQLException ex) { + LOG.error("rollback auto-commit after failure: state - " + ex.getSQLState() + + ", code - " + ex.getErrorCode() + ", message - " + ex.getMessage()); + } + } + + @Override + public void commitChanges() { + + final String caller = "commitChanges"; + if (transactionCompleted) { + return; + } + + try { + con.commit(); + transactionCompleted = true; + con.setAutoCommit(true); + } catch (SQLException ex) { + LOG.error("commitChanges: state - " + ex.getSQLState() + + ", code - " + ex.getErrorCode() + ", message - " + ex.getMessage()); + transactionCompleted = true; + throw sqlError(ex, caller); + } + } + + Domain saveDomainSettings(String domainName, ResultSet rs, String caller) { + try { + Domain domain = new Domain().setName(domainName) + .setAuditEnabled(rs.getBoolean(ZMSConsts.DB_COLUMN_AUDIT_ENABLED)) + .setEnabled(rs.getBoolean(ZMSConsts.DB_COLUMN_ENABLED)) + .setModified(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime())) + .setDescription(saveValue(rs.getString(ZMSConsts.DB_COLUMN_DESCRIPTION))) + .setOrg(saveValue(rs.getString(ZMSConsts.DB_COLUMN_ORG))) + .setId(saveUuidValue(rs.getString(ZMSConsts.DB_COLUMN_UUID))) + .setAccount(saveValue(rs.getString(ZMSConsts.DB_COLUMN_ACCOUNT))) + .setYpmId(rs.getInt(ZMSConsts.DB_COLUMN_PRODUCT_ID)); + return domain; + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + } + + @Override + public Domain getDomain(String domainName) { + + final String caller = "getDomain"; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN)) { + ps.setString(1, domainName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + return saveDomainSettings(domainName, rs, caller); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return null; + } + + @Override + public boolean insertDomain(Domain domain) { + + int affectedRows = 0; + final String caller = "insertDomain"; + + // we need to verify that our account and product ids are unique + // in the store. we can't rely on db uniqueness check since + // some of the domains will not have these attributes set + + verifyDomainAccountUniqueness(domain.getName(), domain.getAccount(), caller); + verifyDomainProductIdUniqueness(domain.getName(), domain.getYpmId(), caller); + + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_DOMAIN)) { + ps.setString(1, domain.getName()); + ps.setString(2, processInsertValue(domain.getDescription())); + ps.setString(3, processInsertValue(domain.getOrg())); + ps.setString(4, processInsertUuidValue(domain.getId())); + ps.setBoolean(5, processInsertValue(domain.getEnabled(), true)); + ps.setBoolean(6, processInsertValue(domain.getAuditEnabled(), false)); + ps.setString(7, processInsertValue(domain.getAccount())); + ps.setInt(8, processInsertValue(domain.getYpmId())); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + void verifyDomainProductIdUniqueness(String name, Integer productId, String caller) { + + if (productId == null || productId.intValue() == 0) { + return; + } + + String domainName = lookupDomainById(null, productId); + if (domainName != null && !domainName.equals(name)) { + throw requestError(caller, "Product Id: " + productId + + " is already assigned to domain: " + domainName); + } + } + + void verifyDomainAccountUniqueness(String name, String account, String caller) { + + if (account == null || account.isEmpty()) { + return; + } + + String domainName = lookupDomainById(account, 0); + if (domainName != null && !domainName.equals(name)) { + throw requestError(caller, "Account Id: " + account + + " is already assigned to domain: " + domainName); + } + } + + @Override + public boolean updateDomain(Domain domain) { + + int affectedRows = 0; + final String caller = "updateDomain"; + + // we need to verify that our account and product ids are unique + // in the store. we can't rely on db uniqueness check since + // some of the domains will not have these attributes set + + verifyDomainAccountUniqueness(domain.getName(), domain.getAccount(), caller); + verifyDomainProductIdUniqueness(domain.getName(), domain.getYpmId(), caller); + + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_DOMAIN)) { + ps.setString(1, processInsertValue(domain.getDescription())); + ps.setString(2, processInsertValue(domain.getOrg())); + ps.setString(3, processInsertUuidValue(domain.getId())); + ps.setBoolean(4, processInsertValue(domain.getEnabled(), true)); + ps.setBoolean(5, processInsertValue(domain.getAuditEnabled(), false)); + ps.setString(6, processInsertValue(domain.getAccount())); + ps.setInt(7, processInsertValue(domain.getYpmId())); + ps.setString(8, domain.getName()); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean updateDomainModTimestamp(String domainName) { + + int affectedRows = 0; + final String caller = "updateDomainModTimestamp"; + + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_DOMAIN_MOD_TIMESTAMP)) { + ps.setString(1, domainName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public long getDomainModTimestamp(String domainName) { + + long modTime = 0; + final String caller = "getDomainModTimestamp"; + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_MOD_TIMESTAMP)) { + ps.setString(1, domainName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + modTime = rs.getTimestamp(1).getTime(); + } + } + } catch (SQLException ex) { + // ignore any failures and return default value 0 + } + return modTime; + } + + @Override + public boolean deleteDomain(String domainName) { + + int affectedRows = 0; + final String caller = "deleteDomain"; + + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_DOMAIN)) { + ps.setString(1, domainName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + PreparedStatement prepareScanStatement(Connection con, String prefix, long modifiedSince) + throws SQLException { + + PreparedStatement ps = null; + if (prefix != null && prefix.length() > 0) { + int len = prefix.length(); + char c = (char) (prefix.charAt(len - 1) + 1); + String stop = prefix.substring(0, len - 1) + c; + if (modifiedSince != 0) { + ps = con.prepareStatement(SQL_LIST_DOMAIN_PREFIX_MODIFIED); + ps.setString(1, prefix); + ps.setString(2, stop); + Calendar cal = Calendar.getInstance(TimeZone.getTimeZone("GMT")); + ps.setTimestamp(3, new java.sql.Timestamp(modifiedSince), cal); + } else { + ps = con.prepareStatement(SQL_LIST_DOMAIN_PREFIX); + ps.setString(1, prefix); + ps.setString(2, stop); + } + } else if (modifiedSince != 0) { + ps = con.prepareStatement(SQL_LIST_DOMAIN_MODIFIED); + Calendar cal = Calendar.getInstance(TimeZone.getTimeZone("GMT")); + ps.setTimestamp(1, new java.sql.Timestamp(modifiedSince), cal); + } else { + ps = con.prepareStatement(SQL_LIST_DOMAIN); + } + return ps; + } + + PreparedStatement prepareScanByRoleStatement(Connection con, String roleMember, String roleName) + throws SQLException { + + PreparedStatement ps = null; + boolean memberPresent = (roleMember != null && !roleMember.isEmpty()); + boolean rolePresent = (roleName != null && !roleName.isEmpty()); + if (memberPresent && rolePresent) { + ps = con.prepareStatement(SQL_LIST_DOMAIN_ROLE_NAME_MEMBER); + ps.setString(1, roleMember); + ps.setString(2, roleName); + } else if (memberPresent) { + ps = con.prepareStatement(SQL_LIST_DOMAIN_ROLE_MEMBER); + ps.setString(1, roleMember); + } else if (rolePresent) { + ps = con.prepareStatement(SQL_LIST_DOMAIN_ROLE_NAME); + ps.setString(1, roleName); + } else { + ps = con.prepareStatement(SQL_LIST_DOMAIN); + } + return ps; + } + + @Override + public List lookupDomainByRole(String roleMember, String roleName) { + + final String caller = "lookupDomainByRole"; + + // it's possible that we'll get duplicate domain names returned + // from this result - e.g. when no role name is filtered on so + // we're going to automatically skip those by using a set + + Set uniqueDomains = new HashSet<>(); + try (PreparedStatement ps = prepareScanByRoleStatement(con, roleMember, roleName)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + uniqueDomains.add(rs.getString(ZMSConsts.DB_COLUMN_NAME)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + List domains = new ArrayList<>(uniqueDomains); + Collections.sort(domains); + return domains; + } + + @Override + public String lookupDomainById(String account, int productId) { + + final String caller = "lookupDomain"; + + String sqlCmd = null; + if (account != null) { + sqlCmd = SQL_GET_DOMAIN_WITH_ACCOUNT; + } else { + sqlCmd = SQL_GET_DOMAIN_WITH_PRODUCT_ID; + } + + String domainName = null; + try (PreparedStatement ps = con.prepareStatement(sqlCmd)) { + + if (account != null) { + ps.setString(1, account.trim()); + } else { + ps.setInt(1, productId); + } + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + domainName = rs.getString(1); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + return domainName; + } + + @Override + public List listDomains(String prefix, long modifiedSince) { + + final String caller = "listDomains"; + + List domains = new ArrayList<>(); + try (PreparedStatement ps = prepareScanStatement(con, prefix, modifiedSince)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + domains.add(rs.getString(ZMSConsts.DB_COLUMN_NAME)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + Collections.sort(domains); + return domains; + } + + @Override + public boolean insertDomainTemplate(String domainName, String templateName, String params) { + + final String caller = "insertDomainTemplate"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_DOMAIN_TEMPLATE)) { + ps.setInt(1, domainId); + ps.setString(2, templateName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean deleteDomainTemplate(String domainName, String templateName, String params) { + + final String caller = "deleteDomainTemplate"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_DOMAIN_TEMPLATE)) { + ps.setInt(1, domainId); + ps.setString(2, templateName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public List listDomainTemplates(String domainName) { + + final String caller = "listDomainTemplates"; + + List templates = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_DOMAIN_TEMPLATE)) { + ps.setString(1, domainName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + templates.add(rs.getString(1)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + Collections.sort(templates); + return templates; + } + + int getDomainId(Connection con, String domainName) { + + final String caller = "getDomainId"; + + // first check to see if our cache contains this value + // otherwise we'll contact the MySQL Server + + StringBuilder cacheKeyBldr = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + cacheKeyBldr.append(CACHE_DOMAIN).append(domainName); + String cacheKey = cacheKeyBldr.toString(); + + Integer value = objectMap.get(cacheKey); + if (value != null) { + return value; + } + + int domainId = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_ID)) { + ps.setString(1, domainName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + domainId = rs.getInt(1); + } + } + } catch (SQLException ex) { + LOG.error("unable to get domain id for name: " + domainName + + " error code: " + ex.getErrorCode() + " msg: " + ex.getMessage()); + } + + // before returning the value update our cache + + if (domainId != 0) { + objectMap.put(cacheKey, domainId); + } + + return domainId; + } + + int getPolicyId(Connection con, int domainId, String policyName) { + + final String caller = "getPolicyId"; + + // first check to see if our cache contains this value + // otherwise we'll contact the MySQL Server + + StringBuilder cacheKeyBldr = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + cacheKeyBldr.append(CACHE_POLICY).append(domainId).append('.').append(policyName); + String cacheKey = cacheKeyBldr.toString(); + + Integer value = objectMap.get(cacheKey); + if (value != null) { + return value; + } + + int policyId = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_POLICY_ID)) { + ps.setInt(1, domainId); + ps.setString(2, policyName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + policyId = rs.getInt(1); + } + } + } catch (SQLException ex) { + LOG.error("unable to get polcy id for name: " + policyName + + " error code: " + ex.getErrorCode() + " msg: " + ex.getMessage()); + } + + // before returning the value update our cache + + if (policyId != 0) { + objectMap.put(cacheKey, policyId); + } + + return policyId; + } + + int getRoleId(Connection con, int domainId, String roleName) { + + final String caller = "getRoleId"; + + // first check to see if our cache contains this value + // otherwise we'll contact the MySQL Server + + StringBuilder cacheKeyBldr = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + cacheKeyBldr.append(CACHE_ROLE).append(domainId).append('.').append(roleName); + String cacheKey = cacheKeyBldr.toString(); + + Integer value = objectMap.get(cacheKey); + if (value != null) { + return value; + } + + int roleId = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_ROLE_ID)) { + ps.setInt(1, domainId); + ps.setString(2, roleName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + roleId = rs.getInt(1); + } + } + } catch (SQLException ex) { + LOG.error("unable to get role id for name: " + roleName + + " error code: " + ex.getErrorCode() + " msg: " + ex.getMessage()); + } + + // before returning the value update our cache + + if (roleId != 0) { + objectMap.put(cacheKey, roleId); + } + + return roleId; + } + + int getServiceId(Connection con, int domainId, String serviceName) { + + final String caller = "getServiceId"; + + // first check to see if our cache contains this value + // otherwise we'll contact the MySQL Server + + StringBuilder cacheKeyBldr = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + cacheKeyBldr.append(CACHE_SERVICE).append(domainId).append('.').append(serviceName); + String cacheKey = cacheKeyBldr.toString(); + + Integer value = objectMap.get(cacheKey); + if (value != null) { + return value; + } + + int serviceId = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_SERVICE_ID)) { + ps.setInt(1, domainId); + ps.setString(2, serviceName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + serviceId = rs.getInt(1); + } + } + } catch (SQLException ex) { + LOG.error("unable to get service id for name: " + serviceName + + " error code: " + ex.getErrorCode() + " msg: " + ex.getMessage()); + } + + // before returning the value update our cache + + if (serviceId != 0) { + objectMap.put(cacheKey, serviceId); + } + + return serviceId; + } + + int getPrincipalId(Connection con, String principal) { + + final String caller = "getPrincipalId"; + + // first check to see if our cache contains this value + // otherwise we'll contact the MySQL Server + + StringBuilder cacheKeyBldr = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + cacheKeyBldr.append(CACHE_PRINCIPAL).append(principal); + String cacheKey = cacheKeyBldr.toString(); + + Integer value = objectMap.get(cacheKey); + if (value != null) { + return value; + } + + int principalId = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_PRINCIPAL_ID)) { + ps.setString(1, principal); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + principalId = rs.getInt(1); + } + } + } catch (SQLException ex) { + LOG.error("unable to get principal id for name: " + principal + + " error code: " + ex.getErrorCode() + + " msg: " + ex.getMessage()); + } + + // before returning the value update our cache + + if (principalId != 0) { + objectMap.put(cacheKey, principalId); + } + + return principalId; + } + + int getHostId(Connection con, String hostName) { + + final String caller = "getHostId"; + + // first check to see if our cache contains this value + // otherwise we'll contact the MySQL Server + + StringBuilder cacheKeyBldr = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT); + cacheKeyBldr.append(CACHE_HOST).append(hostName); + String cacheKey = cacheKeyBldr.toString(); + + Integer value = objectMap.get(cacheKey); + if (value != null) { + return value; + } + + int hostId = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_HOST_ID)) { + ps.setString(1, hostName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + hostId = rs.getInt(1); + } + } + } catch (SQLException ex) { + LOG.error("unable to get host id for name: " + hostName + + " error code: " + ex.getErrorCode() + " msg: " + ex.getMessage()); + } + + // before returning the value update our cache + + if (hostId != 0) { + objectMap.put(cacheKey, hostId); + } + + return hostId; + } + + int getLastInsertId(Connection con) { + + int lastInsertId = 0; + final String caller = "getLastInsertId"; + + try (PreparedStatement ps = con.prepareStatement(SQL_LAST_INSERT_ID)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + lastInsertId = rs.getInt(1); + } + } + } catch (SQLException ex) { + LOG.error("unable to get last insert id - error code: " + ex.getErrorCode() + + " msg: " + ex.getMessage()); + } + return lastInsertId; + } + + @Override + public Role getRole(String domainName, String roleName) { + + final String caller = "getRole"; + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_ROLE)) { + ps.setString(1, domainName); + ps.setString(2, roleName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + Role role = new Role().setName(ZMSUtils.roleResourceName(domainName, roleName)) + .setModified(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime())) + .setTrust(saveValue(rs.getString(ZMSConsts.DB_COLUMN_TRUST))); + return role; + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return null; + } + + String extractObjectName(String domainName, String fullName, String objType) { + + // generate prefix to compare with + + StringBuilder prefixBuffer = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT) + .append(domainName).append(objType); + String prefix = prefixBuffer.toString(); + if (!fullName.startsWith(prefix)) { + return null; + } + return fullName.substring(prefix.length()); + } + + String extractRoleName(String domainName, String fullRoleName) { + return extractObjectName(domainName, fullRoleName, ":role."); + } + + String extractPolicyName(String domainName, String fullPolicyName) { + return extractObjectName(domainName, fullPolicyName, ":policy."); + } + + String extractServiceName(String domainName, String fullServiceName) { + return extractObjectName(domainName, fullServiceName, "."); + } + + @Override + public boolean insertRole(String domainName, Role role) { + + int affectedRows = 0; + final String caller = "insertRole"; + + String roleName = extractRoleName(domainName, role.getName()); + if (roleName == null) { + throw requestError(caller, "domain name mismatch: " + domainName + + " insert role name: " + role.getName()); + } + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_ROLE)) { + ps.setString(1, roleName); + ps.setInt(2, domainId); + ps.setString(3, processInsertValue(role.getTrust())); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean updateRole(String domainName, Role role) { + + int affectedRows = 0; + final String caller = "updateRole"; + + String roleName = extractRoleName(domainName, role.getName()); + if (roleName == null) { + throw requestError(caller, "domain name mismatch: " + domainName + + " update role name: " + role.getName()); + } + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int roleId = getRoleId(con, domainId, roleName); + if (roleId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_ROLE, ZMSUtils.roleResourceName(domainName, roleName)); + } + + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_ROLE)) { + ps.setString(1, processInsertValue(role.getTrust())); + ps.setInt(2, roleId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + return (affectedRows > 0); + } + + @Override + public boolean updateRoleModTimestamp(String domainName, String roleName) { + + int affectedRows = 0; + final String caller = "updateRoleModTimestamp"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int roleId = getRoleId(con, domainId, roleName); + if (roleId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_ROLE, ZMSUtils.roleResourceName(domainName, roleName)); + } + + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_ROLE_MOD_TIMESTAMP)) { + ps.setInt(1, roleId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean deleteRole(String domainName, String roleName) { + + final String caller = "deleteRole"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_ROLE)) { + ps.setInt(1, domainId); + ps.setString(2, roleName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public List listRoles(String domainName) { + + final String caller = "listRoles"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + List roles = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_ROLE)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + roles.add(rs.getString(1)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + Collections.sort(roles); + return roles; + } + + @Override + public List listRoleMembers(String domainName, String roleName) { + + final String caller = "listRoleMembers"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int roleId = getRoleId(con, domainId, roleName); + if (roleId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_ROLE, ZMSUtils.roleResourceName(domainName, roleName)); + } + List members = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_ROLE_MEMBERS)) { + ps.setInt(1, roleId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + members.add(rs.getString(1)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + Collections.sort(members); + return members; + } + + @Override + public List listRoleAuditLogs(String domainName, String roleName) { + + final String caller = "listRoleAuditLogs"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int roleId = getRoleId(con, domainId, roleName); + if (roleId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_ROLE, ZMSUtils.roleResourceName(domainName, roleName)); + } + List logs = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_ROLE_AUDIT_LOGS)) { + ps.setInt(1, roleId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + RoleAuditLog log = new RoleAuditLog(); + log.setAction(rs.getString(ZMSConsts.DB_COLUMN_ACTION)); + log.setMember(rs.getString(ZMSConsts.DB_COLUMN_MEMBER)); + log.setAdmin(rs.getString(ZMSConsts.DB_COLUMN_ADMIN)); + log.setAuditRef(saveValue(rs.getString(ZMSConsts.DB_COLUMN_AUDIT_REF))); + log.setCreated(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_CREATED).getTime())); + logs.add(log); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return logs; + } + + boolean parsePrincipal(String principal, StringBuilder domain, StringBuilder name) { + int idx = principal.lastIndexOf('.'); + if (idx == -1 || idx == 0 || idx == principal.length() - 1) { + return false; + } + domain.append(principal.substring(0, idx)); + name.append(principal.substring(idx + 1)); + return true; + } + + @Override + public Membership getRoleMember(String domainName, String roleName, String member) { + + final String caller = "getRoleMember"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int roleId = getRoleId(con, domainId, roleName); + if (roleId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_ROLE, ZMSUtils.roleResourceName(domainName, roleName)); + } + + Membership membership = new Membership() + .setMemberName(member) + .setRoleName(ZMSUtils.roleResourceName(domainName, roleName)) + .setIsMember(false); + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_ROLE_MEMBER)) { + ps.setInt(1, roleId); + ps.setString(2, member); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + membership.setIsMember(true); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return membership; + } + + int insertPrincipal(Connection con, String principal) { + + int affectedRows = 0; + final String caller = "insertPrincipal"; + + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_PRINCIPAL)) { + ps.setString(1, principal); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + int principalId = 0; + if (affectedRows == 1) { + principalId = getLastInsertId(con); + } + return principalId; + } + + int insertHost(Connection con, String hostName) { + + int affectedRows = 0; + final String caller = "insertHost"; + + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_HOST)) { + ps.setString(1, hostName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + int hostId = 0; + if (affectedRows == 1) { + hostId = getLastInsertId(con); + } + return hostId; + } + + @Override + public boolean insertRoleMember(String domainName, String roleName, String principal, + String admin, String auditRef) { + + final String caller = "insertRoleMember"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int roleId = getRoleId(con, domainId, roleName); + if (roleId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_ROLE, ZMSUtils.roleResourceName(domainName, roleName)); + } + if (!validatePrincipalDomain(principal)) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, principal); + } + int principalId = getPrincipalId(con, principal); + if (principalId == 0) { + principalId = insertPrincipal(con, principal); + if (principalId == 0) { + throw internalServerError(caller, "Unable to insert principal: " + principal); + } + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_ROLE_MEMBER)) { + ps.setInt(1, roleId); + ps.setInt(2, principalId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + boolean result = (affectedRows > 0); + + // add audit log entry for this change if the add was successful + // add return the result of the audit log insert operation + + if (result) { + result = insertRoleAuditLog(con, roleId, admin, principal, "ADD", auditRef); + } + + return result; + } + + @Override + public boolean deleteRoleMember(String domainName, String roleName, String principal, + String admin, String auditRef) { + + final String caller = "deleteRoleMember"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int roleId = getRoleId(con, domainId, roleName); + if (roleId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_ROLE, ZMSUtils.roleResourceName(domainName, roleName)); + } + int principalId = getPrincipalId(con, principal); + if (principalId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_PRINCIPAL, principal); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_ROLE_MEMBER)) { + ps.setInt(1, roleId); + ps.setInt(2, principalId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + boolean result = (affectedRows > 0); + + // add audit log entry for this change if the delete was successful + // add return the result of the audit log insert operation + + if (result) { + result = insertRoleAuditLog(con, roleId, admin, principal, "DELETE", auditRef); + } + + return result; + } + + boolean insertRoleAuditLog(Connection con, int roleId, String admin, String member, + String action, String auditRef) { + + int affectedRows = 0; + final String caller = "insertRoleAuditEntry"; + + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_ROLE_AUDIT_LOG)) { + ps.setInt(1, roleId); + ps.setString(2, processInsertValue(admin)); + ps.setString(3, member); + ps.setString(4, action); + ps.setString(5, processInsertValue(auditRef)); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public Assertion getAssertion(String domainName, String policyName, Long assertionId) { + + final String caller = "getAssertion"; + + Assertion assertion = null; + try (PreparedStatement ps = con.prepareStatement(SQL_GET_ASSERTION)) { + ps.setInt(1, assertionId.intValue()); + ps.setString(2, domainName); + ps.setString(3, policyName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + assertion = new Assertion(); + assertion.setRole(ZMSUtils.roleResourceName(domainName, rs.getString(ZMSConsts.DB_COLUMN_ROLE))); + assertion.setResource(rs.getString(ZMSConsts.DB_COLUMN_RESOURCE)); + assertion.setAction(rs.getString(ZMSConsts.DB_COLUMN_ACTION)); + assertion.setEffect(AssertionEffect.valueOf(rs.getString(ZMSConsts.DB_COLUMN_EFFECT))); + assertion.setId((long) rs.getInt(ZMSConsts.DB_COLUMN_ASSERT_ID)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return assertion; + } + + @Override + public Policy getPolicy(String domainName, String policyName) { + + final String caller = "getPolicy"; + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_POLICY)) { + ps.setString(1, domainName); + ps.setString(2, policyName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + Policy policy = new Policy().setName(ZMSUtils.policyResourceName(domainName, policyName)) + .setModified(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime())); + return policy; + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return null; + } + + @Override + public boolean insertPolicy(String domainName, Policy policy) { + + int affectedRows = 0; + final String caller = "insertPolicy"; + + String policyName = extractPolicyName(domainName, policy.getName()); + if (policyName == null) { + throw requestError(caller, "domain name mismatch: " + domainName + + " insert policy name: " + policy.getName()); + } + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_POLICY)) { + ps.setString(1, policyName); + ps.setInt(2, domainId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean updatePolicy(String domainName, Policy policy) { + + int affectedRows = 0; + final String caller = "updatePolicy"; + + String policyName = extractPolicyName(domainName, policy.getName()); + if (policyName == null) { + throw requestError(caller, "domain name mismatch: " + domainName + + " update policy name: " + policy.getName()); + } + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int policyId = getPolicyId(con, domainId, policyName); + if (policyId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_POLICY, ZMSUtils.policyResourceName(domainName, policyName)); + } + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_POLICY)) { + ps.setString(1, policyName); + ps.setInt(2, policyId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean updatePolicyModTimestamp(String domainName, String policyName) { + + int affectedRows = 0; + final String caller = "updatePolicyModTimestamp"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int policyId = getPolicyId(con, domainId, policyName); + if (policyId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_POLICY, ZMSUtils.policyResourceName(domainName, policyName)); + } + + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_POLICY_MOD_TIMESTAMP)) { + ps.setInt(1, policyId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean deletePolicy(String domainName, String policyName) { + + final String caller = "deletePolicy"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_POLICY)) { + ps.setInt(1, domainId); + ps.setString(2, policyName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public List listPolicies(String domainName, String assertionRoleName) { + + final String caller = "listPolicies"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + List policies = new ArrayList<>(); + String sqlStatement = null; + if (assertionRoleName == null) { + sqlStatement = SQL_LIST_POLICY; + } else { + sqlStatement = SQL_LIST_POLICY_REFERENCING_ROLE; + } + try (PreparedStatement ps = con.prepareStatement(sqlStatement)) { + ps.setInt(1, domainId); + if (assertionRoleName != null) { + ps.setString(2, assertionRoleName); + } + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + policies.add(rs.getString(1)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + Collections.sort(policies); + return policies; + } + + @Override + public boolean insertAssertion(String domainName, String policyName, Assertion assertion) { + + final String caller = "insertAssertion"; + + String roleName = extractRoleName(domainName, assertion.getRole()); + if (roleName == null) { + throw requestError(caller, "domain name mismatch: " + domainName + + " assertion role name: " + assertion.getRole()); + } + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int policyId = getPolicyId(con, domainId, policyName); + if (policyId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_POLICY, ZMSUtils.policyResourceName(domainName, policyName)); + } + + // special handling for assertions since we don't want to have duplicates + // and we don't want to setup a unique key across all values in the row + + try (PreparedStatement ps = con.prepareStatement(SQL_CHECK_ASSERTION)) { + ps.setInt(1, policyId); + ps.setString(2, roleName); + ps.setString(3, assertion.getResource()); + ps.setString(4, assertion.getAction()); + ps.setString(5, processInsertValue(assertion.getEffect())); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + return true; + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + // at this point we know we don't have another assertion with the same + // values so we'll go ahead and add one + + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_ASSERTION)) { + ps.setInt(1, policyId); + ps.setString(2, roleName); + ps.setString(3, assertion.getResource()); + ps.setString(4, assertion.getAction()); + ps.setString(5, processInsertValue(assertion.getEffect())); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + boolean result = (affectedRows > 0); + + if (result) { + assertion.setId((long) getLastInsertId(con)); + } + return result; + } + + @Override + public boolean deleteAssertion(String domainName, String policyName, Long assertionId) { + + final String caller = "deleteAssertion"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int policyId = getPolicyId(con, domainId, policyName); + if (policyId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_POLICY, ZMSUtils.policyResourceName(domainName, policyName)); + } + + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_ASSERTION)) { + ps.setInt(1, policyId); + ps.setInt(2, assertionId.intValue()); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public List listAssertions(String domainName, String policyName) { + + final String caller = "listAssertions"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int policyId = getPolicyId(con, domainId, policyName); + if (policyId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_POLICY, ZMSUtils.policyResourceName(domainName, policyName)); + } + List assertions = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_ASSERTION)) { + ps.setInt(1, policyId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + Assertion assertion = new Assertion(); + assertion.setRole(ZMSUtils.roleResourceName(domainName, rs.getString(ZMSConsts.DB_COLUMN_ROLE))); + assertion.setResource(rs.getString(ZMSConsts.DB_COLUMN_RESOURCE)); + assertion.setAction(rs.getString(ZMSConsts.DB_COLUMN_ACTION)); + assertion.setEffect(AssertionEffect.valueOf(rs.getString(ZMSConsts.DB_COLUMN_EFFECT))); + assertion.setId((long) rs.getInt(ZMSConsts.DB_COLUMN_ASSERT_ID)); + assertions.add(assertion); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return assertions; + } + + String saveValue(String value) { + return (value.isEmpty()) ? null : value; + } + + UUID saveUuidValue(String value) { + return (value.isEmpty()) ? null : UUID.fromString(value); + } + + @Override + public ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + + final String caller = "getServiceIdentity"; + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_SERVICE)) { + ps.setString(1, domainName); + ps.setString(2, serviceName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + ServiceIdentity serviceIdentity = new ServiceIdentity() + .setName(ZMSUtils.serviceResourceName(domainName, serviceName)) + .setModified(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime())) + .setProviderEndpoint(saveValue(rs.getString(ZMSConsts.DB_COLUMN_PROVIDER_ENDPOINT))) + .setExecutable(saveValue(rs.getString(ZMSConsts.DB_COLUMN_EXECTUABLE))) + .setUser(saveValue(rs.getString(ZMSConsts.DB_COLUMN_SVC_USER))) + .setGroup(saveValue(rs.getString(ZMSConsts.DB_COLUMN_SVC_GROUP))); + + return serviceIdentity; + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return null; + } + + int processInsertValue(Integer value) { + return (value == null) ? 0 : value.intValue(); + } + + String processInsertValue(String value) { + return (value == null) ? "" : value.trim(); + } + + boolean processInsertValue(Boolean value, boolean defaultValue) { + return (value == null) ? defaultValue : value; + } + + String processInsertValue(AssertionEffect value) { + return (value == null) ? ZMSConsts.ASSERTION_EFFECT_ALLOW : value.toString(); + } + + String processInsertUuidValue(UUID value) { + return (value == null) ? "" : value.toString(); + } + + @Override + public boolean insertServiceIdentity(String domainName, ServiceIdentity service) { + + int affectedRows = 0; + final String caller = "insertServiceIdentity"; + + String serviceName = extractServiceName(domainName, service.getName()); + if (serviceName == null) { + throw requestError(caller, "domain name mismatch: " + domainName + + " insert service name: " + service.getName()); + } + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_SERVICE)) { + ps.setString(1, serviceName); + ps.setString(2, processInsertValue(service.getProviderEndpoint())); + ps.setString(3, processInsertValue(service.getExecutable())); + ps.setString(4, processInsertValue(service.getUser())); + ps.setString(5, processInsertValue(service.getGroup())); + ps.setInt(6, domainId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean updateServiceIdentity(String domainName, ServiceIdentity service) { + + int affectedRows = 0; + final String caller = "updateServiceIdentity"; + + String serviceName = extractServiceName(domainName, service.getName()); + if (serviceName == null) { + throw requestError(caller, "domain name mismatch: " + domainName + + " update service name: " + service.getName()); + } + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_SERVICE)) { + ps.setString(1, processInsertValue(service.getProviderEndpoint())); + ps.setString(2, processInsertValue(service.getExecutable())); + ps.setString(3, processInsertValue(service.getUser())); + ps.setString(4, processInsertValue(service.getGroup())); + ps.setInt(5, serviceId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean deleteServiceIdentity(String domainName, String serviceName) { + + final String caller = "deleteServiceIdentity"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_SERVICE)) { + ps.setInt(1, domainId); + ps.setString(2, serviceName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public List listServiceIdentities(String domainName) { + + final String caller = "listServiceIdentities"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + List services = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_SERVICE)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + services.add(rs.getString(1)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + Collections.sort(services); + return services; + } + + @Override + public List listPublicKeys(String domainName, String serviceName) { + + final String caller = "listPublicKeys"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + List publicKeys = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_PUBLIC_KEY)) { + ps.setInt(1, serviceId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + PublicKeyEntry publicKey = new PublicKeyEntry() + .setId(rs.getString(ZMSConsts.DB_COLUMN_KEY_ID)) + .setKey(rs.getString(ZMSConsts.DB_COLUMN_KEY_VALUE)); + publicKeys.add(publicKey); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return publicKeys; + } + + @Override + public PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, String keyId) { + + final String caller = "getPublicKeyEntry"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + try (PreparedStatement ps = con.prepareStatement(SQL_GET_PUBLIC_KEY)) { + ps.setInt(1, serviceId); + ps.setString(2, keyId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + PublicKeyEntry publicKey = new PublicKeyEntry().setId(keyId) + .setKey(rs.getString(ZMSConsts.DB_COLUMN_KEY_VALUE)); + return publicKey; + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return null; + } + + @Override + public boolean insertPublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey) { + + final String caller = "insertPublicKeyEntry"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_PUBLIC_KEY)) { + ps.setInt(1, serviceId); + ps.setString(2, publicKey.getId()); + ps.setString(3, publicKey.getKey()); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean updatePublicKeyEntry(String domainName, String serviceName, PublicKeyEntry publicKey) { + + final String caller = "updatePublicKeyEntry"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_PUBLIC_KEY)) { + ps.setString(1, publicKey.getKey()); + ps.setInt(2, serviceId); + ps.setString(3, publicKey.getId()); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean deletePublicKeyEntry(String domainName, String serviceName, String keyId) { + + final String caller = "deletePublicKeyEntry"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_PUBLIC_KEY)) { + ps.setInt(1, serviceId); + ps.setString(2, keyId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public List listServiceHosts(String domainName, String serviceName) { + + final String caller = "listServiceHosts"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + List hosts = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_SERVICE_HOST)) { + ps.setInt(1, serviceId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + hosts.add(rs.getString(ZMSConsts.DB_COLUMN_NAME)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return hosts; + } + + @Override + public boolean insertServiceHost(String domainName, String serviceName, String hostName) { + + final String caller = "insertServiceHost"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + int hostId = getHostId(con, hostName); + if (hostId == 0) { + hostId = insertHost(con, hostName); + if (hostId == 0) { + throw internalServerError(caller, "Unable to insert host: " + hostName); + } + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_SERVICE_HOST)) { + ps.setInt(1, serviceId); + ps.setInt(2, hostId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean deleteServiceHost(String domainName, String serviceName, String hostName) { + + final String caller = "deleteServiceHost"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int serviceId = getServiceId(con, domainId, serviceName); + if (serviceId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_SERVICE, ZMSUtils.serviceResourceName(domainName, serviceName)); + } + int hostId = getHostId(con, hostName); + if (hostId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_HOST, hostName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_SERVICE_HOST)) { + ps.setInt(1, serviceId); + ps.setInt(2, hostId); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean insertEntity(String domainName, Entity entity) { + + final String caller = "insertEntity"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_INSERT_ENTITY)) { + ps.setInt(1, domainId); + ps.setString(2, entity.getName()); + ps.setString(3, JSON.string(entity.getValue())); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean updateEntity(String domainName, Entity entity) { + + final String caller = "updateEntity"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_UPDATE_ENTITY)) { + ps.setString(1, JSON.string(entity.getValue())); + ps.setInt(2, domainId); + ps.setString(3, entity.getName()); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public boolean deleteEntity(String domainName, String entityName) { + + final String caller = "deleteEntity"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + int affectedRows = 0; + try (PreparedStatement ps = con.prepareStatement(SQL_DELETE_ENTITY)) { + ps.setInt(1, domainId); + ps.setString(2, entityName); + affectedRows = ps.executeUpdate(); + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return (affectedRows > 0); + } + + @Override + public Entity getEntity(String domainName, String entityName) { + + final String caller = "getEntity"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + try (PreparedStatement ps = con.prepareStatement(SQL_GET_ENTITY)) { + ps.setInt(1, domainId); + ps.setString(2, entityName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + Entity entity = new Entity().setName(entityName) + .setValue(JSON.fromString(rs.getString(ZMSConsts.DB_COLUMN_VALUE), Struct.class)); + return entity; + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + return null; + } + + @Override + public List listEntities(String domainName) { + + final String caller = "listEntities"; + + int domainId = getDomainId(con, domainName); + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + List entities = new ArrayList<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_ENTITY)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + entities.add(rs.getString(1)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + Collections.sort(entities); + return entities; + } + + void getAthenzDomainRoles(String domainName, int domainId, AthenzDomain athenzDomain, String caller) { + + Map roleMap = new HashMap<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_ROLES)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String roleName = rs.getString(ZMSConsts.DB_COLUMN_NAME); + Role role = new Role().setName(ZMSUtils.roleResourceName(domainName, roleName)) + .setModified(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime())) + .setTrust(saveValue(rs.getString(ZMSConsts.DB_COLUMN_TRUST))); + roleMap.put(roleName, role); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_ROLE_MEMBERS)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String roleName = rs.getString(1); + Role role = roleMap.get(roleName); + if (role == null) { + continue; + } + List members = role.getMembers(); + if (members == null) { + members = new ArrayList<>(); + role.setMembers(members); + } + members.add(rs.getString(2)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + athenzDomain.getRoles().addAll(roleMap.values()); + } + + void getAthenzDomainPolicies(String domainName, int domainId, AthenzDomain athenzDomain, String caller) { + + Map policyMap = new HashMap<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_POLICIES)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String policyName = rs.getString(ZMSConsts.DB_COLUMN_NAME); + Policy policy = new Policy().setName(ZMSUtils.policyResourceName(domainName, policyName)) + .setModified(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime())); + policyMap.put(policyName, policy); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_POLICY_ASSERTIONS)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String policyName = rs.getString(1); + Policy policy = policyMap.get(policyName); + if (policy == null) { + continue; + } + List assertions = policy.getAssertions(); + if (assertions == null) { + assertions = new ArrayList<>(); + policy.setAssertions(assertions); + } + Assertion assertion = new Assertion(); + assertion.setRole(ZMSUtils.roleResourceName(domainName, rs.getString(ZMSConsts.DB_COLUMN_ROLE))); + assertion.setResource(rs.getString(ZMSConsts.DB_COLUMN_RESOURCE)); + assertion.setAction(rs.getString(ZMSConsts.DB_COLUMN_ACTION)); + assertion.setEffect(AssertionEffect.valueOf(rs.getString(ZMSConsts.DB_COLUMN_EFFECT))); + assertion.setId((long) rs.getInt(ZMSConsts.DB_COLUMN_ASSERT_ID)); + assertions.add(assertion); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + athenzDomain.getPolicies().addAll(policyMap.values()); + } + + void getAthenzDomainServices(String domainName, int domainId, AthenzDomain athenzDomain, String caller) { + + Map serviceMap = new HashMap<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_SERVICES)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String serviceName = rs.getString(ZMSConsts.DB_COLUMN_NAME); + ServiceIdentity service = new ServiceIdentity() + .setName(ZMSUtils.serviceResourceName(domainName, serviceName)) + .setProviderEndpoint(saveValue(rs.getString(ZMSConsts.DB_COLUMN_PROVIDER_ENDPOINT))) + .setExecutable(saveValue(rs.getString(ZMSConsts.DB_COLUMN_EXECTUABLE))) + .setUser(saveValue(rs.getString(ZMSConsts.DB_COLUMN_SVC_USER))) + .setGroup(saveValue(rs.getString(ZMSConsts.DB_COLUMN_SVC_GROUP))) + .setModified(Timestamp.fromMillis(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime())); + List publicKeys = new ArrayList<>(); + service.setPublicKeys(publicKeys); + serviceMap.put(serviceName, service); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_SERVICES_HOSTS)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String serviceName = rs.getString(1); + ServiceIdentity service = serviceMap.get(serviceName); + if (service == null) { + continue; + } + List hosts = service.getHosts(); + if (hosts == null) { + hosts = new ArrayList<>(); + service.setHosts(hosts); + } + hosts.add(rs.getString(2)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN_SERVICES_PUBLIC_KEYS)) { + ps.setInt(1, domainId); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String serviceName = rs.getString(1); + ServiceIdentity service = serviceMap.get(serviceName); + if (service == null) { + continue; + } + PublicKeyEntry publicKey = new PublicKeyEntry() + .setId(rs.getString(ZMSConsts.DB_COLUMN_KEY_ID)) + .setKey(rs.getString(ZMSConsts.DB_COLUMN_KEY_VALUE)); + service.getPublicKeys().add(publicKey); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + athenzDomain.getServices().addAll(serviceMap.values()); + } + + @Override + public AthenzDomain getAthenzDomain(String domainName) { + + final String caller = "getAthenzDomain"; + + int domainId = 0; + AthenzDomain athenzDomain = new AthenzDomain(domainName); + + try (PreparedStatement ps = con.prepareStatement(SQL_GET_DOMAIN)) { + ps.setString(1, domainName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + if (rs.next()) { + Domain domain = saveDomainSettings(domainName, rs, caller); + athenzDomain.setDomain(domain); + domainId = rs.getInt(ZMSConsts.DB_COLUMN_DOMAIN_ID); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + if (domainId == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_DOMAIN, domainName); + } + + getAthenzDomainRoles(domainName, domainId, athenzDomain, caller); + getAthenzDomainPolicies(domainName, domainId, athenzDomain, caller); + getAthenzDomainServices(domainName, domainId, athenzDomain, caller); + + return athenzDomain; + } + + @Override + public DomainModifiedList listModifiedDomains(long modifiedSince) { + + final String caller = "listModifiedDomains"; + + DomainModifiedList domainModifiedList = new DomainModifiedList(); + List nameMods = new ArrayList(); + + try (PreparedStatement ps = prepareScanStatement(con, null, modifiedSince)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + DomainModified dm = new DomainModified() + .setName(rs.getString(ZMSConsts.DB_COLUMN_NAME)) + .setModified(rs.getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED).getTime()); + nameMods.add(dm); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + domainModifiedList.setNameModList(nameMods); + return domainModifiedList; + } + + boolean validatePrincipalDomain(String principal) { + int idx = principal.lastIndexOf('.'); + if (idx == -1 || idx == 0 || idx == principal.length() - 1) { + return false; + } + if (getDomainId(con, principal.substring(0, idx)) == 0) { + return false; + } + return true; + } + + String roleIndex(String domainId, String roleName) { + StringBuilder index = new StringBuilder(512); + index.append(domainId).append(':').append(roleName); + return index.toString(); + } + + PreparedStatement prepareRoleAssertionsStatement(Connection con, String action) + throws SQLException { + + PreparedStatement ps = null; + if (action != null && action.length() > 0) { + ps = con.prepareStatement(SQL_LIST_ROLE_ASSERTIONS + SQL_LIST_ROLE_ASSERTION_QUERY_ACTION); + ps.setString(1, action); + } else { + ps = con.prepareStatement(SQL_LIST_ROLE_ASSERTIONS + SQL_LIST_ROLE_ASSERTION_NO_ACTION); + } + return ps; + } + + Map> getRoleAssertions(String action, String caller) { + + Map> roleAssertions = new HashMap<>(); + try (PreparedStatement ps = prepareRoleAssertionsStatement(con, action)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + Assertion assertion = new Assertion(); + String domainName = rs.getString(ZMSConsts.DB_COLUMN_NAME); + String roleName = rs.getString(ZMSConsts.DB_COLUMN_ROLE); + assertion.setRole(ZMSUtils.roleResourceName(domainName, roleName)); + assertion.setResource(rs.getString(ZMSConsts.DB_COLUMN_RESOURCE)); + assertion.setAction(rs.getString(ZMSConsts.DB_COLUMN_ACTION)); + assertion.setEffect(AssertionEffect.valueOf(rs.getString(ZMSConsts.DB_COLUMN_EFFECT))); + assertion.setId((long) rs.getInt(ZMSConsts.DB_COLUMN_ASSERT_ID)); + + String index = roleIndex(rs.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID), roleName); + List assertions = roleAssertions.get(index); + if (assertions == null) { + assertions = new ArrayList<>(); + roleAssertions.put(index, assertions); + } + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": adding assertion " + assertion + " for " + index); + } + + assertions.add(assertion); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + return roleAssertions; + } + + PreparedStatement prepareRolePrincipalsStatement(Connection con, String principal, boolean awsQuery) + throws SQLException { + + PreparedStatement ps = null; + if (principal != null && principal.length() > 0) { + ps = con.prepareStatement(SQL_LIST_ROLE_PRINCIPALS + SQL_LIST_ROLE_PRINCIPALS_QUERY); + ps.setString(1, principal); + } else if (awsQuery) { + ps = con.prepareStatement(SQL_LIST_ROLE_PRINCIPALS + SQL_LIST_ROLE_PRINCIPALS_YBY_ONLY); + } else { + ps = con.prepareStatement(SQL_LIST_ROLE_PRINCIPALS); + } + return ps; + } + + Map> getRolePrincipals(String principal, boolean awsQuery, String caller) { + + Map> rolePrincipals = new HashMap<>(); + try (PreparedStatement ps = prepareRolePrincipalsStatement(con, principal, awsQuery)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String principalName = rs.getString(ZMSConsts.DB_COLUMN_NAME); + String roleName = rs.getString(ZMSConsts.DB_COLUMN_ROLE_NAME); + + String index = roleIndex(rs.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID), roleName); + List principals = rolePrincipals.get(index); + if (principals == null) { + principals = new ArrayList<>(); + rolePrincipals.put(index, principals); + } + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": adding principal " + principalName + " for " + index); + } + + principals.add(principalName); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + return rolePrincipals; + } + + Map> getTrustedRoles(String caller) { + + Map> trustedRoles = new HashMap<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_TRUSTED_ROLES)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + String trustDomainId = rs.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID); + String trustRoleName = rs.getString(ZMSConsts.DB_COLUMN_NAME); + String assertDomainId = rs.getString(ZMSConsts.DB_COLUMN_ASSERT_DOMAIN_ID); + String assertRoleName = rs.getString(ZMSConsts.DB_COLUMN_ROLE); + + String index = roleIndex(assertDomainId, assertRoleName); + List roles = trustedRoles.get(index); + if (roles == null) { + roles = new ArrayList<>(); + trustedRoles.put(index, roles); + } + + String tRoleName = roleIndex(trustDomainId, trustRoleName); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": adding trusted role " + tRoleName + " for " + index); + } + + roles.add(tRoleName); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + return trustedRoles; + } + + Map getAwsDomains(String caller) { + + Map awsDomains = new HashMap<>(); + try (PreparedStatement ps = con.prepareStatement(SQL_LIST_DOMAIN_AWS)) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": " + ps.toString()); + } + + try (ResultSet rs = ps.executeQuery()) { + while (rs.next()) { + awsDomains.put(rs.getString(ZMSConsts.DB_COLUMN_NAME), rs.getString(ZMSConsts.DB_COLUMN_ACCOUNT)); + } + } + } catch (SQLException ex) { + throw sqlError(ex, caller); + } + + return awsDomains; + } + + boolean skipAwsUserQuery(Map awsDomains, String queryPrincipal, + String rolePincipal, String userDomain) { + + // if no aws domains specified then it's not an aws query + + if (awsDomains == null) { + return false; + } + + // check if our query principal is not specified + + if (queryPrincipal != null && !queryPrincipal.isEmpty()) { + return false; + } + + // so now we know this is a global aws role query so we're only + // going to keep yby users - everyone else is skipped + + // make sure the principal starts with yby prefix + + String userDomainPrefix = userDomain + "."; + if (!rolePincipal.startsWith(userDomainPrefix)) { + return true; + } + + // make sure this is not a service within the user's + // personal domain + + if (rolePincipal.substring(userDomainPrefix.length()).indexOf('.') != -1) { + return true; + } + + return false; + } + + void addRoleAssertions(List principalAssertions, List roleAssertions, + Map awsDomains) { + + // if the role assertions is empty then we have nothing to do + + if (roleAssertions == null || roleAssertions.isEmpty()) { + + if (LOG.isDebugEnabled()) { + LOG.debug("addRoleAssertions: role assertion list is empty"); + } + + return; + } + + // if this is not an aws request or the awsDomain list is empty, + // then we're just going to add the role assertions to the + // principal's assertion list as is + + if (awsDomains == null || awsDomains.isEmpty()) { + principalAssertions.addAll(roleAssertions); + return; + } + + // we're going to update each assertion and generate the + // resource in the expected aws role format + + for (Assertion assertion : roleAssertions) { + + String resource = assertion.getResource(); + int idx = resource.indexOf(':'); + if (idx == -1) { + principalAssertions.add(assertion); + continue; + } + + String awsDomain = awsDomains.get(resource.substring(0, idx)); + if (awsDomain == null) { + principalAssertions.add(assertion); + continue; + } + + StringBuilder awsRole = new StringBuilder(512); + awsRole.append("arn:aws:iam::").append(awsDomain).append(":role/").append(resource.substring(idx + 1)); + assertion.setResource(awsRole.toString()); + principalAssertions.add(assertion); + } + } + + ResourceAccess getResourceAccessObject(String principal, List assertions) { + ResourceAccess rsrcAccess = new ResourceAccess(); + rsrcAccess.setPrincipal(principal); + rsrcAccess.setAssertions(assertions != null ? assertions : new ArrayList()); + return rsrcAccess; + } + + @Override + public ResourceAccessList listResourceAccess(String principal, String action, String userDomain) { + + final String caller = "listResourceAccess"; + + ResourceAccessList rsrcAccessList = new ResourceAccessList(); + List resources = new ArrayList<>(); + rsrcAccessList.setResources(resources); + + // check to see if this an aws request based on + // the action query + + boolean awsQuery = (action != null && action.equals(ZMSConsts.ACTION_ASSUME_AWS_ROLE)); + boolean singlePrincipalQuery = (principal != null && !principal.isEmpty()); + + // first let's get the principal list that we're asked to check for + // since if we have no matches then we have nothing to do + + Map> rolePrincipals = getRolePrincipals(principal, awsQuery, caller); + if (rolePrincipals.isEmpty()) { + if (singlePrincipalQuery) { + + // so the given principal is not available as a role member + // so before returning an empty response let's make sure + // that it has been registered in Athenz otherwise we'll + // just return 404 - not found exception + + if (getPrincipalId(con, principal) == 0) { + throw notFoundError(caller, ZMSConsts.OBJECT_PRINCIPAL, principal); + } + + resources.add(getResourceAccessObject(principal, null)); + } + return rsrcAccessList; + } + + // now let's get the list of role assertions. if we have + // no matches, then we have nothing to do + + Map> roleAssertions = getRoleAssertions(action, caller); + if (roleAssertions.isEmpty()) { + if (singlePrincipalQuery) { + resources.add(getResourceAccessObject(principal, null)); + } + return rsrcAccessList; + } + + // finally we need to get all the trusted role maps + + Map> trustedRoles = getTrustedRoles(caller); + + // couple of special cases - if we're asked for action assume_aws_role + // then we're looking for role access in AWS. So we're going to retrieve + // the domains that have aws account configured only and update + // the resource to generate aws role resources. If the action is + // assume_aws_role with no principal - then another special case to + // look for yby users only + + Map awsDomains = null; + if (awsQuery) { + awsDomains = getAwsDomains(caller); + } + + // now let's go ahead and combine all of our data together + // we're going to go through each principal, lookup + // the assertions for the role and add them to the return object + // if the role has no corresponding assertions, then we're going + // to look at the trust role map in case it's a trusted role + + Map> principalAssertions = new HashMap<>(); + for (Map.Entry> entry : rolePrincipals.entrySet()) { + + String roleIndex = entry.getKey(); + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": processing role: " + roleIndex); + } + + // get the list of principals for this role + + List rPrincipals = entry.getValue(); + for (String rPrincipal : rPrincipals) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": processing role principal: " + rPrincipal); + } + + // if running an aws query with no principals specified then make + // sure this is real user and not some service + + if (skipAwsUserQuery(awsDomains, principal, rPrincipal, userDomain)) { + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": skipping non-user: " + rPrincipal); + } + continue; + } + + List assertions = principalAssertions.get(rPrincipal); + if (assertions == null) { + assertions = new ArrayList<>(); + principalAssertions.put(rPrincipal, assertions); + } + + // retrieve the assertions for this role + + addRoleAssertions(assertions, roleAssertions.get(roleIndex), awsDomains); + + // check to see if this is a trusted role. There might be multiple + // roles all being mapped as trusted, so we need to process them all + + List mappedTrustedRoles = trustedRoles.get(roleIndex); + if (mappedTrustedRoles != null) { + for (String mappedTrustedRole : mappedTrustedRoles) { + + if (LOG.isDebugEnabled()) { + LOG.debug(caller + ": processing trusted role: " + mappedTrustedRole); + } + + addRoleAssertions(assertions, roleAssertions.get(mappedTrustedRole), awsDomains); + } + } + } + } + + // finally we need to create resource access list objects and return + + for (Map.Entry> entry : principalAssertions.entrySet()) { + + // if this is a query for all principals in Athenz then we're + // automatically going to skip any principals who have no + // assertions + + List assertions = entry.getValue(); + if (!singlePrincipalQuery && (assertions == null || assertions.isEmpty())) { + continue; + } + + resources.add(getResourceAccessObject(entry.getKey(), assertions)); + } + + return rsrcAccessList; + } + + RuntimeException notFoundError(String caller, String objectType, String objectName) { + rollbackChanges(); + String message = "unknown " + objectType + " - " + objectName; + return ZMSUtils.notFoundError(message, caller); + } + + RuntimeException requestError(String caller, String message) { + rollbackChanges(); + return ZMSUtils.requestError(message, caller); + } + + RuntimeException internalServerError(String caller, String message) { + rollbackChanges(); + return ZMSUtils.internalServerError(message, caller); + } + + RuntimeException sqlError(SQLException ex, String caller) { + + // check to see if this is a conflict error in which case + // we're going to let the server to retry the caller + // The two SQL states that are 'retry-able' are 08S01 + // for a communications error, and 40001 for deadlock. + // also check for the error code where the mysql server is + // in read-mode which could happen if we had a failover + // and the connections are still going to the old master + + String sqlState = ex.getSQLState(); + int code = ResourceException.INTERNAL_SERVER_ERROR; + String msg = null; + if ("08S01".equals(sqlState) || "40001".equals(sqlState)) { + code = ResourceException.CONFLICT; + msg = "Concurrent update conflict, please retry your operation later."; + } else if (ex.getErrorCode() == MYSQL_ER_OPTION_PREVENTS_STATEMENT) { + code = ResourceException.GONE; + msg = "MySQL Database running in read-only mode"; + } else if (ex.getErrorCode() == MYSQL_ER_OPTION_DUPLICATE_ENTRY) { + code = ResourceException.BAD_REQUEST; + msg = "Entry already exists"; + } else { + msg = ex.getMessage() + ", state: " + sqlState + ", code: " + ex.getErrorCode(); + } + rollbackChanges(); + return ZMSUtils.error(code, msg, caller); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/JDBCObjectStore.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/JDBCObjectStore.java new file mode 100644 index 00000000000..6be3517f5cf --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/JDBCObjectStore.java @@ -0,0 +1,47 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import java.sql.SQLException; + +import com.yahoo.athenz.zms.ResourceException; +import com.yahoo.athenz.zms.store.ObjectStore; +import com.yahoo.athenz.zms.store.ObjectStoreConnection; +import com.yahoo.athenz.zms.utils.ZMSUtils; + +public class JDBCObjectStore implements ObjectStore { + + PoolableDataSource src; + + public JDBCObjectStore(PoolableDataSource src) { + this.src = src; + } + + @Override + public ObjectStoreConnection getConnection(boolean autoCommit) { + final String caller = "getConnection"; + try { + return new JDBCConnection(src.getConnection(), autoCommit); + } catch (SQLException ex) { + throw ZMSUtils.error(ResourceException.INTERNAL_SERVER_ERROR, caller, ex.getMessage()); + } + } + + @Override + public void clearConnections() { + src.clearPoolConnections(); + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/PoolableDataSource.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/PoolableDataSource.java new file mode 100644 index 00000000000..82692a56cee --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/PoolableDataSource.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import javax.sql.DataSource; + +public interface PoolableDataSource extends DataSource { + + /** + * Clears all idle connections in the pool + */ + public void clearPoolConnections(); +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/ZMSDataSource.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/ZMSDataSource.java new file mode 100644 index 00000000000..7bba4a0f6c0 --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/store/jdbc/ZMSDataSource.java @@ -0,0 +1,46 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import org.apache.commons.dbcp2.PoolableConnection; +import org.apache.commons.dbcp2.PoolingDataSource; +import org.apache.commons.pool2.ObjectPool; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class ZMSDataSource extends PoolingDataSource implements PoolableDataSource { + + private static final Logger LOG = LoggerFactory.getLogger(ZMSDataSource.class); + + public ZMSDataSource(ObjectPool pool) { + super(pool); + } + + @Override + synchronized public void clearPoolConnections() { + ObjectPool pool = getPool(); + try { + if (LOG.isDebugEnabled()) { + LOG.debug("Clearing all active/idle (" + pool.getNumActive() + "/" + + pool.getNumIdle() + ") connections from the pool"); + } + pool.clear(); + } catch (Exception ex) { + LOG.error("Unable to clear connections from the pool: " + ex.getMessage()); + } + } +} diff --git a/servers/zms/src/main/java/com/yahoo/athenz/zms/utils/ZMSUtils.java b/servers/zms/src/main/java/com/yahoo/athenz/zms/utils/ZMSUtils.java new file mode 100644 index 00000000000..fab9fdd27fc --- /dev/null +++ b/servers/zms/src/main/java/com/yahoo/athenz/zms/utils/ZMSUtils.java @@ -0,0 +1,216 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.utils; + +import java.util.ArrayList; +import java.util.List; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.common.server.util.StringUtils; +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.ResourceError; +import com.yahoo.athenz.zms.ResourceException; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ZMSConsts; +import com.yahoo.athenz.zms.ZMSImpl; + +public class ZMSUtils { + + private static final Logger LOG = LoggerFactory.getLogger(ZMSUtils.class); + + public static void addAssertion(Policy policy, String resource, String action, String role, + AssertionEffect effect) { + + List assertions = policy.getAssertions(); + if (assertions == null) { + assertions = new ArrayList<>(); + policy.setAssertions(assertions); + } + Assertion assertion = new Assertion() + .setAction(action) + .setResource(resource) + .setRole(role); + assertions.add(assertion); + } + + public static Role makeAdminRole(String domainName, List adminUsers) { + + Role role = new Role() + .setName(roleResourceName(domainName, ZMSConsts.ADMIN_ROLE_NAME)) + .setMembers(adminUsers); + return role; + } + + public static Policy makeAdminPolicy(String domainName, Role adminsRole) { + + Policy policy = new Policy() + .setName(policyResourceName(domainName, ZMSConsts.ADMIN_POLICY_NAME)); + + addAssertion(policy, domainName + ":*", "*", adminsRole.getName(), AssertionEffect.ALLOW); + return policy; + } + + static String generateResourceName(String domainName, String resName, String resType) { + StringBuilder name = new StringBuilder(ZMSConsts.STRING_BLDR_SIZE_DEFAULT).append(domainName); + if (!resType.isEmpty()) { + name.append(':'); + name.append(resType); + } + name.append('.'); + name.append(resName); + return name.toString(); + } + + public static String roleResourceName(String domainName, String roleName) { + return generateResourceName(domainName, roleName, ZMSConsts.OBJECT_ROLE); + } + + public static String policyResourceName(String domainName, String policyName) { + return generateResourceName(domainName, policyName, ZMSConsts.OBJECT_POLICY); + } + + public static String serviceResourceName(String domainName, String serviceName) { + return generateResourceName(domainName, serviceName, ""); + } + + public static String entityResourceName(String domainName, String serviceName) { + return generateResourceName(domainName, serviceName, ""); + } + + public static String removeDomainPrefix(String objectName, String domainName, String objectPrefix) { + String valPrefix = domainName + ":" + objectPrefix; + if (objectName.startsWith(valPrefix)) { + objectName = objectName.substring(valPrefix.length()); + } + return objectName; + } + + public static String getTenantResourceGroupRolePrefix(String provSvcName, String tenantDomain, String resourceGroup) { + + StringBuilder rolePrefix = new StringBuilder(256); + rolePrefix.append(provSvcName).append(".tenant.").append(tenantDomain).append("."); + if (resourceGroup != null) { + rolePrefix.append("res_group.").append(resourceGroup).append("."); + } + return rolePrefix.toString(); + } + + public static String getProviderResourceGroupRolePrefix(String provSvcDomain, String provSvcName, String resourceGroup) { + + StringBuilder rolePrefix = new StringBuilder(256); + rolePrefix.append(provSvcDomain).append(".").append(provSvcName).append("."); + if (resourceGroup != null) { + rolePrefix.append("res_group.").append(resourceGroup).append("."); + } + return rolePrefix.toString(); + } + + public static String getTrustedResourceGroupRolePrefix(String provSvcDomain, String provSvcName, + String tenantDomain, String resourceGroup) { + + StringBuilder trustedRole = new StringBuilder(256); + trustedRole.append(provSvcDomain).append(":role.").append(provSvcName) + .append(".tenant.").append(tenantDomain).append("."); + if (resourceGroup != null) { + trustedRole.append("res_group.").append(resourceGroup).append("."); + } + return trustedRole.toString(); + } + + public static boolean assumeRoleResourceMatch(String roleName, Assertion assertion) { + + if (!ZMSConsts.ACTION_ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { + return false; + } + + String rezPattern = StringUtils.patternFromGlob(assertion.getResource()); + if (!roleName.matches(rezPattern)) { + return false; + } + + return true; + } + + public static RuntimeException error(int code, String msg, String caller) { + + if (LOG.isDebugEnabled()) { + LOG.debug(msg); + } + + // If caller is null, we do not want to emit any error metrics. + // Otherwise, the caller name should be from the method that threw + // the specific runtime exception. + + if (caller != null && !emitMonmetricError(code, caller)) { + LOG.error("Unable to emit error metric for caller: " + caller + + " with message: " + msg); + } + return new ResourceException(code, new ResourceError().code(code).message(msg)); + } + + public static RuntimeException requestError(String msg, String caller) { + return error(ResourceException.BAD_REQUEST, msg, caller); + } + + public static RuntimeException redirectError(String msg, String caller) { + return error(ResourceException.FOUND, msg, caller); + } + + public static RuntimeException unauthorizedError(String msg, String caller) { + return error(ResourceException.UNAUTHORIZED, msg, caller); + } + + public static RuntimeException forbiddenError(String msg, String caller) { + return error(ResourceException.FORBIDDEN, msg, caller); + } + + public static RuntimeException notFoundError(String msg, String caller) { + return error(ResourceException.NOT_FOUND, msg, caller); + } + + public static RuntimeException internalServerError(String msg, String caller) { + return error(ResourceException.INTERNAL_SERVER_ERROR, msg, caller); + } + + public static boolean emitMonmetricError(int errorCode, String caller) { + if (errorCode < 1) { + return false; + } + if (caller == null || caller.length() == 0) { + return false; + } + caller = caller.trim(); + String alphanum = "^[a-zA-Z0-9]*$"; + if (!caller.matches(alphanum)) { + return false; + } + + // Set 3 scoreboard error metrics: + // (1) cumulative "ERROR" (of all zms request and error types) + // (2) cumulative granular zms request and error type (eg- "getdomainlist_error_400") + // (3) cumulative error type (of all zms requests) (eg- "error_404") + String errCode = Integer.toString(errorCode); + ZMSImpl.metric.increment("ERROR"); + ZMSImpl.metric.increment(caller.toLowerCase() + "_error_" + errCode); + ZMSImpl.metric.increment("error_" + errCode); + + return true; + } +} diff --git a/servers/zms/src/main/rdl/ZMS.rdl b/servers/zms/src/main/rdl/ZMS.rdl new file mode 100644 index 00000000000..3fe055b080a --- /dev/null +++ b/servers/zms/src/main/rdl/ZMS.rdl @@ -0,0 +1,17 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// +//The Authorization Management Service (ZMS) API +// +name ZMS; +use "rdl"; +version 1; +namespace com.yahoo.athenz.zms; + +include "../../../../../core/zms/src/main/rdl/ZMS.rdl"; + +// Get RDL Schema +resource rdl.Schema GET "/schema" { + expected OK; +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/provider/ProviderMockClient.java b/servers/zms/src/test/java/com/yahoo/athenz/provider/ProviderMockClient.java new file mode 100644 index 00000000000..4ac11df027e --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/provider/ProviderMockClient.java @@ -0,0 +1,96 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.provider; + +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; + +import com.yahoo.athenz.auth.Principal; + +public class ProviderMockClient extends ProviderClient { + + private static boolean returnTenantRoles = true; + private static List resourceGroups = new ArrayList<>(); + public ProviderMockClient(String url, Principal identity) { + super(url); + } + + static final List TABLE_PROVIDER_ROLES = Arrays.asList("admin", + "writer", "reader"); + + static final List RESOURCE_PROVIDER_ROLES = Arrays.asList("writer", "reader"); + + @Override + public Tenant getTenant(String providerService, String tenantDomain) { + Tenant tenant = new Tenant(); + tenant.setName(tenantDomain).setService(providerService); + if (!resourceGroups.isEmpty()) { + tenant.setResourceGroups(resourceGroups); + } + return tenant; + } + + @Override + public Tenant deleteTenant(String providerService, String tenantDomain, String auditRef) { + return null; + } + + @Override + public Tenant putTenant(String providerService, String tenantDomain, String auditRef, Tenant spec) { + + System.out.println("putTenant: " + tenantDomain + " -> " + spec); + if (!tenantDomain.equals(spec.getName())) { + return null; + } + + if (returnTenantRoles) { + spec.setRoles(TABLE_PROVIDER_ROLES); + } + return spec; + } + + @Override + public TenantResourceGroup deleteTenantResourceGroup(String providerService, String tenantDomain, String resourceGroup, + String auditRef) { + return null; + } + + @Override + public TenantResourceGroup putTenantResourceGroup(String providerService, String tenantDomain, String resourceGroup, + String auditRef, TenantResourceGroup data) { + + System.out.println("putTenantResourceGroup: " + tenantDomain + " -> " + data); + if (!tenantDomain.equals(data.getName())) { + return null; + } + + data.setRoles(RESOURCE_PROVIDER_ROLES); + return data; + } + + public static void setReturnTenantRoles(boolean returnTenantRoles) { + ProviderMockClient.returnTenantRoles = returnTenantRoles; + } + + public static void setResourceGroups(List resourceGroups) { + if (resourceGroups == null) { + ProviderMockClient.resourceGroups.clear(); + } else { + ProviderMockClient.resourceGroups.addAll(resourceGroups); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/provider/ProviderMockClientTest.java b/servers/zms/src/test/java/com/yahoo/athenz/provider/ProviderMockClientTest.java new file mode 100644 index 00000000000..d107b54ae28 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/provider/ProviderMockClientTest.java @@ -0,0 +1,50 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.provider; + +import static org.testng.Assert.*; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; + +public class ProviderMockClientTest { + + @Test + public void testPutTenant() { + String systemAdminUser = "user.user_admin"; + Authority authority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Principal p = SimplePrincipal.create("user", systemAdminUser, + "v=U1;d=user;n=" + systemAdminUser + ";s=signature", 0, authority); + ProviderMockClient provider = new ProviderMockClient("localhost:3306/athenz", p); + Tenant tenant = new Tenant(); + tenant.setName("name"); + assertNull(provider.putTenant("providerService1", "tenantDom1", "zms", tenant)); + } + + @Test + public void testPutTenantResourceGroup() { + String systemAdminUser = "user.user_admin"; + Authority authority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Principal p = SimplePrincipal.create("user", systemAdminUser, + "v=U1;d=user;n=" + systemAdminUser + ";s=signature", 0, authority); + ProviderMockClient provider = new ProviderMockClient("localhost:3306/athenz", p); + TenantResourceGroup tenant = new TenantResourceGroup(); + tenant.setName("name"); + assertNull(provider.putTenantResourceGroup("providerService1", "tenantDom1", "zms", "zms", tenant)); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/DBServiceTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/DBServiceTest.java new file mode 100644 index 00000000000..d49abcce0b8 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/DBServiceTest.java @@ -0,0 +1,2498 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import org.mockito.Mockito; +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; +import org.testng.annotations.*; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.provider.ProviderMockClient; +import com.yahoo.athenz.zms.store.ObjectStore; +import com.yahoo.athenz.zms.store.file.FileConnection; +import com.yahoo.athenz.zms.store.file.FileObjectStore; +import com.yahoo.athenz.zms.utils.ZMSUtils; +import com.yahoo.rdl.Struct; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.util.ArrayList; +import java.util.List; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import junit.framework.TestCase; + +public class DBServiceTest extends TestCase { + + @Mock FileConnection mockFileConn; + @Mock ObjectStore mockObjStore; + + ZMSImpl zms = null; + String adminUser = null; + String pubKey = null; // assume default is K0 + String pubKeyK1 = null; + String pubKeyK2 = null; + String privKey = null; // assume default is K0 + String privKeyK1 = null; + String privKeyK2 = null; + String auditRef = "audittest"; + + // typically used when creating and deleting domains with all the tests + // + @Mock ZMSImpl.RsrcCtxWrapper mockDomRsrcCtx; + @Mock com.yahoo.athenz.common.server.rest.ResourceContext mockDomRestRsrcCtx; + Principal rsrcPrince = null; // used with the mockDomRestRsrcCtx + + private static final String MOCKCLIENTADDR = "10.11.12.13"; + @Mock HttpServletRequest mockServletRequest; + @Mock HttpServletResponse mockServletResponse; + + private static final String ZMS_DATA_STORE_PATH = "/tmp/zms_core_unit_tests/zms_root"; + + static final Struct TABLE_PROVIDER_ROLE_ACTIONS = new Struct() + .with("admin", "*").with("writer", "WRITE").with("reader", "READ"); + + static final Struct RESOURCE_PROVIDER_ROLE_ACTIONS = new Struct() + .with("writer", "WRITE").with("reader", "READ"); + + static final int BASE_PRODUCT_ID = 500000000; // these product ids will lie in 500 million range + static java.util.Random domainProductId = new java.security.SecureRandom(); + static synchronized int getRandomProductId() { + return BASE_PRODUCT_ID + domainProductId.nextInt(99999999); + } + + @BeforeClass + public void setUp() throws Exception { + MockitoAnnotations.initMocks(this); + + Mockito.when(mockServletRequest.getRemoteAddr()).thenReturn(MOCKCLIENTADDR); + setupServiceId(); + } + + ResourceContext createResourceContext(Principal prince) { + com.yahoo.athenz.common.server.rest.ResourceContext rsrcCtx = Mockito.mock(com.yahoo.athenz.common.server.rest.ResourceContext.class); + Mockito.when(rsrcCtx.principal()).thenReturn(prince); + Mockito.when(rsrcCtx.request()).thenReturn(mockServletRequest); + Mockito.when(rsrcCtx.response()).thenReturn(mockServletResponse); + + ZMSImpl.RsrcCtxWrapper rsrcCtxWrapper = Mockito.mock(ZMSImpl.RsrcCtxWrapper.class); + Mockito.when(rsrcCtxWrapper.context()).thenReturn(rsrcCtx); + Mockito.when(rsrcCtxWrapper.principal()).thenReturn(prince); + Mockito.when(rsrcCtxWrapper.request()).thenReturn(mockServletRequest); + Mockito.when(rsrcCtxWrapper.response()).thenReturn(mockServletResponse); + return rsrcCtxWrapper; + } + + ResourceContext createResourceContext(Principal principal, HttpServletRequest request) { + if (request == null) { + return createResourceContext(principal); + } + + com.yahoo.athenz.common.server.rest.ResourceContext rsrcCtx = Mockito.mock(com.yahoo.athenz.common.server.rest.ResourceContext.class); + Mockito.when(rsrcCtx.principal()).thenReturn(principal); + Mockito.when(rsrcCtx.request()).thenReturn(request); + Mockito.when(rsrcCtx.response()).thenReturn(mockServletResponse); + + ZMSImpl.RsrcCtxWrapper rsrcCtxWrapper = Mockito.mock(ZMSImpl.RsrcCtxWrapper.class); + Mockito.when(rsrcCtxWrapper.context()).thenReturn(rsrcCtx); + Mockito.when(rsrcCtxWrapper.request()).thenReturn(request); + Mockito.when(rsrcCtxWrapper.principal()).thenReturn(principal); + Mockito.when(rsrcCtxWrapper.response()).thenReturn(mockServletResponse); + return rsrcCtxWrapper; + } + + Object getWebAppExcEntity(javax.ws.rs.WebApplicationException wex) { + javax.ws.rs.core.Response resp = wex.getResponse(); + return resp.getEntity(); + } + + Object getWebAppExcMapValue(javax.ws.rs.WebApplicationException wex, String header) { + javax.ws.rs.core.MultivaluedMap mvmap = wex.getResponse().getMetadata(); + Object obj = mvmap.getFirst(header); + return obj; + } + + private ZMSImpl zmsInit() { + // we want to make sure we start we clean dir structure + FileConnection.deleteDirectory(new File(ZMS_DATA_STORE_PATH)); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + + rsrcPrince = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", + 0, principalAuthority); + ((SimplePrincipal) rsrcPrince).setUnsignedCreds("v=U1;d=user;n=user1"); + + Mockito.when(mockDomRestRsrcCtx.request()).thenReturn(mockServletRequest); + Mockito.when(mockDomRestRsrcCtx.principal()).thenReturn(rsrcPrince); + Mockito.when(mockDomRsrcCtx.context()).thenReturn(mockDomRestRsrcCtx); + Mockito.when(mockDomRsrcCtx.request()).thenReturn(mockServletRequest); + Mockito.when(mockDomRsrcCtx.principal()).thenReturn(rsrcPrince); + + ObjectStore store = new FileObjectStore(new File(ZMS_DATA_STORE_PATH)); + + String pubKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY); + System.out.println("public key file=" + pubKeyName); + File pubKeyFile = new File(pubKeyName); + pubKey = Crypto.encodedFile(pubKeyFile); + + String privKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY); + System.out.println("private key file=" + privKeyName); + File privKeyFile = new File(privKeyName); + privKey = Crypto.encodedFile(privKeyFile); + PrivateKey privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + String privKeyId = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_ID, "0"); + + adminUser = System.getProperty(ZMSConsts.ZMS_PROP_DOMAIN_ADMIN); + + // enable product id support + System.setProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT, "true"); + System.setProperty(ZMSConsts.ZMS_PROP_SOLUTION_TEMPLATE_FNAME, "src/test/resources/solution_templates.json"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + ZMSImpl zmsObj = new ZMSImpl("localhost", store, debugMetric, privateKey, + privKeyId, pubKey, AuditLogFactory.getLogger(), null); + + ServiceIdentity service = createServiceObject("sys.auth", + "zms", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zmsObj.putServiceIdentity(mockDomRsrcCtx, "sys.auth", "zms", auditRef, service); + + return zmsObj; + } + + private Entity createEntityObject(String entityName) { + + Entity entity = new Entity(); + entity.setName(entityName); + + Struct value = new Struct(); + value.put("Key1", "Value1"); + entity.setValue(value); + + return entity; + } + + private Role createRoleObject(String domainName, String roleName, + String trust, String member1, String member2) { + + List members = new ArrayList(); + if (member1 != null) { + members.add(member1); + } + if (member2 != null) { + members.add(member2); + } + return createRoleObject(domainName, roleName, trust, members); + } + + private Role createRoleObject(String domainName, String roleName, + String trust, List members) { + + Role role = new Role(); + role.setName(ZMSUtils.roleResourceName(domainName, roleName)); + role.setMembers(members); + if (trust != null) { + role.setTrust(trust); + } + + return role; + } + + private Policy createPolicyObject(String domainName, String policyName) { + return createPolicyObject(domainName, policyName, "role1", true, "*", + domainName + ":*", AssertionEffect.ALLOW); + } + + private Policy createPolicyObject(String domainName, String policyName, + String roleName, boolean generateRoleName, String action, + String resource, AssertionEffect effect) { + + Policy policy = new Policy(); + policy.setName(ZMSUtils.policyResourceName(domainName, policyName)); + + Assertion assertion = new Assertion(); + assertion.setAction(action); + assertion.setEffect(effect); + assertion.setResource(resource); + if (generateRoleName) { + assertion.setRole(ZMSUtils.roleResourceName(domainName, roleName)); + } else { + assertion.setRole(roleName); + } + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + return policy; + } + + private ServiceIdentity createServiceObject(String domainName, + String serviceName, String endPoint, String executable, + String user, String group, String host) { + + ServiceIdentity service = new ServiceIdentity(); + service.setExecutable(executable); + service.setName(ZMSUtils.serviceResourceName(domainName, serviceName)); + + List publicKeyList = new ArrayList(); + PublicKeyEntry publicKeyEntry1 = new PublicKeyEntry(); + publicKeyEntry1.setKey(pubKeyK1); + publicKeyEntry1.setId("1"); + publicKeyList.add(publicKeyEntry1); + PublicKeyEntry publicKeyEntry2 = new PublicKeyEntry(); + publicKeyEntry2.setKey(pubKeyK2); + publicKeyEntry2.setId("2"); + publicKeyList.add(publicKeyEntry2); + service.setPublicKeys(publicKeyList); + + service.setUser(user); + service.setGroup(group); + + if (endPoint != null) { + service.setProviderEndpoint(endPoint); + } + + List hosts = new ArrayList(); + hosts.add(host); + service.setHosts(hosts); + + return service; + } + + ZMSImpl getZmsImpl(String storeDir, AuditLogger alogger) { + + FileConnection.deleteDirectory(new File(storeDir)); + ObjectStore store = new FileObjectStore(new File(storeDir)); + + String privKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY); + File privKeyFile = new File(privKeyName); + String privKey = Crypto.encodedFile(privKeyFile); + PrivateKey privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + String privKeyId = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_ID, "0"); + ServiceIdentity service = createServiceObject("sys.auth", + "zms", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + ZMSImpl zmsObj = new ZMSImpl("localhost", store, debugMetric, privateKey, + privKeyId, pubKey, alogger, null); + zmsObj.putServiceIdentity(mockDomRsrcCtx, "sys.auth", "zms", auditRef, service); + zmsObj.setProviderClientClass(ProviderMockClient.class); + return zmsObj; + } + + public void setupServiceId() throws IOException { + + Path path = Paths.get("./src/test/resources/zms_public_k1.pem"); + pubKeyK1 = Crypto.ybase64((new String(Files.readAllBytes(path))).getBytes()); + + path = Paths.get("./src/test/resources/zms_public_k2.pem"); + pubKeyK2 = Crypto.ybase64(new String(Files.readAllBytes(path)).getBytes()); + + path = Paths.get("./src/test/resources/zms_private_k1.pem"); + privKeyK1 = Crypto.ybase64(new String(Files.readAllBytes(path)).getBytes()); + + path = Paths.get("./src/test/resources/zms_private_k2.pem"); + privKeyK2 = Crypto.ybase64(new String(Files.readAllBytes(path)).getBytes()); + + zms = zmsInit(); + zms.setProviderClientClass(ProviderMockClient.class); + } + + @AfterClass + public void shutdown() { + FileConnection.deleteDirectory(new File(ZMS_DATA_STORE_PATH)); + System.clearProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT); + } + + private TopLevelDomain createTopLevelDomainObject(String name, String description, + String org, String admin, boolean enabled, boolean auditEnabled) { + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setAuditEnabled(auditEnabled); + dom.setEnabled(enabled); + dom.setYpmId(getRandomProductId()); + + List admins = new ArrayList(); + admins.add(admin); + dom.setAdminUsers(admins); + + return dom; + } + + private TopLevelDomain createTopLevelDomainObject(String name, + String description, String org, String admin) { + return createTopLevelDomainObject(name, description, org, admin, true, false); + } + + @Test + public void testCheckDomainAuditEnabledFlagTrueRefValid() { + + String domainName = "audit-test-domain-name"; + Domain domain = new Domain().setAuditEnabled(true).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain(domainName); + + String auditCheck = "testaudit"; + String caller = "testCheckDomainAuditEnabledFlagTrueRefValid"; + Domain dom = zms.dbService.checkDomainAuditEnabled(mockFileConn, domainName, auditCheck, caller); + assertNotNull(dom); + } + + @Test + public void testGetResourceAccessList() { + try { + // currently in the filestore that we're using for our unit + // we don't have an implementation for this method + zms.dbService.getResourceAccessList("principal", "UPDATE"); + } catch (Exception ex) { + assertTrue(true); + } + } + + private SubDomain createSubDomainObject(String name, String parent, + String description, String org, String admin) { + + SubDomain dom = new SubDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setParent(parent); + + List admins = new ArrayList(); + admins.add(admin); + dom.setAdminUsers(admins); + + return dom; + } + + @Test + public void testCheckDomainAuditEnabledFlagTrueRefNull() { + + String domainName = "audit-test-domain-name"; + Domain domain = new Domain().setAuditEnabled(true).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain(domainName); + + String auditCheck = null; + String caller = "testCheckDomainAuditEnabledFlagTrueRefNull"; + try { + zms.dbService.checkDomainAuditEnabled(mockFileConn, domainName, auditCheck, caller); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } + } + + @Test + public void testCheckDomainAuditEnabledFlagTrueRefEmpty() { + + String domainName = "audit-test-domain-name"; + Domain domain = new Domain().setAuditEnabled(true).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain(domainName); + + String auditCheck = ""; // empty string + String caller = "testCheckDomainAuditEnabledFlagTrueRefEmpty"; + try { + zms.dbService.checkDomainAuditEnabled(mockFileConn, domainName, auditCheck, caller); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } + } + + @Test + public void testCheckDomainAuditEnabledFlagFalseRefValid() { + + String domainName = "audit-test-domain-name"; + Domain domain = new Domain().setAuditEnabled(false).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain(domainName); + + String auditCheck = "testaudit"; + String caller = "testCheckDomainAuditEnabledFlagFalseRefValid"; + Domain dom = zms.dbService.checkDomainAuditEnabled(mockFileConn, domainName, auditCheck, caller); + assertNotNull(dom); + } + + @Test + public void testCheckDomainAuditEnabledFlagFalseRefNull() { + + String domainName = "audit-test-domain-name"; + Domain domain = new Domain().setAuditEnabled(false).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain(domainName); + + String auditCheck = null; + String caller = "testCheckDomainAuditEnabledFlagFalseRefNull"; + Domain dom = zms.dbService.checkDomainAuditEnabled(mockFileConn, domainName, auditCheck, caller); + assertNotNull(dom); + } + + @Test + public void testCheckDomainAuditEnabledFlagFalseRefEmpty() { + + String domainName = "audit-test-domain-name"; + Domain domain = new Domain().setAuditEnabled(false).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain(domainName); + + String auditCheck = ""; + String caller = "testCheckDomainAuditEnabledFlagFalseRefEmpty"; + Domain dom = zms.dbService.checkDomainAuditEnabled(mockFileConn, domainName, auditCheck, caller); + assertNotNull(dom); + } + + @Test + public void testCheckDomainAuditEnabledInvalidDomain() { + + String domainName = "audit-test-domain-name"; + Domain domain = new Domain().setAuditEnabled(false).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain(domainName); + + String auditCheck = "testaudit"; + String caller = "testCheckDomainAuditEnabledDefault"; + try { + zms.dbService.checkDomainAuditEnabled(mockFileConn, "unknown_domain", auditCheck, caller); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testUpdateTemplateRoleNoMembers() { + Role role = new Role().setName("_domain_:role.readers"); + Role newRole = zms.dbService.updateTemplateRole(role, "athenz", "readers"); + assertEquals("athenz:role.readers", newRole.getName()); + assertEquals(0, newRole.getMembers().size()); + } + + @Test + public void testUpdateTemplateRoleWithTrust() { + Role role = new Role().setName("_domain_:role.readers").setTrust("trustdomain"); + Role newRole = zms.dbService.updateTemplateRole(role, "athenz", "readers"); + assertEquals("athenz:role.readers", newRole.getName()); + assertEquals("trustdomain", newRole.getTrust()); + assertEquals(0, newRole.getMembers().size()); + } + + @Test + public void testUpdateTemplateRoleWithMembers() { + Role role = new Role().setName("_domain_:role.readers"); + List members = new ArrayList<>(); + members.add("user.user1"); + members.add("user.user2"); + role.setMembers(members); + + Role newRole = zms.dbService.updateTemplateRole(role, "athenz", "readers"); + assertEquals("athenz:role.readers", newRole.getName()); + List newMembers = newRole.getMembers(); + assertEquals(2, newMembers.size()); + assertTrue(newMembers.contains("user.user1")); + assertTrue(newMembers.contains("user.user2")); + } + + @Test + public void testUpdateTemplatePolicy() { + Policy policy = createPolicyObject("_domain_", "policy1", + "role1", true, "read", "_domain_:*", AssertionEffect.ALLOW); + + Policy newPolicy = zms.dbService.updateTemplatePolicy(policy, "athenz", "policy1"); + + assertEquals("athenz:policy.policy1", newPolicy.getName()); + + List assertions = newPolicy.getAssertions(); + assertEquals(1, assertions.size()); + Assertion assertion = assertions.get(0); + assertEquals("athenz:role.role1", assertion.getRole()); + assertEquals("athenz:*", assertion.getResource()); + assertEquals("read", assertion.getAction()); + assertEquals(AssertionEffect.ALLOW, assertion.getEffect()); + } + + @Test + public void testUpdateTemplatePolicyNoAssertions() { + Policy policy = new Policy().setName("_domain_:policy.policy1"); + Policy newPolicy = zms.dbService.updateTemplatePolicy(policy, "athenz", "policy1"); + + assertEquals("athenz:policy.policy1", newPolicy.getName()); + List assertions = newPolicy.getAssertions(); + assertEquals(0, assertions.size()); + } + + @Test + public void testUpdateTemplatePolicyAssertionNoRewrite() { + Policy policy = createPolicyObject("_domain_", "policy1", + "coretech:role.role1", false, "read", "coretech:*", AssertionEffect.ALLOW); + + Policy newPolicy = zms.dbService.updateTemplatePolicy(policy, "athenz", "policy1"); + + assertEquals("athenz:policy.policy1", newPolicy.getName()); + + List assertions = newPolicy.getAssertions(); + assertEquals(1, assertions.size()); + Assertion assertion = assertions.get(0); + assertEquals("coretech:role.role1", assertion.getRole()); + assertEquals("coretech:*", assertion.getResource()); + assertEquals("read", assertion.getAction()); + assertEquals(AssertionEffect.ALLOW, assertion.getEffect()); + } + + @Test + public void testIsTenantRolePrefixMatchNoPrefixMatch() { + assertFalse(zms.dbService.isTenantRolePrefixMatch(mockFileConn, "coretech.storage.role1", + "coretech2.role.", "tenant")); + } + + @Test + public void testIsTenantRolePrefixMatchResGroupNullTenant() { + assertFalse(zms.dbService.isTenantRolePrefixMatch(mockFileConn, "coretech.storage.res_group.reader", + "coretech.storage.", null)); + } + + @Test + public void testIsTenantRolePrefixMatchResGroupMultipleComponents() { + assertFalse(zms.dbService.isTenantRolePrefixMatch(mockFileConn, "coretech.storage.group1.group2.group3.reader", + "coretech.storage.", "tenant")); + } + + @Test + public void testIsTenantRolePrefixMatchResGroupSingleComponent() { + assertTrue(zms.dbService.isTenantRolePrefixMatch(mockFileConn, "coretech.storage.group1", + "coretech.storage.", "tenant")); + } + + @Test + public void testIsTenantRolePrefixMatchSubdomainCheckExists() { + + Domain domain = new Domain().setAuditEnabled(false).setEnabled(true); + Mockito.doReturn(domain).when(mockFileConn).getDomain("tenant.sub"); + + // since subdomain exists - we're assuming is not a tenant role + + assertFalse(zms.dbService.isTenantRolePrefixMatch(mockFileConn, "coretech.storage.sub.reader", + "coretech.storage.", "tenant")); + } + + @Test + public void testIsTenantRolePrefixMatchSubdomainCheckDoesNotExist() { + + Mockito.doReturn(null).when(mockFileConn).getDomain("tenant.sub"); + + // subdomain does not exist thus this is a tenant role + + assertTrue(zms.dbService.isTenantRolePrefixMatch(mockFileConn, "coretech.storage.sub.reader", + "coretech.storage.", "tenant")); + } + + @Test + public void testIsTrustRoleForTenantPrefixNoMatch() { + + assertFalse(zms.dbService.isTrustRoleForTenant(mockFileConn, "sports", "coretech.storage.tenant.admin", + "coretech2.storage.tenant.", "athenz")); + } + + @Test + public void testIsTrustRoleForTenantNoRole() { + + Mockito.doReturn(null).when(mockFileConn).getRole("sports", "coretech.storage.tenant.admin"); + + assertFalse(zms.dbService.isTrustRoleForTenant(mockFileConn, "sports", "coretech.storage.tenant.admin", + "coretech.storage.tenant.", "athenz")); + } + + @Test + public void testIsTrustRoleForTenantNoRoleTrust() { + + Role role = new Role().setName(ZMSUtils.roleResourceName("sports", "coretech.storage.tenant.admin")); + Mockito.doReturn(role).when(mockFileConn).getRole("sports", "coretech.storage.tenant.admin"); + + assertFalse(zms.dbService.isTrustRoleForTenant(mockFileConn, "sports", "coretech.storage.tenant.admin", + "coretech.storage.tenant.", "athenz")); + } + + @Test + public void testIsTrustRoleForTenantRoleTrustMatch() { + + Role role = new Role().setName(ZMSUtils.roleResourceName("sports", "coretech.storage.tenant.admin")) + .setTrust("athenz"); + Mockito.doReturn(role).when(mockFileConn).getRole("sports", "coretech.storage.tenant.admin"); + + assertTrue(zms.dbService.isTrustRoleForTenant(mockFileConn, "sports", "coretech.storage.tenant.admin", + "coretech.storage.tenant.", "athenz")); + } + + @Test + public void testIsTrustRoleForTenantRoleTrustNoMatch() { + + Role role = new Role().setName(ZMSUtils.roleResourceName("sports", "coretech.storage.tenant.admin")) + .setTrust("athenz2"); + Mockito.doReturn(role).when(mockFileConn).getRole("sports", "coretech.storage.tenant.admin"); + + assertFalse(zms.dbService.isTrustRoleForTenant(mockFileConn, "sports", "coretech.storage.tenant.admin", + "coretech.storage.tenant.", "athenz")); + } + + @Test + public void testExecutePutPolicyCreate() { + + String domainName = "testreplacepolicycreatedomain"; + String policyName = "policy1"; + + TopLevelDomain dom = createTopLevelDomainObject(domainName, null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Policy policy = createPolicyObject(domainName, policyName); + zms.dbService.executePutPolicy(mockDomRsrcCtx, domainName, policyName, policy, + auditRef, "testReplacePolicyCreate"); + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + assertNotNull(policyRes); + assertEquals(policyRes.getName(), domainName + ":policy." + policyName); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutPolicyExisting() { + + String domainName = "testreplacepolicycreatedomain"; + String policyName = "policy1"; + + TopLevelDomain dom = createTopLevelDomainObject(domainName, null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Policy policy = createPolicyObject(domainName, policyName); + zms.dbService.executePutPolicy(mockDomRsrcCtx, domainName, policyName, policy, + auditRef, "testExecutePutPolicyExisting"); + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + assertNotNull(policyRes); + assertEquals(policyRes.getName(), domainName + ":policy." + policyName); + List asserts = policyRes.getAssertions(); + int origAssertCnt = (asserts == null) ? 0 : asserts.size(); + + // replace the existing policy with a modified version + + Assertion assertion = new Assertion(); + assertion.setAction("test").setEffect(AssertionEffect.ALLOW).setResource("tests"); + asserts = policy.getAssertions(); + asserts.add(assertion); + policy = policy.setAssertions(asserts); + + zms.dbService.executePutPolicy(mockDomRsrcCtx, domainName, policyName, policy, + auditRef, "testExecutePutPolicyExisting"); + + Policy policyRes2 = zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + assertNotNull(policyRes2); + asserts = policyRes2.getAssertions(); + assertTrue(asserts.size() > origAssertCnt); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutPolicyMissingAuditRef() { + // create a new policy without an auditref + + String domain = "testreplacepolicymissingauditref"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Policy policy = createPolicyObject(domain, "policy1"); + try { + zms.dbService.executePutPolicy(mockDomRsrcCtx, domain, "policy1", policy, + null, "testExecutePutPolicyMissingAuditRef"); + fail("requesterror not thrown by replacePolicy."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testExecuteDeleteEntity() { + + String domainName = "delentitydom1"; + String entityName = "entity1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Entity entity1 = createEntityObject(entityName); + zms.putEntity(mockDomRsrcCtx, domainName, entityName, auditRef, entity1); + + Entity entityRes = zms.getEntity(mockDomRsrcCtx, domainName, entityName); + assertNotNull(entityRes); + + zms.dbService.executeDeleteEntity(mockDomRsrcCtx, domainName, entityName, auditRef, "deleteEntity"); + + try { + entityRes = zms.getEntity(mockDomRsrcCtx, domainName, entityName); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecuteDeleteMembership() { + + String domainName = "mbrdeldom1"; + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, roleName, null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + zms.dbService.executeDeleteMembership(mockDomRsrcCtx, domainName, roleName, + "user.joe", auditRef, "deleteMembership"); + + Role role = zms.getRole(mockDomRsrcCtx, domainName, roleName, true, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + + assertFalse(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecuteDeletePolicy() { + + String domainName = "policydeldom1"; + String policyName = "policy1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject(domainName, policyName); + zms.putPolicy(mockDomRsrcCtx, domainName, policyName, auditRef, policy1); + + Policy policyRes1 = zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + assertNotNull(policyRes1); + + zms.dbService.executeDeletePolicy(mockDomRsrcCtx, domainName, policyName, + auditRef, "deletePolicy"); + + // we need to get an exception here + try { + zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecuteDeletePublicKeyEntry() { + + String domainName = "servicedelpubkeydom1"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef, service); + + zms.dbService.executeDeletePublicKeyEntry(mockDomRsrcCtx, domainName, serviceName, + "1", auditRef, "deletePublicKeyEntry"); + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, domainName, serviceName); + List keyList = serviceRes.getPublicKeys(); + boolean found = false; + for (PublicKeyEntry entry : keyList) { + if (entry.getId().equals("1")) { + found = true; + } + } + assertFalse(found); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecuteDeletePublicKeyEntryLastKeyNotAllowed() { + + String domainName = "servicedelpubkeydom1"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef, service); + + zms.dbService.executeDeletePublicKeyEntry(mockDomRsrcCtx, domainName, serviceName, + "1", auditRef, "deletePublicKeyEntry"); + + try { + zms.dbService.executeDeletePublicKeyEntry(mockDomRsrcCtx, domainName, serviceName, + "2", auditRef, "deletePublicKeyEntry"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecuteDeleteRole() { + + String domainName = "delroledom1"; + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, roleName, null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + RoleList roleList = zms.getRoleList(mockDomRsrcCtx, domainName, null, null); + assertNotNull(roleList); + + // our role count is +1 because of the admin role + assertEquals(roleList.getNames().size(), 2); + + zms.dbService.executeDeleteRole(mockDomRsrcCtx, domainName, roleName, auditRef, "deleteRole"); + + roleList = zms.getRoleList(mockDomRsrcCtx, domainName, null, null); + assertNotNull(roleList); + + // our role counti is +1 because of the admin role + assertEquals(roleList.getNames().size(), 1); + + assertFalse(roleList.getNames().contains(roleName)); + assertTrue(roleList.getNames().contains("admin")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecuteDeleteServiceIdentity() { + + String domainName = "servicedeldom1"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef, service1); + + ServiceIdentity serviceRes1 = zms.getServiceIdentity(mockDomRsrcCtx, domainName, serviceName); + assertNotNull(serviceRes1); + + zms.dbService.executeDeleteServiceIdentity(mockDomRsrcCtx, domainName, serviceName, + auditRef, "deleteServiceIdentity"); + + // this should throw a not found exception + try { + zms.getServiceIdentity(mockDomRsrcCtx, domainName, serviceName); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecuteDeleteTenantRoles() { + + String tenantDomain = "deltenantrolesdom1"; + String providerDomain = "coretech"; + String providerService = "storage"; + + // create domain for tenant + + TopLevelDomain dom1 = createTopLevelDomainObject(tenantDomain, + "Test Tenant Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // create domain for provider + + TopLevelDomain domProv = createTopLevelDomainObject(providerDomain, + "Test Provider Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, domProv); + + // create service identity for providerDomain.providerService + + ServiceIdentity service = createServiceObject( + providerDomain, providerService, "http://localhost:8090/tableprovider", + "/usr/bin/java", "root", "users", "localhost"); + + zms.putServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef, service); + + TenantRoles roles = zms.getTenantRoles(mockDomRsrcCtx, providerDomain, providerService, + tenantDomain); + assertNotNull(roles); + assertEquals(roles.getDomain(), providerDomain); + assertEquals(roles.getService(), providerService); + assertEquals(roles.getTenant(), tenantDomain); + assertEquals(roles.getRoles().size(), 0); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + TenantRoles tenantRoles = new TenantRoles().setDomain(providerDomain) + .setService(providerService).setTenant(tenantDomain) + .setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, providerDomain, providerService, tenantDomain, + auditRef, tenantRoles); + + RoleList roleList = zms.getRoleList(mockDomRsrcCtx, providerDomain, null, null); + assertNotNull(roleList); + + boolean readerFound = false; + boolean writerFound = false; + for (String roleName : roleList.getNames()) { + if (roleName.contains("reader")) { + readerFound = true; + } else if (roleName.contains("writer")) { + writerFound = true; + } + } + + assertTrue(readerFound); + assertTrue(writerFound); + + PolicyList policyList = zms.getPolicyList(mockDomRsrcCtx, providerDomain, null, null); + assertNotNull(policyList); + + readerFound = false; + writerFound = false; + for (String policy : policyList.getNames()) { + if (policy.contains("reader")) { + readerFound = true; + } else if (policy.contains("writer")) { + writerFound = true; + } + } + + assertTrue(readerFound); + assertTrue(writerFound); + + zms.dbService.executeDeleteTenantRoles(mockDomRsrcCtx, providerDomain, providerService, tenantDomain, + null, auditRef, "deleteTenantRoles"); + + roleList = zms.getRoleList(mockDomRsrcCtx, providerDomain, null, null); + assertNotNull(roleList); + + readerFound = false; + writerFound = false; + for (String roleName : roleList.getNames()) { + if (roleName.contains("reader")) { + readerFound = true; + } else if (roleName.contains("writer")) { + writerFound = true; + } + } + + assertFalse(readerFound); + assertFalse(writerFound); + + policyList = zms.getPolicyList(mockDomRsrcCtx, providerDomain, null, null); + assertNotNull(policyList); + + readerFound = false; + writerFound = false; + for (String policy : policyList.getNames()) { + if (policy.contains("reader")) { + readerFound = true; + } else if (policy.contains("writer")) { + writerFound = true; + } + } + + assertFalse(readerFound); + assertFalse(writerFound); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testExecutePutEntity() { + + String domainName = "createentitydom1"; + String entityName = "entity1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Entity entity1 = createEntityObject(entityName); + zms.dbService.executePutEntity(mockDomRsrcCtx, domainName, entityName, + entity1, auditRef, "putEntity"); + + Entity entity2 = zms.getEntity(mockDomRsrcCtx, domainName, entityName); + assertNotNull(entity2); + assertEquals(entity2.getName(), entityName); + + Struct value = entity2.getValue(); + assertEquals("Value1", value.getString("Key1")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutEntityUpdate() { + + String domainName = "createentitydom1-mod"; + String entityName = "entity1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Entity entity1 = createEntityObject(entityName); + zms.dbService.executePutEntity(mockDomRsrcCtx, domainName, entityName, + entity1, auditRef, "putEntity"); + + Struct value = new Struct(); + value.put("Key2", "Value2"); + entity1.setValue(value); + + zms.dbService.executePutEntity(mockDomRsrcCtx, domainName, entityName, + entity1, auditRef, "putEntity"); + + Entity entity2 = zms.getEntity(mockDomRsrcCtx, domainName, entityName); + assertNotNull(entity2); + assertEquals(entity2.getName(), entityName); + value = entity2.getValue(); + assertEquals("Value2", value.getString("Key2")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutDomainMeta() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MetaDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Domain resDom1 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); + assertNotNull(resDom1); + assertEquals("Test Domain1", resDom1.getDescription()); + assertEquals("testOrg", resDom1.getOrg()); + assertTrue(resDom1.getEnabled()); + assertFalse(resDom1.getAuditEnabled()); + + // update meta with values for account and product ids + + DomainMeta meta = new DomainMeta().setDescription("Test2 Domain").setOrg("NewOrg") + .setEnabled(true).setAuditEnabled(false).setAccount("12345").setYpmId(Integer.valueOf(1001)); + zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, auditRef, "putDomainMeta"); + + Domain resDom2 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); + assertNotNull(resDom2); + assertEquals("Test2 Domain", resDom2.getDescription()); + assertEquals("NewOrg", resDom2.getOrg()); + assertTrue(resDom2.getEnabled()); + assertFalse(resDom2.getAuditEnabled()); + assertEquals(Integer.valueOf(1001), resDom2.getYpmId()); + assertEquals("12345", resDom2.getAccount()); + + // now update without account and product ids + + meta = new DomainMeta().setDescription("Test2 Domain-New").setOrg("NewOrg-New") + .setEnabled(true).setAuditEnabled(false); + zms.dbService.executePutDomainMeta(mockDomRsrcCtx, "metadom1", meta, auditRef, "putDomainMeta"); + + Domain resDom3 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); + assertNotNull(resDom3); + assertEquals("Test2 Domain-New", resDom3.getDescription()); + assertEquals("NewOrg-New", resDom3.getOrg()); + assertTrue(resDom3.getEnabled()); + assertFalse(resDom3.getAuditEnabled()); + assertEquals(Integer.valueOf(1001), resDom3.getYpmId()); + assertEquals("12345", resDom3.getAccount()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MetaDom1", auditRef); + } + + @Test + public void testExecutePutMembership() { + + String domainName = "mgradddom1"; + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + Role role1 = createRoleObject(domainName, roleName, null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + zms.dbService.executePutMembership(mockDomRsrcCtx, domainName, roleName, + "user.doe", auditRef, "putMembership"); + + zms.dbService.executePutMembership(mockDomRsrcCtx, domainName, roleName, + "coretech.storage", auditRef, "putMembership"); + + Role role = zms.getRole(mockDomRsrcCtx, domainName, roleName, false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 4); + + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.doe")); + assertTrue(members.contains("coretech.storage")); + + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutMembershipTrustRole() { + + String domainName = "putmbrtrustrole"; + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, roleName, "sys.auth", + null, null); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + try { + zms.dbService.executePutMembership(mockDomRsrcCtx, domainName, roleName, + "user.doe", auditRef, "putMembership"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutPolicy() { + + String domainName = "policyadddom1"; + String policyName = "policy1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject(domainName, policyName); + zms.dbService.executePutPolicy(mockDomRsrcCtx, domainName, policyName, + policy1, auditRef, "putPolicy"); + + Policy policyRes2 = zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + assertNotNull(policyRes2); + assertEquals(policyRes2.getName(), domainName + ":policy." + policyName); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutPolicyInvalidDomain() { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyAddDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject("PolicyAddDom1", "Policy1"); + + try { + zms.dbService.executePutPolicy(mockDomRsrcCtx, "PolicyAddDom1Invalid", "Policy1", + policy1, auditRef, "putPolicy"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyAddDom1", auditRef); + } + + @Test + public void testExecutePutPublicKeyEntry() { + + String domainName = "servicepubpubkeydom1"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef, service); + + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + + zms.dbService.executePutPublicKeyEntry(mockDomRsrcCtx, domainName, serviceName, + keyEntry, auditRef, "putPublicKeyEntry"); + + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, domainName, serviceName); + List keyList = serviceRes.getPublicKeys(); + boolean foundKey1 = false; + boolean foundKey2 = false; + boolean foundKeyZONE1 = false; + for (PublicKeyEntry entry : keyList) { + if (entry.getId().equals("1")) { + foundKey1 = true; + } else if (entry.getId().equals("2")) { + foundKey2 = true; + } else if (entry.getId().equals("zone1")) { + foundKeyZONE1 = true; + } + } + assertTrue(foundKey1); + assertTrue(foundKey2); + assertTrue(foundKeyZONE1); + + PublicKeyEntry entry = zms.getPublicKeyEntry(mockDomRsrcCtx, domainName, serviceName, "zone1"); + assertNotNull(entry); + assertEquals(entry.getId(), "zone1"); + assertEquals(entry.getKey(), pubKeyK2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutRole() { + + String domainName = "executeputroledom1"; + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, roleName, null, + "user.joe", "user.jane"); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, roleName, role1, auditRef, "putRole"); + + Role role3 = zms.getRole(mockDomRsrcCtx, domainName, roleName, false, false); + assertNotNull(role3); + assertEquals(role3.getName(), domainName + ":role." + roleName); + assertNull(role3.getTrust()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutRoleInvalidDomain() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ExecutePutRoleInvalidDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("ExecutePutRoleInvalidDom1", "Role1", null, + "user.joe", "user.jane"); + + try { + zms.dbService.executePutRole(mockDomRsrcCtx, "ExecutePutRoleInvalidDom2", + "Role1", role1, auditRef, "putRole"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ExecutePutRoleInvalidDom1", auditRef); + } + + @Test + public void testExecutePutServiceIdentity() { + + String domainName = "serviceadddom1"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.dbService.executePutServiceIdentity(mockDomRsrcCtx, domainName, serviceName, + service, auditRef, "putServiceIdentity"); + + ServiceIdentity serviceRes2 = zms.getServiceIdentity(mockDomRsrcCtx, domainName, + serviceName); + assertNotNull(serviceRes2); + assertEquals(serviceRes2.getName(), domainName + "." + serviceName); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutServiceIdentityRetryException() { + + String domainName = "serviceadddom1"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + Domain domain = new Domain().setAuditEnabled(false); + Mockito.when(mockObjStore.getConnection(false)).thenReturn(mockFileConn); + Mockito.when(mockFileConn.getDomain(domainName)).thenReturn(domain); + Mockito.when(mockFileConn.insertServiceIdentity(domainName, service)) + .thenThrow(new ResourceException(ResourceException.CONFLICT, "conflict")); + + ObjectStore saveStore = zms.dbService.store; + zms.dbService.store = mockObjStore; + int saveRetryCount = zms.dbService.defaultRetryCount; + zms.dbService.defaultRetryCount = 2; + + try { + zms.dbService.executePutServiceIdentity(mockDomRsrcCtx, domainName, serviceName, + service, auditRef, "putServiceIdentity"); + fail(); + } catch (ResourceException ex) { + assertEquals(ResourceException.CONFLICT, ex.getCode()); + } + + zms.dbService.defaultRetryCount = saveRetryCount; + zms.dbService.store = saveStore; + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutServiceIdentityModifyHost() { + + String domainName = "serviceadddom1-modhost"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.dbService.executePutServiceIdentity(mockDomRsrcCtx, domainName, serviceName, + service, auditRef, "putServiceIdentity"); + + service.getHosts().add("host2"); + service.getHosts().add("host3"); + service.getHosts().remove("host1"); + + zms.dbService.executePutServiceIdentity(mockDomRsrcCtx, domainName, serviceName, + service, auditRef, "putServiceIdentity"); + + ServiceIdentity serviceRes2 = zms.getServiceIdentity(mockDomRsrcCtx, domainName, + serviceName); + assertNotNull(serviceRes2); + assertEquals(serviceRes2.getName(), domainName + "." + serviceName); + assertEquals(2, service.getHosts().size()); + assertTrue(service.getHosts().contains("host2")); + assertTrue(service.getHosts().contains("host3")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testExecutePutServiceIdentityInvalidDomain() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceAddDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + try { + zms.dbService.executePutServiceIdentity(mockDomRsrcCtx, "ServiceAddDom1Invalid", + "Service1", service, auditRef, "putServiceIdentity"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceAddDom1", auditRef); + } + + @Test + public void testExecutePutTenantRoles() throws Exception { + + String tenantDomain = "tenantadminpolicy"; + String providerDomain = "coretech"; + String providerService = "storage"; + + // create domain for tenant + + TopLevelDomain dom1 = createTopLevelDomainObject(tenantDomain, + "Test Tenant Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // create domain for provider + + TopLevelDomain domProv = createTopLevelDomainObject(providerDomain, + "Test Provider Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, domProv); + + // create service identity for providerDomain.providerService + + ServiceIdentity service = createServiceObject( + providerDomain, providerService, "http://localhost:8090/tableprovider", + "/usr/bin/java", "root", "users", "localhost"); + + zms.putServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef, service); + + Tenancy tenant = new Tenancy(); + tenant.setDomain(tenantDomain); + tenant.setService("coretech.storage"); + + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, tenantDomain, "coretech.storage", auditRef, tenant); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + + zms.dbService.executePutTenantRoles(mockDomRsrcCtx, providerDomain, providerService, + tenantDomain, null, roleActions, auditRef, "putTenantRoles"); + + Tenancy tenant1 = zms.getTenancy(mockDomRsrcCtx, tenantDomain, "coretech.storage"); + assertNotNull(tenant1); + + zms.deleteTenancy(mockDomRsrcCtx, tenantDomain, "coretech.storage", auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + + void verifyPolicies(String domainName) { + + List names = zms.dbService.listPolicies(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + // this should be our own policy that we created previously + Policy policy = zms.dbService.getPolicy(domainName, "vip_admin"); + assertEquals(domainName + ":policy.vip_admin", policy.getName()); + + // The updated policy will have two assertions, one from the original, and the other from template application. + // The original assertion is { role: "solutiontemplate-withpolicy:role.role1", action: "*", effect: "ALLOW", resource: "*"} + // Newly added one is { resource: "solutiontemplate-withpolicy:vip*", role: "solutiontemplate-withpolicy:role.vip_admin", action: "*"} + assertEquals(2, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); // this is the original assertion + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.role1", assertion.getRole()); + assertEquals("solutiontemplate-withpolicy:*", assertion.getResource()); + + Assertion assertionAdded = policy.getAssertions().get(1); // this is the added assertion + assertEquals("*", assertionAdded.getAction()); + assertEquals(domainName + ":role.vip_admin", assertionAdded.getRole()); + assertEquals("solutiontemplate-withpolicy:vip*", assertionAdded.getResource()); + } + + @Test + public void testApplySolutionTemplateDomainExistingPolicies() { + + String caller = "testApplySolutionTemplateDomainExistingPolicies"; + String domainName = "solutiontemplate-withpolicy"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // we are going to create one of the policies that's also in + // the template - this should not change + + Policy policy1 = createPolicyObject(domainName, "vip_admin"); + zms.putPolicy(mockDomRsrcCtx, domainName, "vip_admin", auditRef, policy1); + + // apply the template + + List templates = new ArrayList<>(); + templates.add("vipng"); + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + DomainTemplateList domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(1, domainTemplateList.getTemplateNames().size()); + + // verify that our role collection includes the expected roles + + List names = zms.dbService.listRoles(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Role role = zms.dbService.getRole(domainName, "vip_admin", false, false); + assertEquals(domainName + ":role.vip_admin", role.getName()); + assertNull(role.getTrust()); + assertNull(role.getMembers()); + + role = zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false); + assertEquals(domainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // verify that our policy collections includes the policies defined in the template + + verifyPolicies(domainName); + + // Try applying the template again. This time, there should be no changes. + + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + verifyPolicies(domainName); + + // the rest should be identical what's in the template + + Policy policy = zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin"); + assertEquals(domainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + // remove the vipng template + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "vipng", + auditRef, caller); + + assertNull(zms.dbService.getRole(domainName, "vip_admin", false, false)); + assertNull(zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false)); + assertNull(zms.dbService.getPolicy(domainName, "vip_admin")); + assertNull(zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin")); + assertNotNull(zms.dbService.getRole(domainName, "admin", false, false)); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertTrue(domainTemplateList.getTemplateNames().isEmpty()); + + // remove vipng again to ensure same result + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "vipng", + auditRef, caller); + + assertNull(zms.dbService.getRole(domainName, "vip_admin", false, false)); + assertNull(zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false)); + assertNull(zms.dbService.getPolicy(domainName, "vip_admin")); + assertNull(zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin")); + assertNotNull(zms.dbService.getRole(domainName, "admin", false, false)); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertTrue(domainTemplateList.getTemplateNames().isEmpty()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testApplySolutionTemplateMultipleTemplates() { + + String caller = "testApplySolutionTemplateMultipleTemplates"; + String domainName = "solutiontemplate-multi"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // apply the template + + List templates = new ArrayList<>(); + templates.add("vipng"); + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + DomainTemplateList domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(1, domainTemplateList.getTemplateNames().size()); + + // verify that our role collection includes the roles defined in template + + List names = zms.dbService.listRoles(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Role role = zms.dbService.getRole(domainName, "vip_admin", false, false); + assertEquals(domainName + ":role.vip_admin", role.getName()); + assertNull(role.getTrust()); + assertNull(role.getMembers()); + + role = zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false); + assertEquals(domainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // verify that our policy collections includes the policies defined in the template + + names = zms.dbService.listPolicies(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Policy policy = zms.dbService.getPolicy(domainName, "vip_admin"); + assertEquals(domainName + ":policy.vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + policy = zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin"); + assertEquals(domainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + // add another template + templates = new ArrayList<>(); + templates.add("platforms"); + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(2, domainTemplateList.getTemplateNames().size()); + + names = zms.dbService.listRoles(domainName); + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("platforms_deployer")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + names = zms.dbService.listPolicies(domainName); + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + assertTrue(names.contains("platforms_deploy")); + + // remove the vipng template + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "vipng", + auditRef, caller); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(1, domainTemplateList.getTemplateNames().size()); + + names = zms.dbService.listRoles(domainName); + assertEquals(2, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("platforms_deployer")); + + names = zms.dbService.listPolicies(domainName); + assertEquals(2, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("platforms_deploy")); + + // remove the platforms template + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "platforms", + auditRef, caller); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(0, domainTemplateList.getTemplateNames().size()); + + names = zms.dbService.listRoles(domainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + names = zms.dbService.listPolicies(domainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testApplySolutionTemplateEmptyDomain() { + + String domainName = "solutiontemplate-ok"; + String caller = "testApplySolutionTemplateDomainExistingPolicies"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // apply the template + + List templates = new ArrayList<>(); + templates.add("vipng"); + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + DomainTemplateList domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(1, domainTemplateList.getTemplateNames().size()); + + // verify that our role collection includes the expected roles + + List names = zms.dbService.listRoles(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Role role = zms.dbService.getRole(domainName, "vip_admin", false, false); + assertEquals(domainName + ":role.vip_admin", role.getName()); + assertNull(role.getTrust()); + assertNull(role.getMembers()); + + role = zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false); + assertEquals(domainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // verify that our policy collections includes the policies defined in the template + + names = zms.dbService.listPolicies(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + // Try applying the template again. This time, there should be no changes. + + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + names = zms.dbService.listPolicies(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + // the rest should be identical what's in the template + + Policy policy = zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin"); + assertEquals(domainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + // remove the vipng template + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "vipng", + auditRef, caller); + + assertNull(zms.dbService.getRole(domainName, "vip_admin", false, false)); + assertNull(zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false)); + assertNull(zms.dbService.getPolicy(domainName, "vip_admin")); + assertNull(zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin")); + assertNotNull(zms.dbService.getRole(domainName, "admin", false, false)); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertTrue(domainTemplateList.getTemplateNames().isEmpty()); + + // remove vipng again to ensure same result + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "vipng", + auditRef, caller); + + assertNull(zms.dbService.getRole(domainName, "vip_admin", false, false)); + assertNull(zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false)); + assertNull(zms.dbService.getPolicy(domainName, "vip_admin")); + assertNull(zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin")); + assertNotNull(zms.dbService.getRole(domainName, "admin", false, false)); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertTrue(domainTemplateList.getTemplateNames().isEmpty()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testApplySolutionTemplateMultipleTimes() { + + String caller = "testApplySolutionTemplateMultipleTimes"; + String domainName = "solutiontemplate-multiple"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // apply the template + + List templates = new ArrayList<>(); + templates.add("vipng"); + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + // apply the template again - nothing should change + + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + DomainTemplateList domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(1, domainTemplateList.getTemplateNames().size()); + + // verify that our role collection includes the expected roles + + List names = zms.dbService.listRoles(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Role role = zms.dbService.getRole(domainName, "vip_admin", false, false); + assertEquals(domainName + ":role.vip_admin", role.getName()); + assertNull(role.getTrust()); + assertNull(role.getMembers()); + + role = zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false); + assertEquals(domainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // verify that our policy collections includes the policies defined in the template + + names = zms.dbService.listPolicies(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Policy policy = zms.dbService.getPolicy(domainName, "vip_admin"); + assertEquals(domainName + ":policy.vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + policy = zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin"); + assertEquals(domainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + // remove the vipng template + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "vipng", + auditRef, caller); + + assertNull(zms.dbService.getRole(domainName, "vip_admin", false, false)); + assertNull(zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false)); + assertNull(zms.dbService.getPolicy(domainName, "vip_admin")); + assertNull(zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin")); + assertNotNull(zms.dbService.getRole(domainName, "admin", false, false)); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertTrue(domainTemplateList.getTemplateNames().isEmpty()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testApplySolutionTemplateExistingRoles() { + + String caller = "testApplySolutionTemplateExistingRoles"; + String domainName = "solutiontemplate-withrole"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // we are going to create one of the roles that's also in + // the template - this should not change + + Role role1 = createRoleObject(domainName, "vip_admin", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName, "vip_admin", auditRef, role1); + + // apply the template + + List templates = new ArrayList<>(); + templates.add("vipng"); + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + // apply the template again - nothing should change + + zms.dbService.executePutDomainTemplate(mockDomRsrcCtx, domainName, templates, auditRef, caller); + + DomainTemplateList domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertEquals(1, domainTemplateList.getTemplateNames().size()); + + // verify that our role collection includes the expected roles + + List names = zms.dbService.listRoles(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + // this should be our own role that we created previously + + Role role = zms.dbService.getRole(domainName, "vip_admin", false, false); + assertEquals(domainName + ":role.vip_admin", role.getName()); + assertNull(role.getTrust()); + assertEquals(2, role.getMembers().size()); + assertTrue(role.getMembers().contains("user.joe")); + assertTrue(role.getMembers().contains("user.jane")); + + // the rest should be whatever we had in the template + + role = zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false); + assertEquals(domainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // the rest should be whatever we had in the template + + names = zms.dbService.listPolicies(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Policy policy = zms.dbService.getPolicy(domainName, "vip_admin"); + assertEquals(domainName + ":policy.vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + policy = zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin"); + assertEquals(domainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + // remove the vipng template + + zms.dbService.executeDeleteDomainTemplate(mockDomRsrcCtx, domainName, "vipng", + auditRef, caller); + + assertNull(zms.dbService.getRole(domainName, "vip_admin", false, false)); + assertNull(zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false)); + assertNull(zms.dbService.getPolicy(domainName, "vip_admin")); + assertNull(zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin")); + assertNotNull(zms.dbService.getRole(domainName, "admin", false, false)); + + domainTemplateList = zms.dbService.listDomainTemplates(domainName); + assertTrue(domainTemplateList.getTemplateNames().isEmpty()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testSetupTenantAdminPolicy() { + + String caller = "testSetupTenantAdminPolicy"; + String tenantDomain = "tenantadminpolicy"; + String providerDomain = "coretech"; + String providerService = "storage"; + + // create domain for tenant + + TopLevelDomain dom1 = createTopLevelDomainObject(tenantDomain, + "Test Tenant Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // create domain for provider + + TopLevelDomain domProv = createTopLevelDomainObject(providerDomain, + "Test Provider Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, domProv); + + // create service identity for providerDomain.providerService + + ServiceIdentity service = createServiceObject( + providerDomain, providerService, "http://localhost:8090/tableprovider", + "/usr/bin/java", "root", "users", "localhost"); + + zms.putServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef, service); + + // let's create the tenant admin policy + + zms.dbService.setupTenantAdminPolicy(mockDomRsrcCtx, tenantDomain, providerDomain, + providerService, auditRef, caller); + + // the admin policy must be called + + String policyName = "tenancy.coretech.storage.admin"; + Policy policy = zms.dbService.getPolicy(tenantDomain, policyName); + assertNotNull(policy); + + List assertList = policy.getAssertions(); + assertNotNull(assertList); + assertEquals(3, assertList.size()); + boolean domainAdminRoleCheck = false; + boolean tenantAdminRoleCheck = false; + boolean tenantUpdateCheck = false; + for (Assertion obj : assertList) { + assertEquals(AssertionEffect.ALLOW, obj.getEffect()); + if (obj.getRole().equals("tenantadminpolicy:role.admin")) { + assertEquals(obj.getResource(), "coretech:role.storage.tenant.tenantadminpolicy.admin"); + assertEquals(obj.getAction(), "assume_role"); + domainAdminRoleCheck = true; + } else if (obj.getRole().equals("tenantadminpolicy:role.tenancy.coretech.storage.admin")) { + if (obj.getAction().equals("assume_role")) { + assertEquals(obj.getResource(), "coretech:role.storage.tenant.tenantadminpolicy.admin"); + tenantAdminRoleCheck = true; + } else if (obj.getAction().equals("update")) { + assertEquals("tenantadminpolicy:tenancy.coretech.storage", obj.getResource()); + tenantUpdateCheck = true; + } + } + } + assertTrue(domainAdminRoleCheck); + assertTrue(tenantAdminRoleCheck); + assertTrue(tenantUpdateCheck); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + + @Test + public void testInvalidDBServiceConfig() { + + System.setProperty(ZMSConsts.ZMS_PROP_CONFLICT_RETRY_COUNT, "-100"); + System.setProperty(ZMSConsts.ZMS_PROP_CONFLICT_RETRY_SLEEP_TIME, "-1000"); + + DBService dbService = new DBService(null, null, "user"); + assertEquals(120, dbService.defaultRetryCount); + assertEquals(250, dbService.retrySleepTime); + + System.clearProperty(ZMSConsts.ZMS_PROP_CONFLICT_RETRY_COUNT); + System.clearProperty(ZMSConsts.ZMS_PROP_CONFLICT_RETRY_SLEEP_TIME); + } + + @Test + public void testShouldRetryOperation() { + + FileObjectStore store = new FileObjectStore(new File(".")); + DBService dbService = new DBService(store, null, "user"); + + // regardless of exception, count of 0 or 1 returns false + + assertFalse(dbService.shouldRetryOperation(null, 0)); + assertFalse(dbService.shouldRetryOperation(null, 1)); + + // conflict returns true + + ResourceException exc = new ResourceException(ResourceException.CONFLICT, "unit-test"); + assertTrue(dbService.shouldRetryOperation(exc, 2)); + + // gone - read/only mode returns true + + exc = new ResourceException(ResourceException.GONE, "unit-test"); + assertTrue(dbService.shouldRetryOperation(exc, 2)); + + // all others return false + + exc = new ResourceException(ResourceException.BAD_REQUEST, "unit-test"); + assertFalse(dbService.shouldRetryOperation(exc, 2)); + + exc = new ResourceException(ResourceException.FORBIDDEN, "unit-test"); + assertFalse(dbService.shouldRetryOperation(exc, 2)); + + exc = new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, "unit-test"); + assertFalse(dbService.shouldRetryOperation(exc, 2)); + + exc = new ResourceException(ResourceException.NOT_FOUND, "unit-test"); + assertFalse(dbService.shouldRetryOperation(exc, 2)); + } + + @Test + public void testLookupDomainByAccount() { + + String domainName = "lookupdomainaccount"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + dom1.setAccount("1234"); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainList list = zms.dbService.lookupDomainByAccount("1234"); + assertNotNull(list.getNames()); + assertEquals(list.getNames().size(), 1); + assertEquals(list.getNames().get(0), domainName); + + list = zms.dbService.lookupDomainById("1234", 0); + assertNotNull(list.getNames()); + assertEquals(list.getNames().size(), 1); + assertEquals(list.getNames().get(0), domainName); + + list = zms.dbService.lookupDomainByAccount("1235"); + assertNull(list.getNames()); + + list = zms.dbService.lookupDomainById("1235", 0); + assertNull(list.getNames()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testLookupDomainByProductId() { + + String domainName = "lookupdomainbyproductid"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + dom1.setYpmId(Integer.valueOf(101)); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainList list = zms.dbService.lookupDomainByProductId(101); + assertNotNull(list.getNames()); + assertEquals(list.getNames().size(), 1); + assertEquals(list.getNames().get(0), domainName); + + list = zms.dbService.lookupDomainById(null, 101); + assertNotNull(list.getNames()); + assertEquals(list.getNames().size(), 1); + assertEquals(list.getNames().get(0), domainName); + + list = zms.dbService.lookupDomainByProductId(102); + assertNull(list.getNames()); + + list = zms.dbService.lookupDomainById(null, 102); + assertNull(list.getNames()); + + list = zms.dbService.lookupDomainByProductId(0); + assertNull(list.getNames()); + + list = zms.dbService.lookupDomainById(null, 0); + assertNull(list.getNames()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testLookupDomainByRole() { + + String domainName = "lookupdomainrole"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + dom1.setYpmId(Integer.valueOf(199)); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainList list = zms.dbService.lookupDomainByRole(adminUser, "admin"); + assertNotNull(list.getNames()); + assertTrue(list.getNames().contains(domainName)); + + List doms = zms.dbService.listDomains(null, 0); + + // all domains have admin role + + list = zms.dbService.lookupDomainByRole(null, "admin"); + assertNotNull(list.getNames()); + assertEquals(list.getNames().size(), doms.size()); + + // null role/member gives us the full set + + list = zms.dbService.lookupDomainByRole(null, null); + assertNotNull(list.getNames()); + assertEquals(list.getNames().size(), doms.size()); + + // unknown role and member in the system + + list = zms.dbService.lookupDomainByRole(adminUser, "unknown_role"); + assertEquals(list.getNames().size(), 0); + + list = zms.dbService.lookupDomainByRole("unkwown-user", "admin"); + assertEquals(list.getNames().size(), 0); + + // lets add a role for joe and jane + + Role role1 = createRoleObject(domainName, "list-role", null, + "user.joe", "user.jane"); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "list-role", + role1, auditRef, "putRole"); + + list = zms.dbService.lookupDomainByRole("user.joe", "list-role"); + assertNotNull(list.getNames()); + assertEquals(list.getNames().size(), 1); + assertEquals(list.getNames().get(0), domainName); + + list = zms.dbService.lookupDomainByRole(adminUser, "list-role"); + assertEquals(list.getNames().size(), 0); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetPrincipalYrn() { + + Principal principal = SimplePrincipal.create("user", "user1", "creds", null); + ZMSImpl.RsrcCtxWrapper rsrcCtx = Mockito.mock(ZMSImpl.RsrcCtxWrapper.class); + Mockito.when(rsrcCtx.principal()).thenReturn(principal); + assertEquals(zms.dbService.getPrincipalYrn(rsrcCtx), "user.user1"); + + assertNull(zms.dbService.getPrincipalYrn(null)); + + ZMSImpl.RsrcCtxWrapper rsrcCtx2 = Mockito.mock(ZMSImpl.RsrcCtxWrapper.class); + Mockito.when(rsrcCtx2.principal()).thenReturn(null); + assertNull(zms.dbService.getPrincipalYrn(rsrcCtx2)); + } + + @Test + public void testAuditLogPublicKeyEntry() { + StringBuilder auditDetails = new StringBuilder(); + assertFalse(zms.dbService.auditLogPublicKeyEntry(auditDetails, "keyId", true)); + assertEquals("{id: \"keyId\"}", auditDetails.toString()); + + auditDetails.setLength(0); + assertFalse(zms.dbService.auditLogPublicKeyEntry(auditDetails, "keyId", false)); + assertEquals(",{id: \"keyId\"}", auditDetails.toString()); + } + + @Test + public void testApplySolutionTemplateNullTemplat() { + StringBuilder auditDetails = new StringBuilder(); + assertTrue(zms.dbService.applySolutionTemplate(null, null, "template1", null, true, null, null, auditDetails)); + assertEquals("{name: \"template1\"}", auditDetails.toString()); + } + + @Test + public void testIsTrustRole() { + + // null role + assertFalse(zms.dbService.isTrustRole(null)); + + // null trust + Role role = new Role().setName("domain1:role.role1").setTrust(null); + assertFalse(zms.dbService.isTrustRole(role)); + + // empty trust + role = new Role().setName("domain1:role.role1").setTrust(""); + assertFalse(zms.dbService.isTrustRole(role)); + + // with trust + role = new Role().setName("domain1:role.role1").setTrust("domain2"); + assertTrue(zms.dbService.isTrustRole(role)); + } + + @Test + public void testGetDelegatedRoleNoExpand() { + + String domainName = "rolenoexpand"; + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, roleName, "sys.auth", + null, null); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + Role role = zms.dbService.getRole(domainName, roleName, false, false); + assertNotNull(role); + assertEquals(role.getTrust(), "sys.auth"); + assertNull(role.getMembers()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetDelegatedRoleExpand() { + + String domainName1 = "role-expand1"; + String domainName2 = "role-expand2"; + + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName1, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject(domainName2, + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + Role role1 = createRoleObject(domainName1, roleName, domainName2, + null, null); + zms.putRole(mockDomRsrcCtx, domainName1, roleName, auditRef, role1); + + Role role2a = createRoleObject(domainName2, "role2a", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName2, "role2a", auditRef, role2a); + + Role role2b = createRoleObject(domainName2, "role2b", null, + "user.joe", "user.doe"); + zms.putRole(mockDomRsrcCtx, domainName2, "role2b", auditRef, role2b); + + Policy policy = createPolicyObject(domainName2, "policy", + domainName2 + ":role.role2a", false, "assume_role", domainName1 + ":role." + roleName, + AssertionEffect.ALLOW); + + Assertion assertion = new Assertion(); + assertion.setAction("assume_role"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role." + roleName); + assertion.setRole(domainName2 + ":role.role2b"); + policy.getAssertions().add(assertion); + zms.putPolicy(mockDomRsrcCtx, domainName2, "policy", auditRef, policy); + + Role role = zms.dbService.getRole(domainName1, roleName, false, true); + assertNotNull(role); + assertEquals(role.getTrust(), domainName2); + List members = role.getMembers(); + assertEquals(3, members.size()); + + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.doe")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName1, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName2, auditRef); + } + + @Test + public void testGetDelegatedRoleMembersInvalidDomain() { + + assertNull(zms.dbService.getDelegatedRoleMembers("dom1", "dom1", "role1")); + assertNull(zms.dbService.getDelegatedRoleMembers("dom1", "invalid-domain", "role1")); + } + + @Test + public void testGetDelegatedRoleMembers() { + + String domainName1 = "role-expand1"; + String domainName2 = "role-expand2"; + + String roleName = "role1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName1, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject(domainName2, + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + Role role1 = createRoleObject(domainName1, roleName, domainName2, + null, null); + zms.putRole(mockDomRsrcCtx, domainName1, roleName, auditRef, role1); + + Role role2a = createRoleObject(domainName2, "role2a", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName2, "role2a", auditRef, role2a); + + Role role2b = createRoleObject(domainName2, "role2b", null, + "user.joe", "user.doe"); + zms.putRole(mockDomRsrcCtx, domainName2, "role2b", auditRef, role2b); + + Role role2c = createRoleObject(domainName2, "role2c", "sys.auth", + null, null); + zms.putRole(mockDomRsrcCtx, domainName2, "role2c", auditRef, role2c); + + Role role2d = createRoleObject(domainName2, "role2d", null, + "user.user1", "user.user2"); + zms.putRole(mockDomRsrcCtx, domainName2, "role2d", auditRef, role2d); + + Role role2e = createRoleObject(domainName2, "role2e", null, + null, null); + zms.putRole(mockDomRsrcCtx, domainName2, "role2e", auditRef, role2e); + + Policy policy = createPolicyObject(domainName2, "policy", + domainName2 + ":role.role2a", false, "assume_role", domainName1 + ":role." + roleName, + AssertionEffect.ALLOW); + + Assertion assertion = new Assertion(); + assertion.setAction("assume_role"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role." + roleName); + assertion.setRole(domainName2 + ":role.role2b"); + policy.getAssertions().add(assertion); + zms.putPolicy(mockDomRsrcCtx, domainName2, "policy", auditRef, policy); + + policy = new Policy().setName(domainName2 + ":policy.policy2"); + zms.dbService.executePutPolicy(mockDomRsrcCtx, domainName2, "policy2", policy, auditRef, "putPolicy"); + + List members = zms.dbService.getDelegatedRoleMembers(domainName1, domainName2, roleName); + assertEquals(3, members.size()); + + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.doe")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName1, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName2, auditRef); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/MockConnectionFactory.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/MockConnectionFactory.java new file mode 100644 index 00000000000..7c76123046a --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/MockConnectionFactory.java @@ -0,0 +1,30 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.sql.Connection; +import java.sql.SQLException; + +import org.apache.commons.dbcp2.ConnectionFactory; + +public class MockConnectionFactory implements ConnectionFactory { + + @Override + public Connection createConnection() throws SQLException { + return null; + } + +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/MockHttpServletRequest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/MockHttpServletRequest.java new file mode 100644 index 00000000000..d170f20e5ab --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/MockHttpServletRequest.java @@ -0,0 +1,462 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.io.BufferedReader; +import java.io.IOException; +import java.io.UnsupportedEncodingException; +import java.security.Principal; +import java.util.Collection; +import java.util.Enumeration; +import java.util.HashMap; +import java.util.Locale; +import java.util.Map; + +import javax.servlet.AsyncContext; +import javax.servlet.DispatcherType; +import javax.servlet.RequestDispatcher; +import javax.servlet.ServletContext; +import javax.servlet.ServletException; +import javax.servlet.ServletInputStream; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import javax.servlet.http.HttpUpgradeHandler; +import javax.servlet.http.Part; + +public class MockHttpServletRequest implements HttpServletRequest { + + Map headers = new HashMap<>(); + + public MockHttpServletRequest() { + } + + public void addHeader(String name, String value) { + headers.put(name, value); + } + + @Override + public Object getAttribute(String name) { + // Auto-generated method stub + return null; + } + + @Override + public Enumeration getAttributeNames() { + // Auto-generated method stub + return null; + } + + @Override + public String getCharacterEncoding() { + // Auto-generated method stub + return null; + } + + @Override + public void setCharacterEncoding(String env) throws UnsupportedEncodingException { + // Auto-generated method stub + } + + @Override + public int getContentLength() { + // Auto-generated method stub + return 0; + } + + @Override + public long getContentLengthLong() { + // Auto-generated method stub + return 0; + } + + @Override + public String getContentType() { + // Auto-generated method stub + return null; + } + + @Override + public ServletInputStream getInputStream() throws IOException { + // Auto-generated method stub + return null; + } + + @Override + public String getParameter(String name) { + // Auto-generated method stub + return null; + } + + @Override + public Enumeration getParameterNames() { + // Auto-generated method stub + return null; + } + + @Override + public String[] getParameterValues(String name) { + // Auto-generated method stub + return null; + } + + @Override + public Map getParameterMap() { + // Auto-generated method stub + return null; + } + + @Override + public String getProtocol() { + // Auto-generated method stub + return null; + } + + @Override + public String getScheme() { + // Auto-generated method stub + return null; + } + + @Override + public String getServerName() { + // Auto-generated method stub + return null; + } + + @Override + public int getServerPort() { + // Auto-generated method stub + return 0; + } + + @Override + public BufferedReader getReader() throws IOException { + // Auto-generated method stub + return null; + } + + @Override + public String getRemoteAddr() { + // Auto-generated method stub + return null; + } + + @Override + public String getRemoteHost() { + // Auto-generated method stub + return null; + } + + @Override + public void setAttribute(String name, Object o) { + // Auto-generated method stub + } + + @Override + public void removeAttribute(String name) { + // Auto-generated method stub + } + + @Override + public Locale getLocale() { + // Auto-generated method stub + return null; + } + + @Override + public Enumeration getLocales() { + // Auto-generated method stub + return null; + } + + @Override + public boolean isSecure() { + // Auto-generated method stub + return false; + } + + @Override + public RequestDispatcher getRequestDispatcher(String path) { + // Auto-generated method stub + return null; + } + + @Override + public String getRealPath(String path) { + // Auto-generated method stub + return null; + } + + @Override + public int getRemotePort() { + // Auto-generated method stub + return 0; + } + + @Override + public String getLocalName() { + // Auto-generated method stub + return null; + } + + @Override + public String getLocalAddr() { + // Auto-generated method stub + return null; + } + + @Override + public int getLocalPort() { + // Auto-generated method stub + return 0; + } + + @Override + public ServletContext getServletContext() { + // Auto-generated method stub + return null; + } + + @Override + public AsyncContext startAsync() throws IllegalStateException { + // Auto-generated method stub + return null; + } + + @Override + public AsyncContext startAsync(ServletRequest servletRequest, ServletResponse servletResponse) + throws IllegalStateException { + // Auto-generated method stub + return null; + } + + @Override + public boolean isAsyncStarted() { + // Auto-generated method stub + return false; + } + + @Override + public boolean isAsyncSupported() { + // Auto-generated method stub + return false; + } + + @Override + public AsyncContext getAsyncContext() { + // Auto-generated method stub + return null; + } + + @Override + public DispatcherType getDispatcherType() { + // Auto-generated method stub + return null; + } + + @Override + public String getAuthType() { + // Auto-generated method stub + return null; + } + + @Override + public Cookie[] getCookies() { + // Auto-generated method stub + return null; + } + + @Override + public long getDateHeader(String name) { + // Auto-generated method stub + return 0; + } + + @Override + public String getHeader(String name) { + return headers.get(name); + } + + @Override + public Enumeration getHeaders(String name) { + // Auto-generated method stub + return null; + } + + @Override + public Enumeration getHeaderNames() { + // Auto-generated method stub + return null; + } + + @Override + public int getIntHeader(String name) { + // Auto-generated method stub + return 0; + } + + @Override + public String getMethod() { + // Auto-generated method stub + return null; + } + + @Override + public String getPathInfo() { + // Auto-generated method stub + return null; + } + + @Override + public String getPathTranslated() { + // Auto-generated method stub + return null; + } + + @Override + public String getContextPath() { + // Auto-generated method stub + return null; + } + + @Override + public String getQueryString() { + // Auto-generated method stub + return null; + } + + @Override + public String getRemoteUser() { + // Auto-generated method stub + return null; + } + + @Override + public boolean isUserInRole(String role) { + // Auto-generated method stub + return false; + } + + @Override + public Principal getUserPrincipal() { + // Auto-generated method stub + return null; + } + + @Override + public String getRequestedSessionId() { + // Auto-generated method stub + return null; + } + + @Override + public String getRequestURI() { + // Auto-generated method stub + return null; + } + + @Override + public StringBuffer getRequestURL() { + // Auto-generated method stub + return null; + } + + @Override + public String getServletPath() { + // Auto-generated method stub + return null; + } + + @Override + public HttpSession getSession(boolean create) { + // Auto-generated method stub + return null; + } + + @Override + public HttpSession getSession() { + // Auto-generated method stub + return null; + } + + @Override + public String changeSessionId() { + // Auto-generated method stub + return null; + } + + @Override + public boolean isRequestedSessionIdValid() { + // Auto-generated method stub + return false; + } + + @Override + public boolean isRequestedSessionIdFromCookie() { + // Auto-generated method stub + return false; + } + + @Override + public boolean isRequestedSessionIdFromURL() { + // Auto-generated method stub + return false; + } + + @Override + public boolean isRequestedSessionIdFromUrl() { + // Auto-generated method stub + return false; + } + + @Override + public boolean authenticate(HttpServletResponse response) throws IOException, ServletException { + // Auto-generated method stub + return false; + } + + @Override + public void login(String username, String password) throws ServletException { + // Auto-generated method stub + } + + @Override + public void logout() throws ServletException { + // Auto-generated method stub + } + + @Override + public Collection getParts() throws IOException, ServletException { + // Auto-generated method stub + return null; + } + + @Override + public Part getPart(String name) throws IOException, ServletException { + // Auto-generated method stub + return null; + } + + @Override + public T upgrade(Class handlerClass) throws IOException, ServletException { + // Auto-generated method stub + return null; + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/MockHttpServletResponse.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/MockHttpServletResponse.java new file mode 100644 index 00000000000..5494da825c9 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/MockHttpServletResponse.java @@ -0,0 +1,235 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.io.IOException; +import java.io.PrintWriter; +import java.util.Collection; +import java.util.HashMap; +import java.util.Locale; +import java.util.Map; + +import javax.servlet.ServletOutputStream; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletResponse; + +public class MockHttpServletResponse implements HttpServletResponse { + + Map headers = new HashMap<>(); + + public MockHttpServletResponse() { + } + + @Override + public String getCharacterEncoding() { + // Auto-generated method stub + return null; + } + + @Override + public String getContentType() { + // Auto-generated method stub + return null; + } + + @Override + public ServletOutputStream getOutputStream() throws IOException { + // Auto-generated method stub + return null; + } + + @Override + public PrintWriter getWriter() throws IOException { + // Auto-generated method stub + return null; + } + + @Override + public void setCharacterEncoding(String charset) { + // Auto-generated method stub + } + + @Override + public void setContentLength(int len) { + // Auto-generated method stub + } + + @Override + public void setContentLengthLong(long len) { + // Auto-generated method stub + } + + @Override + public void setContentType(String type) { + // Auto-generated method stub + } + + @Override + public void setBufferSize(int size) { + // Auto-generated method stub + } + + @Override + public int getBufferSize() { + // Auto-generated method stub + return 0; + } + + @Override + public void flushBuffer() throws IOException { + // Auto-generated method stub + } + + @Override + public void resetBuffer() { + // Auto-generated method stub + } + + @Override + public boolean isCommitted() { + // Auto-generated method stub + return false; + } + + @Override + public void reset() { + // Auto-generated method stub + } + + @Override + public void setLocale(Locale loc) { + // Auto-generated method stub + } + + @Override + public Locale getLocale() { + // Auto-generated method stub + return null; + } + + @Override + public void addCookie(Cookie cookie) { + // Auto-generated method stub + } + + @Override + public boolean containsHeader(String name) { + // Auto-generated method stub + return false; + } + + @Override + public String encodeURL(String url) { + // Auto-generated method stub + return null; + } + + @Override + public String encodeRedirectURL(String url) { + // Auto-generated method stub + return null; + } + + @Override + public String encodeUrl(String url) { + // Auto-generated method stub + return null; + } + + @Override + public String encodeRedirectUrl(String url) { + // Auto-generated method stub + return null; + } + + @Override + public void sendError(int sc, String msg) throws IOException { + // Auto-generated method stub + } + + @Override + public void sendError(int sc) throws IOException { + // Auto-generated method stub + } + + @Override + public void sendRedirect(String location) throws IOException { + // Auto-generated method stub + } + + @Override + public void setDateHeader(String name, long date) { + // Auto-generated method stub + } + + @Override + public void addDateHeader(String name, long date) { + // Auto-generated method stub + } + + @Override + public void setHeader(String name, String value) { + // Auto-generated method stub + } + + @Override + public void addHeader(String name, String value) { + headers.put(name, value); + } + + @Override + public void setIntHeader(String name, int value) { + // Auto-generated method stub + } + + @Override + public void addIntHeader(String name, int value) { + // Auto-generated method stub + } + + @Override + public void setStatus(int sc) { + // Auto-generated method stub + } + + @Override + public void setStatus(int sc, String sm) { + // Auto-generated method stub + } + + @Override + public int getStatus() { + // Auto-generated method stub + return 0; + } + + @Override + public String getHeader(String name) { + return headers.get(name); + } + + @Override + public Collection getHeaders(String name) { + // Auto-generated method stub + return null; + } + + @Override + public Collection getHeaderNames() { + // Auto-generated method stub + return null; + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/ResourceExceptionTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/ResourceExceptionTest.java new file mode 100644 index 00000000000..8891368510d --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/ResourceExceptionTest.java @@ -0,0 +1,72 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import static org.testng.Assert.*; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.ResourceException; + + +public class ResourceExceptionTest { + + @Test + public void testCodeToString() { + + assertEquals("OK", ResourceException.codeToString(200)); + assertEquals("Created", ResourceException.codeToString(201)); + assertEquals("Accepted", ResourceException.codeToString(202)); + assertEquals("No Content", ResourceException.codeToString(204)); + assertEquals("Moved Permanently", ResourceException.codeToString(301)); + assertEquals("Found", ResourceException.codeToString(302)); + assertEquals("See Other", ResourceException.codeToString(303)); + assertEquals("Not Modified", ResourceException.codeToString(304)); + assertEquals("Temporary Redirect", ResourceException.codeToString(307)); + assertEquals("Bad Request", ResourceException.codeToString(400)); + assertEquals("Unauthorized", ResourceException.codeToString(401)); + assertEquals("Forbidden", ResourceException.codeToString(403)); + assertEquals("Not Found", ResourceException.codeToString(404)); + assertEquals("Conflict", ResourceException.codeToString(409)); + assertEquals("Gone", ResourceException.codeToString(410)); + assertEquals("Precondition Failed", ResourceException.codeToString(412)); + assertEquals("Unsupported Media Type", ResourceException.codeToString(415)); + assertEquals("Internal Server Error", ResourceException.codeToString(500)); + assertEquals("Not Implemented", ResourceException.codeToString(501)); + assertEquals("1001", ResourceException.codeToString(1001)); + } + + @Test + public void testCodeOnly() { + + ResourceException exc = new ResourceException(400); + assertEquals(exc.getData().toString(), "{code: 400, message: \"Bad Request\"}"); + } + + @Test + public void testGetData() { + + ResourceException exc = new ResourceException(400, "Invalid domain name"); + assertEquals(exc.getData(), "Invalid domain name"); + } + + @Test + public void testGetDataCast() { + + ResourceException exc = new ResourceException(400, new Integer(5000)); + assertEquals(exc.getData(Integer.class), new Integer(5000)); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSDaemonTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSDaemonTest.java new file mode 100644 index 00000000000..0b63db949d1 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSDaemonTest.java @@ -0,0 +1,54 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import static org.testng.Assert.*; + +import org.apache.commons.daemon.DaemonContext; +import org.mockito.Mockito; +import org.testng.annotations.Test; + +public class ZMSDaemonTest { + + @Test + public void testInit() throws Exception { + DaemonContext daemoncontext = Mockito.mock(DaemonContext.class); + ZMSDaemon daemon = new ZMSDaemon(); + daemon.init(daemoncontext); + } + + @Test + public void testStart() { + ZMSDaemon daemon = new ZMSDaemon(); + try { + daemon.start(); + } catch (Exception ex) { + assertTrue(true); + } + } + + @Test + public void testStop() throws Exception { + ZMSDaemon daemon = new ZMSDaemon(); + daemon.stop(); + } + + @Test + public void testDestroy() throws Exception { + ZMSDaemon daemon = new ZMSDaemon(); + daemon.destroy(); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSImplTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSImplTest.java new file mode 100644 index 00000000000..aff66bbdc85 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSImplTest.java @@ -0,0 +1,14109 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import java.io.File; +import java.io.IOException; +import java.io.UnsupportedEncodingException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.text.DateFormat; +import java.text.SimpleDateFormat; +import java.util.ArrayList; +import java.util.Date; +import java.util.List; + +import org.mockito.Mockito; +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; +import org.testng.annotations.*; + +import static org.testng.Assert.*; +import junit.framework.TestCase; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.ws.rs.WebApplicationException; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.impl.SimpleServiceIdentityProvider; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.metrics.MetricFactory; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.provider.ProviderMockClient; +import com.yahoo.athenz.zms.ZMSImpl.AccessStatus; +import com.yahoo.athenz.zms.ZMSImpl.AthenzObject; +import com.yahoo.athenz.zms.store.AthenzDomain; +import com.yahoo.athenz.zms.store.ObjectStore; +import com.yahoo.athenz.zms.store.file.FileConnection; +import com.yahoo.athenz.zms.store.file.FileObjectStore; +import com.yahoo.athenz.zms.utils.ZMSUtils; +import com.yahoo.rdl.Schema; +import com.yahoo.rdl.Struct; + +public class ZMSImplTest extends TestCase { + + ZMSImpl zms = null; + String adminUser = null; + String pubKey = null; // assume default is K0 + String pubKeyK1 = null; + String pubKeyK2 = null; + String privKey = null; // assume default is K0 + String privKeyK1 = null; + String privKeyK2 = null; + String auditRef = "audittest"; + + // typically used when creating and deleting domains with all the tests + // + @Mock ZMSImpl.RsrcCtxWrapper mockDomRsrcCtx; + @Mock com.yahoo.athenz.common.server.rest.ResourceContext mockDomRestRsrcCtx; + Principal rsrcPrince = null; // used with the mockDomRestRsrcCtx + + @Mock ZMSImpl.RsrcCtxWrapper mockDomRsrcCtx2; + @Mock com.yahoo.athenz.common.server.rest.ResourceContext mockDomRestRsrcCtx2; + + private static final String MOCKCLIENTADDR = "10.11.12.13"; + @Mock HttpServletRequest mockServletRequest; + @Mock HttpServletResponse mockServletResponse; + + private static final String ZMS_DATA_STORE_PATH = "/tmp/zms_core_unit_tests/zms_root"; + + static final Struct TABLE_PROVIDER_ROLE_ACTIONS = new Struct() + .with("admin", "*").with("writer", "WRITE").with("reader", "READ"); + + static final Struct RESOURCE_PROVIDER_ROLE_ACTIONS = new Struct() + .with("writer", "WRITE").with("reader", "READ"); + + static final int BASE_PRODUCT_ID = 400000000; // these product ids will lie in 400 million range + static java.util.Random domainProductId = new java.security.SecureRandom(); + static synchronized int getRandomProductId() { + return BASE_PRODUCT_ID + domainProductId.nextInt(99999999); + } + + @BeforeClass(alwaysRun=true) + public void setUp() throws Exception { + MockitoAnnotations.initMocks(this); + + Mockito.when(mockServletRequest.getRemoteAddr()).thenReturn(MOCKCLIENTADDR); + + System.setProperty(ZMSConsts.ZMS_PROP_METRIC_FACTORY_CLASS, ZMSConsts.ZMS_METRIC_FACTORY_CLASS); + System.setProperty(ZMSConsts.ZMS_PROP_STATS_ENABLED, "true"); + System.setProperty(ZMSConsts.ZMS_PROP_PROVIDER_ENDPOINTS, ".athenzcompany.com"); + + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_STORE_CLASS, "com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory"); + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, "src/test/resources/zms_private.pem"); + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, "src/test/resources/zms_public.pem"); + System.setProperty(ZMSConsts.ZMS_PROP_DOMAIN_ADMIN, "user.testadminuser"); + System.setProperty(ZMSConsts.ZMS_PROP_AUTHZ_SERVICE_FNAME, "src/test/resources/authorized_services.json"); + System.setProperty(ZMSConsts.ZMS_PROP_SOLUTION_TEMPLATE_FNAME, "src/test/resources/solution_templates.json"); + System.setProperty("logback.configurationFile", "src/test/resources/logback.xml"); + + setupServiceId(); + } + + com.yahoo.athenz.zms.ResourceContext createResourceContext(Principal prince) { + com.yahoo.athenz.common.server.rest.ResourceContext rsrcCtx = Mockito.mock(com.yahoo.athenz.common.server.rest.ResourceContext.class); + Mockito.when(rsrcCtx.principal()).thenReturn(prince); + Mockito.when(rsrcCtx.request()).thenReturn(mockServletRequest); + Mockito.when(rsrcCtx.response()).thenReturn(mockServletResponse); + + ZMSImpl.RsrcCtxWrapper rsrcCtxWrapper = Mockito.mock(ZMSImpl.RsrcCtxWrapper.class); + Mockito.when(rsrcCtxWrapper.context()).thenReturn(rsrcCtx); + Mockito.when(rsrcCtxWrapper.principal()).thenReturn(prince); + Mockito.when(rsrcCtxWrapper.request()).thenReturn(mockServletRequest); + Mockito.when(rsrcCtxWrapper.response()).thenReturn(mockServletResponse); + return rsrcCtxWrapper; + } + + com.yahoo.athenz.zms.ResourceContext createResourceContext(Principal principal, HttpServletRequest request) { + if (request == null) { + return createResourceContext(principal); + } + + com.yahoo.athenz.common.server.rest.ResourceContext rsrcCtx = Mockito.mock(com.yahoo.athenz.common.server.rest.ResourceContext.class); + Mockito.when(rsrcCtx.principal()).thenReturn(principal); + Mockito.when(rsrcCtx.request()).thenReturn(request); + Mockito.when(rsrcCtx.response()).thenReturn(mockServletResponse); + + ZMSImpl.RsrcCtxWrapper rsrcCtxWrapper = Mockito.mock(ZMSImpl.RsrcCtxWrapper.class); + Mockito.when(rsrcCtxWrapper.context()).thenReturn(rsrcCtx); + Mockito.when(rsrcCtxWrapper.request()).thenReturn(request); + Mockito.when(rsrcCtxWrapper.principal()).thenReturn(principal); + Mockito.when(rsrcCtxWrapper.response()).thenReturn(mockServletResponse); + return rsrcCtxWrapper; + } + + Object getWebAppExcEntity(javax.ws.rs.WebApplicationException wex) { + javax.ws.rs.core.Response resp = wex.getResponse(); + return resp.getEntity(); + } + + Object getWebAppExcMapValue(javax.ws.rs.WebApplicationException wex, String header) { + javax.ws.rs.core.MultivaluedMap mvmap = wex.getResponse().getMetadata(); + Object obj = mvmap.getFirst(header); + return obj; + } + + private Metric createMetric() { + MetricFactory metricFactory = null; + Metric metric = null; + try { + metricFactory = (MetricFactory) + Class.forName(System.getProperty(ZMSConsts.ZMS_PROP_METRIC_FACTORY_CLASS)).newInstance(); + metric = metricFactory.create(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException exc) { + System.out.println("Invalid MetricFactory class: " + ZMSConsts.ZMS_METRIC_FACTORY_CLASS + + " error: " + exc.getMessage()); + metric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + } + return metric; + } + + private ZMSImpl zmsInit() { + // we want to make sure we start we clean dir structure + FileConnection.deleteDirectory(new File(ZMS_DATA_STORE_PATH)); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String unsignedCreds = "v=U1;d=user;n=user1"; + rsrcPrince = SimplePrincipal.create("user", "user1", unsignedCreds + ";s=signature", + 0, principalAuthority); + ((SimplePrincipal) rsrcPrince).setUnsignedCreds(unsignedCreds); + + Mockito.when(mockDomRestRsrcCtx.request()).thenReturn(mockServletRequest); + Mockito.when(mockDomRestRsrcCtx.principal()).thenReturn(rsrcPrince); + Mockito.when(mockDomRsrcCtx.context()).thenReturn(mockDomRestRsrcCtx); + Mockito.when(mockDomRsrcCtx.request()).thenReturn(mockServletRequest); + Mockito.when(mockDomRsrcCtx.principal()).thenReturn(rsrcPrince); + + ObjectStore store = new FileObjectStore(new File(ZMS_DATA_STORE_PATH)); + + String pubKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY); + System.out.println("public key file=" + pubKeyName); + File pubKeyFile = new File(pubKeyName); + pubKey = Crypto.encodedFile(pubKeyFile); + + String privKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY); + System.out.println("private key file=" + privKeyName); + File privKeyFile = new File(privKeyName); + privKey = Crypto.encodedFile(privKeyFile); + PrivateKey privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + String privKeyId = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_ID, "0"); + + adminUser = System.getProperty(ZMSConsts.ZMS_PROP_DOMAIN_ADMIN); + + Metric metric = createMetric(); + ZMSImpl zmsObj = new ZMSImpl("localhost", store, metric, privateKey, + privKeyId, pubKey, AuditLogFactory.getLogger(), null); + + ServiceIdentity service = createServiceObject("sys.auth", + "zms", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zmsObj.putServiceIdentity(mockDomRsrcCtx, "sys.auth", "zms", auditRef, service); + + return zmsObj; + } + + ZMSImpl getZmsImpl(String storeDir, AuditLogger alogger) { + + FileConnection.deleteDirectory(new File(storeDir)); + ObjectStore store = new FileObjectStore(new File(storeDir)); + String privKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY); + File privKeyFile = new File(privKeyName); + String privKey = Crypto.encodedFile(privKeyFile); + PrivateKey privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + String privKeyId = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_ID, "0"); + ServiceIdentity service = createServiceObject("sys.auth", + "zms", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + Metric metric = createMetric(); + ZMSImpl zmsObj = new ZMSImpl("localhost", store, metric, privateKey, + privKeyId, pubKey, alogger, null); + zmsObj.putServiceIdentity(mockDomRsrcCtx, "sys.auth", "zms", auditRef, service); + zmsObj.setProviderClientClass(ProviderMockClient.class); + return zmsObj; + } + + public void setupServiceId() throws IOException { + + Path path = Paths.get("./src/test/resources/zms_public_k1.pem"); + pubKeyK1 = Crypto.ybase64((new String(Files.readAllBytes(path))).getBytes()); + + path = Paths.get("./src/test/resources/zms_public_k2.pem"); + pubKeyK2 = Crypto.ybase64(new String(Files.readAllBytes(path)).getBytes()); + + path = Paths.get("./src/test/resources/zms_private_k1.pem"); + privKeyK1 = Crypto.ybase64(new String(Files.readAllBytes(path)).getBytes()); + + path = Paths.get("./src/test/resources/zms_private_k2.pem"); + privKeyK2 = Crypto.ybase64(new String(Files.readAllBytes(path)).getBytes()); + + zms = zmsInit(); + zms.setProviderClientClass(ProviderMockClient.class); + } + + @AfterClass(alwaysRun=true) + public void shutdown() { + FileConnection.deleteDirectory(new File(ZMS_DATA_STORE_PATH)); + } + + private Membership generateMembership(String roleName, String memberName) { + Membership mbr = new Membership(); + mbr.setRoleName(roleName); + mbr.setMemberName(memberName); + mbr.setIsMember(true); + return mbr; + } + + private TopLevelDomain createTopLevelDomainObject(String name, + String description, String org, String admin) { + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setYpmId(getRandomProductId()); + + List admins = new ArrayList(); + admins.add(admin); + dom.setAdminUsers(admins); + + return dom; + } + + private UserDomain createUserDomainObject(String name, String description, String org) { + + UserDomain dom = new UserDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + + return dom; + } + + private SubDomain createSubDomainObject(String name, String parent, + String description, String org, String admin) { + + SubDomain dom = new SubDomain(); + dom.setName(name); + dom.setDescription(description); + dom.setOrg(org); + dom.setParent(parent); + + List admins = new ArrayList(); + admins.add(admin); + dom.setAdminUsers(admins); + + return dom; + } + + private DomainMeta createDomainMetaObject(String description, String org, + Boolean futureEnabled, Boolean auditEnabled, String account, Integer productId) { + + DomainMeta meta = new DomainMeta(); + meta.setDescription(description); + meta.setOrg(org); + if (futureEnabled != null) { + meta.setEnabled(futureEnabled); + } + if (auditEnabled != null) { + meta.setAuditEnabled(auditEnabled); + } + if (account != null) { + meta.setAccount(account); + } + meta.setYpmId(productId); + + return meta; + } + + private Role createRoleObject(String domainName, String roleName, + String trust) { + Role role = new Role(); + role.setName(ZMSUtils.roleResourceName(domainName, roleName)); + role.setTrust(trust); + return role; + } + + private Role createRoleObject(String domainName, String roleName, + String trust, String member1, String member2) { + + List members = new ArrayList(); + if (member1 != null) { + members.add(member1); + } + if (member2 != null) { + members.add(member2); + } + return createRoleObject(domainName, roleName, trust, members); + } + + private Role createRoleObject(String domainName, String roleName, + String trust, List members) { + + Role role = new Role(); + role.setName(ZMSUtils.roleResourceName(domainName, roleName)); + role.setMembers(members); + if (trust != null) { + role.setTrust(trust); + } + + return role; + } + + private Policy createPolicyObject(String domainName, String policyName, + String roleName, String action, String resource, + AssertionEffect effect) { + return createPolicyObject(domainName, policyName, roleName, true, + action, resource, effect); + } + + private Policy createPolicyObject(String domainName, String policyName, + String roleName, boolean generateRoleName, String action, + String resource, AssertionEffect effect) { + + Policy policy = new Policy(); + policy.setName(ZMSUtils.policyResourceName(domainName, policyName)); + + Assertion assertion = new Assertion(); + assertion.setAction(action); + assertion.setEffect(effect); + assertion.setResource(resource); + if (generateRoleName) { + assertion.setRole(ZMSUtils.roleResourceName(domainName, roleName)); + } else { + assertion.setRole(roleName); + } + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + return policy; + } + + private Policy createPolicyObject(String domainName, String policyName) { + return createPolicyObject(domainName, policyName, "Role1", "*", + domainName + ":*", AssertionEffect.ALLOW); + } + + private ServiceIdentity createServiceObject(String domainName, + String serviceName, String endPoint, String executable, + String user, String group, String host) { + + ServiceIdentity service = new ServiceIdentity(); + service.setExecutable(executable); + service.setName(ZMSUtils.serviceResourceName(domainName, serviceName)); + + List publicKeyList = new ArrayList(); + PublicKeyEntry publicKeyEntry1 = new PublicKeyEntry(); + publicKeyEntry1.setKey(pubKeyK1); + publicKeyEntry1.setId("1"); + publicKeyList.add(publicKeyEntry1); + PublicKeyEntry publicKeyEntry2 = new PublicKeyEntry(); + publicKeyEntry2.setKey(pubKeyK2); + publicKeyEntry2.setId("2"); + publicKeyList.add(publicKeyEntry2); + service.setPublicKeys(publicKeyList); + + service.setUser(user); + service.setGroup(group); + + if (endPoint != null) { + service.setProviderEndpoint(endPoint); + } + + List hosts = new ArrayList(); + hosts.add(host); + service.setHosts(hosts); + + return service; + } + + private Entity createEntityObject(String entityName) { + + Entity entity = new Entity(); + entity.setName(entityName); + + Struct value = new Struct(); + value.put("Key1", "Value1"); + entity.setValue(value); + + return entity; + } + + private void setupTenantDomainProviderService(ZMSImpl zms, String tenantDomain, String providerDomain, + String providerService, String providerEndpoint) { + + // create domain for tenant + // + TopLevelDomain dom1 = createTopLevelDomainObject(tenantDomain, + "Test Tenant Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // create domain for provider + // + TopLevelDomain domProv = createTopLevelDomainObject(providerDomain, + "Test Provider Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, domProv); + + // create service identity for providerDomain.providerService + // + ServiceIdentity service = createServiceObject( + providerDomain, providerService, providerEndpoint, + "/usr/bin/java", "root", "users", "localhost"); + + zms.putServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef, service); + } + + private void setupTenantDomainProviderService(String tenantDomain, String providerDomain, + String providerService, String providerEndpoint) { + setupTenantDomainProviderService(zms, tenantDomain, providerDomain, providerService, providerEndpoint); + } + + private Tenancy createTenantObject(String domain, String service) { + + Tenancy tenant = new Tenancy(); + tenant.setDomain(domain); + tenant.setService(service); + + return tenant; + } + + @Test + public void testSchema() { + Schema schema = zms.schema(); + assertNotNull(schema); + } + + @Test + public void testGetAuditLogMsgBuilder() { + AuditLogMsgBuilder msgBldr = ZMSImpl.getAuditLogMsgBuilder(mockDomRsrcCtx, "mydomain", auditRef, "myapi", "PUT"); + assertNotNull(msgBldr); + } + + @Test + public void testGetAuditLogMsgBuilderNullCtx() { + AuditLogMsgBuilder msgBldr = ZMSImpl.getAuditLogMsgBuilder(null, "mydomain", auditRef, "myapi", "PUT"); + assertNotNull(msgBldr); + } + + @Test + public void testGetAuditLogMsgBuilderNullPrincipal() { + ResourceContext ctx = createResourceContext(null); + AuditLogMsgBuilder msgBldr = ZMSImpl.getAuditLogMsgBuilder(ctx, "mydomain", auditRef, "myapi", "PUT"); + assertNotNull(msgBldr); + } + + @Test + public void testGetAuditLogMsgBuilderTokenWithSig() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String userId = "user1"; + String signature = "ABRACADABRA"; + String unsignedCreds = "v=U1;d=user;n=user1"; + Principal principal = SimplePrincipal.create("user", userId, unsignedCreds + ";s=" + signature, + 0, principalAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); // set unsigned creds + ResourceContext ctx = createResourceContext(principal); + AuditLogMsgBuilder msgBldr = ZMSImpl.getAuditLogMsgBuilder(ctx, "mydomain", auditRef, "myapi", "PUT"); + assertNotNull(msgBldr); + String who = msgBldr.who(); + assertNotNull(who); + assertTrue(who.contains(userId)); + assertTrue("Should not contain the signature: " + who, !who.contains(signature)); + } + + @Test + public void testGetAuditLogMsgBuilderTokenSigMissing() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String userId = "user1"; + String unsignedCreds = "v=U1;d=user;n=user1"; + Principal principal = SimplePrincipal.create("user", userId, unsignedCreds, + 0, principalAuthority); + ResourceContext ctx = createResourceContext(principal); + AuditLogMsgBuilder msgBldr = ZMSImpl.getAuditLogMsgBuilder(ctx, "mydomain", auditRef, "myapi", "PUT"); + assertNotNull(msgBldr); + String who = msgBldr.who(); + assertNotNull(who); + assertTrue(who.contains(userId)); + } + + @Test + public void testGetAuditLogMsgBuilderNullParams() { + AuditLogMsgBuilder msgBldr = ZMSImpl.getAuditLogMsgBuilder(mockDomRsrcCtx, null, null, null, null); + assertNotNull(msgBldr); + } + + @Test + public void testGetDomain() { + Domain domain = zms.getDomain(mockDomRsrcCtx, "sys.auth"); + assertNotNull(domain); + } + + @Test + public void testGetDomainThrowException() { + try { + zms.getDomain(mockDomRsrcCtx, "wrongDomain"); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + } + + @Test(groups="post-domain-tests") + public void testPostDomain() { + String domName = "olddominion"; + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + } catch (ResourceException re) { + assertEquals(re.getCode(), 404); + } + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(domName); + dom.setDescription("old virginny"); + dom.setOrg("universities"); + dom.setYpmId(1930); + + List admins = new ArrayList(); + admins.add(adminUser); + dom.setAdminUsers(admins); + + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + // post subdomain + String subDomName = "extension"; + SubDomain subDom = createSubDomainObject(subDomName, domName, + "old dominion extension", "education", adminUser); + zms.postSubDomain(mockDomRsrcCtx, domName, auditRef, subDom); + + // post sub domain that is too big - default length is 128 + String subDomNameBad = "extension0extension0extension0extension0"; + subDomNameBad = subDomNameBad.concat("extension0extension0extension0extension0"); + subDomNameBad = subDomNameBad.concat("extension0extension0extension0extension0"); + + subDom = createSubDomainObject(subDomNameBad, domName, + "old dominion extension+++", "education", adminUser); + try { + zms.postSubDomain(mockDomRsrcCtx, domName, auditRef, subDom); + fail("requesterror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Invalid SubDomain name")); + assertTrue(ex.getMessage().contains("name length cannot exceed")); + } + + zms.deleteSubDomain(mockDomRsrcCtx, domName, subDomName, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + } + + @Test(groups="post-domain-tests") + public void testPostDomainNullObject() { + try { + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, null); + fail("requesterror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test(groups="post-domain-tests") + public void testPostTopLevelDomainNoProductId() { + + // enable product id support + + System.setProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT, "true"); + ZMSImpl zmsImpl = zmsInit(); + + String domName = "jabberwocky"; + try { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + } catch (ResourceException re) { + assertEquals(re.getCode(), 404); + } + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(domName); + dom.setDescription("mythic animal"); + dom.setOrg("animals"); + + List admins = new ArrayList(); + admins.add(adminUser); + dom.setAdminUsers(admins); + + try { + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + fail("requesterror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Product Id is required when creating top level domain")); + } + + System.clearProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT); + } + + @Test(groups="post-domain-tests") + public void testPostTopLevelDomainNameTooLong() { + String domName = "a234567890"; + StringBuilder dname = new StringBuilder(); + dname.append(domName).append(domName).append(domName).append(domName); + dname.append(domName).append(domName).append(domName).append(domName); + dname.append(domName).append(domName).append(domName).append(domName); + dname.append("a23456789"); // have 129 chars - default is 128 + domName = dname.toString(); + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + } catch (ResourceException re) { + assertEquals(re.getCode(), 404); + } + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(domName); + dom.setDescription("bigun"); + dom.setOrg("bigdog"); + + List admins = new ArrayList(); + admins.add(adminUser); + dom.setAdminUsers(admins); + + try { + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + fail("requesterror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("name length cannot exceed")); + } + } + + @Test(groups="post-domain-tests") + public void testPostDomainNameOnSizeLimit() { + + // set the domain size limit to 45 + System.setProperty(ZMSConsts.ZMS_PROP_DOMAIN_NAME_MAX_SIZE, "45"); + + ZMSImpl zmsImpl = zmsInit(); + + String domName = "a234567890"; + StringBuilder dname = new StringBuilder(); + dname.append(domName).append(domName).append(domName).append(domName); + dname.append("a2345"); // have 45 chars + domName = dname.toString(); + try { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + } catch (ResourceException re) { + assertEquals(re.getCode(), 404); + } + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(domName); + dom.setDescription("bigun"); + dom.setOrg("bigdog"); + dom.setYpmId(999999); + + List admins = new ArrayList(); + admins.add(adminUser); + dom.setAdminUsers(admins); + + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + // post sub domain which will be too big by 1 char + String subDomNameBad = "B"; + SubDomain subDom = createSubDomainObject(subDomNameBad, domName, + "1 char too many", "dogs", adminUser); + try { + zmsImpl.postSubDomain(mockDomRsrcCtx, domName, auditRef, subDom); + fail("requesterror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Invalid SubDomain name")); + assertTrue(ex.getMessage().contains("name length cannot exceed")); + } + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_DOMAIN_NAME_MAX_SIZE); + } + + @Test + public void testPostTopLevelDomainNameReduceSizeLimitTooSmall() { + + // lower name length to 5 which should be reset internally to the default + System.setProperty(ZMSConsts.ZMS_PROP_DOMAIN_NAME_MAX_SIZE, "5"); + ZMSImpl zmsImpl = zmsInit(); + + String domName = "abcdef7890"; + try { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + } catch (ResourceException re) { + assertEquals(re.getCode(), 404); + } + + TopLevelDomain dom = new TopLevelDomain(); + dom.setName(domName); + dom.setDescription("bigun"); + dom.setOrg("bigdog"); + dom.setYpmId(77777); + + List admins = new ArrayList(); + admins.add(adminUser); + dom.setAdminUsers(admins); + + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domName, auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_DOMAIN_NAME_MAX_SIZE); + } + + @Test + public void testGetDomainList() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ListDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("ListDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, null, null, null, null, + null, null, null, null, null); + assertNotNull(domList); + + assertTrue(domList.getNames().contains("ListDom1".toLowerCase())); + assertTrue(domList.getNames().contains("ListDom2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDom2", auditRef); + } + + @Test + public void testGetDomainListByAccount() { + + String domainName = "lookupdomainaccount"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + dom1.setAccount("1234"); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, null, null, null, null, + "1234", null, null, null, null); + assertNotNull(domList.getNames()); + assertEquals(domList.getNames().size(), 1); + assertEquals(domList.getNames().get(0), domainName); + + domList = zms.getDomainList(mockDomRsrcCtx, null, null, null, null, + "1235", null, null, null, null); + assertNull(domList.getNames()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetDomainListByProductId() { + + String domainName = "lookupdomainbyproductid"; + + // enable product id support + + System.setProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT, "true"); + ZMSImpl zmsImpl = zmsInit(); + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + dom1.setYpmId(Integer.valueOf(101)); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainList domList = zmsImpl.getDomainList(mockDomRsrcCtx, null, null, null, + null, null, Integer.valueOf(101), null, null, null); + assertNotNull(domList.getNames()); + assertEquals(domList.getNames().size(), 1); + assertEquals(domList.getNames().get(0), domainName); + + domList = zmsImpl.getDomainList(mockDomRsrcCtx, null, null, null, null, null, + Integer.valueOf(102), null, null, null); + assertNull(domList.getNames()); + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT); + } + + @Test + public void testGetDomainListIfModifiedSince() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ListDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // let's get the current time + + Date now = new Date(); + + try { + Thread.sleep(1000); + } catch (InterruptedException e) { + } + + TopLevelDomain dom2 = createTopLevelDomainObject("ListDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DateFormat df = new SimpleDateFormat("EEE, d MMM yyyy HH:mm:ss zzz"); + String modifiedSince = df.format(now); + + // this is only a partial list since our file struct store + // which the unit tests use does not support last modified + // option so this will be tested in zms_system_test package + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, null, null, null, + null, null, null, null, null, modifiedSince); + assertNotNull(domList); + + assertTrue(domList.getNames().contains("ListDom2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDom2", auditRef); + } + + @Test + public void testGetDomainListInvalidIfModifiedSince() { + + try { + zms.getDomainList(mockDomRsrcCtx, null, null, null, null, null, + null, null, null, "abc"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + zms.getDomainList(mockDomRsrcCtx, null, null, null, null, null, + null, null, null, "May 20, 1099"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + zms.getDomainList(mockDomRsrcCtx, null, null, null, null, null, + null, null, null, "03:03:20 PM"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testGetDomainListParamsLimit() { + + TopLevelDomain dom1 = createTopLevelDomainObject("LimitDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("LimitDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, 1, null, null, + null, null, null, null, null, null); + assertTrue(domList.getNames().size() == 1); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "LimitDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "LimitDom2", auditRef); + } + + @Test + public void testGetDomainListParamsSkip() { + + TopLevelDomain dom1 = createTopLevelDomainObject("SkipDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("SkipDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + TopLevelDomain dom3 = createTopLevelDomainObject("SkipDom3", + "Test Domain3", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom3); + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, null, null, null, + null, null, null, null, null, null); + int size = domList.getNames().size(); + assertTrue(size > 3); + + // ask for only for 2 domains back + domList = zms.getDomainList(mockDomRsrcCtx, 2, null, null, null, null, + null, null, null, null); + assertEquals(domList.getNames().size(), 2); + + // ask for the remaining domains + DomainList remList = zms.getDomainList(mockDomRsrcCtx, null, domList.getNext(), + null, null, null, null, null, null, null); + assertEquals(remList.getNames().size(), size - 2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SkipDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SkipDom2", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SkipDom3", auditRef); + } + + @Test + public void testGetDomainListParamsPrefix() { + + TopLevelDomain dom1 = createTopLevelDomainObject("NoPrefixDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("PrefixDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, null, null, + "Prefix", null, null, null, null, null, null); + + assertFalse(domList.getNames().contains("NoPrefixDom1".toLowerCase())); + assertTrue(domList.getNames().contains("PrefixDom2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "NoPrefixDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PrefixDom2", auditRef); + } + + @Test + public void testGetDomainListParamsDepth() { + + TopLevelDomain dom1 = createTopLevelDomainObject("DepthDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("DepthDom2", "DepthDom1", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "DepthDom1", auditRef, dom2); + + SubDomain dom3 = createSubDomainObject("DepthDom3", + "DepthDom1.DepthDom2", "Test Domain3", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "DepthDom1.DepthDom2", auditRef, dom3); + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, null, null, null, + 1, null, null, null, null, null); + + assertTrue(domList.getNames().contains("DepthDom1".toLowerCase())); + assertTrue(domList.getNames().contains("DepthDom1.DepthDom2".toLowerCase())); + assertFalse(domList.getNames().contains("DepthDom1.DepthDom2.DepthDom3".toLowerCase())); + + zms.deleteSubDomain(mockDomRsrcCtx, "DepthDom1.DepthDom2", "DepthDom3", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "DepthDom1", "DepthDom2", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "DepthDom1", auditRef); + } + + @Test + public void testGetDomainListThrowException() { + try { + zms.getDomainList(mockDomRsrcCtx, -1, null, null, null, null, null, null, null, null); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + } + + @Test + public void testCreateTopLevelDomain() { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddTopDom1", + "Test Domain1", "testOrg", adminUser); + Domain resDom1 = zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + assertNotNull(resDom1); + + Domain resDom2 = zms.getDomain(mockDomRsrcCtx, "AddTopDom1"); + assertNotNull(resDom2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AddTopDom1", auditRef); + } + + @Test + public void testCreateTopLevelDomainOnceOnly() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_posttopdomonceonly"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + TopLevelDomain dom1 = createTopLevelDomainObject("AddOnceTopDom1", + "Test Domain1", "testOrg", adminUser); + Domain resDom1 = zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + assertNotNull(resDom1); + + // we should get an exception for the second call + + try { + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + String caller = "posttopleveldomain"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + if (msg.indexOf("ERROR=(") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(makeDomain: Cannot create domain: addoncetopdom1 - already exists)") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "AddOnceTopDom1", auditRef); + } + + @Test + public void testCreateSubDomain() { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddSubDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("AddSubDom2", "AddSubDom1", + "Test Domain2", "testOrg", adminUser); + Domain resDom1 = zms.postSubDomain(mockDomRsrcCtx, "AddSubDom1", auditRef, dom2); + assertNotNull(resDom1); + + Domain resDom2 = zms.getDomain(mockDomRsrcCtx, "AddSubDom1.AddSubDom2"); + assertNotNull(resDom2); + + zms.deleteSubDomain(mockDomRsrcCtx, "AddSubDom1", "AddSubDom2", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AddSubDom1", auditRef); + } + + @Test + public void testCreateUserDomain() { + + UserDomain dom1 = createUserDomainObject("hga", "Test Domain1", "testOrg"); + zms.postUserDomain(mockDomRsrcCtx, "hga", auditRef, dom1); + + Domain resDom2 = zms.getDomain(mockDomRsrcCtx, "user.hga"); + assertNotNull(resDom2); + + zms.deleteUserDomain(mockDomRsrcCtx, "hga", auditRef); + } + + + @Test + public void testCreateUserDomainMismatch() { + + UserDomain dom1 = createUserDomainObject("hga", "Test Domain1", "testOrg"); + try { + zms.postUserDomain(mockDomRsrcCtx, "hga2", auditRef, dom1); + } catch (ResourceException ex) { + assertEquals(403, ex.getCode()); + } + } + + @Test + public void testDeleteUserDomain() { + + UserDomain dom1 = createUserDomainObject("hga", "Test Domain1", "testOrg"); + zms.postUserDomain(mockDomRsrcCtx, "hga", auditRef, dom1); + + zms.deleteUserDomain(mockDomRsrcCtx, "hga", auditRef); + + try { + zms.getDomain(mockDomRsrcCtx, "hga"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + } + + @Test + public void testCreateSubDomainWithVirtualLimit() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "2"); + ZMSImpl zmsTest = zmsInit(); + + TopLevelDomain dom1 = createTopLevelDomainObject("SubDomNoVirtual", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom = createSubDomainObject("sub1", "SubDomNoVirtual", + "Test Domain2", "testOrg", adminUser); + Domain resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "SubDomNoVirtual", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub2", "SubDomNoVirtual", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "SubDomNoVirtual", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub3", "SubDomNoVirtual", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "SubDomNoVirtual", auditRef, dom); + assertNotNull(resDom); + + zms.deleteSubDomain(mockDomRsrcCtx, "SubDomNoVirtual", "sub3", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "SubDomNoVirtual", "sub2", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "SubDomNoVirtual", "sub1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SubDomNoVirtual", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT); + } + + @Test + public void testCreateSubDomainVirtual() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "5"); + ZMSImpl zmsTest = zmsInit(); + + SubDomain dom = createSubDomainObject("sub1", "user.user1", + "Test Domain2", "testOrg", adminUser); + Domain resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub2", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub3", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub1a", "user.user1.sub1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1.sub1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub1aa", "user.user1.sub1.sub1a", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1.sub1.sub1a", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub1ab", "user.user1.sub1.sub1a", + "Test Domain2", "testOrg", adminUser); + try { + zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1.sub1.sub1a", auditRef, dom); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + + dom = createSubDomainObject("sub4", "user.user1", + "Test Domain2", "testOrg", adminUser); + try { + zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1.sub1.sub1a", "sub1aa", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1.sub1", "sub1a", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub3", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub2", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub1", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT); + } + + @Test + public void testCreateSubDomainVirtualNoLimit() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "0"); + ZMSImpl zmsTest = zmsInit(); + + SubDomain dom = createSubDomainObject("sub1", "user.user1", + "Test Domain2", "testOrg", adminUser); + Domain resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub2", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub3", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub4", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub5", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub6", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zmsTest.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub6", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub5", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub4", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub3", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub2", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub1", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT); + } + + @Test + public void testCreateSubDomainMismatchParent() { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddSubMismatchParentDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("AddSubDom2", "AddSubMismatchParentDom1", + "Test Domain2", "testOrg", adminUser); + + try { + zms.postSubDomain(mockDomRsrcCtx, "AddSubMismatchParentDom2", auditRef, dom2); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 403); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AddSubMismatchParentDom1", auditRef); + } + + @Test + public void testCreateSubdomainOnceOnly() { + + TopLevelDomain dom1 = createTopLevelDomainObject("AddOnceSubDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("AddOnceSubDom2", + "AddOnceSubDom1", "Test Domain2", "testOrg", adminUser); + Domain resDom1 = zms.postSubDomain(mockDomRsrcCtx, "AddOnceSubDom1", auditRef, dom2); + assertNotNull(resDom1); + + // we should get an exception for the second call + + try { + zms.postSubDomain(mockDomRsrcCtx, "AddOnceSubDom1", auditRef, dom2); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zms.deleteSubDomain(mockDomRsrcCtx, "AddOnceSubDom1", "AddOnceSubDom2", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AddOnceSubDom1", auditRef); + } + + @Test + public void testDeleteDomain() { + TopLevelDomain dom = createTopLevelDomainObject( + "TestDeleteDomain", null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + zms.deleteDomain(mockDomRsrcCtx, auditRef, "testdeletedomain", "testDeleteDomain"); + + try { + zms.getDomain(mockDomRsrcCtx, "TestDeleteDomain"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testDeleteDomainNonExistant() { + try { + zms.deleteDomain(mockDomRsrcCtx, auditRef, "TestDeleteDomainNonExist", "testDeleteDomainNonExistant"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testDeleteDomainMissingAuditRef() { + // create domain and require auditing + String domain = "testdeletedomainmissingauditref"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + // delete it without an auditRef and catch exception + try { + zms.deleteDomain(mockDomRsrcCtx, null, domain, "testDeleteDomainMissingAuditRef"); + fail("requesterror not thrown by testDeleteDomainMissingAuditRef."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testDeleteTopLevelDomain() { + + TopLevelDomain dom1 = createTopLevelDomainObject("DelTopDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Domain resDom1 = zms.getDomain(mockDomRsrcCtx, "DelTopDom1"); + assertNotNull(resDom1); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "DelTopDom1", auditRef); + + // we should get a forbidden exception since the domain + // no longer exists + + try { + zms.getDomain(mockDomRsrcCtx, "DelTopDom1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteTopLevelDomainChildExist() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_deltopdomhrowexc"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String caller = "deletetopleveldomain"; + + TopLevelDomain dom1 = createTopLevelDomainObject("DelTopChildDom1", + "Test Domain1", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("DelSubDom2", "DelTopChildDom1", + "Test Domain2", "testOrg", adminUser); + zmsImpl.postSubDomain(mockDomRsrcCtx, "DelTopChildDom1", auditRef, dom2); + + // we can't delete Dom1 since Dom2 still exists + + try { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "DelTopChildDom1", auditRef); + fail("requesterror not thrown."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deletetopleveldomain: Cannot delete domain deltopchilddom1: 1 subdomains of it exist))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + zmsImpl.deleteSubDomain(mockDomRsrcCtx, "DelTopChildDom1", "DelSubDom2", auditRef); + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "DelTopChildDom1", auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testDeleteTopLevelDomainNonExistant() { + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, "NonExistantDomain", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testDeleteTopLevelDomainNonExistantNoAuditRef() { + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, "NonExistantDomain", null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testDeleteTopLevelDomainMissingAuditRef() { + // create domain and require auditing + TopLevelDomain dom = createTopLevelDomainObject( + "TopDomainAuditRequired", null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + // delete it without an auditRef and catch exception + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, "TopDomainAuditRequired", null); + fail("requesterror not thrown by deleteTopLevelDomain."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, "TopDomainAuditRequired", auditRef); + } + } + + @Test + public void testDeleteSubDomain() { + + TopLevelDomain dom1 = createTopLevelDomainObject("DelSubDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("DelSubDom2", "DelSubDom1", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "DelSubDom1", auditRef, dom2); + + Domain resDom1 = zms.getDomain(mockDomRsrcCtx, "DelSubDom1.DelSubDom2"); + assertNotNull(resDom1); + + zms.deleteSubDomain(mockDomRsrcCtx, "DelSubDom1", "DelSubDom2", auditRef); + + // we should get a forbidden exception since the domain + // no longer exists + + try { + zms.getDomain(mockDomRsrcCtx, "DelSubDom1.DelSubDom2"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "DelSubDom1", auditRef); + } + + @Test + public void testDeleteSubDomainChildExist() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_delsubdomchildexist"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String caller = "deletesubdomain"; + + TopLevelDomain dom1 = createTopLevelDomainObject("DelSubChildDom1", + "Test Domain1", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("DelSubDom2", "DelSubChildDom1", + "Test Domain2", "testOrg", adminUser); + zmsImpl.postSubDomain(mockDomRsrcCtx, "DelSubChildDom1", auditRef, dom2); + + SubDomain dom3 = createSubDomainObject("DelSubDom3", "DelSubChildDom1.DelSubDom2", + "Test Domain3", "testOrg", adminUser); + zmsImpl.postSubDomain(mockDomRsrcCtx, "DelSubChildDom1.DelSubDom2", auditRef, dom3); + + // we can't delete Dom2 since Dom3 still exists + + try { + zmsImpl.deleteSubDomain(mockDomRsrcCtx, "DelSubChildDom1", "DelSubDom2", auditRef); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deletesubdomain: Cannot delete domain delsubchilddom1.delsubdom2: 1 subdomains of it exist))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + zmsImpl.deleteSubDomain(mockDomRsrcCtx, "DelSubChildDom1.DelSubDom2", "DelSubDom3", auditRef); + zmsImpl.deleteSubDomain(mockDomRsrcCtx, "DelSubChildDom1", "DelSubDom2", auditRef); + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "DelSubChildDom1", auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testDeleteSubDomainNonExistant() { + TopLevelDomain dom = createTopLevelDomainObject( + "ExistantTopDomain", null, null, adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + try { + zms.deleteSubDomain(mockDomRsrcCtx, "ExistantTopDomain", "NonExistantSubDomain", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ExistantTopDomain", auditRef); + } + + @Test + public void testDeleteSubDomainSubAndTopNonExistant() { + try { + zms.deleteSubDomain(mockDomRsrcCtx, "NonExistantTopDomain", "NonExistantSubDomain", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testDeleteSubDomainMissingAuditRef() { + TopLevelDomain dom = createTopLevelDomainObject( + "ExistantTopDomain2", null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + SubDomain subDom = createSubDomainObject( + "ExistantSubDom2", "ExistantTopDomain2", + null, null, adminUser); + subDom.setAuditEnabled(true); + zms.postSubDomain(mockDomRsrcCtx, "ExistantTopDomain2", auditRef, subDom); + + try { + zms.deleteSubDomain(mockDomRsrcCtx, "ExistantTopDomain2", "ExistantSubDom2", null); + fail("requesterror not thrown by deleteSubDomain."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteSubDomain(mockDomRsrcCtx, "ExistantTopDomain2", "ExistantSubDom2", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ExistantTopDomain2", auditRef); + } + } + + @Test + public void testPutDomainMetaThrowException() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_putdommetathrowexc"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String caller = "putdomainmeta"; + String domName = "wrongDomainName"; + DomainMeta meta = new DomainMeta(); + meta.setYpmId(getRandomProductId()); + try { + zmsImpl.putDomainMeta(mockDomRsrcCtx, domName, auditRef, meta); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(404, e.getCode()); + } + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(putdomainmeta: Unknown domain: wrongdomainname))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test(groups="post-domain-tests") + public void testPutDomainMeta() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MetaDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Domain resDom1 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); + assertNotNull(resDom1); + assertEquals(resDom1.getDescription(), "Test Domain1"); + assertEquals(resDom1.getOrg(), "testOrg"); + assertTrue(resDom1.getEnabled()); + assertFalse(resDom1.getAuditEnabled()); + + DomainMeta meta = createDomainMetaObject("Test2 Domain", "NewOrg", + false, true, "12345", 1001); + zms.putDomainMeta(mockDomRsrcCtx, "MetaDom1", auditRef, meta); + + Domain resDom3 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); + assertNotNull(resDom3); + assertEquals(resDom3.getDescription(), "Test2 Domain"); + assertEquals(resDom3.getOrg(), "NewOrg"); + assertTrue(resDom3.getEnabled()); + assertTrue(resDom3.getAuditEnabled()); + assertEquals("12345", resDom3.getAccount()); + assertEquals(Integer.valueOf(1001), resDom3.getYpmId()); + + // put the meta data using same product id + meta.setDescription("just a new desc"); + meta.setOrg("organs"); + zms.putDomainMeta(mockDomRsrcCtx, "MetaDom1", auditRef, meta); + + resDom3 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); + assertNotNull(resDom3); + assertEquals(resDom3.getDescription(), "just a new desc"); + assertEquals(resDom3.getOrg(), "organs"); + assertTrue(resDom3.getEnabled()); + assertTrue(resDom3.getAuditEnabled()); + assertEquals("12345", resDom3.getAccount()); + assertEquals(Integer.valueOf(1001), resDom3.getYpmId()); + + // put the meta data using new product + Integer newProductId = getRandomProductId(); + meta.setYpmId(newProductId); + zms.putDomainMeta(mockDomRsrcCtx, "MetaDom1", auditRef, meta); + + resDom3 = zms.getDomain(mockDomRsrcCtx, "MetaDom1"); + assertNotNull(resDom3); + assertEquals(resDom3.getDescription(), "just a new desc"); + assertEquals(resDom3.getOrg(), "organs"); + assertTrue(resDom3.getEnabled()); + assertTrue(resDom3.getAuditEnabled()); + assertEquals("12345", resDom3.getAccount()); + assertEquals(newProductId, resDom3.getYpmId()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MetaDom1", auditRef); + } + + @Test(groups="post-domain-tests") + public void testPutDomainMetaInvalid() { + + // enable product id support + + System.setProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT, "true"); + ZMSImpl zmsImpl = zmsInit(); + + TopLevelDomain dom = createTopLevelDomainObject("MetaDomProductid", + "Test Domain", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Domain resDom = zmsImpl.getDomain(mockDomRsrcCtx, "MetaDomProductid"); + assertNotNull(resDom); + assertEquals(resDom.getDescription(), "Test Domain"); + assertEquals(resDom.getOrg(), "testOrg"); + assertTrue(resDom.getEnabled()); + assertFalse(resDom.getAuditEnabled()); + Integer productId = resDom.getYpmId(); + + DomainMeta meta = createDomainMetaObject("Test2 Domain", "NewOrg", + false, true, "12345", null); + try { + zmsImpl.putDomainMeta(mockDomRsrcCtx, "MetaDomProductid", auditRef, meta); + fail("bad request exc not thrown"); + } catch (ResourceException exc) { + assertEquals(400, exc.getCode()); + assertTrue(exc.getMessage().contains("Unique Product Id must be specified for top level domain")); + } + + // put meta data using another domains productId + dom = createTopLevelDomainObject("MetaDomProductid2", + "Test Domain", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + resDom = zmsImpl.getDomain(mockDomRsrcCtx, "MetaDomProductid2"); + Integer productId2 = resDom.getYpmId(); + assertFalse(productId.intValue() == productId2.intValue()); + + meta = createDomainMetaObject("Test3 Domain", "NewOrg", + false, true, "12345", productId2); + try { + zmsImpl.putDomainMeta(mockDomRsrcCtx, "MetaDomProductid", auditRef, meta); + fail("bad request exc not thrown"); + } catch (ResourceException exc) { + assertEquals(400, exc.getCode()); + assertTrue(exc.getMessage().contains("is already assigned to domain")); + } + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "MetaDomProductid", auditRef); + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "MetaDomProductid2", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_PRODUCT_ID_SUPPORT); + } + + @Test + public void testPutDomainMetaDefaults() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MetaDom2", + null, null, adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Domain resDom1 = zms.getDomain(mockDomRsrcCtx, "MetaDom2"); + assertNotNull(resDom1); + assertNull(resDom1.getDescription()); + assertNull(resDom1.getOrg()); + assertTrue(resDom1.getEnabled()); + assertFalse(resDom1.getAuditEnabled()); + + DomainMeta meta = createDomainMetaObject("Test2 Domain", "NewOrg", + true, false, null, 0); + zms.putDomainMeta(mockDomRsrcCtx, "MetaDom2", auditRef, meta); + + Domain resDom3 = zms.getDomain(mockDomRsrcCtx, "MetaDom2"); + assertNotNull(resDom3); + assertEquals(resDom3.getDescription(), "Test2 Domain"); + assertEquals(resDom3.getOrg(), "NewOrg"); + assertTrue(resDom3.getEnabled()); + assertFalse(resDom3.getAuditEnabled()); + assertNull(resDom3.getAccount()); + assertEquals(Integer.valueOf(0), resDom3.getYpmId()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MetaDom2", auditRef); + } + + @Test + public void testPutDomainMetaMissingAuditRef() { + String domain = "testSetDomainMetaMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test1 Domain", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Domain resDom = zms.getDomain(mockDomRsrcCtx, domain); + assertNotNull(resDom); + assertEquals(resDom.getDescription(), "Test1 Domain"); + assertEquals(resDom.getOrg(), "testOrg"); + assertTrue(resDom.getAuditEnabled()); + + DomainMeta meta = createDomainMetaObject("Test2 Domain", "NewOrg", false, true, null, 0); + try { + zms.putDomainMeta(mockDomRsrcCtx, domain, null, meta); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test(groups="post-domain-tests") + public void testPutDomainMetaSubDomain() { + try { + TopLevelDomain dom = createTopLevelDomainObject("MetaDomProductid", + "Test Domain", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + } catch (ResourceException rexc) { + assertTrue(rexc.getCode() == 400); + } + + SubDomain subDom = createSubDomainObject("metaSubDom", "MetaDomProductid", + "sub Domain", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "MetaDomProductid", auditRef, subDom); + + // put meta data with null productId + DomainMeta meta = createDomainMetaObject("Test sub Domain", "NewOrg", + false, true, "12345", null); + zms.putDomainMeta(mockDomRsrcCtx, "MetaDomProductid.metaSubDom", auditRef, meta); + + // put meta data with a productId + meta = createDomainMetaObject("Test sub Domain", "NewOrg", + false, true, "12345", getRandomProductId()); + zms.putDomainMeta(mockDomRsrcCtx, "MetaDomProductid.metaSubDom", auditRef, meta); + + zms.deleteSubDomain(mockDomRsrcCtx, "MetaDomProductid", "metaSubDom", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MetaDomProductid", auditRef); + } + + @Test + public void testGetRoleList() { + + TopLevelDomain dom1 = createTopLevelDomainObject("RoleListDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("RoleListDom1", "Role1", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, "RoleListDom1", "Role1", auditRef, role1); + + Role role2 = createRoleObject("RoleListDom1", "Role2", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, "RoleListDom1", "Role2", auditRef, role2); + + RoleList roleList = zms.getRoleList(mockDomRsrcCtx, "RoleListDom1", null, null); + assertNotNull(roleList); + + assertTrue(roleList.getNames().contains("Role1".toLowerCase())); + assertTrue(roleList.getNames().contains("Role2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "RoleListDom1", auditRef); + } + + @Test + public void testGetRoleListParams() { + + TopLevelDomain dom1 = createTopLevelDomainObject("RoleListParamDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("RoleListParamDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "RoleListParamDom1", "Role1", auditRef, role1); + + Role role2 = createRoleObject("RoleListParamDom1", "Role2", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "RoleListParamDom1", "Role2", auditRef, role2); + + RoleList roleList = zms.getRoleList(mockDomRsrcCtx, "RoleListParamDom1", null, "Role1"); + assertNotNull(roleList); + + assertFalse(roleList.getNames().contains("Role1".toLowerCase())); + assertTrue(roleList.getNames().contains("Role2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "RoleListParamDom1", auditRef); + } + + @Test + public void testGetRoleListThrowException() { + try { + zms.getRoleList(mockDomRsrcCtx, "wrongDomainName", null, null); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + } + + @Test + public void testGetRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("GetRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("GetRoleDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "GetRoleDom1", "Role1", auditRef, role1); + + Role role = zms.getRole(mockDomRsrcCtx, "GetRoleDom1", "Role1", false, false); + assertNotNull(role); + + assertEquals(role.getName(), "GetRoleDom1:role.Role1".toLowerCase()); + assertNull(role.getTrust()); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 2); + + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "GetRoleDom1", auditRef); + } + + @Test + public void testGetRoleThrowException() { + String domainName = "MbrGetRoleDom1"; + String roleName = "Role1"; + + // Tests the getRole() condition: if (domain == null)... + try { + zms.getRole(mockDomRsrcCtx, domainName, roleName, false, false); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Tests the getRole() condition: if (collection == null)... + try { + // Should fail because we did not create a role resource. + zms.getRole(mockDomRsrcCtx, domainName, roleName, false, false); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + // Tests the getRole() condition: if (role == null)... + String wrongRoleName = "Role2"; + try { + Role role1 = createRoleObject(domainName, roleName, null); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + // Should fail because we are trying to find a non-existent role. + zms.getRole(mockDomRsrcCtx, domainName, wrongRoleName, false, false); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutRoleThrowException() { + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_putrolethrowexc"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domainName = "DomainName1"; + String roleName = "RoleName1"; + Role role = new Role(); + + // Tests the getRole() condition : if (!roleResourceName(domainName, roleName).equals(role.getName()))... + try { + String roleRoleName = "inconsistentRoleName1"; + role.setName(roleRoleName); + + // The role naming is inconsistent. + zmsImpl.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + boolean foundError = false; + for (String msg: aLogMsgs) { + if (!msg.contains("WHAT-api=(putrole)")) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.contains("WHAT-details=(ERROR=(putRole: Inconsistent role names - expected: domainname1:role.rolename1, actual: inconsistentrolename1))")); + foundError = true; + break; + } + assertTrue(foundError); + + aLogMsgs.clear(); + // Tests the getRole() condition : if (domain == null)... + try { + String roleRoleName = "DomainName1:role.RoleName1"; + role.setName(roleRoleName); + + // We never created a domain for this role. + zmsImpl.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(putrole)") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(putrole: Unknown domain: domainname1))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testCreateRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("CreateRoleDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "CreateRoleDom1", "Role1", auditRef, role1); + + Role role3 = zms.getRole(mockDomRsrcCtx, "CreateRoleDom1", "Role1", false, false); + assertNotNull(role3); + assertEquals(role3.getName(), "CreateRoleDom1:role.Role1".toLowerCase()); + assertNull(role3.getTrust()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "CreateRoleDom1", auditRef); + } + + @Test + public void testCreateRoleLocalNameOnly() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = new Role(); + role1.setName("role1"); + + zms.putRole(mockDomRsrcCtx, "CreateRoleDom1", "Role1", auditRef, role1); + + Role role3 = zms.getRole(mockDomRsrcCtx, "CreateRoleDom1", "Role1", false, false); + assertNotNull(role3); + assertEquals(role3.getName(), "CreateRoleDom1:role.Role1".toLowerCase()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "CreateRoleDom1", auditRef); + } + + @Test + public void testCreateRoleMissingAuditRef() { + String domain = "testCreateRoleMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Role role = createRoleObject( + domain, "Role1", null, "user.joe", "user.jane"); + try { + zms.putRole(mockDomRsrcCtx, domain, "Role1", null, role); + fail("requesterror not thrown by putRole."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testCreateRoleMismatchName() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "CreateMismatchRoleDom1", "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("CreateMismatchRoleDom1", "Role1", null, + "user.joe", "user.jane"); + + try { + zms.putRole(mockDomRsrcCtx, "CreateMismatchRoleDom1", + "CreateMismatchRoleDom1.Role1", auditRef, role1); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "CreateMismatchRoleDom1", auditRef); + } + + @Test + public void testCreateRoleInvalidName() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "CreateRoleInvalidNameDom1", "Test Domain1", "testOrg", + adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = new Role(); + role1.setName("Role1"); + + try { + zms.putRole(mockDomRsrcCtx, "CreateRoleInvalidNameDom1", "Role111", auditRef, role1); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"CreateRoleInvalidNameDom1", auditRef); + } + + @Test + public void testCreateRoleInvalidStruct() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "CreateRoleInvalidStructDom1", "Test Domain1", "testOrg", + adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = new Role(); + + try { + zms.putRole(mockDomRsrcCtx, "CreateRoleInvalidStructDom1", "Role1", auditRef, role1); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"CreateRoleInvalidStructDom1", auditRef); + } + + @Test + public void testCreateRoleInvalidMembers() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "CreateInvalidMemberRoleDom1", "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("CreateInvalidMemberRoleDom1", "Role1", null, + "user.joe", "jane"); + + try { + zms.putRole(mockDomRsrcCtx, "CreateInvalidMemberRoleDom1", "Role1", auditRef, role1); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + Role role2 = createRoleObject("CreateInvalidMemberRoleDom1", "Role2", null, + "joe", "user.jane"); + + try { + zms.putRole(mockDomRsrcCtx, "CreateInvalidMemberRoleDom1", "Role2", auditRef, role2); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"CreateInvalidMemberRoleDom1", auditRef); + } + + @Test + public void testCreateRoleBothMemberAndTrust() { + + String domainName = "rolebothmemberandtrust"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, "Role1", "sys.auth", + "user.joe", "user.jane"); + + try { + zms.putRole(mockDomRsrcCtx, domainName, "Role1", auditRef, role1); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testCreateRoleTrustItself() { + + String domainName = "roletrustitself"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, "Role1", domainName, + null, null); + + try { + zms.putRole(mockDomRsrcCtx, domainName, "Role1", auditRef, role1); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testCreateDuplicateMemberRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateDuplicateMemberRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("CreateDuplicateMemberRoleDom1", "Role1", null, + "user.joe", "user.joe"); + zms.putRole(mockDomRsrcCtx, "CreateDuplicateMemberRoleDom1", "Role1", auditRef, role1); + + Role role = zms.getRole(mockDomRsrcCtx, "CreateDuplicateMemberRoleDom1", "Role1", false, false); + assertNotNull(role); + + assertEquals(role.getName(), "CreateDuplicateMemberRoleDom1:role.Role1".toLowerCase()); + assertNull(role.getTrust()); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + assertTrue(members.get(0).equals("user.joe")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"CreateDuplicateMemberRoleDom1", auditRef); + } + + @Test + public void testCreateNormalizedUserMemberRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateNormalizedUserMemberRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ArrayList roleMembers = new ArrayList<>(); + roleMembers.add("user:joe"); + roleMembers.add("user.joe"); + roleMembers.add("user:joe"); + roleMembers.add("user.jane"); + + Role role1 = createRoleObject("CreateNormalizedUserMemberRoleDom1", "Role1", + null, roleMembers); + zms.putRole(mockDomRsrcCtx, "CreateNormalizedUserMemberRoleDom1", "Role1", auditRef, role1); + + Role role = zms.getRole(mockDomRsrcCtx, "CreateNormalizedUserMemberRoleDom1", "Role1", false, false); + assertNotNull(role); + + assertEquals(role.getName(), "CreateNormalizedUserMemberRoleDom1:role.Role1".toLowerCase()); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 2); + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"CreateNormalizedUserMemberRoleDom1", auditRef); + } + + @Test + public void testCreateNormalizedServiceMemberRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateNormalizedServiceMemberRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + SubDomain subDom3 = createSubDomainObject("user1", "user", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "user", auditRef, subDom3); + + SubDomain subDom4 = createSubDomainObject("dom1", "user.user1", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, subDom4); + + ArrayList roleMembers = new ArrayList<>(); + roleMembers.add("coretech.storage"); + roleMembers.add("coretech:service.storage"); + roleMembers.add("user.user1.dom1:service.api"); + + Role role1 = createRoleObject("CreateNormalizedServiceMemberRoleDom1", "Role1", + null, roleMembers); + zms.putRole(mockDomRsrcCtx, "CreateNormalizedServiceMemberRoleDom1", "Role1", auditRef, role1); + + Role role = zms.getRole(mockDomRsrcCtx, "CreateNormalizedServiceMemberRoleDom1", "Role1", false, false); + assertNotNull(role); + + assertEquals(role.getName(), "CreateNormalizedServiceMemberRoleDom1:role.Role1".toLowerCase()); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 2); + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("user.user1.dom1.api")); + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "dom1", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user", "user1", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx,"CreateNormalizedServiceMemberRoleDom1", auditRef); + } + + @Test + public void testCreateNormalizedCombinedMemberRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateNormalizedCombinedMemberRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + SubDomain subDom3 = createSubDomainObject("user1", "user", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "user", auditRef, subDom3); + + SubDomain subDom4 = createSubDomainObject("dom1", "user.user1", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, subDom4); + + ArrayList roleMembers = new ArrayList<>(); + roleMembers.add("user:joe"); + roleMembers.add("user.joe"); + roleMembers.add("user:joe"); + roleMembers.add("user.jane"); + roleMembers.add("coretech.storage"); + roleMembers.add("coretech:service.storage"); + roleMembers.add("user.user1.dom1:service.api"); + + Role role1 = createRoleObject("CreateNormalizedCombinedMemberRoleDom1", "Role1", + null, roleMembers); + zms.putRole(mockDomRsrcCtx, "CreateNormalizedCombinedMemberRoleDom1", "Role1", auditRef, role1); + + Role role = zms.getRole(mockDomRsrcCtx, "CreateNormalizedCombinedMemberRoleDom1", "Role1", false, false); + assertNotNull(role); + + assertEquals(role.getName(), "CreateNormalizedCombinedMemberRoleDom1:role.Role1".toLowerCase()); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 4); + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("user.user1.dom1.api")); + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "dom1", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user", "user1", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx,"CreateNormalizedCombinedMemberRoleDom1", auditRef); + } + + @Test + public void testDeleteRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("DelRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("DelRoleDom1", "Role1", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, "DelRoleDom1", "Role1", auditRef, role1); + + Role role2 = createRoleObject("DelRoleDom1", "Role2", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, "DelRoleDom1", "Role2", auditRef, role2); + + RoleList roleList = zms.getRoleList(mockDomRsrcCtx, "DelRoleDom1", null, null); + assertNotNull(roleList); + + // our role count is +1 because of the admin role + assertEquals(roleList.getNames().size(), 3); + + zms.deleteRole(mockDomRsrcCtx,"DelRoleDom1", "Role1", auditRef); + + roleList = zms.getRoleList(mockDomRsrcCtx, "DelRoleDom1", null, null); + assertNotNull(roleList); + + // our role counti is +1 because of the admin role + assertEquals(roleList.getNames().size(), 2); + + assertFalse(roleList.getNames().contains("Role1".toLowerCase())); + assertTrue(roleList.getNames().contains("Role2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"DelRoleDom1", auditRef); + } + + @Test + public void testDeleteRoleMissingAuditRef() { + String domain = "testDeleteRoleMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Role role = createRoleObject( + domain, "Role1", null, "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, domain, "Role1", auditRef, role); + + try { + zms.deleteRole(mockDomRsrcCtx, domain, "Role1", null); + fail("requesterror not thrown by deleteRole."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testDeleteRoleThrowException() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_delrolethrowexc"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String caller = "deleterole"; + String domainName = "DomainName1"; + String roleName = "RoleName1"; + try { + zmsImpl.deleteRole(mockDomRsrcCtx,domainName, roleName, auditRef); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + FileConnection.deleteDirectory(new File(storeDir)); + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deleterole: Unknown domain: domainname1))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testDeleteAdminRole() { + + TopLevelDomain dom1 = createTopLevelDomainObject("DelAdminRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + try { + zms.deleteRole(mockDomRsrcCtx,"DelAdminRoleDom1", "admin", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"DelAdminRoleDom1", auditRef); + } + + @Test + public void testGetMembership() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrGetRoleDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("MbrGetRoleDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrGetRoleDom1", "Role1", auditRef, role1); + + Membership member1 = zms.getMembership(mockDomRsrcCtx, "MbrGetRoleDom1", "Role1", + "user.joe"); + assertNotNull(member1); + assertEquals(member1.getMemberName(), "user.joe"); + assertEquals(member1.getRoleName(), "MbrGetRoleDom1:role.Role1".toLowerCase()); + assertTrue(member1.getIsMember()); + + Membership member2 = zms.getMembership(mockDomRsrcCtx, "MbrGetRoleDom1", "Role1", + "user.doe"); + assertNotNull(member2); + assertEquals(member2.getMemberName(), "user.doe"); + assertEquals(member2.getRoleName(), "MbrGetRoleDom1:role.Role1".toLowerCase()); + assertFalse(member2.getIsMember()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"MbrGetRoleDom1", auditRef); + } + + @Test + public void testGetMembershipThrowException() { + String domainName = "MbrGetRoleDom1"; + String roleName = "Role1"; + String memberName1 = "user.john"; + String memberName2 = "user.jane"; + + // Tests the getMembership() condition : if (domain == null)... + try { + // Should fail because we never created this domain. + zms.getMembership(mockDomRsrcCtx, domainName, roleName, memberName1); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Tests the getMembership() condition: if (collection == null)... + try { + // Should fail because we never added a role to this domain. + zms.getMembership(mockDomRsrcCtx, domainName, roleName, memberName1); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + // Tests the getMembership() condition: if (role == null)... + try { + String missingRoleName = "Role2"; + + Role role1 = createRoleObject("MbrGetRoleDom1", "Role1", null, + memberName1, memberName2); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + // Trying to find a non-existent role. + zms.getMembership(mockDomRsrcCtx, domainName, missingRoleName, memberName1); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx,domainName, auditRef); + } + + @Test + public void testPutMembership() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + Role role1 = createRoleObject("MbrAddDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDom1", "Role1", auditRef, role1); + + Membership mbr = generateMembership("Role1", "user.doe"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom1", "Role1", "user.doe", auditRef, mbr); + + mbr = generateMembership("Role1", "coretech.storage"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom1", "Role1", "coretech.storage", auditRef, mbr); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrAddDom1", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 4); + + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.doe")); + assertTrue(members.contains("coretech.storage")); + + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx,"MbrAddDom1", auditRef); + } + + @Test + public void testPutMembershipEmptyRoleMembers() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom1EmptyRole", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = new Role(); + role1.setName(ZMSUtils.roleResourceName("MbrAddDom1EmptyRole", "Role1")); + zms.putRole(mockDomRsrcCtx, "MbrAddDom1EmptyRole", "Role1", auditRef, role1); + + Membership mbr = generateMembership("Role1", "user.doe"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom1EmptyRole", "Role1", "user.doe", auditRef, mbr); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrAddDom1EmptyRole", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + + assertTrue(members.contains("user.doe")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx,"MbrAddDom1EmptyRole", auditRef); + } + + @Test + public void testPutMembershipMissingAuditRef() { + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_putmembershipmissauditref"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domain = "testPutMembershipMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Role role = createRoleObject( + domain, "Role1", null, "user.joe", "user.jane"); + zmsImpl.putRole(mockDomRsrcCtx, domain, "Role1", auditRef, role); + + Membership mbr = generateMembership("Role1", "user.john"); + try { + zmsImpl.putMembership(mockDomRsrcCtx, domain, "Role1", "user.john", null, mbr); + fail("requesterror not thrown by putMembership."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + + String caller = "putmembership"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(putmembership: Audit reference required for domain: testputmembershipmissingauditref);:caller specified memberName=(user.john))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testPutMembershipNormalizedUser() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom2", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + Role role1 = createRoleObject("MbrAddDom2", "Role1", null, + "coretech.storage", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDom2", "Role1", auditRef, role1); + + Membership mbr = generateMembership("Role1", "user:doe"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom2", "Role1", "user:doe", auditRef, mbr); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrAddDom2", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 3); + + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.doe")); + + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrAddDom2", auditRef); + } + + @Test + public void testPutMembershipNormalizedUseruser() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom3", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + Role role1 = createRoleObject("MbrAddDom3", "Role1", null, + "coretech.storage", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDom3", "Role1", auditRef, role1); + + Membership mbr = generateMembership("Role1", "user:doe"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom3", "Role1", "user:doe", auditRef, mbr); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrAddDom3", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 3); + + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.doe")); + + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrAddDom3", auditRef); + } + + @Test + public void testPutMembershipNormalizedService() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom4", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + TopLevelDomain dom3 = createTopLevelDomainObject("weather", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom3); + + SubDomain subDom3 = createSubDomainObject("storage", "weather", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "weather", auditRef, subDom3); + + Role role1 = createRoleObject("MbrAddDom4", "Role1", null, + "coretech.storage", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDom4", "Role1", auditRef, role1); + + Membership mbr = generateMembership("Role1", "weather:service.storage"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom4", "Role1", "weather:service.storage", auditRef, mbr); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrAddDom4", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 3); + + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("weather.storage")); + + zms.deleteSubDomain(mockDomRsrcCtx, "weather", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "weather", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrAddDom4", auditRef); + } + + public void testPutMembershipRoleNotPresent() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDomNoRole", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + Role role1 = createRoleObject("MbrAddDomNoRole", "Role1", null, + "coretech.storage", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDomNoRole", "Role1", auditRef, role1); + + // membership object with only member + + Membership mbr = new Membership(); + mbr.setMemberName("user.joe"); + + zms.putMembership(mockDomRsrcCtx, "MbrAddDomNoRole", "Role1", "user.joe", auditRef, mbr); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrAddDomNoRole", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 3); + + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("user.joe")); + + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrAddDomNoRole", auditRef); + } + + @Test + public void testPutMembershipInvalid() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom5", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("MbrAddDom5", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDom5", "Role1", auditRef, role1); + try { + Membership mbr = generateMembership("Role1", "coretech"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom5", "Role1", "coretech", auditRef, mbr); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrAddDom5", auditRef); + } + + @Test + public void testPutMembershipRoleMismatch() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom6", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("MbrAddDom6", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDom6", "Role1", auditRef, role1); + try { + Membership mbr = generateMembership("Role2", "user.john"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom6", "Role1", "user.john", auditRef, mbr); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrAddDom6", auditRef); + } + + @Test + public void testPutMembershipMemberMismatch() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrAddDom7", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("MbrAddDom7", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrAddDom7", "Role1", auditRef, role1); + try { + Membership mbr = generateMembership("Role1", "user.john"); + zms.putMembership(mockDomRsrcCtx, "MbrAddDom7", "Role1", "user.johnny", auditRef, mbr); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrAddDom7", auditRef); + } + + @Test + public void testPutMembershipThrowException() { + String domainName = "MbrGetRoleDom1"; + String roleName = "Role1"; + String memberName1 = "user.john"; + String memberName2 = "user.jane"; + String wrongDomainName = "MbrGetRoleDom2"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Tests the putMembership() condition : if (domain == null)... + try { + // Trying to add a wrong domain name. + Membership mbr = generateMembership(roleName, memberName1); + zms.putMembership(mockDomRsrcCtx, wrongDomainName, roleName, memberName1, auditRef, mbr); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + // Tests the putMembership() condition: if (collection == null)... + try { + // Should fail because we never added a role resource. + Membership mbr = generateMembership(roleName, memberName1); + zms.putMembership(mockDomRsrcCtx, domainName, roleName, memberName1, auditRef, mbr); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + // Tests the putMembership() condition: if (role == null)... + try { + String wrongRoleName = "Role2"; + + Role role1 = createRoleObject(domainName, roleName, null, + memberName1, memberName2); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + // Trying to add member to non-existent role. + Membership mbr = generateMembership(wrongRoleName, memberName1); + zms.putMembership(mockDomRsrcCtx, domainName, wrongRoleName, memberName1, auditRef, mbr); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteMembership() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrDelDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("MbrDelDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", auditRef, role1); + zms.deleteMembership(mockDomRsrcCtx, "MbrDelDom1", "Role1", "user.joe", auditRef); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + + assertFalse(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrDelDom1", auditRef); + } + + @Test + public void testDeleteMembershipMissingAuditRef() { + String domain = "testDeleteMembershipMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Role role = createRoleObject( + domain, "Role1", null, "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, domain, "Role1", auditRef, role); + + try { + zms.deleteMembership(mockDomRsrcCtx, domain, "Role1", "user.joe", null); + fail("requesterror not thrown by deleteMembership."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testDeleteMembershipInvalidDomain() { + String domainName = "MbrGetRoleDom1"; + String roleName = "Role1"; + String memberName1 = "user.john"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Tests the deleteMembership() condition : if (domain == null)... + try { + String wrongDomainName = "MbrGetRoleDom2"; + + // Should fail because this domain does not exist. + zms.deleteMembership(mockDomRsrcCtx, wrongDomainName, roleName, memberName1, auditRef); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteMembershipInvalidRoleCollection() { + String domainName = "MbrGetRoleDom1"; + String roleName = "Role1"; + String memberName1 = "user.john"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Test the deleteMembership() condition: if (collection == null)... + try { + // Should fail b/c a role entity was never added. + zms.deleteMembership(mockDomRsrcCtx, domainName, roleName, memberName1, auditRef); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteMembershipInvalidRole() { + String domainName = "MbrGetRoleDom1"; + String roleName = "Role1"; + String memberName1 = "user.john"; + String memberName2 = "user.jane"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Tests the deleteMembership() condition: if (role == null)... + try { + String wrongRoleName = "Role2"; + Role role1 = createRoleObject(domainName, roleName, null, + memberName1, memberName2); + zms.putRole(mockDomRsrcCtx, domainName, roleName, auditRef, role1); + + // Should fail b/c trying to find a non-existent role. + zms.deleteMembership(mockDomRsrcCtx, domainName, wrongRoleName, memberName1, auditRef); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteMembershipAdminRoleSingleMember() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_delmembershipadminrsm"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String caller = "deletemembership"; + String domainName = "MbrGetRoleDom1"; + String memberName1 = "user.john"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Test the deleteMembership() condition: if ("admin".equals(roleName))... + try { + String adminRoleName = "admin"; + + List members = new ArrayList(); + members.add(memberName1); + Role role1 = createRoleObject(domainName, adminRoleName, null, members); + zmsImpl.putRole(mockDomRsrcCtx, domainName, adminRoleName, auditRef, role1); + + // Can not delete the last admin role. + zmsImpl.deleteMembership(mockDomRsrcCtx, domainName, adminRoleName, memberName1, auditRef); + fail("forbiddenerror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 403); + } + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deletemembership: Cannot delete last member of 'admin' role);:caller specified memberName=(user.john))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteMembershipNormalizedUser() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrDelDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("MbrDelDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", auditRef, role1); + zms.deleteMembership(mockDomRsrcCtx, "MbrDelDom1", "Role1", "user:joe", auditRef); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + + assertFalse(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrDelDom1", auditRef); + } + + @Test + public void testDeleteMembershipNormalizeduser() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrDelDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("MbrDelDom1", "Role1", null, + "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", auditRef, role1); + zms.deleteMembership(mockDomRsrcCtx, "MbrDelDom1", "Role1", "user:joe", auditRef); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + + assertFalse(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrDelDom1", auditRef); + } + + @Test + public void testDeleteMembershipNormalizedService() { + + TopLevelDomain dom1 = createTopLevelDomainObject("MbrDelDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("coretech", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + SubDomain subDom2 = createSubDomainObject("storage", "coretech", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "coretech", auditRef, subDom2); + + Role role1 = createRoleObject("MbrDelDom1", "Role1", null, + "user.joe", "coretech.storage"); + zms.putRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", auditRef, role1); + zms.deleteMembership(mockDomRsrcCtx, "MbrDelDom1", "Role1", "coretech:service.storage", auditRef); + + Role role = zms.getRole(mockDomRsrcCtx, "MbrDelDom1", "Role1", false, false); + assertNotNull(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + + assertTrue(members.contains("user.joe")); + + zms.deleteSubDomain(mockDomRsrcCtx, "coretech", "storage", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "MbrDelDom1", auditRef); + } + + @Test + public void testGetPolicyList() { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyListDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject("PolicyListDom1", "Policy1"); + zms.putPolicy(mockDomRsrcCtx, "PolicyListDom1", "Policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject("PolicyListDom1", "Policy2"); + zms.putPolicy(mockDomRsrcCtx, "PolicyListDom1", "Policy2", auditRef, policy2); + + PolicyList policyList = zms.getPolicyList(mockDomRsrcCtx, "PolicyListDom1", null, null); + assertNotNull(policyList); + + // policy count +1 due to admin policy + assertEquals(policyList.getNames().size(), 3); + + assertTrue(policyList.getNames().contains("Policy1".toLowerCase())); + assertTrue(policyList.getNames().contains("Policy2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyListDom1", auditRef); + } + + @Test + public void testGetPolicyListParams() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "PolicyListParamsDom1", "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject("PolicyListParamsDom1", "Policy1"); + zms.putPolicy(mockDomRsrcCtx, "PolicyListParamsDom1", "Policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject("PolicyListParamsDom1", "Policy2"); + zms.putPolicy(mockDomRsrcCtx, "PolicyListParamsDom1", "Policy2", auditRef, policy2); + + PolicyList policyList = zms.getPolicyList(mockDomRsrcCtx, "PolicyListParamsDom1", null, + "Policy1"); + assertNotNull(policyList); + + assertFalse(policyList.getNames().contains("Policy1".toLowerCase())); + assertTrue(policyList.getNames().contains("Policy2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyListParamsDom1", auditRef); + } + + @Test + public void testGetPolicyListThrowException() { + try { + zms.getPolicyList(mockDomRsrcCtx, "WrongDomainName", null, null); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + } + + @Test + public void testGetPolicy() { + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_getpol"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyGetDom1", + "Test Domain1", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject("PolicyGetDom1", "Policy1"); + zmsImpl.putPolicy(mockDomRsrcCtx, "PolicyGetDom1", "Policy1", auditRef, policy1); + + Policy policy = zmsImpl.getPolicy(mockDomRsrcCtx, "PolicyGetDom1", "Policy1"); + assertNotNull(policy); + assertEquals(policy.getName(), "PolicyGetDom1:policy.Policy1".toLowerCase()); + + List assertList = policy.getAssertions(); + assertNotNull(assertList); + assertEquals(assertList.size(), 1); + Assertion obj = assertList.get(0); + assertEquals(obj.getAction(), "*"); + assertEquals(obj.getEffect(), AssertionEffect.ALLOW); + assertEquals(obj.getResource(), "policygetdom1:*"); + assertEquals(obj.getRole(), "PolicyGetDom1:role.Role1".toLowerCase()); + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(putpolicy)") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + int index = msg.indexOf("WHAT-details=("); + assertTrue(msg, index != -1); + int index2 = msg.indexOf("role: \"policygetdom1:role.role1\""); + assertTrue(msg, index < index2); + index2 = msg.indexOf("ERROR"); + assertTrue(msg, index2 == -1); + foundError = true; + break; + } + assertTrue(foundError); + + // this should throw an exception + try { + zmsImpl.getPolicy(mockDomRsrcCtx, "PolicyGetDom1", "Policy2"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyGetDom1", auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testGetPolicyThrowException() { + String domainName = "PolicyGetDom1"; + String policyName = "Policy1"; + + // Tests the getPolicy() condition : if (domain == null)... + try { + zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Tests the getPolicy() condition: if (collection == null)... + try { + // Should fail b/c a policy was never added. + zms.getPolicy(mockDomRsrcCtx, domainName, policyName); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + // Tests the getPolicy() condition: if (policy == null)... + try { + String wrongPolicyName = "Policy2"; + + Policy policy1 = createPolicyObject(domainName, policyName); + zms.putPolicy(mockDomRsrcCtx, domainName, policyName, auditRef, policy1); + + // Should fail b/c trying to find a non-existent policy. + zms.getPolicy(mockDomRsrcCtx, domainName, wrongPolicyName); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutPolicyThrowException() { + String domainName = "DomainName"; + String policyName = "PolicyName"; + String wrongPolicyName = "WrongPolicyName"; + + // Tests the putPolicy() condition : if (!policyResourceName(domainName, policyName).equals(policy.getName()))... + try { + Policy policy = createPolicyObject(domainName, wrongPolicyName); + + // policyName should not be the same as policy.getName() + zms.putPolicy(mockDomRsrcCtx, domainName, policyName, auditRef, policy); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + + // Tests the putPolicy() condition: if (domain == null)... + try { + Policy policy = createPolicyObject(domainName, policyName); + + // should fail b/c we never created a top level domain. + zms.putPolicy(mockDomRsrcCtx, domainName, policyName, auditRef, policy); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + } + + @Test + public void testCreatePolicy() { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyAddDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject("PolicyAddDom1", "Policy1"); + zms.putPolicy(mockDomRsrcCtx, "PolicyAddDom1", "Policy1", auditRef, policy1); + + Policy policyRes2 = zms.getPolicy(mockDomRsrcCtx, "PolicyAddDom1", "Policy1"); + assertNotNull(policyRes2); + assertEquals(policyRes2.getName(), "PolicyAddDom1:policy.Policy1".toLowerCase()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyAddDom1", auditRef); + } + + @Test + public void testCreatePolicyWithLocalName() { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyAddDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = new Policy(); + policy.setName("policy1"); + + Assertion assertion = new Assertion(); + assertion.setAction("read"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("policyadddom1:*"); + assertion.setRole("policyadddom1:role.admin"); + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + + zms.putPolicy(mockDomRsrcCtx, "PolicyAddDom1", "Policy1", auditRef, policy); + + Policy policyRes2 = zms.getPolicy(mockDomRsrcCtx, "PolicyAddDom1", "Policy1"); + assertNotNull(policyRes2); + assertEquals(policyRes2.getName(), "PolicyAddDom1:policy.Policy1".toLowerCase()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyAddDom1", auditRef); + } + + @Test + public void testCreatePolicyMissingAuditRef() { + String domain = "testCreatePolicyMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Policy policy = createPolicyObject(domain, "Policy1"); + try { + zms.putPolicy(mockDomRsrcCtx, domain, "Policy1", null, policy); + fail("requesterror not thrown by putPolicy."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testPutPolicyChanges() { + String domain = "PutPolicyChanges"; + String policyName = "Jobs"; + TopLevelDomain dom1 = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject(domain, policyName); + List origAsserts = policy1.getAssertions(); + + String userId = "hank"; + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String unsignedCreds = "v=U1;d=user;n=" + userId; + Principal principal = SimplePrincipal.create("user", userId, unsignedCreds + ";s=signature", + 0, principalAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); + + ResourceContext rsrcCtx1 = createResourceContext(principal); + zms.putPolicy(rsrcCtx1, domain, policyName, auditRef, policy1); + + Policy policyRes1A = zms.getPolicy(mockDomRsrcCtx, domain, policyName); + List resAsserts = policyRes1A.getAssertions(); + + // check assertions are the same - should only be 1 + assertEquals(origAsserts.size(), resAsserts.size()); + + // now replace the old assertion with a new ones + // + Assertion assertionA = new Assertion(); + assertionA.setResource(domain + ":books"); + assertionA.setAction("READ"); + assertionA.setRole(domain + ":role.librarian"); + assertionA.setEffect(AssertionEffect.ALLOW); + + Assertion assertionB = new Assertion(); + assertionB.setResource(domain + ":jupiter"); + assertionB.setAction("TRAVEL"); + assertionB.setRole(domain + ":role.astronaut"); + assertionB.setEffect(AssertionEffect.ALLOW); + + List newAssertions = new ArrayList(); + newAssertions.add(assertionA); + newAssertions.add(assertionB); + + policyRes1A.setAssertions(newAssertions); + + zms.putPolicy(mockDomRsrcCtx, domain, policyName, auditRef, policyRes1A); + + Policy policyRes1B = zms.getPolicy(mockDomRsrcCtx, domain, policyName); + List resAssertsB = policyRes1B.getAssertions(); + + // check assertions are the same - should be 2 + assertEquals(newAssertions.size(), resAssertsB.size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + + @Test + public void testPutAdminPolicyRejection() { + + String domain = "put-admin-rejection"; + + TopLevelDomain dom1 = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domain, "admin"); + try { + zms.putPolicy(mockDomRsrcCtx, domain, "admin", auditRef, policy); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage(), ex.getMessage().contains("admin policy cannot be modified")); + } + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + + @Test + public void testCreatePolicyNoAssertions() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "testCreatePolicyNoAssertions", "Test Domain1", "testOrg", + adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = new Policy(); + policy1.setName(ZMSUtils.policyResourceName("testCreatePolicyNoAssertions", + "Policy1")); + + try { + zms.putPolicy(mockDomRsrcCtx, "testCreatePolicyNoAssertions", "Policy1", auditRef, policy1); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "testCreatePolicyNoAssertions", auditRef); + } + + @Test + public void testPutPolicyInvalidAssertionResources() { + + String domainName = "InvalidAssertionResources"; + String policyName = "Policy1"; + + TopLevelDomain dom1 = createTopLevelDomainObject( + domainName, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = new Policy(); + policy.setName(ZMSUtils.policyResourceName(domainName, policyName)); + + // assertion missing domain name + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("resource1"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "role1")); + + List assertList = new ArrayList(); + assertList.add(assertion); + policy.setAssertions(assertList); + + try { + zms.putPolicy(mockDomRsrcCtx, domainName, policyName, auditRef, policy); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // assertion with invalid domain name + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain name:resource1"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "role1")); + + assertList.clear(); + assertList.add(assertion); + policy.setAssertions(assertList); + + try { + zms.putPolicy(mockDomRsrcCtx, domainName, policyName, auditRef, policy); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testCreatePolicyMismatchName() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "PolicyAddMismatchNameDom1", "Test Domain1", "testOrg", + adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject("PolicyAddMismatchNameDom1", + "Policy1"); + + try { + zms.putPolicy(mockDomRsrcCtx, "PolicyAddMismatchNameDom1", + "PolicyAddMismatchNameDom1.Policy1", auditRef, policy1); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyAddMismatchNameDom1", auditRef); + } + + @Test + public void testCreatePolicyInvalidName() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "PolicyAddInvalidNameDom1", "Test Domain1", "testOrg", + adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = new Policy(); + policy.setName("Policy1"); + + try { + zms.putPolicy(mockDomRsrcCtx, "PolicyAddInvalidNameDom1", "Policy1", auditRef, policy); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyAddInvalidNameDom1", auditRef); + } + + @Test + public void testCreatePolicyInvalidStruct() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "PolicyAddInvalidStructDom1", "Test Domain1", "testOrg", + adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = new Policy(); + + try { + zms.putPolicy(mockDomRsrcCtx, "PolicyAddInvalidStructDom1", "Policy1", auditRef, policy); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyAddInvalidStructDom1", auditRef); + } + + @Test + public void testDeletePolicy() { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyDelDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject("PolicyDelDom1", "Policy1"); + zms.putPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject("PolicyDelDom1", "Policy2"); + zms.putPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy2", auditRef, policy2); + + Policy policyRes1 = zms.getPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy1"); + assertNotNull(policyRes1); + + Policy policyRes2 = zms.getPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy2"); + assertNotNull(policyRes2); + + zms.deletePolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy1", auditRef); + + // we need to get an exception here + try { + zms.getPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + policyRes2 = zms.getPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy2"); + assertNotNull(policyRes2); + + zms.deletePolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy2", auditRef); + + // we need to get an exception here + try { + zms.getPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + // we need to get an exception here + try { + zms.getPolicy(mockDomRsrcCtx, "PolicyDelDom1", "Policy2"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyDelDom1", auditRef); + } + + @Test + public void testDeletePolicyThrowException() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_delpolhrowexc"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String caller = "deletepolicy"; + String domainName = "WrongDomainName"; + String policyName = "WrongPolicyName"; + try { + zmsImpl.deletePolicy(mockDomRsrcCtx, domainName, policyName, auditRef); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + FileConnection.deleteDirectory(new File(storeDir)); + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deletepolicy: Unknown domain: wrongdomainname))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testDeleteAdminPolicy() { + + TopLevelDomain dom1 = createTopLevelDomainObject("PolicyAdminDelDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + try { + zms.deletePolicy(mockDomRsrcCtx, "PolicyAdminDelDom1", "admin", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "PolicyAdminDelDom1", auditRef); + } + + @Test + public void testDeletePolicyMissingAuditRef() { + // create a new policy without an auditref + String domain = "testDeletePolicyMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, null, null, adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + try { + zms.deletePolicy(mockDomRsrcCtx, domain, "Policy1", null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testCreateServiceIdentity() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceAddDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceAddDom1", "Service1", auditRef, service); + + ServiceIdentity serviceRes2 = zms.getServiceIdentity(mockDomRsrcCtx, "ServiceAddDom1", + "Service1"); + assertNotNull(serviceRes2); + assertEquals(serviceRes2.getName(), "ServiceAddDom1.Service1".toLowerCase()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceAddDom1", auditRef); + } + + @Test + public void testCreateServiceIdentityNotSimpleName() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_createsvcidnosimplename"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddDom1NotSimpleName", + "Test Domain1", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceAddDom1NotSimpleName", + "Service1.Test", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + try { + zmsImpl.putServiceIdentity(mockDomRsrcCtx, "ServiceAddDom1NotSimpleName", "Service1.Test", auditRef, service); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + String caller = "putserviceidentity"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + if (msg.indexOf("ERROR") == -1) { + continue; + } + assertTrue(msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + int index = msg.indexOf("WHAT-details=(ERROR=(Invalid SimpleName error: String pattern mismatch (expected \"[a-zA-Z0-9_][a-zA-Z0-9_-]*\") for type SimpleName in data)"); + assertTrue(index != -1); + foundError = true; + break; + } + assertTrue(foundError); + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceAddDom1NotSimpleName", auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testCreateServiceIdentityMissingAuditRef() { + String domain = "testCreateServiceIdentityMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + ServiceIdentity service = createServiceObject( + domain, + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + try { + zms.putServiceIdentity(mockDomRsrcCtx, domain, "Service1", null, service); + fail("requesterror not thrown by putServiceIdentity."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testCreateServiceIdentityMismatchName() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddMismatchNameDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceAddMismatchNameDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + try { + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceAddMismatchNameDom1", + "ServiceAddMismatchNameDom1.Service1", auditRef, service); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceAddMismatchNameDom1", auditRef); + } + + @Test + public void testCreateServiceIdentityInvalidName() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddInvalidNameDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("Service1"); + + try { + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceAddInvalidNameDom1", "Service1", auditRef, service); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceAddInvalidNameDom1", auditRef); + } + + @Test + public void testCreateServiceIdentityInvalidCert() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddInvalidCertDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = new ServiceIdentity(); + service.setName(ZMSUtils.serviceResourceName("ServiceAddInvalidCertDom1", "Service1")); + List pubKeys = new ArrayList<>(); + pubKeys.add(new PublicKeyEntry().setId("0").setKey("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTk")); + service.setPublicKeys(pubKeys); + + try { + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceAddInvalidCertDom1", "Service1", auditRef, service); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceAddInvalidCertDom1", auditRef); + } + + @Test + public void testCreateServiceIdentityInvalidStruct() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceAddInvalidStructDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = new ServiceIdentity(); + + try { + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceAddInvalidStructDom1", "Service1", auditRef, service); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceAddInvalidStructDom1", auditRef); + } + + @Test + public void testPutServiceIdentityThrowException() { + String domainName = "DomainName"; + String serviceName = "ServiceName"; + String wrongServiceName = "WrongServiceName"; + + // Tests the putServiceIdentity() condition: if (!serviceResourceName(domainName, serviceName).equals(detail.getName()))... + try { + ServiceIdentity detail = createServiceObject(domainName, + wrongServiceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + // serviceName should not rendered to be the same as domainName:service.wrongServiceName + zms.putServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef, detail); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + + // Tests the putServiceIdentity() condition: if (domain == null)... + try { + ServiceIdentity detail = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + // should fail b/c we never created a top level domain. + zms.putServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef, detail); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + } + + @Test + public void testGetServiceIdentity() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceGetDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceGetDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceGetDom1", "Service1", auditRef, service); + + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, "ServiceGetDom1", + "Service1"); + assertNotNull(serviceRes); + assertEquals(serviceRes.getName(), "ServiceGetDom1.Service1".toLowerCase()); + assertEquals(serviceRes.getExecutable(), "/usr/bin/java"); + assertEquals(serviceRes.getGroup(), "users"); + assertEquals(serviceRes.getProviderEndpoint().toString(), + "http://localhost"); + assertEquals(serviceRes.getUser(), "root"); + + List hosts = serviceRes.getHosts(); + assertNotNull(hosts); + assertEquals(hosts.size(), 1); + assertEquals(hosts.get(0), "host1"); + + // this should throw a not found exception + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceGetDom1", "Service2"); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 404); + } + + // this should throw a request error exception + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceGetDom1", "Service2.Service3"); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceGetDom1", auditRef); + } + + @Test + public void testGetServiceIdentityThrowException() { + String domainName = "ServiceGetDom1"; + String serviceName = "Service1"; + + // Tests the getServiceIdentity() condition : if (domain == null)... + try { + // Should fail because we never created this domain. + zms.getServiceIdentity(mockDomRsrcCtx, domainName, serviceName); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // Tests the getServiceIdentity() condition : if (collection == null)... + try { + // Should fail because we never added a service identity to this domain. + zms.getServiceIdentity(mockDomRsrcCtx, domainName, serviceName); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + // Tests the getServiceIdentity() condition : if (service == null)... + try { + String wrongServiceName = "Service2"; + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef, service); + + // Should fail because trying to find a non-existent service identity. + zms.getServiceIdentity(mockDomRsrcCtx, domainName, wrongServiceName); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteServiceIdentity() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceDelDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject("ServiceDelDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject("ServiceDelDom1", + "Service2", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service2", auditRef, service2); + + ServiceIdentity serviceRes1 = zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", + "Service1"); + assertNotNull(serviceRes1); + + ServiceIdentity serviceRes2 = zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", + "Service2"); + assertNotNull(serviceRes2); + + zms.deleteServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service1", auditRef); + + // this should throw a not found exception + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service1"); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 404); + } + + serviceRes2 = zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service2"); + assertNotNull(serviceRes2); + + zms.deleteServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service2", auditRef); + + // this should throw a not found exception + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service1"); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 404); + } + + // this should throw a not found exception + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service2"); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 404); + } + + // this should throw an invalid exception + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelDom1", "Service2.Service3"); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceDelDom1", auditRef); + } + + @Test + public void testDeleteServiceIdentityMissingAuditRef() { + String domain = "testDeleteServiceIdentityMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + ServiceIdentity service = createServiceObject( + domain, + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domain, "Service1", auditRef, service); + ServiceIdentity serviceRes = + zms.getServiceIdentity(mockDomRsrcCtx, domain, "Service1"); + assertNotNull(serviceRes); + try { + zms.deleteServiceIdentity(mockDomRsrcCtx, domain, "Service1", null); + fail("requesterror not thrown by deleteServiceIdentity."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testDeleteServiceIdentityThrowException() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_delsvcidthrowexc"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String caller = "deleteserviceidentity"; + String domainName = "WrongDomainName"; + String serviceName = "WrongServiceName"; + try { + zmsImpl.deleteServiceIdentity(mockDomRsrcCtx, domainName, serviceName, auditRef); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deleteserviceidentity: Unknown domain: wrongdomainname))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testGetServiceIdentityList() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceListDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject("ServiceListDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceListDom1", "Service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject("ServiceListDom1", + "Service2", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceListDom1", "Service2", auditRef, service2); + + ServiceIdentityList serviceList = zms.getServiceIdentityList( + mockDomRsrcCtx, "ServiceListDom1", null, null); + assertNotNull(serviceList); + assertEquals(serviceList.getNames().size(), 2); + + assertTrue(serviceList.getNames().contains("Service1".toLowerCase())); + assertTrue(serviceList.getNames().contains("Service2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceListDom1", auditRef); + } + + @Test + public void testGetServiceIdentityListParams() { + + TopLevelDomain dom1 = createTopLevelDomainObject( + "ServiceListParamsDom1", "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject("ServiceListParamsDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceListParamsDom1", "Service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject("ServiceListParamsDom1", + "Service2", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceListParamsDom1", "Service2", auditRef, service2); + + ServiceIdentityList serviceList = zms.getServiceIdentityList( + mockDomRsrcCtx, "ServiceListParamsDom1", 1, null); + assertNotNull(serviceList); + assertEquals(serviceList.getNames().size(), 1); + + serviceList = zms.getServiceIdentityList(mockDomRsrcCtx, "ServiceListParamsDom1", null, + "Service1"); + assertNotNull(serviceList); + assertEquals(serviceList.getNames().size(), 1); + + assertFalse(serviceList.getNames().contains("Service1".toLowerCase())); + assertTrue(serviceList.getNames().contains("Service2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceListParamsDom1", auditRef); + } + + @Test + public void testGetServiceIdentityListThrowException() { + String domainName = "WrongDomainName"; + try { + zms.getServiceIdentityList(mockDomRsrcCtx, domainName, null, null); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + } + + @Test + public void testGetEntity() { + + TopLevelDomain dom1 = createTopLevelDomainObject("GetEntityDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Entity entity1 = createEntityObject("Entity1"); + zms.putEntity(mockDomRsrcCtx, "GetEntityDom1", "Entity1", auditRef, entity1); + + Entity entity2 = zms.getEntity(mockDomRsrcCtx, "GetEntityDom1", "Entity1"); + assertNotNull(entity2); + + assertEquals(entity2.getName(), "Entity1".toLowerCase()); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "GetEntityDom1", auditRef); + } + + @Test + public void testGetEntityThrowException() { + try { + zms.getEntity(mockDomRsrcCtx, "wrongDomainName", "wrongEntityName"); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + } + + @Test + public void testCreateEntity() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CreateEntityDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Entity entity1 = createEntityObject("Entity1"); + zms.putEntity(mockDomRsrcCtx, "CreateEntityDom1", "Entity1", auditRef, entity1); + + Entity entity2 = zms.getEntity(mockDomRsrcCtx, "CreateEntityDom1", "Entity1"); + assertNotNull(entity2); + assertEquals(entity2.getName(), "Entity1".toLowerCase()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "CreateEntityDom1", auditRef); + } + + @Test + public void testListEntity() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ListEntityDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + EntityList entityList = zms.getEntityList(mockDomRsrcCtx, "ListEntityDom1"); + assertNotNull(entityList); + assertEquals(0, entityList.getNames().size()); + + Entity entity1 = createEntityObject("Entity1"); + zms.putEntity(mockDomRsrcCtx, "ListEntityDom1", "Entity1", auditRef, entity1); + + entityList = zms.getEntityList(mockDomRsrcCtx, "ListEntityDom1"); + assertNotNull(entityList); + assertEquals(1, entityList.getNames().size()); + assertTrue(entityList.getNames().contains("entity1")); + + Entity entity2 = createEntityObject("Entity2"); + zms.putEntity(mockDomRsrcCtx, "ListEntityDom1", "Entity2", auditRef, entity2); + + entityList = zms.getEntityList(mockDomRsrcCtx, "ListEntityDom1"); + assertNotNull(entityList); + assertEquals(2, entityList.getNames().size()); + assertTrue(entityList.getNames().contains("entity1")); + assertTrue(entityList.getNames().contains("entity2")); + + zms.deleteEntity(mockDomRsrcCtx, "ListEntityDom1", "entity1", auditRef); + + entityList = zms.getEntityList(mockDomRsrcCtx, "ListEntityDom1"); + assertNotNull(entityList); + assertEquals(1, entityList.getNames().size()); + assertTrue(entityList.getNames().contains("entity2")); + + zms.deleteEntity(mockDomRsrcCtx, "ListEntityDom1", "entity2", auditRef); + + entityList = zms.getEntityList(mockDomRsrcCtx, "ListEntityDom1"); + assertNotNull(entityList); + assertEquals(0, entityList.getNames().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListEntityDom1", auditRef); + } + + @Test + public void testCreateEntityMissingAuditRef() { + String domain = "testCreateEntityMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Entity entity = createEntityObject("Entity1"); + try { + zms.putEntity(mockDomRsrcCtx, domain, "Entity1", null, entity); + fail("requesterror not thrown by putEntity."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testCreateEntityReservedNames() { + // create the weather domain + + TopLevelDomain dom = createTopLevelDomainObject("EntityReservedNames", + "Test entity", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Role role = createRoleObject("EntityReservedNames", "Role1", null, null, null); + zms.putRole(mockDomRsrcCtx, "EntityReservedNames", "Role1", auditRef, role); + + Policy policy = createPolicyObject("EntityReservedNames", "Policy1", + "Role1", "READ", "EntityReservedNames:*", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "EntityReservedNames", "Policy1", auditRef, policy); + + ServiceIdentity service = createServiceObject("EntityReservedNames", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "EntityReservedNames", "Service1", auditRef, service); + + Entity entity = createEntityObject("role"); + try { + zms.putEntity(mockDomRsrcCtx, "EntityReservedNames", "role", auditRef, entity); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + entity = createEntityObject("policy"); + try { + zms.putEntity(mockDomRsrcCtx, "EntityReservedNames", "policy", auditRef, entity); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + entity = createEntityObject("service"); + try { + zms.putEntity(mockDomRsrcCtx, "EntityReservedNames", "service", auditRef, entity); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + Role roleRes = zms.getRole(mockDomRsrcCtx, "EntityReservedNames", "Role1", false, false); + assertNotNull(roleRes); + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, "EntityReservedNames", "Policy1"); + assertNotNull(policyRes); + + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, "EntityReservedNames", "Service1"); + assertNotNull(serviceRes); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "EntityReservedNames", auditRef); + } + + @Test + public void testDeleteEntity() { + + TopLevelDomain dom1 = createTopLevelDomainObject("DelEntityDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Entity entity1 = createEntityObject("Entity1"); + zms.putEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity1", auditRef, entity1); + + Entity entity2 = createEntityObject("Entity2"); + zms.putEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity2", auditRef, entity2); + + Entity entityRes = zms.getEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity1"); + assertNotNull(entityRes); + + entityRes = zms.getEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity2"); + assertNotNull(entityRes); + + zms.deleteEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity1", auditRef); + + try { + entityRes = zms.getEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + entityRes = zms.getEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity2"); + assertNotNull(entityRes); + + zms.deleteEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity2", auditRef); + + try { + entityRes = zms.getEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + try { + entityRes = zms.getEntity(mockDomRsrcCtx, "DelEntityDom1", "Entity2"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "DelEntityDom1", auditRef); + } + + @Test + public void testDeleteEntityMissingAuditRef() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_delentitymissauditref"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domain = "testDeleteEntityMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Entity entity = createEntityObject("Entity1"); + zmsImpl.putEntity(mockDomRsrcCtx, domain, "Entity1", auditRef, entity); + + try { + zmsImpl.deleteEntity(mockDomRsrcCtx, domain, "Entity1", null); + fail("requesterror not thrown by deleteEntity."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + + String caller = "deleteentity"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deleteentity: Audit reference required for domain: testdeleteentitymissingauditref))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } finally { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + } + + @Test + public void testGetUserToken() { + + // Use real Principal Authority to verify signatures + PrincipalAuthority principalAuthority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + principalAuthority.setKeyStore(zms); + + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + + String userId = "george"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", + 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + zms.privateKeyId = "0"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + zms.publicKey = pubKey; + + UserToken token = zms.getUserToken(rsrcCtx1, userId, null); + assertNotNull(token); + assertTrue(token.getToken().startsWith("v=U1;d=user;n=" + userId + ";")); + assertTrue(token.getToken().contains(";h=localhost")); + assertTrue(token.getToken().contains(";i=10.11.12.13")); + assertTrue(token.getToken().contains(";k=0")); + // Verify signature + Principal principalToVerify = principalAuthority.authenticate(token.getToken(), "10.11.12.13", "GET", null); + assertNotNull(principalToVerify); + + zms.privateKeyId = "1"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKeyK1)); + zms.publicKey = pubKeyK1; + token = zms.getUserToken(rsrcCtx1, userId, null); + assertNotNull(token); + assertTrue(token.getToken().contains("k=1")); + // Verify signature + principalToVerify = principalAuthority.authenticate(token.getToken(), "10.11.12.13", "GET", null); + assertNotNull(principalToVerify); + + zms.privateKeyId = "2"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKeyK2)); + zms.publicKey = pubKeyK2; + + token = zms.getUserToken(rsrcCtx1, userId, null); + assertNotNull(token); + assertTrue(token.getToken().contains("k=2")); + // Verify signature + principalToVerify = principalAuthority.authenticate(token.getToken(), "10.11.12.13", "GET", null); + assertNotNull(principalToVerify); + } + + @Test + public void testGetUserTokenAuthorizedService() { + + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + + String userId = "george"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", + 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + zms.privateKeyId = "0"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + zms.publicKey = pubKey; + + UserToken token = zms.getUserToken(rsrcCtx1, userId, "coretech.storage"); + assertNotNull(token); + assertTrue(token.getToken().contains(";b=coretech.storage;")); + + token = zms.getUserToken(rsrcCtx1, userId, "coretech.storage,sports.hockey"); + assertNotNull(token); + assertTrue(token.getToken().contains(";b=coretech.storage,sports.hockey;")); + } + + @Test + public void testGetUserTokenInvalidAuthorizedService() { + + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + + String userId = "george"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", + 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + try { + zms.getUserToken(rsrcCtx1, userId, "coretech.storage,sports"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 401); + assertTrue(ex.getMessage().contains("getUserToken: Service sports is not authorized in ZMS")); + } + + try { + zms.getUserToken(rsrcCtx1, userId, "baseball"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 401); + assertTrue(ex.getMessage().contains("getUserToken: Service baseball is not authorized in ZMS")); + } + + try { + zms.getUserToken(rsrcCtx1, userId, "hat trick"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 401); + assertTrue(ex.getMessage().contains("getUserToken: Service hat trick is not authorized in ZMS")); + } + } + + @Test + public void testGetUserTokenExpiredIssueTime() { + + // Use real Principal Authority to verify signatures + PrincipalAuthority principalAuthority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + principalAuthority.setKeyStore(zms); + + // we're going to set the issue time 2 hours before the current time + + long issueTime = (System.currentTimeMillis() / 1000) - 7200; + + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + + String userId = "george"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", + 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + zms.privateKeyId = "0"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + zms.publicKey = pubKey; + + UserToken token = zms.getUserToken(rsrcCtx1, userId, null); + assertNotNull(token); + // Verify signature + Principal principalToVerify = principalAuthority.authenticate(token.getToken(), "10.11.12.13", "GET", null); + assertNotNull(principalToVerify); + + // verify that the issue time for the user token is not our issue time + + PrincipalToken pToken = new PrincipalToken(token.getToken()); + assertNotEquals(pToken.getTimestamp(), issueTime); + + // verify that our expiry is close to 1 hour default value + + assertTrue(pToken.getExpiryTime() - (System.currentTimeMillis() / 1000) > 3500); + } + + @Test + public void testGetUserTokenMismatchName() { + int code = 401; + + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + + String userId = "user1"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", + 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + try { + zms.getUserToken(rsrcCtx1, "user2", null); + fail("unauthorizederror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), code); + } + + try { + zms.getUserToken(rsrcCtx1, "_self", null); + fail("unauthorizederror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), code); + } + + try { + zms.getUserToken(rsrcCtx1, "self", null); + fail("unauthorizederror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), code); + } + } + + @Test + public void testGetUserTokenDefaultSelfName() { + + // Use real Principal Authority to verify signatures + PrincipalAuthority principalAuthority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + principalAuthority.setKeyStore(zms); + + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + + String userId = "user10"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", + 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + zms.privateKeyId = "0"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + zms.publicKey = pubKey; + + UserToken token = zms.getUserToken(rsrcCtx1, "_self_", null); + assertNotNull(token); + assertTrue(token.getToken().startsWith("v=U1;d=user;n=" + userId + ";")); + assertTrue(token.getToken().contains(";h=localhost")); + assertTrue(token.getToken().contains(";i=10.11.12.13")); + assertTrue(token.getToken().contains(";k=0")); + // Verify signature + Principal principalToVerify = principalAuthority.authenticate(token.getToken(), "10.11.12.13", "GET", null); + assertNotNull(principalToVerify); + } + + @Test + public void testGetUserTokenBadAuthority() { + int code = 401; + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", + 0, principalAuthority); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + try { + zms.getUserToken(rsrcCtx1, "user1", null); + fail("unauthorizederror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), code); + } + } + + @Test + public void testGetUserTokenNullAuthority() { + int code = 401; + + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature"); + ResourceContext rsrcCtx1 = createResourceContext(principal); + + try { + zms.getUserToken(rsrcCtx1, "user1", null); + fail("unauthorizederror not thrown."); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), code); + } + } + + @Test + public void testDeleteTenantRoles() { + + setupTenantDomainProviderService("DelTenantRolesDom1", "coretech", "storage", + "http://localhost:8090/tableprovider"); + + TenantRoles roles = zms.getTenantRoles(mockDomRsrcCtx, "coretech", "storage", + "DelTenantRolesDom1"); + assertNotNull(roles); + assertEquals(roles.getDomain(), "coretech"); + assertEquals(roles.getService(), "storage"); + assertEquals(roles.getTenant(), "DelTenantRolesDom1".toLowerCase()); + assertEquals(roles.getRoles().size(), 0); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + TenantRoles tenantRoles = new TenantRoles().setDomain("coretech") + .setService("storage").setTenant("DelTenantRolesDom1") + .setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, "coretech", "storage", "DelTenantRolesDom1", + auditRef, tenantRoles); + + RoleList roleList = zms.getRoleList(mockDomRsrcCtx, "coretech", null, null); + assertNotNull(roleList); + + boolean readerFound = false; + boolean writerFound = false; + for (String roleName : roleList.getNames()) { + if (roleName.contains("reader")) { + readerFound = true; + } else if (roleName.contains("writer")) { + writerFound = true; + } + } + + assertTrue(readerFound); + assertTrue(writerFound); + + PolicyList policyList = zms.getPolicyList(mockDomRsrcCtx, "coretech", null, null); + assertNotNull(policyList); + + readerFound = false; + writerFound = false; + for (String policy : policyList.getNames()) { + if (policy.contains("reader")) { + readerFound = true; + } else if (policy.contains("writer")) { + writerFound = true; + } + } + + assertTrue(readerFound); + assertTrue(writerFound); + + zms.deleteTenantRoles(mockDomRsrcCtx, "coretech", "storage", "DelTenantRolesDom1", auditRef); + + roleList = zms.getRoleList(mockDomRsrcCtx, "coretech", null, null); + assertNotNull(roleList); + + readerFound = false; + writerFound = false; + for (String roleName : roleList.getNames()) { + if (roleName.contains("reader")) { + readerFound = true; + } else if (roleName.contains("writer")) { + writerFound = true; + } + } + + assertFalse(readerFound); + assertFalse(writerFound); + + policyList = zms.getPolicyList(mockDomRsrcCtx, "coretech", null, null); + assertNotNull(policyList); + + readerFound = false; + writerFound = false; + for (String policy : policyList.getNames()) { + if (policy.contains("reader")) { + readerFound = true; + } else if (policy.contains("writer")) { + writerFound = true; + } + } + + assertFalse(readerFound); + assertFalse(writerFound); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "DelTenantRolesDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + } + + @Test + public void testDeleteTenantRolesWithResourceGroup() { + + String domain = "testDeleteTenantRoles"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String serviceName = "storage"; + String tenantDomain = "tenantTestDeleteTenantRoles"; + String resourceGroup = "Group1"; + + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles().setDomain(domain) + .setService(serviceName).setTenant(tenantDomain) + .setRoles(roleActions).setResourceGroup(resourceGroup); + zms.putTenantResourceGroupRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, resourceGroup, + auditRef, tenantRoles); + + TenantResourceGroupRoles tRoles = zms.getTenantResourceGroupRoles(mockDomRsrcCtx, domain, serviceName, + tenantDomain, resourceGroup); + assertNotNull(tRoles); + assertEquals(domain.toLowerCase(), tRoles.getDomain()); + assertEquals(serviceName.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(TABLE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + + zms.deleteTenantResourceGroupRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, resourceGroup, auditRef); + + tRoles = zms.getTenantResourceGroupRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, resourceGroup); + assertNotNull(tRoles); + assertEquals(domain.toLowerCase(), tRoles.getDomain()); + assertEquals(serviceName.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(0, tRoles.getRoles().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "testDeleteTenantRoles", auditRef); + } + + @Test + public void testDeleteTenantRolesMissingAuditRef() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_deltenantrolesmissauditref"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domain = "testDeleteTenantRolesMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String serviceName = "storage"; + String tenantDomain = "tenantTestDeleteTenantRolesMissingAuditRef"; + TenantRoles tenantRoles = new TenantRoles().setDomain(domain) + .setService(serviceName).setTenant(tenantDomain) + .setRoles(roleActions); + zmsImpl.putTenantRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, auditRef, tenantRoles); + + TenantRoles tRoles = zmsImpl.getTenantRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain); + assertNotNull(tRoles); + assertEquals(tRoles.getDomain(), domain.toLowerCase()); + assertEquals(tRoles.getService(), serviceName.toLowerCase()); + assertEquals(tRoles.getTenant(), tenantDomain.toLowerCase()); + assertEquals(tRoles.getRoles().size(), TABLE_PROVIDER_ROLE_ACTIONS.size()); + + try { + zmsImpl.deleteTenantRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, null); + fail("requesterror not thrown by deleteTenantRoles."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + + String caller = "deletetenantroles"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(deletetenantroles: Audit reference required for domain: testdeletetenantrolesmissingauditref);:caller specified provider-service=(storage))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + } finally { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + } + + @Test + public void testValidatedAdminUsersThrowException() { + try { + zms.validatedAdminUsers(null); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + } + + @Test + public void testPutDefaultAdmins() { + + TopLevelDomain sportsDomain = createTopLevelDomainObject("sports", + "Test domain for sports", "testOrg", adminUser); + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } catch (ResourceException ex) { + } + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, sportsDomain); + + List adminList = new ArrayList(); + DefaultAdmins admins = new DefaultAdmins(); + + // negative test, pass an empty list + admins.setAdmins(adminList); + zms.putDefaultAdmins(mockDomRsrcCtx, "sports", auditRef, admins); + + Role role = zms.getRole(mockDomRsrcCtx, "sports", "admin", false, false); + assertNotNull(role); + assertEquals(role.getName(), "sports:role.admin"); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 1); + assertEquals(members.get(0), adminUser); + + // positive test + adminList.add("user.sports_admin"); + adminList.add("sports.fantasy"); + adminList.add("user.joeschmoe"); + adminList.add("user.johndoe"); + + admins.setAdmins(adminList); + zms.putDefaultAdmins(mockDomRsrcCtx, "sports", auditRef, admins); + + role = zms.getRole(mockDomRsrcCtx, "sports", "admin", false, false); + assertNotNull(role); + assertEquals(role.getName(), "sports:role.admin"); + members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 5); + + // add user.testadminuser to the list for verification since it should be + // there when the domain was added + adminList.add(adminUser); + for (String admin : adminList) { + boolean found = false; + for (String memberFromRole : members) { + if (memberFromRole.equalsIgnoreCase(admin)) { + found = true; + break; + } + } + assertTrue(found); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } + + @Test + public void testPutDefaultAdminsMissingAuditRef() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_putdefaminsmissauditref"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domain = "testPutDefaultAdminsMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List adminList = new ArrayList(); + adminList.add("user.sports_admin"); + adminList.add("sports.fantasy"); + DefaultAdmins admins = new DefaultAdmins(); + admins.setAdmins(adminList); + try { + zmsImpl.putDefaultAdmins(mockDomRsrcCtx, domain, null, admins); + fail("requesterror not thrown by putDefaultAdmins."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + + String caller = "putdefaultadmins"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(putdefaultadmins: Audit reference required for domain: testputdefaultadminsmissingauditref);:caller specified default-admins=(\"user.sports_admin\",\"sports.fantasy\"))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } finally { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + } + + @Test + public void testPutDefaultAdmins_NoAdminRole() { + + TopLevelDomain sportsDomain = createTopLevelDomainObject("sports", + "Test domain for sports", "testOrg", adminUser); + + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } catch (ResourceException ex) { + } + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, sportsDomain); + + // since we can't delete the admin role anymore + // we're going to access the store object directly to + // accomplish that for our unit test + + zms.dbService.executeDeleteRole(mockDomRsrcCtx, sportsDomain.getName(), "admin", + auditRef, "unittest"); + + List adminList = new ArrayList(); + DefaultAdmins admins = new DefaultAdmins(); + adminList.add("user.sports_admin"); + adminList.add("sports.fantasy"); + adminList.add("user.joeschmoe"); + adminList.add("user.johndoe"); + adminList.add(adminUser); + + admins.setAdmins(adminList); + zms.putDefaultAdmins(mockDomRsrcCtx, "sports", auditRef, admins); + + Role role = zms.getRole(mockDomRsrcCtx, "sports", "admin", false, false); + assertNotNull(role); + assertEquals(role.getName(), "sports:role.admin"); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 5); + + // add user.testadminuser to the list for verification since it should be + // there when the domain was added + adminList.add(adminUser); + for (String admin : adminList) { + boolean found = false; + for (String memberFromRole : members) { + if (memberFromRole.equalsIgnoreCase(admin)) { + found = true; + break; + } + } + assertTrue(found); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } + + @Test + public void testPutDefaultAdmins_NoAdminPolicy() { + + TopLevelDomain sportsDomain = createTopLevelDomainObject("sports", + "Test domain for sports", "testOrg", adminUser); + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } catch (ResourceException ex) { + } + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, sportsDomain); + + // since we can't delete the admin policy anymore + // we're going to access the store object directly to + // accomplish that for our unit test + + zms.dbService.executeDeletePolicy(mockDomRsrcCtx, sportsDomain.getName(), "admin", + auditRef, "unittest"); + + List adminList = new ArrayList(); + DefaultAdmins admins = new DefaultAdmins(); + adminList.add("user.sports_admin"); + adminList.add("sports.fantasy"); + adminList.add("user.joeschmoe"); + adminList.add("user.johndoe"); + + admins.setAdmins(adminList); + zms.putDefaultAdmins(mockDomRsrcCtx, "sports", auditRef, admins); + + // Validate that admin policy has been added back + Policy policy = zms.getPolicy(mockDomRsrcCtx, "sports", "admin"); + assertNotNull(policy); + assertEquals(policy.getName(), "sports:policy.admin"); + List assertions = policy.getAssertions(); + boolean foundAssertion = false; + for (Assertion assertion : assertions) { + if ("sports:*".equals(assertion.getResource()) + && "*".equals(assertion.getAction()) + && "sports:role.admin".equals(assertion.getRole())) { + foundAssertion = true; + } + } + assertTrue(foundAssertion); + + Role role = zms.getRole(mockDomRsrcCtx, "sports", "admin", false, false); + assertNotNull(role); + assertEquals(role.getName(), "sports:role.admin"); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 5); + + for (String admin : adminList) { + boolean found = false; + for (String memberFromRole : members) { + if (memberFromRole.equalsIgnoreCase(admin)) { + found = true; + break; + } + } + assertTrue(found); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } + + @Test + public void testPutDefaultAdmins_AdminPolicyWithDeny() { + + TopLevelDomain sportsDomain = createTopLevelDomainObject("sports", + "Test domain for sports", "testOrg", adminUser); + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } catch (ResourceException ex) { + } + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, sportsDomain); + + // Add policy which will DENY admin role + Policy policy = new Policy(); + policy.setName(ZMSUtils.policyResourceName("sports", "denyAdmin")); + Assertion assertion = new Assertion(); + assertion.setResource("sports:*"); + assertion.setAction("*"); + assertion.setRole("sports:role.admin"); + assertion.setEffect(AssertionEffect.DENY); + List assertions = new ArrayList(); + assertions.add(assertion); + policy.setAssertions(assertions); + zms.putPolicy(mockDomRsrcCtx, "sports", "denyAdmin", auditRef, policy); + + List adminList = new ArrayList(); + DefaultAdmins admins = new DefaultAdmins(); + adminList.add("user.sports_admin"); + adminList.add("sports.fantasy"); + adminList.add("user.joeschmoe"); + adminList.add("user.johndoe"); + + admins.setAdmins(adminList); + zms.putDefaultAdmins(mockDomRsrcCtx, "sports", auditRef, admins); + + // denyAdmin policy should be deleted by putDefaultAdmins validation + try { + policy = zms.getPolicy(mockDomRsrcCtx, "sports", "denyAdmin"); + assertNotNull(policy); // should not be found + } catch (ResourceException ex) { + // policy should not be found + if (ex.getCode() != 404) { + throw ex; + } + } + + Role role = zms.getRole(mockDomRsrcCtx, "sports", "admin", false, false); + assertNotNull(role); + assertEquals(role.getName(), "sports:role.admin"); + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 5); + + for (String admin : adminList) { + boolean found = false; + for (String memberFromRole : members) { + if (memberFromRole.equalsIgnoreCase(admin)) { + found = true; + break; + } + } + assertTrue(found); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } + + @Test + public void testPutDefaultAdmins_DenyIndirectRole() { + + TopLevelDomain sportsDomain = createTopLevelDomainObject("sports", + "Test domain for sports", "testOrg", adminUser); + try { + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } catch (ResourceException ex) { + } + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, sportsDomain); + + // Add role indirectRole + Role role = new Role(); + role.setName("sports:role.indirectRole"); + List members = new ArrayList(); + members.add("user.johnadams"); + members.add("user.sports_admin"); + members.add("sports.fantasy"); + members.add("user.joeschmoe"); + members.add("user.johndoe"); + role.setMembers(members); + role.setTrust(null); + zms.putRole(mockDomRsrcCtx, "sports", "indirectRole", auditRef, role); + + // Add policy which will DENY indirectRole role + Policy policy = new Policy(); + policy.setName(ZMSUtils.policyResourceName("sports", "denyIndirectRole")); + Assertion assertion = new Assertion(); + assertion.setResource("sports:*"); + assertion.setAction("*"); + assertion.setRole("sports:role.indirectRole"); + assertion.setEffect(AssertionEffect.DENY); + List assertions = new ArrayList(); + assertions.add(assertion); + policy.setAssertions(assertions); + zms.putPolicy(mockDomRsrcCtx, "sports", "denyIndirectRole", auditRef, policy); + + List adminList = new ArrayList(); + DefaultAdmins admins = new DefaultAdmins(); + adminList.add("user.sports_admin"); + adminList.add("sports.fantasy"); + adminList.add("user.joeschmoe"); + adminList.add("user.johndoe"); + + admins.setAdmins(adminList); + zms.putDefaultAdmins(mockDomRsrcCtx, "sports", auditRef, admins); + + role = zms.getRole(mockDomRsrcCtx, "sports", "indirectRole", false, false); + assertNotNull(role); + assertEquals(role.getName(), "sports:role.indirectRole".toLowerCase()); + members = role.getMembers(); + assertEquals(members.size(), 1); + + for (String admin : adminList) { + boolean found = false; + for (String memberFromRole : members) { + if (memberFromRole.equalsIgnoreCase(admin)) { + found = true; + break; + } + } + assertFalse(found); + } + + role = zms.getRole(mockDomRsrcCtx, "sports", "admin", false, false); + assertNotNull(role); + assertEquals(role.getName(), "sports:role.admin"); + members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 5); + + for (String admin : adminList) { + boolean found = false; + for (String memberFromRole : members) { + if (memberFromRole.equalsIgnoreCase(admin)) { + found = true; + break; + } + } + assertTrue(found); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, sportsDomain.getName(), auditRef); + } + + @Test + public void testManageTenantRoles() { + + setupTenantDomainProviderService("AddTenantRolesDom1", "coretech", "storage", + "http://localhost:8090/tableprovider"); + + TenantRoles roles = zms.getTenantRoles(mockDomRsrcCtx, "coretech", "storage", + "AddTenantRolesDom1"); + assertNotNull(roles); + assertEquals(roles.getDomain(), "coretech"); + assertEquals(roles.getService(), "storage"); + assertEquals(roles.getTenant(), "AddTenantRolesDom1".toLowerCase()); + assertEquals(roles.getRoles().size(), 0); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + TenantRoles tenantRoles = new TenantRoles().setDomain("coretech") + .setService("storage").setTenant("AddTenantRolesDom1") + .setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, "coretech", "storage", "AddTenantRolesDom1", + auditRef, tenantRoles); + + roles = zms.getTenantRoles(mockDomRsrcCtx, "coretech", "storage", "AddTenantRolesDom1"); + assertNotNull(roles); + assertEquals(roles.getDomain(), "coretech"); + assertEquals(roles.getService(), "storage"); + assertEquals(roles.getTenant(), "AddTenantRolesDom1".toLowerCase()); + assertEquals(roles.getRoles().size(), 3); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AddTenantRolesDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + } + + @Test + public void testGetSignedDomains() { + + // create multiple top level domains + TopLevelDomain dom1 = createTopLevelDomainObject("SignedDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // set the meta attributes for domain + + DomainMeta meta = createDomainMetaObject("Tenant Domain1", null, true, false, "12345", 0); + zms.putDomainMeta(mockDomRsrcCtx, "signeddom1", auditRef, meta); + + TopLevelDomain dom2 = createTopLevelDomainObject("SignedDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + meta = createDomainMetaObject("Tenant Domain2", null, true, false, "12346", 0); + zms.putDomainMeta(mockDomRsrcCtx, "signeddom2", auditRef, meta); + + DomainList domList = zms.getDomainList(mockDomRsrcCtx, null, null, null, null, + null, null, null, null, null); + List domNames = domList.getNames(); + int numDoms = domNames.size(); + + zms.privateKeyId = "0"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + zms.publicKey = pubKey; + + GetSignedDomainsResult result = new GetSignedDomainsResult(mockDomRsrcCtx); + SignedDomains sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, null, null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + List list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(list.size(), numDoms); + + boolean dom1Found = false; + boolean dom2Found = false; + for(SignedDomain sDomain : list) { + String signature = sDomain.getSignature(); + String keyId = sDomain.getKeyId(); + String publicKey = zms.getPublicKey("sys.auth", "zms", keyId); + DomainData domainData = sDomain.getDomain(); + if (domainData.getName().equals("signeddom1")) { + assertEquals("12345", domainData.getAccount()); + dom1Found = true; + } else if (domainData.getName().equals("signeddom2")) { + assertEquals("12346", domainData.getAccount()); + dom2Found = true; + } + assertTrue(Crypto.verify(SignUtils.asCanonicalString(sDomain.getDomain()), Crypto.loadPublicKey(publicKey), signature)); + } + assertTrue(dom1Found); + assertTrue(dom2Found); + + zms.privateKeyId = "1"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKeyK1)); + zms.publicKey = pubKeyK1; + + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, null, null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + list = null; + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(list.size(), numDoms); + + for(SignedDomain sDomain : list) { + String signature = sDomain.getSignature(); + String keyId = sDomain.getKeyId(); + String publicKey = zms.getPublicKey("sys.auth", "zms", keyId); + assertTrue(Crypto.verify(SignUtils.asCanonicalString(sDomain.getDomain()), Crypto.loadPublicKey(publicKey), signature)); + + // we now need to verify the policy struct signature as well + + SignedPolicies signedPolicies = sDomain.getDomain().getPolicies(); + signature = signedPolicies.getSignature(); + keyId = signedPolicies.getKeyId(); + assertTrue(Crypto.verify(SignUtils.asCanonicalString(signedPolicies.getContents()), Crypto.loadPublicKey(publicKey), signature)); + } + + zms.privateKeyId = "2"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKeyK2)); + zms.publicKey = pubKeyK2; + + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, null, null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + + list = null; + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(list.size(), numDoms); + + for(SignedDomain sDomain : list) { + String signature = sDomain.getSignature(); + String keyId = sDomain.getKeyId(); + String publicKey = zms.getPublicKey("sys.auth", "zms", keyId); + assertTrue(Crypto.verify(SignUtils.asCanonicalString(sDomain.getDomain()), Crypto.loadPublicKey(publicKey), signature)); + } + + // test metaonly=true + // + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, "tRuE", null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + + list = null; + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(list.size(), numDoms); + + for (SignedDomain sDomain : list) { + String signature = sDomain.getSignature(); + assertTrue(signature == null || signature.isEmpty()); + String keyId = sDomain.getKeyId(); + assertTrue(keyId == null || keyId.isEmpty()); + DomainData ddata = sDomain.getDomain(); + assertTrue(ddata != null); + assertFalse(ddata.getName().isEmpty()); + assertTrue(ddata.getModified() != null); + assertTrue(ddata.getPolicies() == null); + assertTrue(ddata.getRoles() == null); + assertTrue(ddata.getServices() == null); + } + + // test metaonly=garbage + // + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, "garbage", null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + + list = null; + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(list.size(), numDoms); + + for (SignedDomain sDomain : list) { + String signature = sDomain.getSignature(); + String keyId = sDomain.getKeyId(); + String publicKey = zms.getPublicKey("sys.auth", "zms", keyId); + assertTrue(Crypto.verify(SignUtils.asCanonicalString(sDomain.getDomain()), Crypto.loadPublicKey(publicKey), signature)); + DomainData ddata = sDomain.getDomain(); + assertTrue(ddata.getPolicies() != null); + assertTrue(ddata.getRoles() != null && ddata.getRoles().size() > 0); + assertTrue(ddata.getServices() != null); + } + + // test metaonly=false + // + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, "fAlSe", null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + + list = null; + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(list.size(), numDoms); + + for (SignedDomain sDomain : list) { + String signature = sDomain.getSignature(); + String keyId = sDomain.getKeyId(); + String publicKey = zms.getPublicKey("sys.auth", "zms", keyId); + assertTrue(Crypto.verify(SignUtils.asCanonicalString(sDomain.getDomain()), Crypto.loadPublicKey(publicKey), signature)); + DomainData ddata = sDomain.getDomain(); + assertTrue(ddata.getPolicies() != null); + assertTrue(ddata.getRoles() != null && ddata.getRoles().size() > 0); + assertTrue(ddata.getServices() != null); + } + + // test bad tag format + // + String eTag = new String("I am not good"); + String eTag2 = null; + result = new GetSignedDomainsResult(mockDomRsrcCtx); + try { + zms.getSignedDomains(mockDomRsrcCtx, null, null, eTag, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + Object val = getWebAppExcMapValue(wexc, "ETag"); + eTag2 = val.toString(); + } + + assertNotNull(eTag2); + assertNotEquals(eTag, eTag2); + list = null; + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(list.size(), numDoms); + + try { + Thread.sleep(1000); + } catch (InterruptedException e) { + } + + Policy policy1 = createPolicyObject("SignedDom1", "Policy1"); + zms.putPolicy(mockDomRsrcCtx, "SignedDom1", "Policy1", auditRef, policy1); + + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + eTag = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, null, eTag2, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + Object val = getWebAppExcMapValue(wexc, "ETag"); + eTag = val.toString(); + } + + assertNotNull(eTag); + assertNotEquals(eTag, eTag2); + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(1, list.size()); + + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + eTag2 = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, null, null, eTag, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + assertTrue(wexc.getResponse().getStatus() == 304); + Object val = getWebAppExcMapValue(wexc, "ETag"); + eTag2 = val.toString(); + } + assertNull(sdoms); + + assertNotNull(eTag2); + assertEquals(eTag, eTag2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SignedDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SignedDom2", auditRef); + } + + @Test + public void testGetSignedDomainsFiltered() { + + // create multiple top level domains + TopLevelDomain dom1 = createTopLevelDomainObject("signeddom1filtered", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("signeddom2filtered", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + zms.privateKeyId = "0"; + zms.privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + zms.publicKey = pubKey; + + GetSignedDomainsResult result = new GetSignedDomainsResult(mockDomRsrcCtx); + SignedDomains sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, "signeddom1filtered", null, null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + List list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(1, list.size()); + + SignedDomain sDomain = list.get(0); + String signature = sDomain.getSignature(); + String keyId = sDomain.getKeyId(); + String publicKey = zms.getPublicKey("sys.auth", "zms", keyId); + assertTrue(Crypto.verify(SignUtils.asCanonicalString(sDomain.getDomain()), Crypto.loadPublicKey(publicKey), signature)); + assertEquals("signeddom1filtered", sDomain.getDomain().getName()); + + // use domain=signeddom1filtered and metaonly=true + // + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, "signeddom1filtered", "true", null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(1, list.size()); + + sDomain = list.get(0); + signature = sDomain.getSignature(); + assertTrue(signature == null || signature.isEmpty()); + keyId = sDomain.getKeyId(); + assertTrue(keyId == null || keyId.isEmpty()); + DomainData ddata = sDomain.getDomain(); + assertEquals("signeddom1filtered", ddata.getName()); + assertTrue(ddata.getModified() != null); + assertTrue(ddata.getPolicies() == null); + assertTrue(ddata.getRoles() == null); + assertTrue(ddata.getServices() == null); + + // no changes, we should still get the same data back + // we're going to pass the domain name with caps and + // make sure we still get back our domain + + result = new GetSignedDomainsResult(mockDomRsrcCtx); + sdoms = null; + try { + zms.getSignedDomains(mockDomRsrcCtx, "SignedDom1Filtered", null, null, result); + fail("webappexc not thrown by getSignedDomains"); + } catch (javax.ws.rs.WebApplicationException wexc) { + Object obj = getWebAppExcEntity(wexc); + sdoms = (SignedDomains) obj; + } + assertNotNull(sdoms); + list = null; + list = sdoms.getDomains(); + assertNotNull(list); + assertEquals(1, list.size()); + + sDomain = list.get(0); + signature = sDomain.getSignature(); + keyId = sDomain.getKeyId(); + publicKey = zms.getPublicKey("sys.auth", "zms", keyId); + assertTrue(Crypto.verify(SignUtils.asCanonicalString(sDomain.getDomain()), Crypto.loadPublicKey(publicKey), signature)); + assertEquals("signeddom1filtered", sDomain.getDomain().getName()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "signeddom1filtered", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "signeddom2filtered", auditRef); + } + + @Test + public void testGetAccess() { + + TopLevelDomain dom1 = createTopLevelDomainObject("AccessDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("AccessDom1", "Role1", null, "user.user1", + "user.user3"); + zms.putRole(mockDomRsrcCtx, "AccessDom1", "Role1", auditRef, role1); + + Role role2 = createRoleObject("AccessDom1", "Role2", null, "user.user2", + "user.user3"); + zms.putRole(mockDomRsrcCtx, "AccessDom1", "Role2", auditRef, role2); + + Policy policy1 = createPolicyObject("AccessDom1", "Policy1", "Role1", + "UPDATE", "AccessDom1:resource1", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject("AccessDom1", "Policy2", "Role2", + "CREATE", "AccessDom1:resource2", AssertionEffect.DENY); + zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy2", auditRef, policy2); + + Policy policy3 = createPolicyObject("AccessDom1", "Policy3", "Role2", + "*", "AccessDom1:resource3", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy3", auditRef, policy3); + + Policy policy4 = createPolicyObject("AccessDom1", "Policy4", "Role2", + "DELETE", "accessdom1:*", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy4", auditRef, policy4); + + Policy policy5 = createPolicyObject("AccessDom1", "Policy5", "Role1", + "READ", "accessdom1:*", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy5", auditRef, policy5); + + Policy policy6 = createPolicyObject("AccessDom1", "Policy6", "Role1", + "READ", "AccessDom1:resource6", AssertionEffect.DENY); + zms.putPolicy(mockDomRsrcCtx, "AccessDom1", "Policy6", auditRef, policy6); + + // user1 and user3 have access to UPDATE/resource1 + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + Principal principal2 = principalAuthority.authenticate("v=U1;d=user;n=user2;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtx2 = createResourceContext(principal2); + Principal principal3 = principalAuthority.authenticate("v=U1;d=user;n=user3;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtx3 = createResourceContext(principal3); + + Access access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource1", + "AccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource1", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource1", + "AccessDom1", null); + assertTrue(access.getGranted()); + + // same set as before with no trust domain field + + access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource1", + null, null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource1", + null, null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource1", + null, null); + assertTrue(access.getGranted()); + + // all three have no access to CREATE action on resource1 + + access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1", + "AccessDom1", null); + assertFalse(access.getGranted()); + + // all three have no access to invalid domain name on resource 1 + + access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1", + "AccessDom2", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1", + "AccessDom2", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1", + "AccessDom2", null); + assertFalse(access.getGranted()); + + // same as before with no trust domain field + + access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource1", + null, null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource1", + null, null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource1", + null, null); + assertFalse(access.getGranted()); + + // all three should have deny access to resource 2 + + access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource2", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource2", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource2", + "AccessDom1", null); + assertFalse(access.getGranted()); + + // user2 and user3 have access to CREATE(*)/resource 3 + + access = zms.getAccess(rsrcCtx1, "CREATE", "AccessDom1:resource3", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "AccessDom1:resource3", + "AccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "CREATE", "AccessDom1:resource3", + "AccessDom1", null); + assertTrue(access.getGranted()); + + // user2 and user3 have access to UPDATE(*)/resource 3 + + access = zms.getAccess(rsrcCtx1, "UPDATE", "AccessDom1:resource3", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "UPDATE", "AccessDom1:resource3", + "AccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "UPDATE", "AccessDom1:resource3", + "AccessDom1", null); + assertTrue(access.getGranted()); + + // user2 and user3 have access to DELETE/resource 4 (*) + + access = zms.getAccess(rsrcCtx1, "DELETE", "AccessDom1:resource4", + "AccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "DELETE", "AccessDom1:resource4", + "AccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "DELETE", "AccessDom1:resource4", + "AccessDom1", null); + assertTrue(access.getGranted()); + + // user1 should be able to read resource 5(*) but not resource 6 + // (explicit DENY) + + access = zms.getAccess(rsrcCtx1, "READ", "AccessDom1:resource5", + "AccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "READ", "AccessDom1:resource6", + "AccessDom1", null); + assertFalse(access.getGranted()); + + // we should get an exception since access is not allowed to be called + // with user cookie - this api is only for functions that require a + // service or user tokens + + try { + zms.access("READ", "AccessDom1:resource5", principal1, "AccessDom1"); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AccessDom1", auditRef); + } + + @Test + public void testGetAccessCrossUser() { + + TopLevelDomain dom1 = createTopLevelDomainObject("CrossAllowDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("CrossAllowDom1", "Role1", null, + "user.user1", "user.user3"); + zms.putRole(mockDomRsrcCtx, "CrossAllowDom1", "Role1", auditRef, role1); + + Role role2 = createRoleObject("CrossAllowDom1", "Role2", null, + "user.user2", "user.user3"); + zms.putRole(mockDomRsrcCtx, "CrossAllowDom1", "Role2", auditRef, role2); + + Role role3 = createRoleObject("CrossAllowDom1", "Role3", null, + "user.user1", null); + zms.putRole(mockDomRsrcCtx, "CrossAllowDom1", "Role3", auditRef, role3); + + Policy policy1 = createPolicyObject("CrossAllowDom1", "Policy1", + "Role1", "UPDATE", "CrossAllowDom1:resource1", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject("CrossAllowDom1", "Policy2", + "Role2", "CREATE", "CrossAllowDom1:resource2", + AssertionEffect.DENY); + zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy2", auditRef, policy2); + + Policy policy3 = createPolicyObject("CrossAllowDom1", "Policy3", + "Role2", "*", "CrossAllowDom1:resource3", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy3", auditRef, policy3); + + Policy policy4 = createPolicyObject("CrossAllowDom1", "Policy4", + "Role2", "DELETE", "CrossAllowDom1:*", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "CrossAllowDom1", "Policy4", auditRef, policy4); + + // verify we have allow access for access resource + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + Principal principal2 = principalAuthority.authenticate("v=U1;d=user;n=user2;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtx2 = createResourceContext(principal2); + Principal principal3 = principalAuthority.authenticate("v=U1;d=user;n=user3;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtx3 = createResourceContext(principal3); + + // user1 and user3 have access to UPDATE/resource1 + + Access access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user1"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user1"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user2"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user2"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user3"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user3"); + assertTrue(access.getGranted()); + + // all three have no access to CREATE action on resource1 + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user1"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user1"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user2"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user2"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user3"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user3"); + assertFalse(access.getGranted()); + + // all three have no access to invalid domain name on resource 1 + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom2", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom2", "user1"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom2", "user.user1"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "CrossAllowDom1:resource1", + "CrossAllowDom2", null); + assertFalse(access.getGranted()); + + // user2 and user3 have access to CREATE(*)/resource 3 + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", "user1"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", "user.user1"); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", "user2"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", "user.user2"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", "user3"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx1, "CREATE", "CrossAllowDom1:resource3", + "CrossAllowDom1", "user.user3"); + assertTrue(access.getGranted()); + + // user2 and user3 are allowed to check each other's access + + access = zms.getAccess(rsrcCtx2, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user1"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx2, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user1"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user1"); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtx3, "UPDATE", "CrossAllowDom1:resource1", + "CrossAllowDom1", "user.user1"); + assertTrue(access.getGranted()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "CrossAllowDom1", auditRef); + } + + @Test + public void testGetAccessHomeDomainEnabled() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "true"); + ZMSImpl zmsTest = zmsInit(); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + + Principal pJane = principalAuthority.authenticate("v=U1;d=user;n=jane;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxJane = createResourceContext(pJane); + + Access access = zmsTest.getAccess(rsrcCtxJane, "READ", "user.jane:Resource1", null, null); + assertTrue(access.getGranted()); + + access = zmsTest.getAccess(rsrcCtxJane, "WRITE", "user.jane:Resource1", null, null); + assertTrue(access.getGranted()); + + access = zmsTest.getAccess(rsrcCtxJane, "UPDATE", "user.jane:Resource1", null, null); + assertTrue(access.getGranted()); + + // user id does not match yrn domain - all should be failure + + Principal pJohn = principalAuthority.authenticate("v=U1;d=user;n=john;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxJohn = createResourceContext(pJohn); + + try { + zmsTest.getAccess(rsrcCtxJohn, "READ", "user.jane:Resource1", null, null); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zmsTest.getAccess(rsrcCtxJohn, "WRITE", "user.jane:Resource1", null, null); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zmsTest.getAccess(rsrcCtxJohn, "UPDATE", "user.jane:Resource1", null, null); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN); + } + + @Test + public void testGetAccessHomeDomainDisabled() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "false"); + ZMSImpl zmsTest = zmsInit(); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + + Principal pJane = principalAuthority.authenticate("v=U1;d=user;n=jane;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxJane = createResourceContext(pJane); + + try { + zmsTest.getAccess(rsrcCtxJane, "READ", "user.jane:Resource1", null, null); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zmsTest.getAccess(rsrcCtxJane, "WRITE", "user.jane:Resource1", null, null); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zmsTest.getAccess(rsrcCtxJane, "UPDATE", "user.jane:Resource1", null, null); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN); + } + + @Test + public void testRetrieveAccessDomainValid() { + + TopLevelDomain dom1 = createTopLevelDomainObject("AccessDomain", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal pJane = principalAuthority.authenticate("v=U1;d=user;n=jane;s=signature", "10.11.12.13", "GET", null); + + AthenzDomain athenzDomain = zms.retrieveAccessDomain("accessdomain", pJane); + assertNotNull(athenzDomain); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AccessDomain", auditRef); + } + + @Test + public void testRetrieveAccessDomainVirtualValid() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "true"); + ZMSImpl zmsTest = zmsInit(); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", + 0, principalAuthority); + + AthenzDomain athenzDomain = zmsTest.retrieveAccessDomain("user.user1", principal); + assertNotNull(athenzDomain); + assertEquals(athenzDomain.getName(), "user.user1"); + + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN); + } + + @Test + public void testRetrieveAccessDomainVirtualDomainDisabled() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "false"); + ZMSImpl zmsTest = zmsInit(); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", + 0, principalAuthority); + + AthenzDomain athenzDomain = zmsTest.retrieveAccessDomain("user.user1", principal); + assertNull(athenzDomain); + + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN); + } + + @Test + public void testRetrieveAccessDomainPrincialNullDomain() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "true"); + ZMSImpl zmsTest = zmsInit(); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal = SimplePrincipal.create(null, "user1", "v=U1;d=user;n=user1;s=signature", + 0, principalAuthority); + + AthenzDomain athenzDomain = zmsTest.retrieveAccessDomain("user.user1", principal); + assertNull(athenzDomain); + + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN); + + } + + @Test + public void testRetrieveAccessDomainMismatch() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN, "true"); + ZMSImpl zmsTest = zmsInit(); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal = SimplePrincipal.create("user", "user2", "v=U1;d=user;n=user2;s=signature", + 0, principalAuthority); + + AthenzDomain athenzDomain = zmsTest.retrieveAccessDomain("user.user1", principal); + assertNull(athenzDomain); + + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN); + } + + @Test + public void testGetAccessCrossDomain() { + + setupTenantDomainProviderService("CrossDomainAccessDom1", "coretech", "storage", + "http://localhost:8090/provider"); + + Tenancy tenant = createTenantObject("CrossDomainAccessDom1", "coretech.storage"); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, "CrossDomainAccessDom1", "coretech.storage", auditRef, tenant); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction((String) f.value())); + } + TenantRoles tenantRoles = new TenantRoles().setDomain("coretech") + .setService("storage").setTenant("CrossDomainAccessDom1") + .setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, "coretech", "storage", "CrossDomainAccessDom1", + auditRef, tenantRoles); + + Tenancy tenant1 = zms.getTenancy(mockDomRsrcCtx, "CrossDomainAccessDom1", "coretech.storage"); + assertNotNull(tenant1); + + // reset roles in the CrossDomainAccessDom1 domain with unique values + + Role role = createRoleObject("CrossDomainAccessDom1", "reader", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, "CrossDomainAccessDom1", "reader", auditRef, role); + + role = createRoleObject("CrossDomainAccessDom1", "writer", null, "user.john", + "user.jane"); + zms.putRole(mockDomRsrcCtx, "CrossDomainAccessDom1", "writer", auditRef, role); + + Policy policy = createPolicyObject("CrossDomainAccessDom1", "tenancy.coretech.storage.writer", + "writer", "ASSUME_ROLE", "coretech:role.storage.tenant.CrossDomainAccessDom1.writer", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "CrossDomainAccessDom1", "tenancy.coretech.storage.writer", auditRef, policy); + + policy = createPolicyObject("CrossDomainAccessDom1", "tenancy.coretech.storage.reader", + "reader", "ASSUME_ROLE", "coretech:role.storage.tenant.CrossDomainAccessDom1.reader", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "CrossDomainAccessDom1", "tenancy.coretech.storage.reader", auditRef, policy); + + // verify the ASSUME_ROLE check - with trust domain specified it should work and + // without trust domain it will not work since the resource is pointing to the + // provider's domain and not to the tenant's domain + + Access access = zms.getAccess(mockDomRsrcCtx, "ASSUME_ROLE", "coretech:role.storage.tenant.CrossDomainAccessDom1.reader", + null, "user.jane"); + assertFalse(access.getGranted()); + + access = zms.getAccess(mockDomRsrcCtx, "ASSUME_ROLE", "coretech:role.storage.tenant.CrossDomainAccessDom1.reader", + "CrossDomainAccessDom1", "user.jane"); + assertTrue(access.getGranted()); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + + Principal pJane = principalAuthority.authenticate("v=U1;d=user;n=jane;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxJane = createResourceContext(pJane); + Principal pJohn = principalAuthority.authenticate("v=U1;d=user;n=john;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxJohn = createResourceContext(pJohn); + Principal pJoe = principalAuthority.authenticate("v=U1;d=user;n=joe;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxJoe = createResourceContext(pJoe); + + access = zms.getAccess(rsrcCtxJoe, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtxJane, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtxJohn, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJoe, "WRITE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJane, "WRITE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtxJohn, "WRITE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertTrue(access.getGranted()); + + // unknown action should always fail + + access = zms.getAccess(rsrcCtxJoe, "UPDATE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJane, "UPDATE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJohn, "UPDATE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom1", null); + assertFalse(access.getGranted()); + + // same set as above without trust domain field + + access = zms.getAccess(rsrcCtxJoe, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + null, null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtxJane, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + null, null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtxJohn, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + null, null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJoe, "WRITE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + null, null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJane, "WRITE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + null, null); + assertTrue(access.getGranted()); + + access = zms.getAccess(rsrcCtxJohn, "WRITE", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + null, null); + assertTrue(access.getGranted()); + + // failure with different domain name + + access = zms.getAccess(rsrcCtxJoe, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom2", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJane, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom2", null); + assertFalse(access.getGranted()); + + access = zms.getAccess(rsrcCtxJohn, "READ", "coretech:service.storage.tenant.CrossDomainAccessDom1.resource1", + "CrossDomainAccessDom2", null); + assertFalse(access.getGranted()); + + zms.deleteTenancy(mockDomRsrcCtx, "CrossDomainAccessDom1", "coretech.storage", auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "CrossDomainAccessDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + } + + @Test + public void testGetAccessCrossDomainWildCardResources() { + + // create the netops domain + + TopLevelDomain dom = createTopLevelDomainObject("netops", + "Test Netops", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + Role role = createRoleObject("netops", "users", null, null, null); + zms.putRole(mockDomRsrcCtx, "netops", "users", auditRef, role); + + role = createRoleObject("netops", "superusers", null, "user.siteops_user_1", + "user.siteops_user_2"); + zms.putRole(mockDomRsrcCtx, "netops", "superusers", auditRef, role); + + Policy policy = createPolicyObject("netops", "users", + "users", "NODE_USER", "netops:node.", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "netops", "users", auditRef, policy); + + policy = createPolicyObject("netops", "superusers", + "superusers", "NODE_SUDO", "netops:node.", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "netops", "superusers", auditRef, policy); + + policy = createPolicyObject("netops", "netops_superusers", + "netops:role.superusers", false, "ASSUME_ROLE", "*:role.netops_superusers", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "netops", "netops_superusers", auditRef, policy); + + // create the weather domain + + dom = createTopLevelDomainObject("weather", + "Test weather", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + role = createRoleObject("weather", "users", null, null, null); + zms.putRole(mockDomRsrcCtx, "weather", "users", auditRef, role); + + role = createRoleObject("weather", "superusers", null, "user.weather_admin_user", + null); + zms.putRole(mockDomRsrcCtx, "weather", "superusers", auditRef, role); + + role = createRoleObject("weather", "netops_superusers", "netops"); + zms.putRole(mockDomRsrcCtx, "weather", "netops_superusers", auditRef, role); + + policy = createPolicyObject("weather", "users", + "users", "NODE_USER", "weather:node.", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "weather", "users", auditRef, policy); + + policy = createPolicyObject("weather", "superusers", + "superusers", "NODE_SUDO", "weather:node.*", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "weather", "superusers", auditRef, policy); + + policy = createPolicyObject("weather", "netops_superusers", + "netops_superusers", "NODE_SUDO", "weather:node.*", + AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "weather", "netops_superusers", auditRef, policy); + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + + Principal pWeather = principalAuthority.authenticate("v=U1;d=user;n=weather_admin_user;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxWeather = createResourceContext(pWeather); + + Access access = zms.getAccess(rsrcCtxWeather, "NODE_SUDO", "weather:node.x", null, null); + assertTrue(access.getGranted()); + + Principal pSiteOps = principalAuthority.authenticate("v=U1;d=user;n=siteops_user_1;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxSiteOps = createResourceContext(pSiteOps); + + access = zms.getAccess(rsrcCtxSiteOps, "NODE_SUDO", "weather:node.x", null, null); + assertTrue(access.getGranted()); + + Principal pRandom = principalAuthority.authenticate("v=U1;d=user;n=random_user;s=signature", "10.11.12.13", "GET", null); + ResourceContext rsrcCtxRandom = createResourceContext(pRandom); + + access = zms.getAccess(rsrcCtxRandom, "NODE_SUDO", "weather:node.x", null, null); + assertFalse(access.getGranted()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "weather", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "netops", auditRef); + } + + @Test + public void testValidateEntity() { + int code = 400; + String en = new String("entityOne"); + Entity entity = new Entity(); + String nonmatchName = new String("entityTwo"); + + // tests the condition: if (!en.equals(entity.getName()))... + try { + entity.setName(nonmatchName); + + zms.validateEntity(en, entity); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), code); + } + + // tests the condition: if (entity.getValue() == null)... + try { + entity.setName(en); + + zms.validateEntity(en, entity); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), code); + } + } + + @Test + public void testCheckReservedEntityName() { + int code = 400; + String reserved = new String("meta"); + try { + zms.checkReservedEntityName(reserved); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), code); + } + } + + @Test + public void testPutEntity() { + int code = 404; + String name = new String("entityOne"); + try { + Entity entity = createEntityObject(name); + + // entityName will not match entity.name. + zms.putEntity(mockDomRsrcCtx, "wrongDomainName", name, auditRef, entity); + fail("notfounderror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), code); + } + } + + @Test + public void testGetPublicKeyZMS() { + + String publicKey = zms.getPublicKey("sys.auth", "zms", "0"); + assertNotNull(publicKey); + try { + assertTrue(pubKey.equals(Crypto.ybase64(publicKey.getBytes("UTF-8")))); + } catch (UnsupportedEncodingException e) { + fail(); + } + + publicKey = zms.getPublicKey("sys.auth", "zms", "1"); + assertNotNull(publicKey); + try { + assertTrue(pubKeyK1.equals(Crypto.ybase64(publicKey.getBytes("UTF-8")))); + } catch (UnsupportedEncodingException e) { + fail(); + } + + publicKey = zms.getPublicKey("sys.auth", "zms", "2"); + assertNotNull(publicKey); + try { + assertTrue(pubKeyK2.equals(Crypto.ybase64(publicKey.getBytes("UTF-8")))); + } catch (UnsupportedEncodingException e) { + fail(); + } + } + + @Test + public void testGetPublicKeyInvalidService() { + + String pubKey = zms.getPublicKey("sys.auth", "sys.auth", "0"); + assertNull(pubKey); + } + + @Test + public void testGetPublicKeyService() { + + TopLevelDomain dom1 = createTopLevelDomainObject("GetPublicKeyDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("GetPublicKeyDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "GetPublicKeyDom1", "Service1", auditRef, service); + + String publicKey = zms.getPublicKey("GetPublicKeyDom1", "Service1", "0"); + assertNull(publicKey); + + assertNull(zms.getPublicKey("GetPublicKeyDom1", null, "0")); + assertNull(zms.getPublicKey("GetPublicKeyDom1", "Service1", null)); + + publicKey = zms.getPublicKey("GetPublicKeyDom1", "Service1", "1"); + assertNotNull(publicKey); + assertTrue(publicKey.equals(Crypto.ybase64DecodeString(pubKeyK1))); + + publicKey = zms.getPublicKey("GetPublicKeyDom1", "Service1", "2"); + assertNotNull(publicKey); + assertTrue(publicKey.equals(Crypto.ybase64DecodeString(pubKeyK2))); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "GetPublicKeyDom1", auditRef); + } + + @Test + public void testPutTenancy() { + + setupTenantDomainProviderService("AddTenancyDom1", "coretech", "storage", + "http://localhost:8090/provider"); + + Tenancy tenant = createTenantObject("AddTenancyDom1", "coretech.storage"); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage", auditRef, tenant); + + // make sure our roles have been created + + Role role = zms.getRole(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage.admin", false, false); + assertNotNull(role); + + role = zms.getRole(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage.reader", false, false); + assertNotNull(role); + + role = zms.getRole(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage.writer", false, false); + assertNotNull(role); + + // verify the policies have the correct roles + + Policy policy = zms.getPolicy(mockDomRsrcCtx, "AddTenancyDom1", "tenancy.coretech.storage.admin"); + assertNotNull(policy); + + // the admin is a special case where we are going to create the policy + // before we call the provider's tenant controller service so we'll + // end up with 4 assertions + + List assertList = policy.getAssertions(); + assertEquals(4, assertList.size()); + + boolean domainAdminRoleCheck = false; + boolean tenantAdminRoleCheck = false; + boolean resourceAdminRoleCheck = false; + boolean tenantUpdateCheck = false; + for (Assertion obj : assertList) { + assertEquals(AssertionEffect.ALLOW, obj.getEffect()); + if (obj.getRole().equals("addtenancydom1:role.admin")) { + assertEquals(obj.getAction(), "assume_role"); + domainAdminRoleCheck = true; + } else if (obj.getRole().equals("addtenancydom1:role.tenancy.coretech.storage.admin")) { + if (obj.getAction().equals("assume_role")) { + tenantAdminRoleCheck = true; + } else if (obj.getAction().equals("update")) { + tenantUpdateCheck = true; + } + } else if (obj.getRole().equals("addtenancydom1:role.coretech.storage.admin")) { + assertEquals(obj.getAction(), "assume_role"); + resourceAdminRoleCheck = true; + } + } + assertTrue(domainAdminRoleCheck); + assertTrue(tenantAdminRoleCheck); + assertTrue(resourceAdminRoleCheck); + assertTrue(tenantUpdateCheck); + + policy = zms.getPolicy(mockDomRsrcCtx, "AddTenancyDom1", "tenancy.coretech.storage.reader"); + assertNotNull(policy); + + assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), "addtenancydom1:role.coretech.storage.reader"); + + policy = zms.getPolicy(mockDomRsrcCtx, "AddTenancyDom1", "tenancy.coretech.storage.writer"); + assertNotNull(policy); + + assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), "addtenancydom1:role.coretech.storage.writer"); + + // now add the tenant roles for our domain since our mock provider client + // cannot connect to our zms instance + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + TenantRoles tenantRoles = new TenantRoles().setDomain("coretech") + .setService("storage").setTenant("AddTenancyDom1") + .setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, "coretech", "storage", "AddTenancyDom1", + auditRef, tenantRoles); + + Tenancy tenant1 = zms.getTenancy(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage"); + assertNotNull(tenant1); + + zms.deleteTenancy(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage", auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AddTenancyDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + } + + @Test + public void testPutTenancyWithAuthorizedService() { + + String tenantDomain = "puttenancyauthorizedservice"; + String providerService = "storage"; + String providerDomain = "coretech"; + String provider = providerDomain + "." + providerService; + + setupTenantDomainProviderService(tenantDomain, providerDomain, providerService, null); + + // tenant is setup so let's setup up policy to authorize access to tenants + // without this role/policy we won't be authorized to add tenant roles + // to the provider domain even with authorized service details + + Role role = createRoleObject(providerDomain, "self_serve", null, + providerDomain + "." + providerService, null); + zms.putRole(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, role); + + Policy policy = createPolicyObject(providerDomain, "self_serve", + "self_serve", "update", providerDomain + ":tenant.*", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, policy); + + // we are going to create a principal object with authorized service + // set to coretech.storage + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String userId = "user1"; + String unsignedCreds = "v=U1;d=user;u=" + userId; + Principal principal = SimplePrincipal.create("user", userId, unsignedCreds + ";s=signature", 0, principalAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); + ((SimplePrincipal) principal).setAuthorizedService(provider); + ResourceContext ctx = createResourceContext(principal); + + // after this call we should have admin roles set for both provider and tenant + + Tenancy tenant = createTenantObject(tenantDomain, provider); + zms.putTenancy(ctx, tenantDomain, provider, auditRef, tenant); + + // make sure our policy has been created + + policy = zms.getPolicy(mockDomRsrcCtx, tenantDomain, "tenancy." + provider + ".admin"); + assertNotNull(policy); + + String tenantRoleInProviderDomain = providerService + ".tenant." + tenantDomain + ".admin"; + + List assertList = policy.getAssertions(); + assertEquals(3, assertList.size()); + boolean domainAdminRoleCheck = false; + boolean tenantAdminRoleCheck = false; + boolean tenantUpdateCheck = false; + for (Assertion obj : assertList) { + assertEquals(AssertionEffect.ALLOW, obj.getEffect()); + if (obj.getRole().equals(tenantDomain + ":role.admin")) { + assertEquals("assume_role", obj.getAction()); + assertEquals("coretech:role.storage.tenant.puttenancyauthorizedservice.admin", obj.getResource()); + domainAdminRoleCheck = true; + } else if (obj.getRole().equals(tenantDomain + ":role.tenancy." + provider + ".admin")) { + if (obj.getAction().equals("assume_role")) { + assertEquals("coretech:role.storage.tenant.puttenancyauthorizedservice.admin", obj.getResource()); + tenantAdminRoleCheck = true; + } else if (obj.getAction().equals("update")) { + assertEquals(tenantDomain + ":tenancy." + provider, obj.getResource()); + tenantUpdateCheck = true; + } + } + } + assertTrue(domainAdminRoleCheck); + assertTrue(tenantAdminRoleCheck); + assertTrue(tenantUpdateCheck); + + // now let's verify the provider side by using the get tenant roles call + + TenantRoles tRoles = zms.getTenantRoles(mockDomRsrcCtx, providerDomain, providerService, tenantDomain); + assertNotNull(tRoles); + assertEquals(1, tRoles.getRoles().size()); + TenantRoleAction roleAction = tRoles.getRoles().get(0); + assertEquals("*", roleAction.getAction()); + assertEquals("admin", roleAction.getRole()); + + role = zms.getRole(mockDomRsrcCtx, providerDomain, tenantRoleInProviderDomain, false, false); + assertNotNull(role); + + // now let's call delete tenancy support with the same authorized service token + + zms.deleteTenancy(ctx, tenantDomain, provider, auditRef); + + // verify that all roles and policies have been deleted + + try { + zms.getPolicy(mockDomRsrcCtx, tenantDomain, "tenancy." + provider + ".admin"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + try { + zms.getRole(mockDomRsrcCtx, providerDomain, tenantRoleInProviderDomain, false, false); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + // get tenant roles now returns an empty set + + tRoles = zms.getTenantRoles(mockDomRsrcCtx, providerDomain, providerService, tenantDomain); + assertNotNull(tRoles); + assertEquals(0, tRoles.getRoles().size()); + + // clean up our domains + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + + @Test + public void testPutTenancyWithAuthorizedServiceMismatch() { + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_puttenancywithauthsvcmism"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String tenantDomain = "puttenancyauthorizedservicemismatch"; + String providerService = "storage"; + String providerDomain = "coretech-test"; + String provider = providerDomain + "." + providerService; + + setupTenantDomainProviderService(zmsImpl, tenantDomain, providerDomain, providerService, null); + + // tenant is setup so let's setup up policy to authorize access to tenants + // without this role/policy we won't be authorized to add tenant roles + // to the provider domain even with authorized service details + + Role role = createRoleObject(providerDomain, "self_serve", null, + providerDomain + "." + providerService, null); + zmsImpl.putRole(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, role); + + Policy policy = createPolicyObject(providerDomain, "self_serve", + "self_serve", "update", providerDomain + ":tenant.*", AssertionEffect.ALLOW); + zmsImpl.putPolicy(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, policy); + + // we are going to create a principal object with authorized service + // set to coretech.storage + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String userId = "user1"; + String unsignedCreds = "v=U1;d=user;u=" + userId; + Principal principal = SimplePrincipal.create("user", userId, unsignedCreds + ";s=signature", 0, principalAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); + ((SimplePrincipal) principal).setAuthorizedService("coretech.storage"); // make provider mismatch + ResourceContext ctx = createResourceContext(principal); + + // this should fail since the authorized service name does not + // match to the provider and there is no endpoint specified for the provider + + Tenancy tenant = createTenantObject(tenantDomain, provider); + try { + zmsImpl.putTenancy(ctx, tenantDomain, provider, auditRef, tenant); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + String caller = "puttenancy"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg.indexOf("WHAT-details=(ERROR=(putTenancy: tenant domain(puttenancyauthorizedservicemismatch): Cannot put tenancy on provider service=coretech-test.storage -- not a provider service)") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + // clean up our domains + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testPutTenancyWithoutTenantRoles() { + + setupTenantDomainProviderService("AddTenancyDom1", "coretech", "storage", + "http://localhost:8090/provider"); + + Tenancy tenant = createTenantObject("AddTenancyDom1", "coretech.storage"); + ProviderMockClient.setReturnTenantRoles(false); + zms.putTenancy(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage", auditRef, tenant); + + // make sure our roles have not been created + + try { + zms.getRole(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage.admin", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getRole(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage.reader", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getRole(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage.writer", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + // verify the admin policy has been successfully created + + Policy policy = zms.getPolicy(mockDomRsrcCtx, "AddTenancyDom1", "tenancy.coretech.storage.admin"); + assertNotNull(policy); + + // we should not have other policies for actions + + try { + zms.getPolicy(mockDomRsrcCtx, "AddTenancyDom1", "tenancy.coretech.storage.reader"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getPolicy(mockDomRsrcCtx, "AddTenancyDom1", "tenancy.coretech.storage.writer"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + zms.deleteTenancy(mockDomRsrcCtx, "AddTenancyDom1", "coretech.storage", auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "AddTenancyDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + } + + @Test + public void testPutTenancyResourceGroup() { + + String domain = "addtenancyresourcegroupdom1"; + + setupTenantDomainProviderService(domain, "coretech", "storage", + "http://localhost:8090/provider"); + + Tenancy tenant = createTenantObject(domain, "coretech.storage"); + ProviderMockClient.setReturnTenantRoles(false); + zms.putTenancy(mockDomRsrcCtx, domain, "coretech.storage", auditRef, tenant); + + // make sure our roles have not been created + + try { + zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.admin", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.reader", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.writer", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + // verify the admin policy has been successfully created + + Policy policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.admin"); + assertNotNull(policy); + + // we should not have other policies for actions + + try { + zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.reader"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.writer"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + // now let's put a resource group + + TenancyResourceGroup detail = new TenancyResourceGroup(); + detail.setDomain(domain).setService("coretech.storage").setResourceGroup("hockey"); + zms.putTenancyResourceGroup(mockDomRsrcCtx, domain, "coretech.storage", "hockey", auditRef, detail); + + // now verify that roles were created successfully + + Role role = zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.hockey.reader", false, false); + assertNotNull(role); + + role = zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.hockey.writer", false, false); + assertNotNull(role); + + // verify the policies were created successfully + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.hockey.reader"); + assertNotNull(policy); + + List assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), domain + ":role.coretech.storage.res_group.hockey.reader"); + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.hockey.writer"); + assertNotNull(policy); + + assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), domain + ":role.coretech.storage.res_group.hockey.writer"); + + // now add the tenant roles for our domain since our mock provider client + // cannot connect to our zms instance + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles().setDomain("coretech") + .setService("storage").setTenant(domain) + .setRoles(roleActions).setResourceGroup("hockey"); + + zms.putTenantResourceGroupRoles(mockDomRsrcCtx, "coretech", "storage", domain, "hockey", + auditRef, tenantRoles); + + List tenantResourceGroups = new ArrayList<>(); + tenantResourceGroups.add("hockey"); + ProviderMockClient.setResourceGroups(tenantResourceGroups); + + // let's verify that our get Tenancy returns the resource group + + Tenancy tenancy = zms.getTenancy(mockDomRsrcCtx, domain, "coretech.storage"); + assertNotNull(tenancy); + assertEquals(1, tenancy.getResourceGroups().size()); + assertTrue(tenancy.getResourceGroups().contains("hockey")); + ProviderMockClient.setResourceGroups(null); + + // now let's add another resource group + + detail = new TenancyResourceGroup(); + detail.setDomain(domain).setService("coretech.storage").setResourceGroup("baseball"); + zms.putTenancyResourceGroup(mockDomRsrcCtx, domain, "coretech.storage", "baseball", auditRef, detail); + + // now verify that roles were created successfully + + role = zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.baseball.reader", false, false); + assertNotNull(role); + + role = zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.baseball.writer", false, false); + assertNotNull(role); + + // verify the policies were created successfully + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.baseball.reader"); + assertNotNull(policy); + + assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), domain + ":role.coretech.storage.res_group.baseball.reader"); + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.baseball.writer"); + assertNotNull(policy); + + assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), domain + ":role.coretech.storage.res_group.baseball.writer"); + + // now add the tenant roles for our domain since our mock provider client + // cannot connect to our zms instance + + tenantRoles = new TenantResourceGroupRoles().setDomain("coretech") + .setService("storage").setTenant(domain) + .setRoles(roleActions).setResourceGroup("baseball"); + + zms.putTenantResourceGroupRoles(mockDomRsrcCtx, "coretech", "storage", domain, "baseball", + auditRef, tenantRoles); + + tenantResourceGroups.add("baseball"); + ProviderMockClient.setResourceGroups(tenantResourceGroups); + + tenancy = zms.getTenancy(mockDomRsrcCtx, domain, "coretech.storage"); + assertNotNull(tenancy); + assertEquals(2, tenancy.getResourceGroups().size()); + assertTrue(tenancy.getResourceGroups().contains("hockey")); + assertTrue(tenancy.getResourceGroups().contains("baseball")); + ProviderMockClient.setResourceGroups(null); + + // now we're going to let the provider an extra resource + // that must be removed by zms since there are no policies + // defined for that resource group + + tenantResourceGroups.add("basketball"); + ProviderMockClient.setResourceGroups(tenantResourceGroups); + + tenancy = zms.getTenancy(mockDomRsrcCtx, domain, "coretech.storage"); + assertNotNull(tenancy); + assertEquals(2, tenancy.getResourceGroups().size()); + assertTrue(tenancy.getResourceGroups().contains("hockey")); + assertTrue(tenancy.getResourceGroups().contains("baseball")); + ProviderMockClient.setResourceGroups(null); + + zms.deleteTenancy(mockDomRsrcCtx, domain, "coretech.storage", auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + } + + @Test + public void testPutTenancyMissingAuditRef() { + String tenantDomain = "testPutTenancyMissingAuditRef"; + String providerDomain = "providerTestPutTenancyMissingAuditRef"; + String providerService = "storage"; + + // create tenant and provider domains + // + setupTenantDomainProviderService(tenantDomain, providerDomain, providerService, + "http://localhost:8090/provider"); + + // modify the tenant domain to require auditing + // + DomainMeta meta = createDomainMetaObject("Tenant Domain", null, false, true, null, 0); + zms.putDomainMeta(mockDomRsrcCtx, tenantDomain, auditRef, meta); + + Tenancy tenant = createTenantObject(tenantDomain, providerDomain + "." + providerService); + try { + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, tenantDomain, providerDomain + "." + providerService, null, tenant); + fail("requesterror not thrown by putTenancy."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + } + + @Test + public void testPutTenancyThrowException() { + String domainName = "AddTenancyDom2"; + String tenantDomain = "coretech2"; + String tenantService = "storage"; + String service = tenantDomain + "." + tenantService; + + try { + // use invalid provider-endpoint. + setupTenantDomainProviderService(domainName, tenantDomain, tenantService, ""); + + Tenancy tenant = createTenantObject(domainName, service); + + // should fail because do not have a valid provider-endpoint. + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, domainName, service, auditRef, tenant); + fail("requesterror not thrown"); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testDeleteTenancy() { + String tenantDomain = "testDeleteTenancy"; + String providerDomain = "providerTestDeleteTenancy"; + String providerService = "storage"; + String provServiceYRN = providerDomain + "." + providerService; + + // create tenant and provider domains + // + setupTenantDomainProviderService(tenantDomain, providerDomain, providerService, + "http://localhost:8090/provider"); + + // modify the tenant domain to require auditing + // + DomainMeta meta = + createDomainMetaObject("Tenant Domain", null, false, true, null, 0); + zms.putDomainMeta(mockDomRsrcCtx, tenantDomain, auditRef, meta); + + String testRoleName = providerDomain + ".testrole"; + Role role = createRoleObject(tenantDomain, testRoleName, null, "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, tenantDomain, testRoleName, auditRef, role); + + // setup tenancy + // + Tenancy tenant = createTenantObject(tenantDomain, provServiceYRN); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, tenantDomain, provServiceYRN, auditRef, tenant); + + try { + zms.deleteTenancy(mockDomRsrcCtx, tenantDomain, provServiceYRN, auditRef); + + // verify we didn't delete a role by mistake + + assertNotNull(zms.getRole(mockDomRsrcCtx, tenantDomain, testRoleName, false, false)); + + // verify that all roles and policies have been deleted + + try { + zms.getRole(mockDomRsrcCtx, tenantDomain, provServiceYRN + ".admin", false, false); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + try { + zms.getRole(mockDomRsrcCtx, tenantDomain, provServiceYRN + ".reader", false, false); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + try { + zms.getRole(mockDomRsrcCtx, tenantDomain, provServiceYRN + ".writer", false, false); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + try { + zms.getPolicy(mockDomRsrcCtx, tenantDomain, "tenancy." + provServiceYRN + ".admin"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + try { + zms.getPolicy(mockDomRsrcCtx, tenantDomain, "tenancy." + provServiceYRN + ".reader"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + try { + zms.getPolicy(mockDomRsrcCtx, tenantDomain, "tenancy." + provServiceYRN + ".writer"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + } + + @Test + public void testDeleteTenancyResourceGroup() { + + String domain = "deletetenancyresourcegroupdom1"; + + setupTenantDomainProviderService(domain, "coretech", "storage", + "http://localhost:8090/provider"); + + Tenancy tenant = createTenantObject(domain, "coretech.storage"); + ProviderMockClient.setReturnTenantRoles(false); + zms.putTenancy(mockDomRsrcCtx, domain, "coretech.storage", auditRef, tenant); + + // verify the admin policy has been successfully created + + Policy policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.admin"); + assertNotNull(policy); + + // now let's put a resource group + + TenancyResourceGroup detail = new TenancyResourceGroup(); + detail.setDomain(domain).setService("coretech.storage").setResourceGroup("hockey"); + zms.putTenancyResourceGroup(mockDomRsrcCtx, domain, "coretech.storage", "hockey", auditRef, detail); + + // now let's add another resource group + + detail = new TenancyResourceGroup(); + detail.setDomain(domain).setService("coretech.storage").setResourceGroup("baseball"); + zms.putTenancyResourceGroup(mockDomRsrcCtx, domain, "coretech.storage", "baseball", auditRef, detail); + + // now let's delete our initial hockey resource group + + zms.deleteTenancyResourceGroup(mockDomRsrcCtx, domain, "coretech.storage", "hockey", auditRef); + + // verify the admin policy is still present + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.admin"); + assertNotNull(policy); + + // now verify that baseball roles are still around + + Role role = zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.baseball.reader", false, false); + assertNotNull(role); + + role = zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.baseball.writer", false, false); + assertNotNull(role); + + // verify the policies also exist for baseball group + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.baseball.reader"); + assertNotNull(policy); + + List assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), domain + ":role.coretech.storage.res_group.baseball.reader"); + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.baseball.writer"); + assertNotNull(policy); + + assertList = policy.getAssertions(); + assertEquals(assertList.size(), 1); + assertEquals(assertList.get(0).getRole(), domain + ":role.coretech.storage.res_group.baseball.writer"); + + // now verify that the hockey roles and policies were indeed removed + + try { + zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.hockey.reader", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.hockey.writer", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + // we should not have other policies for actions + + try { + zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.hockey.reader"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.hockey.writer"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + // now let's delete the baseball resource group as well + + zms.deleteTenancyResourceGroup(mockDomRsrcCtx, domain, "coretech.storage", "baseball", auditRef); + + // now verify that the admin policy is still around + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.admin"); + assertNotNull(policy); + + // now verify that the baseball roles and policies were indeed removed + + try { + zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.baseball.reader", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getRole(mockDomRsrcCtx, domain, "coretech.storage.res_group.baseball.writer", false, false); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + // we should not have other policies for actions + + try { + zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.baseball.reader"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + try { + zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.res_group.baseball.writer"); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + // now let's just delete some invalid resource group which should not + // affect anything since we have no roles/policies to delete + + zms.deleteTenancyResourceGroup(mockDomRsrcCtx, domain, "coretech.storage", "basketball", auditRef); + + // now verify that the admin policy is still around + + policy = zms.getPolicy(mockDomRsrcCtx, domain, "tenancy.coretech.storage.admin"); + assertNotNull(policy); + + zms.deleteTenancy(mockDomRsrcCtx, domain, "coretech.storage", auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef); + } + + @Test + public void testDeleteTenancyMissingService() { + String tenantDomain = "testDeleteTenancy"; + String providerDomain = "providerTestDeleteTenancy"; + String providerService = "storage"; + String provServiceYRN = providerDomain + "." + providerService; + + // create tenant and provider domains + // + setupTenantDomainProviderService(tenantDomain, providerDomain, providerService, + "http://localhost:8090/provider"); + + // modify the tenant domain to require auditing + // + DomainMeta meta = + createDomainMetaObject("Tenant Domain", null, false, true, null, 0); + zms.putDomainMeta(mockDomRsrcCtx, tenantDomain, auditRef, meta); + + // setup tenancy + // + Tenancy tenant = createTenantObject(tenantDomain, provServiceYRN); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, tenantDomain, provServiceYRN, auditRef, tenant); + + // delete the provider service + + zms.deleteServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef); + + try { + zms.deleteTenancy(mockDomRsrcCtx, tenantDomain, provServiceYRN, auditRef); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("service does not exist")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + } + + @Test + public void testDeleteTenancyMissingEndpoint() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_deltenancymissendpoint"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String tenantDomain = "testDeleteTenancyMissEnd"; + String providerDomain = "providerTestDeleteTenancyMissEnd"; + String providerService = "storage"; + String provServiceYRN = providerDomain + "." + providerService; + + // create tenant and provider domains + // + setupTenantDomainProviderService(zmsImpl, tenantDomain, providerDomain, providerService, + "http://localhost:8090/provider"); + + // modify the tenant domain to require auditing + // + DomainMeta meta = + createDomainMetaObject("Tenant Domain", null, false, true, null, 0); + zmsImpl.putDomainMeta(mockDomRsrcCtx, tenantDomain, auditRef, meta); + + // setup tenancy + // + Tenancy tenant = createTenantObject(tenantDomain, provServiceYRN); + ProviderMockClient.setReturnTenantRoles(true); + zmsImpl.putTenancy(mockDomRsrcCtx, tenantDomain, provServiceYRN, auditRef, tenant); + + // delete the provider service endpoint + + ServiceIdentity service = createServiceObject( + providerDomain, providerService, null, + "/usr/bin/java", "root", "users", "localhost"); + + zmsImpl.putServiceIdentity(mockDomRsrcCtx, providerDomain, providerService, auditRef, service); + + try { + zmsImpl.deleteTenancy(mockDomRsrcCtx, tenantDomain, provServiceYRN, auditRef); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("service does not have endpoint configured")); + + String caller = "deletetenancy"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + if (msg.indexOf("(ERROR=(deleteTenancy") == -1) { + continue; + } + assertTrue(msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + String errMsg = "WHAT-details=(ERROR=(deleteTenancy: Tenant cleanup in(testdeletetenancymissend): completed successfully. However, there was an error when contacting the Provider Service: providertestdeletetenancymissend.storage:service does not have endpoint configured"; + int index = msg.indexOf(errMsg); + assertTrue(index != -1); + foundError = true; + break; + } + assertTrue(foundError); + + } finally { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + } + + @Test + public void testDeleteTenancyMissingAuditRef() { + String tenantDomain = "testDeleteTenancyMissingAuditRef"; + String providerDomain = "providerTestDeleteTenancyMissingAuditRef"; + String providerService = "storage"; + + // create tenant and provider domains + // + setupTenantDomainProviderService(tenantDomain, providerDomain, providerService, + "http://localhost:8090/provider"); + + // modify the tenant domain to require auditing + // + DomainMeta meta = + createDomainMetaObject("Tenant Domain", null, false, true, null, 0); + zms.putDomainMeta(mockDomRsrcCtx, tenantDomain, auditRef, meta); + + // setup tenancy + // + Tenancy tenant = createTenantObject(tenantDomain, providerDomain + "." + providerService); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, tenantDomain, providerDomain + "." + providerService, auditRef, tenant); + + try { + zms.deleteTenancy(mockDomRsrcCtx, tenantDomain, providerDomain + "." + providerService, null); + fail("requesterror not thrown by deleteTenancy."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + } + + @Test + public void testPutTenantRoles() { + + String domain = "testPutTenantRoles"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String serviceName = "storage"; + String tenantDomain = "tenantTestPutTenantRoles"; + TenantRoles tenantRoles = new TenantRoles().setDomain(domain) + .setService(serviceName).setTenant(tenantDomain) + .setRoles(roleActions); + zms.putTenantRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, auditRef, tenantRoles); + + TenantRoles tRoles = zms.getTenantRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain); + assertNotNull(tRoles); + assertEquals(tRoles.getDomain(), domain.toLowerCase()); + assertEquals(tRoles.getService(), serviceName.toLowerCase()); + assertEquals(tRoles.getTenant(), tenantDomain.toLowerCase()); + assertEquals(tRoles.getRoles().size(), TABLE_PROVIDER_ROLE_ACTIONS.size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + + @Test + public void testPutTenantRolesMissingAuditRef() { + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_puttenantrolesmissauditref"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domain = "testPutTenantRoles"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String serviceName = "storage"; + String tenantDomain = "tenantTestPutTenantRoles"; + TenantRoles tenantRoles = new TenantRoles().setDomain(domain) + .setService(serviceName).setTenant(tenantDomain) + .setRoles(roleActions); + try { + zmsImpl.putTenantRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, null, tenantRoles); + fail("requesterror not thrown by putTenantRoles."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + + String caller = "puttenantroles"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(puttenantroles: Audit reference required for domain: testputtenantroles);:caller specified provider-service=(storage))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } finally { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + } + + @Test + public void testPutTenantRolesThrowException() { + String domainName = "AddTenancyDom3"; + String tenantDomain = "coretech3"; + String tenantService = "storage"; + String providerEndpoint = "http://localhost:8090/provider"; + String service = tenantDomain + "." + tenantService; + + // Should FAIL validate() as we are passing null for the tenant role action list. + try { + setupTenantDomainProviderService(domainName, tenantDomain, tenantService, providerEndpoint); + + Tenancy tenant = createTenantObject(domainName, service); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, domainName, service, auditRef, tenant); + + zms.putTenantRoles(mockDomRsrcCtx, tenantDomain, tenantService, domainName, auditRef, null); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } finally { + zms.deleteTenancy(mockDomRsrcCtx, domainName, service, auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + // Should FAIL validate() as we are passing an empty tenantroles. + try { + setupTenantDomainProviderService(domainName, tenantDomain, tenantService, providerEndpoint); + + Tenancy tenant = createTenantObject(domainName, service); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, domainName, service, auditRef, tenant); + + TenantRoles tenantRoles = new TenantRoles(); + + zms.putTenantRoles(mockDomRsrcCtx, tenantDomain, tenantService, domainName, auditRef, tenantRoles); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } finally { + zms.deleteTenancy(mockDomRsrcCtx, domainName, service, auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + // Should FAIL as we are passing a tenantrole with empty actions list. + try { + setupTenantDomainProviderService(domainName, tenantDomain, tenantService, providerEndpoint); + + Tenancy tenant = createTenantObject(domainName, service); + ProviderMockClient.setReturnTenantRoles(true); + zms.putTenancy(mockDomRsrcCtx, domainName, service, auditRef, tenant); + + List roleActions = new ArrayList(); + TenantRoles tenantRoles = new TenantRoles().setDomain(tenantDomain) + .setService(tenantService).setTenant(domainName).setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, tenantDomain, tenantService, domainName, auditRef, tenantRoles); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } finally { + zms.deleteTenancy(mockDomRsrcCtx, domainName, service, auditRef); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + } + + @Test + public void testPutTenantRolesWithResourceGroup() { + + String domain = "testPutTenantRoles"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String serviceName = "storage"; + String tenantDomain = "tenantTestPutTenantRoles"; + String resourceGroup = "Group1"; + + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles().setDomain(domain) + .setService(serviceName).setTenant(tenantDomain) + .setRoles(roleActions).setResourceGroup(resourceGroup); + zms.putTenantResourceGroupRoles(mockDomRsrcCtx, domain, serviceName, tenantDomain, resourceGroup, + auditRef, tenantRoles); + + TenantResourceGroupRoles tRoles = zms.getTenantResourceGroupRoles(mockDomRsrcCtx, domain, serviceName, + tenantDomain, resourceGroup); + assertNotNull(tRoles); + assertEquals(domain.toLowerCase(), tRoles.getDomain()); + assertEquals(serviceName.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(TABLE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + + @Test + public void testGetDomainDataCheck() { + + String tenantDomainName = "testGetDomainDataCheck"; + TopLevelDomain tenDom = createTopLevelDomainObject(tenantDomainName, + "Test Provider Domain", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, tenDom); + // create roles + Role role1 = createRoleObject(tenantDomainName, "Role1", null, "user.joe", "user.jane"); + zms.putRole(mockDomRsrcCtx, tenantDomainName, "Role1", auditRef, role1); + + Role role2 = createRoleObject(tenantDomainName, "Role2", null, "user.phil", "user.gil"); + zms.putRole(mockDomRsrcCtx, tenantDomainName, "Role2", auditRef, role2); + + // create policies + Policy policy1 = createPolicyObject(tenantDomainName, "Policy1", "Role1", + "UPDATE", tenantDomainName + ":resource1", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy1", auditRef, policy1); + Policy policy2 = createPolicyObject(tenantDomainName, "Policy2", "Role2", + "READ", tenantDomainName + ":resource1", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy2); + // + // test valid setup domain + DomainDataCheck ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(3, ddc.getPolicyCount()); + assertEquals(3, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // set valid wildcard role + Assertion assertion = new Assertion(); + assertion.setAction("MANAGE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(tenantDomainName + ":wildlife"); + assertion.setRole(tenantDomainName + ":role.Role*"); + + Policy policy = zms.getPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2"); + List assertList = policy.getAssertions(); + assertList.add(assertion); + policy.setAssertions(assertList); + zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(3, ddc.getPolicyCount()); + assertEquals(4, ddc.getAssertionCount()); + assertEquals(1, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // test dangling policy with wildcard role + assertion = new Assertion(); + assertion.setAction("MANAGE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(tenantDomainName + ":wildlife"); + assertion.setRole(tenantDomainName + ":role.Wild*"); + + policy = zms.getPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2"); + assertList = policy.getAssertions(); + assertList.add(assertion); + policy.setAssertions(assertList); + zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(3, ddc.getPolicyCount()); + assertEquals(5, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertEquals(1, ddc.getDanglingPolicies().size()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // add a dangling role + Role role3 = createRoleObject(tenantDomainName, "Role3", null, "user.user1", "user.user3"); + zms.putRole(mockDomRsrcCtx, tenantDomainName, "Role3", auditRef, role3); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(3, ddc.getPolicyCount()); + assertEquals(5, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(1, ddc.getDanglingPolicies().size()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // test more dangling policies + // create policy with assertion using unknown role + assertion = new Assertion(); + assertion.setAction("snorkel"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(tenantDomainName + ":molokoni"); + assertion.setRole(tenantDomainName + ":role.snorkeler"); + + policy = zms.getPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2"); + assertList = policy.getAssertions(); + assertList.add(assertion); + policy.setAssertions(assertList); + zms.putPolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef, policy); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(3, ddc.getPolicyCount()); + assertEquals(6, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // create provider domain + String provDomainTop = "testGetDomainDataCheckProvider"; + TopLevelDomain provDom = createTopLevelDomainObject(provDomainTop, + "Test Provider Domain", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, provDom); + + String provDomainSub = provDomainTop + ".sub"; + SubDomain subDom = createSubDomainObject("sub", provDomainTop, null, null, adminUser); + subDom.setAuditEnabled(true); + zms.postSubDomain(mockDomRsrcCtx, provDomainTop, auditRef, subDom); + + // test incomplete tenancy setup + // put tenancy for provider + String provEndPoint = "http://localhost:8090/provider"; + String provSvc = "storage"; + ServiceIdentity service = createServiceObject( + provDomainSub, provSvc, provEndPoint, + "/usr/bin/java", "root", "users", "localhost"); + + zms.putServiceIdentity(mockDomRsrcCtx, provDomainSub, provSvc, auditRef, service); + + ProviderMockClient.setReturnTenantRoles(true); + Tenancy tenant = createTenantObject(tenantDomainName, provDomainSub + "." + provSvc); + zms.putTenancy(mockDomRsrcCtx, tenantDomainName, provDomainSub + "." + provSvc, auditRef, tenant); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(6, ddc.getPolicyCount()); + assertEquals(12, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertTrue(ddc.getDanglingRoles().contains("role3")); + boolean danglingPolicy1Found = false; + boolean danglingPolicy2Found = false; + for (DanglingPolicy danglingPolicy : ddc.getDanglingPolicies()) { + if (danglingPolicy.getPolicyName().equals("policy2") && danglingPolicy.getRoleName().equals("wild*")) { + danglingPolicy1Found = true; + } else if (danglingPolicy.getPolicyName().equals("policy2") && danglingPolicy.getRoleName().equals("snorkeler")) { + danglingPolicy2Found = true; + } + } + assertTrue(danglingPolicy1Found); + assertTrue(danglingPolicy2Found); + assertEquals(1, ddc.getProvidersWithoutTrust().size()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // test that now all is hunky dory between the tenant and provider + // provider gets the trust role(s) + List roleActions = new ArrayList(); + for (Struct.Field f : TABLE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction((String) f.value())); + } + + TenantRoles tenantRoles = new TenantRoles().setDomain(provDomainSub) + .setService(provSvc).setTenant(tenantDomainName) + .setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, provDomainSub, provSvc, tenantDomainName, + auditRef, tenantRoles); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(6, ddc.getPolicyCount()); + assertEquals(12, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainSub); + assertNotNull(ddc); + assertEquals(4, ddc.getPolicyCount()); + assertEquals(4, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // test provider should report tenant is missing + // remove the assume_role policies from the tenant + zms.deleteTenancy(mockDomRsrcCtx, tenantDomainName, provDomainSub + "." + provSvc, auditRef); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainSub); + assertNotNull(ddc); + assertEquals(4, ddc.getPolicyCount()); + assertEquals(4, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertNull(ddc.getProvidersWithoutTrust()); + assertTrue(ddc.getTenantsWithoutAssumeRole().size() == 1); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(3, ddc.getPolicyCount()); + assertEquals(6, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(2, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // test service name with resource group + // setup up the top level domain+service with resource group + String provSvcTop = "shelter"; + service = createServiceObject( + provDomainTop, provSvcTop, provEndPoint, + "/usr/bin/java", "root", "users", "localhost"); + + zms.putServiceIdentity(mockDomRsrcCtx, provDomainTop, provSvcTop, auditRef, service); + + TenantResourceGroupRoles tenantGroupRoles = new TenantResourceGroupRoles() + .setDomain(provDomainTop) + .setService(provSvcTop).setTenant(tenantDomainName) + .setRoles(roleActions).setResourceGroup("ravers"); + // put the trust roles with resource group into top level provider domain + // - tenant is not yet supporting the top level domain + zms.putTenantResourceGroupRoles(mockDomRsrcCtx, provDomainTop, provSvcTop, tenantDomainName, "ravers", + auditRef, tenantGroupRoles); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainTop); + assertNotNull(ddc); + assertEquals(4, ddc.getPolicyCount()); + assertEquals(4, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertNull(ddc.getProvidersWithoutTrust()); + assertEquals(1, ddc.getTenantsWithoutAssumeRole().size()); + + // now set up the tenant for the sub domain provider + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(provDomainSub).setService(provSvc) + .setTenant(tenantDomainName).setRoles(roleActions) + .setResourceGroup("ravers"); + // this sets up the assume roles in the tenant for the sub domain + // if it is an authorized service, then it will setup the provider roles too + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomainName, provDomainSub, provSvc, + "ravers", auditRef, providerRoles); + + // tenant sees that the subdomain provider isnt provisioned yet + // for the resource group: testgetdomaindatacheckprovider.sub.storage.ravers + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc.toString(), ddc); + assertEquals(7, ddc.getPolicyCount()); + assertEquals(12, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertEquals(1, ddc.getProvidersWithoutTrust().size()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // setup tenancy in the tenant domain for the provider subdomain + zms.putTenancy(mockDomRsrcCtx, tenantDomainName, provDomainSub + "." + provSvc, auditRef, tenant); + + // the subdomain provider believes it is in sync with tenant + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, provDomainSub); + assertNotNull(ddc); + assertEquals(4, ddc.getPolicyCount()); + assertEquals(4, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // but the tenant sees the sub provider is not setup + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(9, ddc.getPolicyCount()); + assertEquals(15, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertEquals(1, ddc.getProvidersWithoutTrust().size()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // now set up the sub domain provider for the tenant with resource groups + // so tenant and the sub domain provider are in sync again + // add resource groups to provider + tenantGroupRoles = new TenantResourceGroupRoles() + .setDomain(provDomainSub) + .setService(provSvc).setTenant(tenantDomainName) + .setRoles(roleActions).setResourceGroup("ravers"); + // put the trust roles into sub domain provider + zms.putTenantResourceGroupRoles(mockDomRsrcCtx, provDomainSub, provSvc, tenantDomainName, "ravers", + auditRef, tenantGroupRoles); + + // now tenant sees the sub domain has provisioned it + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(9, ddc.getPolicyCount()); + assertEquals(15, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // now set up the tenant for the top level domain provider + // so tenant and the top level domain provider are in sync again + providerRoles = new ProviderResourceGroupRoles() + .setDomain(provDomainTop).setService(provSvcTop) + .setTenant(tenantDomainName).setRoles(roleActions) + .setResourceGroup("ravers"); + // this sets up the assume roles in the tenant for the top level domain + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomainName, provDomainTop, provSvcTop, + "ravers", auditRef, providerRoles); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(13, ddc.getPolicyCount()); + assertEquals(21, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertEquals(1, ddc.getProvidersWithoutTrust().size()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // delete the resource group tenancy support from sub domain + // this means the tenant domain should show both the sub domain and + // the top domain is without trust roles + zms.deleteTenantResourceGroupRoles(mockDomRsrcCtx, provDomainSub, provSvc, + tenantDomainName, "ravers", auditRef); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(13, ddc.getPolicyCount()); + assertEquals(21, ddc.getAssertionCount()); + assertEquals(2, ddc.getRoleWildCardCount()); + assertEquals(1, ddc.getDanglingRoles().size()); + assertEquals(2, ddc.getDanglingPolicies().size()); + assertEquals(2, ddc.getProvidersWithoutTrust().size()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // delete the dangling policies and dangling role + zms.deletePolicy(mockDomRsrcCtx, tenantDomainName, "Policy2", auditRef); + zms.deleteRole(mockDomRsrcCtx, tenantDomainName, "Role3", auditRef); + zms.deleteRole(mockDomRsrcCtx, tenantDomainName, "Role2", auditRef); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(12, ddc.getPolicyCount()); + assertEquals(17, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertEquals(2, ddc.getProvidersWithoutTrust().size()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // add the tenancy support for top domain + // - now tenant will see that it is all setup + tenantRoles = new TenantRoles().setDomain(provDomainTop) + .setService(provSvcTop).setTenant(tenantDomainName) + .setRoles(roleActions); + + zms.putTenantRoles(mockDomRsrcCtx, provDomainTop, provSvcTop, tenantDomainName, + auditRef, tenantRoles); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(12, ddc.getPolicyCount()); + assertEquals(17, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertEquals(1, ddc.getProvidersWithoutTrust().size()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + // delete the provider resource group roles for the sub domain provider + // then everything in sync for this tenant + zms.deleteProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomainName, provDomainSub, provSvc, + "ravers", auditRef); + + ddc = zms.getDomainDataCheck(mockDomRsrcCtx, tenantDomainName); + assertNotNull(ddc); + assertEquals(9, ddc.getPolicyCount()); + assertEquals(14, ddc.getAssertionCount()); + assertEquals(0, ddc.getRoleWildCardCount()); + assertNull(ddc.getDanglingRoles()); + assertNull(ddc.getDanglingPolicies()); + assertNull(ddc.getProvidersWithoutTrust()); + assertNull(ddc.getTenantsWithoutAssumeRole()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomainName, auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, provDomainTop, "sub", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, provDomainTop, auditRef); + } + + @Test + public void testGetServicePrincipal() { + + Authority principalAuthority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + SimpleServiceIdentityProvider provider = new SimpleServiceIdentityProvider(principalAuthority, privKey); + + Principal testPrincipal = provider.getIdentity("coretech", "storage"); + assertNotNull(testPrincipal); + ResourceContext rsrcCtxTest = createResourceContext(testPrincipal); + ServicePrincipal principal = zms.getServicePrincipal(rsrcCtxTest); + assertNotNull(principal); + assertTrue(principal.getService().equals("storage")); + assertTrue(principal.getDomain().equals("coretech")); + } + + @Test + public void testEmitMonmetricError() { + int errorCode = 403; + String caller = "forbiddenError"; + boolean isEmitMonmetricError; + + // negative tests + isEmitMonmetricError = ZMSUtils.emitMonmetricError(errorCode, null); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZMSUtils.emitMonmetricError(errorCode, ""); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZMSUtils.emitMonmetricError(errorCode, new String()); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZMSUtils.emitMonmetricError(errorCode, "invalidcharacterslike...$!?"); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZMSUtils.emitMonmetricError(errorCode, "spaces are not allowed"); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZMSUtils.emitMonmetricError(0, caller); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZMSUtils.emitMonmetricError(-100, caller); + assertFalse(isEmitMonmetricError); + + // positive tests + isEmitMonmetricError = ZMSUtils.emitMonmetricError(errorCode, caller); + assertTrue(isEmitMonmetricError); + + isEmitMonmetricError = ZMSUtils.emitMonmetricError(errorCode, " " + caller + " "); + assertTrue(isEmitMonmetricError); + } + + @Test + public void testCheckKerberosAuthorityAuthorization() { + Authority authority = new com.yahoo.athenz.auth.impl.KerberosAuthority(); + Principal principal = SimplePrincipal.create("krb", "user1", "v=U1;d=user;n=user1;s=signature", + 0, authority); + assertTrue(zms.authorityAuthorizationAllowed(principal)); + } + + @Test + public void testCheckNullAuthorityAuthorization() { + Principal principal = SimplePrincipal.create("user", "joe", "v=U1;d=user;n=user1;s=signature", + 0, null); + assertTrue(zms.authorityAuthorizationAllowed(principal)); + } + + @Test + public void testValidRoleTokenAccessTrustDomain() { + assertFalse(zms.validRoleTokenAccess("TrustDomain", "Domain1", "Domain1")); + } + + @Test + public void testValidRoleTokenAccessMismatchYRNs() { + assertFalse(zms.validRoleTokenAccess(null, "Domain1", "Domain2")); + } + + @Test + public void testValidRoleTokenAccessValid() { + assertTrue(zms.validRoleTokenAccess(null, "Domain1", "Domain1")); + } + + @Test + public void testIsVirtualDomain() { + + assertTrue(zms.isVirtualDomain("user.user1")); + assertTrue(zms.isVirtualDomain("user.user2")); + assertTrue(zms.isVirtualDomain("user.user1.sub1")); + assertTrue(zms.isVirtualDomain("user.user1.sub2.sub3")); + + assertFalse(zms.isVirtualDomain("user")); + assertFalse(zms.isVirtualDomain("usertest")); + assertFalse(zms.isVirtualDomain("coretech.api")); + } + + @Test + public void testHasExceededVirtualSubDomainLimitUnderLimitOneLevel() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "2"); + ZMSImpl zmsTest = zmsInit(); + + assertFalse(zmsTest.hasExceededVirtualSubDomainLimit("user.user1")); + + SubDomain dom = createSubDomainObject("sub1", "user.user1", + "Test Domain2", "testOrg", adminUser); + Domain resDom = zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + assertFalse(zmsTest.hasExceededVirtualSubDomainLimit("user.user1")); + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub1", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT); + } + + @Test + public void testHasExceededVirtualSubDomainLimitOverLimitOneLevel() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "2"); + ZMSImpl zmsTest = zmsInit(); + + SubDomain dom = createSubDomainObject("sub1", "user.user1", + "Test Domain2", "testOrg", adminUser); + Domain resDom = zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub2", "user.user1", + "Test Domain2", "testOrg", adminUser); + resDom = zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + assertTrue(zmsTest.hasExceededVirtualSubDomainLimit("user.user1")); + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub1", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub2", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT); + } + + @Test + public void testHasExceededVirtualSubDomainLimitUnderLimitMultipleLevel() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "3"); + ZMSImpl zmsTest = zmsInit(); + + assertFalse(zmsTest.hasExceededVirtualSubDomainLimit("user.user1")); + + SubDomain dom = createSubDomainObject("sub1", "user.user1", + "Test Domain2", "testOrg", adminUser); + Domain resDom = zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub2", "user.user1.sub1", + "Test Domain2", "testOrg", adminUser); + resDom = zms.postSubDomain(mockDomRsrcCtx, "user.user1.sub1", auditRef, dom); + assertNotNull(resDom); + + assertFalse(zmsTest.hasExceededVirtualSubDomainLimit("user.user1.sub1")); + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1.sub1", "sub2", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub1", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT); + } + + @Test + public void testHasExceededVirtualSubDomainLimitOverLimitMultipleLevel() { + + System.setProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT, "2"); + ZMSImpl zmsTest = zmsInit(); + + SubDomain dom = createSubDomainObject("sub1", "user.user1", + "Test Domain2", "testOrg", adminUser); + Domain resDom = zms.postSubDomain(mockDomRsrcCtx, "user.user1", auditRef, dom); + assertNotNull(resDom); + + dom = createSubDomainObject("sub2", "user.user1.sub1", + "Test Domain2", "testOrg", adminUser); + resDom = zms.postSubDomain(mockDomRsrcCtx, "user.user1.sub1", auditRef, dom); + assertNotNull(resDom); + + assertTrue(zmsTest.hasExceededVirtualSubDomainLimit("user.user1.sub1")); + assertTrue(zmsTest.hasExceededVirtualSubDomainLimit("user.user1")); + + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1.sub1", "sub2", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "user.user1", "sub1", auditRef); + System.clearProperty(ZMSConsts.ZMS_PROP_VIRTUAL_DOMAIN_LIMIT); + } + + @Test + public void testGetNormalizedMemberNoSplit() { + + assertEquals(zms.getNormalizedMember("user.user"), "user.user"); + assertEquals(zms.getNormalizedMember("user.user2"), "user.user2"); + assertEquals(zms.getNormalizedMember("user.user1"), "user.user1"); + assertEquals(zms.getNormalizedMember("coretech.storage"), "coretech.storage"); + assertEquals(zms.getNormalizedMember("user1"), "user1"); + } + + @Test + public void testGetNormalizedMemberInvalidFormat() { + + assertEquals(zms.getNormalizedMember("user:user:user1"), "user:user:user1"); + assertEquals(zms.getNormalizedMember("user:"), "user:"); + assertEquals(zms.getNormalizedMember("coretech:storage:api"), "coretech:storage:api"); + } + + @Test + public void testGetNormalizedMemberUsersWithSplit() { + + assertEquals(zms.getNormalizedMember("user:user"), "user.user"); + assertEquals(zms.getNormalizedMember("user:user2"), "user.user2"); + assertEquals(zms.getNormalizedMember("user:user1"), "user.user1"); + } + + @Test + public void testGetNormalizedMemberServiceWithSplit() { + + assertEquals(zms.getNormalizedMember("coretech:service.storage"), "coretech.storage"); + assertEquals(zms.getNormalizedMember("weather:service.storage.api"), "weather.storage.api"); + assertEquals(zms.getNormalizedMember("weather.storage:service.api"), "weather.storage.api"); + assertEquals(zms.getNormalizedMember("weather.storage:entity.api"), "weather.storage:entity.api"); + assertEquals(zms.getNormalizedMember("weather.storage:service."), "weather.storage."); + } + + @Test + public void testNormalizeRoleMembersUsers() { + + ArrayList roleMembers = new ArrayList<>(); + roleMembers.add("user:joe"); + roleMembers.add("user.joe"); + roleMembers.add("user:joe"); + roleMembers.add("user.jane"); + + Role role = createRoleObject("TestRole", "Role1", null, roleMembers); + zms.normalizeRoleMembers(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 2); + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + } + + @Test + public void testNormalizeRoleMembersServices() { + + ArrayList roleMembers = new ArrayList<>(); + roleMembers.add("coretech.storage"); + roleMembers.add("coretech:service.storage"); + roleMembers.add("weather:service.storage"); + + Role role = createRoleObject("TestRole", "Role1", null, roleMembers); + zms.normalizeRoleMembers(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 2); + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("weather.storage")); + } + + @Test + public void testNormalizeRoleMembersCombined() { + + ArrayList roleMembers = new ArrayList<>(); + roleMembers.add("user:joe"); + roleMembers.add("user.joe"); + roleMembers.add("user:joe"); + roleMembers.add("user.jane"); + roleMembers.add("coretech.storage"); + roleMembers.add("coretech:service.storage"); + roleMembers.add("weather:service.storage"); + roleMembers.add("weather.api.access"); + + Role role = createRoleObject("TestRole", "Role1", null, roleMembers); + zms.normalizeRoleMembers(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 5); + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user.jane")); + assertTrue(members.contains("weather.api.access")); + assertTrue(members.contains("coretech.storage")); + assertTrue(members.contains("weather.storage")); + } + + @Test + public void testNormalizeRoleMembersInvalid() { + + ArrayList roleMembers = new ArrayList<>(); + roleMembers.add("user.joe"); + roleMembers.add("user2"); + + Role role = createRoleObject("TestRole", "Role1", null, roleMembers); + zms.normalizeRoleMembers(role); + + List members = role.getMembers(); + assertNotNull(members); + assertEquals(members.size(), 2); + assertTrue(members.contains("user.joe")); + assertTrue(members.contains("user2")); + } + + @Test + public void testHasExceededListLimitNullLimit() { + assertFalse(zms.hasExceededListLimit(null, 10)); + } + + @Test + public void testHasExceededListLimitNotValidLimit() { + assertFalse(zms.hasExceededListLimit(0, 10)); + assertFalse(zms.hasExceededListLimit(-1, 10)); + } + + @Test + public void testHasExceededListLimitYes() { + assertTrue(zms.hasExceededListLimit(10, 11)); + } + + @Test + public void testHasExceededListLimitNo() { + assertFalse(zms.hasExceededListLimit(10, 9)); + assertFalse(zms.hasExceededListLimit(10, 10)); + } + + @Test + public void testVerifyServicePublicKeysNoKeys() { + + ServiceIdentity service = new ServiceIdentity(); + service.setName(ZMSUtils.serviceResourceName("ServiceAddInvalidCertDom1", "Service1")); + assertFalse(zms.verifyServicePublicKeys(service)); + } + + @Test + public void testVerifyServicePublicKeysInvalidPublicKeys() { + + ServiceIdentity service = new ServiceIdentity(); + service.setName(ZMSUtils.serviceResourceName("ServiceDom1", "Service1")); + + List publicKeyList = new ArrayList(); + PublicKeyEntry publicKeyEntry1 = new PublicKeyEntry(); + publicKeyEntry1.setKey("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTk"); + publicKeyEntry1.setId("1"); + publicKeyList.add(publicKeyEntry1); + service.setPublicKeys(publicKeyList); + + assertFalse(zms.verifyServicePublicKeys(service)); + } + + @Test + public void testVerifyServicePublicKeyInvalidPublicKey() { + assertFalse(zms.verifyServicePublicKey("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1B")); + assertFalse(zms.verifyServicePublicKey("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUVVBQTRHTk")); + assertFalse(zms.verifyServicePublicKey(privKeyK1)); + assertFalse(zms.verifyServicePublicKey(privKeyK2)); + } + + @Test + public void testVerifyServicePublicKeyValidPublicKey() { + assertTrue(zms.verifyServicePublicKey(pubKeyK1)); + assertTrue(zms.verifyServicePublicKey(pubKeyK2)); + } + + @Test + public void testVerifyServicePublicKeysValidKeysOnly() { + ServiceIdentity service = createServiceObject("ServiceAddDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + assertTrue(zms.verifyServicePublicKeys(service)); + } + + @Test + public void testShouldRunDelegatedTrustCheckNullTrust() { + assertFalse(zms.shouldRunDelegatedTrustCheck(null, "TrustDomain")); + } + @Test + public void testShouldRunDelegatedTrustCheckNullTrustDomain() { + assertTrue(zms.shouldRunDelegatedTrustCheck("TrustDomain", null)); + } + @Test + public void testShouldRunDelegatedTrustCheckMatch() { + assertTrue(zms.shouldRunDelegatedTrustCheck("TrustDomain", "TrustDomain")); + } + @Test + public void testShouldRunDelegatedTrustCheckNoMatch() { + assertFalse(zms.shouldRunDelegatedTrustCheck("TrustDomain1", "TrustDomain")); + } + + @Test + public void testIsValidUserTokenRequestNoAuthority() { + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature"); + assertFalse(zms.isValidUserTokenRequest(principal, "user1")); + } + + @Test + public void testIsValidUserTokenRequestNotuserAuthority() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", + 0, principalAuthority); + + assertFalse(zms.isValidUserTokenRequest(principal, "user1")); + } + + @Test + public void testIsValidUserTokenRequestNullPrincipal() { + assertFalse(zms.isValidUserTokenRequest(null, "user1")); + } + + @Test + public void testMatchDelegatedTrustPolicyNullAssertions() { + Policy policy = new Policy(); + assertFalse(zms.matchDelegatedTrustPolicy(policy, "testRole", "testMember", null)); + } + + @Test + public void testMatchDelegatedTrustAssertionInvalidAction() { + + Assertion assertion = new Assertion(); + assertion.setAction("READ"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain:*"); + assertion.setRole("domain:role.Role"); + + assertFalse(zms.matchDelegatedTrustAssertion(assertion, null, null, null)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoResPatternMatchWithOutPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain:role.Role"); + assertion.setRole("domain:role.Role"); + + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "domain:role.Role2", null, null)); + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, null)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoResPatternMatchWithPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("domain:role.Role"); + + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "domain:role.Role2", null, null)); + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "coretech:role.Role2", null, null)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoRoleMatchWithPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.*"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("coretech", "readers", null); + roles.add(role); + + role = createRoleObject("coretech", "writers", null); + roles.add(role); + + role = createRoleObject("coretech", "updaters", null); + roles.add(role); + + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoRoleMatchWithOutPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.Role"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("coretech", "Role1", null); + roles.add(role); + + role = createRoleObject("coretech", "Role2", null); + roles.add(role); + + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "weather:role.Role1", null, roles)); + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoMemberMatch() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.Role"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("weather", "Role1", null, "user.user1", null); + roles.add(role); + + role = createRoleObject("weather", "Role", null, "user.user2", null); + roles.add(role); + + assertFalse(zms.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user.user1", roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionValidWithPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.*"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("weather", "Role1", null, "user.user1", null); + roles.add(role); + + role = createRoleObject("weather", "Role", null, "user.user2", null); + roles.add(role); + + assertTrue(zms.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user.user2", roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionValidWithOutPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.Role"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("weather", "Role1", null, "user.user1", null); + roles.add(role); + + role = createRoleObject("weather", "Role", null, "user.user2", null); + roles.add(role); + + assertTrue(zms.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user.user2", roles)); + } + + @Test + public void testMatchPrincipalInRoleStdMemberMatch() { + + Role role = createRoleObject("weather", "Role", null, "user.user2", null); + assertTrue(zms.matchPrincipalInRole(role, null, "user.user2", null)); + } + + @Test + public void testMatchPrincipalInRoleStdMemberNoMatch() { + + Role role = createRoleObject("weather", "Role", null, "user.user2", null); + assertFalse(zms.matchPrincipalInRole(role, null, "user.user23", null)); + } + + @Test + public void testMatchPrincipalInRoleNoDelegatedTrust() { + Role role = createRoleObject("weather", "Role", null); + assertFalse(zms.matchPrincipalInRole(role, null, null, null)); + assertFalse(zms.matchPrincipalInRole(role, null, null, "weather")); + } + + @Test + public void testMatchPrincipalInRoleDelegatedTrustNoMatch() { + Role role = createRoleObject("weather", "Role", "coretech_not_present"); + assertFalse(zms.matchPrincipalInRole(role, "Role", "user.user1", "coretech_not_present")); + } + + @Test + public void testMatchPrincipalInRoleDelegatedTrustMatch() { + + String domainName = "coretechtrust"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user2"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Policy policy = createPolicyObject(domainName, "trust", "coretechtrust:role.role1", + false, "ASSUME_ROLE", "weather:role.role1", AssertionEffect.ALLOW); + zms.dbService.executePutPolicy(mockDomRsrcCtx, domainName, "trust", + policy, auditRef, "unitTest"); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user1", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user2", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role = createRoleObject("weather", "role1", domainName); + assertTrue(zms.matchPrincipalInRole(role, "weather:role.role1", "user.user1", "coretechtrust")); + assertFalse(zms.matchPrincipalInRole(role, "weather:role.role1", "user.user1", "coretechtrust2")); + assertFalse(zms.matchPrincipalInRole(role, "weather:role.role1", "user.user3", "coretechtrust")); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestNoCollection() { + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role3 = createRoleObject(domainName, "role3", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role3", + role3, auditRef, "unittest"); + + zms.dbService.executeDeletePolicy(mockDomRsrcCtx, domainName, "admin", auditRef, "unittest"); + + List names = new ArrayList<>(); + assertNull(zms.processListRequest(domainName, AthenzObject.POLICY, null, null, names)); + assertEquals(names.size(), 0); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestCollectionEmpty() { + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + zms.dbService.executeDeleteRole(mockDomRsrcCtx, domainName, "admin", auditRef, "unittest"); + + List names = new ArrayList<>(); + assertNull(zms.processListRequest(domainName, AthenzObject.ROLE, null, null, names)); + assertEquals(names.size(), 0); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestUnknownType() { + + List names = new ArrayList<>(); + assertNull(zms.processListRequest("testdomain", AthenzObject.ASSERTION, null, null, names)); + assertEquals(names.size(), 0); + } + + @Test + public void testProcessListRequestSkipNoMatch() { + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role3 = createRoleObject(domainName, "role3", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role3", + role3, auditRef, "unittest"); + + List names = new ArrayList<>(); + assertNull(zms.processListRequest(domainName, AthenzObject.ROLE, null, "role4", names)); + + // our response is going to get the admin role + + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("role1")); + assertTrue(names.contains("role2")); + assertTrue(names.contains("role3")); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestSkipMatch() { + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role3 = createRoleObject(domainName, "role3", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role3", + role3, auditRef, "unittest"); + + List names = new ArrayList<>(); + assertNull(zms.processListRequest(domainName, AthenzObject.ROLE, null, "role2", names)); + assertEquals(names.size(), 1); + assertTrue(names.contains("role3")); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestLimitExceeded() { + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role3 = createRoleObject(domainName, "role3", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role3", + role3, auditRef, "unittest"); + + List names = new ArrayList<>(); + String next = zms.processListRequest(domainName, AthenzObject.ROLE, 2, null, names); + assertEquals("role1", next); + assertEquals(2, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("role1")); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestLimitNotExceeded() { + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role3 = createRoleObject(domainName, "role3", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role3", + role3, auditRef, "unittest"); + + List names = new ArrayList<>(); + zms.processListRequest(domainName, AthenzObject.ROLE, 5, null, names); + + // make sure to account for the admin role + + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("role1")); + assertTrue(names.contains("role2")); + assertTrue(names.contains("role3")); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestLimitAndSkip() { + + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role3 = createRoleObject(domainName, "role3", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role3", + role3, auditRef, "unittest"); + + Role role4 = createRoleObject(domainName, "role4", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role4", + role4, auditRef, "unittest"); + + Role role5 = createRoleObject(domainName, "role5", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role5", + role5, auditRef, "unittest"); + + List names = new ArrayList<>(); + String next = zms.processListRequest(domainName, AthenzObject.ROLE, 2, "role2", names); + assertEquals(next, "role4"); + assertEquals(names.size(), 2); + assertTrue(names.contains("role3")); + assertTrue(names.contains("role4")); + zms.dbService.executeDeleteDomain(mockDomRsrcCtx, domainName, auditRef, "unittest"); + } + + @Test + public void testProcessListRequestLimitAndSkipLessThanLimitLeft() { + + String domainName = "listrequest"; + List adminUsers = new ArrayList<>(); + adminUsers.add("user.user"); + zms.dbService.makeDomain(mockDomRsrcCtx, domainName, "Test Domain", "org", + true, adminUsers, null, 0, null, auditRef); + + Role role1 = createRoleObject(domainName, "role1", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role1", + role1, auditRef, "unittest"); + + Role role2 = createRoleObject(domainName, "role2", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role2", + role2, auditRef, "unittest"); + + Role role3 = createRoleObject(domainName, "role3", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role3", + role3, auditRef, "unittest"); + + Role role4 = createRoleObject(domainName, "role4", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role4", + role4, auditRef, "unittest"); + + Role role5 = createRoleObject(domainName, "role5", null, "user.user", null); + zms.dbService.executePutRole(mockDomRsrcCtx, domainName, "role5", + role5, auditRef, "unittest"); + + List names = new ArrayList<>(); + assertNull(zms.processListRequest(domainName, AthenzObject.ROLE, 2, "role4", names)); + assertEquals(names.size(), 1); + assertTrue(names.contains("role5")); + } + + @Test + public void testAccessInvalidResourceDomain() { + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature"); + try { + zms.access("read", "domain:invalid:entity", principal, null); + fail(); + } catch (com.yahoo.athenz.common.server.rest.ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testHasAccessInvalidRoleTokenAccess() { + + List authRoles = new ArrayList<>(); + authRoles.add("role1"); + Principal principal = SimplePrincipal.create("coretech", "v=U1;d=user;n=user1;s=signature", authRoles, null); + AthenzDomain domain = zms.retrieveAccessDomain("coretech", principal); + assertEquals(zms.hasAccess(domain, "coretech", "read", "coretech:entity", principal, "trustdomain"), + AccessStatus.DENIED_INVALID_ROLE_TOKEN); + } + + @Test + public void testAccessNotFoundDomain() { + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature"); + try { + zms.access("read", "domain_not_found:entity", principal, null); + fail(); + } catch (com.yahoo.athenz.common.server.rest.ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testHasAccessValidMember() { + + TopLevelDomain dom1 = createTopLevelDomainObject("HasAccessDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("HasAccessDom1", "Role1", null, "user.user1", + "user.user3"); + zms.putRole(mockDomRsrcCtx, "HasAccessDom1", "Role1", auditRef, role1); + + Policy policy1 = createPolicyObject("HasAccessDom1", "Policy1", "Role1", + "UPDATE", "HasAccessDom1:resource1", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "HasAccessDom1", "Policy1", auditRef, policy1); + + // user1 and user3 have access to UPDATE/resource1 + + Principal principal1 = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature"); + AthenzDomain domain = zms.retrieveAccessDomain("hasaccessdom1", principal1); + + assertEquals(zms.hasAccess(domain, "hasaccessdom1", "update", "hasaccessdom1:resource1", + principal1, null), AccessStatus.ALLOWED); + + Principal principal3 = SimplePrincipal.create("user", "user3", "v=U1;d=user;n=user3;s=signature"); + assertEquals(zms.hasAccess(domain, "hasaccessdom1", "update", "hasaccessdom1:resource1", + principal3, null), AccessStatus.ALLOWED); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "HasAccessDom1", auditRef); + } + + @Test + public void testHasAccessInValidMember() { + + TopLevelDomain dom1 = createTopLevelDomainObject("HasAccessDom2", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject("HasAccessDom2", "Role1", null, "user.user1", + "user.user3"); + zms.putRole(mockDomRsrcCtx, "HasAccessDom2", "Role1", auditRef, role1); + + Policy policy1 = createPolicyObject("HasAccessDom2", "Policy1", "Role1", + "UPDATE", "HasAccessDom2:resource1", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, "HasAccessDom2", "Policy1", auditRef, policy1); + + // user2 does not have access to UPDATE/resource1 + + Principal principal2 = SimplePrincipal.create("user", "user2", "v=U1;d=user;n=user2;s=signature"); + + // this is internal zms function so the values passed have already been converted to lower + // case so we need to handle the test case accordingly. + + AthenzDomain domain = zms.retrieveAccessDomain("hasaccessdom2", principal2); + assertEquals(AccessStatus.DENIED, zms.hasAccess(domain, "hasaccessdom2", "update", + "hasaccessdom2:resource1", principal2, null)); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "HasAccessDom2", auditRef); + } + + @Test + public void testEvaluateAccessNoAssertions() { + + AthenzDomain domain = new AthenzDomain("coretech"); + Role role = new Role().setName("coretech:role.role1"); + domain.getRoles().add(role); + Policy policy = new Policy().setName("coretech:policy.policy1"); + domain.getPolicies().add(policy); + assertEquals(zms.evaluateAccess(domain, null, null, null, null, null), AccessStatus.DENIED); + } + + @Test + public void testEvaluateAccessAssertionDeny() { + + AthenzDomain domain = new AthenzDomain("coretech"); + Role role = createRoleObject("coretech", "role1", null, "user.user1", null); + domain.getRoles().add(role); + + Policy policy = new Policy().setName("coretech:policy.policy1"); + Assertion assertion = new Assertion(); + assertion.setAction("read"); + assertion.setEffect(AssertionEffect.DENY); + assertion.setResource("coretech:*"); + assertion.setRole("coretech:role.role1"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion); + domain.getPolicies().add(policy); + + assertEquals(zms.evaluateAccess(domain, "user.user1", "read", "coretech:resource1", + null, null), AccessStatus.DENIED); + } + + @Test + public void testEvaluateAccessAssertionAllow() { + + AthenzDomain domain = new AthenzDomain("coretech"); + Role role = createRoleObject("coretech", "role1", null, "user.user1", null); + domain.getRoles().add(role); + + Policy policy = new Policy().setName("coretech:policy.policy1"); + Assertion assertion = new Assertion(); + assertion.setAction("read"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("coretech:*"); + assertion.setRole("coretech:role.role1"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion); + domain.getPolicies().add(policy); + + assertEquals(zms.evaluateAccess(domain, "user.user1", "read", "coretech:resource1", null, null), AccessStatus.ALLOWED); + } + + @Test + public void testHasExceededDepthLimitNullLimit() { + assertFalse(zms.hasExceededDepthLimit(null, "domain")); + } + + @Test + public void testHasExceededDepthLimitNotValidLimit() { + assertTrue(zms.hasExceededDepthLimit(-1, "domain")); + assertTrue(zms.hasExceededDepthLimit(-1, "domain.sub1")); + } + + @Test + public void testHasExceededDepthLimitYes() { + assertTrue(zms.hasExceededDepthLimit(0, "domain.sub1")); + assertTrue(zms.hasExceededDepthLimit(1, "domain.sub1.sub2")); + assertTrue(zms.hasExceededDepthLimit(1, "domain.sub1.sub2.sub3")); + assertTrue(zms.hasExceededDepthLimit(2, "domain.sub1.sub2.sub3")); + } + + @Test + public void testHasExceededDepthLimitNo() { + assertFalse(zms.hasExceededDepthLimit(1, "domain.sub1")); + assertFalse(zms.hasExceededDepthLimit(2, "domain.sub1")); + assertFalse(zms.hasExceededDepthLimit(2, "domain.sub1.sub2")); + assertFalse(zms.hasExceededDepthLimit(3, "domain.sub1.sub2")); + assertFalse(zms.hasExceededDepthLimit(3, "domain.sub1.sub2.sub3")); + assertFalse(zms.hasExceededDepthLimit(4, "domain.sub1.sub2.sub3")); + } + + @Test + public void testIsZMSServiceYes() { + + assertTrue(zms.isZMSService("sys.auth", "zms")); + assertTrue(zms.isZMSService("sys.Auth", "ZMS")); + assertTrue(zms.isZMSService("SYS.AUTH", "ZMS")); + } + + @Test + public void testIsZMSServiceNo() { + + assertFalse(zms.isZMSService("sys.auth2", "zms")); + assertFalse(zms.isZMSService("sys.auth", "zts")); + } + + @Test + public void testRetrieveServiceIdentityInvalidServiceName() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceRetrieveDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceRetrieveDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceRetrieveDom1", "Service1", auditRef, service); + + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceRetrieveDom1", "Service"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceRetrieveDom1", "Service2"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + try { + zms.getServiceIdentity(mockDomRsrcCtx, "ServiceRetrieveDom1", "Service11"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceRetrieveDom1", auditRef); + } + + @Test + public void testRetriveServiceIdentityValid() { + + String domainName = "serviceretrievedom2"; + String serviceName = "service1"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject(domainName, + serviceName, "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "Service1", auditRef, service); + + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, domainName, serviceName); + assertNotNull(serviceRes); + assertEquals(serviceRes.getName(), domainName + "." + serviceName); + assertEquals(serviceRes.getExecutable(), "/usr/bin/java"); + assertEquals(serviceRes.getGroup(), "users"); + assertEquals(serviceRes.getProviderEndpoint().toString(), "http://localhost"); + assertEquals(serviceRes.getUser(), "root"); + + List hosts = serviceRes.getHosts(); + assertNotNull(hosts); + assertEquals(hosts.size(), 1); + assertEquals(hosts.get(0), "host1"); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetProviderRoleActionPolicyNotFound() { + + String domainName = "coretech"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Assertion assertion = new Assertion(); + assertion.setAction("read"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("coretech:*"); + assertion.setRole("coretech:role.role1"); + + Policy policy = new Policy().setName("coretech:policy.provider"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion); + + zms.putPolicy(mockDomRsrcCtx, domainName, "provider", auditRef, policy); + + assertEquals(zms.getProviderRoleAction(domainName, "policy1"), ""); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetProviderRoleActionAssertionNoMatch() { + + String domainName = "coretech"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Assertion assertion = new Assertion(); + assertion.setAction("read"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("coretech:*"); + assertion.setRole("coretech:role.role1"); + + Policy policy = new Policy().setName("coretech:policy.provider"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion); + + zms.putPolicy(mockDomRsrcCtx, domainName, "provider", auditRef, policy); + + assertEquals(zms.getProviderRoleAction(domainName, "provider"), ""); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetProviderRoleActionAssertionActionNull() { + + String domainName = "coretech"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Assertion assertion = new Assertion(); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("coretech:*"); + assertion.setRole("coretech:role.provider"); + + Policy policy = new Policy().setName("coretech:policy.provider"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion); + + try { + zms.putPolicy(mockDomRsrcCtx, domainName, "provider", auditRef, policy); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + assertEquals(zms.getProviderRoleAction(domainName, "provider"), ""); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetProviderRoleActionValid() { + + String domainName = "coretech"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Assertion assertion = new Assertion(); + assertion.setAction("read"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("coretech:*"); + assertion.setRole("coretech:role.provider"); + + Policy policy = new Policy().setName("coretech:policy.provider"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion); + + zms.putPolicy(mockDomRsrcCtx, domainName, "provider", auditRef, policy); + + assertEquals(zms.getProviderRoleAction(domainName, "provider"), "read"); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testListDomains() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ListDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("ListDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainList domList = zms.listDomains(null, null, null, null, 0); + assertNotNull(domList); + + assertTrue(domList.getNames().contains("ListDom1".toLowerCase())); + assertTrue(domList.getNames().contains("ListDom2".toLowerCase())); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDom2", auditRef); + } + + @Test + public void testListDomainsParamsLimit() { + + TopLevelDomain dom1 = createTopLevelDomainObject("LimitDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("LimitDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainList domList = zms.listDomains(1, null, null, null, 0); + assertTrue(domList.getNames().size() == 1); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "LimitDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "LimitDom2", auditRef); + } + + @Test + public void testListDomainsParamsSkip() { + + TopLevelDomain dom1 = createTopLevelDomainObject("SkipDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("SkipDom2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + TopLevelDomain dom3 = createTopLevelDomainObject("SkipDom3", + "Test Domain3", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom3); + + DomainList domList = zms.listDomains(null, null, null, null, 0); + int size = domList.getNames().size(); + assertTrue(size > 3); + + // ask for only for 2 domains back + domList = zms.listDomains(2, null, null, null, 0); + assertEquals(domList.getNames().size(), 2); + + // ask for the remaining domains + DomainList remList = zms.listDomains(null, domList.getNext(), null, null, 0); + assertEquals(remList.getNames().size(), size - 2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SkipDom1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SkipDom2", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "SkipDom3", auditRef); + } + + @Test + public void testListDomainsParamsPrefix() { + + String noPrefixDom = "noprefixdom1"; + String prefixDom = "prefixdom2"; + + TopLevelDomain dom1 = createTopLevelDomainObject(noPrefixDom, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject(prefixDom, + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainList domList = zms.listDomains(null, null, "prefix", null, 0); + + assertFalse(domList.getNames().contains(noPrefixDom)); + assertTrue(domList.getNames().contains(prefixDom)); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, noPrefixDom, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, prefixDom, auditRef); + } + + @Test + public void testListDomainsParamsDepth() { + + TopLevelDomain dom1 = createTopLevelDomainObject("DepthDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("DepthDom2", "DepthDom1", + "Test Domain2", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "DepthDom1", auditRef, dom2); + + SubDomain dom3 = createSubDomainObject("DepthDom3", + "DepthDom1.DepthDom2", "Test Domain3", "testOrg", adminUser); + zms.postSubDomain(mockDomRsrcCtx, "DepthDom1.DepthDom2", auditRef, dom3); + + DomainList domList = zms.listDomains(null, null, null, 1, 0); + + assertTrue(domList.getNames().contains("DepthDom1".toLowerCase())); + assertTrue(domList.getNames().contains("DepthDom1.DepthDom2".toLowerCase())); + assertFalse(domList.getNames().contains("DepthDom1.DepthDom2.DepthDom3".toLowerCase())); + + zms.deleteSubDomain(mockDomRsrcCtx, "DepthDom1.DepthDom2", "DepthDom3", auditRef); + zms.deleteSubDomain(mockDomRsrcCtx, "DepthDom1", "DepthDom2", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "DepthDom1", auditRef); + } + + @Test + public void testListModifiedDomains() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ListDomMod1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("ListDomMod2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainModifiedList domModList = zms.dbService.listModifiedDomains(0); + assertNotNull(domModList); + assertTrue(domModList.getNameModList().size() > 1); + + boolean dom1Found = false; + boolean dom2Found = false; + for (DomainModified domName : domModList.getNameModList()) { + if (domName.getName().equalsIgnoreCase("ListDomMod1")) { + dom1Found = true; + } else if (domName.getName().equalsIgnoreCase("ListDomMod2")) { + dom2Found = true; + } + } + + assertTrue(dom1Found); + assertTrue(dom2Found); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDomMod1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDomMod2", auditRef); + } + + @Test + public void testListModifiedDomainsMillis() { + + long timestamp = System.currentTimeMillis() - 1001; + + TopLevelDomain dom1 = createTopLevelDomainObject("ListDomMod1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject("ListDomMod2", + "Test Domain2", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + + DomainModifiedList domModList = zms.dbService.listModifiedDomains(timestamp); + assertNotNull(domModList); + assertTrue(domModList.getNameModList().size() > 1); + + boolean dom1Found = false; + boolean dom2Found = false; + for (DomainModified domName : domModList.getNameModList()) { + if (domName.getName().equalsIgnoreCase("ListDomMod1")) { + dom1Found = true; + } else if (domName.getName().equalsIgnoreCase("ListDomMod2")) { + dom2Found = true; + } + } + + assertTrue(dom1Found); + assertTrue(dom2Found); + + timestamp += 10000; // add 10 seconds + domModList = zms.dbService.listModifiedDomains(timestamp); + assertNotNull(domModList); + assertTrue(domModList.getNameModList().size() == 0); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDomMod1", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ListDomMod2", auditRef); + } + + @Test + public void testVirtualHomeDomain() { + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + + Principal principal = SimplePrincipal.create("user", "user1", "v=U1;d=user;n=user1;s=signature", + 0, principalAuthority); + + AthenzDomain virtualDomain = zms.virtualHomeDomain(principal); + assertNotNull(virtualDomain); + + List roles = virtualDomain.getRoles(); + assertNotNull(roles); + Role adminRole = null; + for (Role role : roles) { + if (role.getName().equals("user.user1:role.admin")) { + adminRole = role; + break; + } + } + assertNotNull(adminRole); + + List policies = virtualDomain.getPolicies(); + assertNotNull(policies); + Policy adminPolicy = null; + for (Policy policy : policies) { + if (policy.getName().equals("user.user1:policy.admin")) { + adminPolicy = policy; + break; + } + } + assertNotNull(adminPolicy); + } + + @Test + public void testDeletePublicKeyEntry() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceDelPubKeyDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceDelPubKeyDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceDelPubKeyDom1", "Service1", auditRef, service); + + zms.deletePublicKeyEntry(mockDomRsrcCtx, "ServiceDelPubKeyDom1", "Service1", "1", auditRef); + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelPubKeyDom1", "Service1"); + List keyList = serviceRes.getPublicKeys(); + boolean found = false; + for (PublicKeyEntry entry : keyList) { + if (entry.getId().equals("1")) { + found = true; + } + } + assertFalse(found); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceDelPubKeyDom1", auditRef); + } + + @Test + public void testDeletePublicKeyEntryMissingAuditRef() { + String domain = "testDeletePublicKeyEntryMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + ServiceIdentity service = createServiceObject( + domain, + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domain, "Service1", auditRef, service); + + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + zms.putPublicKeyEntry(mockDomRsrcCtx, domain, "Service1", "zone1", auditRef, keyEntry); + try { + zms.deletePublicKeyEntry(mockDomRsrcCtx, domain, "Service1", "1", null); + fail("requesterror not thrown by deletePublicKeyEntry."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testDeletePublicKeyEntryDomainNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceDelPubKeyDom2", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceDelPubKeyDom2", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceDelPubKeyDom2", "Service1", auditRef, service); + + // this should throw a not found exception + try { + zms.deletePublicKeyEntry(mockDomRsrcCtx, "UnknownPublicKeyDomain", "Service1", "1", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceDelPubKeyDom2", auditRef); + } + + @Test + public void testDeletePublicKeyEntryInvalidService() { + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_delpubkeyinvalidsvc"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceDelPubKeyDom2InvalidService", + "Test Domain1", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceDelPubKeyDom2InvalidService", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zmsImpl.putServiceIdentity(mockDomRsrcCtx, "ServiceDelPubKeyDom2InvalidService", "Service1", auditRef, service); + + // this should throw an invalid request exception + try { + zmsImpl.deletePublicKeyEntry(mockDomRsrcCtx, "ServiceDelPubKeyDom2InvalidService", "Service1.Service2", "1", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + String caller = "deletepublickeyentry"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(Invalid SimpleName error: String pattern mismatch (expected \"[a-zA-Z0-9_][a-zA-Z0-9_-]*\") for type SimpleName in data);:caller specified keyId=(1)") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceDelPubKeyDom2InvalidService", auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testDeletePublicKeyEntryServiceNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceDelPubKeyDom3", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceDelPubKeyDom3", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceDelPubKeyDom3", "Service1", auditRef, service); + + // this should throw a not found exception + try { + zms.deletePublicKeyEntry(mockDomRsrcCtx, "ServiceDelPubKeyDom3", "ServiceNotFound", "1", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceDelPubKeyDom3", auditRef); + } + + @Test + public void testDeletePublicKeyEntryIdNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServiceDelPubKeyDom4", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServiceDelPubKeyDom4", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServiceDelPubKeyDom4", "Service1", auditRef, service); + + // process invalid keys + + try { + zms.deletePublicKeyEntry(mockDomRsrcCtx, "ServiceDelPubKeyDom4", "Service1", "zone", auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + // make sure both 1 and 2 keys are still valid + + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, "ServiceDelPubKeyDom4", "Service1"); + List keyList = serviceRes.getPublicKeys(); + boolean foundKey1 = false; + boolean foundKey2 = false; + for (PublicKeyEntry entry : keyList) { + if (entry.getId().equals("1")) { + foundKey1 = true; + } else if (entry.getId().equals("2")) { + foundKey2 = true; + } + } + assertTrue(foundKey1); + assertTrue(foundKey2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServiceDelPubKeyDom4", auditRef); + } + + @Test + public void testGetPublicKeyEntry() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePubKeyDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePubKeyDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePubKeyDom1", "Service1", auditRef, service); + + PublicKeyEntry entry = zms.getPublicKeyEntry(mockDomRsrcCtx, "ServicePubKeyDom1", "Service1", "1"); + assertNotNull(entry); + assertEquals(entry.getId(), "1"); + assertEquals(entry.getKey(), pubKeyK1); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePubKeyDom1", auditRef); + } + + @Test + public void testGetPublicKeyEntryInvalidService() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePubKeyDom2Invalid", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePubKeyDom2Invalid", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePubKeyDom2Invalid", "Service1", auditRef, service); + + // this should throw an invalid request exception + try { + zms.getPublicKeyEntry(mockDomRsrcCtx, "ServicePubKeyDom2Invalid", "Service1.Service2", "1"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePubKeyDom2Invalid", auditRef); + } + + @Test + public void testGetPublicKeyEntryDomainNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePubKeyDom2", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePubKeyDom2", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePubKeyDom2", "Service1", auditRef, service); + + // this should throw a not found exception + try { + zms.getPublicKeyEntry(mockDomRsrcCtx, "UnknownPublicKeyDomain", "Service1", "1"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePubKeyDom2", auditRef); + } + + @Test + public void testGetPublicKeyEntryServiceNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePubKeyDom3", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePubKeyDom3", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePubKeyDom3", "Service1", auditRef, service); + + // this should throw a not found exception + try { + zms.getPublicKeyEntry(mockDomRsrcCtx, "ServicePubKeyDom3", "ServiceNotFound", "1"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePubKeyDom3", auditRef); + } + + @Test + public void testGetPublicKeyEntryIdNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePubKeyDom4", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePubKeyDom4", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePubKeyDom4", "Service1", auditRef, service); + + // this should throw a not found exception + try { + zms.getPublicKeyEntry(mockDomRsrcCtx, "ServicePubKeyDom4", "Service1", "zone"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePubKeyDom4", auditRef); + } + + @Test + public void testPutPublicKeyEntryNew() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePutPubKeyDom1", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePutPubKeyDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePutPubKeyDom1", "Service1", auditRef, service); + + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + + zms.putPublicKeyEntry(mockDomRsrcCtx, "ServicePutPubKeyDom1", "Service1", "zone1", auditRef, keyEntry); + + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, "ServicePutPubKeyDom1", "Service1"); + List keyList = serviceRes.getPublicKeys(); + boolean foundKey1 = false; + boolean foundKey2 = false; + boolean foundKeyZONE1 = false; + for (PublicKeyEntry entry : keyList) { + if (entry.getId().equals("1")) { + foundKey1 = true; + } else if (entry.getId().equals("2")) { + foundKey2 = true; + } else if (entry.getId().equals("zone1")) { + foundKeyZONE1 = true; + } + } + assertTrue(foundKey1); + assertTrue(foundKey2); + assertTrue(foundKeyZONE1); + + PublicKeyEntry entry = zms.getPublicKeyEntry(mockDomRsrcCtx, "ServicePutPubKeyDom1", "Service1", "zone1"); + assertNotNull(entry); + assertEquals(entry.getId(), "zone1"); + assertEquals(entry.getKey(), pubKeyK2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePutPubKeyDom1", auditRef); + } + + @Test + public void testPutPublicKeyEntryMissingAuditRef() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_putpubkeyentrymissauditref"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domain = "testPutPublicKeyEntryMissingAuditRef"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + dom.setAuditEnabled(true); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + ServiceIdentity service = createServiceObject( + domain, + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zmsImpl.putServiceIdentity(mockDomRsrcCtx, domain, "Service1", auditRef, service); + + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + + try { + zmsImpl.putPublicKeyEntry(mockDomRsrcCtx, domain, "Service1", "zone1", null, keyEntry); + fail("requesterror not thrown by putPublicKeyEntry."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + assertTrue(ex.getMessage().contains("Audit reference required")); + + String caller = "putpublickeyentry"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(putpublickeyentry: Audit reference required for domain: testputpublickeyentrymissingauditref)") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } finally { + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + } + + @Test + public void testPutPublicKeyEntryInvalidService() { + + String domain = "testPutPublicKeyEntryInvalidService"; + TopLevelDomain dom = createTopLevelDomainObject( + domain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + ServiceIdentity service = createServiceObject( + domain, + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domain, "Service1", auditRef, service); + + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + + try { + zms.putPublicKeyEntry(mockDomRsrcCtx, domain, "Service1.Service2", "zone1", null, keyEntry); + fail("requesterror not thrown by putPublicKeyEntry."); + } catch (ResourceException ex) { + assertTrue(ex.getCode() == 400); + } finally { + zms.deleteTopLevelDomain(mockDomRsrcCtx, domain, auditRef); + } + } + + @Test + public void testPutPublicKeyEntryUpdate() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePutPubKeyDom1A", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePutPubKeyDom1A", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePutPubKeyDom1A", "Service1", auditRef, service); + + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("1"); + keyEntry.setKey(pubKeyK2); + + zms.putPublicKeyEntry(mockDomRsrcCtx, "ServicePutPubKeyDom1A", "Service1", "1", auditRef, keyEntry); + + ServiceIdentity serviceRes = zms.getServiceIdentity(mockDomRsrcCtx, "ServicePutPubKeyDom1A", "Service1"); + List keyList = serviceRes.getPublicKeys(); + assertEquals(keyList.size(), 2); + + boolean foundKey1 = false; + boolean foundKey2 = false; + for (PublicKeyEntry entry : keyList) { + if (entry.getId().equals("1")) { + foundKey1 = true; + } else if (entry.getId().equals("2")) { + foundKey2 = true; + } + } + + assertTrue(foundKey1); + assertTrue(foundKey2); + + PublicKeyEntry entry = zms.getPublicKeyEntry(mockDomRsrcCtx, "ServicePutPubKeyDom1A", "Service1", "1"); + assertNotNull(entry); + assertEquals(entry.getId(), "1"); + assertEquals(entry.getKey(), pubKeyK2); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePutPubKeyDom1A", auditRef); + } + + @Test + public void testPutPublicKeyEntryDomainNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePutPubKeyDom2", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePutPubKeyDom2", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePutPubKeyDom2", "Service1", auditRef, service); + + // this should throw a not found exception + try { + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + + zms.putPublicKeyEntry(mockDomRsrcCtx, "UnknownPublicKeyDomain", "Service1", "zone1", auditRef, keyEntry); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePutPubKeyDom2", auditRef); + } + + @Test + public void testPutPublicKeyEntryServiceNotFound() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePutPubKeyDom3", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePutPubKeyDom3", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePutPubKeyDom3", "Service1", auditRef, service); + + // this should throw a not found exception + try { + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + + zms.putPublicKeyEntry(mockDomRsrcCtx, "ServicePutPubKeyDom3", "ServiceNotFound", "zone1", auditRef, keyEntry); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePutPubKeyDom3", auditRef); + } + + @Test + public void testDeletePublicKeyEntryIdNoMatch() { + + TopLevelDomain dom1 = createTopLevelDomainObject("ServicePutPubKeyDom4", + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service = createServiceObject("ServicePutPubKeyDom4", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + zms.putServiceIdentity(mockDomRsrcCtx, "ServicePutPubKeyDom4", "Service1", auditRef, service); + + // this should throw invalid request exception + + try { + PublicKeyEntry keyEntry = new PublicKeyEntry(); + keyEntry.setId("zone1"); + keyEntry.setKey(pubKeyK2); + + zms.putPublicKeyEntry(mockDomRsrcCtx, "ServicePutPubKeyDom4", "Service1", "zone2", auditRef, keyEntry); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, "ServicePutPubKeyDom4", auditRef); + } + + @Test + public void testSleepBeforeRetryingRequestExpireZero() { + + long timeStamp = System.currentTimeMillis(); + zms.sleepBeforeRetryingRequest(0, 2000, "testSleep"); + assertTrue(System.currentTimeMillis() - timeStamp < 1000); + } + + @Test + public void testSleepBeforeRetryingRequestExpireNegative() { + + long timeStamp = System.currentTimeMillis(); + zms.sleepBeforeRetryingRequest(-1, 2000, "testSleep"); + assertTrue(System.currentTimeMillis() - timeStamp < 1000); + } + + @Test + public void testSleepBeforeRetryingRequest() { + + long timeStamp = System.currentTimeMillis(); + zms.sleepBeforeRetryingRequest(50, 2000, "testSleep"); + + // let's assume we'll never get interrupted + assertTrue(System.currentTimeMillis() - timeStamp >= 2000); + } + + @Test + public void testConverToLowerCaseAssertion() { + + Assertion assertion = new Assertion(); + assertion.setAction("Read"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("coreTech:VIP.*"); + assertion.setRole("coretech:role.Role1"); + + AthenzObject.ASSERTION.convertToLowerCase(assertion); + assertEquals(assertion.getRole(), "coretech:role.role1"); + assertEquals(assertion.getAction(), "read"); + assertEquals(assertion.getResource(), "coretech:vip.*"); + } + + @Test + public void testRemoveQuotes() { + + assertEquals(zms.removeQuotes("abc"), "abc"); + assertEquals(zms.removeQuotes("\"abc"), "abc"); + assertEquals(zms.removeQuotes("abc\""), "abc"); + assertEquals(zms.removeQuotes("\"abc\""), "abc"); + assertEquals(zms.removeQuotes("\"a\"bc\""), "a\"bc"); + } + + @Test + public void testConvertToLowerCaseList() { + + AthenzObject.LIST.convertToLowerCase(null); + + List list = new ArrayList<>(); + list.add("item1"); + list.add("Item2"); + list.add("ITEM3"); + + AthenzObject.LIST.convertToLowerCase(list); + assertTrue(list.contains("item1")); + assertTrue(list.contains("item2")); + assertTrue(list.contains("item3")); + assertEquals(list.size(), 3); + } + + @Test + public void testConvertToLowerCaseSubdomain() { + + SubDomain dom = createSubDomainObject("DepthDom2", "DepthDom1", + "Test Domain2", "testOrg", "user.user3A"); + AthenzObject.SUB_DOMAIN.convertToLowerCase(dom); + assertEquals(dom.getName(), "depthdom2"); + assertEquals(dom.getParent(), "depthdom1"); + assertTrue(dom.getAdminUsers().contains("user.user3a")); + + SubDomain dom2 = createSubDomainObject("DepthDom2", "DepthDom1", + "Test Domain2", "testOrg", "user.user3B"); + DomainTemplateList templates = new DomainTemplateList(); + List list = new ArrayList<>(); + list.add("platforms"); + list.add("vipNg"); + list.add("ATHENZ"); + templates.setTemplateNames(list); + dom2.setTemplates(templates); + AthenzObject.SUB_DOMAIN.convertToLowerCase(dom2); + assertEquals(dom2.getName(), "depthdom2"); + assertEquals(dom2.getParent(), "depthdom1"); + assertTrue(dom2.getAdminUsers().contains("user.user3b")); + templates = dom2.getTemplates(); + list = templates.getTemplateNames(); + assertEquals(3, list.size()); + assertTrue(list.contains("platforms")); + assertTrue(list.contains("vipng")); + assertTrue(list.contains("athenz")); + } + + @Test + public void testConvertToLowerCaseTopLeveldomain() { + + TopLevelDomain dom = createTopLevelDomainObject("TopLevelDomain", + "Test Domain1", "testOrg", "user.USER3A"); + AthenzObject.TOP_LEVEL_DOMAIN.convertToLowerCase(dom); + assertEquals(dom.getName(), "topleveldomain"); + assertTrue(dom.getAdminUsers().contains("user.user3a")); + + TopLevelDomain dom2 = createTopLevelDomainObject("TopLevelDomain", + "Test Domain1", "testOrg", "user.USER3B"); + DomainTemplateList templates = new DomainTemplateList(); + List list = new ArrayList<>(); + list.add("platforms"); + list.add("vipNg"); + list.add("ATHENZ"); + templates.setTemplateNames(list); + dom2.setTemplates(templates); + AthenzObject.TOP_LEVEL_DOMAIN.convertToLowerCase(dom2); + assertEquals(dom2.getName(), "topleveldomain"); + assertTrue(dom2.getAdminUsers().contains("user.user3b")); + templates = dom2.getTemplates(); + list = templates.getTemplateNames(); + assertEquals(3, list.size()); + assertTrue(list.contains("platforms")); + assertTrue(list.contains("vipng")); + assertTrue(list.contains("athenz")); + } + + @Test + public void testConvertToLowerCaseUserdomain() { + + UserDomain dom = createUserDomainObject("USER3A", + "Test Domain1", "testOrg"); + AthenzObject.USER_DOMAIN.convertToLowerCase(dom); + assertEquals(dom.getName(), "user3a"); + + UserDomain dom2 = createUserDomainObject("USER3B", + "Test Domain1", "testOrg"); + DomainTemplateList templates = new DomainTemplateList(); + List list = new ArrayList<>(); + list.add("platforms"); + list.add("vipNg"); + list.add("ATHENZ"); + templates.setTemplateNames(list); + dom2.setTemplates(templates); + + AthenzObject.USER_DOMAIN.convertToLowerCase(dom2); + assertEquals(dom2.getName(), "user3b"); + templates = dom2.getTemplates(); + list = templates.getTemplateNames(); + assertEquals(3, list.size()); + assertTrue(list.contains("platforms")); + assertTrue(list.contains("vipng")); + assertTrue(list.contains("athenz")); + } + + @Test + public void testConvertToLowerCasePublicKeyEntry() { + PublicKeyEntry keyEntry = new PublicKeyEntry().setKey("KEY").setId("ZONE1"); + AthenzObject.PUBLIC_KEY_ENTRY.convertToLowerCase(keyEntry); + assertEquals(keyEntry.getKey(), "KEY"); + assertEquals(keyEntry.getId(), "zone1"); + } + + @Test + public void testConvertToLowerCaseEntity() { + Entity entity = createEntityObject("ABcEntity"); + AthenzObject.ENTITY.convertToLowerCase(entity); + assertEquals(entity.getName(), "abcentity"); + } + + @Test + public void testConvertToLowerCaseTenancy() { + Tenancy tenancy = createTenantObject("CoretecH", "STorage"); + List groups = new ArrayList(); + groups.add("Burbank"); + groups.add("santa_monica"); + tenancy.setResourceGroups(groups); + AthenzObject.TENANCY.convertToLowerCase(tenancy); + assertEquals(tenancy.getDomain(), "coretech"); + assertEquals(tenancy.getService(), "storage"); + assertTrue(tenancy.getResourceGroups().contains("burbank")); + assertTrue(tenancy.getResourceGroups().contains("santa_monica")); + } + + @Test + public void testConvertToLowerCaseTenancyResourceGroup() { + TenancyResourceGroup tenancyResourceGroup = new TenancyResourceGroup(); + tenancyResourceGroup.setDomain("CoretecH").setService("STorage").setResourceGroup("Group1"); + AthenzObject.TENANCY_RESOURCE_GROUP.convertToLowerCase(tenancyResourceGroup); + assertEquals("coretech", tenancyResourceGroup.getDomain()); + assertEquals("storage", tenancyResourceGroup.getService()); + assertEquals("group1", tenancyResourceGroup.getResourceGroup()); + } + + @Test + public void testConvertToLowerCaseDefaultAdmins() { + + List adminList = new ArrayList(); + adminList.add("user.User1"); + adminList.add("user.user2"); + DefaultAdmins admins = new DefaultAdmins(); + admins.setAdmins(adminList); + + AthenzObject.DEFAULT_ADMINS.convertToLowerCase(admins); + assertTrue(admins.getAdmins().contains("user.user1")); + assertTrue(admins.getAdmins().contains("user.user2")); + } + + @Test + public void testConvertToLowerCaseTenantRolesNoActions() { + + TenantRoles tenantRoles = new TenantRoles().setDomain("coreTech") + .setService("storaGe").setTenant("DelTenantRolesDom1"); + AthenzObject.TENANT_ROLES.convertToLowerCase(tenantRoles); + assertEquals(tenantRoles.getDomain(), "coretech"); + assertEquals(tenantRoles.getService(), "storage"); + assertEquals(tenantRoles.getTenant(), "deltenantrolesdom1"); + } + + @Test + public void testConvertToLowerCaseTenantResourceGroupRolesNoActions() { + + TenantResourceGroupRoles tenantRoles = new TenantResourceGroupRoles() + .setDomain("coreTech").setService("storaGe") + .setTenant("DelTenantRolesDom1").setResourceGroup("Hockey"); + AthenzObject.TENANT_RESOURCE_GROUP_ROLES.convertToLowerCase(tenantRoles); + assertEquals(tenantRoles.getDomain(), "coretech"); + assertEquals(tenantRoles.getService(), "storage"); + assertEquals(tenantRoles.getTenant(), "deltenantrolesdom1"); + assertEquals(tenantRoles.getResourceGroup(), "hockey"); + } + + @Test + public void testConvertToLowerCaseProviderResourceGroupRolesNoActions() { + + ProviderResourceGroupRoles tenantRoles = new ProviderResourceGroupRoles() + .setDomain("coreTech").setService("storaGe") + .setTenant("DelTenantRolesDom1").setResourceGroup("Hockey"); + AthenzObject.PROVIDER_RESOURCE_GROUP_ROLES.convertToLowerCase(tenantRoles); + assertEquals(tenantRoles.getDomain(), "coretech"); + assertEquals(tenantRoles.getService(), "storage"); + assertEquals(tenantRoles.getTenant(), "deltenantrolesdom1"); + assertEquals(tenantRoles.getResourceGroup(), "hockey"); + } + + @Test + public void testConvertToLowerCaseGroupRole() { + Role role = createRoleObject("RoleDomain", "roleName", null, "user.USER1", "user.user2"); + AthenzObject.ROLE.convertToLowerCase(role); + assertEquals(role.getName(), "roledomain:role.rolename"); + assertTrue(role.getMembers().contains("user.user1")); + assertTrue(role.getMembers().contains("user.user2")); + } + + @Test + public void testConvertToLowerCaseTrustRole() { + Role role = createRoleObject("RoleDomain", "roleName", "TRUSTDomain"); + AthenzObject.ROLE.convertToLowerCase(role); + assertEquals(role.getName(), "roledomain:role.rolename"); + assertEquals(role.getTrust(), "trustdomain"); + } + + @Test + public void testConvertToLowerCaseMembershipWithRole() { + Membership membership = new Membership().setMemberName("user.member1").setRoleName("ROLE1"); + AthenzObject.MEMBERSHIP.convertToLowerCase(membership); + assertEquals(membership.getMemberName(), "user.member1"); + assertEquals(membership.getRoleName(), "role1"); + } + + @Test + public void testConvertToLowerCaseMembershipWithoutRole() { + Membership membership = new Membership().setMemberName("user.member1"); + AthenzObject.MEMBERSHIP.convertToLowerCase(membership); + assertEquals(membership.getMemberName(), "user.member1"); + } + + @Test + public void testConvertToLowerCaseServciceWithKeys() { + ServiceIdentity service = createServiceObject("CoreTECH", "STORage", + "http://localhost:4080", "jetty", "user", "group", "HOST1"); + List publicKeyList = new ArrayList(); + PublicKeyEntry publicKeyEntry1 = new PublicKeyEntry(); + publicKeyEntry1.setKey(pubKeyK1); + publicKeyEntry1.setId("ZONE1"); + publicKeyList.add(publicKeyEntry1); + PublicKeyEntry publicKeyEntry2 = new PublicKeyEntry(); + publicKeyEntry2.setKey(pubKeyK2); + publicKeyEntry2.setId("2"); + publicKeyList.add(publicKeyEntry2); + service.setPublicKeys(publicKeyList); + AthenzObject.SERVICE_IDENTITY.convertToLowerCase(service); + assertEquals(service.getName(), "coretech.storage"); + assertTrue(service.getHosts().contains("host1")); + assertEquals(service.getPublicKeys().get(0).getId(), "zone1"); + assertEquals(service.getPublicKeys().get(1).getId(), "2"); + } + + @Test + public void testConvertToLowerCaseTenantRolesWithActions() { + + List roleActions = new ArrayList(); + roleActions.add(new TenantRoleAction().setRole("Role").setAction("WRITE")); + + TenantRoles tenantRoles = new TenantRoles().setDomain("CORETECH") + .setService("storage").setTenant("DelTenantRolesDom1") + .setRoles(roleActions); + + AthenzObject.TENANT_ROLES.convertToLowerCase(tenantRoles); + assertEquals(tenantRoles.getDomain(), "coretech"); + assertEquals(tenantRoles.getService(), "storage"); + assertEquals(tenantRoles.getTenant(), "deltenantrolesdom1"); + TenantRoleAction roleAction = tenantRoles.getRoles().get(0); + assertEquals(roleAction.getAction(), "write"); + assertEquals(roleAction.getRole(), "role"); + } + + @Test + public void testConvertToLowerCaseTenantRoleAction() { + + TenantRoleAction roleAction = new TenantRoleAction().setRole("ReaDer").setAction("READ"); + + AthenzObject.TENANT_ROLE_ACTION.convertToLowerCase(roleAction); + assertEquals(roleAction.getAction(), "read"); + assertEquals(roleAction.getRole(), "reader"); + } + + @Test + public void testConvertToLowerCasePolicyNoAssertion() { + + Policy policy = new Policy(); + policy.setName(ZMSUtils.policyResourceName("CoreTech", "policy")); + + AthenzObject.POLICY.convertToLowerCase(policy); + assertEquals(policy.getName(), "coretech:policy.policy"); + + policy.setName(ZMSUtils.policyResourceName("newtech", "Policy")); + + AthenzObject.POLICY.convertToLowerCase(policy); + assertEquals(policy.getName(), "newtech:policy.policy"); + } + + @Test + public void testConvertToLowerCasePolicyMultipleAssertion() { + + Policy policy = new Policy(); + policy.setName(ZMSUtils.policyResourceName("CoreTech", "policy")); + + Assertion assertion1 = new Assertion(); + assertion1.setAction("Read"); + assertion1.setEffect(AssertionEffect.ALLOW); + assertion1.setResource("coreTech:VIP.*"); + assertion1.setRole("coretech:role.Role1"); + + Assertion assertion2 = new Assertion(); + assertion2.setAction("UPDATE"); + assertion2.setEffect(AssertionEffect.ALLOW); + assertion2.setResource("CoreTech:VIP.*"); + assertion2.setRole("coretech:role.RoleAB"); + + List assertList = new ArrayList(); + assertList.add(assertion1); + assertList.add(assertion2); + + policy.setAssertions(assertList); + + AthenzObject.POLICY.convertToLowerCase(policy); + assertEquals(policy.getName(), "coretech:policy.policy"); + Assertion assertion = policy.getAssertions().get(0); + assertEquals(assertion.getRole(), "coretech:role.role1"); + assertEquals(assertion.getAction(), "read"); + assertEquals(assertion.getResource(), "coretech:vip.*"); + + assertion = policy.getAssertions().get(1); + assertEquals(assertion.getRole(), "coretech:role.roleab"); + assertEquals(assertion.getAction(), "update"); + assertEquals(assertion.getResource(), "coretech:vip.*"); + } + + @Test + public void testConvertToLowerCasePolicyOneAssertion() { + + Policy policy = createPolicyObject("CoreTech", "NewPolicy"); + AthenzObject.POLICY.convertToLowerCase(policy); + assertEquals(policy.getName(), "coretech:policy.newpolicy"); + Assertion assertion = policy.getAssertions().get(0); + assertEquals(assertion.getRole(), "coretech:role.role1"); + } + + @Test + public void testConvertToLowerCaseDomainTemplateList() { + DomainTemplateList templates = new DomainTemplateList(); + List list = new ArrayList<>(); + list.add("platforms"); + list.add("vipNg"); + list.add("ATHENZ"); + templates.setTemplateNames(list); + AthenzObject.DOMAIN_TEMPLATE_LIST.convertToLowerCase(templates); + + list = templates.getTemplateNames(); + assertEquals(3, list.size()); + assertTrue(list.contains("platforms")); + assertTrue(list.contains("vipng")); + assertTrue(list.contains("athenz")); + } + + @Test + public void testProviderServiceDomain() { + assertEquals(zms.providerServiceDomain("coretech.storage"), "coretech"); + assertEquals(zms.providerServiceDomain("coretech.hosted.storage"), "coretech.hosted"); + assertNull(zms.providerServiceDomain("coretech")); + assertNull(zms.providerServiceDomain(".coretech")); + assertNull(zms.providerServiceDomain("coretech.")); + } + + @Test + public void testProviderServiceName() { + assertEquals(zms.providerServiceName("coretech.storage"), "storage"); + assertEquals(zms.providerServiceName("coretech.hosted.storage"), "storage"); + assertNull(zms.providerServiceName("coretech")); + assertNull(zms.providerServiceName(".coretech")); + assertNull(zms.providerServiceName("coretech.")); + } + + @Test + public void testIsAuthorizedProviderServiceInvalidService() { + + // null authorized service argument + + assertFalse(zms.isAuthorizedProviderService(null, "coretech", "storage", "sports", auditRef)); + + // service does not match provider details + + assertFalse(zms.isAuthorizedProviderService("coretech.storage", "coretech", "storage2", "sports", auditRef)); + assertFalse(zms.isAuthorizedProviderService("coretech.storage", "coretech2", "storage", "sports", auditRef)); + + // domain does not exist in zms + + assertFalse(zms.isAuthorizedProviderService("not_present_domain.storage", "not_present_domain", + "storage", "sports", auditRef)); + } + + @Test + public void testIsAuthorizedProviderServiceAuthorized() { + + String tenantDomain = "AuthorizedProviderDom1"; + String providerDomain = "coretech"; + setupTenantDomainProviderService(tenantDomain, providerDomain, "storage", + "http://localhost:8090/tableprovider"); + + // tenant is setup so let's setup up policy to authorize access to tenants + + Role role = createRoleObject(providerDomain, "self_serve", null, providerDomain + ".storage", null); + zms.putRole(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, role); + + Policy policy = createPolicyObject(providerDomain, "self_serve", + "self_serve", "update", providerDomain + ":tenant.*", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, policy); + + assertTrue(zms.isAuthorizedProviderService(providerDomain + ".storage", providerDomain, + "storage", tenantDomain, auditRef)); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + + @Test + public void testIsAuthorizedProviderServiceNotAuthorized() { + + String tenantDomain = "AuthorizedProviderDom2"; + String providerDomain = "coretech"; + setupTenantDomainProviderService(tenantDomain, providerDomain, "storage", + "http://localhost:8090/tableprovider"); + + // tenant is setup but no policy to authorize access to tenants + + assertFalse(zms.isAuthorizedProviderService(providerDomain + ".storage", providerDomain, + "storage", tenantDomain, auditRef)); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + + @Test + public void testVerifyAuthorizedServiceOperation() { + + // null authorized service means it's all good + + zms.verifyAuthorizedServiceOperation(null, "putrole"); + + // our test resource json file includes two services: + // coretech.storage - allowed for putrole and putpolicy + // sports.hockey - allowed for all ops + + zms.verifyAuthorizedServiceOperation("coretech.storage", "putrole"); + zms.verifyAuthorizedServiceOperation("coretech.storage", "putpolicy"); + try { + zms.verifyAuthorizedServiceOperation("coretech.storage", "postdomain"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + try { + zms.verifyAuthorizedServiceOperation("coretech.storage", "deleterole"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + + zms.verifyAuthorizedServiceOperation("sports.hockey", "putrole"); + zms.verifyAuthorizedServiceOperation("sports.hockey", "putpolicy"); + zms.verifyAuthorizedServiceOperation("sports.hockey", "deleterole"); + zms.verifyAuthorizedServiceOperation("sports.hockey", "putserviceidentity"); + + // ATHENZ-1528 + // Try passing along operationItem key + value to see if verification works + + // First, try with AllowAll operation + zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putrole"); // putrole has no restriction. This should pass. + + // Second, try with restricted operation. Currently, putmembership only allow single operation item. + zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "role", "platforms_deployer"); + zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "role", "platforms_different_deployer"); + zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "not_role", "platforms_role_deployer"); + + // Third, try with restriction operation, with not-specified operation item. + boolean errorThrown = false; + int code = -1; + try { + zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "role", "platforms_deployer_new"); + } catch (ResourceException ex) { + errorThrown = true; + code = ex.getCode(); + } + assertEquals(403, code); + assertTrue(errorThrown); + errorThrown = false; + code = -1; + + try { + zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "not_role", "platforms_deployer_new_new"); + } catch (ResourceException ex) { + errorThrown = true; + code = ex.getCode(); + } + assertEquals(403, code); + assertTrue(errorThrown); + errorThrown = false; + code = -1; + + + try { + zms.verifyAuthorizedServiceOperation("coretech.storage2", "postdomain"); + } catch (ResourceException ex) { + errorThrown = true; + code = ex.getCode(); + } + assertEquals(403, code); + assertTrue(errorThrown); + errorThrown = false; + code = -1; + + try { + zms.verifyAuthorizedServiceOperation("media.storage", "deleterole"); + } catch (ResourceException ex) { + errorThrown = true; + code = ex.getCode(); + } + assertEquals(403, code); + assertTrue(errorThrown); + errorThrown = false; + code = -1; + } + + @Test + public void testPutProviderResourceGroupRoles() { + + String tenantDomain = "putproviderresourcegrouproles"; + TopLevelDomain dom = createTopLevelDomainObject(tenantDomain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String providerService = "storage"; + String providerDomain = "coretech"; + String resourceGroup = "hockey"; + + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup); + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup, auditRef, providerRoles); + + ProviderResourceGroupRoles tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testPutProviderResourceGroupMultipleRoles() { + + String tenantDomain = "putproviderresourcegroupmultipleroles"; + TopLevelDomain dom = createTopLevelDomainObject(tenantDomain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String providerService = "storage"; + String providerDomain = "coretech"; + String resourceGroup1 = "hockey"; + String resourceGroup2 = "baseball"; + + // add resource group1 roles + + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup1); + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup1, auditRef, providerRoles); + + // add resource group2 roles + + providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup1); + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup2, auditRef, providerRoles); + + // verify group 1 roles + + ProviderResourceGroupRoles tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup1); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup1.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + + // verify group 2 roles + + tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup2); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup2.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testDeleteProviderResourceGroupRoles() { + + String tenantDomain = "deleteproviderresourcegrouproles"; + TopLevelDomain dom = createTopLevelDomainObject(tenantDomain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String providerService = "storage"; + String providerDomain = "coretech"; + String resourceGroup = "hockey"; + + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup); + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup, auditRef, providerRoles); + + ProviderResourceGroupRoles tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + + // now let's delete our resource group + + zms.deleteProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup, auditRef); + + // now let's retrieve our resource group and verify we got 0 roles + + tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(0, tRoles.getRoles().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testDeleteProviderResourceGroupMultipleRoles() { + + String tenantDomain = "deleteproviderresourcegroupmultipleroles"; + TopLevelDomain dom = createTopLevelDomainObject(tenantDomain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String providerService = "storage"; + String providerDomain = "coretech"; + String resourceGroup1 = "hockey"; + String resourceGroup2 = "baseball"; + + // add resource group1 roles + + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup1); + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup1, auditRef, providerRoles); + + // add resource group2 roles + + providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup1); + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup2, auditRef, providerRoles); + + // now let's delete our resource group 1 + + zms.deleteProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup1, auditRef); + + // verify group 1 roles and it's size of 0 + + ProviderResourceGroupRoles tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup1); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup1.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(0, tRoles.getRoles().size()); + + // verify group 2 roles with valid size of roles + + tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup2); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup2.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + + // now let's delete our resource group 2 + + zms.deleteProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup2, auditRef); + + // now both get operations must return 0 for the size + + tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup1); + + assertNotNull(tRoles); + assertEquals(0, tRoles.getRoles().size()); + + tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup2); + + assertNotNull(tRoles); + assertEquals(0, tRoles.getRoles().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testGetProviderResourceGroupRoles() { + + String tenantDomain = "getproviderresourcegrouproles"; + TopLevelDomain dom = createTopLevelDomainObject(tenantDomain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + String providerService = "storage"; + String providerDomain = "coretech"; + String resourceGroup = "hockey"; + + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup); + zms.putProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, providerService, + resourceGroup, auditRef, providerRoles); + + ProviderResourceGroupRoles tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup); + + assertNotNull(tRoles); + assertEquals(providerDomain.toLowerCase(), tRoles.getDomain()); + assertEquals(providerService.toLowerCase(), tRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), tRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), tRoles.getResourceGroup()); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + List traList = tRoles.getRoles(); + List roles = new ArrayList<>(); + for (TenantRoleAction ra : traList) { + roles.add(ra.getRole()); + } + assertTrue(roles.contains("reader")); + assertTrue(roles.contains("writer")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testGetProviderResourceGroupRolesInvalid() { + + String tenantDomain = "getproviderresourcegrouprolesinvalid"; + TopLevelDomain dom = createTopLevelDomainObject(tenantDomain, "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom); + + // all invalid input with provider domain, resource and resource group + // just returns an empty list for role actions. + + ProviderResourceGroupRoles tRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, "test1", "invalid", "hockey"); + + assertNotNull(tRoles); + assertEquals(0, tRoles.getRoles().size()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + } + + @Test + public void testPutProviderResourceGroupRolesWithAuthorizedService() { + + String tenantDomain = "providerresourcegrouprolesauthorizedservice"; + String providerService = "storage"; + String providerDomain = "coretech"; + String resourceGroup = "hockey"; + + setupTenantDomainProviderService(tenantDomain, providerDomain, providerService, + "http://localhost:8090/tableprovider"); + + // tenant is setup so let's setup up policy to authorize access to tenants + // without this role/policy we won't be authorized to add tenant roles + // to the provider domain even with authorized service details + + Role role = createRoleObject(providerDomain, "self_serve", null, + providerDomain + "." + providerService, null); + zms.putRole(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, role); + + Policy policy = createPolicyObject(providerDomain, "self_serve", + "self_serve", "update", providerDomain + ":tenant.*", AssertionEffect.ALLOW); + zms.putPolicy(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, policy); + + // now we're going to setup our provider role call + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup); + + // we are going to create a principal object with authorized service + // set to coretech.storage + + String userId = "user1"; + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String unsignedCreds = "v=U1;d=user;n=" + userId; + Principal principal = SimplePrincipal.create("user", userId, unsignedCreds + ";s=signature", + 0, principalAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); + ((SimplePrincipal) principal).setAuthorizedService("coretech.storage"); + ResourceContext ctx = createResourceContext(principal); + + // after this call we should have roles set for both provider and tenant + + zms.putProviderResourceGroupRoles(ctx, tenantDomain, providerDomain, providerService, + resourceGroup, auditRef, providerRoles); + + ProviderResourceGroupRoles pRoles = zms.getProviderResourceGroupRoles(ctx, + tenantDomain, providerDomain, providerService, resourceGroup); + + assertNotNull(pRoles); + assertEquals(providerDomain.toLowerCase(), pRoles.getDomain()); + assertEquals(providerService.toLowerCase(), pRoles.getService()); + assertEquals(tenantDomain.toLowerCase(), pRoles.getTenant()); + assertEquals(resourceGroup.toLowerCase(), pRoles.getResourceGroup()); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), pRoles.getRoles().size()); + List traList = pRoles.getRoles(); + List roles = new ArrayList<>(); + for (TenantRoleAction ra : traList) { + roles.add(ra.getRole()); + } + assertTrue(roles.contains("reader")); + assertTrue(roles.contains("writer")); + + // now get the tenant roles for the provider + + TenantResourceGroupRoles tRoles = zms.getTenantResourceGroupRoles(mockDomRsrcCtx, providerDomain, + providerService, tenantDomain, resourceGroup); + assertNotNull(tRoles); + assertEquals(tRoles.getDomain(), providerDomain); + assertEquals(tRoles.getService(), providerService); + assertEquals(tRoles.getTenant(), tenantDomain); + assertEquals(tRoles.getResourceGroup(), resourceGroup); + assertEquals(RESOURCE_PROVIDER_ROLE_ACTIONS.size(), tRoles.getRoles().size()); + traList = pRoles.getRoles(); + roles = new ArrayList<>(); + for (TenantRoleAction ra : traList) { + roles.add(ra.getRole()); + } + assertTrue(roles.contains("reader")); + assertTrue(roles.contains("writer")); + + // now we're going to delete the provider roles using the standard + // resource object without the authorized service. in this case + // the provider roles are going to be deleted but not the tenant + // roles from the provider domain + + zms.deleteProviderResourceGroupRoles(mockDomRsrcCtx, tenantDomain, providerDomain, + providerService, resourceGroup, auditRef); + + // so for tenant we're going to 0 provider roles + + pRoles = zms.getProviderResourceGroupRoles(mockDomRsrcCtx, + tenantDomain, providerDomain, providerService, resourceGroup); + + assertNotNull(pRoles); + assertEquals(0, pRoles.getRoles().size()); + + // but for provider we're still going to get full set of roles + + tRoles = zms.getTenantResourceGroupRoles(mockDomRsrcCtx, providerDomain, + providerService, tenantDomain, resourceGroup); + assertNotNull(tRoles); + assertEquals(2, tRoles.getRoles().size()); + + // now this time we're going to delete with the principal with the + // authorized service token + + zms.deleteProviderResourceGroupRoles(ctx, tenantDomain, providerDomain, + providerService, resourceGroup, auditRef); + + // so for tenant we're still going to 0 provider roles + + pRoles = zms.getProviderResourceGroupRoles(ctx, + tenantDomain, providerDomain, providerService, resourceGroup); + + assertNotNull(pRoles); + assertEquals(0, pRoles.getRoles().size()); + + // and for provider we're now going to get 0 tenant roles as well + + tRoles = zms.getTenantResourceGroupRoles(mockDomRsrcCtx, providerDomain, + providerService, tenantDomain, resourceGroup); + assertNotNull(tRoles); + assertEquals(0, tRoles.getRoles().size()); + + // clean up our domains + + zms.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + } + + @Test + public void testProviderResourceGroupRolesWithAuthorizedServiceNoAccess() { + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_putprovrsrcdomnoaccess"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String tenantDomain = "provrscgrprolesauthorizedservicenoaccess"; + String providerService = "index"; + String providerDomain = "coretech"; + String resourceGroup = "hockey"; + + setupTenantDomainProviderService(zmsImpl, tenantDomain, providerDomain, providerService, + "http://localhost:8090/tableprovider"); + + // tenant is setup so let's setup up policy to authorize access to tenants + // without this role/policy we won't be authorized to add tenant roles + // to the provider domain even with authorized service details + + Role role = createRoleObject(providerDomain, "self_serve", null, + providerDomain + "." + providerService, null); + zmsImpl.putRole(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, role); + + Policy policy = createPolicyObject(providerDomain, "self_serve", + "self_serve", "update", providerDomain + ":tenant.*", AssertionEffect.ALLOW); + zmsImpl.putPolicy(mockDomRsrcCtx, providerDomain, "self_serve", auditRef, policy); + + // now we're going to setup our provider role call + + List roleActions = new ArrayList(); + for (Struct.Field f : RESOURCE_PROVIDER_ROLE_ACTIONS) { + roleActions.add(new TenantRoleAction().setRole(f.name()).setAction( + (String) f.value())); + } + + ProviderResourceGroupRoles providerRoles = new ProviderResourceGroupRoles() + .setDomain(providerDomain).setService(providerService) + .setTenant(tenantDomain).setRoles(roleActions) + .setResourceGroup(resourceGroup); + + // we are going to create a principal object with authorized service + // set to coretech.index + + String userId = "user1"; + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + String unsignedCreds = "v=U1;d=user;n=" + userId; + Principal principal = SimplePrincipal.create("user", userId, unsignedCreds + ";s=signature", + 0, principalAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); + ((SimplePrincipal) principal).setUnsignedCreds(unsignedCreds); + ((SimplePrincipal) principal).setAuthorizedService("coretech.index"); + ResourceContext ctx = createResourceContext(principal); + + // this call should return an exception since we can't execute + // the putproviderresourcegrouproles operation with our chained token + + try { + zmsImpl.putProviderResourceGroupRoles(ctx, tenantDomain, providerDomain, providerService, + resourceGroup, auditRef, providerRoles); + fail(); + } catch (ResourceException ex) { + assertEquals(403, ex.getCode()); + } + + String caller = "putproviderresourcegrouproles"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + assertTrue(msg.indexOf("WHAT-details=(ERROR=(Unauthorized Operation (putproviderresourcegrouproles) for Service coretech.index)") != -1); + foundError = true; + break; + } + assertTrue(foundError); + + // clean up our domains + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, tenantDomain, auditRef); + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, providerDomain, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testOptionsUserTokenInvalidService() { + + // null service must return 400 + + try { + zms.optionsUserToken(mockDomRsrcCtx, "user1", null); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // empty service must return 400 + + try { + zms.optionsUserToken(mockDomRsrcCtx, "user1", ""); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // unknown registered service must return 400 + try { + zms.optionsUserToken(mockDomRsrcCtx, "user1", "unknown_service_name"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // in a list all services must be valid - any invalid must return 400 + + try { + zms.optionsUserToken(mockDomRsrcCtx, "user1", "coretech.storage,unknown_service_name"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + } + + @Test + public void testOptionsUserToken() { + HttpServletRequest servletRequest = new MockHttpServletRequest(); + HttpServletResponse servletResponse = new MockHttpServletResponse(); + ResourceContext ctx = new ZMSImpl.RsrcCtxWrapper(servletRequest, servletResponse, null, null); + + zms.optionsUserToken(ctx, "user", "coretech.storage"); + assertEquals("GET", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_METHODS)); + assertEquals("2592000", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_MAX_AGE)); + assertEquals("true", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_CREDENTIALS)); + + // using default values where we'll get back * for origin and no allow headers + + assertEquals("*", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_ORIGIN)); + assertNull(servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_HEADERS)); + } + + @Test + public void testOptionsUserTokenRequestHeaders() { + MockHttpServletRequest servletRequest = new MockHttpServletRequest(); + MockHttpServletResponse servletResponse = new MockHttpServletResponse(); + ResourceContext ctx = new ZMSImpl.RsrcCtxWrapper(servletRequest, servletResponse, null, null); + + String origin = "https://zms.origin.athenzcompany.com"; + String requestHeaders = "X-Forwarded-For,Content-Type"; + servletRequest.addHeader(ZMSConsts.HTTP_ORIGIN, origin); + servletRequest.addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_REQUEST_HEADERS, requestHeaders); + + // this time we're going to try with multiple services + + zms.optionsUserToken(ctx, "user", "coretech.storage,coretech.index"); + assertEquals("GET", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_METHODS)); + assertEquals("2592000", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_MAX_AGE)); + assertEquals("true", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_CREDENTIALS)); + + assertEquals(origin, servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_ORIGIN)); + assertEquals(requestHeaders, servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_HEADERS)); + } + + @Test + public void testSetStandardCORSHeaders() { + HttpServletRequest servletRequest = new MockHttpServletRequest(); + HttpServletResponse servletResponse = new MockHttpServletResponse(); + ResourceContext ctx = new ZMSImpl.RsrcCtxWrapper(servletRequest, servletResponse, null, null); + + zms.setStandardCORSHeaders(ctx); + assertEquals("true", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_CREDENTIALS)); + + // using default values where we'll get back * for origin and no allow headers + + assertEquals("*", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_ORIGIN)); + assertNull(servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_HEADERS)); + } + + @Test + public void testSetStandardCORSHeadersRequestHeaders() { + MockHttpServletRequest servletRequest = new MockHttpServletRequest(); + MockHttpServletResponse servletResponse = new MockHttpServletResponse(); + ResourceContext ctx = new ZMSImpl.RsrcCtxWrapper(servletRequest, servletResponse, null, null); + + String origin = "https://zms.origin.athenzcompany.com"; + String requestHeaders = "X-Forwarded-For,Content-Type"; + servletRequest.addHeader(ZMSConsts.HTTP_ORIGIN, origin); + servletRequest.addHeader(ZMSConsts.HTTP_ACCESS_CONTROL_REQUEST_HEADERS, requestHeaders); + + zms.setStandardCORSHeaders(ctx); + assertEquals("true", servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_CREDENTIALS)); + + assertEquals(origin, servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_ORIGIN)); + assertEquals(requestHeaders, servletResponse.getHeader(ZMSConsts.HTTP_ACCESS_CONTROL_ALLOW_HEADERS)); + } + + @Test + public void testVerifyProviderEndpoint() { + + // http successful test cases (localhost or *.athenzcompany.com) + assertTrue(zms.verifyProviderEndpoint("http://localhost")); + assertTrue(zms.verifyProviderEndpoint("http://localhost:4080")); + assertTrue(zms.verifyProviderEndpoint("http://localhost:4080/")); + assertTrue(zms.verifyProviderEndpoint("http://localhost:4080/test1")); + assertTrue(zms.verifyProviderEndpoint("http://host1.athenzcompany.com")); + assertTrue(zms.verifyProviderEndpoint("http://host1.athenzcompany.com:4080")); + assertTrue(zms.verifyProviderEndpoint("http://host1.athenzcompany.com:4080/")); + assertTrue(zms.verifyProviderEndpoint("http://host1.athenzcompany.com:4080/test1")); + + // https successful test cases (localhost or *.athenzcompany.com) + assertTrue(zms.verifyProviderEndpoint("https://localhost")); + assertTrue(zms.verifyProviderEndpoint("https://localhost:4080")); + assertTrue(zms.verifyProviderEndpoint("https://localhost:4080/")); + assertTrue(zms.verifyProviderEndpoint("https://localhost:4080/test1")); + assertTrue(zms.verifyProviderEndpoint("https://host1.athenzcompany.com")); + assertTrue(zms.verifyProviderEndpoint("https://host1.athenzcompany.com:4080")); + assertTrue(zms.verifyProviderEndpoint("https://host1.athenzcompany.com:4080/")); + assertTrue(zms.verifyProviderEndpoint("https://host1.athenzcompany.com:4080/test1")); + + // http invalid cases - not *.athenzcompany.com + assertFalse(zms.verifyProviderEndpoint("http://host1.server.com")); + assertFalse(zms.verifyProviderEndpoint("http://host1.server.com:4080")); + assertFalse(zms.verifyProviderEndpoint("http://host1.server.com:4080/")); + assertFalse(zms.verifyProviderEndpoint("http://host1.server.yahoo:4080/test1")); + assertFalse(zms.verifyProviderEndpoint("http://host1.athenz.server.com:4080/test1")); + assertFalse(zms.verifyProviderEndpoint("http://host1.athenz.ch:4080/test1")); + + // non-http scheme test cases + assertFalse(zms.verifyProviderEndpoint("file://host1.athenz.com")); + + // other null test cases + assertTrue(zms.verifyProviderEndpoint(null)); + } + + @Test + public void testGetServerTemplateList() { + + ServerTemplateList list = zms.getServerTemplateList(mockDomRsrcCtx); + assertNotNull(list); + assertTrue(list.getTemplateNames().contains("platforms")); + assertTrue(list.getTemplateNames().contains("vipng")); + assertTrue(list.getTemplateNames().contains("user_provisioning")); + } + + @Test + public void testGetTemplateInvalid() { + try { + zms.getTemplate(mockDomRsrcCtx, "platforms test"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + try { + zms.getTemplate(mockDomRsrcCtx, "invalid"); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + } + + @Test + public void testGetTemplate() { + + Template template = zms.getTemplate(mockDomRsrcCtx, "user_provisioning"); + assertNotNull(template); + + List roles = template.getRoles(); + assertNotNull(roles); + assertEquals(3, roles.size()); + + Role user_role = null; + Role superuser_role = null; + Role openstack_readers_role = null; + for (Role role : roles) { + if (role.getName().equals("_domain_:role.user")) { + user_role = role; + } else if (role.getName().equals("_domain_:role.superuser")) { + superuser_role = role; + } else if (role.getName().equals("_domain_:role.openstack_readers")) { + openstack_readers_role = role; + } + } + + assertNotNull(user_role); + assertNotNull(superuser_role); + assertNotNull(openstack_readers_role); + + // openstack_readers role has 2 members + + assertEquals(2, openstack_readers_role.getMembers().size()); + assertTrue(openstack_readers_role.getMembers().contains("sys.builder")); + assertTrue(openstack_readers_role.getMembers().contains("sys.openstack")); + + // other roles have no members + + assertNull(user_role.getMembers()); + assertNull(superuser_role.getMembers()); + + List policies = template.getPolicies(); + assertNotNull(policies); + assertEquals(3, policies.size()); + + Policy user_policy = null; + Policy superuser_policy = null; + Policy openstack_readers_policy = null; + for (Policy policy : policies) { + if (policy.getName().equals("_domain_:policy.user")) { + user_policy = policy; + } else if (policy.getName().equals("_domain_:policy.superuser")) { + superuser_policy = policy; + } else if (policy.getName().equals("_domain_:policy.openstack_readers")) { + openstack_readers_policy = policy; + } + } + + assertNotNull(user_policy); + assertNotNull(superuser_policy); + assertNotNull(openstack_readers_policy); + + assertEquals(1, user_policy.getAssertions().size()); + assertEquals(1, superuser_policy.getAssertions().size()); + assertEquals(2, openstack_readers_policy.getAssertions().size()); + + template = zms.getTemplate(mockDomRsrcCtx, "vipng"); + assertNotNull(template); + + template = zms.getTemplate(mockDomRsrcCtx, "platforms"); + assertNotNull(template); + + template = zms.getTemplate(mockDomRsrcCtx, "VipNg"); + assertNotNull(template); + } + + @Test + public void testValidateSolutionTemplates() { + final String caller = "testValidateDomainTemplates"; + List templateNames = new ArrayList<>(); + templateNames.add("platforms"); + zms.validateSolutionTemplates(templateNames, caller); + + templateNames.add("vipng"); + zms.validateSolutionTemplates(templateNames, caller); + + templateNames.add("athenz"); + try { + zms.validateSolutionTemplates(templateNames, caller); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + assertTrue(ex.getMessage().contains("athenz")); + } + } + + @Test + public void testPutDomainTemplateInvalidTemplate() { + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + String storeDir = ZMS_DATA_STORE_PATH + "_putdomtempllistinvalid"; + ZMSImpl zmsImpl = getZmsImpl(storeDir, alogger); + + String domainName = "templatelist-invalid"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zmsImpl.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainTemplate templateList = new DomainTemplate(); + List templates = new ArrayList<>(); + templates.add("test validate"); + templateList.setTemplateNames(templates); + try { + zmsImpl.putDomainTemplate(mockDomRsrcCtx, domainName, auditRef, templateList); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + String caller = "putdomaintemplate"; + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(" + caller + ")") == -1) { + continue; + } + assertTrue(msg.indexOf("CLIENT-IP=(" + MOCKCLIENTADDR + ")") != -1); + int index = msg.indexOf("WHAT-details=(ERROR=(Invalid DomainTemplate error: String pattern mismatch (expected \"[a-zA-Z0-9_][a-zA-Z0-9_-]*\") for type SimpleName in data[0]"); + assertTrue(index != -1); + int index2 = msg.indexOf("templates=(\"test validate\"))"); + assertTrue(index < index2); + foundError = true; + break; + } + assertTrue(foundError); + + zmsImpl.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + FileConnection.deleteDirectory(new File(storeDir)); + } + + @Test + public void testPutDomainTemplateNotFoundTemplate() { + + String domainName = "templatelist-invalid"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainTemplate templateList = new DomainTemplate(); + List templates = new ArrayList<>(); + templates.add("InvalidTemplate"); + templateList.setTemplateNames(templates); + try { + zms.putDomainTemplate(mockDomRsrcCtx, domainName, auditRef, templateList); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutDomainTemplateSingleTemplate() { + + String domainName = "templatelist-single"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainTemplate domTemplate = new DomainTemplate(); + List templates = new ArrayList<>(); + templates.add("vipng"); + domTemplate.setTemplateNames(templates); + + zms.putDomainTemplate(mockDomRsrcCtx, domainName, auditRef, domTemplate); + + // verify that our role collection includes the roles defined in template + + List names = zms.dbService.listRoles(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Role role = zms.dbService.getRole(domainName, "vip_admin", false, false); + assertEquals(domainName + ":role.vip_admin", role.getName()); + assertNull(role.getTrust()); + assertNull(role.getMembers()); + + role = zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false); + assertEquals(domainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // verify that our policy collections includes the policies defined in the template + + names = zms.dbService.listPolicies(domainName); + assertEquals(3, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + + Policy policy = zms.dbService.getPolicy(domainName, "vip_admin"); + assertEquals(domainName + ":policy.vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + policy = zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin"); + assertEquals(domainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + // delete an applied service template + // + String templateName = "vipng"; + zms.deleteDomainTemplate(mockDomRsrcCtx, domainName, templateName, auditRef); + + // verify that our role collection does NOT include the roles defined in template + + names = zms.dbService.listRoles(domainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + names = zms.dbService.listPolicies(domainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutDomainTemplateMultipleTemplates() { + + String domainName = "templatelist-multiple"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + DomainTemplate domTemplate = new DomainTemplate(); + List templates = new ArrayList<>(); + templates.add("vipng"); + templates.add("platforms"); + templates.add("user_provisioning"); + domTemplate.setTemplateNames(templates); + + zms.putDomainTemplate(mockDomRsrcCtx, domainName, auditRef, domTemplate); + + // verify that our role collection includes the roles defined in template + + List names = zms.dbService.listRoles(domainName); + assertEquals(7, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + assertTrue(names.contains("platforms_deployer")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + Role role = zms.dbService.getRole(domainName, "openstack_readers", false, false); + assertEquals(domainName + ":role.openstack_readers", role.getName()); + assertNull(role.getTrust()); + assertEquals(2, role.getMembers().size()); + assertTrue(role.getMembers().contains("sys.builder")); + assertTrue(role.getMembers().contains("sys.openstack")); + + role = zms.dbService.getRole(domainName, "sys_network_super_vip_admin", false, false); + assertEquals(domainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // verify that our policy collections includes the policies defined in the template + + names = zms.dbService.listPolicies(domainName); + assertEquals(7, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + assertTrue(names.contains("platforms_deploy")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + Policy policy = zms.dbService.getPolicy(domainName, "vip_admin"); + assertEquals(domainName + ":policy.vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + policy = zms.dbService.getPolicy(domainName, "sys_network_super_vip_admin"); + assertEquals(domainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(domainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(domainName + ":vip*", assertion.getResource()); + + // delete applied service template + // + String templateName = "vipng"; + zms.deleteDomainTemplate(mockDomRsrcCtx, domainName, templateName, auditRef); + + // verify that our role collection does NOT include the vipng roles defined in template + + names = zms.dbService.listRoles(domainName); + assertEquals(5, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("platforms_deployer")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + names = zms.dbService.listPolicies(domainName); + assertEquals(5, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("platforms_deploy")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + // delete applied service template + // + templateName = "platforms"; + zms.deleteDomainTemplate(mockDomRsrcCtx, domainName, templateName, auditRef);; + + // verify that our role collection does NOT include the platforms roles defined in template + + names = zms.dbService.listRoles(domainName); + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + names = zms.dbService.listPolicies(domainName); + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + // delete last applied service template + // + templateName = "user_provisioning"; + zms.deleteDomainTemplate(mockDomRsrcCtx, domainName, templateName, auditRef); + + // verify that our role collection does NOT include the user_provisioning roles defined in template + + names = zms.dbService.listRoles(domainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + names = zms.dbService.listPolicies(domainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetDomainTemplateListInvalid() { + + try { + zms.getDomainTemplateList(mockDomRsrcCtx, "invalid_domain name"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + try { + zms.getDomainTemplateList(mockDomRsrcCtx, "not_found_domain_name"); + fail(); + } catch (ResourceException ex) { + assertEquals(404, ex.getCode()); + } + } + + @Test + public void testGetDomainTemplateList() { + + String domainName = "domaintemplatelist-valid"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + // initially no templates + + DomainTemplateList domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, domainName); + List templates = domaintemplateList.getTemplateNames(); + assertEquals(0, templates.size()); + + // add a single template + + DomainTemplate domTemplate = new DomainTemplate(); + templates = new ArrayList<>(); + templates.add("vipng"); + domTemplate.setTemplateNames(templates); + + zms.putDomainTemplate(mockDomRsrcCtx, domainName, auditRef, domTemplate); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, domainName); + templates = domaintemplateList.getTemplateNames(); + assertEquals(1, templates.size()); + assertTrue(templates.contains("vipng")); + + // add 2 templates + + domTemplate = new DomainTemplate(); + templates = new ArrayList<>(); + templates.add("vipng"); + templates.add("platforms"); + domTemplate.setTemplateNames(templates); + + zms.putDomainTemplate(mockDomRsrcCtx, domainName, auditRef, domTemplate); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, domainName); + templates = domaintemplateList.getTemplateNames(); + assertEquals(2, templates.size()); + assertTrue(templates.contains("vipng")); + assertTrue(templates.contains("platforms")); + + // add the same set of templates again and no change in results + domTemplate = new DomainTemplate(); + domTemplate.setTemplateNames(templates); + zms.putDomainTemplate(mockDomRsrcCtx, domainName, auditRef, domTemplate); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, domainName); + templates = domaintemplateList.getTemplateNames(); + assertEquals(2, templates.size()); + assertTrue(templates.contains("vipng")); + assertTrue(templates.contains("platforms")); + + // delete an applied service template + // + String templateName = "vipng"; + zms.deleteDomainTemplate(mockDomRsrcCtx, domainName, templateName, auditRef); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, domainName); + templates = domaintemplateList.getTemplateNames(); + assertEquals(1, templates.size()); + assertTrue(templates.contains("platforms")); + + // delete last applied service template + // + templateName = "platforms"; + zms.deleteDomainTemplate(mockDomRsrcCtx, domainName, templateName, auditRef); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, domainName); + templates = domaintemplateList.getTemplateNames(); + assertTrue(templates.isEmpty()); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPostSubDomainWithTemplates() { + + String domainName = "postsubdomain-withtemplate"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + SubDomain dom2 = createSubDomainObject("sub", domainName, + "Test Domain2", "testOrg", adminUser); + DomainTemplateList templateList = new DomainTemplateList(); + List templates = new ArrayList<>(); + templates.add("vipng"); + templates.add("platforms"); + templates.add("user_provisioning"); + templateList.setTemplateNames(templates); + dom2.setTemplates(templateList); + + Domain resDom1 = zms.postSubDomain(mockDomRsrcCtx, domainName, auditRef, dom2); + assertNotNull(resDom1); + + String subDomainName = domainName + ".sub"; + + // verify that our role collection includes the roles defined in template + + List names = zms.dbService.listRoles(subDomainName); + assertEquals(7, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + assertTrue(names.contains("platforms_deployer")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + Role role = zms.dbService.getRole(subDomainName, "openstack_readers", false, false); + assertEquals(subDomainName + ":role.openstack_readers", role.getName()); + assertNull(role.getTrust()); + assertEquals(2, role.getMembers().size()); + assertTrue(role.getMembers().contains("sys.builder")); + assertTrue(role.getMembers().contains("sys.openstack")); + + role = zms.dbService.getRole(subDomainName, "sys_network_super_vip_admin", false, false); + assertEquals(subDomainName + ":role.sys_network_super_vip_admin", role.getName()); + assertEquals("sys.network", role.getTrust()); + + // verify that our policy collections includes the policies defined in the template + + names = zms.dbService.listPolicies(subDomainName); + assertEquals(7, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("vip_admin")); + assertTrue(names.contains("sys_network_super_vip_admin")); + assertTrue(names.contains("platforms_deploy")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + Policy policy = zms.dbService.getPolicy(subDomainName, "vip_admin"); + assertEquals(subDomainName + ":policy.vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + Assertion assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(subDomainName + ":role.vip_admin", assertion.getRole()); + assertEquals(subDomainName + ":vip*", assertion.getResource()); + + policy = zms.dbService.getPolicy(subDomainName, "sys_network_super_vip_admin"); + assertEquals(subDomainName + ":policy.sys_network_super_vip_admin", policy.getName()); + assertEquals(1, policy.getAssertions().size()); + assertion = policy.getAssertions().get(0); + assertEquals("*", assertion.getAction()); + assertEquals(subDomainName + ":role.sys_network_super_vip_admin", assertion.getRole()); + assertEquals(subDomainName + ":vip*", assertion.getResource()); + + // verify the saved domain list + + DomainTemplateList domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, subDomainName); + templates = domaintemplateList.getTemplateNames(); + assertEquals(3, templates.size()); + assertTrue(templates.contains("vipng")); + assertTrue(templates.contains("platforms")); + assertTrue(templates.contains("user_provisioning")); + + // delete an applied service template + // + String templateName = "vipng"; + zms.deleteDomainTemplate(mockDomRsrcCtx, subDomainName, templateName, auditRef); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, subDomainName); + templates = domaintemplateList.getTemplateNames(); + assertEquals(2, templates.size()); + assertTrue(templates.contains("platforms")); + assertTrue(templates.contains("user_provisioning")); + + names = zms.dbService.listRoles(subDomainName); + assertEquals(5, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("platforms_deployer")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + names = zms.dbService.listPolicies(subDomainName); + assertEquals(5, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("platforms_deploy")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + // delete an applied service template + // + templateName = "platforms"; + zms.deleteDomainTemplate(mockDomRsrcCtx, subDomainName, templateName, auditRef); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, subDomainName); + templates = domaintemplateList.getTemplateNames(); + assertEquals(1, templates.size()); + assertTrue(templates.contains("user_provisioning")); + + names = zms.dbService.listRoles(subDomainName); + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + names = zms.dbService.listPolicies(subDomainName); + assertEquals(4, names.size()); + assertTrue(names.contains("admin")); + assertTrue(names.contains("user")); + assertTrue(names.contains("superuser")); + assertTrue(names.contains("openstack_readers")); + + // delete last applied service template + // + templateName = "user_provisioning"; + zms.deleteDomainTemplate(mockDomRsrcCtx, subDomainName, templateName, auditRef); + + domaintemplateList = zms.getDomainTemplateList(mockDomRsrcCtx, subDomainName); + templates = domaintemplateList.getTemplateNames(); + assertTrue(templates.isEmpty()); + + names = zms.dbService.listRoles(subDomainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + names = zms.dbService.listPolicies(subDomainName); + assertEquals(1, names.size()); + assertTrue(names.contains("admin")); + + zms.deleteSubDomain(mockDomRsrcCtx, domainName, "sub", auditRef); + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutPolicyNoLoopbackNoSuchDomainErrorAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("10.10.10.11"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + String storeDir = ZMS_DATA_STORE_PATH + "_al_noloop"; + ZMSImpl zmsObj = getZmsImpl(storeDir, alogger); + + String userId = "user"; + Principal principal = SimplePrincipal.create("user", userId, "v=U1;d=user;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + String domainName = "DomainName"; + String policyName = "PolicyName"; + + // Tests the putPolicy() condition: if (domain == null)... + try { + Policy policy = createPolicyObject(domainName, policyName); + + // should fail b/c we never created a top level domain. + zmsObj.putPolicy(context, domainName, policyName, auditRef, policy); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 404); + } + + FileConnection.deleteDirectory(new File(storeDir)); + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (msg.indexOf("WHAT-api=(putpolicy)") == -1) { + continue; + } + assertTrue(msg, msg.indexOf("CLIENT-IP=(10.10.10.11)") != -1); + assertTrue(msg, msg.indexOf("WHAT-details=(ERROR=(putpolicy: Unknown domain: domainname))") != -1); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testPutPolicyLoopbackNoXFF_InconsistentNameErrorAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + String storeDir = ZMS_DATA_STORE_PATH + "_al_loopback"; + ZMSImpl zmsObj = getZmsImpl(storeDir, alogger); + + String userId = "user"; + Principal principal = SimplePrincipal.create("user", userId, "v=U1;d=user;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + String domainName = "DomainName"; + String policyName = "PolicyName"; + + // Tests the putPolicy() condition : if (!policyResourceName(domainName, policyName).equals(policy.getName()))... + try { + Policy policy = createPolicyObject(domainName, policyName); + + zmsObj.putPolicy(context, domainName, "Bad" + policyName, auditRef, policy); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + + FileConnection.deleteDirectory(new File(storeDir)); + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (!msg.contains("WHAT-api=(putpolicy)")) { + continue; + } + assertTrue(msg, msg.contains("CLIENT-IP=(127.0.0.1)")); + assertTrue(msg, msg.contains("WHAT-details=(ERROR=(putPolicy: Inconsistent policy names - expected: domainname:policy.badpolicyname, actual: domainname:policy.policyname)")); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testPutPolicyLoopbackXFFSingleValueAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + Mockito.when(servletRequest.getHeader("X-Forwarded-For")).thenReturn("10.10.10.11"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + String storeDir = ZMS_DATA_STORE_PATH + "_al_loopbackXff"; + ZMSImpl zmsObj = getZmsImpl(storeDir, alogger); + + String userId = "user"; + Principal principal = SimplePrincipal.create("user", userId, "v=U1;d=user;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + String domainName = "DomainName"; + String policyName = "PolicyName"; + + // Tests the putPolicy() condition : if (!policyResourceName(domainName, policyName).equals(policy.getName()))... + try { + Policy policy = createPolicyObject(domainName, policyName); + + zmsObj.putPolicy(context, domainName, "Bad" + policyName, auditRef, policy); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + + FileConnection.deleteDirectory(new File(storeDir)); + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (!msg.contains("WHAT-api=(putpolicy)")) { + continue; + } + assertTrue(msg, msg.contains("CLIENT-IP=(10.10.10.11)")); + assertTrue(msg, msg.contains("WHAT-entity=(badpolicyname)")); + assertTrue(msg, msg.contains("WHAT-details=(ERROR=(putPolicy: Inconsistent policy names - expected: domainname:policy.badpolicyname, actual: domainname:policy.policyname))")); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testPutPolicyLoopbackXFFMultipleValuesAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + Mockito.when(servletRequest.getHeader("X-Forwarded-For")).thenReturn("10.10.10.11, 10.11.11.11, 10.12.12.12"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + String storeDir = ZMS_DATA_STORE_PATH + "_al_loopbackXffMulti"; + ZMSImpl zmsObj = getZmsImpl(storeDir, alogger); + + String userId = "user"; + Principal principal = SimplePrincipal.create("user", userId, "v=U1;d=user;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + String domainName = "DomainName"; + String policyName = "PolicyName"; + + // Tests the putPolicy() condition : if (!policyResourceName(domainName, policyName).equals(policy.getName()))... + try { + Policy policy = createPolicyObject(domainName, policyName); + + zmsObj.putPolicy(context, domainName, "Bad" + policyName, auditRef, policy); + fail("requesterror not thrown."); + } catch (ResourceException e) { + assertEquals(e.getCode(), 400); + } + + FileConnection.deleteDirectory(new File(storeDir)); + + boolean foundError = false; + for (String msg: aLogMsgs) { + if (!msg.contains("WHAT-api=(putpolicy)")) { + continue; + } + assertTrue(msg, msg.contains("CLIENT-IP=(10.12.12.12)")); + assertTrue(msg, msg.contains("WHAT-entity=(badpolicyname)")); + int index = msg.indexOf("WHAT-details=(ERROR=(putPolicy: Inconsistent policy names - expected: domainname:policy.badpolicyname, actual: domainname:policy.policyname))"); + assertTrue(index != -1); + foundError = true; + break; + } + assertTrue(foundError); + } + + @Test + public void testRetrieveResourceDomainAssumeRoleWithTrust() { + assertEquals("trustdomain", zms.retrieveResourceDomain("resource", "assume_role", "trustdomain")); + } + + @Test + public void testRetrieveResourceDomainAssumeRoleWithOutTrust() { + assertEquals("domain1", zms.retrieveResourceDomain("domain1:resource", "assume_role", null)); + } + + @Test + public void testRetrieveResourceDomainValidDomain() { + assertEquals("domain1", zms.retrieveResourceDomain("domain1:resource", "read", null)); + assertEquals("domain1", zms.retrieveResourceDomain("domain1:resource", "read", "trustdomain")); + } + + @Test + public void testRetrieveResourceDomainInvalidResource() { + assertEquals(null, zms.retrieveResourceDomain("domain1:resource:invalid", "read", null)); + assertEquals(null, zms.retrieveResourceDomain("domain1:a:b:c:d:e", "read", "trustdomain")); + } + + @Test + public void testLoadPublicKeys() { + // verify that the public keys were loaded during server startup + assertFalse(zms.serverPublicKeyMap.isEmpty()); + String privKeyId = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_ID, "0"); + assertEquals(zms.serverPublicKeyMap.get(privKeyId), pubKey); + } + + @Test + public void testUnderscoreNotAllowed() { + + String domainName = "core-tech"; + String badDomainName = "core_tech"; + + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + TopLevelDomain dom2 = createTopLevelDomainObject(badDomainName, + "Test Domain1", "testOrg", adminUser); + try { + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom2); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + SubDomain sub = createSubDomainObject(badDomainName, domainName, + "Test Domain2", "testOrg", adminUser); + try { + zms.postSubDomain(mockDomRsrcCtx, domainName, auditRef, sub); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + UserDomain userDom = createUserDomainObject(badDomainName, "Test Domain1", "testOrg"); + try { + zms.postUserDomain(mockDomRsrcCtx, badDomainName, auditRef, userDom); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testReadOnlyMode() throws Exception { + + // first initialize our impl which would create our service + + ZMSImpl zmsTest = zmsInit(); + + // now we're going to create a new instance with read-only mode + + System.setProperty(ZMSConsts.ZMS_PROP_READ_ONLY_MODE, "true"); + + ObjectStore store = new FileObjectStore(new File(ZMS_DATA_STORE_PATH)); + String privKeyName = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY); + File privKeyFile = new File(privKeyName); + String privKey = Crypto.encodedFile(privKeyFile); + PrivateKey privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + String privKeyId = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_ID, "0"); + + Metric metric = createMetric(); + zmsTest = new ZMSImpl("localhost", store, metric, privateKey, + privKeyId, pubKey, AuditLogFactory.getLogger(), null); + + TopLevelDomain dom1 = createTopLevelDomainObject("ReadOnlyDom1", + "Test Domain1", "testOrg", adminUser); + try { + zmsTest.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Read-Only")); + } + + Policy policy1 = createPolicyObject("ReadOnlyDom1", "Policy1"); + try { + zmsTest.putPolicy(mockDomRsrcCtx, "ReadOnlyDom1", "Policy1", auditRef, policy1); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Read-Only")); + } + + Role role1 = createRoleObject("ReadOnlyDom1", "Role1", null, + "user.joe", "user.jane"); + try { + zmsTest.putRole(mockDomRsrcCtx, "ReadOnlyDom1", "Role1", auditRef, role1); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Read-Only")); + } + + ServiceIdentity service1 = createServiceObject("ReadOnlyDom1", + "Service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + + try { + zmsTest.putServiceIdentity(mockDomRsrcCtx, "ReadOnlyDom1", "Service1", auditRef, service1); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains("Read-Only")); + } + + // now make sure we can read our sys.auth zms service + + ServiceIdentity serviceRes = zmsTest.getServiceIdentity(mockDomRsrcCtx, "sys.auth", "zms"); + assertNotNull(serviceRes); + assertEquals(serviceRes.getName(), "sys.auth.zms"); + + System.clearProperty(ZMSConsts.ZMS_PROP_READ_ONLY_MODE); + } + + @Test + public void testGetSignedDomainsResult() { + GetSignedDomainsResult object = new GetSignedDomainsResult(null); + assertFalse(object.isAsync()); + + try { + object.done(101); + } catch (WebApplicationException ex) { + } + } + + @Test + public void testResourceContext() { + + ZMSImpl.RsrcCtxWrapper ctx = (ZMSImpl.RsrcCtxWrapper) zms.newResourceContext(mockServletRequest, mockServletResponse); + assertNotNull(ctx); + assertNotNull(ctx.context()); + assertNull(ctx.principal()); + assertEquals(ctx.request(), mockServletRequest); + assertEquals(ctx.response(), mockServletResponse); + + try { + com.yahoo.athenz.common.server.rest.ResourceException restExc = new com.yahoo.athenz.common.server.rest.ResourceException(401, "failed struct"); + ctx.throwZmsException(restExc); + fail(); + } catch (ResourceException ex) { + assertEquals(401, ex.getCode()); + assertEquals( ((ResourceError) ex.data).message, "failed struct"); + } + } + + @Test + public void testEqualToOrPrefixedBy() { + assertTrue(zms.equalToOrPrefixedBy("pattern", "pattern")); + assertTrue(zms.equalToOrPrefixedBy("pattern", "pattern.")); + assertTrue(zms.equalToOrPrefixedBy("pattern", "pattern.test")); + assertFalse(zms.equalToOrPrefixedBy("pattern", "pattern-test")); + assertFalse(zms.equalToOrPrefixedBy("pattern", "patterns.test")); + assertFalse(zms.equalToOrPrefixedBy("pattern", "apattern.test")); + } + + @Test + public void testMatchRoleNoRoles() { + assertFalse(zms.matchRole("domain", new ArrayList(), "role", null)); + } + + @Test + public void testMatchRoleNoRoleMatch() { + Role role = new Role().setName("domain:role.role1"); + ArrayList roles = new ArrayList<>(); + roles.add(role); + assertFalse(zms.matchRole("domain", new ArrayList(), "domain:role\\.role2.*", null)); + } + + @Test + public void testMatchRoleAuthRoleNoMatch() { + Role role = new Role().setName("domain:role.role1"); + ArrayList roles = new ArrayList<>(); + roles.add(role); + + ArrayList authRoles = new ArrayList<>(); + authRoles.add("role3"); + + assertFalse(zms.matchRole("domain", roles, "domain:role\\.role1.*", authRoles)); + } + + @Test + public void testMatchRole() { + Role role = new Role().setName("domain:role.role1"); + ArrayList roles = new ArrayList<>(); + roles.add(role); + + ArrayList authRoles = new ArrayList<>(); + authRoles.add("role1"); + + assertTrue(zms.matchRole("domain", roles, "domain:role\\.role.*", authRoles)); + } + + @Test + public void testGetYrnDomain() { + assertEquals(zms.yrnDomain("yrn:service:location:domain:entity"), "domain"); + } + + @Test + public void testServerInternalError() { + + RuntimeException ex = ZMSUtils.internalServerError("unit test", "tester"); + assertTrue(ex.getMessage().contains("{code: 500")); + } + + @Test + public void testGetSchema() { + Schema schema = zms.getRdlSchema(mockDomRsrcCtx); + assertNotNull(schema); + } + + @Test + public void testValidatePolicyAssertionsInValid() { + + // assertion missing domain name + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + List assertList = new ArrayList(); + assertList.add(assertion); + + try { + zms.validatePolicyAssertions(assertList, "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // assertion with empty domain name + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(":resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + assertList.clear(); + assertList.add(assertion); + + try { + zms.validatePolicyAssertions(assertList, "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // assertion with invalid domain name + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain name:resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + assertList.clear(); + assertList.add(assertion); + + try { + zms.validatePolicyAssertions(assertList, "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + } + + @Test + public void testValidatePolicyAssertionInValid() { + + // assertion missing domain name + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + try { + zms.validatePolicyAssertion(assertion, "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // assertion with empty domain name + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(":resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + try { + zms.validatePolicyAssertion(assertion, "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + + // assertion with invalid domain name + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain name:resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + try { + zms.validatePolicyAssertion(assertion, "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + } + + @Test + public void testValidatePolicyAssertionsValid() { + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain1:resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + List assertList = new ArrayList(); + assertList.add(assertion); + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + assertList.add(assertion); + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain1:"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + assertList.add(assertion); + + try { + zms.validatePolicyAssertions(assertList, "unitTest"); + } catch (Exception ex) { + fail(ex.getMessage()); + } + + // null should also be valid + + try { + zms.validatePolicyAssertions(null, "unitTest"); + } catch (Exception ex) { + fail(ex.getMessage()); + } + } + + @Test + public void testValidatePolicyAssertionValid() { + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain1:resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + try { + zms.validatePolicyAssertion(assertion, "unitTest"); + } catch (Exception ex) { + fail(ex.getMessage()); + } + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:resource1"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + try { + zms.validatePolicyAssertion(assertion, "unitTest"); + } catch (Exception ex) { + fail(ex.getMessage()); + } + + assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain1:"); + assertion.setRole(ZMSUtils.roleResourceName("domain1", "role1")); + + try { + zms.validatePolicyAssertion(assertion, "unitTest"); + } catch (Exception ex) { + fail(ex.getMessage()); + } + } + + @Test + public void testSetupRoleListWithMembers() { + + String domainName = "setuprolelistwithmembers"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, "Role1", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName, "Role1", auditRef, role1); + + Role role2 = createRoleObject(domainName, "Role2", null, "user.doe", + "user.janie"); + zms.putRole(mockDomRsrcCtx, domainName, "Role2", auditRef, role2); + + Role role3 = createRoleObject(domainName, "Role3", "sys.auth", null, null); + zms.putRole(mockDomRsrcCtx, domainName, "Role3", auditRef, role3); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List roles = zms.setupRoleList(domain, Boolean.valueOf(true)); + assertEquals(4, roles.size()); // need to account for admin role + + boolean role1Check = false; + boolean role2Check = false; + boolean role3Check = false; + + for (Role role : roles) { + switch (role.getName()) { + case "setuprolelistwithmembers:role.role1": + assertTrue(role.getMembers().contains("user.joe")); + assertTrue(role.getMembers().contains("user.jane")); + assertEquals(role.getMembers().size(), 2); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role1Check = true; + break; + case "setuprolelistwithmembers:role.role2": + assertTrue(role.getMembers().contains("user.doe")); + assertTrue(role.getMembers().contains("user.janie")); + assertEquals(role.getMembers().size(), 2); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role2Check = true; + break; + case "setuprolelistwithmembers:role.role3": + assertEquals(role.getTrust(), "sys.auth"); + assertNull(role.getMembers()); + role3Check = true; + assertNotNull(role.getModified()); + break; + } + } + + assertTrue(role1Check); + assertTrue(role2Check); + assertTrue(role3Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testSetupRoleListWithOutMembers() { + + String domainName = "setuprolelistwithoutmembers"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, "Role1", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName, "Role1", auditRef, role1); + + Role role2 = createRoleObject(domainName, "Role2", null, "user.doe", + "user.janie"); + zms.putRole(mockDomRsrcCtx, domainName, "Role2", auditRef, role2); + + Role role3 = createRoleObject(domainName, "Role3", "sys.auth", null, null); + zms.putRole(mockDomRsrcCtx, domainName, "Role3", auditRef, role3); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List roles = zms.setupRoleList(domain, Boolean.valueOf(false)); + assertEquals(4, roles.size()); // need to account for admin role + + boolean role1Check = false; + boolean role2Check = false; + boolean role3Check = false; + + for (Role role : roles) { + switch (role.getName()) { + case "setuprolelistwithoutmembers:role.role1": + assertNull(role.getMembers()); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role1Check = true; + break; + case "setuprolelistwithoutmembers:role.role2": + assertNull(role.getMembers()); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role2Check = true; + break; + case "setuprolelistwithoutmembers:role.role3": + assertEquals(role.getTrust(), "sys.auth"); + assertNull(role.getMembers()); + role3Check = true; + assertNotNull(role.getModified()); + break; + } + } + + assertTrue(role1Check); + assertTrue(role2Check); + assertTrue(role3Check); + + // we'll do the same check this time passing null + // for the boolean flag instead of false + + roles = zms.setupRoleList(domain, null); + assertEquals(4, roles.size()); // need to account for admin role + + role1Check = false; + role2Check = false; + role3Check = false; + + for (Role role : roles) { + switch (role.getName()) { + case "setuprolelistwithoutmembers:role.role1": + assertNull(role.getMembers()); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role1Check = true; + break; + case "setuprolelistwithoutmembers:role.role2": + assertNull(role.getMembers()); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role2Check = true; + break; + case "setuprolelistwithoutmembers:role.role3": + assertEquals(role.getTrust(), "sys.auth"); + assertNull(role.getMembers()); + role3Check = true; + assertNotNull(role.getModified()); + break; + } + } + + assertTrue(role1Check); + assertTrue(role2Check); + assertTrue(role3Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetRoles() { + + String domainName = "getroles"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Role role1 = createRoleObject(domainName, "Role1", null, "user.joe", + "user.jane"); + zms.putRole(mockDomRsrcCtx, domainName, "Role1", auditRef, role1); + + Role role2 = createRoleObject(domainName, "Role2", null, "user.doe", + "user.janie"); + zms.putRole(mockDomRsrcCtx, domainName, "Role2", auditRef, role2); + + Role role3 = createRoleObject(domainName, "Role3", "sys.auth", null, null); + zms.putRole(mockDomRsrcCtx, domainName, "Role3", auditRef, role3); + + Roles roleList = zms.getRoles(mockDomRsrcCtx, domainName, Boolean.valueOf(true)); + List roles = roleList.getList(); + assertEquals(4, roles.size()); // need to account for admin role + + boolean role1Check = false; + boolean role2Check = false; + boolean role3Check = false; + + for (Role role : roles) { + switch (role.getName()) { + case "getroles:role.role1": + assertTrue(role.getMembers().contains("user.joe")); + assertTrue(role.getMembers().contains("user.jane")); + assertEquals(role.getMembers().size(), 2); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role1Check = true; + break; + case "getroles:role.role2": + assertTrue(role.getMembers().contains("user.doe")); + assertTrue(role.getMembers().contains("user.janie")); + assertEquals(role.getMembers().size(), 2); + assertNull(role.getTrust()); + assertNotNull(role.getModified()); + role2Check = true; + break; + case "getroles:role.role3": + assertEquals(role.getTrust(), "sys.auth"); + assertNull(role.getMembers()); + role3Check = true; + assertNotNull(role.getModified()); + break; + } + } + + assertTrue(role1Check); + assertTrue(role2Check); + assertTrue(role3Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetRolesInvalidDomain() { + + final String domainName = "getrolesinvaliddomain"; + + try { + zms.getRoles(mockDomRsrcCtx, domainName, null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testSetupPolicyListWithAssertions() { + + final String domainName = "setup-policy-with-assert"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject(domainName, "policy2"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy2", auditRef, policy2); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List policies = zms.setupPolicyList(domain, Boolean.valueOf(true)); + assertEquals(3, policies.size()); // need to account for admin policy + + boolean policy1Check = false; + boolean policy2Check = false; + + List testAssertions = null; + for (Policy policy : policies) { + switch (policy.getName()) { + case "setup-policy-with-assert:policy.policy1": + testAssertions = policy.getAssertions(); + assertEquals(testAssertions.size(), 1); + policy1Check = true; + break; + case "setup-policy-with-assert:policy.policy2": + testAssertions = policy.getAssertions(); + assertEquals(testAssertions.size(), 1); + policy2Check = true; + break; + } + } + + assertTrue(policy1Check); + assertTrue(policy2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetPolicies() { + + final String domainName = "get-policies"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject(domainName, "policy2"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy2", auditRef, policy2); + + Policies policyList = zms.getPolicies(mockDomRsrcCtx, domainName, Boolean.valueOf(true)); + List policies = policyList.getList(); + assertEquals(3, policies.size()); // need to account for admin policy + + boolean policy1Check = false; + boolean policy2Check = false; + + List testAssertions = null; + for (Policy policy : policies) { + switch (policy.getName()) { + case "get-policies:policy.policy1": + testAssertions = policy.getAssertions(); + assertEquals(testAssertions.size(), 1); + policy1Check = true; + break; + case "get-policies:policy.policy2": + testAssertions = policy.getAssertions(); + assertEquals(testAssertions.size(), 1); + policy2Check = true; + break; + } + } + + assertTrue(policy1Check); + assertTrue(policy2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetPoliciesInvalidDomain() { + + String domainName = "get-policies-invalid-domain"; + + try { + zms.getPolicies(mockDomRsrcCtx, domainName, Boolean.valueOf(true)); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testSetupPolicyListWithOutAssertions() { + + final String domainName = "setup-policy-without-assert"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy1 = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy1); + + Policy policy2 = createPolicyObject(domainName, "policy2"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy2", auditRef, policy2); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List policies = zms.setupPolicyList(domain, Boolean.valueOf(false)); + assertEquals(3, policies.size()); // need to account for admin policy + + boolean policy1Check = false; + boolean policy2Check = false; + + for (Policy policy : policies) { + switch (policy.getName()) { + case "setup-policy-without-assert:policy.policy1": + assertNull(policy.getAssertions()); + policy1Check = true; + break; + case "setup-policy-without-assert:policy.policy2": + assertNull(policy.getAssertions()); + policy2Check = true; + break; + } + } + + assertTrue(policy1Check); + assertTrue(policy2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetServiceIdentities() { + + final String domainName = "get-services"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject(domainName, + "service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject(domainName, + "service2", "http://localhost", "/usr/bin/java", "yahoo", + "users", "host2"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service2", auditRef, service2); + + ServiceIdentities serviceList = zms.getServiceIdentities(mockDomRsrcCtx, domainName, + Boolean.valueOf(true), Boolean.valueOf(true)); + List services = serviceList.getList(); + assertEquals(2, services.size()); + + boolean service1Check = false; + boolean service2Check = false; + + for (ServiceIdentity service : services) { + switch (service.getName()) { + case "get-services.service1": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "root"); + assertEquals(service.getPublicKeys().size(), 2); + assertEquals(service.getHosts().size(), 1); + assertEquals(service.getHosts().get(0), "host1"); + service1Check = true; + break; + case "get-services.service2": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "yahoo"); + assertEquals(service.getPublicKeys().size(), 2); + assertEquals(service.getHosts().size(), 1); + assertEquals(service.getHosts().get(0), "host2"); + service2Check = true; + break; + } + } + + assertTrue(service1Check); + assertTrue(service2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetServiceIdentitiesInvalidDomain() { + + String domainName = "get-services-invalid-domain"; + + try { + zms.getServiceIdentities(mockDomRsrcCtx, domainName, + Boolean.valueOf(true), Boolean.valueOf(true)); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testSetupServiceListWithKeysHosts() { + + final String domainName = "setup-service-keys-hosts"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject(domainName, + "service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject(domainName, + "service2", "http://localhost", "/usr/bin/java", "yahoo", + "users", "host2"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service2", auditRef, service2); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List services = zms.setupServiceIdentityList(domain, + Boolean.valueOf(true), Boolean.valueOf(true)); + assertEquals(2, services.size()); + + boolean service1Check = false; + boolean service2Check = false; + + for (ServiceIdentity service : services) { + switch (service.getName()) { + case "setup-service-keys-hosts.service1": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "root"); + assertEquals(service.getPublicKeys().size(), 2); + assertEquals(service.getHosts().size(), 1); + assertEquals(service.getHosts().get(0), "host1"); + service1Check = true; + break; + case "setup-service-keys-hosts.service2": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "yahoo"); + assertEquals(service.getPublicKeys().size(), 2); + assertEquals(service.getHosts().size(), 1); + assertEquals(service.getHosts().get(0), "host2"); + service2Check = true; + break; + } + } + + assertTrue(service1Check); + assertTrue(service2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testSetupServiceListWithOutKeysHosts() { + + final String domainName = "setup-service-without-keys-hosts"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject(domainName, + "service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject(domainName, + "service2", "http://localhost", "/usr/bin/java", "yahoo", + "users", "host2"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service2", auditRef, service2); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List services = zms.setupServiceIdentityList(domain, + Boolean.valueOf(false), Boolean.valueOf(false)); + assertEquals(2, services.size()); + + boolean service1Check = false; + boolean service2Check = false; + + for (ServiceIdentity service : services) { + switch (service.getName()) { + case "setup-service-without-keys-hosts.service1": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "root"); + assertNull(service.getPublicKeys()); + assertNull(service.getHosts()); + service1Check = true; + break; + case "setup-service-without-keys-hosts.service2": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "yahoo"); + assertNull(service.getPublicKeys()); + assertNull(service.getHosts()); + service2Check = true; + break; + } + } + + assertTrue(service1Check); + assertTrue(service2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testSetupServiceListWithKeysOnly() { + + final String domainName = "setup-service-keys-only"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject(domainName, + "service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject(domainName, + "service2", "http://localhost", "/usr/bin/java", "yahoo", + "users", "host2"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service2", auditRef, service2); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List services = zms.setupServiceIdentityList(domain, + Boolean.valueOf(true), Boolean.valueOf(false)); + assertEquals(2, services.size()); + + boolean service1Check = false; + boolean service2Check = false; + + for (ServiceIdentity service : services) { + switch (service.getName()) { + case "setup-service-keys-only.service1": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "root"); + assertEquals(service.getPublicKeys().size(), 2); + assertNull(service.getHosts()); + service1Check = true; + break; + case "setup-service-keys-only.service2": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "yahoo"); + assertEquals(service.getPublicKeys().size(), 2); + assertNull(service.getHosts()); + service2Check = true; + break; + } + } + + assertTrue(service1Check); + assertTrue(service2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testSetupServiceListWithHostsOnly() { + + final String domainName = "setup-service-hosts-only"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + ServiceIdentity service1 = createServiceObject(domainName, + "service1", "http://localhost", "/usr/bin/java", "root", + "users", "host1"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service1", auditRef, service1); + + ServiceIdentity service2 = createServiceObject(domainName, + "service2", "http://localhost", "/usr/bin/java", "yahoo", + "users", "host2"); + zms.putServiceIdentity(mockDomRsrcCtx, domainName, "service2", auditRef, service2); + + AthenzDomain domain = zms.getAthenzDomain(domainName, false); + List services = zms.setupServiceIdentityList(domain, + Boolean.valueOf(false), Boolean.valueOf(true)); + assertEquals(2, services.size()); + + boolean service1Check = false; + boolean service2Check = false; + + for (ServiceIdentity service : services) { + switch (service.getName()) { + case "setup-service-hosts-only.service1": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "root"); + assertNull(service.getPublicKeys()); + assertEquals(service.getHosts().size(), 1); + assertEquals(service.getHosts().get(0), "host1"); + service1Check = true; + break; + case "setup-service-hosts-only.service2": + assertEquals(service.getExecutable(), "/usr/bin/java"); + assertEquals(service.getUser(), "yahoo"); + assertNull(service.getPublicKeys()); + assertEquals(service.getHosts().size(), 1); + assertEquals(service.getHosts().get(0), "host2"); + service2Check = true; + break; + } + } + + assertTrue(service1Check); + assertTrue(service2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetAssertion() { + + final String domainName = "get-assertion"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy); + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, "policy1"); + Long assertionId = policyRes.getAssertions().get(0).getId(); + + Assertion assertion = zms.getAssertion(mockDomRsrcCtx, domainName, "policy1", assertionId); + assertNotNull(assertion); + assertEquals(assertion.getAction(), "*"); + assertEquals(assertion.getResource(), domainName + ":*"); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetAssertionMultiple() { + + final String domainName = "get-assertion-multiple"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domainName, "policy1"); + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(domainName + ":resource"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "admin")); + policy.getAssertions().add(assertion); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy); + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, "policy1"); + List testAssertions = new ArrayList<>(); + + Long assertionId = policyRes.getAssertions().get(0).getId(); + Assertion testAssertion = zms.getAssertion(mockDomRsrcCtx, domainName, "policy1", assertionId); + assertNotNull(testAssertion); + testAssertions.add(testAssertion); + + assertionId = policyRes.getAssertions().get(1).getId(); + testAssertion = zms.getAssertion(mockDomRsrcCtx, domainName, "policy1", assertionId); + assertNotNull(testAssertion); + testAssertions.add(testAssertion); + + boolean assert1Check = false; + boolean assert2Check = false; + for (Assertion testAssert : testAssertions) { + switch (testAssert.getAction()) { + case "*": + assertEquals(testAssert.getResource(), domainName + ":*"); + assert1Check = true; + break; + case "update": + assertEquals(testAssert.getResource(), domainName + ":resource"); + assert2Check = true; + break; + } + } + assertTrue(assert1Check); + assertTrue(assert2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetAssertionUnknownId() { + + final String domainName = "get-assertion-invalid"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy); + + try { + zms.getAssertion(mockDomRsrcCtx, domainName, "policy1", Long.valueOf(1)); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutAssertion() { + + final String domainName = "put-assertion"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy); + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(domainName + ":resource"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "admin")); + + // add the assertion + + assertion = zms.putAssertion(mockDomRsrcCtx, domainName, "policy1", auditRef, assertion); + + // verity that the return assertion object has the id set + + assertNotNull(assertion.getId()); + + // validate that both assertions exist + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, "policy1"); + + boolean assert1Check = false; + boolean assert2Check = false; + for (Assertion testAssert : policyRes.getAssertions()) { + switch (testAssert.getAction()) { + case "*": + assertEquals(testAssert.getResource(), domainName + ":*"); + assert1Check = true; + break; + case "update": + assertEquals(testAssert.getResource(), domainName + ":resource"); + assert2Check = true; + break; + } + } + assertTrue(assert1Check); + assertTrue(assert2Check); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutAssertionAdminReject() { + + final String domainName = "put-assertion-admin"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(domainName + ":resource"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "admin")); + + try { + zms.putAssertion(mockDomRsrcCtx, domainName, "admin", auditRef, assertion); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getMessage(), ex.getMessage().contains("admin policy cannot be modified")); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testPutAssertionUnknownPolicy() { + + final String domainName = "put-assertion-unknown"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(domainName + ":resource"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "admin")); + + // add the assertion which should fail due to unknown policy name + + try { + zms.putAssertion(mockDomRsrcCtx, domainName, "policy2", auditRef, assertion); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteAssertionSingle() { + + final String domainName = "delete-assertion-single"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy); + + // now let's delete the assertion directly + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, "policy1"); + Long assertionId = policyRes.getAssertions().get(0).getId(); + + zms.deleteAssertion(mockDomRsrcCtx, domainName, "policy1", assertionId, auditRef); + + policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, "policy1"); + assertEquals(policyRes.getAssertions().size(), 0); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteAssertionMultiple() { + + final String domainName = "delete-assertion-multiple"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domainName, "policy1"); + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(domainName + ":resource"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "admin")); + policy.getAssertions().add(assertion); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy); + + Policy policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, "policy1"); + + // we are going to delete assertion at index 0 + + Long assertionId = policyRes.getAssertions().get(0).getId(); + zms.deleteAssertion(mockDomRsrcCtx, domainName, "policy1", assertionId, auditRef); + + // remember the assertion action for index 1 + + String action = policyRes.getAssertions().get(1).getAction(); + + // fetch the policy again and verify the action + + policyRes = zms.getPolicy(mockDomRsrcCtx, domainName, "policy1"); + assertEquals(policyRes.getAssertions().size(), 1); + assertEquals(policyRes.getAssertions().get(0).getAction(), action); + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteAssertionAdminReject() { + + final String domainName = "delete-assertion-admin"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + try { + zms.deleteAssertion(mockDomRsrcCtx, domainName, "admin", Long.valueOf(101), auditRef); + fail(); + } catch (ResourceException ex) { + assertTrue(ex.getMessage(), ex.getMessage().contains("admin policy cannot be modified")); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testDeleteAssertionUnknown() { + + final String domainName = "delete-assertion-unknown"; + TopLevelDomain dom1 = createTopLevelDomainObject(domainName, + "Test Domain1", "testOrg", adminUser); + zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1); + + Policy policy = createPolicyObject(domainName, "policy1"); + zms.putPolicy(mockDomRsrcCtx, domainName, "policy1", auditRef, policy); + + // delete the assertion which should fail due to unknown policy name + + try { + zms.deleteAssertion(mockDomRsrcCtx, domainName, "policy2", Long.valueOf(1), auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + // delete the assertion which should fail due to unknown assertion id + + try { + zms.deleteAssertion(mockDomRsrcCtx, domainName, "policy1", Long.valueOf(1), auditRef); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + zms.deleteTopLevelDomain(mockDomRsrcCtx, domainName, auditRef); + } + + @Test + public void testGetPolicyListWithoutAssertionId() { + + assertNull(zms.getPolicyListWithoutAssertionId(null)); + + List emptyList = new ArrayList<>(); + List result = zms.getPolicyListWithoutAssertionId(emptyList); + assertTrue(result.isEmpty()); + + final String domainName = "assertion-test"; + Policy policy = createPolicyObject(domainName, "policy1"); + Assertion assertion = new Assertion(); + assertion.setAction("update"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource(domainName + ":resource"); + assertion.setRole(ZMSUtils.roleResourceName(domainName, "admin")); + assertion.setId(Long.valueOf(101)); + policy.getAssertions().add(assertion); + + List policyList = new ArrayList<>(); + policyList.add(policy); + + result = zms.getPolicyListWithoutAssertionId(policyList); + assertEquals(result.size(), 1); + Assertion testAssertion = result.get(0).getAssertions().get(0); + assertNull(testAssertion.getId()); + assertEquals(assertion.getAction(), "update"); + assertEquals(assertion.getEffect(), AssertionEffect.ALLOW); + assertEquals(assertion.getResource(), domainName + ":resource"); + assertEquals(assertion.getRole(), ZMSUtils.roleResourceName(domainName, "admin")); + } + + @Test + public void testIsConsistentRoleName() { + + Role role = new Role(); + + // yrn behavior + + role.setName("domain1:role.role1"); + assertTrue(zms.isConsistentRoleName("domain1", "role1", role)); + + // local name behavior + + role.setName("role1"); + assertTrue(zms.isConsistentRoleName("domain1", "role1", role)); + assertEquals(role.getName(), "domain1:role.role1"); + + // inconsistent behavior + + role.setName("domain1:role.role1"); + assertFalse(zms.isConsistentRoleName("domain1", "role2", role)); + + role.setName("role1"); + assertFalse(zms.isConsistentRoleName("domain1", "role2", role)); + } + + @Test + public void testIsConsistentPolicyName() { + + Policy policy = new Policy(); + + // yrn behavior + + policy.setName("domain1:policy.policy1"); + assertTrue(zms.isConsistentPolicyName("domain1", "policy1", policy)); + + // local name behavior + + policy.setName("policy1"); + assertTrue(zms.isConsistentPolicyName("domain1", "policy1", policy)); + assertEquals(policy.getName(), "domain1:policy.policy1"); + + // inconsistent behavior + + policy.setName("domain1:policy.policy1"); + assertFalse(zms.isConsistentPolicyName("domain1", "policy2", policy)); + + policy.setName("policy1"); + assertFalse(zms.isConsistentPolicyName("domain1", "policy2", policy)); + } + + @Test + public void testGetDomainListNotNull() { + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + String userId = "user1"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + zms.getDomainList(rsrcCtx1, 100, null, null, 100, "account", 224, "roleMem1", "role1", null); + } + + @Test + public void testDeleteUserDomainNull() { + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + String userId = "user1"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + try { + zms.deleteUserDomain(rsrcCtx1, null, null); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteDomainTemplateNull() { + Authority userAuthority = new com.yahoo.athenz.common.server.debug.DebugUserAuthority(); + String userId = "user1"; + Principal principal = SimplePrincipal.create("user", userId, userId + ":password", 0, userAuthority); + ((SimplePrincipal) principal).setUnsignedCreds(userId); + ResourceContext rsrcCtx1 = createResourceContext(principal); + try { + zms.deleteDomainTemplate(rsrcCtx1, "dom1", null, "zms"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testIsAllowedResourceLookForAllUsers() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + try{ + zms.isAllowedResourceLookForAllUsers(principal1); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteDomainTemplate() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + try{ + zms.deleteDomainTemplate(rsrcCtx1, null, null, null); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testPutTenancyResourceGroupNull() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + TenancyResourceGroup tenantResource = new TenancyResourceGroup(); + try{ + zms.putTenancyResourceGroup(rsrcCtx1, null, null, null, null, tenantResource); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteTenancyResourceGroupNull() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + try{ + zms.deleteTenancyResourceGroup(rsrcCtx1, null, null, null, null); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testPutTenantResourceGroupRolesNull() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + TenantResourceGroupRoles tenantResource = new TenantResourceGroupRoles(); + try{ + zms.putTenantResourceGroupRoles(rsrcCtx1, null, null, null, null, null, tenantResource); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteTenantResourceGroupRolesNull() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + try{ + zms.deleteTenantResourceGroupRoles(rsrcCtx1, null, null, null, null, null); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testGetResourceAccessList() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + try{ + zms.getResourceAccessList(rsrcCtx1, "principal", "UPDATE"); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testDeleteProviderResourceGroupRolesNull() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + ResourceContext rsrcCtx1 = createResourceContext(principal1); + try{ + zms.deleteProviderResourceGroupRoles(rsrcCtx1, null, null, null, null, null); + } catch(Exception ex) { + assertTrue(true); + } + } + + @Test + public void testGetProviderClient() { + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature", + "10.11.12.13", "GET", null); + try{ + zms.setProviderClientClass(null); + zms.getProviderClient("localhost/zms", principal1); + } catch(Exception ex) { + assertTrue(true); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSJettyContainerTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSJettyContainerTest.java new file mode 100644 index 00000000000..2a996840457 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSJettyContainerTest.java @@ -0,0 +1,425 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import static org.testng.Assert.*; + + +import org.eclipse.jetty.server.Connector; +import org.eclipse.jetty.server.Handler; +import org.eclipse.jetty.server.HttpConfiguration; +import org.eclipse.jetty.server.RequestLog; +import org.eclipse.jetty.server.Server; +import org.eclipse.jetty.server.Slf4jRequestLog; +import org.eclipse.jetty.server.handler.RequestLogHandler; +import org.eclipse.jetty.servlet.ServletContextHandler; +import org.eclipse.jetty.util.ssl.SslContextFactory; +import org.eclipse.jetty.util.thread.ThreadPool; + +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; + +import org.testng.annotations.BeforeClass; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.log.AthenzRequestLog; +import com.yahoo.athenz.common.server.log.AuditLogFactory; + +public class ZMSJettyContainerTest { + + @Mock ZMSHandler mockImpl; + + @BeforeClass + public void setUp() throws Exception { + MockitoAnnotations.initMocks(this); + } + + @AfterMethod + public void cleanup() { + System.clearProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PATH); + System.clearProperty(ZMSConsts.ZMS_PROP_KEYSTORE_TYPE); + System.clearProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PASSWORD); + System.clearProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PATH); + System.clearProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_TYPE); + System.clearProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PASSWORD); + System.clearProperty(ZMSConsts.ZMS_PROP_KEYMANAGER_PASSWORD); + System.clearProperty(ZMSConsts.ZMS_PROP_EXCLUDED_CIPHER_SUITES); + System.clearProperty(ZMSConsts.ZMS_PROP_EXCLUDED_PROTOCOLS); + System.clearProperty(ZMSConsts.ZMS_PROP_IDLE_TIMEOUT); + System.clearProperty(ZMSConsts.ZMS_PROP_SEND_SERVER_VERSION); + System.clearProperty(ZMSConsts.ZMS_PROP_SEND_DATE_HEADER); + System.clearProperty(ZMSConsts.ZMS_PROP_OUTPUT_BUFFER_SIZE); + System.clearProperty(ZMSConsts.ZMS_PROP_REQUEST_HEADER_SIZE); + System.clearProperty(ZMSConsts.ZMS_PROP_RESPONSE_HEADER_SIZE); + System.clearProperty(ZMSConsts.ZMS_PROP_MAX_THREADS); + } + + @Test + public void testContainerThreadPool() { + + System.setProperty(ZMSConsts.ZMS_PROP_MAX_THREADS, "100"); + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.createServer(100); + + Server server = container.getServer(); + assertNotNull(server); + + ThreadPool threadPool = server.getThreadPool(); + assertNotNull(threadPool); + + // at this point we have no threads so the value is 0 + assertEquals(threadPool.getThreads(), 0); + assertEquals(threadPool.getIdleThreads(), 0); + } + + @Test + public void testRequestLogHandler() { + + System.setProperty(ZMSConsts.ZMS_PROP_ACCESS_LOG_RETAIN_DAYS, "3"); + System.setProperty(ZMSConsts.ZMS_PROP_MAX_THREADS, "100"); + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.createServer(100); + + container.addRequestLogHandler("/tmp/zms_log"); + + // now retrieve the request log handler + + Handler[] handlers = container.getHandlers().getHandlers(); + RequestLogHandler logHandler = null; + for (Handler handler : handlers) { + if (handler instanceof RequestLogHandler) { + logHandler = (RequestLogHandler) handler; + break; + } + } + + assertNotNull(logHandler); + + RequestLog reqLog = logHandler.getRequestLog(); + assertNotNull(reqLog); + assertEquals(reqLog.getClass(), AthenzRequestLog.class); + } + + @Test + public void testSlf4jRequestLogHandler() { + + System.setProperty(ZMSConsts.ZMS_PROP_ACCESS_SLF4J_LOGGER, "AthenzAccessLogger"); + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.resource(ZMSResources.class); + container.delegate(ZMSHandler.class, mockImpl); + container.createServer(100); + + container.addRequestLogHandler("/tmp/zms_log"); + + // now retrieve the request log handler + + Handler[] handlers = container.getHandlers().getHandlers(); + RequestLogHandler logHandler = null; + for (Handler handler : handlers) { + if (handler instanceof RequestLogHandler) { + logHandler = (RequestLogHandler) handler; + break; + } + } + + assertNotNull(logHandler); + + RequestLog reqLog = logHandler.getRequestLog(); + assertNotNull(reqLog); + assertEquals(reqLog.getClass(), Slf4jRequestLog.class); + assertEquals(((Slf4jRequestLog) reqLog).getLoggerName(), "AthenzAccessLogger"); + System.clearProperty(ZMSConsts.ZMS_PROP_ACCESS_SLF4J_LOGGER); + } + + @Test + public void testAddServletHandlers() { + System.setProperty(ZMSConsts.ZMS_PROP_KEEP_ALIVE, "false"); + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.resource(ZMSResources.class); + container.delegate(ZMSHandler.class, mockImpl); + container.createServer(100); + container.addServletHandlers("/tmp", "localhost"); + } + + @Test + public void testPrimaryContext() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.resource(ZMSResources.class); + container.delegate(ZMSHandler.class, mockImpl); + container.createServer(100); + container.addServletHandlers("/tmp", "localhost"); + + Handler[] handlers = container.getHandlers().getHandlers(); + ServletContextHandler srvHandler = null; + for (Handler handler : handlers) { + if (handler instanceof ServletContextHandler) { + srvHandler = (ServletContextHandler) handler; + break; + } + } + + assertNotNull(srvHandler); + assertEquals(srvHandler.getContextPath(), "/"); + } + + @Test + public void testHttpConfigurationValidHttpsPort() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.createServer(100); + + System.setProperty(ZMSConsts.ZMS_PROP_SEND_SERVER_VERSION, "true"); + System.setProperty(ZMSConsts.ZMS_PROP_SEND_DATE_HEADER, "false"); + System.setProperty(ZMSConsts.ZMS_PROP_OUTPUT_BUFFER_SIZE, "128"); + System.setProperty(ZMSConsts.ZMS_PROP_REQUEST_HEADER_SIZE, "256"); + System.setProperty(ZMSConsts.ZMS_PROP_RESPONSE_HEADER_SIZE, "512"); + + int httpsPort = 443; + + HttpConfiguration httpConfig = container.newHttpConfiguration(httpsPort); + assertNotNull(httpConfig); + + assertEquals(httpConfig.getOutputBufferSize(), 128); + assertFalse(httpConfig.getSendDateHeader()); + assertTrue(httpConfig.getSendServerVersion()); + assertEquals(httpConfig.getRequestHeaderSize(), 256); + assertEquals(httpConfig.getResponseHeaderSize(), 512); + assertEquals(httpConfig.getSecurePort(), httpsPort); + assertEquals(httpConfig.getSecureScheme(), "https"); + } + + @Test + public void testHttpConfigurationNoHttpsPort() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.createServer(100); + + System.setProperty(ZMSConsts.ZMS_PROP_SEND_SERVER_VERSION, "false"); + System.setProperty(ZMSConsts.ZMS_PROP_SEND_DATE_HEADER, "true"); + System.setProperty(ZMSConsts.ZMS_PROP_OUTPUT_BUFFER_SIZE, "64"); + System.setProperty(ZMSConsts.ZMS_PROP_REQUEST_HEADER_SIZE, "128"); + System.setProperty(ZMSConsts.ZMS_PROP_RESPONSE_HEADER_SIZE, "256"); + + HttpConfiguration httpConfig = container.newHttpConfiguration(0); + assertNotNull(httpConfig); + + assertEquals(httpConfig.getOutputBufferSize(), 64); + assertTrue(httpConfig.getSendDateHeader()); + assertFalse(httpConfig.getSendServerVersion()); + assertEquals(httpConfig.getRequestHeaderSize(), 128); + assertEquals(httpConfig.getResponseHeaderSize(), 256); + assertEquals(httpConfig.getSecurePort(), 0); + + // it defaults to https even if we have no value specified + assertEquals(httpConfig.getSecureScheme(), "https"); + } + + @Test + public void testHttpConnectorsBoth() { + + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PATH, "/tmp/keystore"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PATH, "/tmp/truststore"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_IDLE_TIMEOUT, "10001"); + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.createServer(100); + + HttpConfiguration httpConfig = container.newHttpConfiguration(8082); + container.addHTTPConnectors(httpConfig, 8081, 8082); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 2); + + assertEquals(connectors[0].getIdleTimeout(), 10001); + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + + System.out.println("Connectors: " + connectors[1].getProtocols().toString()); + assertTrue(connectors[1].getProtocols().contains("http/1.1")); + assertTrue(connectors[1].getProtocols().contains("ssl")); + } + + @Test + public void testHttpConnectorsHttpsOnly() { + + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_IDLE_TIMEOUT, "10001"); + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.createServer(100); + + HttpConfiguration httpConfig = container.newHttpConfiguration(8082); + container.addHTTPConnectors(httpConfig, 0, 8082); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertTrue(connectors[0].getProtocols().contains("ssl")); + } + + @Test + public void testHttpConnectorsHttpOnly() { + + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_IDLE_TIMEOUT, "10001"); + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.createServer(100); + + HttpConfiguration httpConfig = container.newHttpConfiguration(0); + container.addHTTPConnectors(httpConfig, 8081, 0); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + assertEquals(connectors[0].getIdleTimeout(), 10001); + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertFalse(connectors[0].getProtocols().contains("ssl")); + } + + @Test + public void testFilter() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + container.resource(ZMSResources.class); + container.delegate(ZMSHandler.class, mockImpl); + container.createServer(100); + container.addServletHandlers("/tmp", "localhost"); + + Handler[] handlers = container.getHandlers().getHandlers(); + ServletContextHandler srvHandler = null; + for (Handler handler : handlers) { + if (handler instanceof ServletContextHandler) { + srvHandler = (ServletContextHandler) handler; + break; + } + } + assertNotNull(srvHandler); + } + + @Test + public void testCreateSSLContextObject() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_EXCLUDED_CIPHER_SUITES, ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES); + System.setProperty(ZMSConsts.ZMS_PROP_EXCLUDED_PROTOCOLS, ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_PROTOCOLS); + + SslContextFactory sslContextFactory = container.createSSLContextObject(); + assertNotNull(sslContextFactory); + assertEquals(sslContextFactory.getKeyStorePath(), "file:///tmp/keystore"); + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getTrustStoreResource().toString(), "file:///tmp/truststore"); + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getExcludeCipherSuites(), ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES.split(",")); + assertEquals(sslContextFactory.getExcludeProtocols(), ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_PROTOCOLS.split(",")); + } + + @Test + public void testCreateSSLContextObjectNoValues() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + SslContextFactory sslContextFactory = container.createSSLContextObject(); + + assertNotNull(sslContextFactory); + assertNull(sslContextFactory.getKeyStoreResource()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertNull(sslContextFactory.getTrustStoreResource()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + } + + @Test + public void testCreateSSLContextObjectNoKeyStore() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_EXCLUDED_CIPHER_SUITES, ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES); + System.setProperty(ZMSConsts.ZMS_PROP_EXCLUDED_PROTOCOLS, ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_PROTOCOLS); + + SslContextFactory sslContextFactory = container.createSSLContextObject(); + assertNotNull(sslContextFactory); + assertNull(sslContextFactory.getKeyStoreResource()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getTrustStoreResource().toString(), "file:///tmp/truststore"); + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getExcludeCipherSuites(), ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES.split(",")); + assertEquals(sslContextFactory.getExcludeProtocols(), ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_PROTOCOLS.split(",")); + } + + @Test + public void testCreateSSLContextObjectNoTrustStore() { + + ZMSJettyContainer container = new ZMSJettyContainer(AuditLogFactory.getLogger()); + + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZMSConsts.ZMS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZMSConsts.ZMS_PROP_EXCLUDED_CIPHER_SUITES, ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES); + System.setProperty(ZMSConsts.ZMS_PROP_EXCLUDED_PROTOCOLS, ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_PROTOCOLS); + + SslContextFactory sslContextFactory = container.createSSLContextObject(); + assertNotNull(sslContextFactory); + assertEquals(sslContextFactory.getKeyStorePath(), "file:///tmp/keystore"); + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertNull(sslContextFactory.getTrustStore()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getExcludeCipherSuites(), ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_CIPHER_SUITES.split(",")); + assertEquals(sslContextFactory.getExcludeProtocols(), ZMSJettyContainer.ZMS_DEFAULT_EXCLUDED_PROTOCOLS.split(",")); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSServerImplTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSServerImplTest.java new file mode 100644 index 00000000000..a2b57ecaac6 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSServerImplTest.java @@ -0,0 +1,112 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.common.metrics.MetricFactory; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.zms.ZMSServerImpl; +import com.yahoo.athenz.zms.pkey.PrivateKeyStoreFactory; +import com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory; + +import static org.testng.Assert.*; + +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +public class ZMSServerImplTest { + + @BeforeClass + public void setUp() throws Exception { + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_STORE_CLASS, "com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory"); + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, "src/test/resources/zms_private.pem"); + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, "src/test/resources/zms_public.pem"); + System.setProperty(ZMSConsts.ZMS_PROP_DOMAIN_ADMIN, "user.testadminuser"); + } + + @Test + public void testDebugAuthorities() throws Exception { + + Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority(); + principalAuthority.initialize(); + + Authority roleAuthority = new com.yahoo.athenz.common.server.debug.DebugRoleAuthority(); + roleAuthority.initialize(); + + com.yahoo.athenz.common.server.rest.Http.AuthorityList authList = new com.yahoo.athenz.common.server.rest.Http.AuthorityList(); + authList.add(principalAuthority); + authList.add(roleAuthority); + + String policyStoreContext = "."; + + MetricFactory debugMetricFactory = new com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory(); + PrivateKeyStoreFactory privateKeyFactory = new FilePrivateKeyStoreFactory(); + ZMSServerImpl core = new ZMSServerImpl("localhost", policyStoreContext, + privateKeyFactory, debugMetricFactory, AuditLogFactory.getLogger(), + null, authList); + assertNotNull(core); + + assertNotNull(core.getAuthorizer()); + assertNotNull(core.getInstance()); + } + + @Test + public void testRealAuthorities() throws Exception { + + Authority principalAuthority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Authority roleAuthority = new com.yahoo.athenz.auth.impl.RoleAuthority(); + + String policyStoreContext = "."; + + com.yahoo.athenz.common.server.rest.Http.AuthorityList authList = new com.yahoo.athenz.common.server.rest.Http.AuthorityList(); + authList.add(principalAuthority); + authList.add(roleAuthority); + + MetricFactory debugMetricFactory = new com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory(); + PrivateKeyStoreFactory privateKeyFactory = new FilePrivateKeyStoreFactory(); + ZMSServerImpl core = new ZMSServerImpl("localhost", policyStoreContext, + privateKeyFactory, debugMetricFactory, AuditLogFactory.getLogger(), + null, authList); + assertNotNull(core); + + assertNotNull(core.getAuthorizer()); + assertNotNull(core.getInstance()); + } + + @Test + public void testNullContext() throws Exception { + + Authority principalAuthority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + Authority roleAuthority = new com.yahoo.athenz.auth.impl.RoleAuthority(); + + String policyStoreContext = null; + + com.yahoo.athenz.common.server.rest.Http.AuthorityList authList = new com.yahoo.athenz.common.server.rest.Http.AuthorityList(); + authList.add(principalAuthority); + authList.add(roleAuthority); + + MetricFactory debugMetricFactory = new com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory(); + PrivateKeyStoreFactory privateKeyFactory = new FilePrivateKeyStoreFactory(); + ZMSServerImpl core = new ZMSServerImpl("localhost", policyStoreContext, + privateKeyFactory, debugMetricFactory, AuditLogFactory.getLogger(), + null, authList); + assertNotNull(core); + + assertNotNull(core.getAuthorizer()); + assertNotNull(core.getInstance()); + } +} + diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSTest.java new file mode 100644 index 00000000000..d5d192ab578 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSTest.java @@ -0,0 +1,192 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms; + +import static org.testng.Assert.*; + +import org.eclipse.jetty.server.Connector; +import org.eclipse.jetty.server.Server; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +public class ZMSTest { + + @BeforeClass + public void setUp() throws Exception { + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_STORE_CLASS, "com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory"); + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, "src/test/resources/zms_private.pem"); + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, "src/test/resources/zms_public.pem"); + System.setProperty(ZMSConsts.ZMS_PROP_DOMAIN_ADMIN, "user.testadminuser"); + } + + @AfterMethod + public void cleanup() { + System.clearProperty(ZMSConsts.ZMS_PROP_HOME); + System.clearProperty(ZMSConsts.ZMS_PROP_HOSTNAME); + System.clearProperty(ZMSConsts.ZMS_PROP_HTTP_PORT); + System.clearProperty(ZMSConsts.ZMS_PROP_HTTPS_PORT); + } + + @Test + public void testGetAuditLogger() { + System.setProperty(ZMSConsts.ZMS_PROP_AUDIT_LOGGER_CLASS, "zmsclass"); + System.setProperty(ZMSConsts.ZMS_PROP_AUDIT_LOGGER_CLASS_PARAM, "zmsparam"); + ZMS.getAuditLogger(); + } + + @Test + public void testGetServerHostNamePropertySet() { + System.setProperty(ZMSConsts.ZMS_PROP_HOSTNAME, "MyTestHost"); + assertEquals(ZMS.getServerHostName(), "MyTestHost"); + } + + @Test + public void testGetServerHostNameNoProperty() { + assertNotNull(ZMS.getServerHostName()); + } + + @Test + public void initContainerValidPorts() { + + System.setProperty(ZMSConsts.ZMS_PROP_HOME, "/tmp/zms_server"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "4080"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTPS_PORT, "4443"); + + ZMSJettyContainer container = ZMS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 2); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + + System.out.println("Connectors: " + connectors[1].getProtocols().toString()); + assertTrue(connectors[1].getProtocols().contains("http/1.1")); + assertTrue(connectors[1].getProtocols().contains("ssl")); + } + + @Test + public void initContainerOnlyHTTPSPort() { + + System.setProperty(ZMSConsts.ZMS_PROP_HOME, "/tmp/zms_server"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "0"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTPS_PORT, "4443"); + System.setProperty("yahoo.zms.debug.user_authority", "true"); + + ZMSJettyContainer container = ZMS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertTrue(connectors[0].getProtocols().contains("ssl")); + } + + @Test + public void initContainerOnlyHTTPPort() { + + System.setProperty(ZMSConsts.ZMS_PROP_HOME, "/tmp/zms_server"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "4080"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTPS_PORT, "0"); + + ZMSJettyContainer container = ZMS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertFalse(connectors[0].getProtocols().contains("ssl")); + } + + @Test + public void initContainerInvalidHTTPPort() { + + System.setProperty(ZMSConsts.ZMS_PROP_HOME, "/tmp/zms_server"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "-10"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTPS_PORT, "4443"); + + ZMSJettyContainer container = ZMS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 2); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + + System.out.println("Connectors: " + connectors[1].getProtocols().toString()); + assertTrue(connectors[1].getProtocols().contains("http/1.1")); + assertTrue(connectors[1].getProtocols().contains("ssl")); + } + + @Test + public void initContainerInvalidHTTPSPort() { + + System.setProperty(ZMSConsts.ZMS_PROP_HOME, "/tmp/zms_server"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "4080"); + System.setProperty(ZMSConsts.ZMS_PROP_HTTPS_PORT, "-10"); + + ZMSJettyContainer container = ZMS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertFalse(connectors[0].getProtocols().contains("ssl")); + } + + @Test + public void testGetPortNumberDefault() { + assertEquals(ZMS.getPortNumber("NotExistantProperty", 4080), 4080); + } + + @Test + public void testGetPortNumberValid() { + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "4085"); + assertEquals(ZMS.getPortNumber(ZMSConsts.ZMS_PROP_HTTP_PORT, 4080), 4085); + } + + @Test + public void testGetPortNumberInvalidFormat() { + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "abc"); + assertEquals(ZMS.getPortNumber(ZMSConsts.ZMS_PROP_HTTP_PORT, 4080), 4080); + } + + @Test + public void testGetPortNumberOutOfRangeNegative() { + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "-1"); + assertEquals(ZMS.getPortNumber(ZMSConsts.ZMS_PROP_HTTP_PORT, 4080), 4080); + } + + @Test + public void testGetPortNumberOutOfRangePositive() { + System.setProperty(ZMSConsts.ZMS_PROP_HTTP_PORT, "65536"); + assertEquals(ZMS.getPortNumber(ZMSConsts.ZMS_PROP_HTTP_PORT, 4080), 4080); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/config/AllowedOperationTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/config/AllowedOperationTest.java new file mode 100644 index 00000000000..71050d813ee --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/config/AllowedOperationTest.java @@ -0,0 +1,303 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.config; + +import static org.testng.Assert.*; + +import org.testng.annotations.*; + +import java.util.Set; +import java.util.HashSet; +import java.util.Map; +import java.util.HashMap; + +public class AllowedOperationTest { + + @BeforeClass(alwaysRun=true) + public void setUp() throws Exception { + } + + @AfterClass(alwaysRun=true) + public void shutdown() { + } + + @Test + public void testSetName() { + String name = "AllowedOperationName"; + AllowedOperation op = new AllowedOperation(); + op.setName(name); + String gottenName = op.getName(); + assertEquals(gottenName, name); + } + + @SuppressWarnings("serial") + @Test + public void testSetItems() { + AllowedOperation op = new AllowedOperation(); + Set item = new HashSet() { + { + add("hoge"); + } + }; + Map> items = new HashMap>() { + { + put("key", item); + } + }; + op.setItems(items); + + Map> gottenItems = op.getItems(); + assertEquals(gottenItems, items); + } + + + @Test + public void testIsOperationAllowedOnNoItems() { + AllowedOperation op = new AllowedOperation(); + boolean ret = op.isOperationAllowedOn("opItemType", "opItemValue"); + assertTrue(ret); + } + + @Test + public void testIsOperationAllowedOnItemsIsEmpty() { + AllowedOperation op = new AllowedOperation(); + Map> items = new HashMap>(); + op.setItems(items); + boolean ret = op.isOperationAllowedOn("opItemType", "opItemValue"); + assertTrue(ret); + } + + @SuppressWarnings("serial") + @Test + public void testIsOperationAllowedOnOpItemTypeIsNull() { + AllowedOperation op = new AllowedOperation(); + Set item = new HashSet() { + { + add("hoge"); + } + }; + Map> items = new HashMap>() { + { + put("key", item); + } + }; + op.setItems(items); + boolean ret = op.isOperationAllowedOn(null, "opItemValue"); + assertFalse(ret); + } + + @SuppressWarnings("serial") + @Test + public void testIsOperationAllowedOnOpItemValueIsNull() { + AllowedOperation op = new AllowedOperation(); + Set item = new HashSet() { + { + add("hoge"); + } + }; + Map> items = new HashMap>() { + { + put("key", item); + } + }; + op.setItems(items); + boolean ret = op.isOperationAllowedOn("opItemType", null); + assertFalse(ret); + } + + @SuppressWarnings("serial") + @Test + public void testIsOperationAllowedOnOpItemTypeIsNotDefined() { + AllowedOperation op = new AllowedOperation(); + Set item = new HashSet() { + { + add("hoge"); + } + }; + Map> items = new HashMap>() { + { + put("key", item); + } + }; + op.setItems(items); + boolean ret = op.isOperationAllowedOn("opItemType", "opItemValue"); + assertFalse(ret); + } + + @SuppressWarnings("serial") + @Test + public void testIsOperationAllowedOnOpItemValueIsNotAllowed() { + AllowedOperation op = new AllowedOperation(); + Set item = new HashSet() { + { + add("hoge"); + } + }; + Map> items = new HashMap>() { + { + put("key", item); + } + }; + op.setItems(items); + boolean ret = op.isOperationAllowedOn("key", "opItemValue"); + assertFalse(ret); + } + + @SuppressWarnings("serial") + @Test + public void testIsOperationAllowedOnOpItemValueIsAllowed() { + AllowedOperation op = new AllowedOperation(); + Set item = new HashSet() { + { + add("hoge"); + } + }; + Map> items = new HashMap>() { + { + put("key", item); + } + }; + op.setItems(items); + boolean ret = op.isOperationAllowedOn("key", "hoge"); + assertTrue(ret); + } + + @Test + public void testEqualsSameObject() { + AllowedOperation op1 = new AllowedOperation(); + boolean ret = op1.equals(op1); + assertTrue(ret); + } + + @Test + public void testEqualsObjctIsNull() { + AllowedOperation op1 = new AllowedOperation(); + Object obj = null; + boolean ret = op1.equals(obj); + assertFalse(ret); + } + + @Test + public void testEqualsDifferentClass() { + AllowedOperation op1 = new AllowedOperation(); + String str = "fuga"; + boolean ret = op1.equals(str); + assertFalse(ret); + } + + @Test + public void testEqualsNameIsNull() { + AllowedOperation op1 = new AllowedOperation(); + AllowedOperation op2 = new AllowedOperation(); + op2.setName("AllowedOperation2"); + + boolean ret = op1.equals(op2); + assertFalse(ret); + } + + @Test + public void testEqualsBothNameIsNull() { + AllowedOperation op1 = new AllowedOperation(); + AllowedOperation op2 = new AllowedOperation(); + + boolean ret = op1.equals(op2); + assertTrue(ret); + } + + @Test + public void testEqualsSameName() { + AllowedOperation op1 = new AllowedOperation(); + op1.setName("AllowedOperation1"); + AllowedOperation op2 = new AllowedOperation(); + op2.setName("AllowedOperation1"); + boolean ret = op1.equals(op2); + assertTrue(ret); + } + + @Test + public void testEqualsDifferentName() { + AllowedOperation op1 = new AllowedOperation(); + op1.setName("AllowedOperation1"); + AllowedOperation op2 = new AllowedOperation(); + op2.setName("AllowedOperation2"); + boolean ret = op1.equals(op2); + assertFalse(ret); + } + + @SuppressWarnings("serial") + @Test + public void testEqualsSameHashCode() { + AllowedOperation op1 = new AllowedOperation(); + Set item1 = new HashSet() { + { + add("hoge"); + } + }; + Map> items1 = new HashMap>() { + { + put("key", item1); + } + }; + op1.setItems(items1); + + AllowedOperation op2 = new AllowedOperation(); + Set item2 = new HashSet() { + { + add("hoge"); + } + }; + Map> items2 = new HashMap>() { + { + put("key", item2); + } + }; + op2.setItems(items2); + + assertEquals(op1.hashCode(), op2.hashCode()); + } + + @SuppressWarnings("serial") + @Test + public void testEqualsDifferentHashCode() { + AllowedOperation op1 = new AllowedOperation(); + Set item1 = new HashSet() { + { + add("hoge"); + } + }; + Map> items1 = new HashMap>() { + { + put("key", item1); + } + }; + op1.setItems(items1); + + AllowedOperation op2 = new AllowedOperation(); + Set item2 = new HashSet() { + { + add("fuga"); + } + }; + Map> items2 = new HashMap>() { + { + put("key", item2); + } + }; + op2.setItems(items2); + + assertNotEquals(op1.hashCode(), op2.hashCode()); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/config/AuthorizedServicesTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/config/AuthorizedServicesTest.java new file mode 100644 index 00000000000..775ea1ae6d3 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/config/AuthorizedServicesTest.java @@ -0,0 +1,50 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.config; + +import static org.testng.Assert.assertTrue; +import java.util.HashMap; + +import org.mockito.Mockito; +import org.testng.annotations.Test; + +public class AuthorizedServicesTest { + + @Test + public void testGetServices() { + AuthorizedServices authorizedService = new AuthorizedServices(); + authorizedService.getServices(); + } + + @Test + public void testSetTemplates() { + AuthorizedServices authorizedService = new AuthorizedServices(); + @SuppressWarnings("unchecked") + HashMap authorizedServiceHash = Mockito.mock(HashMap.class); + authorizedService.setTemplates(authorizedServiceHash); + } + + @Test + public void testName() { + AuthorizedServices authorizedService = new AuthorizedServices(); + try { + authorizedService.names(); + } catch (Exception ex) { + assertTrue(true); + } + } + +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/config/SolutionTemplatesTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/config/SolutionTemplatesTest.java new file mode 100644 index 00000000000..33f36d3de3a --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/config/SolutionTemplatesTest.java @@ -0,0 +1,31 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.config; + +import java.util.HashMap; +import org.testng.annotations.Test; +import com.yahoo.athenz.zms.Template; +import static org.testng.Assert.assertNull; + +public class SolutionTemplatesTest { + + @Test + public void testGetTemplates() { + SolutionTemplates solution = new SolutionTemplates(); + HashMap templates = solution.getTemplates(); + assertNull(templates); + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/pkey/PrivateKeyStoreTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/pkey/PrivateKeyStoreTest.java new file mode 100644 index 00000000000..25d75025205 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/pkey/PrivateKeyStoreTest.java @@ -0,0 +1,42 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.pkey; + +import static org.testng.Assert.*; + +import java.security.PrivateKey; + +import org.testng.annotations.Test; + +public class PrivateKeyStoreTest { + + public class PrivateKeyStoreInstance implements PrivateKeyStore { + + @Test + public void testGetPrivateKeyMulti() { + PrivateKeyStoreInstance keystore = new PrivateKeyStoreInstance(); + StringBuilder sb = new StringBuilder(); + PrivateKey key = keystore.getPrivateKey(sb); + assertNull(key); + } + + @Test + public void testGetPEMPublicKey() { + PrivateKeyStoreInstance keystore = new PrivateKeyStoreInstance(); + assertNull(keystore.getPEMPublicKey()); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStoreTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStoreTest.java new file mode 100644 index 00000000000..0cdf34204ee --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/pkey/file/FilePrivateKeyStoreTest.java @@ -0,0 +1,138 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.pkey.file; + +import static org.testng.Assert.*; + +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.security.PrivateKey; + +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.ZMSConsts; +import com.yahoo.athenz.zms.pkey.PrivateKeyStore; +import com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStore; +import com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory; + +public class FilePrivateKeyStoreTest { + + @BeforeClass + public void setUp() throws Exception { + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY_STORE_CLASS, "com.yahoo.athenz.zms.pkey.file.FilePrivateKeyStoreFactory"); + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, "src/test/resources/zms_private.pem"); + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, "src/test/resources/zms_public.pem"); + } + + @Test + public void testCreateStore() { + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + assertNotNull(store); + } + + @Test + public void testRetrievePublicKeyValid() { + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + String saveProp = System.getProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY); + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, "src/test/resources/zms_public.pem"); + + String pubKey = store.getPEMPublicKey(); + assertNotNull(pubKey); + + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, saveProp); + } + + @Test + public void testRetrievePublicKeyInValid() { + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + String saveProp = System.getProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY); + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, "src/test/resources/invalid_zms_public.pem"); + + try { + store.getPEMPublicKey(); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + System.setProperty(ZMSConsts.ZMS_PROP_PUBLIC_KEY, saveProp); + } + + @Test + public void testRetrievePrivateKeyValid() { + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + String saveProp = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY); + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, "src/test/resources/zms_private.pem"); + + StringBuilder keyId = new StringBuilder(256); + PrivateKey privKey = store.getPrivateKey(keyId); + assertNotNull(privKey); + + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, saveProp); + } + + @Test + public void testRetrievePrivateKeyInValid() { + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + String saveProp = System.getProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY); + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, "src/test/resources/invalid_zms_private.pem"); + + try { + StringBuilder keyId = new StringBuilder(256); + store.getPrivateKey(keyId); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + System.setProperty(ZMSConsts.ZMS_PROP_PRIVATE_KEY, saveProp); + } + + @Test + public void testGetStringNullStream() throws IOException { + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + FilePrivateKeyStore store = (FilePrivateKeyStore) factory.create("localhost"); + assertNull(store.getString(null)); + } + + @Test + public void testGetString() throws IOException { + String str = "This is a Unit Test String"; + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + FilePrivateKeyStore store = (FilePrivateKeyStore) factory.create("localhost"); + try (InputStream is = new ByteArrayInputStream(str.getBytes("UTF-8"))) { + String getStr = store.getString(is); + assertEquals(getStr, str); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/store/file/FileConnectionTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/file/FileConnectionTest.java new file mode 100644 index 00000000000..2060379b255 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/file/FileConnectionTest.java @@ -0,0 +1,514 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.file; + +import static org.testng.Assert.*; +import java.io.File; +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.Domain; +import com.yahoo.athenz.zms.Entity; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; + +public class FileConnectionTest { + + @Test + public void testGetDomainModTimestamp() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + fileconnection.getDomainModTimestamp("DummyDomain1"); + } + } + + @Test + public void testUpdateDomain() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + Domain domMock = Mockito.mock(Domain.class); + Mockito.when(domMock.getName()).thenReturn("domain1"); + Mockito.when(fileconnection.getDomainStruct("domain1")).thenReturn(null); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testRemovePublicKeyEntry() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + assertFalse(fileconnection.removePublicKeyEntry(null, "12")); + } + } + + @Test + public void testLookupDomainByRole() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.lookupDomainByRole("member1", "role1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testValidatePrincipalDomain() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.validatePrincipalDomain("principal"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdateDomainModTimestamp() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.updateDomainModTimestamp("DummyDomain1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testInsertDomainTemplate() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.insertDomainTemplate("DummyDomain1", "Template1", "param"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeleteDomainTemplate() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deleteDomainTemplate("DummyDomain1", "Template1", "param"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testListEntities() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.listEntities("DummyDomain1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testListRoleMembers() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.listRoleMembers("DummyDomain1", "Role1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testInsertRoleMember() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.insertRoleMember("DummyDomain1", "Role1", "principal1", "audit1", "zmsjcltest"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdatePolicy() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + Policy policy = new Policy(); + try { + fileconnection.updatePolicy("Domain1", policy); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeletePolicy() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deletePolicy("Domain1", "policy1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testInsertAssertion() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + Assertion assertion = new Assertion(); + try { + fileconnection.insertAssertion("Domain1", "policy1", assertion); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testListAssertions() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.listAssertions("Domain1", "Policy1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdateServiceIdentity() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + ServiceIdentity service1 = new ServiceIdentity(); + try { + fileconnection.updateServiceIdentity("Domain1", service1); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeleteServiceIdentity() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deleteServiceIdentity("Domain1", "service1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testListPublicKeys() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.listPublicKeys("Domain1", "service1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testListServiceHosts() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.listPublicKeys("Domain1", "service1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testInsertServiceHost() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.insertServiceHost("Domain1", "service1", "athenz.zms.client.zms_url"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeleteServiceHost() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deleteServiceHost("Domain1", "service1", "athenz.zms.client.zms_url"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdateEntity() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + Entity entity1 = new Entity(); + try { + fileconnection.updateEntity("Domain1", entity1); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeleteEntity() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deleteEntity("Domain1", "entity1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDelete() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + fileconnection.delete("zms"); + } + } + + @Test + public void testListResourceAccess() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.listResourceAccess("principal1", "UPDATE", "UserDomain1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdatePolicyModTimestamp() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.updatePolicyModTimestamp("domain1", "policy1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdateRole() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + Role role = new Role(); + try { + fileconnection.updateRole("domain1", role); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdateRoleModTimestamp() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.updateRoleModTimestamp("domain1", "role1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeleteRole() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deleteRole("domain1", "role1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testListServiceHostsList() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.listServiceHosts("domain1", "service1"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testGetRoleObject() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + DomainStruct domain = new DomainStruct(); + fileconnection.getRoleObject(domain, "role1"); + } + } + + @Test + public void testGetPolicyObject() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + DomainStruct domain = new DomainStruct(); + fileconnection.getPolicyObject(domain, "role1"); + } + } + + @Test + public void testDeleteRoleMember() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deleteRoleMember("domain1", "role1", "principal", "admin", "zmsjcltest"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testGetAssertion() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + long assertid = 33456; + try { + fileconnection.getAssertion("domain1", "policy1", assertid); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeleteAssertion() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + long assertid = 33456; + try { + fileconnection.deleteAssertion("domain1", "policy1", assertid); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testDeletePublicKeyEntry() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + try { + fileconnection.deletePublicKeyEntry("domain1", "service1", "223"); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testUpdatePublicKeyEntry() { + File file = new File("/home/athenz/"); + try (FileConnection fileconnection = new FileConnection(file)) { + PublicKeyEntry keyEntry = new PublicKeyEntry(); + try { + fileconnection.updatePublicKeyEntry("domain1", "service1", keyEntry); + } catch (Exception ex) { + assertTrue(true); + } + } + } + + @Test + public void testAssertionMatch() { + File file = new File("/home/athenz/"); + Assertion assertion1 = new Assertion(); + assertion1.setAction("UPDATE").setResource("resource").setRole("zmsRole"); + Assertion assertion2 = new Assertion(); + assertion2.setAction("UPDATE").setResource("resource").setRole("zmsRole"); + try (FileConnection fileconnection = new FileConnection(file)) { + assertTrue(fileconnection.assertionMatch(assertion1, assertion2)); + + Assertion assertion3 = new Assertion(); + assertion3.setAction("UPDATE").setResource("resource").setRole("zmsRole"); + Assertion assertion4 = new Assertion(); + assertion4.setAction("Delete").setResource("resource").setRole("zmsRole"); + assertFalse(fileconnection.assertionMatch(assertion3, assertion4)); + + Assertion assertion5 = new Assertion(); + assertion5.setAction("UPDATE").setResource("resource1").setRole("zmsRole"); + Assertion assertion6 = new Assertion(); + assertion6.setAction("UPDATE").setResource("resource2").setRole("zmsRole"); + assertFalse(fileconnection.assertionMatch(assertion5, assertion6)); + + Assertion assertion7 = new Assertion(); + assertion7.setAction("UPDATE").setResource("resource").setRole("zmsRole1"); + Assertion assertion8 = new Assertion(); + assertion8.setAction("UPDATE").setResource("resource").setRole("zmsRole2"); + assertFalse(fileconnection.assertionMatch(assertion7, assertion8)); + + Assertion assertion9 = new Assertion(); + AssertionEffect effect1 = AssertionEffect.ALLOW; + assertion9.setAction("UPDATE").setResource("resource").setRole("zmsRole").setEffect(effect1); + Assertion assertion10 = new Assertion(); + assertion10.setAction("UPDATE").setResource("resource").setRole("zmsRole").setEffect(effect1); + assertTrue(fileconnection.assertionMatch(assertion9, assertion10)); + + Assertion assertion11 = new Assertion(); + AssertionEffect effect2 = AssertionEffect.ALLOW; + AssertionEffect effect3 = AssertionEffect.DENY; + assertion11.setAction("UPDATE").setResource("resource").setRole("zmsRole").setEffect(effect2); + Assertion assertion12 = new Assertion(); + assertion12.setAction("UPDATE").setResource("resource").setRole("zmsRole").setEffect(effect3); + assertFalse(fileconnection.assertionMatch(assertion11, assertion12)); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/store/file/FileObjectStoreTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/file/FileObjectStoreTest.java new file mode 100644 index 00000000000..afcaea0dee7 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/file/FileObjectStoreTest.java @@ -0,0 +1,49 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.file; + +import static org.testng.Assert.*; +import java.io.File; + +import org.testng.annotations.Test; + +public class FileObjectStoreTest { + @Test + public void testError() { + try { + FileObjectStore.error("Not Found"); + } catch (RuntimeException ex) { + assertTrue(true); + } + } + + @Test + public void TestFileObjectStore() { + File file = new File("/home/athenz/"); + File file2 = new File("/home/hoge.txt"); + try { + new FileObjectStore(file); + } catch (Exception ex) { + assertTrue(true); + } + + try { + new FileObjectStore(file2); + } catch (Exception ex) { + assertTrue(true); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/DataSourceFactoryTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/DataSourceFactoryTest.java new file mode 100644 index 00000000000..cb729fac783 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/DataSourceFactoryTest.java @@ -0,0 +1,320 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import static org.testng.Assert.*; + +import java.io.PrintWriter; + +import org.apache.commons.pool2.impl.BaseObjectPoolConfig; +import org.apache.commons.pool2.impl.GenericObjectPoolConfig; +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.MockConnectionFactory; +import com.yahoo.athenz.zms.store.jdbc.DataSourceFactory; +import com.yahoo.athenz.zms.store.jdbc.DataSourceFactory.SimpleDataSource; +import com.yahoo.athenz.zms.store.jdbc.PoolableDataSource; + + +public class DataSourceFactoryTest { + + static final String ZMS_DBPOOL_PROP1 = "athenz.zms.db_pool_test_prop"; + + @Test + public void testCrateDataSourceWithMysqlUrl() { + + PoolableDataSource src = DataSourceFactory.create("jdbc:mysql:localhost:3306/athenz"); + assertNotNull(src); + } + + @Test + public void testCrateDataSourceWithSQLiteUrl() { + + PoolableDataSource src = DataSourceFactory.create("jdbc:sqlite:localhost:3306/athenz"); + assertNotNull(src); + } + + @Test + public void testCreateDataSourceWithUnknownUrl() { + + try { + DataSourceFactory.create("jdbc:tdb:localhost:11080"); + fail(); + } catch (RuntimeException ex) { + assertTrue(true); + } + } + + @Test + public void testCreateDataSourceWithFactory() { + + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TTL, "10000"); + + MockConnectionFactory connectionFactory = new MockConnectionFactory(); + PoolableDataSource src = DataSourceFactory.create(connectionFactory); + assertNotNull(src); + + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TTL); + } + + @Test + public void testCreateDataSourceWithFactoryInvalidTTL() { + + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TTL, "abc"); + + // we ignore the invalid ttl and everything else should work fine + + MockConnectionFactory connectionFactory = new MockConnectionFactory(); + PoolableDataSource src = DataSourceFactory.create(connectionFactory); + assertNotNull(src); + + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TTL); + } + + @Test + public void testPoolConfigDefaultValues() { + + GenericObjectPoolConfig config = DataSourceFactory.setupPoolConfig(); + assertNotNull(config); + assertEquals(config.getMaxTotal(), GenericObjectPoolConfig.DEFAULT_MAX_TOTAL); + assertEquals(config.getMaxIdle(), GenericObjectPoolConfig.DEFAULT_MAX_IDLE); + assertEquals(config.getMinIdle(), GenericObjectPoolConfig.DEFAULT_MIN_IDLE); + assertEquals(config.getMaxWaitMillis(), GenericObjectPoolConfig.DEFAULT_MAX_WAIT_MILLIS); + assertEquals(config.getMinEvictableIdleTimeMillis(), BaseObjectPoolConfig.DEFAULT_MIN_EVICTABLE_IDLE_TIME_MILLIS); + assertEquals(config.getTimeBetweenEvictionRunsMillis(), BaseObjectPoolConfig.DEFAULT_MIN_EVICTABLE_IDLE_TIME_MILLIS); + assertTrue(config.getTestWhileIdle()); + assertTrue(config.getTestOnBorrow()); + } + + @Test + public void testPoolConfigSpecifiedValues() { + + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TOTAL, "10"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_IDLE, "20"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MIN_IDLE, "30"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_WAIT, "40"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT, "50"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL, "60"); + + GenericObjectPoolConfig config = DataSourceFactory.setupPoolConfig(); + assertNotNull(config); + assertEquals(config.getMaxTotal(), 10); + assertEquals(config.getMaxIdle(), 20); + assertEquals(config.getMinIdle(), 30); + assertEquals(config.getMaxWaitMillis(), 40); + assertEquals(config.getMinEvictableIdleTimeMillis(), 50); + assertEquals(config.getTimeBetweenEvictionRunsMillis(), 60); + assertTrue(config.getTestWhileIdle()); + assertTrue(config.getTestOnBorrow()); + + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TOTAL); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_IDLE); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MIN_IDLE); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_WAIT); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL); + } + + @Test + public void testPoolConfigInvalidValues() { + + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TOTAL, "a"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_IDLE, "b"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MIN_IDLE, "c"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_WAIT, "d"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT, "e"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL, "f"); + + GenericObjectPoolConfig config = DataSourceFactory.setupPoolConfig(); + assertNotNull(config); + + assertEquals(config.getMaxTotal(), GenericObjectPoolConfig.DEFAULT_MAX_TOTAL); + assertEquals(config.getMaxIdle(), GenericObjectPoolConfig.DEFAULT_MAX_IDLE); + assertEquals(config.getMinIdle(), GenericObjectPoolConfig.DEFAULT_MIN_IDLE); + assertEquals(config.getMaxWaitMillis(), GenericObjectPoolConfig.DEFAULT_MAX_WAIT_MILLIS); + assertEquals(config.getMinEvictableIdleTimeMillis(), BaseObjectPoolConfig.DEFAULT_MIN_EVICTABLE_IDLE_TIME_MILLIS); + assertEquals(config.getTimeBetweenEvictionRunsMillis(), BaseObjectPoolConfig.DEFAULT_MIN_EVICTABLE_IDLE_TIME_MILLIS); + assertTrue(config.getTestWhileIdle()); + assertTrue(config.getTestOnBorrow()); + + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TOTAL); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_IDLE); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MIN_IDLE); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_WAIT); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL); + } + + @Test + public void testPoolConfigZeroValues() { + + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TOTAL, "0"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_IDLE, "0"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MIN_IDLE, "0"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_WAIT, "0"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT, "0"); + System.setProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL, "0"); + + GenericObjectPoolConfig config = DataSourceFactory.setupPoolConfig(); + assertNotNull(config); + + // MaxTotal and MaxIdle are set to -1 if the value is 0 + assertEquals(config.getMaxTotal(), -1); + assertEquals(config.getMaxIdle(), -1); + assertEquals(config.getMinIdle(), 0); + assertEquals(config.getMaxWaitMillis(), 0); + assertEquals(config.getMinEvictableIdleTimeMillis(), 0); + assertEquals(config.getTimeBetweenEvictionRunsMillis(), 0); + assertTrue(config.getTestWhileIdle()); + assertTrue(config.getTestOnBorrow()); + + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_TOTAL); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_IDLE); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MIN_IDLE); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_MAX_WAIT); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_TIMEOUT); + System.clearProperty(DataSourceFactory.ZMS_PROP_DBPOOL_EVICT_IDLE_INTERVAL); + } + + @Test + public void testRetrieveConfigSettingLong() { + + System.setProperty(ZMS_DBPOOL_PROP1, "100"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20L), 100L); + + System.setProperty(ZMS_DBPOOL_PROP1, "0"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20L), 0); + + System.setProperty(ZMS_DBPOOL_PROP1, "-100"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20L), -100L); + + System.clearProperty(ZMS_DBPOOL_PROP1); + } + + @Test + public void testRetrieveConfigSettingLongNull() { + System.clearProperty(ZMS_DBPOOL_PROP1); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 25L), 25L); + } + + @Test + public void testRetrieveConfigSettingLongInvalid() { + System.setProperty(ZMS_DBPOOL_PROP1, "abc"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20L), 20L); + System.clearProperty(ZMS_DBPOOL_PROP1); + } + + @Test + public void testRetrieveConfigSettingInt() { + + System.setProperty(ZMS_DBPOOL_PROP1, "100"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20), 100); + + System.setProperty(ZMS_DBPOOL_PROP1, "0"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20), 0); + + System.setProperty(ZMS_DBPOOL_PROP1, "-100"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20), -100); + + System.clearProperty(ZMS_DBPOOL_PROP1); + } + + @Test + public void testRetrieveConfigSettingIntNull() { + System.clearProperty(ZMS_DBPOOL_PROP1); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 25), 25); + } + + @Test + public void testRetrieveConfigSettingIntInvalid() { + System.setProperty(ZMS_DBPOOL_PROP1, "abc"); + assertEquals(DataSourceFactory.retrieveConfigSetting(ZMS_DBPOOL_PROP1, 20), 20); + System.clearProperty(ZMS_DBPOOL_PROP1); + } + + @Test + public void testGetConnection() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + assertEquals(dataSource.getLoginTimeout(), 0); + } + + @Test + public void testSetLoginTimeout() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + dataSource.setLoginTimeout(30); + } + + @Test + public void testSetLogWriter() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + PrintWriter writer = Mockito.mock(PrintWriter.class); + dataSource.setLogWriter(writer); + } + + @Test + public void testGetLogWriter() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + dataSource.getLogWriter(); + } + + @Test + public void testConnectionGetConnection() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + try { + dataSource.getConnection(); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + try { + dataSource.getConnection("user1", "pass1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + + } + + @Test + public void testGetParentLogger() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + try { + dataSource.getParentLogger(); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + } + + @Test + public void testIsWrapperFor() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + assertFalse(dataSource.isWrapperFor(String.class)); + } + + @Test + public void testUnwrap() { + SimpleDataSource dataSource = new SimpleDataSource("zmsclass", "localhost:3306/athenz"); + try { + dataSource.unwrap(String.class); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/JDBCConnectionTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/JDBCConnectionTest.java new file mode 100644 index 00000000000..256366611f1 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/JDBCConnectionTest.java @@ -0,0 +1,5263 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.Domain; +import com.yahoo.athenz.zms.DomainModified; +import com.yahoo.athenz.zms.DomainModifiedList; +import com.yahoo.athenz.zms.Entity; +import com.yahoo.athenz.zms.Membership; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.ResourceAccess; +import com.yahoo.athenz.zms.ResourceAccessList; +import com.yahoo.athenz.zms.ResourceException; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.RoleAuditLog; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zms.ZMSConsts; +import com.yahoo.athenz.zms.store.AthenzDomain; +import com.yahoo.athenz.zms.store.jdbc.JDBCConnection; +import com.yahoo.athenz.zms.store.jdbc.JDBCObjectStore; +import com.yahoo.athenz.zms.store.jdbc.PoolableDataSource; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.UUID; + +import java.sql.Connection; +import java.sql.SQLException; +import java.sql.Statement; +import java.util.ArrayList; +import java.util.Calendar; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.sql.PreparedStatement; +import java.sql.ResultSet; + +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.mockito.Matchers; + +import static org.mockito.Mockito.times; + +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +import junit.framework.TestCase; + +public class JDBCConnectionTest extends TestCase { + + @Mock PoolableDataSource mockDataSrc; + @Mock Statement mockStmt; + @Mock PreparedStatement mockPrepStmt; + @Mock Connection mockConn; + @Mock ResultSet mockResultSet; + @Mock JDBCConnection mockJDBCConn; + + JDBCObjectStore strStore; + String domainData; + String domainChangedData; + + @BeforeClass + public void setUp() throws Exception { + MockitoAnnotations.initMocks(this); + Mockito.doReturn(mockConn).when(mockDataSrc).getConnection(); + Mockito.doReturn(mockStmt).when(mockConn).createStatement(); + Mockito.doReturn(mockResultSet).when(mockStmt).executeQuery(Matchers.isA(String.class)); + Mockito.doReturn(true).when(mockStmt).execute(Matchers.isA(String.class)); + Mockito.doReturn(mockPrepStmt).when(mockConn).prepareStatement(Matchers.isA(String.class)); + Mockito.doReturn(mockResultSet).when(mockPrepStmt).executeQuery(); + } + + @Test + public void testGetDomain() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("my-domain").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_NAME); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + Mockito.doReturn(true).when(mockResultSet).getBoolean(ZMSConsts.DB_COLUMN_ENABLED); + Mockito.doReturn(false).when(mockResultSet).getBoolean(ZMSConsts.DB_COLUMN_AUDIT_ENABLED); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_DESCRIPTION); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_ORG); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_UUID); + Mockito.doReturn("12345").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_ACCOUNT); + Mockito.doReturn(1001).when(mockResultSet).getInt(ZMSConsts.DB_COLUMN_PRODUCT_ID); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Domain domain = jdbcConn.getDomain("my-domain"); + assertNotNull(domain); + assertEquals("my-domain", domain.getName()); + assertTrue(domain.getEnabled()); + assertFalse(domain.getAuditEnabled()); + assertNull(domain.getDescription()); + assertNull(domain.getOrg()); + assertNull(domain.getId()); + jdbcConn.close(); + } + + @Test + public void testGetDomainNotFound() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Domain domain = jdbcConn.getDomain("my-domain"); + assertNull(domain); + jdbcConn.close(); + } + + @Test + public void testGetDomainId() throws Exception { + + // first time success from mysql, second time failure so + // we can verify we get the value from our cache + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn(7).when(mockResultSet).getInt(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(7, jdbcConn.getDomainId(mockConn, "my-domain")); + assertEquals(7, jdbcConn.getDomainId(mockConn, "my-domain")); + + jdbcConn.close(); + } + + @Test + public void testGetDomainIdException() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getDomainId(mockConn, "my-domain"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetRoleId() throws Exception { + + // first time success from mysql, second time failure so + // we can verify we get the value from our cache + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn(9).when(mockResultSet).getInt(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(9, jdbcConn.getRoleId(mockConn, 7, "role1")); + assertEquals(9, jdbcConn.getRoleId(mockConn, 7, "role1")); + + jdbcConn.close(); + } + + @Test + public void testGetRoleIdException() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getRoleId(mockConn, 3, "role1"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetPrincipalId() throws Exception { + + // first time success from mysql, second time failure so + // we can verify we get the value from our cache + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn(7).when(mockResultSet).getInt(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(7, jdbcConn.getPrincipalId(mockConn, "my-domain.user1")); + assertEquals(7, jdbcConn.getPrincipalId(mockConn, "my-domain.user1")); + + jdbcConn.close(); + } + + @Test + public void testGetPrincipalIdException() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getPrincipalId(mockConn, "domain.user1"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetLastInsertIdFailure() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.next()).thenReturn(false); + + assertEquals(0, jdbcConn.getLastInsertId(mockConn)); + jdbcConn.close(); + } + + @Test + public void testGetLastInsertIdException() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getLastInsertId(mockConn); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetPolicyId() throws Exception { + + // first time success from mysql, second time failure so + // we can verify we get the value from our cache + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn(9).when(mockResultSet).getInt(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(9, jdbcConn.getPolicyId(mockConn, 7, "policy1")); + assertEquals(9, jdbcConn.getPolicyId(mockConn, 7, "policy1")); + + jdbcConn.close(); + } + + @Test + public void testGetPolicyIdException() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getPolicyId(mockConn, 3, "policy1"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetServiceId() throws Exception { + + // first time success from mysql, second time failure so + // we can verify we get the value from our cache + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn(9).when(mockResultSet).getInt(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(9, jdbcConn.getServiceId(mockConn, 7, "service1")); + assertEquals(9, jdbcConn.getServiceId(mockConn, 7, "service1")); + + jdbcConn.close(); + } + + @Test + public void testGetServiceIdException() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getServiceId(mockConn, 3, "service1"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetHostId() throws Exception { + + // first time success from mysql, second time failure so + // we can verify we get the value from our cache + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn(9).when(mockResultSet).getInt(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(9, jdbcConn.getHostId(mockConn, "host1")); + assertEquals(9, jdbcConn.getHostId(mockConn, "host1")); + + jdbcConn.close(); + } + + @Test + public void testGetHostIdException() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getHostId(mockConn, "host1"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetDomainAllFields() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("my-domain").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_NAME); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + Mockito.doReturn(true).when(mockResultSet).getBoolean(ZMSConsts.DB_COLUMN_ENABLED); + Mockito.doReturn(true).when(mockResultSet).getBoolean(ZMSConsts.DB_COLUMN_AUDIT_ENABLED); + Mockito.doReturn("my own domain").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_DESCRIPTION); + Mockito.doReturn("cloud_services").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_ORG); + Mockito.doReturn("e5e97240-e94e-11e4-8163-6d083f3f473f").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_UUID); + Mockito.doReturn("12345").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_ACCOUNT); + Mockito.doReturn(1001).when(mockResultSet).getInt(ZMSConsts.DB_COLUMN_PRODUCT_ID); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Domain domain = jdbcConn.getDomain("my-domain"); + assertNotNull(domain); + assertEquals("my-domain", domain.getName()); + assertTrue(domain.getEnabled()); + assertTrue(domain.getAuditEnabled()); + assertEquals("my own domain", domain.getDescription()); + assertEquals("cloud_services", domain.getOrg()); + assertEquals(UUID.fromString("e5e97240-e94e-11e4-8163-6d083f3f473f"), domain.getId()); + jdbcConn.close(); + } + + @Test + public void testGetDomainException() throws Exception { + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + try { + jdbcConn.getDomain("my-domain"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Domain domain = new Domain().setName("my-domain") + .setEnabled(true) + .setAuditEnabled(false) + .setDescription("my domain") + .setId(UUID.fromString("e5e97240-e94e-11e4-8163-6d083f3f473f")) + .setOrg("cloud_services"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.insertDomain(domain); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "my domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "cloud_services"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "e5e97240-e94e-11e4-8163-6d083f3f473f"); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(5, true); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(6, false); + Mockito.verify(mockPrepStmt, times(1)).setString(7, ""); + Mockito.verify(mockPrepStmt, times(1)).setInt(8, 0); + jdbcConn.close(); + } + + @Test + public void testInsertDomainWithAccountInfo() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Domain domain = new Domain().setName("my-domain") + .setEnabled(true) + .setAuditEnabled(false) + .setDescription("my domain") + .setId(UUID.fromString("e5e97240-e94e-11e4-8163-6d083f3f473f")) + .setOrg("cloud_services") + .setAccount("123456789") + .setYpmId(Integer.valueOf(1011)); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.insertDomain(domain); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "my domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "cloud_services"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "e5e97240-e94e-11e4-8163-6d083f3f473f"); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(5, true); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(6, false); + Mockito.verify(mockPrepStmt, times(1)).setString(7, "123456789"); + Mockito.verify(mockPrepStmt, times(1)).setInt(8, 1011); + jdbcConn.close(); + } + + @Test + public void testInsertDomainNullFields() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Domain domain = new Domain().setName("my-domain") + .setEnabled(true) + .setAuditEnabled(false); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.insertDomain(domain); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(3, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(4, ""); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(5, true); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(6, false); + jdbcConn.close(); + } + + @Test + public void testInsertDomainException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Domain domain = new Domain().setName("my-domain") + .setEnabled(true) + .setAuditEnabled(false) + .setDescription("my domain") + .setId(UUID.fromString("e5e97240-e94e-11e4-8163-6d083f3f473f")) + .setOrg("cloud_services"); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertDomain(domain); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Domain domain = new Domain().setName("my-domain") + .setEnabled(true) + .setAuditEnabled(false) + .setDescription("my domain") + .setId(UUID.fromString("e5e97240-e94e-11e4-8163-6d083f3f473f")) + .setOrg("cloud_services") + .setAccount("123456789") + .setYpmId(Integer.valueOf(1011)); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.updateDomain(domain); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "cloud_services"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "e5e97240-e94e-11e4-8163-6d083f3f473f"); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(4, true); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(5, false); + Mockito.verify(mockPrepStmt, times(1)).setString(6, "123456789"); + Mockito.verify(mockPrepStmt, times(1)).setInt(7, 1011); + Mockito.verify(mockPrepStmt, times(1)).setString(8, "my-domain"); + jdbcConn.close(); + } + + @Test + public void testUpdateDomainNullFields() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Domain domain = new Domain().setName("my-domain") + .setEnabled(true) + .setAuditEnabled(false); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.updateDomain(domain); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(2, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(3, ""); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(4, true); + Mockito.verify(mockPrepStmt, times(1)).setBoolean(5, false); + Mockito.verify(mockPrepStmt, times(1)).setString(6, ""); + Mockito.verify(mockPrepStmt, times(1)).setInt(7, 0); + Mockito.verify(mockPrepStmt, times(1)).setString(8, "my-domain"); + jdbcConn.close(); + } + + @Test + public void testUpdateDomainException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Domain domain = new Domain().setName("my-domain") + .setEnabled(true) + .setAuditEnabled(false) + .setDescription("my domain") + .setId(UUID.fromString("e5e97240-e94e-11e4-8163-6d083f3f473f")) + .setOrg("cloud_services"); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updateDomain(domain); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.deleteDomain("my-domain"); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + jdbcConn.close(); + } + + @Test + public void testUpdateDomainModTimestampSuccess() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.updateDomainModTimestamp("my-domain"); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + jdbcConn.close(); + } + + @Test + public void testUpdateDomainModTimestampFailure() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(0).when(mockPrepStmt).executeUpdate(); + boolean requestSuccess = jdbcConn.updateDomainModTimestamp("my-domain"); + assertFalse(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + jdbcConn.close(); + } + + @Test + public void testUpdateDomainModTimestampException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updateDomainModTimestamp("my-domain"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteDomainException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.deleteDomain("my-domain"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListDomains() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("zdomain") + .thenReturn("adomain") + .thenReturn("bdomain"); + + List domains = jdbcConn.listDomains(null, 0); + + // data back is sorted + + assertEquals(3, domains.size()); + assertEquals("adomain", domains.get(0)); + assertEquals("bdomain", domains.get(1)); + assertEquals("zdomain", domains.get(2)); + jdbcConn.close(); + } + + @Test + public void testListDomainsException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.listDomains(null, 0); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetDomainModTimestampSuccess() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + long modTime = jdbcConn.getDomainModTimestamp("my-domain"); + assertEquals(1454358916, modTime); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + jdbcConn.close(); + } + + @Test + public void testGetDomainModTimestampFailure() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + long modTime = jdbcConn.getDomainModTimestamp("my-domain"); + assertEquals(0, modTime); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + jdbcConn.close(); + } + + @Test + public void testGetDomainModTimestampException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + assertEquals(0, jdbcConn.getDomainModTimestamp("my-domain")); + jdbcConn.close(); + } + + @Test + public void testGetRole() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("role1").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_NAME); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_TRUST); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Role role = jdbcConn.getRole("my-domain", "role1"); + assertNotNull(role); + assertEquals("my-domain:role.role1", role.getName()); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + jdbcConn.close(); + } + + @Test + public void testGetRoleNotFound() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Role role = jdbcConn.getRole("my-domain", "role1"); + assertNull(role); + jdbcConn.close(); + } + + @Test + public void testGetRoleTrust() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("role1").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_NAME); + Mockito.doReturn("trust.domain").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_TRUST); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Role role = jdbcConn.getRole("my-domain", "role1"); + assertNotNull(role); + assertEquals("my-domain:role.role1", role.getName()); + assertEquals("trust.domain", role.getTrust()); + jdbcConn.close(); + } + + @Test + public void testGetRoleException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.getRole("my-domain", "role1"); + fail(); + } catch (ResourceException ex) { + assertEquals(500, ex.getCode()); + } + jdbcConn.close(); + } + + @Test + public void testInsertRole() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.insertRole("my-domain", role); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(1, "role1"); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(3, ""); + jdbcConn.close(); + } + + @Test + public void testInsertRoleInvalidRoleDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain2:role.role1"); + + try { + jdbcConn.insertRole("my-domain", role); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertRoleInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1"); + Mockito.when(mockResultSet.next()).thenReturn(false); // domain id failure + + try { + jdbcConn.insertRole("my-domain", role); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertRoleWithTrust() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1").setTrust("trust_domain"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); // return domain + + boolean requestSuccess = jdbcConn.insertRole("my-domain", role); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(1, "role1"); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "trust_domain"); + jdbcConn.close(); + } + + @Test + public void testInsertRoleException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1"); + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertRole("my-domain", role); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateRole() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5) // return domain id + .thenReturn(4); //role id + + boolean requestSuccess = jdbcConn.updateRole("my-domain", role); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get role id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + // update role + Mockito.verify(mockPrepStmt, times(1)).setString(1, ""); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 4); + jdbcConn.close(); + } + + @Test + public void testUpdateRoleWithTrust() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1").setTrust("trust_domain"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + + boolean requestSuccess = jdbcConn.updateRole("my-domain", role); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get role id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + // update role + Mockito.verify(mockPrepStmt, times(1)).setString(1, "trust_domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 7); + jdbcConn.close(); + } + + @Test + public void testUpdateRoleInvalidRoleDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain2:role.role1"); + + try { + jdbcConn.updateRole("my-domain", role); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateRoleInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1"); + Mockito.when(mockResultSet.next()).thenReturn(false); // domain id failure + + try { + jdbcConn.updateRole("my-domain", role); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateRoleInvalidRoleId() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); // return domain id + + Role role = new Role().setName("my-domain:role.role1"); + + try { + jdbcConn.updateRole("my-domain", role); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateRoleException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Role role = new Role().setName("my-domain:role.role1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updateRole("my-domain", role); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateRoleModTimestampSuccess() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + + boolean requestSuccess = jdbcConn.updateRoleModTimestamp("my-domain", "role1"); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get role id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + // update role time-stamp + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + jdbcConn.close(); + } + + @Test + public void testUpdateRoleModTimestampFailure() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(0).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + + boolean requestSuccess = jdbcConn.updateRoleModTimestamp("my-domain", "role1"); + assertFalse(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get role id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + // update role time-stamp + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + jdbcConn.close(); + } + + @Test + public void testUpdateRoleModTimestampException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updateRoleModTimestamp("my-domain", "role1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteRole() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.deleteRole("my-domain", "role1"); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + jdbcConn.close(); + } + + @Test + public void testDeleteRoleinvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(false); + + try { + jdbcConn.deleteRole("my-domain", "role1"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteRoleException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.deleteRole("my-domain", "role1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListRoles() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(1)) + .thenReturn("zrole") + .thenReturn("arole") + .thenReturn("brole"); + + List roles = jdbcConn.listRoles("my-domain"); + + // data back is sorted + + assertEquals(3, roles.size()); + assertEquals("arole", roles.get(0)); + assertEquals("brole", roles.get(1)); + assertEquals("zrole", roles.get(2)); + jdbcConn.close(); + } + + @Test + public void testListRolesInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + try { + jdbcConn.listRoles("my-domain"); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListRolesException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockResultSet.next()) + .thenReturn(true); // this one is for domain id + + Mockito.when(mockPrepStmt.executeQuery()) + .thenReturn(mockResultSet) + .thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.listRoles("my-domain"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testExtractRoleName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("role1", jdbcConn.extractRoleName("my-domain1", "my-domain1:role.role1")); + assertEquals("role1.role2", jdbcConn.extractRoleName("my-domain1", "my-domain1:role.role1.role2")); + + // invalid roles names + assertNull(jdbcConn.extractRoleName("my-domain1", "my-domain1:role1")); + assertNull(jdbcConn.extractRoleName("my-domain1", "my-domain2:role.role1")); + assertNull(jdbcConn.extractRoleName("my-domain1", "my-domain11:role.role1")); + assertNull(jdbcConn.extractRoleName("my-domain1", ":role.role1")); + assertNull(jdbcConn.extractRoleName("my-domain1", "role1")); + assertNull(jdbcConn.extractRoleName("my-domain1", "role1.role2")); + jdbcConn.close(); + } + + @Test + public void testListRoleMembers() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5).thenReturn(7); // return domain/trust id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for role id + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(1)) + .thenReturn("zdomain.user1") + .thenReturn("adomain.storage") + .thenReturn("bdomain.user2"); + + List roles = jdbcConn.listRoleMembers("my-domain", "role1"); + + // data back is sorted + + assertEquals(3, roles.size()); + assertEquals("adomain.storage", roles.get(0)); + assertEquals("bdomain.user2", roles.get(1)); + assertEquals("zdomain.user1", roles.get(2)); + jdbcConn.close(); + } + + @Test + public void testListRoleMembersInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // invalid domain + + try { + jdbcConn.listRoleMembers("my-domain", "role1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListRoleMembersInvalidRole() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); // return domain id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for role id + + try { + jdbcConn.listRoleMembers("my-domain", "role1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListRoleMembersException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5).thenReturn(7); // return domain id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for role id + + Mockito.when(mockPrepStmt.executeQuery()) + .thenReturn(mockResultSet) + .thenReturn(mockResultSet) + .thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.listRoleMembers("my-domain", "role1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testParseRoleMember() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + StringBuilder domain = new StringBuilder(512); + StringBuilder name = new StringBuilder(512); + assertTrue(jdbcConn.parsePrincipal("user.user", domain, name)); + assertEquals("user", domain.toString()); + assertEquals("user", name.toString()); + + domain.setLength(0); + name.setLength(0); + assertTrue(jdbcConn.parsePrincipal("coretech.storage.service", domain, name)); + assertEquals("coretech.storage", domain.toString()); + assertEquals("service", name.toString()); + + assertFalse(jdbcConn.parsePrincipal(".coretech", domain, name)); + assertFalse(jdbcConn.parsePrincipal("coretech.storage.service.", domain, name)); + assertFalse(jdbcConn.parsePrincipal("service", domain, name)); + assertFalse(jdbcConn.parsePrincipal("", domain, name)); + jdbcConn.close(); + } + + @Test + public void testInsertRoleMember() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // role id + .thenReturn(9); // principal id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for role id + .thenReturn(true); // principal id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "user.user1"); + + // we need additional operation for the audit log + Mockito.verify(mockPrepStmt, times(2)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 9); + + // the rest of the audit log details + + Mockito.verify(mockPrepStmt, times(1)).setString(2, "user.admin"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "user.user1"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "ADD"); + Mockito.verify(mockPrepStmt, times(1)).setString(5, "audit-ref"); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testInsertRoleMemberNewPrincipal() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // role id + .thenReturn(8) // principal domain id + .thenReturn(9); // principal id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for role id + .thenReturn(true) // this one is for valid principal domain + .thenReturn(false) // principal does not exist + .thenReturn(true); // get last id (for new principal) + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "user"); + + // we're going to have 2 sets of operations for principal name + + Mockito.verify(mockPrepStmt, times(2)).setString(1, "user.user1"); + + // we need additional operation for the audit log + Mockito.verify(mockPrepStmt, times(2)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 9); + + // the rest of the audit log details + + Mockito.verify(mockPrepStmt, times(1)).setString(2, "user.admin"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "user.user1"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "ADD"); + Mockito.verify(mockPrepStmt, times(1)).setString(5, "audit-ref"); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testInsertRoleMemberException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // role id + .thenReturn(9) // member domain id + .thenReturn(11); // principal id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for role id + .thenReturn(true) // member domain id + .thenReturn(true); // principal id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.insertRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertRoleMemberNewPrincipalFailure() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // role id + .thenReturn(8) // principal domain id + .thenReturn(9); // principal id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for role id + .thenReturn(true) // this one is for valid principal domain + .thenReturn(false); // principal does not exist + + // principal add returns 0 + + Mockito.doReturn(0).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.insertRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 500); + } + + jdbcConn.close(); + } + + @Test + public void testGetRoleMemberYes() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); // yes a member + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + + Membership membership = jdbcConn.getRoleMember("my-domain", "role1", "user.user1"); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "user.user1"); + + assertEquals(membership.getMemberName(), "user.user1"); + assertEquals(membership.getRoleName(), "my-domain:role.role1"); + assertTrue(membership.getIsMember()); + jdbcConn.close(); + } + + @Test + public void testGetRoleMemberNo() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()) + .thenReturn(true) // domain id + .thenReturn(true) // rold id + .thenReturn(false); // not a member + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + + Membership membership = jdbcConn.getRoleMember("my-domain", "role1", "user.user1"); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "user.user1"); + + assertEquals(membership.getMemberName(), "user.user1"); + assertEquals(membership.getRoleName(), "my-domain:role.role1"); + assertFalse(membership.getIsMember()); + jdbcConn.close(); + } + + @Test + public void testGetRoleMemberInvalidPrincipal() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); // yes a member + + try { + jdbcConn.getRoleMember("my-domain", "role1", "user1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetRoleMemberException() throws Exception { + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + try { + jdbcConn.getRoleMember("my-domain", "role1", "user.user1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteRoleMember() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // role id + .thenReturn(9) // member domain id + .thenReturn(11); // principal id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for role id + .thenReturn(true) // member domain id + .thenReturn(true); // principal id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.deleteRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + assertTrue(requestSuccess); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "user.user1"); + + // we need additional operation for the audit log + Mockito.verify(mockPrepStmt, times(2)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 9); + + // the rest of the audit log details + + Mockito.verify(mockPrepStmt, times(1)).setString(2, "user.admin"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "user.user1"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "DELETE"); + Mockito.verify(mockPrepStmt, times(1)).setString(5, "audit-ref"); + + jdbcConn.close(); + } + + @Test + public void testDeleteRoleMemberInvalidDomain() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.deleteRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteRoleMemberInvalidRole() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for role id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.deleteRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteRoleMemberInvalidPrincipalId() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for role id + .thenReturn(false); // principal id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.deleteRoleMember("my-domain", "role1", "user.user1", + "user.admin", "audit-ref"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetPolicy() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("policy1").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_NAME); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Policy policy = jdbcConn.getPolicy("my-domain", "policy1"); + assertNotNull(policy); + assertEquals("my-domain:policy.policy1", policy.getName()); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + jdbcConn.close(); + } + + @Test + public void testGetPolicyException() throws Exception { + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + try { + jdbcConn.getPolicy("my-domain", "policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertPolicy() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Policy policy = new Policy().setName("my-domain:policy.policy1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.insertPolicy("my-domain", policy); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(1, "policy1"); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 5); + jdbcConn.close(); + } + + @Test + public void testInsertPolicyInvalidName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Policy policy = new Policy().setName("policy1"); + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + try { + jdbcConn.insertPolicy("my-domain", policy); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + jdbcConn.close(); + } + + @Test + public void testInsertPolicyException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Policy policy = new Policy().setName("my-domain:policy.policy1"); + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertPolicy("my-domain", policy); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdatePolicy() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Policy policy = new Policy().setName("my-domain:policy.policy1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5) // return domain id + .thenReturn(4); //policy id + + boolean requestSuccess = jdbcConn.updatePolicy("my-domain", policy); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get policy id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + // update policy + Mockito.verify(mockPrepStmt, times(1)).setString(1, "policy1"); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 4); + jdbcConn.close(); + } + + @Test + public void testUpdatePolicyInvalidName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Policy policy = new Policy().setName("policy1"); + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + try { + jdbcConn.updatePolicy("my-domain", policy); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + jdbcConn.close(); + } + + @Test + public void testUpdatePolicyException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Policy policy = new Policy().setName("my-domain:policy.policy1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updatePolicy("my-domain", policy); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeletePolicy() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.deletePolicy("my-domain", "policy1"); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + jdbcConn.close(); + } + + @Test + public void testDeletePolicyException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.deletePolicy("my-domain", "policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListPolicies() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(1)) + .thenReturn("zpolicy") + .thenReturn("apolicy") + .thenReturn("bpolicy"); + + List policies = jdbcConn.listPolicies("my-domain", null); + + // data back is sorted + + assertEquals(3, policies.size()); + assertEquals("apolicy", policies.get(0)); + assertEquals("bpolicy", policies.get(1)); + assertEquals("zpolicy", policies.get(2)); + jdbcConn.close(); + } + + @Test + public void testExtractPolicyName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("policy1", jdbcConn.extractPolicyName("my-domain1", "my-domain1:policy.policy1")); + assertEquals("policy1.policy2", jdbcConn.extractPolicyName("my-domain1", "my-domain1:policy.policy1.policy2")); + + // invalid policies names + assertNull(jdbcConn.extractPolicyName("my-domain1", "my-domain1:policy1")); + assertNull(jdbcConn.extractPolicyName("my-domain1", "my-domain2:policy.policy1")); + assertNull(jdbcConn.extractPolicyName("my-domain1", "my-domain11:policy.policy1")); + assertNull(jdbcConn.extractPolicyName("my-domain1", ":policy.policy1")); + assertNull(jdbcConn.extractPolicyName("my-domain1", "policy1")); + assertNull(jdbcConn.extractPolicyName("my-domain1", "policy1.policy2")); + jdbcConn.close(); + } + + @Test + public void testSkipAwsUserQuery() throws Exception { + + try (JDBCConnection jdbcConn = new JDBCConnection(mockConn, true)) { + Map map = new HashMap() { + private static final long serialVersionUID = -8689695626417810614L; + { + put("zms", "domain1"); + } + { + put("zms", "domain2"); + } + }; + assertFalse(jdbcConn.skipAwsUserQuery(map, "queryP1", "zms", "zms")); + jdbcConn.skipAwsUserQuery(map, null, "zms", "user"); + } + } + + @Test + public void testInsertAssertion() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Assertion assertion = new Assertion() + .setAction("read") + .setEffect(AssertionEffect.ALLOW) + .setResource("my-domain:*") + .setRole("my-domain:role.role1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // policy id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for policy id + .thenReturn(false); // insertion is not found + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertAssertion("my-domain", "policy1", assertion); + assertTrue(requestSuccess); + + // getting domain and policy ids + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + + // assertion statement - twice once for checking if it exists + // and second time for inserting + + Mockito.verify(mockPrepStmt, times(2)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(2)).setString(2, "role1"); + Mockito.verify(mockPrepStmt, times(2)).setString(3, "my-domain:*"); + Mockito.verify(mockPrepStmt, times(2)).setString(4, "read"); + Mockito.verify(mockPrepStmt, times(2)).setString(5, "ALLOW"); + jdbcConn.close(); + } + + @Test + public void testInsertAssertionDuplicate() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Assertion assertion = new Assertion() + .setAction("read") + .setEffect(AssertionEffect.ALLOW) + .setResource("my-domain:*") + .setRole("my-domain:role.role1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // policy id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for policy id + .thenReturn(true); // insertion is found + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertAssertion("my-domain", "policy1", assertion); + assertTrue(requestSuccess); + + // getting domain and policy ids + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + + // assertion statement + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "role1"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "my-domain:*"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "read"); + Mockito.verify(mockPrepStmt, times(1)).setString(5, "ALLOW"); + jdbcConn.close(); + } + @Test + public void testInsertAssertionInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Assertion assertion = new Assertion() + .setAction("read") + .setEffect(AssertionEffect.ALLOW) + .setResource("my-domain:*") + .setRole("my-domain:role.role1"); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.insertAssertion("my-domain", "policy1", assertion); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertAssertionInvalidRoleName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Assertion assertion = new Assertion() + .setAction("read") + .setEffect(AssertionEffect.ALLOW) + .setResource("my-domain:*") + .setRole("invalid_role"); + + try { + jdbcConn.insertAssertion("my-domain", "policy1", assertion); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertAssertionInvalidPolicy() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Assertion assertion = new Assertion() + .setAction("read") + .setEffect(AssertionEffect.ALLOW) + .setResource("my-domain:*") + .setRole("my-domain:role.role1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for policy id + + try { + jdbcConn.insertAssertion("my-domain", "policy1", assertion); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertAssertionException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Assertion assertion = new Assertion() + .setAction("read") + .setEffect(AssertionEffect.ALLOW) + .setResource("my-domain:*") + .setRole("my-domain:role.role1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // policy id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for policy id + .thenReturn(false); // assume insertion is not found + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertAssertion("my-domain", "policy1", assertion); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteAssertion() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // policy id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for policy id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.deleteAssertion("my-domain", "policy1", (long) 101); + assertTrue(requestSuccess); + + // getting domain and policy ids + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + + // assertion statement + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 101); + jdbcConn.close(); + } + + @Test + public void testDeleteAssertionInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.deleteAssertion("my-domain", "policy1", (long) 101); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteAssertionInvalidPolicy() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for policy id + + try { + jdbcConn.deleteAssertion("my-domain", "policy1", (long) 101); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteAssertionException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // policy id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for policy id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.deleteAssertion("my-domain", "policy1", (long) 101); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetServiceIdentity() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("policy1").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_NAME); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_EXECTUABLE); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_SVC_GROUP); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_SVC_USER); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_PROVIDER_ENDPOINT); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + ServiceIdentity service = jdbcConn.getServiceIdentity("my-domain", "service1"); + assertNotNull(service); + assertEquals("my-domain.service1", service.getName()); + assertNull(service.getExecutable()); + assertNull(service.getGroup()); + assertNull(service.getUser()); + assertNull(service.getProviderEndpoint()); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + jdbcConn.close(); + } + + @Test + public void testGetServiceIdentityNoMatch() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + ServiceIdentity service = jdbcConn.getServiceIdentity("my-domain", "service1"); + assertNull(service); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + jdbcConn.close(); + } + + @Test + public void testGetServiceIdentityAllFields() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("policy1").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_NAME); + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + Mockito.doReturn("/usr/bin64/athenz").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_EXECTUABLE); + Mockito.doReturn("users").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_SVC_GROUP); + Mockito.doReturn("root").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_SVC_USER); + Mockito.doReturn("http://server.athenzcompany.com").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_PROVIDER_ENDPOINT); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + ServiceIdentity service = jdbcConn.getServiceIdentity("my-domain", "service1"); + assertNotNull(service); + assertEquals("my-domain.service1", service.getName()); + assertEquals("/usr/bin64/athenz", service.getExecutable()); + assertEquals("users", service.getGroup()); + assertEquals("root", service.getUser()); + assertEquals("http://server.athenzcompany.com", service.getProviderEndpoint().toString()); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + jdbcConn.close(); + } + + @Test + public void testGetServiceException() throws Exception { + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + try { + jdbcConn.getServiceIdentity("my-domain", "service1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertServiceIdentity() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity().setName("my-domain.service1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); // return domain id + + boolean requestSuccess = jdbcConn.insertServiceIdentity("my-domain", service); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // update service + Mockito.verify(mockPrepStmt, times(1)).setString(1, "service1"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(3, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(4, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(5, ""); + jdbcConn.close(); + } + + @Test + public void testInsertServiceIdentityInvalidName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity().setName("service1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5) // return domain id + .thenReturn(4); //service id + + try { + jdbcConn.insertServiceIdentity("my-domain", service); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + jdbcConn.close(); + } + + @Test + public void testInsertServiceIdentityAllFields() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity() + .setName("my-domain.service1") + .setExecutable("/usr/bin64/test.sh") + .setGroup("users") + .setUser("root") + .setProviderEndpoint("http://server.athenzcompany.com"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); // return domain id + + boolean requestSuccess = jdbcConn.insertServiceIdentity("my-domain", service); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // update service + Mockito.verify(mockPrepStmt, times(1)).setString(1, "service1"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "http://server.athenzcompany.com"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "/usr/bin64/test.sh"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "root"); + Mockito.verify(mockPrepStmt, times(1)).setString(5, "users"); + Mockito.verify(mockPrepStmt, times(1)).setInt(6, 5); + jdbcConn.close(); + } + + @Test + public void testInsertServiceException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity().setName("my-domain.service1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertServiceIdentity("my-domain", service); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateServiceIdentity() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity().setName("my-domain.service1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5) // return domain id + .thenReturn(4); //service id + + boolean requestSuccess = jdbcConn.updateServiceIdentity("my-domain", service); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get service id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + // update service + Mockito.verify(mockPrepStmt, times(1)).setString(1, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(2, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(3, ""); + Mockito.verify(mockPrepStmt, times(1)).setString(4, ""); + Mockito.verify(mockPrepStmt, times(1)).setInt(5, 4); + jdbcConn.close(); + } + + @Test + public void testUpdateServiceIdentityInvalidName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity().setName("service1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5) // return domain id + .thenReturn(4); //service id + + try { + jdbcConn.updateServiceIdentity("my-domain", service); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + jdbcConn.close(); + } + + @Test + public void testUpdateServiceIdentityAllFields() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity() + .setName("my-domain.service1") + .setExecutable("/usr/bin64/test.sh") + .setGroup("users") + .setUser("root") + .setProviderEndpoint("http://server.athenzcompany.com"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5) // return domain id + .thenReturn(4); //service id + + boolean requestSuccess = jdbcConn.updateServiceIdentity("my-domain", service); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get service id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + // update service + Mockito.verify(mockPrepStmt, times(1)).setString(1, "http://server.athenzcompany.com"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "/usr/bin64/test.sh"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "root"); + Mockito.verify(mockPrepStmt, times(1)).setString(4, "users"); + Mockito.verify(mockPrepStmt, times(1)).setInt(5, 4); + jdbcConn.close(); + } + + @Test + public void testUpdateServiceIdentityException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ServiceIdentity service = new ServiceIdentity().setName("my-domain.service1"); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5) // return domain id + .thenReturn(4); //service id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updateServiceIdentity("my-domain", service); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteServiceIdentity() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.deleteServiceIdentity("my-domain", "service1"); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + jdbcConn.close(); + } + + @Test + public void testDeleteServiceIdentityException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.deleteServiceIdentity("my-domain", "service1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListServiceIdentities() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(1)) + .thenReturn("zservice") + .thenReturn("aservice") + .thenReturn("bservice"); + + List services = jdbcConn.listServiceIdentities("my-domain"); + + // data back is sorted + + assertEquals(3, services.size()); + assertEquals("aservice", services.get(0)); + assertEquals("bservice", services.get(1)); + assertEquals("zservice", services.get(2)); + jdbcConn.close(); + } + + @Test + public void testExtractServiceName() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("service1", jdbcConn.extractServiceName("my-domain1", "my-domain1.service1")); + assertEquals("service1", jdbcConn.extractServiceName("my-domain1.domain2", "my-domain1.domain2.service1")); + + // invalid service names + assertNull(jdbcConn.extractServiceName("my-domain1", "my-domain1:service1")); + assertNull(jdbcConn.extractServiceName("my-domain1", "my-domain2.service1")); + assertNull(jdbcConn.extractServiceName("my-domain1", "my-domain11:service.service1")); + assertNull(jdbcConn.extractServiceName("my-domain1", ".service1")); + assertNull(jdbcConn.extractServiceName("my-domain1", "service1")); + assertNull(jdbcConn.extractServiceName("my-domain1", "service1.service2")); + jdbcConn.close(); + } + + @Test + public void testSaveValue() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("test1", jdbcConn.saveValue("test1")); + assertNull(jdbcConn.saveValue("")); + jdbcConn.close(); + } + + @Test + public void testSaveUriValue() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("http://server.athenzcompany.com", jdbcConn.saveValue("http://server.athenzcompany.com")); + assertNull(jdbcConn.saveValue("")); + jdbcConn.close(); + } + + @Test + public void testProcessInsertValue() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("test1", jdbcConn.processInsertValue("test1")); + assertEquals("", jdbcConn.processInsertValue((String) null)); + jdbcConn.close(); + } + + @Test + public void testProcessInsertIntValue() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(1001, jdbcConn.processInsertValue(Integer.valueOf(1001))); + assertEquals(0, jdbcConn.processInsertValue((Integer) null)); + jdbcConn.close(); + } + + @Test + public void testProcessInsertBooleanValue() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals(true, jdbcConn.processInsertValue(Boolean.valueOf(true), false)); + assertEquals(false, jdbcConn.processInsertValue((Boolean) null, false)); + jdbcConn.close(); + } + + @Test + public void testProcessInsertAssertionAffect() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("ALLOW", jdbcConn.processInsertValue(AssertionEffect.ALLOW)); + assertEquals("DENY", jdbcConn.processInsertValue(AssertionEffect.DENY)); + assertEquals("ALLOW", jdbcConn.processInsertValue((AssertionEffect) null)); + jdbcConn.close(); + } + + @Test + public void testProcessInsertUriValue() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("http://server.athenzcompany.com", jdbcConn.processInsertValue("http://server.athenzcompany.com")); + assertEquals("", jdbcConn.processInsertValue((String) null)); + jdbcConn.close(); + } + + @Test + public void testProcessInsertUuidValue() throws Exception { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("e5e97240-e94e-11e4-8163-6d083f3f473f", jdbcConn.processInsertUuidValue(UUID.fromString("e5e97240-e94e-11e4-8163-6d083f3f473f"))); + assertEquals("", jdbcConn.processInsertUuidValue(null)); + jdbcConn.close(); + } + + @Test + public void testListPublicKeys() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5).thenReturn(7); // return domain/service id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_KEY_ID)) + .thenReturn("zms1.zone1") + .thenReturn("zms2.zone1") + .thenReturn("zms3.zone1"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_KEY_VALUE)) + .thenReturn("Value1") + .thenReturn("Value2") + .thenReturn("Value3"); + + List publicKeys = jdbcConn.listPublicKeys("my-domain", "service1"); + + // data back is sorted + + assertEquals(3, publicKeys.size()); + assertEquals("zms1.zone1", publicKeys.get(0).getId()); + assertEquals("Value1", publicKeys.get(0).getKey()); + assertEquals("zms2.zone1", publicKeys.get(1).getId()); + assertEquals("Value2", publicKeys.get(1).getKey()); + assertEquals("zms3.zone1", publicKeys.get(2).getId()); + assertEquals("Value3", publicKeys.get(2).getKey()); + jdbcConn.close(); + } + + @Test + public void testListAssertions() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5).thenReturn(7); // return domain/policy id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for policy id + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) + .thenReturn("role1") + .thenReturn("role2"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_RESOURCE)) + .thenReturn("my-domain:*") + .thenReturn("my-domain:service.*"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) + .thenReturn("*") + .thenReturn("read"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_EFFECT)) + .thenReturn("ALLOW") + .thenReturn("DENY"); + + List assertions = jdbcConn.listAssertions("my-domain", "policy1"); + + assertEquals(2, assertions.size()); + assertEquals("my-domain:role.role1", assertions.get(0).getRole()); + assertEquals("my-domain:*", assertions.get(0).getResource()); + assertEquals("*", assertions.get(0).getAction()); + assertEquals("ALLOW", assertions.get(0).getEffect().toString()); + + assertEquals("my-domain:role.role2", assertions.get(1).getRole()); + assertEquals("my-domain:service.*", assertions.get(1).getResource()); + assertEquals("read", assertions.get(1).getAction()); + assertEquals("DENY", assertions.get(1).getEffect().toString()); + jdbcConn.close(); + } + + @Test + public void testListAssertionsInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + try { + jdbcConn.listAssertions("my-domain", "policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetPublicKeyEntry() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(true); // for key + + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_KEY_VALUE)) + .thenReturn("Value1"); + + PublicKeyEntry publicKey = jdbcConn.getPublicKeyEntry("my-domain", "service1", "zone1"); + assertNotNull(publicKey); + assertEquals("Value1", publicKey.getKey()); + assertEquals("zone1", publicKey.getId()); + jdbcConn.close(); + } + + @Test + public void testGetPublicKeyEntryInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + try { + jdbcConn.getPublicKeyEntry("my-domain", "service1", "zone1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetPublicKeyEntryInvalidServiceId() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for service id + + try { + jdbcConn.getPublicKeyEntry("my-domain", "service1", "zone1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetPublicKeyEntryInvalidKeyId() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(false); // for key + + PublicKeyEntry publicKey = jdbcConn.getPublicKeyEntry("my-domain", "service1", "zone1"); + assertNull(publicKey); + jdbcConn.close(); + } + + @Test + public void testGetPublicKeyEntryException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(false); // for key + + Mockito.when(mockPrepStmt.executeQuery()) + .thenReturn(mockResultSet) + .thenReturn(mockResultSet) + .thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.getPublicKeyEntry("my-domain", "service1", "zone1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertPublicKeyEntry() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for service id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertPublicKeyEntry("my-domain", "service1", publicKey); + assertTrue(requestSuccess); + + // getting domain and service ids + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + + // public key entry statement + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "zms1"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "Value1"); + jdbcConn.close(); + } + + @Test + public void testInsertPublicKeyEntryInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.insertPublicKeyEntry("my-domain", "service1", publicKey); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertPublicKeyEntryInvalidService() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for service id + + try { + jdbcConn.insertPublicKeyEntry("my-domain", "service1", publicKey); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertPublicKeyEntryException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for service id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertPublicKeyEntry("my-domain", "service1", publicKey); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdatePublicKeyEntry() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for service id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.updatePublicKeyEntry("my-domain", "service1", publicKey); + assertTrue(requestSuccess); + + // getting domain and service ids + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + + // public key entry statement + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "Value1"); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 7); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "zms1"); + jdbcConn.close(); + } + + @Test + public void testUpdatePublicKeyEntryInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.updatePublicKeyEntry("my-domain", "service1", publicKey); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdatePublicKeyEntryInvalidService() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for service id + + try { + jdbcConn.updatePublicKeyEntry("my-domain", "service1", publicKey); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdatePublicKeyEntryException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + PublicKeyEntry publicKey = new PublicKeyEntry().setId("zms1").setKey("Value1"); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for service id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updatePublicKeyEntry("my-domain", "service1", publicKey); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeletePublicKeyEntry() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for service id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.deletePublicKeyEntry("my-domain", "service1", "zms1"); + assertTrue(requestSuccess); + + // getting domain and service ids + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + + // public key entry statement + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "zms1"); + jdbcConn.close(); + } + + @Test + public void testDeletePublicKeyEntryInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.deletePublicKeyEntry("my-domain", "service1", "zms1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeletePublicKeyEntryInvalidService() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for service id + + try { + jdbcConn.deletePublicKeyEntry("my-domain", "service1", "zms1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeletePublicKeyEntryException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for service id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.deletePublicKeyEntry("my-domain", "service1", "zms1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertServiceHost() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // service id + .thenReturn(9); // host id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(true); // this on is for host id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertServiceHost("my-domain", "service1", "host1"); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "host1"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 9); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testInsertServiceHostNewHost() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // service id + .thenReturn(9); // host id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(false) // this on is for host does not exist + .thenReturn(true); // insert last id (for new host) + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertServiceHost("my-domain", "service1", "host1"); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + + // 2 times - one for lookup, second time for adding + + Mockito.verify(mockPrepStmt, times(2)).setString(1, "host1"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 9); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testInsertServiceHostInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + try { + jdbcConn.insertServiceHost("my-domain", "service1", "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertServiceHostInvalidService() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for service id + + try { + jdbcConn.insertServiceHost("my-domain", "service1", "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertServiceHostException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // service id + .thenReturn(9); // host id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(true); // this on is for host id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.insertServiceHost("my-domain", "service1", "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteServiceHost() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // service id + .thenReturn(9); // host id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(true); // this on is for host id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.deleteServiceHost("my-domain", "service1", "host1"); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "service1"); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "host1"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 9); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testDeleteServiceHostInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + try { + jdbcConn.deleteServiceHost("my-domain", "service1", "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteServiceHostInvalidService() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(false); // this one is for service id + + try { + jdbcConn.deleteServiceHost("my-domain", "service1", "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteServiceHostInvalidHost() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service ie + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(false); // this one is for host id + + try { + jdbcConn.deleteServiceHost("my-domain", "service1", "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteServiceHostException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7) // service id + .thenReturn(9); // host id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(true); // this on is for host id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.deleteServiceHost("my-domain", "service1", "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListServiceHosts() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // service id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) // this one is for service id + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("host1") + .thenReturn("host3") + .thenReturn("host2"); + + List serviceHosts = jdbcConn.listServiceHosts("my-domain", "service1"); + + assertEquals(3, serviceHosts.size()); + assertEquals("host1", serviceHosts.get(0)); + assertEquals("host3", serviceHosts.get(1)); + assertEquals("host2", serviceHosts.get(2)); + jdbcConn.close(); + } + + @Test + public void testInsertDomainTemplate() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertDomainTemplate("my-domain", "platforms", null); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "platforms"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "platforms"); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testInsertDomainTemplateInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.insertDomainTemplate("my-domain", "platforms", null); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertDomainTemplateNewTemplate() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.insertDomainTemplate("my-domain", "platforms", null); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "platforms"); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testInsertDomainTemplateException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // template id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for template id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.insertDomainTemplate("my-domain", "platforms", null); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteDomainTemplate() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + Mockito.when(mockResultSet.next()) + .thenReturn(true); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + boolean requestSuccess = jdbcConn.deleteDomainTemplate("my-domain", "platforms", null); + + // this is combined for all operations above + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "platforms"); + + assertTrue(requestSuccess); + jdbcConn.close(); + } + + @Test + public void testDeleteDomainTemplateInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // this one is for domain id + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + + try { + jdbcConn.deleteDomainTemplate("my-domain", "platforms", null); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteDomainTemplateException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // template id + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true); // this one is for template id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.deleteDomainTemplate("my-domain", "platforms", null); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListDomainTemplates() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(1)) + .thenReturn("vipng") + .thenReturn("platforms") + .thenReturn("user_understanding"); + + List templates = jdbcConn.listDomainTemplates("my-domain"); + + // data back is sorted + + assertEquals(3, templates.size()); + assertEquals("platforms", templates.get(0)); + assertEquals("user_understanding", templates.get(1)); + assertEquals("vipng", templates.get(2)); + jdbcConn.close(); + } + + @Test + public void testListDomainTemplatesException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.listDomainTemplates("my-domain"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testPreparseScanStatementPrefixNullModifiedZero() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + jdbcConn.prepareScanStatement(mockConn, null, 0); + Mockito.verify(mockPrepStmt, times(0)).setString(Mockito.anyInt(), Mockito.isA(String.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanStatementPrefixModifiedZero() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + jdbcConn.prepareScanStatement(mockConn, "prefix", 0); + Mockito.verify(mockPrepStmt, times(1)).setString(1, "prefix"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "prefiy"); + jdbcConn.close(); + } + + @Test + public void testPreparseScanStatementPrefixModified() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + jdbcConn.prepareScanStatement(mockConn, "prefix", 100); + Mockito.verify(mockPrepStmt, times(1)).setString(1, "prefix"); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "prefiy"); + Mockito.verify(mockPrepStmt, times(1)).setTimestamp(Matchers.eq(3), Matchers.eq(new java.sql.Timestamp(100)), Matchers.isA(Calendar.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanStatementPrefixEmptyModifiedTime() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + jdbcConn.prepareScanStatement(mockConn, "", 100); + Mockito.verify(mockPrepStmt, times(1)).setTimestamp(Matchers.eq(1), Matchers.eq(new java.sql.Timestamp(100)), Matchers.isA(Calendar.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanStatementOnlyModifiedTime() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + jdbcConn.prepareScanStatement(mockConn, null, 100); + Mockito.verify(mockPrepStmt, times(1)).setTimestamp(Matchers.eq(1), Matchers.eq(new java.sql.Timestamp(100)), Matchers.isA(Calendar.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanByRoleStatement() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareScanByRoleStatement(mockConn, "user.member", "name"); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(1), Matchers.eq("user.member")); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(2), Matchers.eq("name")); + jdbcConn.close(); + } + + @Test + public void testPreparseScanByRoleStatementOnlyRoleNameNull() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareScanByRoleStatement(mockConn, null, "name"); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(1), Matchers.eq("name")); + Mockito.verify(mockPrepStmt, times(0)).setString(Matchers.eq(2), Mockito.isA(String.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanByRoleStatementOnlyRoleNameEmpty() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareScanByRoleStatement(mockConn, "", "name"); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(1), Matchers.eq("name")); + Mockito.verify(mockPrepStmt, times(0)).setString(Matchers.eq(2), Mockito.isA(String.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanByRoleStatementOnlyRoleMemberNull() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareScanByRoleStatement(mockConn, "user.member", null); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(1), Matchers.eq("user.member")); + Mockito.verify(mockPrepStmt, times(0)).setString(Matchers.eq(2), Mockito.isA(String.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanByRoleStatementOnlyRoleMemberEmpty() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareScanByRoleStatement(mockConn, "user.member", ""); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(1), Matchers.eq("user.member")); + Mockito.verify(mockPrepStmt, times(0)).setString(Matchers.eq(2), Mockito.isA(String.class)); + jdbcConn.close(); + } + + @Test + public void testPreparseScanByRoleStatementEmptyRoleMember() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + jdbcConn.prepareScanByRoleStatement(mockConn, null, null); + Mockito.verify(mockPrepStmt, times(0)).setString(Mockito.anyInt(), Mockito.isA(String.class)); + + jdbcConn.prepareScanByRoleStatement(mockConn, null, ""); + Mockito.verify(mockPrepStmt, times(0)).setString(Mockito.anyInt(), Mockito.isA(String.class)); + + jdbcConn.prepareScanByRoleStatement(mockConn, "", null); + Mockito.verify(mockPrepStmt, times(0)).setString(Mockito.anyInt(), Mockito.isA(String.class)); + + jdbcConn.prepareScanByRoleStatement(mockConn, "", ""); + Mockito.verify(mockPrepStmt, times(0)).setString(Mockito.anyInt(), Mockito.isA(String.class)); + + jdbcConn.close(); + } + + @Test + public void testListEntities() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // this one is for domain id + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(1)) + .thenReturn("z-entity") + .thenReturn("a-entity") + .thenReturn("b-entity"); + + List entities = jdbcConn.listEntities("my-domain"); + + // data back is sorted + + assertEquals(3, entities.size()); + assertEquals("a-entity", entities.get(0)); + assertEquals("b-entity", entities.get(1)); + assertEquals("z-entity", entities.get(2)); + jdbcConn.close(); + } + + @Test + public void testGetEntity() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn("{\"value\":1}").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_VALUE); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); // domain id + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Entity entity = jdbcConn.getEntity("my-domain", "entity1"); + assertNotNull(entity); + assertEquals("entity1", entity.getName()); + assertEquals("{\"value\":1}", JSON.string(entity.getValue())); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "entity1"); + jdbcConn.close(); + } + + @Test + public void testGetEntityNotFound() throws Exception { + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // for domain id + .thenReturn(false); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Entity entity = jdbcConn.getEntity("my-domain", "entity1"); + assertNull(entity); + jdbcConn.close(); + } + + @Test + public void testGetEntityDomainNotFound() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + try { + jdbcConn.getEntity("my-domain", "entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetEntityException() throws Exception { + + Mockito.when(mockPrepStmt.executeQuery()) + .thenReturn(mockResultSet) + .thenThrow(new SQLException("failed operation", "state", 1001)); + + Mockito.when(mockResultSet.next()) + .thenReturn(true); // for domain id + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5); // domain id + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + try { + jdbcConn.getEntity("my-domain", "entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertEntity() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Entity entity = new Entity().setName("entity1").setValue(JSON.fromString("{\"value\":1}", Struct.class)); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.insertEntity("my-domain", entity); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "entity1"); + jdbcConn.close(); + } + + @Test + public void testInsertEntityInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Entity entity = new Entity().setName("entity1").setValue(JSON.fromString("{\"value\":1}", Struct.class)); + Mockito.when(mockResultSet.next()).thenReturn(false); + + try { + jdbcConn.insertEntity("my-domain", entity); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertEntityException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Entity entity = new Entity().setName("entity1").setValue(JSON.fromString("{\"value\":1}", Struct.class)); + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertEntity("my-domain", entity); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateEntity() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Entity entity = new Entity().setName("entity1").setValue(JSON.fromString("{\"value\":1}", Struct.class)); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.updateEntity("my-domain", entity); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(1, "{\"value\":1}"); + Mockito.verify(mockPrepStmt, times(1)).setInt(2, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "entity1"); + jdbcConn.close(); + } + + @Test + public void testUpdateEntityInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Entity entity = new Entity().setName("entity1").setValue(JSON.fromString("{\"value\":1}", Struct.class)); + Mockito.when(mockResultSet.next()).thenReturn(false); + + try { + jdbcConn.updateEntity("my-domain", entity); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testUpdateEntityException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Entity entity = new Entity().setName("entity1").setValue(JSON.fromString("{\"value\":1}", Struct.class)); + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updateEntity("my-domain", entity); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteEntity() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + boolean requestSuccess = jdbcConn.deleteEntity("my-domain", "entity1"); + assertTrue(requestSuccess); + + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "entity1"); + jdbcConn.close(); + } + + @Test + public void testDeleteEntityInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()).thenReturn(false); + + try { + jdbcConn.deleteEntity("my-domain", "entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testDeleteEntityException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.deleteEntity("my-domain", "entity1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertPrincipalException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertPrincipal(mockConn, "domain.user1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertPrincipalZeroAffected() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenReturn(0); + int value = jdbcConn.insertPrincipal(mockConn, "domain.user1"); + assertEquals(0, value); + jdbcConn.close(); + } + + @Test + public void testInsertHostException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.insertHost(mockConn, "host1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testInsertHostZeroAffected() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenReturn(0); + int value = jdbcConn.insertHost(mockConn, "host1"); + assertEquals(0, value); + jdbcConn.close(); + } + + @Test + public void testListModifiedDomains() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.next()).thenReturn(true) // 3 domains + .thenReturn(true).thenReturn(true).thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("domain1").thenReturn("domain2").thenReturn("domain3"); // 3 domains + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + + DomainModifiedList list = jdbcConn.listModifiedDomains(1454358900); + + Mockito.verify(mockPrepStmt, times(1)).setTimestamp(Matchers.eq(1), + Matchers.eq(new java.sql.Timestamp(1454358900)), Matchers.isA(Calendar.class)); + + assertEquals(3, list.getNameModList().size()); + boolean domain1Found = false; + boolean domain2Found = false; + boolean domain3Found = false; + for (DomainModified dom : list.getNameModList()) { + switch (dom.getName()) { + case "domain1": + domain1Found = true; + break; + case "domain2": + domain2Found = true; + break; + case "domain3": + domain3Found = true; + break; + } + } + assertTrue(domain1Found); + assertTrue(domain2Found); + assertTrue(domain3Found); + + jdbcConn.close(); + } + + @Test + public void testListModifiedDomainsNoEntries() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.next()).thenReturn(false); // no entries + + DomainModifiedList list = jdbcConn.listModifiedDomains(1454358900); + assertEquals(0, list.getNameModList().size()); + + jdbcConn.close(); + } + + @Test + public void testListModifiedDomainsException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.listModifiedDomains(1454358900); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetAthenzDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + // one-domain, 2 roles, 2 members altogether + // 2 policies, 2 assertions + // 1 service, 1 public key + Mockito.when(mockResultSet.next()).thenReturn(true) // domain + .thenReturn(true).thenReturn(true).thenReturn(false) // 2 roles + .thenReturn(true).thenReturn(true).thenReturn(false) // 1 member each + .thenReturn(true).thenReturn(true).thenReturn(false) // 2 policies + .thenReturn(true).thenReturn(true).thenReturn(false) // 1 assertion each + .thenReturn(true).thenReturn(false) // 1 service + .thenReturn(true).thenReturn(false) // 1 public key + .thenReturn(true).thenReturn(false); // 1 host + + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("role1").thenReturn("role2") // role names + .thenReturn("policy1").thenReturn("policy2") // policy names + .thenReturn("service1"); // service name + + Mockito.when(mockResultSet.getString(1)) + .thenReturn("role1").thenReturn("role2") // role names + .thenReturn("policy1").thenReturn("policy2") // policy names + .thenReturn("service1"); // service names + + Mockito.when(mockResultSet.getString(2)) + .thenReturn("user").thenReturn("user") // member domain names + .thenReturn("host1"); // service host name + Mockito.when(mockResultSet.getString(3)).thenReturn("user1").thenReturn("user2"); // member local names + + Mockito.doReturn(new java.sql.Timestamp(1454358916)).when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_MODIFIED); + Mockito.doReturn(true).when(mockResultSet).getBoolean(ZMSConsts.DB_COLUMN_ENABLED); + Mockito.doReturn(false).when(mockResultSet).getBoolean(ZMSConsts.DB_COLUMN_AUDIT_ENABLED); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_DESCRIPTION); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_ORG); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_UUID); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_TRUST); + Mockito.doReturn("").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_ACCOUNT); + Mockito.doReturn(0).when(mockResultSet).getInt(ZMSConsts.DB_COLUMN_PRODUCT_ID); + Mockito.doReturn(5).when(mockResultSet).getInt(ZMSConsts.DB_COLUMN_DOMAIN_ID); + Mockito.doReturn("/usr/bin64/athenz").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_EXECTUABLE); + Mockito.doReturn("users").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_SVC_GROUP); + Mockito.doReturn("root").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_SVC_USER); + Mockito.doReturn("http://server.athenzcompany.com").when(mockResultSet).getString(ZMSConsts.DB_COLUMN_PROVIDER_ENDPOINT); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) + .thenReturn("role1").thenReturn("role2"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_RESOURCE)) + .thenReturn("my-domain:*").thenReturn("my-domain:service.*"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) + .thenReturn("*").thenReturn("read"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_EFFECT)) + .thenReturn("ALLOW").thenReturn("DENY"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_KEY_ID)).thenReturn("zms1.zone1"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_KEY_VALUE)).thenReturn("Value1"); + + AthenzDomain athenzDomain = jdbcConn.getAthenzDomain("my-domain"); + assertNotNull(athenzDomain); + assertEquals("my-domain", athenzDomain.getDomain().getName()); + assertEquals(2, athenzDomain.getRoles().size()); + assertEquals(1, athenzDomain.getRoles().get(0).getMembers().size()); + assertEquals(1, athenzDomain.getRoles().get(1).getMembers().size()); + assertEquals(2, athenzDomain.getPolicies().size()); + assertEquals(1, athenzDomain.getPolicies().get(0).getAssertions().size()); + assertEquals(1, athenzDomain.getPolicies().get(1).getAssertions().size()); + assertEquals(1, athenzDomain.getServices().size()); + assertEquals(1, athenzDomain.getServices().get(0).getPublicKeys().size()); + assertEquals("zms1.zone1", athenzDomain.getServices().get(0).getPublicKeys().get(0).getId()); + assertEquals("Value1", athenzDomain.getServices().get(0).getPublicKeys().get(0).getKey()); + assertEquals(1, athenzDomain.getServices().get(0).getHosts().size()); + assertEquals("host1", athenzDomain.getServices().get(0).getHosts().get(0)); + + jdbcConn.close(); + } + + @Test + public void testSetName() { + AthenzDomain athenzDomain = new AthenzDomain("my-domain"); + try { + athenzDomain.setName("my-domain"); + } catch (Exception ex) { + fail(); + } + assertTrue(true); + } + + @Test + public void testCommit() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, false); + assertFalse(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).setAutoCommit(false); + + jdbcConn.commitChanges(); + assertTrue(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).commit(); + Mockito.verify(mockConn, times(1)).setAutoCommit(true); + + jdbcConn.close(); + } + + @Test + public void testCommitException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, false); + assertFalse(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).setAutoCommit(false); + + Mockito.doThrow(new SQLException("failed operation", "state", 1001)).when(mockConn).commit(); + + try { + jdbcConn.commitChanges(); + fail(); + } catch (ResourceException ex) { + assertTrue(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).commit(); + } + + jdbcConn.close(); + } + + @Test + public void testRollback() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, false); + assertFalse(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).setAutoCommit(false); + + jdbcConn.rollbackChanges(); + assertTrue(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).rollback(); + Mockito.verify(mockConn, times(1)).setAutoCommit(true); + + jdbcConn.close(); + } + + @Test + public void testRollbackException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, false); + assertFalse(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).setAutoCommit(false); + + Mockito.doThrow(new SQLException("failed operation", "state", 1001)).when(mockConn).rollback(); + + jdbcConn.rollbackChanges(); + assertTrue(jdbcConn.transactionCompleted); + Mockito.verify(mockConn, times(1)).rollback(); + Mockito.verify(mockConn, times(1)).setAutoCommit(true); + + jdbcConn.close(); + } + + @Test + public void testValidatePrincipalDomainInvalidValue() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, false); + assertFalse(jdbcConn.validatePrincipalDomain("coretech")); + assertFalse(jdbcConn.validatePrincipalDomain(".coretech")); + assertFalse(jdbcConn.validatePrincipalDomain("coretech.")); + assertFalse(jdbcConn.validatePrincipalDomain("coretech.test.")); + jdbcConn.close(); + } + + @Test + public void testValidatePrincipalDomainInvalidDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, false); + Mockito.when(mockResultSet.next()).thenReturn(false); + + assertFalse(jdbcConn.validatePrincipalDomain("coretech.storage")); + assertFalse(jdbcConn.validatePrincipalDomain("coretech.storage.db")); + jdbcConn.close(); + } + + @Test + public void testValidatePrincipalDomain() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, false); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)).thenReturn(5); + + assertTrue(jdbcConn.validatePrincipalDomain("coretech.storage")); + assertTrue(jdbcConn.validatePrincipalDomain("coretech.storage.db")); + assertTrue(jdbcConn.validatePrincipalDomain("user.user1")); + + jdbcConn.close(); + } + + @Test + public void testVerifyDomainAccountUniquenessEmptyAccount() throws Exception { + + // we are going to set the code to return exception so that we can + // verify that we're returning before making any sql calls + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.verifyDomainAccountUniqueness("iaas.athenz", null, "unitTest"); + jdbcConn.verifyDomainAccountUniqueness("iaas.athenz", "", "unitTest"); + jdbcConn.close(); + } + + @Test + public void testVerifyDomainAccountUniquenessPass() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn("iaas.athenz").when(mockResultSet).getString(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.verifyDomainAccountUniqueness("iaas.athenz", "12345", "unitTest"); + jdbcConn.close(); + } + + @Test + public void testVerifyDomainAccountUniquenessPassNoMatch() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.verifyDomainAccountUniqueness("iaas.athenz", "12345", "unitTest"); + jdbcConn.close(); + } + + @Test + public void testVerifyDomainAccountUniquenessFail() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn("iaas.athenz.ci").when(mockResultSet).getString(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + try { + jdbcConn.verifyDomainAccountUniqueness("iaas.athenz", "12345", "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + assertTrue(ex.getMessage().contains("iaas.athenz.ci")); + } + jdbcConn.close(); + } + + @Test + public void testVerifyDomainProductIdUniquenessEmptyId() throws Exception { + + // we are going to set the code to return exception so that we can + // verify that we're returning before making any sql calls + + Mockito.when(mockResultSet.next()).thenReturn(false); + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.verifyDomainProductIdUniqueness("iaas.athenz", null, "unitTest"); + jdbcConn.verifyDomainProductIdUniqueness("iaas.athenz", Integer.valueOf(0), "unitTest"); + jdbcConn.close(); + } + + @Test + public void testVerifyDomainProductIdUniquenessPass() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn("iaas.athenz").when(mockResultSet).getString(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.verifyDomainProductIdUniqueness("iaas.athenz", Integer.valueOf(1001), "unitTest"); + jdbcConn.close(); + } + + @Test + public void testVerifyDomainProductIdUniquenessPassNoMatch() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(false); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.verifyDomainProductIdUniqueness("iaas.athenz", Integer.valueOf(1001), "unitTest"); + jdbcConn.close(); + } + + @Test + public void testVerifyDomainProductIdUniquenessFail() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn("iaas.athenz.ci").when(mockResultSet).getString(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + try { + jdbcConn.verifyDomainProductIdUniqueness("iaas.athenz", Integer.valueOf(1001), "unitTest"); + fail(); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + assertTrue(ex.getMessage().contains("iaas.athenz.ci")); + } + jdbcConn.close(); + } + + @Test + public void testLookupDomainByAccount() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn("iaas.athenz").when(mockResultSet).getString(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + String domainName = jdbcConn.lookupDomainById("1234", 0); + assertEquals(domainName, "iaas.athenz"); + jdbcConn.close(); + } + + @Test + public void testLookupDomainByProductId() throws Exception { + + Mockito.when(mockResultSet.next()).thenReturn(true).thenReturn(false); + Mockito.doReturn("iaas.athenz").when(mockResultSet).getString(1); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + String domainName = jdbcConn.lookupDomainById(null, Integer.valueOf(1001)); + assertEquals(domainName, "iaas.athenz"); + jdbcConn.close(); + } + + @Test + public void testLookupDomainByRole() throws Exception { + + // 3 domain being returned + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("zdomain") + .thenReturn("adomain") + .thenReturn("bdomain"); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + List domains = jdbcConn.lookupDomainByRole("user.user", "admin"); + assertEquals(3, domains.size()); + assertEquals("adomain", domains.get(0)); + assertEquals("bdomain", domains.get(1)); + assertEquals("zdomain", domains.get(2)); + jdbcConn.close(); + } + + @Test + public void testLookupDomainByRoleDuplicateDomains() throws Exception { + + // 3 domain being returned but 2 are duplicates + // so our end result must be the unique 2 only + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("zdomain") + .thenReturn("adomain") + .thenReturn("zdomain"); + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + List domains = jdbcConn.lookupDomainByRole("user.user", "admin"); + assertEquals(2, domains.size()); + assertEquals("adomain", domains.get(0)); + assertEquals("zdomain", domains.get(1)); + jdbcConn.close(); + } + + @Test + public void testListRoleAuditLogsInvalidDomain() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(false); // invalid domain + + try { + jdbcConn.listRoleAuditLogs("my-domain", "role1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListRoleAuditLogsInvalidRole() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // domain id success + .thenReturn(false); // role id failure + Mockito.doReturn(5).when(mockResultSet).getInt(1); // return domain id + + try { + jdbcConn.listRoleAuditLogs("my-domain", "role1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testListRoleAuditLogsException() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // domain id success + .thenReturn(true); // role id success + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + Mockito.when(mockPrepStmt.executeQuery()) + .thenReturn(mockResultSet) + .thenReturn(mockResultSet) + .thenThrow(new SQLException("failed operation", "state", 1001)); + + try { + jdbcConn.listRoleAuditLogs("my-domain", "role1"); + fail(); + } catch (ResourceException ex) { + assertEquals(500, ex.getCode()); + } + jdbcConn.close(); + } + + @Test + public void testListRoleAuditLogs() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) // domain id success + .thenReturn(true) // role id success + .thenReturn(true) // 2 log entries + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // role id + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) + .thenReturn("ADD") + .thenReturn("DELETE"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_MEMBER)) + .thenReturn("user.member1") + .thenReturn("user.member2"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ADMIN)) + .thenReturn("user.admin1") + .thenReturn("user.admin2"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_AUDIT_REF)) + .thenReturn("") + .thenReturn("audit-ref"); + Mockito.doReturn(new java.sql.Timestamp(1454358916)) + .when(mockResultSet).getTimestamp(ZMSConsts.DB_COLUMN_CREATED); + + List logs = jdbcConn.listRoleAuditLogs("my-domain", "role1"); + assertNotNull(logs); + assertEquals(2, logs.size()); + assertEquals("ADD", logs.get(0).getAction()); + assertEquals("user.admin1", logs.get(0).getAdmin()); + assertEquals("user.member1", logs.get(0).getMember()); + assertNull(logs.get(0).getAuditRef()); + assertEquals("DELETE", logs.get(1).getAction()); + assertEquals("user.admin2", logs.get(1).getAdmin()); + assertEquals("user.member2", logs.get(1).getMember()); + assertEquals("audit-ref", logs.get(1).getAuditRef()); + jdbcConn.close(); + } + + @Test + public void testRoleIndex() throws SQLException { + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + assertEquals("101:role1", jdbcConn.roleIndex("101", "role1")); + jdbcConn.close(); + } + + @Test + public void testPrepareRoleAssertionsStatementWithAction() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareRoleAssertionsStatement(mockConn, "create"); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(1), Matchers.eq("create")); + jdbcConn.close(); + } + + @Test + public void testPrepareRoleAssertionsStatementEmptyAction() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareRoleAssertionsStatement(mockConn, ""); + jdbcConn.prepareRoleAssertionsStatement(mockConn, null); + Mockito.verify(mockPrepStmt, times(0)).setString(Matchers.isA(Integer.class), Matchers.isA(String.class)); + jdbcConn.close(); + } + + @Test + public void testPrepareRolePrinciaplsStatementWithPrincipal() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareRolePrincipalsStatement(mockConn, "user.user1", false); + Mockito.verify(mockPrepStmt, times(1)).setString(Matchers.eq(1), Matchers.eq("user.user1")); + jdbcConn.close(); + } + + @Test + public void testPrepareRolePrinciaplsStatementEmptyPrincipal() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + jdbcConn.prepareRolePrincipalsStatement(mockConn, "", false); + jdbcConn.prepareRolePrincipalsStatement(mockConn, null, false); + Mockito.verify(mockPrepStmt, times(0)).setString(Matchers.isA(Integer.class), Matchers.isA(String.class)); + jdbcConn.close(); + } + + @Test + public void testGetRoleAssertions() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("dom1") + .thenReturn("dom1") + .thenReturn("dom2"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("101") + .thenReturn("102"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) + .thenReturn("role1") + .thenReturn("role1") + .thenReturn("role3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_RESOURCE)) + .thenReturn("resource1") + .thenReturn("resource2") + .thenReturn("resource3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) + .thenReturn("update"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_EFFECT)) + .thenReturn("ALLOW"); + + Map> roleAssertions = jdbcConn.getRoleAssertions("update", "getRoleAssertions"); + assertEquals(2, roleAssertions.size()); + + List assertions = roleAssertions.get("101:role1"); + assertEquals(2, assertions.size()); + + assertEquals("dom1:role.role1", assertions.get(0).getRole()); + assertEquals("resource1", assertions.get(0).getResource()); + assertEquals("update", assertions.get(0).getAction()); + assertEquals("ALLOW", assertions.get(0).getEffect().toString()); + + assertEquals("dom1:role.role1", assertions.get(1).getRole()); + assertEquals("resource2", assertions.get(1).getResource()); + assertEquals("update", assertions.get(1).getAction()); + assertEquals("ALLOW", assertions.get(1).getEffect().toString()); + + assertions = roleAssertions.get("102:role3"); + assertEquals(1, assertions.size()); + + assertEquals("dom2:role.role3", assertions.get(0).getRole()); + assertEquals("resource3", assertions.get(0).getResource()); + assertEquals("update", assertions.get(0).getAction()); + assertEquals("ALLOW", assertions.get(0).getEffect().toString()); + + jdbcConn.close(); + } + + @Test + public void testGetRolePrincipals() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("user.user1") + .thenReturn("user.user2") + .thenReturn("user.user3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("101") + .thenReturn("102"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE_NAME)) + .thenReturn("role1") + .thenReturn("role1") + .thenReturn("role3"); + + Map> rolePrincipals = jdbcConn.getRolePrincipals(null, false, "getRolePrincipals"); + assertEquals(2, rolePrincipals.size()); + + List principals = rolePrincipals.get("101:role1"); + assertEquals(2, principals.size()); + + assertEquals("user.user1", principals.get(0)); + assertEquals("user.user2", principals.get(1)); + + principals = rolePrincipals.get("102:role3"); + assertEquals(1, principals.size()); + + assertEquals("user.user3", principals.get(0)); + + jdbcConn.close(); + } + + @Test + public void testGetTrustedRoles() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("trole1") + .thenReturn("trole2") + .thenReturn("trole3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("102") + .thenReturn("103"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) + .thenReturn("role1") + .thenReturn("role1") + .thenReturn("role3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ASSERT_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("101") + .thenReturn("103"); + + Map> trustedRoles = jdbcConn.getTrustedRoles("getTrustedRoles"); + assertEquals(2, trustedRoles.size()); + + List roles = trustedRoles.get("101:role1"); + assertEquals(2, roles.size()); + + assertEquals("101:trole1", roles.get(0)); + assertEquals("102:trole2", roles.get(1)); + + roles = trustedRoles.get("103:role3"); + assertEquals(1, roles.size()); + + assertEquals("103:trole3", roles.get(0)); + + jdbcConn.close(); + } + + @Test + public void testGetAwsDomains() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("dom1") + .thenReturn("dom2") + .thenReturn("dom3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACCOUNT)) + .thenReturn("101") + .thenReturn("102") + .thenReturn("103"); + + Map awsDomains = jdbcConn.getAwsDomains("getAwsDomains"); + assertEquals(3, awsDomains.size()); + + assertEquals("101", awsDomains.get("dom1")); + assertEquals("102", awsDomains.get("dom2")); + assertEquals("103", awsDomains.get("dom3")); + + jdbcConn.close(); + } + + @Test + public void testAddRoleAssertionsEmptyList() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + List principalAssertions = new ArrayList<>(); + + jdbcConn.addRoleAssertions(principalAssertions, null, null); + assertEquals(0, principalAssertions.size()); + + jdbcConn.addRoleAssertions(principalAssertions, new ArrayList(), null); + assertEquals(0, principalAssertions.size()); + + jdbcConn.close(); + } + + @Test + public void testAddRoleAssertionsAwsDomainListEmpty() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + List principalAssertions = new ArrayList<>(); + + List roleAssertions = new ArrayList<>(); + Assertion assertion = new Assertion().setAction("update").setResource("dom1:resource").setRole("role"); + roleAssertions.add(assertion); + + jdbcConn.addRoleAssertions(principalAssertions, roleAssertions, null); + assertEquals(1, principalAssertions.size()); + + principalAssertions.clear(); + jdbcConn.addRoleAssertions(principalAssertions, roleAssertions, new HashMap()); + assertEquals(1, principalAssertions.size()); + + jdbcConn.close(); + } + + @Test + public void testAddRoleAssertions() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + List principalAssertions = new ArrayList<>(); + + List roleAssertions = new ArrayList<>(); + Assertion assertion = new Assertion().setAction("update").setResource("dom1:resource").setRole("role"); + roleAssertions.add(assertion); + + assertion = new Assertion().setAction("update").setResource("dom2:resource1").setRole("role"); + roleAssertions.add(assertion); + + assertion = new Assertion().setAction("update").setResource("resource3").setRole("role"); + roleAssertions.add(assertion); + + Map awsDomains = new HashMap<>(); + awsDomains.put("dom1", "12345"); + + jdbcConn.addRoleAssertions(principalAssertions, roleAssertions, awsDomains); + assertEquals(3, principalAssertions.size()); + + assertEquals("arn:aws:iam::12345:role/resource", principalAssertions.get(0).getResource()); + assertEquals("dom2:resource1", principalAssertions.get(1).getResource()); + assertEquals("resource3", principalAssertions.get(2).getResource()); + + jdbcConn.close(); + } + + @Test + public void testSqlError() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + SQLException ex = new SQLException("sql-reason", "08S01", 9999); + ResourceException rEx = (ResourceException) jdbcConn.sqlError(ex, "sqlError"); + assertEquals(ResourceException.CONFLICT, rEx.getCode()); + + ex = new SQLException("sql-reason", "40001", 9999); + rEx = (ResourceException) jdbcConn.sqlError(ex, "sqlError"); + assertEquals(ResourceException.CONFLICT, rEx.getCode()); + + ex = new SQLException("sql-reason", "sql-state", 1290); + rEx = (ResourceException) jdbcConn.sqlError(ex, "sqlError"); + assertEquals(ResourceException.GONE, rEx.getCode()); + + ex = new SQLException("sql-reason", "sql-state", 1062); + rEx = (ResourceException) jdbcConn.sqlError(ex, "sqlError"); + assertEquals(ResourceException.BAD_REQUEST, rEx.getCode()); + jdbcConn.close(); + } + + @Test + public void testListResourceAccessNotRegisteredRolePrincipals() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + // no role principals + + Mockito.when(mockResultSet.next()) + .thenReturn(false); + + // we must get back 404 since the user doesn't exist in system + + try { + jdbcConn.listResourceAccess("user.user1", "update", "user"); + fail(); + } catch (ResourceException ex) { + assertEquals(ResourceException.NOT_FOUND, ex.getCode()); + } + + jdbcConn.close(); + } + + @Test + public void testListResourceAccessRegisteredRolePrincipals() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + // no role principals + + Mockito.when(mockResultSet.next()) + .thenReturn(false) // no role principal return + .thenReturn(true); // valid principal id + Mockito.doReturn(7).when(mockResultSet).getInt(1); + + ResourceAccessList resourceAccessList = jdbcConn.listResourceAccess("user.user1", "update", "user"); + + // we should get an empty assertion set for the principal + + List resources = resourceAccessList.getResources(); + assertEquals(1, resources.size()); + ResourceAccess rsrcAccess = resources.get(0); + assertEquals("user.user1", rsrcAccess.getPrincipal()); + List assertions = rsrcAccess.getAssertions(); + assertTrue(assertions.isEmpty()); + + jdbcConn.close(); + } + + @Test + public void testListResourceAccessEmptyRoleAssertions() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false) // upto here is role principals + .thenReturn(false); // we have no role assertions + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("user.user1") + .thenReturn("user.user2") + .thenReturn("user.user3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("101") + .thenReturn("102"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE_NAME)) + .thenReturn("role1") + .thenReturn("role1") + .thenReturn("role3"); + + ResourceAccessList resourceAccessList = jdbcConn.listResourceAccess("user.user1", "update", "user"); + + // we should get an empty assertion set for the principal + + List resources = resourceAccessList.getResources(); + assertEquals(1, resources.size()); + ResourceAccess rsrcAccess = resources.get(0); + assertEquals("user.user1", rsrcAccess.getPrincipal()); + List assertions = rsrcAccess.getAssertions(); + assertTrue(assertions.isEmpty()); + + jdbcConn.close(); + } + + @Test + public void testListResourceAccess() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false) // up to here is role principals + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false) // up to here is role assertions + .thenReturn(false); // no trusted role + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("user.user1") + .thenReturn("user.user2") + .thenReturn("user.user3") // up to here is role principals + .thenReturn("dom1") + .thenReturn("dom1") + .thenReturn("dom2"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("101") + .thenReturn("102") // up to here is role principals + .thenReturn("101") + .thenReturn("101") + .thenReturn("102"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE_NAME)) + .thenReturn("role1") + .thenReturn("role1") + .thenReturn("role3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) + .thenReturn("role1") + .thenReturn("role1") + .thenReturn("role3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_RESOURCE)) + .thenReturn("resource1") + .thenReturn("resource2") + .thenReturn("resource3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) + .thenReturn("update"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_EFFECT)) + .thenReturn("ALLOW"); + + ResourceAccessList resourceAccessList = jdbcConn.listResourceAccess(null, "update", "user"); + List resources = resourceAccessList.getResources(); + assertEquals(3, resources.size()); + + boolean userUser1 = false; + boolean userUser2 = false; + boolean userUser3 = false; + for (ResourceAccess rsrcAccess : resources) { + + switch (rsrcAccess.getPrincipal()) { + case "user.user1": + userUser1 = true; + assertEquals(2, rsrcAccess.getAssertions().size()); + break; + case "user.user2": + userUser2 = true; + assertEquals(2, rsrcAccess.getAssertions().size()); + break; + case "user.user3": + userUser3 = true; + assertEquals(1, rsrcAccess.getAssertions().size()); + break; + } + } + assertTrue(userUser1); + assertTrue(userUser2); + assertTrue(userUser3); + jdbcConn.close(); + } + + @Test + public void testListResourceAccessAws() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false) // up to here is role principals + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false) // up to here is role assertions + .thenReturn(true) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false) // up to here trusted roles + .thenReturn(true) + .thenReturn(false); // up to here is aws domains + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_NAME)) + .thenReturn("user.user1") + .thenReturn("user.user2") + .thenReturn("user.user3.service") // up to here is role principals + .thenReturn("dom1") + .thenReturn("dom2") + .thenReturn("dom3") // up to here is role assertions + .thenReturn("trole1") + .thenReturn("trole2") + .thenReturn("trole3") // up to here trusted roles + .thenReturn("dom1"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("102") + .thenReturn("103") // up to here is role principals + .thenReturn("101") + .thenReturn("102") + .thenReturn("103") // up to here role assertions + .thenReturn("101") + .thenReturn("102") + .thenReturn("103"); // up to here trusted roles + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE_NAME)) + .thenReturn("role1") + .thenReturn("role2") + .thenReturn("role3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) + .thenReturn("role1") + .thenReturn("role2") + .thenReturn("role3") // up to here role assertions + .thenReturn("role1") + .thenReturn("role2") + .thenReturn("role3"); // up to here trusted roles + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_RESOURCE)) + .thenReturn("dom1:role1") + .thenReturn("dom2:role2") + .thenReturn("resource3"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) + .thenReturn("assume_aws_role"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_EFFECT)) + .thenReturn("ALLOW"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACCOUNT)) + .thenReturn("12345"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ASSERT_DOMAIN_ID)) + .thenReturn("101") + .thenReturn("102") + .thenReturn("103"); + + ResourceAccessList resourceAccessList = jdbcConn.listResourceAccess(null, "assume_aws_role", "user"); + List resources = resourceAccessList.getResources(); + assertEquals(2, resources.size()); + + boolean userUser1 = false; + boolean userUser2 = false; + boolean userUser3 = false; // must be skipped + for (ResourceAccess rsrcAccess : resources) { + + switch (rsrcAccess.getPrincipal()) { + case "user.user1": + userUser1 = true; + assertEquals(1, rsrcAccess.getAssertions().size()); + assertEquals("arn:aws:iam::12345:role/role1", rsrcAccess.getAssertions().get(0).getResource()); + break; + case "user.user2": + userUser2 = true; + assertEquals(1, rsrcAccess.getAssertions().size()); + assertEquals("dom2:role2", rsrcAccess.getAssertions().get(0).getResource()); + break; + case "user.user3.service": + userUser3 = true; + break; + } + } + assertTrue(userUser1); + assertTrue(userUser2); + assertFalse(userUser3); + jdbcConn.close(); + } + + @Test + public void testGetResourceAccessObject() throws SQLException { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + ResourceAccess rsrcAccess = jdbcConn.getResourceAccessObject("user.user1", null); + assertEquals("user.user1", rsrcAccess.getPrincipal()); + List assertions = rsrcAccess.getAssertions(); + assertTrue(assertions.isEmpty()); + + List roleAssertions = new ArrayList<>(); + Assertion assertion = new Assertion().setAction("update").setRole("role").setResource("resource"); + roleAssertions.add(assertion); + + rsrcAccess = jdbcConn.getResourceAccessObject("user.user2", roleAssertions); + assertEquals("user.user2", rsrcAccess.getPrincipal()); + assertions = rsrcAccess.getAssertions(); + assertEquals(1, assertions.size()); + Assertion testAssertion = assertions.get(0); + assertEquals("update", testAssertion.getAction()); + assertEquals("role", testAssertion.getRole()); + assertEquals("resource", testAssertion.getResource()); + + jdbcConn.close(); + } + + @Test + public void testUpdatePolicyModTimestampSuccess() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(1).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // policy id + + boolean requestSuccess = jdbcConn.updatePolicyModTimestamp("my-domain", "policy1"); + assertTrue(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get policy id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + // update policy time-stamp + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + jdbcConn.close(); + } + + @Test + public void testUpdatePolicyModTimestampFailure() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.doReturn(0).when(mockPrepStmt).executeUpdate(); + Mockito.when(mockResultSet.next()).thenReturn(true); + Mockito.when(mockResultSet.getInt(1)) + .thenReturn(5) // domain id + .thenReturn(7); // policy id + + boolean requestSuccess = jdbcConn.updatePolicyModTimestamp("my-domain", "policy1"); + assertFalse(requestSuccess); + + // get domain id + Mockito.verify(mockPrepStmt, times(1)).setString(1, "my-domain"); + // get policy id + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 5); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "policy1"); + // update policy time-stamp + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 7); + jdbcConn.close(); + } + + @Test + public void testUpdatePolicyModTimestampException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeUpdate()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.updatePolicyModTimestamp("my-domain", "policy1"); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + + @Test + public void testGetAssertion() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockResultSet.next()) + .thenReturn(true); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ROLE)) + .thenReturn("role1"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_RESOURCE)) + .thenReturn("my-domain:*"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_ACTION)) + .thenReturn("*"); + Mockito.when(mockResultSet.getString(ZMSConsts.DB_COLUMN_EFFECT)) + .thenReturn("ALLOW"); + + Assertion assertion = jdbcConn.getAssertion("my-domain", "policy1", Long.valueOf(101)); + + assertEquals("my-domain:role.role1", assertion.getRole()); + assertEquals("my-domain:*", assertion.getResource()); + assertEquals("*", assertion.getAction()); + assertEquals("ALLOW", assertion.getEffect().toString()); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 101); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "policy1"); + + jdbcConn.close(); + } + + @Test + public void testGetAssertionNoMatch() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + Mockito.when(mockResultSet.next()) + .thenReturn(false); + + Assertion assertion = jdbcConn.getAssertion("my-domain", "policy1", Long.valueOf(101)); + assertNull(assertion); + + Mockito.verify(mockPrepStmt, times(1)).setInt(1, 101); + Mockito.verify(mockPrepStmt, times(1)).setString(2, "my-domain"); + Mockito.verify(mockPrepStmt, times(1)).setString(3, "policy1"); + + jdbcConn.close(); + } + + @Test + public void testGetAssertionException() throws Exception { + + JDBCConnection jdbcConn = new JDBCConnection(mockConn, true); + + Mockito.when(mockPrepStmt.executeQuery()).thenThrow(new SQLException("failed operation", "state", 1001)); + try { + jdbcConn.getAssertion("my-domain", "policy1", Long.valueOf(101)); + fail(); + } catch (Exception ex) { + assertTrue(true); + } + jdbcConn.close(); + } + +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/JDBCObjectStoreTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/JDBCObjectStoreTest.java new file mode 100644 index 00000000000..d5b84657ed5 --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/store/jdbc/JDBCObjectStoreTest.java @@ -0,0 +1,53 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.store.jdbc; + +import java.sql.Connection; +import java.sql.SQLException; + +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.store.jdbc.JDBCObjectStore; +import com.yahoo.athenz.zms.store.jdbc.PoolableDataSource; + +import static org.testng.Assert.*; + +public class JDBCObjectStoreTest { + + @Test + public void testGetConnection() throws SQLException { + PoolableDataSource mockDataSrc = Mockito.mock(PoolableDataSource.class); + Connection mockConn = Mockito.mock(Connection.class); + Mockito.doReturn(mockConn).when(mockDataSrc).getConnection(); + JDBCObjectStore store = new JDBCObjectStore(mockDataSrc); + assertNotNull(store.getConnection(true)); + store.clearConnections(); + } + + @Test + public void testGetConnectionException() throws SQLException { + PoolableDataSource mockDataSrc = Mockito.mock(PoolableDataSource.class); + Mockito.doThrow(new SQLException()).when(mockDataSrc).getConnection(); + try { + JDBCObjectStore store = new JDBCObjectStore(mockDataSrc); + store.getConnection(true); + fail(); + } catch (RuntimeException ex) { + assertTrue(true); + } + } +} diff --git a/servers/zms/src/test/java/com/yahoo/athenz/zms/utils/ZMSUtilsTest.java b/servers/zms/src/test/java/com/yahoo/athenz/zms/utils/ZMSUtilsTest.java new file mode 100644 index 00000000000..0a0d220896c --- /dev/null +++ b/servers/zms/src/test/java/com/yahoo/athenz/zms/utils/ZMSUtilsTest.java @@ -0,0 +1,147 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zms.utils; + +import static org.testng.Assert.*; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.utils.ZMSUtils; + +public class ZMSUtilsTest { + + @Test + public void testRemoveDomainPrefix() { + assertEquals("role1", ZMSUtils.removeDomainPrefix("role1", "domain1", "role.")); + assertEquals("role1", ZMSUtils.removeDomainPrefix("domain1:role.role1", "domain1", "role.")); + assertEquals("domain1:role.role1", ZMSUtils.removeDomainPrefix("domain1:role.role1", "domain2", "role.")); + assertEquals("domain1:role.role1", ZMSUtils.removeDomainPrefix("domain1:role.role1", "domain1", "policy.")); + assertEquals("policy1", ZMSUtils.removeDomainPrefix("domain1:policy.policy1", "domain1", "policy.")); + } + + @Test + public void testGetTenantResourceGroupRolePrefix() { + + assertEquals("storage.tenant.sports.api.", + ZMSUtils.getTenantResourceGroupRolePrefix("storage", "sports.api", null)); + assertEquals("storage.tenant.sports.api.res_group.Group1.", + ZMSUtils.getTenantResourceGroupRolePrefix("storage", "sports.api", "Group1")); + } + + @Test + public void testGetTrustedResourceGroupRolePrefix() { + assertEquals("coretech:role.storage.tenant.sports.api.", + ZMSUtils.getTrustedResourceGroupRolePrefix("coretech", "storage", "sports.api", null)); + assertEquals("coretech:role.storage.tenant.sports.api.res_group.group1.", + ZMSUtils.getTrustedResourceGroupRolePrefix("coretech", "storage", "sports.api", "group1")); + } + + @Test + public void testGetProviderResourceGroupRolePrefix() { + assertEquals("sports.hosted.res_group.hockey.", + ZMSUtils.getProviderResourceGroupRolePrefix("sports", "hosted", "hockey")); + assertEquals("sports.hosted.", + ZMSUtils.getProviderResourceGroupRolePrefix("sports", "hosted", null)); + } + + @Test + public void testAssumeRoleResourceMatchActionNoMatch() { + Assertion assertion = new Assertion() + .setAction("test") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain1:role.role1") + .setResource("domain1:*"); + assertFalse(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_role1") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain1:role.role1") + .setResource("domain1:*"); + assertFalse(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_rol") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain1:role.role1") + .setResource("domain1:*"); + assertFalse(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + } + + @Test + public void testAssumeRoleResourceMatchRoleNoMatch() { + Assertion assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain1:role.role1") + .setResource("domain1:role.role2"); + assertFalse(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain1:role.role1") + .setResource("domain2:role.role1"); + assertFalse(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain1:role.role1") + .setResource("domain1:role.reader*"); + assertFalse(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain1:role.role1") + .setResource("*:role.role2"); + assertFalse(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + } + + @Test + public void testAssumeRoleResourceMatch() { + Assertion assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain2:role.role1") + .setResource("domain1:role.role1"); + assertTrue(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain2:role.role1") + .setResource("domain1:role.*"); + assertTrue(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain2:role.role1") + .setResource("domain1:*"); + assertTrue(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + + assertion = new Assertion() + .setAction("assume_role") + .setEffect(AssertionEffect.ALLOW) + .setRole("domain2:role.role1") + .setResource("*:role.role1"); + assertTrue(ZMSUtils.assumeRoleResourceMatch("domain1:role.role1", assertion)); + } +} diff --git a/servers/zms/src/test/resources/authorized_services.json b/servers/zms/src/test/resources/authorized_services.json new file mode 100644 index 00000000000..5ad9c851930 --- /dev/null +++ b/servers/zms/src/test/resources/authorized_services.json @@ -0,0 +1,38 @@ +{ + "services" : { + "coretech.storage": { + "allowedOperations": [ + {"name":"putproviderresourcegrouproles"}, + {"name":"deleteproviderresourcegrouproles"}, + {"name":"putrole"}, + {"name":"putpolicy"}, + {"name":"puttenancy"}, + {"name":"deletetenancy"} + ] + }, + "coretech.index": { + "allowedOperations": [ + {"name":"putrole"}, + {"name":"putpolicy"} + ] + }, + "sports.hockey": { + }, + "coretech.newsvc": { + "allowedOperations": [ + {"name":"putrole"}, + {"name":"putmembership", + "items": { + "role" : [ + "platforms_deployer", + "platforms_different_deployer" + ], + "not_role" : [ + "platforms_role_deployer" + ] + } + } + ] + } + } +} diff --git a/servers/zms/src/test/resources/logback.xml b/servers/zms/src/test/resources/logback.xml new file mode 100644 index 00000000000..9297d1db86d --- /dev/null +++ b/servers/zms/src/test/resources/logback.xml @@ -0,0 +1,58 @@ + + + + + + + System.out + + %-4relative [%thread] %-5level %class - %msg%n + + + + + + + ${LOG_DIR}/server.log + true + + + ${LOG_DIR}/server.%d{yyyy-MM-dd}.log + 7 + true + + + + %-4relative [%thread] %-5level %logger{35} - %msg%n + + + + + + + ${LOG_DIR}/audit.log + true + + + ${LOG_DIR}/audit.%d{yyyy-MM-dd}.log + 7 + true + + + + %-4relative [%thread] %-5level %logger{35} - %msg%n + + + + + + + + + + + + + + + diff --git a/servers/zms/src/test/resources/solution_templates.json b/servers/zms/src/test/resources/solution_templates.json new file mode 100644 index 00000000000..007930f95d9 --- /dev/null +++ b/servers/zms/src/test/resources/solution_templates.json @@ -0,0 +1,234 @@ +{ + "templates" : { + "vipng": { + "roles": [ + { + "name": "_domain_:role.vip_admin", + "modified": "1970-01-01T00:00:00.000Z" + }, + { + "name": "_domain_:role.sys_network_super_vip_admin", + "modified": "1970-01-01T00:00:00.000Z", + "trust": "sys.network" + } + ], + "policies": [ + { + "name": "_domain_:policy.vip_admin", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:vip*", + "role": "_domain_:role.vip_admin", + "action": "*" + } + ] + }, + { + "name": "_domain_:policy.sys_network_super_vip_admin", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:vip*", + "role": "_domain_:role.sys_network_super_vip_admin", + "action": "*" + } + ] + } + ] + }, + "platforms": { + "roles": [ + { + "name": "_domain_:role.platforms_deployer", + "modified": "1970-01-01T00:00:00.000Z" + } + ], + "policies": [ + { + "name": "_domain_:policy.platforms_deploy", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:service", + "role": "_domain_:role.platforms_deployer", + "action": "*" + }, + { + "resource": "_domain_:service.*", + "role": "_domain_:role.platforms_deployer", + "action": "update" + }, + { + "resource": "_domain_:identity", + "role": "_domain_:role.platforms_deployer", + "action": "create" + }, + { + "resource": "_domain_:identity.*", + "role": "_domain_:role.platforms_deployer", + "action": "read" + }, + { + "resource": "_domain_:daemon.*", + "role": "_domain_:role.platforms_deployer", + "action": "update" + }, + { + "resource": "_domain_:ruleset.*", + "role": "_domain_:role.platforms_deployer", + "action": "update" + }, + { + "resource": "ops_tools.dnsdb:role._domain__traffic_user", + "role": "_domain_:role.platforms_deployer", + "action": "assume_role" + } + ] + } + ] + }, + "user_provisioning": { + "roles": [ + { + "name": "_domain_:role.user", + "modified": "1970-01-01T00:00:00.000Z" + }, + { + "name": "_domain_:role.superuser", + "modified": "1970-01-01T00:00:00.000Z" + }, + { + "name": "_domain_:role.openstack_readers", + "members": [ "sys.builder", "sys.openstack" ], + "modified": "1970-01-01T00:00:00.000Z" + } + ], + "policies": [ + { + "name": "_domain_:policy.user", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:node.*", + "role": "_domain_:role.user", + "action": "node_user" + } + ] + }, + { + "name": "_domain_:policy.superuser", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:node.*", + "role": "_domain_:role.superuser", + "action": "node_sudo" + } + ] + }, + { + "name": "_domain_:policy.openstack_readers", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:nodedef", + "role": "_domain_:role.openstack_readers", + "action": "read" + }, + { + "resource": "_domain_:node", + "role": "_domain_:role.openstack_readers", + "action": "delete" + } + ] + } + ] + }, + "sports": { + "roles": [ + { + "name": "_domain_:role.tenancy.sports.se.access", + "modified": "1970-01-01T00:00:00.000Z", + "trust": "sports" + } + ], + "policies": [ + { + "name": "_domain_:policy.tenancy.sports.se.access", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:tenancy.sports.*", + "role": "_domain_:role.tenancy.sports.se.access", + "action": "update" + } + ] + } + ] + }, + "network": { + "roles": [ + { + "name": "_domain_:role.network_manager", + "modified": "1970-01-01T00:00:00.000Z" + }, + { + "name": "_domain_:role.sys_security_network_admin", + "modified": "1970-01-01T00:00:00.000Z", + "trust": "sys.security" + }, + { + "name": "_domain_:role.sys_security_network_manager_global", + "modified": "1970-01-01T00:00:00.000Z", + "trust": "sys.security" + } + ], + "policies": [ + { + "name": "_domain_:policy.network_manager", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:acl*", + "role": "_domain_:role.network_manager", + "action": "*" + } + ] + }, + { + "name": "_domain_:policy.sys_security_network_admin", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:acl*", + "role": "_domain_:role.sys_security_network_admin", + "action": "*" + } + ] + }, + { + "name": "_domain_:policy.sys_security_network_manager_global", + "modified": "1970-01-01T00:00:00.000Z", + "assertions": [ + { + "resource": "_domain_:acl*", + "role": "_domain_:role.sys_security_network_manager_global", + "action": "create" + }, + { + "resource": "_domain_:acl*", + "role": "_domain_:role.sys_security_network_manager_global", + "action": "update" + }, + { + "resource": "_domain_:acl*", + "role": "_domain_:role.sys_security_network_manager_global", + "action": "delete" + } + ] + } + ] + } + } +} diff --git a/servers/zms/src/test/resources/zms_private.pem b/servers/zms/src/test/resources/zms_private.pem new file mode 100644 index 00000000000..356e1edf8bd --- /dev/null +++ b/servers/zms/src/test/resources/zms_private.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- diff --git a/servers/zms/src/test/resources/zms_private_k1.pem b/servers/zms/src/test/resources/zms_private_k1.pem new file mode 100644 index 00000000000..71ef39207a4 --- /dev/null +++ b/servers/zms/src/test/resources/zms_private_k1.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXQIBAAKBgQC1ZXd4eOeKlbvmY9ffJ7CYWuVwC6BZswpAinrCMohee6CZgqeF +75T0PN0jb8qZRLaAMV8kBl08NWoW1qwGl/TRz5dJPwWiij+NDlyw61ifouArrayb +Hgd+cHDb5O/HBFzNA9ejImVf5BZjUNuYpgqYU53finp5VKGXsL5bIilt7wIDAQAB +AoGBAJv3IzLtWb/5oHamcCzKNne4579f775QR8dYidZBlqkOSPbUtO9fIMajMkxO +yXbg8r3kNXaHFlE3aAE9EOoWa4Mr+2ibf9EFpsud1n9dU7ZW1Q+vayrjOdqy4fsv +Ppp2Q1g4hxJaqPppPP1yjHYOoAifxVN3pcBoryuZZEE5DjIxAkEA3JhEa22AVeLm +4vWJRmjFaOC0eotyVBFnU5oM3Qh0YeDW6VQlFYSFriQte2/Y3HD5ufY3XgGAj5hn +tbdGTcztFwJBANKCoCybCMd1sIU6mYAGFVt17yBvbmfj5mXk0uxdPHOHB9z5zyxj +S0K4NIlUI/CpT3Ed7mo54sPwOMKGjci1/OkCQQDJWSaiU8mfG0OZh3psTPdbWjcB +38RUHaqNcYAqRCxOprYjNU3ADT0jjRwCnj14QJqAdc9lu8NHzlljUM0X+GOzAkAX +VfWtnC4X9lrwGfPkNkht0CAHB3NEvwXOa9RZ8Wf/Iovjmim2MPep2MOyKYqmZg5x +arEAQ5R4xgt0vPfAtTPpAkAD46oZlxxxcONlqrmGAbHZJTtS5cYxAgZT2lt6YyTj ++k/KFQkCuVaVmTtkwqUWmxsKSgY7uZnSe/BmSZRA03uN +-----END RSA PRIVATE KEY----- diff --git a/servers/zms/src/test/resources/zms_private_k2.pem b/servers/zms/src/test/resources/zms_private_k2.pem new file mode 100644 index 00000000000..4bc8a8c0da9 --- /dev/null +++ b/servers/zms/src/test/resources/zms_private_k2.pem @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICWwIBAAKBgQDP9IwR0+n3oeQRKSf43r97j1j6cUSbDDdrvfBAzSRSTyYJteGH +Wu3ty2gJnnYEDBxj6n5z+RZrcpjFS6wjxvQdl2eg6dYgBB2+9QkM6UgYs/LA1mgf +DtLXT+bEskZ+qeXYTTWGvXkPFREaNcabFk71pODVUHMj/+Tf2YLdWf+S6QIDAQAB +AoGALyln5tcnlaiaf6XU0eU6ifwtksbDZ2Jy4zV1Wkzr8trOZp9gIYFmumpKEvxk +CXDxs1tICGcyRXX83anWxVpmnDLA+FBqxJwJC5075oLxCFDE78VlXrWNfnAuhxh3 +ehZ+du4FnVru60M7Wrfk2H9hY0J4m0rPE+ueBG6Q0Mu+a+0CQQDq9FfS4su+sDPv +1BP01roMoFywA7o2MUcM55m2S3anFIAJT4NiifFioy/Vjn8TYKDkRpY2f/fWH+hq +8/ynyx0HAkEA4pUYUmgBA41YNG0cHJmMgdr30phW8qLE9JgCO4KOpr7+c3Y0rN0h +e9GXcCirhIscI7qUeTWXxECZcqLMtOfEjwJAFvveF4AeJEJCYmShqyLSQmfxiTpk +HecGJ0oErGOHcOK9f6uqk5og5eBGzqJI5hFey9Xn3d741JZ8evHxNkzVQwJAdTlR +tgCc1augwK7aZmmCagRRRqEOCsXvQ+QI86TeDKKvnii/o9db5WVQBfTkl9QooMt8 +2SDC/gO137seUVG/PQJAKjHW6X7gQAAZDndXJ93lRAYHRiMjQWEZ/yx1Z0NMoRNd +08JtxGD9FdnIXIHJ2UrQKaZPhKTEw/4orTHrurY0bA== +-----END RSA PRIVATE KEY----- diff --git a/servers/zms/src/test/resources/zms_public.pem b/servers/zms/src/test/resources/zms_public.pem new file mode 100644 index 00000000000..727c3c67f22 --- /dev/null +++ b/servers/zms/src/test/resources/zms_public.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- diff --git a/servers/zms/src/test/resources/zms_public_k1.pem b/servers/zms/src/test/resources/zms_public_k1.pem new file mode 100644 index 00000000000..6843735dbd5 --- /dev/null +++ b/servers/zms/src/test/resources/zms_public_k1.pem @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1ZXd4eOeKlbvmY9ffJ7CYWuVw +C6BZswpAinrCMohee6CZgqeF75T0PN0jb8qZRLaAMV8kBl08NWoW1qwGl/TRz5dJ +PwWiij+NDlyw61ifouArraybHgd+cHDb5O/HBFzNA9ejImVf5BZjUNuYpgqYU53f +inp5VKGXsL5bIilt7wIDAQAB +-----END PUBLIC KEY----- diff --git a/servers/zms/src/test/resources/zms_public_k2.pem b/servers/zms/src/test/resources/zms_public_k2.pem new file mode 100644 index 00000000000..333b8a2711a --- /dev/null +++ b/servers/zms/src/test/resources/zms_public_k2.pem @@ -0,0 +1,6 @@ +-----BEGIN PUBLIC KEY----- +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDP9IwR0+n3oeQRKSf43r97j1j6 +cUSbDDdrvfBAzSRSTyYJteGHWu3ty2gJnnYEDBxj6n5z+RZrcpjFS6wjxvQdl2eg +6dYgBB2+9QkM6UgYs/LA1mgfDtLXT+bEskZ+qeXYTTWGvXkPFREaNcabFk71pODV +UHMj/+Tf2YLdWf+S6QIDAQAB +-----END PUBLIC KEY----- diff --git a/servers/zts/README.md b/servers/zts/README.md new file mode 100644 index 00000000000..a7aab3dd1bb --- /dev/null +++ b/servers/zts/README.md @@ -0,0 +1,12 @@ +ZTS Server +======================= + +ZTS (AuthZ Token System) + +ZTS, the authentication token service, is only needed to support decentralized or data plane functionality. In many ways, ZTS is like a local replica of ZMS’s data to check a principal’s authentication and confirm membership in roles within a domain. The authentication is in the form of a signed ZToken that can be presented to any decentralized service that wants to authorize access efficiently. If needed, multiple ZTS instances will be distributed to different data centers as needed to scale for issuing tokens. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/servers/zts/conf/aws_public.crt b/servers/zts/conf/aws_public.crt new file mode 100644 index 00000000000..7f8173633c7 --- /dev/null +++ b/servers/zts/conf/aws_public.crt @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC7TCCAq0CCQCWukjZ5V4aZzAJBgcqhkjOOAQDMFwxCzAJBgNVBAYTAlVTMRkw +FwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYD +VQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAeFw0xMjAxMDUxMjU2MTJaFw0z +ODAxMDUxMjU2MTJaMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9u +IFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNl +cnZpY2VzIExMQzCCAbcwggEsBgcqhkjOOAQBMIIBHwKBgQCjkvcS2bb1VQ4yt/5e +ih5OO6kK/n1Lzllr7D8ZwtQP8fOEpp5E2ng+D6Ud1Z1gYipr58Kj3nssSNpI6bX3 +VyIQzK7wLclnd/YozqNNmgIyZecN7EglK9ITHJLP+x8FtUpt3QbyYXJdmVMegN6P +hviYt5JH/nYl4hh3Pa1HJdskgQIVALVJ3ER11+Ko4tP6nwvHwh6+ERYRAoGBAI1j +k+tkqMVHuAFcvAGKocTgsjJem6/5qomzJuKDmbJNu9Qxw3rAotXau8Qe+MBcJl/U +hhy1KHVpCGl9fueQ2s6IL0CaO/buycU1CiYQk40KNHCcHfNiZbdlx1E9rpUp7bnF +lRa2v1ntMX3caRVDdbtPEWmdxSCYsYFDk4mZrOLBA4GEAAKBgEbmeve5f8LIE/Gf +MNmP9CM5eovQOGx5ho8WqD+aTebs+k2tn92BBPqeZqpWRa5P/+jrdKml1qx4llHW +MXrs3IgIb6+hUIB+S8dz8/mmO0bpr76RoZVCXYab2CZedFut7qc3WUH9+EUAH5mw +vSeDCOUMYQR7R9LINYwouHIziqQYMAkGByqGSM44BAMDLwAwLAIUWXBlk40xTwSw +7HX32MxXYruse9ACFBNGmdX2ZBrVNGrN9N2f6ROk0k9K + -----END CERTIFICATE----- diff --git a/servers/zts/conf/container_settings b/servers/zts/conf/container_settings new file mode 100644 index 00000000000..ccef22a5056 --- /dev/null +++ b/servers/zts/conf/container_settings @@ -0,0 +1,73 @@ +#!/usr/bin/env bash + +# list of authorities for authenticating principals +CONTAINER_AUTHORITY_CLASSES="com.yahoo.athenz.auth.impl.PrincipalAuthority,com.yahoo.athenz.auth.impl.UserAuthority" + +# private/public key pair for zts instance - must be generated +# using with default key id of 0 +CONTAINER_PRIVKEY="${ROOT}/var/zts_server/keys/zts_private.pem" +CONTAINER_PRIVKEY_ID="0" + +# default ports for zts server. http support is disabled +# https support enabled - must provide certificate for server +CONTAINER_TLS_PORT="8443" +CONTAINER_PORT="0" + +# setup the keystore in pkcs12 format that includes our +# server's private key and x509 cert +CONTAINER_SSL_KEYSTORE="${ROOT}/var/zts_server/certs/zts_keystore.pkcs12" +CONTAINER_SSL_KEYSTORE_TYPE="PKCS12" +CONTAINER_SSL_KEYSTORE_PASSWORD="athenz" + +CONTAINER_SSL_TRUSTSTORE="${ROOT}/var/zts_server/certs/zts_truststore.jks" +CONTAINER_SSL_TRUSTSTORE_TYPE="JKS" +CONTAINER_SSL_TRUSTSTORE_PASSWORD="athenz" + +# ** athenz configuration file +CONTAINER_ATHENZ_CONF="conf/zts_server/athenz.conf" + +# ** logback configuration file +CONTAINER_LOG_CONFIG="${ROOT}/conf/zts_server/logback.xml" + +# ** server settings + +# CONTAINER_LISTEN_HOST= +# CONTAINER_HOSTNAME= +# CONTAINER_ROLE_TOKEN_MAX_TIMEOUT= +# CONTAINER_ROLE_TOKEN_DEFAULT_TIMEOUT= +# CONTAINER_SIGNED_POLICY_TIMEOUT= +# CONTAINER_ZMS_DOMAIN_UPDATE_TIMEOUT= +# CONTAINER_ZMS_DOMAIN_DELETE_TIMEOUT= +# CONTAINER_ZMS_CLIENT_READ_TIMEOUT= + +# ** list of authorized proxy users +# CONTAINER_AUTHZ_PROXY_USERS= + +# ** more ssl settings +# CONTAINER_SSL_KEYMANAGER_PASSWORD= +# CONTAINER_SSL_EXCLUDED_CIPHER_SUITES= +# CONTAINER_SSL_EXCLUDED_PROTOCOLS= + +# ** access log settings +# CONTAINER_ACCESS_LOG_DIR= +# CONTAINER_ACCESS_LOG_NAME= +# CONTAINER_ACCESS_LOG_OPTIONS= +# CONTAINER_ACCESS_LOG_RETAIN_DAYS= +# CONTAINER_ACCESS_LOG_ROTATION_PERIOD= +# CONTAINER_ACCESS_LOG_ROTATION_UNIT= + +# ** configure what implemenation classes to use +# CONTAINER_DATA_CHANGE_LOG_STORE_CLASS= +# CONTAINER_PRIVATE_KEY_STORE_CLASS= +# CONTAINER_CERT_SIGNER_CLASS= +# CONTAINER_HOST_SIGNER_SERVICE= +# CONTAINER_CERTSIGN_BASE_URI= + +# ** kerberos authority settings +# CONTAINER_KRB_KEYTAB= +# CONTAINER_KRB_PRINCIPAL= +# CONTAINER_KRB_TKT_CACHE= +# CONTAINER_KRB_TKT_CACHE_PATH= +# CONTAINER_KRB_TGT_RENEW= +# CONTAINER_KRB_DEBUG= +# CONTAINER_KRB_JAAS_CONF= diff --git a/servers/zts/conf/logback.xml b/servers/zts/conf/logback.xml new file mode 100755 index 00000000000..3d6967870c1 --- /dev/null +++ b/servers/zts/conf/logback.xml @@ -0,0 +1,49 @@ + + + + + + + + + ${LOG_DIR}/server.log + true + + + ${LOG_DIR}/server.%d.log + 7 + true + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n + + + + + + + ${LOG_DIR}/audit.log + true + + + ${LOG_DIR}/audit.%d.log + 30 + true + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n + + + + + + + + + + + + + diff --git a/servers/zts/pom.xml b/servers/zts/pom.xml new file mode 100644 index 00000000000..c3350b9175e --- /dev/null +++ b/servers/zts/pom.xml @@ -0,0 +1,188 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../pom.xml + + + zts_server + zts_server + Athenz ZTS Server + + + + + com.amazonaws + aws-java-sdk-bom + 1.10.67 + pom + import + + + + + + + ${project.groupId} + auth_core + ${project.parent.version} + + + ${project.groupId} + server_common + ${project.parent.version} + + + ${project.groupId} + zts_core + ${project.parent.version} + + + ${project.groupId} + zms_java_client + ${project.parent.version} + + + ${project.groupId} + client_common + ${project.parent.version} + + + org.glassfish.jersey.media + jersey-media-json-jackson + ${jersey.version} + + + com.fasterxml.jackson.core + jackson-annotations + + + + + com.fasterxml.jackson.core + jackson-annotations + ${jackson.version} + + + commons-daemon + commons-daemon + 1.0.15 + + + com.google.guava + guava + 16.0.1 + + + org.bouncycastle + bcprov-jdk15on + 1.53 + + + org.bouncycastle + bcpkix-jdk15on + 1.53 + + + org.glassfish.jersey.containers + jersey-container-servlet + ${jersey.version} + + + org.eclipse.jetty + jetty-servlet + ${jetty.version} + + + org.eclipse.jetty + jetty-util + ${jetty.version} + + + org.eclipse.jetty + jetty-server + ${jetty.version} + + + org.eclipse.jetty + jetty-security + ${jetty.version} + + + org.eclipse.jetty + jetty-rewrite + ${jetty.version} + + + com.amazonaws + aws-java-sdk-s3 + + + com.amazonaws + aws-java-sdk-sts + + + ch.qos.logback + logback-classic + 1.1.3 + + + + + + + org.codehaus.mojo + exec-maven-plugin + 1.1.1 + + + + exec + + generate-sources + + + + bash + + scripts/make_stubs.sh + + + + + org.apache.maven.plugins + maven-dependency-plugin + 3.0.0 + + + copy-dependencies + package + + copy-dependencies + + + runtime + + + + + + + diff --git a/servers/zts/scripts/make_stubs.sh b/servers/zts/scripts/make_stubs.sh new file mode 100755 index 00000000000..d667b28f744 --- /dev/null +++ b/servers/zts/scripts/make_stubs.sh @@ -0,0 +1,27 @@ +#!/bin/bash + +# If the zts_core dependency has been updated, then this script should be run +# manually to pick up the latest rdl to generate the appropriate server stubs. + +# Note this script is dependent on the rdl utility. +# +# Use open source version of rdl https://github.com/ardielle/ardielle-tools +# go get github.com/ardielle/ardielle-tools/... + +command -v rdl >/dev/null 2>&1 || { + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "SOURCE WARNING"; + echo >&2 "------------------------------------------------------------------------"; + echo >&2 "Please install rdl utility: go get github.com/ardielle/ardielle-tools/..."; + echo >&2 "Skipping source generation..."; + exit 0; +} + +echo "Update the ZTS.rdl to define string type" +RDL_FILE=src/main/rdl/ZTS.rdl + +echo "Generate the ZTS server stubs" +rdl -s generate -o src/main/java java-server $RDL_FILE + +echo "Removing not needed ZTS Server file..." +rm src/main/java/com/yahoo/athenz/zts/ZTSServer.java diff --git a/servers/zts/scripts/zts_debug.sh b/servers/zts/scripts/zts_debug.sh new file mode 100755 index 00000000000..5a991653cbc --- /dev/null +++ b/servers/zts/scripts/zts_debug.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +# setup ZTS settings for debug run + +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.home=./" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.zms_url=http://localhost:4080/" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.authority_classes=com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority,com.yahoo.athenz.common.server.debug.DebugUserAuthority,com.yahoo.athenz.common.server.debug.DebugRoleAuthority,com.yahoo.athenz.common.server.debug.DebugKerberosAuthority" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.port=8080" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.privatekey=src/test/resources/zts_private.pem" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.private_key_store_class=com.yahoo.athenz.zts.pkey.file.FilePrivateKeyStoreFactory" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.privatekey_id=0" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.access_log_dir=./zts_logs" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.enable_stats=false" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.zms_domain_update_timeout=30" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.zms_domain_delete_timeout=60" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.cert_signer_class=com.yahoo.athenz.zts.cert.MockCertSignerFactory" +export ZTS_OPTS="${ZTS_OPTS} -Dlogback.configurationFile=src/test/resources/logback.xml" +export ZTS_OPTS="${ZTS_OPTS} -Dathenz.athenz_conf=src/test/resources/athenz.conf" + +if [ "$1" == "-ssl" ]; then + export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.tls_port=8443" + export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.ssl_key_store_password=password" + export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.ssl_key_store=file://$HOME/.keystore" + export ZTS_OPTS="${ZTS_OPTS} -Dathenz.zts.ssl_key_store_type=PKCS12" +fi + +# make sure the access log directory exists + +mkdir -p ./zts_logs + +mvn exec:java -Dexec.mainClass="com.yahoo.athenz.zts.ZTS" ${ZTS_OPTS} -Dexec.classpathScope="test" diff --git a/servers/zts/scripts/zts_start.sh b/servers/zts/scripts/zts_start.sh new file mode 100644 index 00000000000..ea793ce0794 --- /dev/null +++ b/servers/zts/scripts/zts_start.sh @@ -0,0 +1,190 @@ +#!/bin/bash + +if [ -z "${ROOT}" ]; then + ROOT="/home/athenz" +fi + +CONTAINER_NAME=zts_server + +## pick up our service settings which should override +# some of the default values set by the code +if [ ! -f ${ROOT}/conf/${CONTAINER_NAME}/container_settings ]; then + echo "Unable to find container settings: ${ROOT}/conf/${CONTAINER_NAME}/container_settings aborting" + exit -1 +fi + +. "${ROOT}/conf/${CONTAINER_NAME}/container_settings" + +CONTAINER_RUN_PATH=${ROOT}/var/run/zts_server +CONTAINER_CLASSPATH=${ROOT}/lib/jar/zts_server*.jar:${ROOT}/lib/jars/* +CONTAINER_BOOTSTRAP_CLASS=com.yahoo.athenz.zts.ZTS + +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.port=${CONTAINER_PORT}" +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.tls_port=${CONTAINER_TLS_PORT}" +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.logs=${ROOT}/logs/${CONTAINER_NAME}" + +if [ "x${CONTAINER_LOG_CONFIG}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dlogback.configurationFile=${CONTAINER_LOG_CONFIG}" +fi + +if [ "x${CONTAINER_PRIVKEY}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.privatekey=${CONTAINER_PRIVKEY}" +fi + +if [ "x${CONTAINER_PRIVKEY_ID}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.privatekey_id=${CONTAINER_PRIVKEY_ID}" +fi + +if [ "x${CONTAINER_HOSTNAME}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.hostname=${CONTAINER_HOSTNAME}" +fi + +if [ "x${CONTAINER_ROLE_TOKEN_MAX_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.role_token_max_timeout=${CONTAINER_ROLE_TOKEN_MAX_TIMEOUT}" +fi + +if [ "x${CONTAINER_ROLE_TOKEN_DEFAULT_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.role_token_default_timeout=${CONTAINER_ROLE_TOKEN_DEFAULT_TIMEOUT}" +fi + +if [ "x${CONTAINER_SIGNED_POLICY_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.signed_policy_timeout=${CONTAINER_SIGNED_POLICY_TIMEOUT}" +fi + +if [ "x${CONTAINER_ZMS_DOMAIN_UPDATE_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.zms_domain_update_timeout=${CONTAINER_ZMS_DOMAIN_UPDATE_TIMEOUT}" +fi + +if [ "x${CONTAINER_ZMS_DOMAIN_DELETE_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.zms_domain_delete_timeout=${CONTAINER_ZMS_DOMAIN_DELETE_TIMEOUT}" +fi + +if [ "x${CONTAINER_ZMS_CLIENT_READ_TIMEOUT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dyahoo.zms_java_client.read_timeout=${CONTAINER_ZMS_CLIENT_READ_TIMEOUT}" +fi + +if [ "x${CONTAINER_SSL_KEYSTORE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_key_store=${CONTAINER_SSL_KEYSTORE}" +fi + +if [ "x${CONTAINER_SSL_KEYSTORE_TYPE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_key_store_type=${CONTAINER_SSL_KEYSTORE_TYPE}" +fi + +if [ "x${CONTAINER_SSL_KEYSTORE_PASSWORD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_key_store_password=${CONTAINER_SSL_KEYSTORE_PASSWORD}" +fi + +if [ "x${CONTAINER_SSL_TRUSTSTORE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_trust_store=${CONTAINER_SSL_TRUSTSTORE}" + export JAVA_OPTS="${JAVA_OPTS} -Djavax.net.ssl.trustStore=${CONTAINER_SSL_TRUSTSTORE}" +fi + +if [ "x${CONTAINER_SSL_TRUSTSTORE_TYPE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_trust_store_type=${CONTAINER_SSL_TRUSTSTORE_TYPE}" +fi + +if [ "x${CONTAINER_SSL_TRUSTSTORE_PASSWORD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_trust_store_password=${CONTAINER_SSL_TRUSTSTORE_PASSWORD}" +fi + +if [ "x${CONTAINER_SSL_KEYMANAGER_PASSWORD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_key_manager_password=${CONTAINER_SSL_KEYMANAGER_PASSWORD}" +fi + +if [ "x${CONTAINER_SSL_EXCLUDED_CIPHER_SUITES}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_excluded_cipher_suites=${CONTAINER_SSL_EXCLUDED_CIPHER_SUITES}" +fi + +if [ "x${CONTAINER_SSL_EXCLUDED_PROTOCOLS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.ssl_excluded_protocols=${CONTAINER_SSL_EXCLUDED_PROTOCOLS}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_DIR}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.access_log_dir=${CONTAINER_ACCESS_LOG_DIR}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_NAME}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.access_log_name=${CONTAINER_ACCESS_LOG_NAME}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_OPTIONS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.access_log_options=${CONTAINER_ACCESS_LOG_OPTIONS}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_RETAIN_DAYS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.access_log_retain_days=${CONTAINER_ACCESS_LOG_RETAIN_DAYS}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_ROTATION_PERIOD}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.access_log_rotation_period=${CONTAINER_ACCESS_LOG_ROTATION_PERIOD}" +fi + +if [ "x${CONTAINER_ACCESS_LOG_ROTATION_UNIT}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.access_log_rotation_unit=${CONTAINER_ACCESS_LOG_ROTATION_UNIT}" +fi + +if [ "x${CONTAINER_LISTEN_HOST}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.listen_host=${CONTAINER_LISTEN_HOST}" +fi + +if [ "x${CONTAINER_DATA_CHANGE_LOG_STORE_CLASS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.data_change_log_store_class=${CONTAINER_DATA_CHANGE_LOG_STORE_CLASS}" +fi + +if [ "x${CONTAINER_PRIVATE_KEY_STORE_CLASS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.private_key_store_class=${CONTAINER_PRIVATE_KEY_STORE_CLASS}" +fi + +if [ "x${CONTAINER_CERT_SIGNER_CLASS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.cert_signer_class=${CONTAINER_CERT_SIGNER_CLASS}" +fi + +if [ "x${CONTAINER_CERTSIGN_BASE_URI}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.certsign_base_uri=${CONTAINER_CERTSIGN_BASE_URI}" +fi + +if [ "x${CONTAINER_HOST_SIGNER_SERVICE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.host_signer_service=${CONTAINER_HOST_SIGNER_SERVICE}" +fi + + +if [ "x${CONTAINER_KRB_KEYTAB}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dyahoo.auth_core.keytab_location=${CONTAINER_KRB_KEYTAB}" +fi + +if [ "x${CONTAINER_KRB_PRINCIPAL}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dyahoo.auth_core.service_principal=${CONTAINER_KRB_PRINCIPAL}" +fi + +if [ "x${CONTAINER_KRB_TKT_CACHE}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dyahoo.auth_core.use_ticket_cache=${CONTAINER_KRB_TKT_CACHE}" +fi + +if [ "x${CONTAINER_KRB_TKT_CACHE_PATH}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dyahoo.auth_core.ticket_cache_name=${CONTAINER_KRB_TKT_CACHE_PATH}" +fi + +if [ "x${CONTAINER_KRB_TGT_RENEW}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dyahoo.auth_core.renewTGT=${CONTAINER_KRB_TGT_RENEW}" +fi + +if [ "x${CONTAINER_KRB_DEBUG}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dsun.security.krb5.debug=${CONTAINER_KRB_DEBUG}" +fi + +if [ "x${CONTAINER_KRB_JAAS_CONF}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Djava.security.auth.login.config=${CONTAINER_KRB_JAAS_CONF}" +fi + +if [ "x${CONTAINER_AUTHZ_PROXY_USERS}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zts.authorized_proxy_users=${CONTAINER_AUTHZ_PROXY_USERS}" +fi + +if [ "x${CONTAINER_ATHENZ_CONF}" != "x" ]; then + export JAVA_OPTS="${JAVA_OPTS} -Dathenz.athenz_conf=${CONTAINER_ATHENZ_CONF}" +fi + +echo "Executing: java -classpath ${CONTAINER_CLASSPATH} ${JAVA_OPTS} ${CONTAINER_BOOTSTRAP_CLASS}" + +java -classpath ${CONTAINER_CLASSPATH} ${JAVA_OPTS} ${CONTAINER_BOOTSTRAP_CLASS} 2>&1 < /dev/null diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/GetDomainSignedPolicyDataResult.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/GetDomainSignedPolicyDataResult.java new file mode 100644 index 00000000000..fc42b4d7fdb --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/GetDomainSignedPolicyDataResult.java @@ -0,0 +1,49 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +import com.yahoo.rdl.*; +import java.util.*; +import javax.ws.rs.core.Response; +import javax.ws.rs.WebApplicationException; + +public final class GetDomainSignedPolicyDataResult { + private ResourceContext context; + private String domainName; + private int code; //normal result + + GetDomainSignedPolicyDataResult(ResourceContext context) { + this.context = context; + this.code = 0; + } + + public boolean isAsync() { + return false; + } + + public void done(int code, DomainSignedPolicyData domainSignedPolicyData, String tag) { + Response resp = Response.status(code).entity(domainSignedPolicyData) + .header("ETag", tag) + .build(); + throw new WebApplicationException(resp); + } + + public void done(int code) { + done(code, new ResourceError().code(code).message(ResourceException.codeToString(code)), ""); + } + + public void done(int code, String tag) { + done(code, new ResourceError().code(code).message(ResourceException.codeToString(code)), tag); + } + + public void done(int code, Object entity, String tag) { + this.code = code; + //to do: check if the exception is declared, and that the entity is of the declared type + WebApplicationException err = new WebApplicationException(Response.status(code).entity(entity) + .header("ETag", tag) + .build()); + throw err; //not optimal + } + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceContext.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceContext.java new file mode 100644 index 00000000000..cd4984e3097 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceContext.java @@ -0,0 +1,17 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +// +// ResourceContext +// +public interface ResourceContext { + public HttpServletRequest request(); + public HttpServletResponse response(); + public void authenticate(); + public void authorize(String action, String resource, String trustedDomain); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceError.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceError.java new file mode 100644 index 00000000000..ddd96536251 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceError.java @@ -0,0 +1,24 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +public class ResourceError { + + public int code; + public String message; + + public ResourceError code(int code) { + this.code = code; + return this; + } + public ResourceError message(String message) { + this.message = message; + return this; + } + + public String toString() { + return "{code: " + code + ", message: \"" + message + "\"}"; + } + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceException.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceException.java new file mode 100644 index 00000000000..4d094b4ee5c --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ResourceException.java @@ -0,0 +1,79 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +public class ResourceException extends RuntimeException { + public final static int OK = 200; + public final static int CREATED = 201; + public final static int ACCEPTED = 202; + public final static int NO_CONTENT = 204; + public final static int MOVED_PERMANENTLY = 301; + public final static int FOUND = 302; + public final static int SEE_OTHER = 303; + public final static int NOT_MODIFIED = 304; + public final static int TEMPORARY_REDIRECT = 307; + public final static int BAD_REQUEST = 400; + public final static int UNAUTHORIZED = 401; + public final static int FORBIDDEN = 403; + public final static int NOT_FOUND = 404; + public final static int CONFLICT = 409; + public final static int GONE = 410; + public final static int PRECONDITION_FAILED = 412; + public final static int UNSUPPORTED_MEDIA_TYPE = 415; + public final static int INTERNAL_SERVER_ERROR = 500; + public final static int NOT_IMPLEMENTED = 501; + + public final static int SERVICE_UNAVAILABLE = 503; + + public static String codeToString(int code) { + switch (code) { + case OK: return "OK"; + case CREATED: return "Created"; + case ACCEPTED: return "Accepted"; + case NO_CONTENT: return "No Content"; + case MOVED_PERMANENTLY: return "Moved Permanently"; + case FOUND: return "Found"; + case SEE_OTHER: return "See Other"; + case NOT_MODIFIED: return "Not Modified"; + case TEMPORARY_REDIRECT: return "Temporary Redirect"; + case BAD_REQUEST: return "Bad Request"; + case UNAUTHORIZED: return "Unauthorized"; + case FORBIDDEN: return "Forbidden"; + case NOT_FOUND: return "Not Found"; + case CONFLICT: return "Conflict"; + case GONE: return "Gone"; + case PRECONDITION_FAILED: return "Precondition Failed"; + case UNSUPPORTED_MEDIA_TYPE: return "Unsupported Media Type"; + case INTERNAL_SERVER_ERROR: return "Internal Server Error"; + case NOT_IMPLEMENTED: return "Not Implemented"; + default: return "" + code; + } + } + + int code; + Object data; + + public ResourceException(int code) { + this(code, new ResourceError().code(code).message(codeToString(code))); + } + + public ResourceException(int code, Object data) { + super("ResourceException (" + code + "): " + data); + this.code = code; + this.data = data; + } + + public int getCode() { + return code; + } + + public Object getData() { + return data; + } + + public T getData(Class cl) { + return cl.cast(data); + } + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/RsrcCtxWrapper.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/RsrcCtxWrapper.java new file mode 100644 index 00000000000..92fa8ffcc6f --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/RsrcCtxWrapper.java @@ -0,0 +1,111 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.KerberosAuthority; +import com.yahoo.athenz.common.server.rest.Http; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +public class RsrcCtxWrapper implements ResourceContext { + + static final String HEADER_NAME_KRB_AUTH = "Authorization"; + static final String HEADER_NAME_WWW_AUTHENTICATE = "WWW-Authenticate"; + static final String HEADER_VALUE_NEGOTIATE = "negotiate"; + + com.yahoo.athenz.common.server.rest.ResourceContext ctx = null; + + public RsrcCtxWrapper(HttpServletRequest request, HttpServletResponse response, Http.AuthorityList authList, Authorizer authorizer) { + ctx = new com.yahoo.athenz.common.server.rest.ResourceContext(request, response, authList, authorizer); + } + + public com.yahoo.athenz.common.server.rest.ResourceContext context() { + return ctx; + } + + public Principal principal() { + return ctx.principal(); + } + + @Override + public HttpServletRequest request() { + return ctx.request(); + } + + @Override + public HttpServletResponse response() { + return ctx.response(); + } + + @Override + public void authenticate() { + try { + ctx.authenticate(); + } catch (com.yahoo.athenz.common.server.rest.ResourceException restExc) { + throwZtsException(restExc); + } + } + + public void authenticateKerberos() { + try { + ctx.authenticate(); + + // we must verify that the authority is the kerberos + // authority responsible for authentication + + if (!(ctx.principal().getAuthority() instanceof KerberosAuthority)) { + throw new com.yahoo.athenz.common.server.rest.ResourceException(com.yahoo.athenz.common.server.rest.ResourceException.UNAUTHORIZED); + } + + } catch (com.yahoo.athenz.common.server.rest.ResourceException restExc) { + + // if the request does not contain kerberos authorization header, + // we're going to add the expected header to the response + + if (ctx.request().getHeader(HEADER_NAME_KRB_AUTH) == null) { + ctx.response().addHeader(HEADER_NAME_WWW_AUTHENTICATE, HEADER_VALUE_NEGOTIATE); + } + + throwZtsException(restExc); + } + } + + @Override + public void authorize(String action, String resource, String trustedDomain) { + try { + ctx.authorize(action, resource, trustedDomain); + } catch (com.yahoo.athenz.common.server.rest.ResourceException restExc) { + throwZtsException(restExc); + } + } + + public void throwZtsException(com.yahoo.athenz.common.server.rest.ResourceException restExc) { + String msg = null; + Object data = restExc.getData(); + if (data instanceof String) { + msg = (String) data; + } + if (msg == null) { + msg = restExc.getMessage(); + } + throw new com.yahoo.athenz.zts.ResourceException(restExc.getCode(), + new ResourceError().code(restExc.getCode()).message(msg)); + } + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTS.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTS.java new file mode 100644 index 00000000000..73e510b380e --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTS.java @@ -0,0 +1,393 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import java.net.InetAddress; +import java.security.PrivateKey; + +import org.eclipse.jetty.server.HttpConfiguration; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.AuthorityKeyStore; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.metrics.MetricFactory; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.rest.Http.AuthorityList; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.CertSignerFactory; +import com.yahoo.athenz.zts.cert.SvcCertStore; +import com.yahoo.athenz.zts.cert.SvcCertStoreFactory; +import com.yahoo.athenz.zts.pkey.PrivateKeyStore; +import com.yahoo.athenz.zts.pkey.PrivateKeyStoreFactory; +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.ChangeLogStoreFactory; +import com.yahoo.athenz.zts.store.CloudStore; +import com.yahoo.athenz.zts.store.DataStore; + +public class ZTS { + + private static final Logger LOG = LoggerFactory.getLogger(ZTS.class); + + static final String ZTS_PRINCIPAL_AUTHORITY_CLASS = "com.yahoo.athenz.auth.impl.PrincipalAuthority"; + static final String ZTS_CHANGE_LOG_STORE_CLASS = "com.yahoo.athenz.zts.store.file.ZMSFileChangeLogStoreFactory"; + static final String ZTS_PKEY_STORE_CLASS = "com.yahoo.athenz.zts.pkey.file.FilePrivateKeyStoreFactory"; + static final String ZTS_CERT_SIGNER_CLASS = "com.yahoo.athenz.zts.cert.impl.YCertSignerFactory"; + static final String ZTS_SVC_CERT_STORE_CLASS = "com.yahoo.athenz.zts.cert.impl.YSvcCertStoreFactory"; + + // This String is used to create the desired AuditLogMsgBuilder object. + // Its OK if its null, we will just get the default msg builder. + // + private static String AUDIT_LOG_MSG_BLDR_CLASS; + + static { + try { + AUDIT_LOG_MSG_BLDR_CLASS = System.getProperty(ZTSConsts.ZTS_PROP_AUDIT_LOG_MSG_BLDR_CLASS); + // test the class to ensure it is valid + try { + @SuppressWarnings("unused") + AuditLogMsgBuilder msgBldr = AuditLogFactory.getMsgBuilder(AUDIT_LOG_MSG_BLDR_CLASS); + } catch (Exception exc) { + LOG.warn("AuditLogMsgBuilder: Cannot instantiate message builder class from=" + + AUDIT_LOG_MSG_BLDR_CLASS + ", therefore will use default log message builder class instead.", exc); + AUDIT_LOG_MSG_BLDR_CLASS = null; + } + } catch (Exception exc) { + LOG.warn("Failed to get the audit log message builder class using property=" + + ZTSConsts.ZTS_PROP_AUDIT_LOG_MSG_BLDR_CLASS + + ", ZTS will use the default log message builder class instead.", exc); + AUDIT_LOG_MSG_BLDR_CLASS = null; + } + } + + private static final AuditLogger AUDITLOG = getAuditLogger(); + + // Creates an AuditLogger + // + static AuditLogger getAuditLogger() { + String auditLoggerClassName = System.getProperty(ZTSConsts.ZTS_PROP_AUDIT_LOGGER_CLASS); + String auditLoggerClassNameParam = System.getProperty(ZTSConsts.ZTS_PROP_AUDIT_LOGGER_CLASS_PARAM); + AuditLogger auditLog = null; + try { + if (auditLoggerClassNameParam != null) { + auditLog = AuditLogFactory.getLogger(auditLoggerClassName, auditLoggerClassNameParam); + } else { + auditLog = AuditLogFactory.getLogger(auditLoggerClassName); + } + } catch (Exception exc) { + LOG.warn("Failed to create audit logger from class=" + + auditLoggerClassName + ", ZTS will use the default logger instead.", exc); + auditLog = AuditLogFactory.getLogger(); + } + return auditLog; + } + + static Authority getAuthority(String className) { + + LOG.debug("Loading authority {}...", className); + + Authority authority = null; + try { + authority = (Authority) Class.forName(className).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid Authority class: " + className + " error: " + e.getMessage()); + return null; + } + return authority; + } + + static String getServerHostName() { + + String serverHostName = System.getProperty(ZTSConsts.ZTS_PROP_HOSTNAME); + if (serverHostName == null || serverHostName.isEmpty()) { + try { + InetAddress localhost = java.net.InetAddress.getLocalHost(); + serverHostName = localhost.getCanonicalHostName(); + } catch (java.net.UnknownHostException e) { + LOG.info("Unable to determine local hostname: " + e.getMessage()); + serverHostName = "localhost"; + } + } + + return serverHostName; + } + + static int getPortNumber(String property, int defaultValue) { + + String propValue = System.getProperty(property); + if (propValue == null) { + return defaultValue; + } + + int port = defaultValue; + try { + + // first try to convert the string property to integer + + port = Integer.parseInt(propValue); + + // now verify that it's a valid port number + + if (port < 0 || port > 65535) { + throw new NumberFormatException(); + } + + } catch (NumberFormatException ex) { + LOG.info("Invalid port: " + propValue + ". Using default port: " + defaultValue); + port = defaultValue; + } + + return port; + } + + static CertSigner getCertSigner() { + + String certSignerFactoryClass = System.getProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS, ZTS_CERT_SIGNER_CLASS); + CertSignerFactory certSignerFactory = null; + try { + certSignerFactory = (CertSignerFactory) Class.forName(certSignerFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid CertSigerFactory class: " + certSignerFactoryClass + + " error: " + e.getMessage()); + return null; + } + + // create our cert signer instance + + return certSignerFactory.create(null); + } + + static SvcCertStore getSvcCertStore(CertSigner certSigner) { + + String svcCertStoreFactoryClass = System.getProperty(ZTSConsts.ZTS_PROP_SVC_CERT_STORE_CLASS, ZTS_SVC_CERT_STORE_CLASS); + SvcCertStoreFactory svcCertStoreFactory = null; + try { + svcCertStoreFactory = (SvcCertStoreFactory) Class.forName(svcCertStoreFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid CertSigerFactory class: " + svcCertStoreFactoryClass + + " error: " + e.getMessage()); + return null; + } + + // create our svc cert store instance + + return svcCertStoreFactory.create(certSigner); + } + + static Metric getMetric() { + + String metricFactoryClass = System.getProperty(ZTSConsts.ZTS_PROP_METRIC_FACTORY_CLASS, ZTSConsts.ZTS_METRIC_FACTORY_CLASS); + boolean statsEnabled = Boolean.parseBoolean(System.getProperty(ZTSConsts.ZTS_PROP_STATS_ENABLED, "false")); + if (!statsEnabled && !metricFactoryClass.equals(ZTSConsts.ZTS_METRIC_FACTORY_CLASS)) { + LOG.warn("Override users metric factory property with default since stats are disabled"); + metricFactoryClass = ZTSConsts.ZTS_METRIC_FACTORY_CLASS; + } + + MetricFactory metricFactory = null; + try { + metricFactory = (MetricFactory) Class.forName(metricFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid MetricFactory class: " + metricFactoryClass + + " error: " + e.getMessage()); + return null; + } + + Metric metric = metricFactory.create(); + if (metric != null) { + metric.increment("zts_startup"); + } + return metric; + } + + static PrivateKeyStore getPrivateKeyStore(String serverHostName) { + + String pkeyFactoryClass = System.getProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY_STORE_CLASS, ZTS_PKEY_STORE_CLASS); + PrivateKeyStoreFactory pkeyFactory = null; + try { + pkeyFactory = (PrivateKeyStoreFactory) Class.forName(pkeyFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid PrivateKeyStoreFactory class: " + pkeyFactoryClass + + " error: " + e.getMessage()); + return null; + } + + return pkeyFactory.create(serverHostName); + } + + + private static ChangeLogStore getChangeLogStore(String homeDir, PrivateKey pkey, String pkeyId, + CloudStore cloudStore) { + + String clogFactoryClass = System.getProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS, ZTS_CHANGE_LOG_STORE_CLASS); + ChangeLogStoreFactory clogFactory = null; + try { + clogFactory = (ChangeLogStoreFactory) Class.forName(clogFactoryClass).newInstance(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException e) { + LOG.error("Invalid ChangeLogStoreFactory class: " + clogFactoryClass + + " error: " + e.getMessage()); + return null; + } + + // create our struct store + + return clogFactory.create(homeDir, pkey, pkeyId, cloudStore); + } + + public static ZTSJettyContainer createJettyContainer() { + + String root = System.getenv("ROOT"); + if (root == null) { + root = "/home/athenz"; + } + + String homeDir = System.getProperty(ZTSConsts.ZTS_PROP_HOME, root + "/var/zts_server"); + + // retrieve our http and https port numbers + + int httpPort = getPortNumber(ZTSConsts.ZTS_PROP_HTTP_PORT, ZTSConsts.ZTS_HTTP_PORT_DEFAULT); + int httpsPort = getPortNumber(ZTSConsts.ZTS_PROP_HTTPS_PORT, ZTSConsts.ZTS_HTTPS_PORT_DEFAULT); + + String serverHostName = getServerHostName(); + + // get our authorities + + String authListConfig = System.getProperty(ZTSConsts.ZTS_PROP_AUTHORITY_CLASSES, ZTS_PRINCIPAL_AUTHORITY_CLASS); + AuthorityList authorities = new AuthorityList(); + + String[] authorityList = authListConfig.split(","); + for (int idx = 0; idx < authorityList.length; idx++) { + Authority authority = getAuthority(authorityList[idx]); + if (authority == null) { + return null; + } + authority.initialize(); + authorities.add(authority); + } + + PrivateKeyStore keyStore = getPrivateKeyStore(serverHostName); + if (keyStore == null) { + return null; + } + + CertSigner certSigner = getCertSigner(); + if (certSigner == null) { + return null; + } + + Metric metric = getMetric(); + if (metric == null) { + return null; + } + + /// extract our official per-host ZTS private key + + StringBuilder privKeyId = new StringBuilder(256); + PrivateKey pkey = keyStore.getHostPrivateKey(privKeyId); + + // create our cloud store if configured + + CloudStore cloudStore = new CloudStore(certSigner); + + // create our SvcCertStore + + SvcCertStore svcCertStore = getSvcCertStore(certSigner); + if (svcCertStore == null) { + return null; + } + + // create our change log store + + ChangeLogStore clogStore = getChangeLogStore(homeDir, pkey, privKeyId.toString(), cloudStore); + if (clogStore == null) { + return null; + } + + // create our data store + + DataStore dataStore = new DataStore(clogStore, cloudStore); + + // Initialize our storage subsystem which would load all data into + // memory and if necessary retrieve the data from ZMS. It will also + // create the thread to monitor for changes from ZMS + + if (!dataStore.init()) { + metric.increment("zts_startup_fail_sum"); + throw new ResourceException(500, "Unable to initialize storage subsystem"); + } + + // create our Jetty container + + ZTSJettyContainer container = new ZTSJettyContainer(AUDITLOG, AUDIT_LOG_MSG_BLDR_CLASS); + container.resource(ZTSResources.class); + + // Create our ZTS impl handler + + ZTSImpl ztsImpl = null; + try { + ztsImpl = new ZTSImpl(serverHostName, dataStore, cloudStore, svcCertStore, metric, + pkey, privKeyId.toString(), AUDITLOG, AUDIT_LOG_MSG_BLDR_CLASS); + ztsImpl.putAuthorityList(authorities); + } catch (Exception ex) { + metric.increment("zts_startup_fail_sum"); + throw ex; + } + container.delegate(new ZTSBinder(ztsImpl)); + + // make sure to set the keystore for any instance that requires it + + for (Authority authority : authorities.getAuthorities()) { + if (AuthorityKeyStore.class.isInstance(authority)) { + ((AuthorityKeyStore) authority).setKeyStore(ztsImpl); + } + } + + Authorizer authorizer = ztsImpl.getAuthorizer(); + container.authorizer(authorizer); + + container.setBanner("http://" + serverHostName + " http port: " + httpPort + " https port: " + httpsPort); + int maxThreads = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_MAX_THREADS, "1024")); + container.createServer(maxThreads); + + HttpConfiguration httpConfig = container.newHttpConfiguration(httpsPort); + container.addHTTPConnectors(httpConfig, httpPort, httpsPort); + container.addServletHandlers(homeDir, serverHostName); + + container.addRequestLogHandler(root); + return container; + } + + public static void main(String [] args) { + + System.getProperties().remove("socksProxyHost"); + + try { + ZTSJettyContainer container = createJettyContainer(); + container.run(null); + + } catch (Exception exc) { + + // log that we are shutting down and re-throw the exception + + LOG.error("Startup failure. Shutting down: " + exc.getMessage()); + throw exc; + } + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSAuthorizer.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSAuthorizer.java new file mode 100644 index 00000000000..52bb562381b --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSAuthorizer.java @@ -0,0 +1,379 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.common.server.util.StringUtils; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zts.cache.DataCache; +import com.yahoo.athenz.zts.store.CloudStore; +import com.yahoo.athenz.zts.store.DataStore; + +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class ZTSAuthorizer implements Authorizer { + + private static final Logger LOGGER = LoggerFactory.getLogger(ZTSAuthorizer.class); + private static final String ASSUME_ROLE = "assume_role"; + final protected DataStore dataStore; + final protected CloudStore cloudStore; + + // enum to represent our access response since in some cases we want to + // handle domain not founds differently instead of just returning failure + + enum AccessStatus { + ALLOWED, + DENIED, + DENIED_DOMAIN_NOT_FOUND, + DENIED_INVALID_ROLE_TOKEN + } + + public ZTSAuthorizer(final DataStore dataStore, final CloudStore cloudStore) { + this.dataStore = dataStore; + this.cloudStore = cloudStore; + } + + @Override + public boolean access(String op, String resource, Principal principal, String trustDomain) { + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + resource = resource.toLowerCase(); + if (trustDomain != null) { + trustDomain = trustDomain.toLowerCase(); + } + op = op.toLowerCase(); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("access:(" + op + ", " + resource + ", " + principal + ", " + trustDomain + ")"); + } + + // check to see if the authority is allowed to be processed in + // authorization checks. If this value is false then the principal + // must get a usertoken from ZMS first and the submit the request + // with that token + + if (!authorityAuthorizationAllowed(principal)) { + LOGGER.error("Authority is not allowed to support authorization checks"); + return false; + } + + // retrieve our domain based on resource and action/trustDomain pair + // we want to provider better error reporting to the users so if we get a + // request where the domain is not found instead of just returning 403 + // forbidden (which is confusing since it assumes the user doesn't have + // access as oppose to possible mistype of the domain name by the user) + // we want to return 404 not found. The rest_core has special handling + // for rest.ResourceExceptions so we'll throw that exception in this + // special case of not found domains. + + String domainName = retrieveResourceDomain(resource, op, trustDomain); + if (domainName == null) { + throw new com.yahoo.athenz.zts.ResourceException(ResourceException.NOT_FOUND, "Domain not found"); + } + DataCache domain = dataStore.getDataCache(domainName); + if (domain == null) { + throw new com.yahoo.athenz.zts.ResourceException(ResourceException.NOT_FOUND, "Domain not found"); + } + + AccessStatus accessStatus = evaluateAccess(domain, principal.getYRN(), op, resource, trustDomain); + if (accessStatus == AccessStatus.ALLOWED) { + return true; + } + + return false; + } + + boolean authorityAuthorizationAllowed(Principal principal) { + + Authority authority = principal.getAuthority(); + if (authority == null) { + return true; + } + + return authority.allowAuthorization(); + } + + String retrieveResourceDomain(String resource, String op, String trustDomain) { + + // special handling for ASSUME_ROLE assertions. Since any assertion with + // that action refers to a resource in another domain, there is no point + // to retrieve the domain name from the resource. In these cases the caller + // must specify the trust domain attribute so we'll use that instead and + // if one is not specified then we'll fall back to using the domain name + // from the resource + + String domainName = null; + if (ASSUME_ROLE.equalsIgnoreCase(op) && trustDomain != null) { + domainName = trustDomain; + } else { + domainName = yrnDomain(resource); + } + return domainName; + } + + AccessStatus evaluateAccess(DataCache domain, String identityYRN, String op, String resource, + String trustDomain) { + + AccessStatus accessStatus = AccessStatus.DENIED; + + List policies = domain.getDomainData().getPolicies().getContents().getPolicies(); + List roles = domain.getDomainData().getRoles(); + + for (com.yahoo.athenz.zms.Policy policy : policies) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("evaluateAccess: processing policy: " + policy.getName()); + } + + // we are going to process all the assertions defined in this + // policy. As soon as we get a match for an assertion that + // denies access, we're going to return that result. If we + // get a match for an assertion that allows access we're + // going to remember that result and continue looking at + // all the assertions in case there is something else that + // explicitly denies access + + List assertions = policy.getAssertions(); + if (assertions == null) { + continue; + } + + for (com.yahoo.athenz.zms.Assertion assertion : assertions) { + + // get the effect for the assertion which is set + // as allowed by default + + com.yahoo.athenz.zms.AssertionEffect effect = assertion.getEffect(); + if (effect == null) { + effect = com.yahoo.athenz.zms.AssertionEffect.ALLOW; + } + + // if we have already matched an allow assertion then + // we'll automatically skip any assertion that has + // allow effect since there is no point of matching it + + if (accessStatus == AccessStatus.ALLOWED && effect == com.yahoo.athenz.zms.AssertionEffect.ALLOW) { + continue; + } + + // if no match then process the next assertion + + if (!assertionMatch(assertion, identityYRN, op, resource, roles, trustDomain)) { + continue; + } + + // if the assertion has matched and the effect is deny + // then we're going to return right away otherwise we'll + // set our return allow matched flag to true and continue + // processing other assertions + + if (effect == com.yahoo.athenz.zms.AssertionEffect.DENY) { + return AccessStatus.DENIED; + } + + accessStatus = AccessStatus.ALLOWED; + } + } + + return accessStatus; + } + + boolean assertionMatch(com.yahoo.athenz.zms.Assertion assertion, String identityYRN, String op, String resource, + List roles, String trustDomain) { + + String opPattern = StringUtils.patternFromGlob(assertion.getAction()); + if (!op.matches(opPattern)) { + return false; + } + + String rezPattern = StringUtils.patternFromGlob(assertion.getResource()); + if (!resource.matches(rezPattern)) { + return false; + } + + String rolePattern = StringUtils.patternFromGlob(assertion.getRole()); + boolean matchResult = matchPrincipal(roles, rolePattern, identityYRN, trustDomain); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("assertionMatch: -> " + matchResult + " (effect: " + assertion.getEffect() + ")"); + } + + return matchResult; + } + + boolean matchPrincipal(List roles, String rolePattern, String fullUser, String trustDomain) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("matchPrincipal: rolePattern: " + rolePattern + " user: " + fullUser + + " trust: " + trustDomain); + } + + for (Role role : roles) { + + String name = role.getName(); + if (!name.matches(rolePattern)) { + continue; + } + + if (matchPrincipalInRole(role, name, fullUser, trustDomain)) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("matchPrincipal: assertionMatch: -> OK (by principal)"); + } + return true; + } + } + return false; + } + + boolean matchPrincipalInRole(Role role, String roleName, String fullUser, String trustDomain) { + + // if we have members in the role then we're going to check + // against that list only + + if (role.getMembers() != null) { + return isMemberOfRole(role, fullUser); + } + + // no members so let's check if this is a trust domain + + String trust = role.getTrust(); + if (!shouldRunDelegatedTrustCheck(trust, trustDomain)) { + return false; + } + + // delegate to another domain. + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("matchPrincipalInRole: [delegated trust. Checking with: " + trust + "]"); + } + + return delegatedTrust(trust, roleName, fullUser); + } + + boolean isMemberOfRole(Role role, String member) { + + if (role.getMembers() == null) { + return false; + } + + Set members = new HashSet(role.getMembers()); + return members.contains(member); + } + + + boolean matchDelegatedTrustAssertion(com.yahoo.athenz.zms.Assertion assertion, String roleName, + String roleMember, List roles) { + + if (!ASSUME_ROLE.equalsIgnoreCase(assertion.getAction())) { + return false; + } + + String rezPattern = StringUtils.patternFromGlob(assertion.getResource()); + if (!roleName.matches(rezPattern)) { + return false; + } + + String rolePattern = StringUtils.patternFromGlob(assertion.getRole()); + for (Role role : roles) { + String name = role.getName(); + if (!name.matches(rolePattern)) { + continue; + } + + if (isMemberOfRole(role, roleMember)) { + return true; + } + } + + return false; + } + + boolean matchDelegatedTrustPolicy(com.yahoo.athenz.zms.Policy policy, String roleName, String roleMember, List roles) { + + List assertions = policy.getAssertions(); + if (assertions == null) { + return false; + } + + for (com.yahoo.athenz.zms.Assertion assertion : assertions) { + if (matchDelegatedTrustAssertion(assertion, roleName, roleMember, roles)) { + return true; + } + } + + return false; + } + + boolean delegatedTrust(String domainName, String roleName, String roleMember) { + + DataCache domain = dataStore.getDataCache(domainName); + if (domain == null) { + return false; + } + + for (com.yahoo.athenz.zms.Policy policy : domain.getDomainData().getPolicies().getContents().getPolicies()) { + if (matchDelegatedTrustPolicy(policy, roleName, roleMember, domain.getDomainData().getRoles())) { + return true; + } + } + + return false; + } + + boolean shouldRunDelegatedTrustCheck(String trust, String trustDomain) { + + // if no trust field field then no delegated trust check + + if (trust == null) { + return false; + } + + // if no specific trust domain specifies then we need + // run the delegated trust check for this domain + + if (trustDomain == null) { + return true; + } + + // otherwise we'll run the delegated trust check only if + // domain name matches + + return trust.equalsIgnoreCase(trustDomain); + } + + String yrnDomain(String yrn) { + // supported format: "domain:entity" + String [] s = yrn.split(":"); + if (s.length <= 2) { + return s[0]; + } else { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("yrnDomain: missing domain name: " + yrn); + } + return null; + } + } + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSBinder.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSBinder.java new file mode 100644 index 00000000000..b6df15b14b5 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSBinder.java @@ -0,0 +1,39 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import org.glassfish.hk2.utilities.binding.AbstractBinder; + +public class ZTSBinder extends AbstractBinder { + private final ZTSImpl ztsImpl; + + public ZTSBinder(final ZTSHandler ztsImpl) { + this.ztsImpl = (ZTSImpl) ztsImpl; + } + + @Override + protected void configure() { + bind(ZTSHandler.class).in(javax.inject.Singleton.class); + bind(ZTSHandler.class.cast(ztsImpl)).to(ZTSHandler.class); + } + + @Override + public String toString() { + StringBuilder sb = new StringBuilder(256); + sb.append("Binder: contains type=").append(ZTSHandler.class).append(" and object=").append(ztsImpl); + return sb.toString(); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSConsts.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSConsts.java new file mode 100644 index 00000000000..bdb904ee8fd --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSConsts.java @@ -0,0 +1,102 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +/** + * Contains constants shared by classes throughout the service. + **/ +public final class ZTSConsts { + // System property names with defaults(where applicable) + + public static final String ZTS_PROP_HTTP_PORT = "athenz.zts.port"; + public static final String ZTS_PROP_HTTPS_PORT = "athenz.zts.tls_port"; + + public static final int ZTS_HTTP_PORT_DEFAULT = 4080; + public static final int ZTS_HTTPS_PORT_DEFAULT = 0; + + public static final String ZTS_PROP_ACCESS_LOG_RETAIN_DAYS = "athenz.zts.access_log_retain_days"; + public static final String ZTS_PROP_SEND_SERVER_VERSION = "athenz.zts.http_send_server_version"; + public static final String ZTS_PROP_SEND_DATE_HEADER = "athenz.zts.http_send_date_header"; + public static final String ZTS_PROP_OUTPUT_BUFFER_SIZE = "athenz.zts.http_output_buffer_size"; + public static final String ZTS_PROP_REQUEST_HEADER_SIZE = "athenz.zts.http_reqeust_header_size"; + public static final String ZTS_PROP_RESPONSE_HEADER_SIZE = "athenz.zts.http_response_header_size"; + public static final String ZTS_PROP_IDLE_TIMEOUT = "athenz.zts.http_idle_timeout"; + public static final String ZTS_PROP_LISTEN_HOST = "athenz.zts.listen_host"; + public static final String ZTS_PROP_KEEP_ALIVE = "athenz.zts.keep_alive"; + public static final String ZTS_PROP_ACCESS_SLF4J_LOGGER = "athenz.zts.access_slf4j_logger"; + public static final String ZTS_PROP_ACCESS_LOG_DIR = "athenz.zts.access_log_dir"; + public static final String ZTS_PROP_ACCESS_LOG_NAME = "athenz.zts.access_log_name"; + public static final String ZTS_PROP_PRIVATE_KEY = "athenz.zts.privatekey"; + public static final String ZTS_PROP_PRIVATE_KEY_ID = "athenz.zts.privatekey_id"; + public static final String ZTS_PROP_PRIVATE_KEY_NAME = "athenz.zts.privatekey_name"; + + public static final String ZTS_PROP_CA_PRIVATE_KEY = "athenz.zts.ca_privatekey"; + public static final String ZTS_PROP_CA_PRIVATE_KEY_PASSWORD = "athenz.zts.ca_privatekey_password"; + public static final String ZTS_PROP_CA_CERTIFICATE = "athenz.zts.ca_certificate"; + + public static final String ZTS_PROP_STATS_ENABLED = "athenz.zts.enable_stats"; + public static final String ZTS_PROP_METRIC_FACTORY_CLASS = "athenz.zts.metric_class"; + + public static final String ZTS_PROP_KEYSTORE_PASSWORD = "athenz.zts.ssl_key_store_password"; + public static final String ZTS_PROP_KEYMANAGER_PASSWORD = "athenz.zts.ssl_key_manager_password"; + public static final String ZTS_PROP_TRUSTSTORE_PASSWORD = "athenz.zts.ssl_trust_store_password"; + public static final String ZTS_PROP_KEYSTORE_PATH = "athenz.zts.ssl_key_store"; + public static final String ZTS_PROP_KEYSTORE_TYPE = "athenz.zts.ssl_key_store_type"; + public static final String ZTS_PROP_TRUSTSTORE_PATH = "athenz.zts.ssl_trust_store"; + public static final String ZTS_PROP_TRUSTSTORE_TYPE = "athenz.zts.ssl_trust_store_type"; + public static final String ZTS_PROP_EXCLUDED_CIPHER_SUITES = "athenz.zts.ssl_excluded_cipher_suites"; + public static final String ZTS_PROP_EXCLUDED_PROTOCOLS = "athenz.zts.ssl_excluded_protocols"; + public static final String ZTS_PROP_DATASTORE_REGEX_CACHE = "athenz.zts.cache.regex.size"; + public static final String ZTS_PROP_WANT_CLIENT_CERT = "athenz.zts.want_client_cert"; + + // properties used to over-ride default Audit logger + // + public static final String ZTS_PROP_AUDIT_LOGGER_CLASS = "athenz.zts.audit_logger_class"; + public static final String ZTS_PROP_AUDIT_LOGGER_CLASS_PARAM = "athenz.zts.audit_logger_class_param"; + public static final String ZTS_PROP_AUDIT_LOG_MSG_BLDR_CLASS = "athenz.zts.audit_log_msg_builder_class"; + + public static final String ZTS_PROP_HOME = "athenz.zts.home"; + public static final String ZTS_PROP_HOSTNAME = "athenz.zts.hostname"; + + public static final String ZTS_PROP_AUTHORITY_CLASSES = "athenz.zts.authority_classes"; + public static final String ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS = "athenz.zts.data_change_log_store_class"; + public static final String ZTS_PROP_PRIVATE_KEY_STORE_CLASS = "athenz.zts.private_key_store_class"; + public static final String ZTS_PROP_CERT_SIGNER_CLASS = "athenz.zts.cert_signer_class"; + public static final String ZTS_PROP_SVC_CERT_STORE_CLASS = "athenz.zts.svc_cert_store_class"; + public static final String ZTS_PROP_MAX_THREADS = "athenz.zts.http_max_threads"; + public static final String ZTS_PROP_LEAST_PRIVILEGE_PRINCIPLE = "athenz.zts.least_privilege_principle"; + + public static final String ZTS_PROP_ROLE_TOKEN_MAX_TIMEOUT = "athenz.zts.role_token_max_timeout"; + public static final String ZTS_PROP_ROLE_TOKEN_DEFAULT_TIMEOUT = "athenz.zts.role_token_default_timeout"; + public static final String ZTS_PROP_SIGNED_POLICY_TIMEOUT = "athenz.zts.signed_policy_timeout"; + public static final String ZTS_PROP_AWS_BOOT_TIME_OFFSET = "athenz.zts.aws_boot_time_offset"; + public static final String ZTS_PROP_SERVICE_TOKEN_TIME_OFFSET = "athenz.zts.service_token_time_offset"; + public static final String ZTS_PROP_AUTHORIZED_PROXY_USERS = "athenz.zts.authorized_proxy_users"; + + public static final String ZTS_PROP_USER_DOMAIN = "athenz.user_domain"; + public static final String ZTS_PROP_ATHENZ_CONF = "athenz.athenz_conf"; + + public static final String ZTS_UNKNOWN_DOMAIN = "unknown_domain"; + public static final String ATHENZ_SYS_DOMAIN = "sys.auth"; + + public static final String STR_DEF_ROOT = "/home/athenz"; + public static final String STR_ENV_ROOT = "ROOT"; + + public static final String ZTS_PROP_AWS_ENABLED = "athenz.zts.aws_enabled"; + + public static final String ZTS_METRIC_FACTORY_CLASS = "com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory"; +} + diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSDaemon.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSDaemon.java new file mode 100644 index 00000000000..0c0f13a57c8 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSDaemon.java @@ -0,0 +1,40 @@ +package com.yahoo.athenz.zts; +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +import org.apache.commons.daemon.Daemon; +import org.apache.commons.daemon.DaemonContext; + +public class ZTSDaemon implements Daemon { + + private String[] args = null; + + public void init(DaemonContext context) throws Exception { + args = context.getArguments(); + } + + public void start() throws Exception { + if (args == null) { + return; + } + ZTS.main(args); + } + + public void stop() throws Exception { + } + + public void destroy() { + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSHandler.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSHandler.java new file mode 100644 index 00000000000..96530a98a65 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSHandler.java @@ -0,0 +1,32 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +import com.yahoo.rdl.*; +import java.util.*; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +// +// ZTSHandler is the interface that the service implementation must implement +// +public interface ZTSHandler { + public ServiceIdentity getServiceIdentity(ResourceContext context, String domainName, String serviceName); + public ServiceIdentityList getServiceIdentityList(ResourceContext context, String domainName); + public PublicKeyEntry getPublicKeyEntry(ResourceContext context, String domainName, String serviceName, String keyId); + public HostServices getHostServices(ResourceContext context, String host); + public void getDomainSignedPolicyData(ResourceContext context, String domainName, String matchingTag, GetDomainSignedPolicyDataResult result); + public RoleToken getRoleToken(ResourceContext context, String domainName, String role, Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); + public Access getAccess(ResourceContext context, String domainName, String roleName, String principal); + public RoleAccess getRoleAccess(ResourceContext context, String domainName, String principal); + public TenantDomains getTenantDomains(ResourceContext context, String providerDomainName, String userName, String roleName, String serviceName); + public Identity postInstanceInformation(ResourceContext context, InstanceInformation info); + public Identity postInstanceRefreshRequest(ResourceContext context, String domain, String service, InstanceRefreshRequest req); + public Identity postAWSInstanceInformation(ResourceContext context, AWSInstanceInformation info); + public Identity postAWSCertificateRequest(ResourceContext context, String domain, String service, AWSCertificateRequest req); + public AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext context, String domainName, String role); + public DomainMetrics postDomainMetrics(ResourceContext context, String domainName, DomainMetrics req); + public Schema getRdlSchema(ResourceContext context); + public ResourceContext newResourceContext(HttpServletRequest request, HttpServletResponse response); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSImpl.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSImpl.java new file mode 100644 index 00000000000..684a2515f54 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSImpl.java @@ -0,0 +1,1609 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import java.nio.charset.StandardCharsets; +import java.security.PrivateKey; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.concurrent.TimeUnit; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.ws.rs.core.EntityTag; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.KeyStore; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.CertificateAuthority; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.rest.Http; +import com.yahoo.athenz.common.server.util.ServletRequestUtil; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zts.cache.DataCache; +import com.yahoo.athenz.zts.cert.SvcCertStore; +import com.yahoo.athenz.zts.store.CloudStore; +import com.yahoo.athenz.zts.store.DataStore; +import com.yahoo.athenz.zts.utils.ZTSUtils; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Schema; +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.Timestamp; +import com.yahoo.rdl.Validator; +import com.yahoo.rdl.Validator.Result; + +/** + * An implementation of ZTS. + */ +public class ZTSImpl implements KeyStore, ZTSHandler { + + protected DataStore dataStore; + protected CloudStore cloudStore; + protected SvcCertStore svcCertStore; + protected Metric metric; + protected Schema schema; + protected PrivateKey privateKey; + protected String privateKeyId = "0"; + protected int roleTokenDefaultTimeout; + protected int roleTokenMaxTimeout; + protected long serviceTokenTimeOffset; + protected long bootTimeOffset; + protected boolean traceAccess = true; + protected long signedPolicyTimeout; + protected String serverHostName = null; + protected AuditLogger auditLogger = null; + protected String auditLoggerMsgBldrClass = null; + protected String serverHttpsPort = null; + protected String serverHttpPort = null; + protected String userDomain = "user"; + protected boolean leastPrivilegePrincipal = false; + protected Set authorizedProxyUsers = null; + + private static final String ATTR_ACCOUNT_ID = "accountId"; + private static final String ATTR_PENDING_TIME = "pendingTime"; + + private static final String TYPE_DOMAIN_NAME = "DomainName"; + private static final String TYPE_SIMPLE_NAME = "SimpleName"; + private static final String TYPE_ENTITY_NAME = "EntityName"; + private static final String TYPE_SERVICE_NAME = "ServiceName"; + private static final String TYPE_INSTANCE_INFO = "InstanceInformation"; + private static final String TYPE_AWS_INSTANCE_INFO = "AWSInstanceInformation"; + private static final String TYPE_AWS_CERT_REQUEST = "AWSCertificateRequest"; + private static final String TYPE_INSTANCE_REFRESH_REQUEST = "InstanceRefreshRequest"; + private static final String TYPE_DOMAIN_METRICS = "DomainMetrics"; + + private static final String ZTS_ROLE_TOKEN_VERSION = "Z1"; + + private static final long ZTS_NTOKEN_DEFAULT_EXPIRY = TimeUnit.SECONDS.convert(2, TimeUnit.HOURS); + private static final long ZTS_NTOKEN_MAX_EXPIRY = TimeUnit.SECONDS.convert(7, TimeUnit.DAYS); + + // HTTP operation types used in metrics + private static final String HTTP_GET = "GET"; + private static final String HTTP_POST = "POST"; + private static final String HTTP_REQUEST = "REQUEST"; + + // domain metrics prefix + private static final String DOM_METRIX_PREFIX = "dom_metric_"; + + private static final Logger LOGGER = LoggerFactory.getLogger(ZTSImpl.class); + + protected Http.AuthorityList authorities = null; + private final ZTSAuthorizer authorizer; + protected static Validator validator; + + public ZTSImpl(String serverHostName, DataStore dataStore, CloudStore cloudStore, SvcCertStore svcCertStore, + Metric metric, PrivateKey privateKey, String privateKeyId, + AuditLogger auditLog, String auditLogMsgBldrClass) { + + this.schema = ZTSSchema.instance(); + validator = new Validator(schema); + + this.dataStore = dataStore; + this.cloudStore = cloudStore; + this.svcCertStore = svcCertStore; + this.metric = metric; + this.privateKey = privateKey; + this.privateKeyId = privateKeyId; + this.serverHostName = serverHostName; + this.userDomain = System.getProperty(ZTSConsts.ZTS_PROP_USER_DOMAIN, "user"); + + auditLogger = auditLog; + auditLoggerMsgBldrClass = auditLogMsgBldrClass; + + // check to see if we want to disable allowing clients to ask for role + // tokens without role name thus violating the least privilege principle + + leastPrivilegePrincipal = Boolean.parseBoolean(System.getProperty(ZTSConsts.ZTS_PROP_LEAST_PRIVILEGE_PRINCIPLE, "false")); + + // Default Role Token timeout is 2 hours. If the client asks for role tokens + // with a min expiry time of 1 hour, the setting of 2 hours allows the client + // to at least cache the tokens for 1 hour. We're going to set the ZTS client's + // min default value to 15 mins so that we can by default cache tokens for + // an hour and 45 minutes. + + long timeout = TimeUnit.SECONDS.convert(2, TimeUnit.HOURS); + this.roleTokenDefaultTimeout = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_DEFAULT_TIMEOUT, Long.toString(timeout))); + + // Max Timeout - 30 days + + timeout = TimeUnit.SECONDS.convert(30, TimeUnit.DAYS); + this.roleTokenMaxTimeout = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_MAX_TIMEOUT, Long.toString(timeout))); + + // signedPolicyTimeout is in milliseconds but the config setting should be in seconds + // to be consistent with other configuration properties + + timeout = TimeUnit.SECONDS.convert(7, TimeUnit.DAYS); + this.signedPolicyTimeout = 1000 * Long.parseLong(System.getProperty(ZTSConsts.ZTS_PROP_SIGNED_POLICY_TIMEOUT, Long.toString(timeout))); + + // bootTimeOffset is in milliseconds but the config setting should be in seconds + // to be consistent with other configuration properties + + timeout = TimeUnit.SECONDS.convert(5, TimeUnit.MINUTES); + this.bootTimeOffset = 1000 * Long.parseLong(System.getProperty(ZTSConsts.ZTS_PROP_AWS_BOOT_TIME_OFFSET, Long.toString(timeout))); + + // when requesting service tokens on behalf of tenants, the provisioner's + // token must be fresh and generated with specified number of seconds + + timeout = TimeUnit.SECONDS.convert(5, TimeUnit.MINUTES); + this.serviceTokenTimeOffset = Long.parseLong(System.getProperty(ZTSConsts.ZTS_PROP_SERVICE_TOKEN_TIME_OFFSET, Long.toString(timeout))); + + serverHttpsPort = System.getProperty(ZTSConsts.ZTS_PROP_HTTPS_PORT, Integer.toString(ZTSConsts.ZTS_HTTPS_PORT_DEFAULT)); + serverHttpPort = System.getProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, Integer.toString(ZTSConsts.ZTS_HTTP_PORT_DEFAULT)); + + // retrieve the list of our authorized proxy users + + String authorizedProxyUserList = System.getProperty(ZTSConsts.ZTS_PROP_AUTHORIZED_PROXY_USERS); + if (authorizedProxyUserList != null) { + authorizedProxyUsers = new HashSet<>(Arrays.asList(authorizedProxyUserList.split(","))); + } + + this.authorizer = new ZTSAuthorizer(dataStore, cloudStore); + } + + public void putAuthorityList(Http.AuthorityList authList) { + authorities = authList; + } + + AuditLogMsgBuilder getAuditLogMsgBuilder(ResourceContext ctx, String domainName, String caller, String method) { + AuditLogMsgBuilder msgBldr; + try { + msgBldr = AuditLogFactory.getMsgBuilder(auditLoggerMsgBldrClass); + } catch (Exception exc) { + LOGGER.error("getAuditLogMsgBuilder: failed to get an AuditLogMsgBuilder. Get the default instead.", exc); + msgBldr = AuditLogFactory.getMsgBuilder(); + } + + // get the where - which means where this server is running + msgBldr.whereIp(serverHostName).whereHttpsPort(serverHttpsPort).whereHttpPort(serverHttpPort); + + msgBldr.whatDomain(domainName).whatApi(caller).whatMethod(method); + + // get the 'who' and set it + // + if (ctx != null) { + Principal princ = ((RsrcCtxWrapper) ctx).principal(); + if (princ != null) { + String unsignedCreds = princ.getUnsignedCredentials(); + if (unsignedCreds == null) { + StringBuilder sb = new StringBuilder(); + sb.append("who-name=").append(princ.getName()); + sb.append(",who-domain=").append(princ.getDomain()); + sb.append(",who-yrn=").append(princ.getYRN()); + List roles = princ.getRoles(); + if (roles != null && roles.size() > 0) { + sb.append(",who-roles=").append(roles.toString()); + } + unsignedCreds = sb.toString(); + } + msgBldr.who(unsignedCreds); + } + + // get the client IP + // + msgBldr.clientIp(ServletRequestUtil.getRemoteAddress(ctx.request())); + } + + return msgBldr; + } + + @Override + public String getPublicKey(String domain, String service, String keyId) { + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + if (domain != null) { + domain = domain.toLowerCase(); + } + if (service != null) { + service = service.toLowerCase(); + } + if (keyId != null) { + keyId = keyId.toLowerCase(); + } + + return dataStore.getPublicKey(domain, service, keyId); + } + + /** + * @return the ZTS Schema object, describing its API and types. + */ + public Schema schema() { + return schema; + } + + ServiceIdentity generateZTSServiceIdentity(com.yahoo.athenz.zms.ServiceIdentity zmsService) { + + // zms and zts are using the same definition for service identities but + // due to RDL generated code they have different classes. So we're going + // convert our ZMS Service object into a struct and then back to ZTS object + + ServiceIdentity ztsService = new ServiceIdentity() + .setName(zmsService.getName()) + .setExecutable(zmsService.getExecutable()) + .setGroup(zmsService.getGroup()) + .setHosts(zmsService.getHosts()) + .setModified(zmsService.getModified()) + .setProviderEndpoint(zmsService.getProviderEndpoint()) + .setUser(zmsService.getUser()); + List zmsPublicKeys = zmsService.getPublicKeys(); + if (zmsPublicKeys != null) { + ArrayList ztsPublicKeys = new ArrayList<>(); + for (com.yahoo.athenz.zms.PublicKeyEntry zmsPublicKey : zmsPublicKeys) { + PublicKeyEntry ztsPublicKey = new PublicKeyEntry() + .setId(zmsPublicKey.getId()) + .setKey(zmsPublicKey.getKey()); + ztsPublicKeys.add(ztsPublicKey); + } + ztsService.setPublicKeys(ztsPublicKeys); + } + + return ztsService; + } + + String generateServiceIdentityName(String domain, String service) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append("."); + str.append(service); + return str.toString(); + } + + ServiceIdentity lookupServiceIdentity(DomainData domainData, String serviceName) { + + List services = domainData.getServices(); + if (services == null) { + return null; + } + + for (com.yahoo.athenz.zms.ServiceIdentity service : services) { + if (service.getName().equalsIgnoreCase(serviceName)) { + ServiceIdentity ztsService = generateZTSServiceIdentity(service); + return ztsService; + } + } + + return null; + } + + // ----------------- the ServiceIdentity interface + + public ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName) { + + final String caller = "getserviceidentity"; + final String callerTiming = "getserviceidentity_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domainName); + DomainData domainData = dataStore.getDomainData(domainName); + if (domainData == null) { + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + throw notFoundError("Domain not found: '" + domainName + "'", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // update our metric with dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + String cnService = generateServiceIdentityName(domainName, serviceName); + ServiceIdentity ztsService = lookupServiceIdentity(domainData, cnService); + + if (ztsService == null) { + throw notFoundError("Service not found: '" + cnService + "'", caller, domainName); + } + + metric.stopTiming(timerMetric); + return ztsService; + } + + public PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName, String serviceName, String keyId) { + + final String caller = "getpublickeyentry"; + final String callerTiming = "getpublickeyentry_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(serviceName, TYPE_SIMPLE_NAME, caller); + + if (keyId == null) { + throw requestError("Invalid Public Key Id specified", caller, domainName); + } + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domainName = domainName.toLowerCase(); + serviceName = serviceName.toLowerCase(); + keyId = keyId.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domainName); + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + String publicKey = dataStore.getPublicKey(domainName, serviceName, keyId); + if (publicKey == null) { + throw notFoundError("Public Key not found", caller, domainName); + } + + PublicKeyEntry entry = new PublicKeyEntry().setId(keyId) + .setKey(Crypto.ybase64(publicKey.getBytes(StandardCharsets.UTF_8))); + metric.stopTiming(timerMetric); + return entry; + } + + void addServiceNameToList(String fullName, String prefix, List names) { + + if (!fullName.startsWith(prefix)) { + return; + } + + names.add(fullName.substring(prefix.length())); + } + + public ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName) { + + final String caller = "getserviceidentitylist"; + final String callerTiming = "getserviceidentitylist_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + domainName = domainName.toLowerCase(); + Object timerMetric = metric.startTiming(callerTiming, domainName); + + DomainData domainData = dataStore.getDomainData(domainName); + if (domainData == null) { + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + throw notFoundError("Domain not found: '" + domainName + "'", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // update our metric with dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + List names = new ArrayList(); + String prefix = domainName + "."; + + ServiceIdentityList result = new ServiceIdentityList(); + List services = domainData.getServices(); + if (services != null) { + for (com.yahoo.athenz.zms.ServiceIdentity service : services) { + addServiceNameToList(service.getName(), prefix, names); + } + result.setNames(names); + } + + metric.stopTiming(timerMetric); + return result; + } + + public HostServices getHostServices(ResourceContext ctx, String host) { + + final String caller = "gethostservices"; + final String callerTiming = "gethostservices_timing"; + metric.increment(HTTP_GET); + metric.increment(HTTP_REQUEST); + metric.increment(caller); + Object timerMetric = metric.startTiming(callerTiming, null); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + host = host.toLowerCase(); + HostServices result = dataStore.getHostServices(host); + + metric.stopTiming(timerMetric); + return result; + } + + List getPolicyList(DomainData domainData) { + + ArrayList ztsPolicies = new ArrayList<>(); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = domainData.getPolicies(); + if (signedPolicies == null) { + return ztsPolicies; + } + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = signedPolicies.getContents(); + if (domainPolicies == null) { + return ztsPolicies; + } + + List zmsPolicies = domainPolicies.getPolicies(); + if (zmsPolicies == null) { + return ztsPolicies; + } + + for (com.yahoo.athenz.zms.Policy zmsPolicy : zmsPolicies) { + Policy ztsPolicy = new Policy() + .setModified(zmsPolicy.getModified()) + .setName(zmsPolicy.getName()); + + List zmsAssertions = zmsPolicy.getAssertions(); + if (zmsAssertions != null) { + ArrayList ztsAssertions = new ArrayList<>(); + for (com.yahoo.athenz.zms.Assertion zmsAssertion : zmsAssertions) { + Assertion ztsAssertion = new Assertion() + .setAction(zmsAssertion.getAction()) + .setResource(zmsAssertion.getResource()) + .setRole(zmsAssertion.getRole()); + + if (zmsAssertion.getEffect() != null + && zmsAssertion.getEffect() == com.yahoo.athenz.zms.AssertionEffect.DENY) { + ztsAssertion.setEffect(AssertionEffect.DENY); + } else { + ztsAssertion.setEffect(AssertionEffect.ALLOW); + } + ztsAssertions.add(ztsAssertion); + } + ztsPolicy.setAssertions(ztsAssertions); + } + ztsPolicies.add(ztsPolicy); + } + + return ztsPolicies; + } + + public void getDomainSignedPolicyData(ResourceContext context, String domainName, + String matchingTag, GetDomainSignedPolicyDataResult signedPoliciesResult) { + + final String caller = "getdomainsignedpolicydata"; + final String callerTiming = "getdomainsignedpolicydata_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + domainName = domainName.toLowerCase(); + Object timerMetric = metric.startTiming(callerTiming, domainName); + + DomainData domainData = dataStore.getDomainData(domainName); + if (domainData == null) { + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + throw notFoundError("Domain not found: '" + domainName + "'", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // update our metric with dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + Timestamp modified = domainData.getModified(); + EntityTag eTag = new EntityTag(modified.toString()); + String tag = eTag.toString(); + + // Set timestamp for domain rather than youngest policy. + // Since a policy could have been deleted, and can only be detected + // via the domain modified timestamp. + + if (matchingTag != null && matchingTag.equals(tag)) { + signedPoliciesResult.done(304, matchingTag); + } + + // first get our PolicyData object + + PolicyData policyData = new PolicyData() + .setDomain(domainName) + .setPolicies(getPolicyList(domainData)); + + // then get the signed policy data + + Timestamp expires = Timestamp.fromMillis(System.currentTimeMillis() + signedPolicyTimeout); + + SignedPolicyData signedPolicyData = new SignedPolicyData() + .setPolicyData(policyData) + .setExpires(expires) + .setModified(modified) + .setZmsKeyId(domainData.getPolicies().getKeyId()) + .setZmsSignature(domainData.getPolicies().getSignature()); + + String signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData), privateKey); + DomainSignedPolicyData result = new DomainSignedPolicyData() + .setSignedPolicyData(signedPolicyData) + .setSignature(signature) + .setKeyId(privateKeyId); + + metric.stopTiming(timerMetric); + signedPoliciesResult.done(200, result, tag); + } + + String convertEmptyStringToNull(String value) { + + if (value != null && value.length() == 0) { + return null; + } else { + return value; + } + } + + long determineTokenTimeout(Integer minExpiryTime, Integer maxExpiryTime) { + + // we're going to default our return value to the default token + // timeout configured in the server + + long tokenTimeout = roleTokenDefaultTimeout; + + if (maxExpiryTime != null && maxExpiryTime > 0) { + + // if our max expiry time is given and it's a positive number then + // we return that value as our result. We're checking and using the + // max value first since that allows the biggest opportunity on the + // client side to cache the token and return on subsequent requests + + tokenTimeout = maxExpiryTime; + + } else if (minExpiryTime != null && minExpiryTime > roleTokenDefaultTimeout) { + + // now we return the min value but only if it's bigger than our + // default value (if the client is looking for a token that's smaller + // than the default timeout, then they would have specified their + // desired smaller value as the max timeout and the first if block + // would have set accordingly. + + tokenTimeout = minExpiryTime; + } + + // however, we're not going to allow the client to ask for unlimited + // tokens so we'll max it out to the server's configured max timeout + + if (tokenTimeout > roleTokenMaxTimeout) { + tokenTimeout = roleTokenMaxTimeout; + } + + return tokenTimeout; + } + + public TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName, + String userName, String roleName, String serviceName) { + + final String caller = "gettenantdomains"; + final String callerTiming = "gettenantdomains_timing"; + metric.increment(HTTP_GET); + + validate(providerDomainName, TYPE_DOMAIN_NAME, caller); + validate(userName, TYPE_ENTITY_NAME, caller); + if (roleName != null) { + validate(roleName, TYPE_ENTITY_NAME, caller); + } + if (serviceName != null) { + validate(serviceName, TYPE_SERVICE_NAME, caller); + } + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + providerDomainName = providerDomainName.toLowerCase(); + userName = userName.toLowerCase(); + if (roleName != null) { + roleName = roleName.toLowerCase(); + } + if (serviceName != null) { + serviceName = serviceName.toLowerCase(); + } + + // first retrieve our domain data object from the cache + + Object timerMetric = metric.startTiming(callerTiming, providerDomainName); + DataCache data = dataStore.getDataCache(providerDomainName); + if (data == null) { + // just increment the request counter without any dimension + // we don't want to get persistent indexes for invalid domains + + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + LOGGER.error("getTenantDomains: Unknown provider domain: " + providerDomainName); + throw notFoundError("getTenantDomains: No such provider domain: " + providerDomainName, + caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // update our metric with dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(HTTP_REQUEST, providerDomainName); + metric.increment(caller, providerDomainName); + + // process our request and retrieve the roles for the principal + + ArrayList roles = new ArrayList<>(); + + // if the username does not contain a domain then we'll assume + // user domain and handle accordingly + + if (userName.indexOf('.') == -1) { + userName = this.userDomain + "." + userName; + } + + dataStore.getAccessibleRoles(data, providerDomainName, userName, + roleName, roles, false); + + // we are going to process the list and only keep the tenant + // domains - this is based on the role names since our tenant + // roles are named: .tenant..[.] + + Set domainNames = new HashSet<>(); + for (String role : roles) { + + String domainName = retrieveTenantDomainName(role, serviceName); + if (domainName != null) { + domainNames.add(domainName); + } + } + + TenantDomains tenantDomains = new TenantDomains(); + tenantDomains.setTenantDomainNames(new ArrayList(domainNames)); + + metric.stopTiming(timerMetric); + return tenantDomains; + } + + String retrieveTenantDomainName(String roleName, String serviceName) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("retrieveTenantDomainName: Processing role name: " + roleName); + } + + // roles are named: .tenant..[.] + // so we're going to do the easy checks first + // check 1: we must have at least 4 components + + String[] comps = roleName.split("\\."); + if (comps.length < 4) { + return null; + } + + // check 2: our second component must be the word tenant + + if (!comps[1].equals("tenant")) { + return null; + } + + // check 3: if service name is given, it must be the first component + + if (serviceName != null && !comps[0].equals(serviceName)) { + return null; + } + + // if we have 4 components then component 3 is the domain name + + if (comps.length == 4) { + + // verify it's a valid domain name before returning + + if (dataStore.getDataCache(comps[2]) == null) { + return null; + } + + return comps[2]; + } + + // so if we have more components than 4 then we have two + // choices to deal with: with and without resource groups + // first let's generate into two strings - one assuming + // to be the resource group + + String resourceGroup = comps[comps.length - 2]; + StringBuffer domainNameBuf = new StringBuffer(512).append(comps[2]); + for (int i = 3; i < comps.length - 2; i++) { + domainNameBuf.append('.').append(comps[i]); + } + + // first we're going to assume the resource group as part + // of the domain name and see if that domain exists + + String fullDomainName = domainNameBuf.toString() + "." + resourceGroup; + if (dataStore.getDataCache(fullDomainName) != null) { + return fullDomainName; + } + + // now let's try without the resource group part + + fullDomainName = domainNameBuf.toString(); + if (dataStore.getDataCache(fullDomainName) != null) { + return fullDomainName; + } + + // we didn't have valid domain + + return null; + } + + boolean isAuthorizedProxyUser(Set proxyUsers, String principal) { + if (proxyUsers == null) { + return false; + } + return proxyUsers.contains(principal); + } + + // Token interface + public RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleName, + Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal) { + + final String caller = "getroletoken"; + final String callerTiming = "getroletoken_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + if (roleName != null && !roleName.isEmpty()) { + validate(roleName, TYPE_ENTITY_NAME, caller); + } + if (proxyForPrincipal != null && !proxyForPrincipal.isEmpty()) { + validate(proxyForPrincipal, TYPE_ENTITY_NAME, caller); + } + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + domainName = domainName.toLowerCase(); + if (roleName != null) { + roleName = roleName.toLowerCase(); + } + + Object timerMetric = metric.startTiming(callerTiming, domainName); + + // get our principal's name + + String principal = ((RsrcCtxWrapper) ctx).principal().getYRN(); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getRoleToken(domain: " + domainName + ", principal: " + principal + + ", role-name: " + roleName + ", proxy-for: " + proxyForPrincipal + ")"); + } + + // do not allow empty (not null) values for role + + roleName = convertEmptyStringToNull(roleName); + proxyForPrincipal = convertEmptyStringToNull(proxyForPrincipal); + + if (leastPrivilegePrincipal && roleName == null) { + LOGGER.error("getRoleToken: Principal: " + principal + + " requested a role token without the required roleName"); + throw requestError("getRoleToken: Client must specify a roleName to request a token for", + caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // we can only have a proxy for principal request if the original + // caller is authorized for such operations + + if (proxyForPrincipal != null && !isAuthorizedProxyUser(authorizedProxyUsers, principal)) { + LOGGER.error("getRoleToken: Principal: " + principal + + " not authorized for proxy role token request"); + throw forbiddenError("getRoleToken: Principal: " + principal + + " not authorized for proxy role token request", caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + StringBuilder auditLogDetails = new StringBuilder(512); + auditLogDetails.append("RoleName=").append(roleName); + AuditLogMsgBuilder msgBldr = getAuditLogMsgBuilder(ctx, domainName, caller, HTTP_GET); + msgBldr.when(Timestamp.fromCurrentTime().toString()). + whatEntity("RoleToken").why("zts-audit"); + + // first retrieve our domain data object from the cache + + DataCache data = dataStore.getDataCache(domainName); + if (data == null) { + // just increment the request counter without any dimension + // we don't want to get persistent indexes for invalid domains + + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + + // create our audit log entry + + auditLogDetails.append(",ERROR=(No Such Domain)"); + msgBldr.whatDetails(auditLogDetails.toString()); + if (auditLogger != null) { + auditLogger.log(msgBldr); + } else { + LOGGER.error(msgBldr.toString()); + } + LOGGER.error("getRoleToken: Principal: " + principal + + " requested a role token for an unknown domain: " + domainName); + throw notFoundError("getRoleToken: No such domain: " + domainName, caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // update our metric with dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + // process our request and retrieve the roles for the principal + + ArrayList roles = new ArrayList<>(); + dataStore.getAccessibleRoles(data, domainName, principal, roleName, + roles, false); + + if (roles.isEmpty()) { + auditLogDetails.append(",ERROR=(Principal Has No Access to Domain)"); + msgBldr.whatDetails(auditLogDetails.toString()); + if (auditLogger != null) { + auditLogger.log(msgBldr); + } else { + LOGGER.error(msgBldr.toString()); + } + LOGGER.error("getRoleToken: Principal: " + principal + + " has no acccess to any roles in domain: " + domainName); + throw forbiddenError("getRoleToken: No access to any roles in domain: " + domainName, + caller, domainName); + } + + // if this is proxy for operation then we want to make sure that + // both principals have access to the same set of roles otherwise + // we're not going to issue a roletoken with an updated principal + // field + + String proxyUser = null; + if (proxyForPrincipal != null) { + ArrayList rolesForProxy = new ArrayList<>(); + dataStore.getAccessibleRoles(data, domainName, proxyForPrincipal, roleName, rolesForProxy, false); + if (!compareRoleLists(roles, rolesForProxy)) { + throw forbiddenError("getRoleToken: Principal does not have access to the same set of roles as proxy principal", + caller, domainName); + } + + // we need to switch our principal and proxy for user + + proxyUser = principal; + principal = proxyForPrincipal; + } + + long tokenTimeout = determineTokenTimeout(minExpiryTime, maxExpiryTime); + com.yahoo.athenz.auth.token.RoleToken token = + new com.yahoo.athenz.auth.token.RoleToken.Builder(ZTS_ROLE_TOKEN_VERSION, domainName, roles) + .expirationWindow(tokenTimeout).host(serverHostName).keyId(privateKeyId) + .principal(principal).ip(ServletRequestUtil.getRemoteAddress(ctx.request())) + .proxyUser(proxyUser).domainCompleteRoleSet(roleName == null).build(); + token.sign(privateKey); + + RoleToken roleToken = new RoleToken(); + roleToken.setToken(token.getSignedToken()); + roleToken.setExpiryTime(token.getExpiryTime()); + + auditLogDetails.append(",SUCCESS ROLETOKEN=(").append(token.getUnsignedToken()).append(")"); + msgBldr.whatDetails(auditLogDetails.toString()); + if (auditLogger != null) { + auditLogger.log(msgBldr); + } else { + LOGGER.error(msgBldr.toString()); + } + + metric.stopTiming(timerMetric); + return roleToken; + } + + boolean compareRoleLists(List list1, List list2) { + + if (list1.size() != list2.size()) { + LOGGER.error("Role lists do not have the same size: " + list1.size() + " vs. " + list2.size()); + return false; + } + + Set set2 = new HashSet<>(list2); + for (String item : list1) { + if (!set2.contains(item)) { + return false; + } + } + + return true; + } + + public RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal) { + + final String caller = "getroleaccess"; + final String callerTiming = "getroleaccess_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(principal, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + domainName = domainName.toLowerCase(); + principal = principal.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domainName); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getRoleAccess(domain: " + domainName + ", principal: " + principal + ")"); + } + + // first retrieve our domain data object from the cache + + DataCache data = dataStore.getDataCache(domainName); + if (data == null) { + // just increment the request counter without any dimension + // we don't want to get persistent indexes for invalid domains + + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + + LOGGER.error("getRoleAccess: Principal: " + principal + + " requested role access for an unknown domain: " + domainName); + throw notFoundError("getRoleAccess: No such domain: " + domainName, + caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // update our metric with dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + // process our request and retrieve the roles for the principal + + ArrayList roles = new ArrayList<>(); + dataStore.getAccessibleRoles(data, domainName, principal, null, + roles, false); + + RoleAccess roleAccess = new RoleAccess().setRoles(roles); + metric.stopTiming(timerMetric); + return roleAccess; + } + + public AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName, + String roleName) { + + final String caller = "getawstemporarycredentials"; + final String callerTiming = "getawstemporarycredentials_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domainName); + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getAWSTemporaryCredentials(domain: " + domainName + ", role: " + roleName + ")"); + } + + if (!cloudStore.isAwsEnabled()) { + throw requestError("getAWSTemporaryCredentials: AWS support is not available", + caller, domainName); + } + + // get our principal's name + + String principal = ((RsrcCtxWrapper) ctx).principal().getYRN(); + + String roleResource = domainName + ":" + roleName; + + // we need to first verify that our principal is indeed configured + // with aws assume role assertion for the specified role and domain + + if (!verifyAWSAssumeRole(domainName, roleResource, principal)) { + throw forbiddenError("getAWSTemporaryCredentials: Forbidden (ASSUME_AWS_ROLE on " + + roleResource + " for " + principal + ")", caller, domainName); + } + + // now need to get the associated AWS account for the domain name + + String account = cloudStore.getAWSAccount(domainName); + if (account == null) { + throw requestError("getAWSTemporaryCredentials: unable to retrieve AWS account for: " + + domainName, caller, domainName); + } + + // obtain the credentials from the cloud store + + AWSTemporaryCredentials creds = cloudStore.assumeAWSRole(account, roleName, principal); + if (creds == null) { + throw requestError("getAWSTemporaryCredentials: unable to assume role " + roleName + + " in domain " + domainName + " for principal " + principal, caller, domainName); + } + + metric.stopTiming(timerMetric); + return creds; + } + + boolean verifyAWSAssumeRole(String domainName, String roleResource, String principal) { + + // first retrieve our domain data object from the cache + + DataCache data = dataStore.getDataCache(domainName); + if (data == null) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("verifyAWSAssumeRole: unknown domain: " + domainName); + } + return false; + } + + // retrieve the roles for the principal + + ArrayList roles = new ArrayList<>(); + dataStore.getAccessibleRoles(data, domainName, principal, null, roles, true); + + if (roles.isEmpty()) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("verifyAWSAssumeRole: Principal: " + principal + + " has no acccess to any roles in domain: " + domainName); + } + return false; + } + + // check to see if any of the roles give access to the specified resource + + Set awsResourceSet = null; + for (String role : roles) { + awsResourceSet = data.getAWSResourceRoleSet(role); + if (awsResourceSet != null && awsResourceSet.contains(roleResource)) { + return true; + } + } + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("verifyAWSAssumeRole: Principal: " + principal + + " has no acccess to resource: " + roleResource + " in domain: " + domainName); + } + + return false; + } + + @Override + public Identity postAWSInstanceInformation(ResourceContext context, AWSInstanceInformation info) { + + final String caller = "postawsinstanceinformation"; + final String callerTiming = "postawsinstanceinformation_timing"; + metric.increment(HTTP_POST); + + validate(info, TYPE_AWS_INSTANCE_INFO, caller); + + Object timerMetric = metric.startTiming(callerTiming, info.getDomain()); + metric.increment(HTTP_REQUEST, info.getDomain()); + metric.increment(caller, info.getDomain()); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("postAWSInstanceInformation: " + info); + } + + if (!cloudStore.isAwsEnabled()) { + throw requestError("postAWSInstanceInformation: AWS support is not available", + caller, info.getDomain()); + } + + // verify we have a valid aws enabled domain + + String account = cloudStore.getAWSAccount(info.getDomain()); + if (account == null) { + throw requestError("postAWSInstanceInformation: unable to retrieve AWS account for: " + + info.getDomain(), caller, info.getDomain()); + } + + // verify the domain account and the account in the info + // object do match + + if (!account.equalsIgnoreCase(info.getAccount())) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("postAWSInstanceInformation: ZTS domain account lookup: " + account); + LOGGER.debug("postAWSInstanceInformation: Instance Information account: " + info.getAccount()); + } + throw requestError("postAWSInstanceInformation: mismatch between account values: " + + " domain lookup: " + account + " vs. instance info: " + info.getAccount(), + caller, info.getDomain()); + } + + // we need to validate the instance document + + if (!cloudStore.validateInstanceDocument(info.getDocument(), info.getSignature())) { + throw requestError("postAWSInstanceInformation: unable to validate instance document", + caller, info.getDomain()); + } + + // convert our document into a struct that we can extract data + + Struct instanceDocument = null; + try { + instanceDocument = JSON.fromString(info.getDocument(), Struct.class); + } catch (Exception ex) { + LOGGER.error("postAWSInstanceInformation: failed to parse: " + info.getDocument() + + " error: " + ex.getMessage()); + } + + if (instanceDocument == null) { + throw requestError("postAWSInstanceInformation: unable to parse instance document", + caller, info.getDomain()); + } + + // verify that the account lookup and the account in the document match + + String docAccount = instanceDocument.getString(ATTR_ACCOUNT_ID); + if (!account.equalsIgnoreCase(docAccount)) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("postAWSInstanceInformation: ZTS domain account lookup: " + account); + LOGGER.debug("postAWSInstanceInformation: Instance document account: " + docAccount); + } + throw requestError("postAWSInstanceInformation: mismatch between account values: " + + " domain lookup: " + account + " vs. instance document: " + docAccount, + caller, info.getDomain()); + } + + // verify that the boot up time for the instance is now + + Timestamp bootTime = instanceDocument.getTimestamp(ATTR_PENDING_TIME); + if (bootTime.millis() < System.currentTimeMillis() - bootTimeOffset) { + throw forbiddenError("postAWSInstanceInformation: instance boot time is not recent enough", + caller, info.getDomain()); + } + + // verify that the temporary credentials specified in the request + // can be used to assume the given role thus verifying the + // instance identity + + if (!cloudStore.verifyInstanceIdentity(info)) { + throw requestError("postAWSInstanceInformation: unable to verify instance identity", + caller, info.getDomain()); + } + + // now let's validate the csr given to us by the client + // and generate certificate for the instance + + Identity identity = cloudStore.generateIdentity(info.getCsr(), info.getName()); + if (identity == null) { + throw requestError("postAWSInstanceInformation: unable to generate identity", + caller, info.getDomain()); + } + + metric.stopTiming(timerMetric); + return identity; + } + + @Override + public Identity postInstanceRefreshRequest(ResourceContext ctx, String domain, + String service, InstanceRefreshRequest req) { + + final String caller = "postinstancerefreshrequest"; + final String callerTiming = "postinstancerefreshrequest_timing"; + metric.increment(HTTP_POST); + + validate(domain, TYPE_DOMAIN_NAME, caller); + validate(service, TYPE_SIMPLE_NAME, caller); + validate(req, TYPE_INSTANCE_REFRESH_REQUEST, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domain = domain.toLowerCase(); + service = service.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domain); + metric.increment(HTTP_REQUEST, domain); + metric.increment(caller, domain); + + // make sure the credentials match to whatever the request is + + Principal principal = ((RsrcCtxWrapper) ctx).principal(); + String yrn = domain + "." + service; + if (!yrn.equals(principal.getYRN())) { + throw requestError("postInstanceRefreshRequest: Principal mismatch: " + + yrn + " vs. " + principal.getYRN(), caller, domain); + } + + Identity identity = null; + if (principal.getAuthority() instanceof CertificateAuthority) { + identity = svcCertStore.generateIdentity(req.getCsr(), yrn); + } + + if (identity == null) { + throw requestError("postInstanceRefreshRequest: unable to generate identity", caller, domain); + } + + metric.stopTiming(timerMetric); + return identity; + } + + @Override + public Identity postInstanceInformation(ResourceContext context, InstanceInformation info) { + final String caller = "postinstanceinformation"; + final String callerTiming = "postinstanceinformation_timing"; + metric.increment(HTTP_POST); + + String domain = info.getDomain(); + String service = info.getService(); + + Object timerMetric = metric.startTiming(callerTiming, domain); + metric.increment(HTTP_REQUEST, domain); + metric.increment(caller, domain); + + validate(info, TYPE_INSTANCE_INFO, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domain = domain.toLowerCase(); + service = service.toLowerCase(); + + // now let's validate the request, and the csr, given to us by the client + // and generate certificate for the instance + + if (!svcCertStore.isValidRequest(info)) { + throw requestError("postInstanceInformation: unable to generate identity, invalid request", caller, domain); + } + + Identity identity = svcCertStore.generateIdentity(info.getCsr(), domain + "." + service); + if (identity == null) { + throw requestError("postInstanceInformation: unable to generate identity", + caller, domain); + } + + metric.stopTiming(timerMetric); + + return identity; + } + + long getSvcTokenExpiryTime(Integer expiryTime) { + + long requestedValue = (expiryTime != null) ? expiryTime : ZTS_NTOKEN_DEFAULT_EXPIRY; + if (requestedValue <= 0) { + requestedValue = ZTS_NTOKEN_DEFAULT_EXPIRY; + } else if (requestedValue > ZTS_NTOKEN_MAX_EXPIRY) { + requestedValue = ZTS_NTOKEN_MAX_EXPIRY; + } + + return requestedValue; + } + + @Override + public Identity postAWSCertificateRequest(ResourceContext ctx, String domain, String service, + AWSCertificateRequest req) { + + final String caller = "postawscertificaterequest"; + final String callerTiming = "postawscertificaterequest_timing"; + metric.increment(HTTP_POST); + + validate(domain, TYPE_DOMAIN_NAME, caller); + validate(service, TYPE_SIMPLE_NAME, caller); + validate(req, TYPE_AWS_CERT_REQUEST, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case (e.g. domain, role, + // policy, service, etc name) + + domain = domain.toLowerCase(); + service = service.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domain); + metric.increment(HTTP_REQUEST, domain); + metric.increment(caller, domain); + + // get our principal's name + + // make sure this was authenticated by the + // Certificate authority and not by anyone else + + Principal principal = ((RsrcCtxWrapper) ctx).principal(); + Authority authority = principal.getAuthority(); + + if (!(authority instanceof com.yahoo.athenz.auth.impl.CertificateAuthority)) { + throw forbiddenError("postAWSCertificateRequest: Not authenticated by Certificate Authority", + caller, domain); + } + + String principalYrn = principal.getYRN(); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("postAWSCertificateRequest: " + req + " for principal: " + principal); + } + + if (!cloudStore.isAwsEnabled()) { + throw requestError("postAWSCertificateRequest: AWS support is not available", + caller, domain); + } + + // verify we have a valid aws enabled domain + + String account = cloudStore.getAWSAccount(domain); + if (account == null) { + throw requestError("postAWSCertificateRequest: unable to retrieve AWS account for: " + + domain, caller, domain); + } + + // now let's validate the csr given to us by the client + // and generate certificate for the instance + + Identity identity = cloudStore.generateIdentity(req.getCsr(), principalYrn); + if (identity == null) { + throw requestError("postAWSCertificateRequest: unable to generate identity", + caller, domain); + } + + metric.stopTiming(timerMetric); + return identity; + } + + @Override + public Access getAccess(ResourceContext context, String domainName, String roleName, String principal) { + + final String caller = "getaccess"; + final String callerTiming = "getaccess_timing"; + metric.increment(HTTP_GET); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(roleName, TYPE_ENTITY_NAME, caller); + validate(principal, TYPE_ENTITY_NAME, caller); + + // for consistent handling of all requests, we're going to convert + // all incoming object values into lower case since ZMS Server + // saves all of its object names in lower case + + domainName = domainName.toLowerCase(); + roleName = roleName.toLowerCase(); + principal = principal.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domainName); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getAccess(domain: " + domainName + ", principal: " + principal + + ", role: " + roleName + ")"); + } + + // first retrieve our domain data object from the cache + + DataCache data = dataStore.getDataCache(domainName); + if (data == null) { + // just increment the request counter without any dimension + // we don't want to get persistent indexes for invalid domains + + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + + LOGGER.error("getAccess(principal: " + principal + ", role: " + roleName + + ") unknown domain: " + domainName); + throw notFoundError("getAccess: No such domain: " + domainName, caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // update our metric with dimension. we're moving the metric here + // after the domain name has been confirmed as valid since with + // dimensions we get stuck with persistent indexes so we only want + // to create them for valid domain names + + metric.increment(HTTP_REQUEST, domainName); + metric.increment(caller, domainName); + + // process our request and retrieve the roles for the principal + + ArrayList roles = new ArrayList<>(); + dataStore.getAccessibleRoles(data, domainName, principal, null, + roles, false); + + // create our response object and set the flag whether + // or not the principal has access to the role + + Access access = new Access(); + access.setGranted(roles.contains(roleName)); + + metric.stopTiming(timerMetric); + return access; + } + + /* + * /metrics/{domainName} + */ + @Override + public DomainMetrics postDomainMetrics(ResourceContext context, String domainName, DomainMetrics req) { + final String caller = "postdomainmetrics"; + final String callerTiming = "postdomainmetrics_timing"; + metric.increment(HTTP_POST); + + validate(domainName, TYPE_DOMAIN_NAME, caller); + validate(req, TYPE_DOMAIN_METRICS, caller); + domainName = domainName.toLowerCase(); + + Object timerMetric = metric.startTiming(callerTiming, domainName); + + // verify valid domain specified + DataCache data = dataStore.getDataCache(domainName); + if (data == null) { + metric.increment(HTTP_REQUEST, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + metric.increment(caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + LOGGER.error("postDomainMetrics: request for unknown domain: " + domainName); + throw notFoundError("postDomainMetrics: No such domain: " + domainName, caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + // verify domain name matches domain name in request object + String metricDomain = req.getDomainName(); + if (metricDomain == null) { + String errMsg = "postDomainMetrics: metrics request missing domain name for uri specified domain: " + domainName; + LOGGER.error(errMsg); + throw requestError(errMsg, caller, domainName); + } else if (metricDomain != null) { + metricDomain = metricDomain.toLowerCase(); + if (!metricDomain.equals(domainName)) { + String errMsg = "postDomainMetrics: mismatched domain names: uri domain: " + domainName + " : metric domain: " + metricDomain; + LOGGER.error(errMsg); + throw requestError(errMsg, caller, domainName); + } + } + + List dmList = req.getMetricList(); + if (dmList == null || dmList.size() == 0) { + // no metrics were sent - log error + String errMsg = "postDomainMetrics: received no metrics for domain: " + domainName; + LOGGER.error(errMsg); + throw requestError(errMsg, caller, domainName); + } + + // process the DomainMetrics request in order to increment each of its attrs + for (DomainMetric dm: dmList) { + DomainMetricType dmType = dm.getMetricType(); + if (dmType == null) { + LOGGER.warn("postDomainMetrics: ignore missing metric received for domain: {}", domainName); + continue; + } + + String dmt = dmType.toString().toLowerCase(); + Integer count = dm.getMetricVal(); + if (count == null || count.intValue() < 0) { + if (LOGGER.isWarnEnabled()) { + LOGGER.warn("postDomainMetrics: ignore metric: " + dmt + + " : invalid counter: " + count + " : received for domain: " + domainName); + } + continue; + } + String metricName = DOM_METRIX_PREFIX + dmt; + metric.increment(metricName, domainName, count); + } + + metric.stopTiming(timerMetric); + return req; + } + + @Override + public Schema getRdlSchema(ResourceContext context) { + return schema; + } + + protected String formatValidationError(String msg, Struct v) { + return msg + ": " + v.getString("error") + " [" + v.getString("context") + "]"; + } + + void validate(Object val, String type, String caller) { + if (val == null) { + throw requestError("Missing or malformed " + type, caller, ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + + Result result = validator.validate(val, type); + if (!result.valid) { + throw requestError("Invalid " + type + " error: " + result.error, caller, + ZTSConsts.ZTS_UNKNOWN_DOMAIN); + } + } + + protected RuntimeException error(int code, String msg, String caller, String domainName) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug(msg); + } + + // If caller is null, we do not want to emit any error metrics. + // Otherwise, the caller name should be from the method that threw + // the specific runtime exception. + + if (caller != null && !ZTSUtils.emitMonmetricError(code, caller, domainName, this.metric)) { + LOGGER.error("ZTS Error: unable to emit error metric for caller: " + caller + + " with message: " + msg); + } + return new ResourceException(code, new ResourceError().code(code).message(msg)); + } + + protected RuntimeException requestError(String msg, String caller, String domainName) { + return error(ResourceException.BAD_REQUEST, msg, caller, domainName); + } + + protected RuntimeException forbiddenError(String msg, String caller, String domainName) { + return error(ResourceException.FORBIDDEN, msg, caller, domainName); + } + + protected RuntimeException notFoundError(String msg, String caller, String domainName) { + return error(ResourceException.NOT_FOUND, msg, caller, domainName); + } + + + public ResourceContext newResourceContext(HttpServletRequest request, HttpServletResponse response) { + return new RsrcCtxWrapper(request, response, authorities, authorizer); + } + + public Authorizer getAuthorizer() { + return authorizer; + } + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSJettyContainer.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSJettyContainer.java new file mode 100644 index 00000000000..8317bbb167d --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSJettyContainer.java @@ -0,0 +1,225 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import java.io.File; + +import org.eclipse.jetty.http.HttpHeader; +import org.eclipse.jetty.http.HttpHeaderValue; +import org.eclipse.jetty.http.HttpVersion; +import org.eclipse.jetty.rewrite.handler.HeaderPatternRule; +import org.eclipse.jetty.rewrite.handler.RewriteHandler; +import org.eclipse.jetty.server.HttpConfiguration; +import org.eclipse.jetty.server.HttpConnectionFactory; +import org.eclipse.jetty.server.SecureRequestCustomizer; +import org.eclipse.jetty.server.ServerConnector; +import org.eclipse.jetty.server.Slf4jRequestLog; +import org.eclipse.jetty.server.SslConnectionFactory; +import org.eclipse.jetty.server.handler.RequestLogHandler; +import org.eclipse.jetty.servlet.ServletContextHandler; +import org.eclipse.jetty.servlet.ServletHolder; +import org.eclipse.jetty.util.ssl.SslContextFactory; + +import org.glassfish.jersey.servlet.ServletContainer; + +import com.yahoo.athenz.common.server.filters.DefaultMediaTypeFilter; +import com.yahoo.athenz.common.server.log.AthenzRequestLog; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.server.rest.Http; +import com.yahoo.athenz.common.server.rest.HttpContainer; +import com.yahoo.athenz.common.server.rest.RestCoreResourceConfig; +import com.yahoo.athenz.zts.utils.ZTSUtils; + +public class ZTSJettyContainer extends HttpContainer { + + /** + * This simple Container runs Jersey in a standalone mode using the Jetty + * HTTP server, and the ContentTypeProvider that can read and write payloads + * using any of data-core's Codec implementations (i.e. JSON, + * ProtocolBuffers, Avro, and TBin), just by identifying the Content-type or + * Accept headers in your request. + */ + + AuditLogger auditLogger = null; + String auditLoggerMsgBldrClass = null; + + public ZTSJettyContainer(AuditLogger auditLog, String auditLogMsgBldrClass) { + auditLogger = auditLog; + auditLoggerMsgBldrClass = auditLogMsgBldrClass; + + authorities = new Http.AuthorityList(); + } + + public void addRequestLogHandler(String rootDir) { + + RequestLogHandler requestLogHandler = new RequestLogHandler(); + + // check to see if have a slf4j logger name specified. if we don't + // then we'll just use our NCSARequestLog extended Athenz logger + // when using the slf4j logger we don't have the option to pass + // our audit logger to keep track of unauthenticated requests + + String accessSlf4jLogger = System.getProperty(ZTSConsts.ZTS_PROP_ACCESS_SLF4J_LOGGER); + if (accessSlf4jLogger != null && !accessSlf4jLogger.isEmpty()) { + + Slf4jRequestLog requestLog = new Slf4jRequestLog(); + requestLog.setLoggerName(accessSlf4jLogger); + requestLog.setExtended(true); + requestLog.setPreferProxiedForAddress(true); + requestLog.setLogTimeZone("GMT"); + requestLogHandler.setRequestLog(requestLog); + + } else { + + String logDir = System.getProperty(ZTSConsts.ZTS_PROP_ACCESS_LOG_DIR, rootDir + "/logs/zts_server"); + String logName = System.getProperty(ZTSConsts.ZTS_PROP_ACCESS_LOG_NAME, "access.yyyy_MM_dd.log"); + + AthenzRequestLog requestLog = new AthenzRequestLog(logDir + File.separator + logName, auditLogger); + requestLog.setAppend(true); + requestLog.setExtended(true); + requestLog.setPreferProxiedForAddress(true); + requestLog.setLogTimeZone("GMT"); + + String retainDays = System.getProperty(ZTSConsts.ZTS_PROP_ACCESS_LOG_RETAIN_DAYS, "31"); + int days = Integer.parseInt(retainDays); + if (days > 0) { + requestLog.setRetainDays(days); + } + requestLogHandler.setRequestLog(requestLog); + } + + getHandlers().addHandler(requestLogHandler); + } + + public void addServletHandlers(String homeDir, String serverHostName) { + + RewriteHandler rewriteHandler = new RewriteHandler(); + + // Check whether or not to disable Keep-Alive support in Jetty. + // This will be the first handler in our array so we always set + // the appropriate header in response. However, since we're now + // behind ATS, we want to keep the connections alive so ATS + // can re-use them as necessary + + boolean keepAlive = Boolean.parseBoolean(System.getProperty(ZTSConsts.ZTS_PROP_KEEP_ALIVE, "true")); + + if (!keepAlive) { + HeaderPatternRule disableKeepAliveRule = new HeaderPatternRule(); + disableKeepAliveRule.setPattern("/*"); + disableKeepAliveRule.setName(HttpHeader.CONNECTION.asString()); + disableKeepAliveRule.setValue(HttpHeaderValue.CLOSE.asString()); + rewriteHandler.addRule(disableKeepAliveRule); + } + + // Return a Host field in the response so during debugging + // we know what server was handling request + + HeaderPatternRule hostNameRule = new HeaderPatternRule(); + hostNameRule.setPattern("/*"); + hostNameRule.setName(HttpHeader.HOST.asString()); + hostNameRule.setValue(serverHostName); + rewriteHandler.addRule(hostNameRule); + + getHandlers().addHandler(rewriteHandler); + + // this sets up the default return media type when client accepts + // any type of media + addContainerRequestFilter(DefaultMediaTypeFilter.class); + + // setup application configuration for authorities, content-providers + // et al + RestCoreResourceConfig rconf = new RestCoreResourceConfig(resources, singletons); + rconf.setAuthorityObject(com.yahoo.athenz.auth.Authorizer.class, authorizer); + rconf.setAuthorityObject(Http.AuthorityList.class, authorities); + rconf.registerAll(); + + // now setup our servlet handler + // + ServletContextHandler servletHandler = new ServletContextHandler(ServletContextHandler.SESSIONS); + servletHandler.setContextPath("/"); + + ServletHolder holder = new ServletHolder(new ServletContainer(rconf)); + servletHandler.addServlet(holder, "/*"); + + getHandlers().addHandler(servletHandler); + } + + public HttpConfiguration newHttpConfiguration(int httpsPort) { + + // HTTP Configuration + + HttpConfiguration httpConfig = new HttpConfiguration(); + + boolean sendServerVersion = Boolean.parseBoolean(System.getProperty(ZTSConsts.ZTS_PROP_SEND_SERVER_VERSION, "false")); + boolean sendDateHeader = Boolean.parseBoolean(System.getProperty(ZTSConsts.ZTS_PROP_SEND_DATE_HEADER, "false")); + int outputBufferSize = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_OUTPUT_BUFFER_SIZE, "32768")); + int requestHeaderSize = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_REQUEST_HEADER_SIZE, "8192")); + int responseHeaderSize = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_RESPONSE_HEADER_SIZE, "8192")); + + if (httpsPort > 0) { + httpConfig.setSecureScheme("https"); + httpConfig.setSecurePort(httpsPort); + } + + httpConfig.setOutputBufferSize(outputBufferSize); + httpConfig.setRequestHeaderSize(requestHeaderSize); + httpConfig.setResponseHeaderSize(responseHeaderSize); + httpConfig.setSendServerVersion(sendServerVersion); + httpConfig.setSendDateHeader(sendDateHeader); + + return httpConfig; + } + + public void addHTTPConnectors(HttpConfiguration httpConfig, int httpPort, int httpsPort) { + + int idleTimeout = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_IDLE_TIMEOUT, "30000")); + String listenHost = System.getProperty(ZTSConsts.ZTS_PROP_LISTEN_HOST); + + // HTTP Connector + + if (httpPort > 0) { + ServerConnector connector = new ServerConnector(server, new HttpConnectionFactory(httpConfig)); + if (listenHost != null) { + connector.setHost(listenHost); + } + connector.setPort(httpPort); + connector.setIdleTimeout(idleTimeout); + server.addConnector(connector); + } + + // SSL Context Factory + + if (httpsPort > 0) { + + SslContextFactory sslContextFactory = ZTSUtils.createSSLContextObject(null); + + // SSL HTTP Configuration + + HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig); + httpsConfig.addCustomizer(new SecureRequestCustomizer()); + + // SSL Connector + + ServerConnector sslConnector = new ServerConnector(server, + new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.asString()), + new HttpConnectionFactory(httpsConfig)); + sslConnector.setPort(httpsPort); + sslConnector.setIdleTimeout(idleTimeout); + server.addConnector(sslConnector); + } + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSResources.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSResources.java new file mode 100644 index 00000000000..4b83bcf6d8d --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSResources.java @@ -0,0 +1,428 @@ +// +// This file generated by rdl 1.4.8. Do not modify! +// +package com.yahoo.athenz.zts; + +import com.yahoo.rdl.*; +import java.util.*; +import javax.ws.rs.*; +import javax.ws.rs.core.*; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.inject.Inject; + +@Path("/zts/v1") +public class ZTSResources { + + @GET + @Path("/domain/{domainName}/service/{serviceName}") + @Produces(MediaType.APPLICATION_JSON) + public ServiceIdentity getServiceIdentity(@PathParam("domainName") String domainName, @PathParam("serviceName") String serviceName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ServiceIdentity e = this.delegate.getServiceIdentity(context, domainName, serviceName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getServiceIdentity"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/service") + @Produces(MediaType.APPLICATION_JSON) + public ServiceIdentityList getServiceIdentityList(@PathParam("domainName") String domainName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + ServiceIdentityList e = this.delegate.getServiceIdentityList(context, domainName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getServiceIdentityList"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/service/{serviceName}/publickey/{keyId}") + @Produces(MediaType.APPLICATION_JSON) + public PublicKeyEntry getPublicKeyEntry(@PathParam("domainName") String domainName, @PathParam("serviceName") String serviceName, @PathParam("keyId") String keyId) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + PublicKeyEntry e = this.delegate.getPublicKeyEntry(context, domainName, serviceName, keyId); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getPublicKeyEntry"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/host/{host}/services") + @Produces(MediaType.APPLICATION_JSON) + public HostServices getHostServices(@PathParam("host") String host) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + HostServices e = this.delegate.getHostServices(context, host); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getHostServices"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/signed_policy_data") + @Produces(MediaType.APPLICATION_JSON) + public void getDomainSignedPolicyData(@PathParam("domainName") String domainName, @HeaderParam("If-None-Match") String matchingTag) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + GetDomainSignedPolicyDataResult result = new GetDomainSignedPolicyDataResult(context); + this.delegate.getDomainSignedPolicyData(context, domainName, matchingTag, result); + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.NOT_MODIFIED: + throw typedException(code, e, void.class); + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getDomainSignedPolicyData"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/token") + @Produces(MediaType.APPLICATION_JSON) + public RoleToken getRoleToken(@PathParam("domainName") String domainName, @QueryParam("role") String role, @QueryParam("minExpiryTime") Integer minExpiryTime, @QueryParam("maxExpiryTime") Integer maxExpiryTime, @QueryParam("proxyForPrincipal") String proxyForPrincipal) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + RoleToken e = this.delegate.getRoleToken(context, domainName, role, minExpiryTime, maxExpiryTime, proxyForPrincipal); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getRoleToken"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/access/domain/{domainName}/role/{roleName}/principal/{principal}") + @Produces(MediaType.APPLICATION_JSON) + public Access getAccess(@PathParam("domainName") String domainName, @PathParam("roleName") String roleName, @PathParam("principal") String principal) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Access e = this.delegate.getAccess(context, domainName, roleName, principal); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getAccess"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/access/domain/{domainName}/principal/{principal}") + @Produces(MediaType.APPLICATION_JSON) + public RoleAccess getRoleAccess(@PathParam("domainName") String domainName, @PathParam("principal") String principal) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + RoleAccess e = this.delegate.getRoleAccess(context, domainName, principal); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getRoleAccess"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/providerdomain/{providerDomainName}/user/{userName}") + @Produces(MediaType.APPLICATION_JSON) + public TenantDomains getTenantDomains(@PathParam("providerDomainName") String providerDomainName, @PathParam("userName") String userName, @QueryParam("roleName") String roleName, @QueryParam("serviceName") String serviceName) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + TenantDomains e = this.delegate.getTenantDomains(context, providerDomainName, userName, roleName, serviceName); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getTenantDomains"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/instance") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Identity postInstanceInformation(InstanceInformation info) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + Identity e = this.delegate.postInstanceInformation(context, info); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postInstanceInformation"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/instance/{domain}/{service}/refresh") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Identity postInstanceRefreshRequest(@PathParam("domain") String domain, @PathParam("service") String service, InstanceRefreshRequest req) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Identity e = this.delegate.postInstanceRefreshRequest(context, domain, service, req); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postInstanceRefreshRequest"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/aws/instance") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Identity postAWSInstanceInformation(AWSInstanceInformation info) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + Identity e = this.delegate.postAWSInstanceInformation(context, info); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postAWSInstanceInformation"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/aws/instance/{domain}/{service}/refresh") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public Identity postAWSCertificateRequest(@PathParam("domain") String domain, @PathParam("service") String service, AWSCertificateRequest req) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + Identity e = this.delegate.postAWSCertificateRequest(context, domain, service, req); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postAWSCertificateRequest"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/domain/{domainName}/role/{role}/creds") + @Produces(MediaType.APPLICATION_JSON) + public AWSTemporaryCredentials getAWSTemporaryCredentials(@PathParam("domainName") String domainName, @PathParam("role") String role) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + context.authenticate(); + AWSTemporaryCredentials e = this.delegate.getAWSTemporaryCredentials(context, domainName, role); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getAWSTemporaryCredentials"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @POST + @Path("/metrics/{domainName}") + @Produces(MediaType.APPLICATION_JSON) + @Consumes(MediaType.APPLICATION_JSON) + public DomainMetrics postDomainMetrics(@PathParam("domainName") String domainName, DomainMetrics req) { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + DomainMetrics e = this.delegate.postDomainMetrics(context, domainName, req); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + case ResourceException.BAD_REQUEST: + throw typedException(code, e, ResourceError.class); + case ResourceException.FORBIDDEN: + throw typedException(code, e, ResourceError.class); + case ResourceException.NOT_FOUND: + throw typedException(code, e, ResourceError.class); + case ResourceException.UNAUTHORIZED: + throw typedException(code, e, ResourceError.class); + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource postDomainMetrics"); + throw typedException(code, e, ResourceError.class); + } + } + } + + @GET + @Path("/schema") + @Produces(MediaType.APPLICATION_JSON) + public Schema getRdlSchema() { + try { + ResourceContext context = this.delegate.newResourceContext(this.request, this.response); + Schema e = this.delegate.getRdlSchema(context); + return e; + } catch (ResourceException e) { + int code = e.getCode(); + switch (code) { + default: + System.err.println("*** Warning: undeclared exception (" + code + ") for resource getRdlSchema"); + throw typedException(code, e, ResourceError.class); + } + } + } + + + WebApplicationException typedException(int code, ResourceException e, Class eClass) { + Object data = e.getData(); + Object entity = eClass.isInstance(data) ? data : null; + if (entity != null) { + return new WebApplicationException(Response.status(code).entity(entity).build()); + } else { + return new WebApplicationException(code); + } + } + + @Inject private ZTSHandler delegate; + @Context private HttpServletRequest request; + @Context private HttpServletResponse response; + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cache/DataCache.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cache/DataCache.java new file mode 100644 index 00000000000..3e2e1330be5 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cache/DataCache.java @@ -0,0 +1,308 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cache; + +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.Map; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.auth.util.CryptoException; +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zms.Role; + +public class DataCache { + + DomainData domainData = null; + + // member ==> [ role1, role2, ...] complete map + private final Map> memberRoleCache; + private final Map> trustCache; + private final Map> hostCache; + private final Map> awsRoleCache; + + // list of roles and their users: role ==> [ member1, member2, ...] complete map + private final Map> roleMemberCache; + + private final Map publicKeyCache; + + public static final String ACTION_ASSUME_ROLE = "assume_role"; + private static final String ACTION_ASSUME_AWS_ROLE = "assume_aws_role"; + + private static final Logger LOGGER = LoggerFactory.getLogger(DataCache.class); + + // rolecache --> memberRoleCache + + public DataCache() { + memberRoleCache = new HashMap<>(); + trustCache = new HashMap<>(); + hostCache = new HashMap<>(); + awsRoleCache = new HashMap<>(); + publicKeyCache = new HashMap<>(); + roleMemberCache = new HashMap<>(); + } + + public void setDomainData(DomainData domainData) { + this.domainData = domainData; + } + + public DomainData getDomainData() { + return domainData; + } + + /** + * Update {@code memberRoleCache} and {@code roleMemberCache} + * @param roleName the new/updated role + * @param members the list of members of that role + */ + void processRoleMembers(String roleName, List members) { + + // roleMemberCache: add role to list of keys, if missing + + if (!roleMemberCache.containsKey(roleName)) { + roleMemberCache.put(roleName, new HashSet<>()); + } + + // early out + + if (members == null) { + return; + } + + // roleMemberCache: add members + + Set roleMembers = roleMemberCache.get(roleName); + roleMembers.addAll(members); + + // memberRoleCache: add members + + for (String member : members) { + if (!memberRoleCache.containsKey(member)) { + memberRoleCache.put(member, new HashSet<>()); + } + final Set rolesForMember = memberRoleCache.get(member); + rolesForMember.add(roleName); + } + } + + void processRoleTrustDomain(String roleName, String trustDomain) { + + if (trustDomain == null) { + return; + } + + if (!trustCache.containsKey(trustDomain)) { + trustCache.put(trustDomain, new HashSet<>()); + } + + final Set rolesForTrustDomain = trustCache.get(trustDomain); + rolesForTrustDomain.add(roleName); + } + + public void processRole(Role role) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Processing role: " + role.getName()); + } + + /* first process members */ + + processRoleMembers(role.getName(), role.getMembers()); + + /* now process trust domains */ + + processRoleTrustDomain(role.getName(), role.getTrust()); + } + + void processAssumeRoleAssertion(Assertion assertion, Map roles) { + + final String roleName = assertion.getRole(); + Role role = roles.get(roleName); + if (role == null) { + return; + } + + /* add the resource as a role name for all the members */ + + processRoleMembers(assertion.getResource(), role.getMembers()); + } + + void processAWSAssumeRoleAssertion(Assertion assertion) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Processing AWS Assume Role for resource: " + assertion.getResource() + + " and role: " + assertion.getRole()); + } + + String role = assertion.getRole(); + if (!awsRoleCache.containsKey(role)) { + awsRoleCache.put(assertion.getRole(), new HashSet<>()); + } + + final Set resourcesForRole = awsRoleCache.get(role); + resourcesForRole.add(assertion.getResource()); + } + + public void processPolicy(String domainName, Policy policy, Map roles) { + + String policyName = policy.getName(); + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Processing policy: " + policyName); + } + + List assertions = policy.getAssertions(); + if (assertions == null || assertions.isEmpty()) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Policy: {} does not have any assertions, skipping." , policyName); + } + return; + } + + for (Assertion assertion : assertions) { + + /* we are only interested in assume_role and + * assume_aws_role assertions */ + + switch (assertion.getAction()) { + case ACTION_ASSUME_AWS_ROLE: + processAWSAssumeRoleAssertion(assertion); + break; + case ACTION_ASSUME_ROLE: + processAssumeRoleAssertion(assertion, roles); + break; + } + } + } + + void processServiceIdentityHosts(String serviceName, List hosts) { + + if (hosts == null || hosts.isEmpty()) { + return; + } + + for (String host : hosts) { + if (!hostCache.containsKey(host)) { + hostCache.put(host, new HashSet<>()); + } + + final Set hostsForService = hostCache.get(host); + hostsForService.add(serviceName); + } + } + + String generateServiceKeyName(String service, String keyId) { + StringBuilder str = new StringBuilder(256); + str.append(service); + str.append("_"); + str.append(keyId); + return str.toString(); + } + + void processServiceIdentityPublicKey(String serviceName, String keyId, String publicKey) { + + if (publicKey == null) { + return; + } + + String keyValue = null; + try { + keyValue = Crypto.ybase64DecodeString(publicKey); + } catch (CryptoException ex) { + LOGGER.error("Invalid public key for " + serviceName + " with id " + keyId + + " with value '" + publicKey + "':" + ex.getMessage()); + } + + if (keyValue != null) { + publicKeyCache.put(generateServiceKeyName(serviceName, keyId), keyValue); + } + } + + void processServiceIdentityPublicKeys(String serviceName, List publicKeys) { + + if (publicKeys == null || publicKeys.isEmpty()) { + return; + } + + for (PublicKeyEntry publicKey : publicKeys) { + processServiceIdentityPublicKey(serviceName, publicKey.getId(), + publicKey.getKey()); + } + } + + public void processServiceIdentity(com.yahoo.athenz.zms.ServiceIdentity service) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Processing service identity: " + service.getName()); + } + + /* first process the hosts for the service */ + + processServiceIdentityHosts(service.getName(), service.getHosts()); + + /* now process the public keys */ + + processServiceIdentityPublicKeys(service.getName(), service.getPublicKeys()); + } + + /** + * Return roles belonging to a member + * @param member whose roles we want + * @return the list of roles + */ + public Set getMemberRoleSet(String member) { + return memberRoleCache.get(member); + } + + /** + * Return the number of members in the cache + */ + public int getMemberCount() { + return memberRoleCache.size(); + } + + /** + * Return the members belonging to a role, inverts {@code getMemberRoleSet} + * @param roleName the role whose members we want + * @return the list of members + */ + public Set getRoleMemberSet(String roleName) { + return roleMemberCache.get(roleName); + } + + public Set getAWSResourceRoleSet(String role) { + return awsRoleCache.get(role); + } + + public Map> getTrustMap() { + return trustCache; + } + + public Map> getHostMap() { + return hostCache; + } + + public Map getPublicKeyMap() { + return publicKeyCache; + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cache/DataCacheProvider.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cache/DataCacheProvider.java new file mode 100644 index 00000000000..06b720bd427 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cache/DataCacheProvider.java @@ -0,0 +1,22 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cache; + +public interface DataCacheProvider { + + public DataCache getDataCache(String domainName); + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/CertSigner.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/CertSigner.java new file mode 100644 index 00000000000..5556b97cb7a --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/CertSigner.java @@ -0,0 +1,39 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +public interface CertSigner { + + /** + * Generate a signed X509 Certificate based on the given request. The + * certificate should be valid for given number of minutes. The result + * must be the certificate in PEM format + * @param csr Certificate request + * @return X509 Certificate in PEM format + */ + String generateX509Certificate(String csr); + + /** + * Retrieve the CA certificate in PEM format + * @return the CA Certificate + */ + String getCACertificate(); + + /** + * Close the httpClient held by certSigner + */ + void close(); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/CertSignerFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/CertSignerFactory.java new file mode 100644 index 00000000000..8beebc78d78 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/CertSignerFactory.java @@ -0,0 +1,27 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +import org.eclipse.jetty.client.HttpClient; + +public interface CertSignerFactory { + + /** + * Create and return a new CertSigner instance + * @return CertSigner instance + */ + public CertSigner create(HttpClient httpClient); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/SvcCertStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/SvcCertStore.java new file mode 100644 index 00000000000..0570d2e8877 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/SvcCertStore.java @@ -0,0 +1,38 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +import com.yahoo.athenz.zts.Identity; +import com.yahoo.athenz.zts.InstanceInformation; + +public interface SvcCertStore { + + /** + * Generate Identity for the csr passed. + * @param csr Certificate request + * @param serviceYrn + * @return Identity + */ + Identity generateIdentity(String csr, String serviceYrn); + + /** + * Is the request valid? Is the HostDocument valid and matches the signature + * Does the domain match the one in host document + * @param instanceInformation + * @return boolean true if instanceInformation is valid, false otherwise + */ + boolean isValidRequest(InstanceInformation instanceInformation); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/SvcCertStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/SvcCertStoreFactory.java new file mode 100644 index 00000000000..7283b4f2c47 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/SvcCertStoreFactory.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +public interface SvcCertStoreFactory { + + /** + * Create and return a new SvcCertStore instance + * @param certSigner CertSigner client to use for signing + * @return SvcCertStore instance + */ + public SvcCertStore create(CertSigner certSigner); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/X509CertSignObject.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/X509CertSignObject.java new file mode 100644 index 00000000000..63b18aa0dbd --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/X509CertSignObject.java @@ -0,0 +1,36 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +import com.fasterxml.jackson.databind.annotation.JsonSerialize; + +@JsonSerialize(include = JsonSerialize.Inclusion.NON_DEFAULT) +public class X509CertSignObject { + + private String pem; + + public X509CertSignObject() { + } + + public String getPem() { + return pem; + } + + public X509CertSignObject setPem(String pem) { + this.pem = pem; + return this; + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YCertSigner.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YCertSigner.java new file mode 100644 index 00000000000..277ffa46038 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YCertSigner.java @@ -0,0 +1,158 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert.impl; + +import java.util.concurrent.ExecutionException; +import java.util.concurrent.TimeoutException; + +import com.yahoo.athenz.zts.ResourceException; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.X509CertSignObject; +import com.yahoo.athenz.zts.utils.ZTSUtils; + +import org.eclipse.jetty.client.HttpClient; +import org.eclipse.jetty.client.api.ContentResponse; +import org.eclipse.jetty.client.api.Request; +import org.eclipse.jetty.client.util.StringContentProvider; +import org.eclipse.jetty.http.HttpHeader; +import org.eclipse.jetty.http.HttpStatus; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.rdl.JSON; + +public class YCertSigner implements CertSigner { + + private static final Logger LOGGER = LoggerFactory.getLogger(YCertSigner.class); + private HttpClient httpClient = null; + String certUri = null; + + private static final String ZTS_PROP_CERTSIGN_BASE_URI = "athenz.zts.certsign_base_uri"; + private static final String DEFAULT_CERTSIGN_BASE_URI = "https://localhost:443/certsign/v2"; + + public YCertSigner(HttpClient client) { + if (client != null) { + this.httpClient = client; + } else { + // Instantiate and start our HttpClient + httpClient = new HttpClient(ZTSUtils.createSSLContextObject(new String[] {"TLSv1.2"})); + httpClient.setFollowRedirects(false); + try { + httpClient.start(); + } catch (Exception ex) { + LOGGER.error("YCertSigner: unable to start http client", ex); + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "Http client not available"); + } + } + + // generate our post and get certificate URIs + + String serverBaseUri = System.getProperty(ZTS_PROP_CERTSIGN_BASE_URI, DEFAULT_CERTSIGN_BASE_URI); + certUri = serverBaseUri + "/x509"; + } + + @Override + public void close() { + try { + if (httpClient != null) { + httpClient.stop(); + } + } catch (Exception ex) { + LOGGER.error("close(): unable to stop httpClient" + ex.getMessage()); + } + } + + @Override + public String generateX509Certificate(String csr) { + + ContentResponse response = null; + try { + Request request = httpClient.POST(certUri); + request.header(HttpHeader.ACCEPT, "application/json"); + request.header(HttpHeader.CONTENT_TYPE, "application/json"); + + X509CertSignObject csrCert = new X509CertSignObject(); + csrCert.setPem(csr); + request.content(new StringContentProvider(JSON.string(csrCert)), "application/json"); + response = request.send(); + + } catch (Exception ex) { + LOGGER.error("generateX509Certificate: unable to fetch requested uri '" + certUri + "': " + + ex.getMessage()); + return null; + } + if (response.getStatus() != HttpStatus.CREATED_201) { + LOGGER.error("generateX509Certificate: unable to fetch requested uri '" + certUri + + "' status: " + response.getStatus()); + return null; + } + + String data = response.getContentAsString(); + if (data == null || data.isEmpty()) { + LOGGER.error("generateX509Certificate: received empty response from uri '" + certUri + + "' status: " + response.getStatus()); + return null; + } + + X509CertSignObject pemCert = null; + try { + pemCert = JSON.fromString(data, X509CertSignObject.class); + } catch (Exception ex) { + LOGGER.error("generateX509Certificate: unable to decode object from '" + certUri + + "' error: " + ex.getMessage()); + } + return (pemCert != null) ? pemCert.getPem() : null; + } + + @Override + public String getCACertificate() { + + ContentResponse response = null; + try { + response = httpClient.GET(certUri); + } catch (InterruptedException | ExecutionException | TimeoutException e) { + LOGGER.error("getCACertificate: unable to fetch requested uri '" + certUri + "': " + + e.getMessage()); + return null; + } + if (response.getStatus() != HttpStatus.OK_200) { + LOGGER.error("getCACertificate: unable to fetch requested uri '" + certUri + + "' status: " + response.getStatus()); + return null; + } + + String data = response.getContentAsString(); + if (data == null || data.isEmpty()) { + LOGGER.error("getCACertificate: received empty response from uri '" + certUri + + "' status: " + response.getStatus()); + return null; + } + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getCACertificate: CA Certificate" + data); + } + + X509CertSignObject pemCert = null; + try { + pemCert = JSON.fromString(data, X509CertSignObject.class); + } catch (Exception ex) { + LOGGER.error("getCACertificate: unable to decode object from '" + certUri + + "' error: " + ex.getMessage()); + } + return (pemCert != null) ? pemCert.getPem() : null; + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YCertSignerFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YCertSignerFactory.java new file mode 100644 index 00000000000..65fb6684032 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YCertSignerFactory.java @@ -0,0 +1,29 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert.impl; + +import org.eclipse.jetty.client.HttpClient; + +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.CertSignerFactory; + +public class YCertSignerFactory implements CertSignerFactory { + + @Override + public CertSigner create(HttpClient httpClient) { + return new YCertSigner(httpClient); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YSvcCertStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YSvcCertStore.java new file mode 100644 index 00000000000..7ce452e4c0b --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YSvcCertStore.java @@ -0,0 +1,45 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert.impl; + +import com.yahoo.athenz.zts.*; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.SvcCertStore; +import com.yahoo.athenz.zts.utils.ZTSUtils; + +public class YSvcCertStore implements SvcCertStore { + CertSigner certSigner = null; + String caPEMCertificate = null; + + public YSvcCertStore() { + + } + + public YSvcCertStore(CertSigner certSigner) { + this.certSigner = certSigner; + if (certSigner != null) { + caPEMCertificate = certSigner.getCACertificate(); + } + } + + public Identity generateIdentity(String csr, String serviceYrn) { + return ZTSUtils.generateIdentity(certSigner, csr, serviceYrn, caPEMCertificate); + } + + public boolean isValidRequest(InstanceInformation instanceInformation) { + return true; + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YSvcCertStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YSvcCertStoreFactory.java new file mode 100644 index 00000000000..5af99f211ca --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/cert/impl/YSvcCertStoreFactory.java @@ -0,0 +1,31 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert.impl; + +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.SvcCertStore; +import com.yahoo.athenz.zts.cert.SvcCertStoreFactory; + +public class YSvcCertStoreFactory implements SvcCertStoreFactory { + + public YSvcCertStoreFactory() { + } + + @Override + public SvcCertStore create(CertSigner certSigner) { + return new YSvcCertStore(certSigner); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/PrivateKeyStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/PrivateKeyStore.java new file mode 100644 index 00000000000..d53a3749488 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/PrivateKeyStore.java @@ -0,0 +1,41 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey; + +import java.security.PrivateKey; + +public interface PrivateKeyStore { + + /** + * Retrieve private key for this ZTS Server instance to sign its tokens + * The private key identifier must be updated in the privateKeyId out + * StringBuilder field. The Private Key Store Factory has the knowledge + * which hostname we're processing this request for. + * @param privateKeyId - out argument - must be updated to include key id + * @return private key for this ZTS Server instance. + */ + default PrivateKey getHostPrivateKey(StringBuilder privateKeyId) { + return null; + } + + default PrivateKey getPrivateKey(String keyName, int keyVersion) { + return null; + } + + default String getPublicKey(String keyName, int keyVersion) { + return null; + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/PrivateKeyStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/PrivateKeyStoreFactory.java new file mode 100644 index 00000000000..f10c9bf03ae --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/PrivateKeyStoreFactory.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey; + +public interface PrivateKeyStoreFactory { + + /** + * Create and return a new PrivateKeyStore instance + * @param serverHostName hostname of the ZTS Server instance + * @return PrivateKeyStore instance + */ + public PrivateKeyStore create(String serverHostName); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStore.java new file mode 100644 index 00000000000..4d38863b742 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStore.java @@ -0,0 +1,128 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey.file; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.zts.ResourceException; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.pkey.PrivateKeyStore; + +public class FilePrivateKeyStore implements PrivateKeyStore { + + private static final Logger LOGGER = LoggerFactory.getLogger(FilePrivateKeyStore.class); + + String rootDir = null; + + public FilePrivateKeyStore() { + + // get the system root directory + + rootDir = System.getenv(ZTSConsts.STR_ENV_ROOT); + if (rootDir == null) { + rootDir = ZTSConsts.STR_DEF_ROOT; + } + } + + @Override + public PrivateKey getHostPrivateKey(StringBuilder privateKeyId) { + + String privKeyName = System.getProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, + rootDir + "/share/athenz/sys.auth/zts.key"); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("FilePrivateKeyStore: private key file=" + privKeyName); + } + + File privKeyFile = new File(privKeyName); + String key = Crypto.encodedFile(privKeyFile); + PrivateKey pkey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(key)); + + if (pkey == null) { + throw new ResourceException(500, "Unable to retrieve ZTS Server private key"); + } + + privateKeyId.append(System.getProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY_ID, "0")); + return pkey; + } + + @Override + public PrivateKey getPrivateKey(String keyName, int keyVersion) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("FilePrivateKeyStore: private key file=" + keyName); + } + + // if the version is 0 then we're going to take the keyname + // as the filename otherwise we'll append ".v" + // to generated the versioned key filename + + String fileName = keyName; + if (keyVersion != 0) { + fileName += ".v" + keyVersion; + } + File privKeyFile = new File(fileName); + String key = Crypto.encodedFile(privKeyFile); + PrivateKey pkey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(key)); + + if (pkey == null) { + throw new ResourceException(500, "Unable to retrieve private key: " + fileName); + } + + return pkey; + } + + @Override + public String getPublicKey(String keyName, int keyVersion) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("FilePrivateKeyStore: public key file=" + keyName); + } + + // if the version is 0 then we're going to take the keyname + // as the filename otherwise we'll append ".v" + // to generated the versioned key filename + + String fileName = keyName; + if (keyVersion != 0) { + fileName += ".v" + keyVersion; + } + Path path = Paths.get(fileName); + String pkey = null; + try { + pkey = new String(Files.readAllBytes(path)); + } catch (IOException ex) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("FilePrivateKeyStore: unable to read public key", ex); + } + } + + if (pkey == null) { + throw new ResourceException(500, "Unable to retrieve public key: " + fileName); + } + + return pkey; + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStoreFactory.java new file mode 100644 index 00000000000..148b69c8498 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStoreFactory.java @@ -0,0 +1,27 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey.file; + +import com.yahoo.athenz.zts.pkey.PrivateKeyStore; +import com.yahoo.athenz.zts.pkey.PrivateKeyStoreFactory; + +public class FilePrivateKeyStoreFactory implements PrivateKeyStoreFactory { + + @Override + public PrivateKeyStore create(String serverHostName) { + return new FilePrivateKeyStore(); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStore.java new file mode 100644 index 00000000000..8cc6529b02a --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStore.java @@ -0,0 +1,31 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey.hsm; + +import java.security.PrivateKey; + +import com.yahoo.athenz.zts.pkey.PrivateKeyStore; + +public class HSMPrivateKeyStore implements PrivateKeyStore { + + public HSMPrivateKeyStore() { + } + + @Override + public PrivateKey getHostPrivateKey(StringBuilder privateKeyId) { + return null; + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStoreFactory.java new file mode 100644 index 00000000000..7e63e8a01e4 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStoreFactory.java @@ -0,0 +1,27 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey.hsm; + +import com.yahoo.athenz.zts.pkey.PrivateKeyStore; +import com.yahoo.athenz.zts.pkey.PrivateKeyStoreFactory; + +public class HSMPrivateKeyStoreFactory implements PrivateKeyStoreFactory { + + @Override + public PrivateKeyStore create(String serverHostName) { + return new HSMPrivateKeyStore(); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/ChangeLogStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/ChangeLogStore.java new file mode 100644 index 00000000000..91eee741daf --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/ChangeLogStore.java @@ -0,0 +1,87 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store; + +import java.util.List; +import java.util.Set; + +import com.yahoo.athenz.zms.SignedDomain; +import com.yahoo.athenz.zms.SignedDomains; + +/** + * An interface that ZTSCore depends on to manage its state. + */ + +public interface ChangeLogStore { + + /** + * Gets the associated domain data for the key + * @param domainName the name of the domain + * @return SignedDomain object of the domain or null if absent + */ + public SignedDomain getSignedDomain(String domainName); + + /** + * Remove the local domain record from the changelog store + * @param domainName the name of the domain + */ + public void removeLocalDomain(String domainName); + + /** + * Save the local domain record from the changelog store + * @param domainName the name of the domain + * @param signedDomain the {@code SignedDomain} for the {@code domainName} supplied + */ + public void saveLocalDomain(String domainName, SignedDomain signedDomain); + + /** + * Returns the names of all domain stored in local repository + * @return List of domain names + */ + public List getLocalDomainList(); + + /** + * Returns the list of all domains configured on server + * @return Set of domain names + */ + public Set getServerDomainList(); + + /** + * Returns the list of domains modified since the last call + * @param lastModTimeBuffer StringBuilder object will be updated to include + * the last modification time for the request. If data store + * successfully updates the local entries in the cache then + * it will call setLastModificationTimestamp with the same value + * @return Array of SignedDomain objects + */ + public SignedDomains getUpdatedSignedDomains(StringBuilder lastModTimeBuffer); + + /** + * Notifies the store to update its changelog last modification + * timestamp. If the value is null then it notifies the stores to + * reset its changelog and during next retrieveDomainUpdates call + * to return set of all domains available in ZMS + * @param lastModTime last modification timestamp + */ + public void setLastModificationTimestamp(String lastModTime); + + /** + * The change log store supports getting a full refresh from + * ZMS Server directly + * @return true if store supports full refresh, false otherwise + */ + public boolean supportsFullRefresh(); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/ChangeLogStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/ChangeLogStoreFactory.java new file mode 100644 index 00000000000..b4d8a7a15af --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/ChangeLogStoreFactory.java @@ -0,0 +1,32 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store; + +import java.security.PrivateKey; + +public interface ChangeLogStoreFactory { + + /** + * Create and return a new ChangeLogStore instance + * @param ztsHomeDir the home directory for the ZTS Server instance (e.g. /home/athenz/var/zts_server) + * @param privateKey the PrivateKey to generate service tokens when communicating with ZMS Server + * @param privateKeyId the private key identifier + * @param cloudStore represents an AWS instance + * @return ChangeLogStore instance + */ + public ChangeLogStore create(String ztsHomeDir, PrivateKey privateKey, + String privateKeyId, CloudStore cloudStore); +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/CloudStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/CloudStore.java new file mode 100644 index 00000000000..6aa76eb55f8 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/CloudStore.java @@ -0,0 +1,636 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store; + +import java.io.File; +import java.security.PublicKey; +import java.security.cert.X509Certificate; +import java.util.HashMap; +import java.util.Map; +import java.util.concurrent.ExecutionException; +import java.util.concurrent.Executors; +import java.util.concurrent.ScheduledExecutorService; +import java.util.concurrent.TimeUnit; +import java.util.concurrent.TimeoutException; + +import org.eclipse.jetty.client.HttpClient; +import org.eclipse.jetty.client.api.ContentResponse; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.amazonaws.auth.BasicSessionCredentials; +import com.amazonaws.regions.Region; +import com.amazonaws.regions.Regions; +import com.amazonaws.services.s3.AmazonS3; +import com.amazonaws.services.s3.AmazonS3Client; +import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient; +import com.amazonaws.services.securitytoken.model.AssumeRoleRequest; +import com.amazonaws.services.securitytoken.model.AssumeRoleResult; +import com.amazonaws.services.securitytoken.model.Credentials; +import com.amazonaws.services.securitytoken.model.GetCallerIdentityRequest; +import com.amazonaws.services.securitytoken.model.GetCallerIdentityResult; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.auth.util.CryptoException; +import com.yahoo.athenz.zts.AWSInstanceInformation; +import com.yahoo.athenz.zts.AWSTemporaryCredentials; +import com.yahoo.athenz.zts.Identity; +import com.yahoo.athenz.zts.ResourceException; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.utils.ZTSUtils; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Struct; +import com.yahoo.rdl.Timestamp; + +public class CloudStore { + + private static final Logger LOGGER = LoggerFactory.getLogger(CloudStore.class); + public static final String ZTS_PROP_AWS_CREDS_UPDATE_TIMEOUT = "athns.zts.aws_creds_update_timeout"; + public static final String ZTS_PROP_AWS_REGION_NAME = "athenz.zts.aws_region_name"; + public static final String ZTS_PROP_AWS_PUBLIC_CERT = "athenz.zts.aws_public_cert"; + + String awsRole = null; + String awsCloud = null; + String awsProfile = null; + String awsAccount = null; + String awsDomain = null; + String awsService = null; + String awsRegion = null; + boolean awsEnabled = false; + CertSigner certSigner = null; + BasicSessionCredentials credentials = null; + Map cloudAccountCache = null; + int credsUpdateTime = 900; + String caPEMCertificate = null; // public key certificate of the certifying authority in PEM format + PublicKey awsPublicKey = null; // AWS public key for validating instance documents + private HttpClient httpClient = null; + + private static ScheduledExecutorService scheduledThreadPool; + + public CloudStore(CertSigner certSigner) { + + // save our cert signer and generate the PEM output of the certificate + + this.certSigner = certSigner; + if (certSigner != null) { + caPEMCertificate = certSigner.getCACertificate(); + } + + // initialize our account cache + + cloudAccountCache = new HashMap(); + + // Instantiate and start our HttpClient + + httpClient = new HttpClient(); + httpClient.setFollowRedirects(false); + try { + httpClient.start(); + } catch (Exception ex) { + LOGGER.error("CloudStore: unable to start http client", ex); + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "Http client not available"); + } + + // let's retrieve our AWS public certificate which is posted here: + // http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html + + String awsCertFileName = System.getProperty(ZTS_PROP_AWS_PUBLIC_CERT); + if (awsCertFileName != null && !awsCertFileName.isEmpty()) { + File awsCertFile = new File(awsCertFileName); + X509Certificate awsCert = Crypto.loadX509Certificate(awsCertFile); + awsPublicKey = awsCert.getPublicKey(); + } + + // check to see if we are given region name + + awsRegion = System.getProperty(ZTS_PROP_AWS_REGION_NAME); + + // initialize aws support + + awsEnabled = Boolean.parseBoolean(System.getProperty(ZTSConsts.ZTS_PROP_AWS_ENABLED, "false")); + initializeAwsSupport(); + } + + void close() { + if (httpClient != null) { + try { + httpClient.stop(); + } catch (Exception e) { + } + } + } + + public void setHttpClient(HttpClient client) { + if (httpClient != null) { + try { + httpClient.stop(); + } catch (Exception e) { + } + } + httpClient = client; + } + + public boolean isAwsEnabled() { + return awsEnabled; + } + + void initializeAwsSupport() { + + // these operations require initialization of aws objects so + // we'll process them only if we have been configured to run in aws + + if (!awsEnabled) { + return; + } + + // initialize and load our bootstrap data + + if (!loadBootMetaData()) { + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "Unable to load boot data"); + } + + // finally fetch the role credentials + + if (!fetchRoleCredentials()) { + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "Unable to fetch aws role credentials"); + } + + // Start our thread to get aws temporary credentials + + credsUpdateTime = ZTSUtils.retrieveConfigSetting(ZTS_PROP_AWS_CREDS_UPDATE_TIMEOUT, 900); + + scheduledThreadPool = Executors.newScheduledThreadPool(1); + scheduledThreadPool.scheduleAtFixedRate(new RoleCredentialsFetcher(), credsUpdateTime, + credsUpdateTime, TimeUnit.SECONDS); + } + + public AmazonS3 getS3Client() { + + if (!awsEnabled) { + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "AWS Support not enabled"); + } + + if (credentials == null) { + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "AWS Role credentials are not available"); + } + + AmazonS3Client s3 = new AmazonS3Client(credentials); + if (awsRegion != null) { + s3.setRegion(Region.getRegion(Regions.fromName(awsRegion))); + } + return s3; + } + + boolean loadBootMetaData() { + + // first load the dynamic document + + String document = getMetaData("/dynamic/instance-identity/document"); + if (document == null) { + return false; + } + + try { + if (!parseInstanceInfo(document)) { + return false; + } + } catch (Exception ex) { + LOGGER.error("CloudStore: unable to parse instance identity document: " + document, ex); + return false; + } + + // then the document signature + + String docSignature = getMetaData("/dynamic/instance-identity/pkcs7"); + if (docSignature == null) { + return false; + } + + // next the iam profile data + + String iamRole = getMetaData("/meta-data/iam/info"); + if (iamRole == null) { + return false; + } + + // now parse and extract the profile details. we'll catch + // all possible index out of bounds exceptions here and just + // report the error and return false + + try { + if (!parseIamRoleInfo(iamRole)) { + return false; + } + } catch (Exception ex) { + LOGGER.error("CloudStore: unable to parse iam role data: " + iamRole, ex); + return false; + } + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("CloudStore: service meta information:"); + LOGGER.debug("CloudStore: cloud: " + awsCloud); + LOGGER.debug("CloudStore: role: " + awsRole); + LOGGER.debug("CloudStore: profile: " + awsProfile); + LOGGER.debug("CloudStore: account: " + awsAccount); + LOGGER.debug("CloudStore: domain: " + awsDomain); + LOGGER.debug("CloudStore: service: " + awsService); + LOGGER.debug("CloudStore: region: " + awsRegion); + } + return true; + } + + boolean parseInstanceInfo(String document) { + + Struct instStruct = null; + try { + instStruct = JSON.fromString(document, Struct.class); + } catch (Exception ex) { + LOGGER.error("CloudStore: unable to parse instance identity document", ex); + } + + if (instStruct == null) { + LOGGER.error("CloudStore: unable to parse instance identity document: " + document); + return false; + } + + // if we don't extract our account id here, we'll try + // to retrieve it from our iam role name + + awsAccount = instStruct.getString("accountId"); + + // if we're overriding the region name, then we'll + // extract that value here + + if (awsRegion == null || awsRegion.isEmpty()) { + awsRegion = instStruct.getString("region"); + if (awsRegion == null || awsRegion.isEmpty()) { + LOGGER.error("CloudStore: unable to extract region from instance identity document: " + document); + return false; + } + } + + return true; + } + + boolean parseIamRoleInfo(String iamRole) { + + Struct iamRoleStruct = null; + try { + iamRoleStruct = JSON.fromString(iamRole, Struct.class); + } catch (Exception ex) { + LOGGER.error("CloudStore: unable to parse iam role data", ex); + } + + if (iamRoleStruct == null) { + LOGGER.error("CloudStore: unable to parse iam role data: " + iamRole); + return false; + } + + // extract and parse our profile arn + // "InstanceProfileArn" : "arn:aws:iam::1111111111111:instance-profile/iaas.athenz.zts,athenz", + + String profileArn = iamRoleStruct.getString("InstanceProfileArn"); + if (profileArn == null || profileArn.isEmpty()) { + LOGGER.error("CloudStore: unable to extract InstanceProfileArn from iam role data: " + iamRole); + return false; + } + + if (!parseInstanceProfileArn(profileArn)) { + return false; + } + + return true; + } + + boolean parseInstanceProfileArn(String profileArn) { + + // "InstanceProfileArn" : "arn:aws:iam::1111111111111:instance-profile/iaas.athenz.zts,athenz", + + if (!profileArn.startsWith("arn:aws:iam::")) { + LOGGER.error("CloudStore: InstanceProfileArn does not start with 'arn:aws:iam::' : " + profileArn); + return false; + } + + int idx = profileArn.indexOf(":instance-profile/"); + if (idx == -1) { + LOGGER.error("CloudStore: unable to parse InstanceProfileArn: " + profileArn); + return false; + } + + awsProfile = profileArn.substring(idx + ":instance-profile/".length()); + + // we should already have our aws account data but in case we didn't + // get it from our instance document, we'll extract it from the profile name + + if (awsAccount == null || awsAccount.isEmpty()) { + awsAccount = profileArn.substring("arn:aws:iam::".length(), idx); + } + + // make sure we have valid profile and account data + + if (awsProfile.isEmpty() || awsAccount.isEmpty()) { + LOGGER.error("CloudStore: unable to extract profile/account data from InstanceProfileArn: " + profileArn); + return false; + } + + // we need to extract the role and cloud names from the profile + + String[] comps = awsProfile.split(","); + if (comps.length != 2) { + LOGGER.error("CloudStore: unable to extract role/cloud name from profile: " + awsProfile); + return false; + } + + awsRole = comps[0]; + awsCloud = comps[1]; + + // retrieve our domain and service names from our role name + + idx = awsRole.lastIndexOf('.'); + if (idx == -1) { + LOGGER.error("CloudStore: malformed service name: " + awsRole); + return false; + } + + awsDomain = awsRole.substring(0, idx); + awsService = awsRole.substring(idx + 1); + + // make sure we have valid service and domain values + + if (awsDomain.isEmpty() || awsService.isEmpty()) { + LOGGER.error("CloudStore: unable to extract domain/service data from profile: " + awsRole); + return false; + } + + return true; + } + + boolean fetchRoleCredentials() { + + // verify that we have a valid awsRole already retrieved + + if (awsRole == null || awsRole.isEmpty()) { + LOGGER.error("CloudStore: awsRole is not avaialble to fetch role credentials"); + return false; + } + + String creds = getMetaData("/meta-data/iam/security-credentials/" + awsRole); + if (creds == null) { + return false; + } + + Struct credsStruct = null; + try { + credsStruct = JSON.fromString(creds, Struct.class); + } catch (Exception ex) { + LOGGER.error("CloudStore: unable to parse role credentials data", ex); + } + + if (credsStruct == null) { + LOGGER.error("CloudStore: unable to parse role credentials data: " + creds); + return false; + } + + String accessKeyId = credsStruct.getString("AccessKeyId"); + String secretAccessKey = credsStruct.getString("SecretAccessKey"); + String token = credsStruct.getString("Token"); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("CloudStore: access key id: " + accessKeyId); + LOGGER.debug("CloudStore: secret access key: " + secretAccessKey); + } + + try { + credentials = new BasicSessionCredentials(accessKeyId, secretAccessKey, token); + } catch (Exception ex) { + LOGGER.error("CloudStore: unable to generate session credentials from: " + creds, ex); + return false; + } + + return true; + } + + String getMetaData(String path) { + + final String baseUri = "http://169.254.169.254/latest"; + ContentResponse response = null; + try { + response = httpClient.GET(baseUri + path); + } catch (InterruptedException | ExecutionException | TimeoutException e) { + LOGGER.error("CloudStore: unable to fetch requested uri '" + path + "': " + + e.getMessage()); + return null; + } + if (response.getStatus() != 200) { + LOGGER.error("CloudStore: unable to fetch requested uri '" + path + + "' status: " + response.getStatus()); + return null; + } + + String data = response.getContentAsString(); + if (data == null || data.isEmpty()) { + LOGGER.error("CloudStore: received empty response from uri '" + path + + "' status: " + response.getStatus()); + return null; + } + + return data; + } + + AssumeRoleRequest getAssumeRoleRequest(String account, String roleName, String principal) { + + // assume the target role to get the credentials for the client + // aws format is arn:aws:iam:::role/ + + String arn = "arn:aws:iam::" + account + ":role/" + roleName; + + AssumeRoleRequest req = new AssumeRoleRequest(); + req.setRoleArn(arn); + req.setRoleSessionName(principal); + + return req; + } + + AWSSecurityTokenServiceClient getTokenServiceClient() { + return new AWSSecurityTokenServiceClient(credentials); + } + + public AWSTemporaryCredentials assumeAWSRole(String account, String roleName, String principal) { + + if (!awsEnabled) { + throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, + "AWS Support not enabled"); + } + + AssumeRoleRequest req = getAssumeRoleRequest(account, roleName, principal); + + AWSTemporaryCredentials tempCreds = null; + try { + AWSSecurityTokenServiceClient client = getTokenServiceClient(); + AssumeRoleResult res = client.assumeRole(req); + + Credentials awsCreds = res.getCredentials(); + tempCreds = new AWSTemporaryCredentials() + .setAccessKeyId(awsCreds.getAccessKeyId()) + .setSecretAccessKey(awsCreds.getSecretAccessKey()) + .setSessionToken(awsCreds.getSessionToken()) + .setExpiration(Timestamp.fromMillis(awsCreds.getExpiration().getTime())); + + } catch (Exception ex) { + LOGGER.error("CloudStore: assumeAWSRole - unable to assume role: " + ex.getMessage()); + return null; + } + + return tempCreds; + } + + public String getAWSAccount(String domainName) { + return cloudAccountCache.get(domainName); + } + + void updateAccount(String domainName, String account) { + + /* if we have a value specified for the domain, then we're just + * going to insert it into our map and update the record. If + * the new value is not present and we had a value stored before + * then let's remove it */ + + if (account != null && !account.isEmpty()) { + cloudAccountCache.put(domainName, account); + } else if (cloudAccountCache.get(domainName) != null) { + cloudAccountCache.remove(domainName); + } + } + + public boolean validateInstanceDocument(String document, String signature) { + + if (document == null || document.isEmpty()) { + LOGGER.error("validateInstanceDocument: AWS instance document is empty"); + return false; + } + + if (signature == null || signature.isEmpty()) { + LOGGER.error("validateInstanceDocument: AWS instance document signature is empty"); + return false; + } + + if (awsPublicKey == null) { + LOGGER.error("validateInstanceDocument: AWS Public key is not available"); + return false; + } + + boolean valid = false; + try { + valid = Crypto.validatePKCS7Signature(document, signature, awsPublicKey); + } catch (CryptoException ex) { + LOGGER.error("validateInstanceDocument: unable to validate AWS instance document", ex); + } + return valid; + } + + class RoleCredentialsFetcher implements Runnable { + + @Override + public void run() { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("RoleCredentialsFetcher: Starting aws role credentials fetcher task..."); + } + + try { + fetchRoleCredentials(); + } catch (Exception ex) { + LOGGER.error("RoleCredentialsFetcher: unable to fetch aws role credentials", ex); + } + } + } + + AWSSecurityTokenServiceClient getInstanceClient(AWSInstanceInformation info) { + + String access = info.getAccess(); + if (access == null || access.isEmpty()) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getInstanceClient: No access key id available in instance document"); + } + return null; + } + + String secret = info.getSecret(); + if (secret == null || secret.isEmpty()) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getInstanceClient: No secret access key available in instance document"); + } + return null; + } + + String token = info.getToken(); + if (token == null || token.isEmpty()) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("getInstanceClient: No token available in instance document"); + } + return null; + } + + BasicSessionCredentials creds = new BasicSessionCredentials(access, secret, token); + return new AWSSecurityTokenServiceClient(creds); + } + + public boolean verifyInstanceIdentity(AWSInstanceInformation info) { + + StringBuilder serviceBuilder = new StringBuilder(256); + serviceBuilder.append(info.getDomain()).append('.').append(info.getService()); + String service = serviceBuilder.toString(); + + GetCallerIdentityRequest req = new GetCallerIdentityRequest(); + + try { + AWSSecurityTokenServiceClient client = getInstanceClient(info); + if (client == null) { + LOGGER.error("CloudStore: verifyInstanceIdentity - unable to get AWS STS client object"); + return false; + } + + GetCallerIdentityResult res = client.getCallerIdentity(req); + if (res == null) { + LOGGER.error("CloudStore: verifyInstanceIdentity - unable to get caller identity"); + return false; + } + + String arn = "arn:aws:sts::" + info.getAccount() + ":assumed-role/" + service + "/"; + if (!res.getArn().startsWith(arn)) { + LOGGER.error("CloudStore: verifyInstanceIdentity - ARN mismatch - request:" + + arn + " caller-identity: " + res.getArn()); + return false; + } + + return true; + + } catch (Exception ex) { + LOGGER.error("CloudStore: verifyInstanceIdentity - unable get caller identity: " + ex.getMessage()); + return false; + } + } + + public Identity generateIdentity(String csr, String serviceYrn) { + return ZTSUtils.generateIdentity(certSigner, csr, serviceYrn, caPEMCertificate); + } +} + diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/DataStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/DataStore.java new file mode 100644 index 00000000000..095bceb899f --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/DataStore.java @@ -0,0 +1,925 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store; + +import com.google.common.cache.Cache; +import com.google.common.cache.CacheBuilder; +import com.yahoo.rdl.*; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.config.AthenzConfig; +import com.yahoo.athenz.common.server.util.StringUtils; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.SignedDomain; +import com.yahoo.athenz.zms.SignedDomains; +import com.yahoo.athenz.zts.HostServices; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.cache.DataCache; +import com.yahoo.athenz.zts.cache.DataCacheProvider; +import com.yahoo.athenz.zts.utils.ZTSUtils; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PublicKey; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.concurrent.Executors; +import java.util.concurrent.ScheduledExecutorService; +import java.util.concurrent.TimeUnit; +import java.util.concurrent.locks.Lock; +import java.util.concurrent.locks.ReentrantReadWriteLock; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class DataStore implements DataCacheProvider { + + ChangeLogStore changeLogStore = null; + private CloudStore cloudStore = null; + private final Cache cacheStore; + final Cache zmsPublicKeyCache; + final Map> hostCache; + final Map publicKeyCache; + + long updDomainRefreshTime = 60; + long delDomainRefreshTime = 3600; + long lastDeleteRunTime = 0; + + private static ScheduledExecutorService scheduledThreadPool; + + private static final String ROLE_POSTFIX = ":role."; + + private final ReentrantReadWriteLock hostRWLock = new ReentrantReadWriteLock(); + private final Lock hostRLock = hostRWLock.readLock(); + private final Lock hostWLock = hostRWLock.writeLock(); + + private final ReentrantReadWriteLock pkeyRWLock = new ReentrantReadWriteLock(); + private final Lock pkeyRLock = pkeyRWLock.readLock(); + private final Lock pkeyWLock = pkeyRWLock.writeLock(); + + private static final String ZTS_PROP_DOMAIN_UPDATE_TIMEOUT = "athenz.zts.zms_domain_update_timeout"; + private static final String ZTS_PROP_DOMAIN_DELETE_TIMEOUT = "athenz.zts.zms_domain_delete_timeout"; + + private static final Logger LOGGER = LoggerFactory.getLogger(DataStore.class); + + public DataStore(ChangeLogStore clogStore, CloudStore cloudStore) { + + /* save our store objects */ + + this.changeLogStore = clogStore; + this.setCloudStore(cloudStore); + + /* generate our cache stores */ + + cacheStore = CacheBuilder.newBuilder().concurrencyLevel(25).build(); + zmsPublicKeyCache = CacheBuilder.newBuilder().concurrencyLevel(25).build(); + + hostCache = new HashMap<>(); + publicKeyCache = new HashMap<>(); + + /* our configured values are going to be in seconds so we need + * to convert our input in seconds to milliseconds */ + + updDomainRefreshTime = ZTSUtils.retrieveConfigSetting(ZTS_PROP_DOMAIN_UPDATE_TIMEOUT, 60); + delDomainRefreshTime = ZTSUtils.retrieveConfigSetting(ZTS_PROP_DOMAIN_DELETE_TIMEOUT, 3600); + + /* we will not let our domain delete update time be shorter + * than the domain update time so if tha't the case we'll + * set both to be the same value */ + + if (delDomainRefreshTime < updDomainRefreshTime) { + delDomainRefreshTime = updDomainRefreshTime; + } + + lastDeleteRunTime = System.currentTimeMillis(); + + /* load the zms public key from configuration files */ + + loadZMSPublicKeys(); + } + + String generateServiceKeyName(String domain, String service, String keyId) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append("."); + str.append(service); + str.append("_"); + str.append(keyId); + return str.toString(); + } + + void loadZMSPublicKeys() { + + String rootDir = System.getenv(ZTSConsts.STR_ENV_ROOT); + if (rootDir == null) { + rootDir = ZTSConsts.STR_DEF_ROOT; + } + + String confFileName = System.getProperty(ZTSConsts.ZTS_PROP_ATHENZ_CONF, + rootDir + "/conf/athenz/athenz.conf"); + Path path = Paths.get(confFileName); + AthenzConfig conf = null; + try { + conf = JSON.fromBytes(Files.readAllBytes(path), AthenzConfig.class); + ArrayList publicKeys = conf.getZmsPublicKeys(); + if (publicKeys != null) { + for (com.yahoo.athenz.zms.PublicKeyEntry publicKey : publicKeys) { + String id = publicKey.getId(); + String key = publicKey.getKey(); + if (key == null || id == null) { + continue; + } + PublicKey zmsKey = Crypto.loadPublicKey(Crypto.ybase64DecodeString(key)); + zmsPublicKeyCache.put(id, zmsKey); + } + } + } catch (IOException e) { + LOGGER.info("Unable to parse conf file " + confFileName); + return; + } + } + + boolean processLocalDomains(List localDomainList) { + + /* we can't have a lastModTime set if we have no local + * domains - in this case we're going to reset */ + + if (localDomainList.isEmpty()) { + return false; + } + + /* first we need to retrieve the list of domains from ZMS so we + * know what domains have been deleted already (if any) */ + + Set zmsDomainList = changeLogStore.getServerDomainList(); + if (zmsDomainList == null) { + return false; + } + + for (String domainName : localDomainList) { + + /* make sure this domain is still active in ZMS otherwise + * we'll just remove our local copy */ + + if (!zmsDomainList.contains(domainName)) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Removing local domain: " + domainName + ". Domain not in ZMS anymore."); + } + + deleteDomain(domainName); + continue; + } + + /* if we get a failure when processing a local domain then it + * indicates that we had an invalid domain file (possibly + * corrupted or hacked. In this case we're going to drop + * everything and request a full refresh from ZMS only if the + * change log store supports that functionality. Otherwise, + * we're going to just skip the domain and continue. */ + + if (!processLocalDomain(domainName) && changeLogStore.supportsFullRefresh()) { + return false; + } + } + + return true; + } + + public boolean init() { + + /* now let's retrieve the list of locally saved domains */ + + List localDomainList = changeLogStore.getLocalDomainList(); + + /* if we are not able to successfully process our local domains + * then we're going to ask our store to reset the changes + * and give us the list of all domains from ZMS */ + + if (!processLocalDomains(localDomainList)) { + + changeLogStore.setLastModificationTimestamp(null); + + /* if we have decided that we need to a full refresh + * we need to clean up and remove any cached domains */ + + for (String domainName : localDomainList) { + deleteDomain(domainName); + } + } + + /* after our local files have been processed now we need to + * retrieve the domains that were modified since the last + * modification time */ + + if (!processDomainUpdates()) { + return false; + } + + /* Start our monitoring thread to get changes from ZMS */ + + scheduledThreadPool = Executors.newScheduledThreadPool(1); + scheduledThreadPool.scheduleAtFixedRate(new DataUpdater(), updDomainRefreshTime, + updDomainRefreshTime, TimeUnit.SECONDS); + + return true; + } + + boolean processLocalDomain(String domainName) { + + boolean result = false; + try { + result = processDomain(changeLogStore.getSignedDomain(domainName), false); + } catch (Exception ex) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Unable to process local domain " + domainName + ": " + ex.getMessage()); + } + } + + if (!result) { + LOGGER.error("Invalid local domain: " + domainName + ". Full refresh from ZMS required."); + } + + return result; + } + + boolean validateSignedDomain(SignedDomain signedDomain) { + + DomainData domainData = signedDomain.getDomain(); + String keyId = signedDomain.getKeyId(); + String signature = signedDomain.getSignature(); + + PublicKey zmsKey = zmsPublicKeyCache.getIfPresent(keyId == null ? "0" : keyId); + if (zmsKey == null) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("ZMS Public Key (id: " + keyId + ") not available"); + } + + return false; + } + + boolean result = Crypto.verify(SignUtils.asCanonicalString(domainData), zmsKey, signature); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Domain '" + domainData.getName() + "' signature validation: " + result); + } + + return result; + } + + void processDomainRoles(DomainData domainData, DataCache domainCache) { + + List roles = domainData.getRoles(); + if (roles == null) { + return; + } + + for (Role role : roles) { + domainCache.processRole(role); + } + } + + void processDomainPolicies(DomainData domainData, DataCache domainCache) { + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = domainData.getPolicies(); + if (signedPolicies == null) { + return; + } + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = signedPolicies.getContents(); + if (domainPolicies == null) { + return; + } + + List policies = domainPolicies.getPolicies(); + if (policies == null) { + return; + } + + List roles = domainData.getRoles(); + HashMap roleMap = new HashMap<>(); + for (Role role : roles) { + roleMap.put(role.getName(), role); + } + for (com.yahoo.athenz.zms.Policy policy : policies) { + domainCache.processPolicy(domainData.getName(), policy, roleMap); + } + } + + void processDomainServiceIdentities(DomainData domainData, DataCache domainCache) { + + List services = domainData.getServices(); + if (services == null) { + return; + } + + for (com.yahoo.athenz.zms.ServiceIdentity service : services) { + domainCache.processServiceIdentity(service); + } + } + + public boolean processDomain(SignedDomain signedDomain, boolean saveInStore) { + + DomainData domainData = signedDomain.getDomain(); + String domainName = domainData.getName(); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Processing domain: " + domainName); + } + + /* before doing anything else let's validate our domain */ + + if (!validateSignedDomain(signedDomain)) { + return false; + } + + /* generate our cache object */ + + DataCache domainCache = new DataCache(); + + /* process the roles for this domain */ + + processDomainRoles(domainData, domainCache); + + /* process the policies for this domain */ + + processDomainPolicies(domainData, domainCache); + + /* finally process the service identities */ + + processDomainServiceIdentities(domainData, domainCache); + + /* save the full domain object with the cache entry itself + * since we need to that information to handle + * getServiceIdentity and getServiceIdentityList requests */ + + domainCache.setDomainData(domainData); + + /* add the entry to the cache and struct store */ + + addDomainToCache(domainName, domainCache); + + if (saveInStore) { + changeLogStore.saveLocalDomain(domainName, signedDomain); + } + + return true; + } + + boolean validDomainListResponse(Set zmsDomainList) { + + /* we're doing some basic validation to make sure our + * retrieved zms domain list is correct. At minimum our + * list must not be empty and include our sys.auth + * domain */ + + if (zmsDomainList.isEmpty()) { + return false; + } + + if (!zmsDomainList.contains(ZTSConsts.ATHENZ_SYS_DOMAIN)) { + return false; + } + + return true; + } + + // API + public boolean processDomainDeletes() { + + /* first let's retrieve the list domains loaded into + * our local cache */ + + ArrayList localDomainList = new ArrayList<>(getCacheStore().asMap().keySet()); + if (localDomainList.isEmpty()) { + return true; + } + + /* now retrieve the list of domains from ZMS */ + + Set zmsDomainList = changeLogStore.getServerDomainList(); + if (zmsDomainList == null) { + return false; + } + + /* make sure we don't have an empty list response + * from ZMS that would cause all of our domains + * to be deleted */ + + if (!validDomainListResponse(zmsDomainList)) { + return false; + } + + /* go through each local domain and if it doesn't + * exist in the list returned from ZMS we're going to + * delete that domain from our cache and change log store */ + + for (String domainName : localDomainList) { + + if (!zmsDomainList.contains(domainName)) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Removing local domain: " + domainName + ". Domain not in ZMS anymore."); + } + deleteDomain(domainName); + } + } + + return true; + } + + // Internal + void deleteDomain(String domainName) { + + /* first delete our data from the cache */ + + deleteDomainFromCache(domainName); + + /* then delete it from the struct store */ + + changeLogStore.removeLocalDomain(domainName); + } + + // Internal + boolean processSignedDomains(SignedDomains signedDomains) { + + /* if we have received no data from ZMS server then we're not + * going to update our last modification time and instead we'll + * just continue using the old one until we get some updates + * from ZMS Server */ + + if (signedDomains == null) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("No updates received from ZMS Server"); + } + return true; + } + + /* now process all of our domains */ + + List domains = signedDomains.getDomains(); + if (domains == null || domains.isEmpty()) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("No updates received from ZMS Server"); + } + return true; + } + + for (SignedDomain domain : domains) { + if (!processDomain(domain, true)) { + return false; + } + } + + return true; + } + + /** + * Poll for new domains and updated domains from the ChangeLogStore (ZMS). + * Called by {@code DataUpdater.run()} thread. Deletes are handled separately in {@code processDomainDeletes()} + * @return true if we have updates, false otherwise + */ + public boolean processDomainUpdates() { + + StringBuilder lastModTimestamp = new StringBuilder(128); + SignedDomains signedDomains = changeLogStore.getUpdatedSignedDomains(lastModTimestamp); + + /* if our data back was null and the last mod timestamp + * is also empty then we had a failure */ + + if (signedDomains == null && lastModTimestamp.length() == 0) { + return false; + } + + /* process all of our received updated domains */ + + boolean result = processSignedDomains(signedDomains); + if (result) { + changeLogStore.setLastModificationTimestamp(lastModTimestamp.toString()); + } + + return result; + } + + // API + public DomainData getDomainData(String name) { + + DataCache data = getCacheStore().getIfPresent(name); + if (data == null) { + return null; + } + return data.getDomainData(); + } + + // Internal + void addHostEntries(Map> hostMap) { + + if (hostMap == null || hostMap.isEmpty()) { + return; + } + + for (Map.Entry> entry : hostMap.entrySet()) { + List services = hostCache.get(entry.getKey()); + if (services == null) { + services = new ArrayList(); + hostCache.put(entry.getKey(), services); + } + services.addAll(entry.getValue()); + } + } + + // Internal + void removeHostEntries(Map> hostMap) { + + if (hostMap == null || hostMap.isEmpty()) { + return; + } + + for (Map.Entry> entry : hostMap.entrySet()) { + List services = hostCache.get(entry.getKey()); + if (services != null) { + services.removeAll(entry.getValue()); + } + } + } + + // Internal + void addPublicKeys(Map publicKeyMap) { + + if (publicKeyMap == null || publicKeyMap.isEmpty()) { + return; + } + + for (Map.Entry entry : publicKeyMap.entrySet()) { + publicKeyCache.put(entry.getKey(), entry.getValue()); + } + } + + // Internal + void removePublicKeys(Map publicKeyMap) { + + if (publicKeyMap == null || publicKeyMap.isEmpty()) { + return; + } + + for (Map.Entry entry : publicKeyMap.entrySet()) { + publicKeyCache.remove(entry.getKey()); + } + } + + // Internal + public void addDomainToCache(String name, DataCache dataCache) { + + /* before update the cache store with our updated data + * we need to remove the old data host and public key sets */ + + DataCache oldDataCache = getCacheStore().getIfPresent(name); + + try { + hostWLock.lock(); + if (oldDataCache != null) { + removeHostEntries(oldDataCache.getHostMap()); + } + addHostEntries(dataCache.getHostMap()); + } finally { + hostWLock.unlock(); + } + + try { + pkeyWLock.lock(); + if (oldDataCache != null) { + removePublicKeys(oldDataCache.getPublicKeyMap()); + } + addPublicKeys(dataCache.getPublicKeyMap()); + } finally { + pkeyWLock.unlock(); + } + + /* now let's see if we have a cloud account defined + * and update accordingly */ + + if (getCloudStore() != null) { + getCloudStore().updateAccount(name, dataCache.getDomainData().getAccount()); + } + + /* update the cache for the given domain */ + + getCacheStore().put(name, dataCache); + } + + // Internal + void deleteDomainFromCache(String name) { + + /* before we delete the domain from our cache, we need to + * remove the old data host and public key sets */ + + DataCache data = getCacheStore().getIfPresent(name); + if (data == null) { + return; + } + + try { + hostWLock.lock(); + removeHostEntries(data.getHostMap()); + } finally { + hostWLock.unlock(); + } + + try { + pkeyWLock.lock(); + removePublicKeys(data.getPublicKeyMap()); + } finally { + pkeyWLock.unlock(); + } + + getCacheStore().invalidate(name); + } + + // Internal + String roleCheckValue(String role, String prefix) { + + if (role == null) { + return null; + } + + String roleCheck = null; + if (!role.startsWith(prefix)) { + roleCheck = prefix + role; + } else { + roleCheck = role; + } + + return roleCheck; + } + + // Internal + void processStandardMembership(Set memberRoles, String rolePrefix, + String roleName, List accessibleRoles, boolean keepFullName) { + + /* if we have no member roles, then we haven't added anything + * to our return result list */ + + if (memberRoles == null) { + return; + } + + for (String member : memberRoles) { + addRoleToList(member, rolePrefix, roleName, accessibleRoles, keepFullName); + } + } + + // Internal + void processTrustMembership(DataCache data, String identity, String rolePrefix, + String roleName, List accessibleRoles, boolean keepFullName) { + + Map> trustedRolesMap = data.getTrustMap(); + + /* iterate through all trusted domains */ + + for (Map.Entry> trustedRole : trustedRolesMap.entrySet()) { + + processTrustedDomain(getCacheStore().getIfPresent(trustedRole.getKey()), + identity, rolePrefix, roleName, trustedRole.getValue(), + accessibleRoles, keepFullName); + } + } + + // API + @Override + public DataCache getDataCache(String domainName) { + return getCacheStore().getIfPresent(domainName); + } + + // API + public void getAccessibleRoles(DataCache data, String domainName, String identity, + String roleName, List accessibleRoles, boolean keepFullName) { + + /* if the domain hasn't been processed then we don't have anything to do */ + + if (data == null) { + return; + } + + String rolePrefix = domainName + ROLE_POSTFIX; + + /* first look through the members to see if the given identity is + * included in the list explicitly */ + + processStandardMembership(data.getMemberRoleSet(identity), + rolePrefix, roleName, accessibleRoles, keepFullName); + + /* now process all the roles that have trusted domain specified */ + + processTrustMembership(data, identity, rolePrefix, roleName, + accessibleRoles, keepFullName); + } + + // Internal + boolean checkRoleSet(String role, Set checkSet) { + + if (checkSet == null) { + return true; + } + + return checkSet.contains(role); + } + + // Internal + void addRoleToList(String role, String rolePrefix, String roleName, + List accessibleRoles, boolean keepFullName) { + + /* any roles we return must start with the domain role prefix */ + + if (!role.startsWith(rolePrefix)) { + return; + } + + /* and it must end with the suffix if specified */ + + if (roleName != null && !role.endsWith(roleName)) { + return; + } + + /* when returning the value we're going to skip the prefix */ + + if (keepFullName) { + accessibleRoles.add(role); + } else { + accessibleRoles.add(role.substring(rolePrefix.length())); + } + } + + // Internal + boolean roleMatchInSet(String role, Set memberRoles) { + + /* since most of the roles will not have wildcards we're + * going to carry out a simple contains check here and if + * that's successful then we're done and we don't have to + * do possibly more expensive regex checks */ + + if (memberRoles.contains(role)) { + return true; + } + + /* no match so let's try the regex pattern check */ + + String rolePattern = null; + for (String memberRole : memberRoles) { + rolePattern = StringUtils.patternFromGlob(memberRole); + if (role.matches(rolePattern)) { + return true; + } + } + + return false; + } + + // Internal + void processSingleTrustedDomainRole(String roleName, String rolePrefix, String roleSuffix, + Set memberRoles, List accessibleRoles, boolean keepFullName) { + + /* since our member role set can include wildcard domains we + * need to match the role as oppose to a direct check if the + * set contains the name */ + + if (!roleMatchInSet(roleName, memberRoles)) { + return; + } + + /* now check if the role is in the resource list as well */ + + addRoleToList(roleName, rolePrefix, roleSuffix, accessibleRoles, keepFullName); + } + + // Internal + void processTrustedDomain(DataCache trustData, String identity, String rolePrefix, + String roleSuffix, Set trustedResources, List accessibleRoles, + boolean keepFullName) { + + /* verify that our data cache and list of trusted resources are valid */ + + if (trustData == null || trustedResources == null) { + return; + } + + /* if we have no member roles, then return right away */ + + Set memberRoles = trustData.getMemberRoleSet(identity); + if (memberRoles == null) { + return; + } + + for (String resource : trustedResources) { + + /* in this case our resource is the role name */ + + processSingleTrustedDomainRole(resource, rolePrefix, roleSuffix, + memberRoles, accessibleRoles, keepFullName); + } + } + + // API + public String getPublicKey(String domain, String service, String keyId) { + + String publicKeyName = generateServiceKeyName(domain, service, keyId); + String publicKey = null; + + try { + pkeyRLock.lock(); + publicKey = publicKeyCache.get(publicKeyName); + } finally { + pkeyRLock.unlock(); + } + + if (publicKey == null && LOGGER.isDebugEnabled()) { + LOGGER.debug("Public key: " + publicKeyName + " not available"); + } + + return publicKey; + } + + // API + public HostServices getHostServices(String host) { + + HostServices result = new HostServices().setHost(host); + + try { + hostRLock.lock(); + + /* we need to make a copy of our list as oppose to just returning + * a reference since once we release the host read lock that list + * can be modified by the updater thread */ + + List services = hostCache.get(host); + if (services != null) { + result.setNames(new ArrayList<>(services)); + } + } finally { + hostRLock.unlock(); + } + + return result; + } + + public CloudStore getCloudStore() { + return cloudStore; + } + + public void setCloudStore(CloudStore cloudStore) { + this.cloudStore = cloudStore; + } + + public Cache getCacheStore() { + return cacheStore; + } + + class DataUpdater implements Runnable { + + @Override + public void run() { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("DataUpdater: Starting data updater thread..."); + } + + try { + processDomainUpdates(); + + /* check to see if we need to handle our delete domain list - + * make sure refresh time is converted to millis */ + + if (System.currentTimeMillis() - lastDeleteRunTime > delDomainRefreshTime * 1000) { + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("DataUpdater: Processing domain delete checks..."); + } + + processDomainDeletes(); + lastDeleteRunTime = System.currentTimeMillis(); + } + + } catch (Exception ex) { + LOGGER.error("DataUpdater: unable to process domain changes", ex); + } + } + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStore.java new file mode 100644 index 00000000000..2b92f570fa4 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStore.java @@ -0,0 +1,348 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.file; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.zms.SignedDomain; +import com.yahoo.athenz.zms.SignedDomains; +import com.yahoo.athenz.zms.ZMSClient; +import com.yahoo.athenz.zms.ZMSClientException; +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.rdl.*; + +import java.io.File; +import java.io.FileOutputStream; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.nio.file.attribute.PosixFilePermission; +import java.security.PrivateKey; +import java.util.EnumSet; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.ArrayList; +import java.util.Set; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * A simple implementation of StructStore that simply stores + * the Struct as JSON in its own file. + */ +public class ZMSFileChangeLogStore implements ChangeLogStore { + + private static final Logger LOGGER = LoggerFactory.getLogger(ZMSFileChangeLogStore.class); + + File rootDir = null; + public String lastModTime = null; + + private PrivateKey privateKey = null; + private String privateKeyId = "0"; + private Authority authority = null; + private String zmsUrl = null; + + private static final String ATTR_TAG = "tag"; + private static final String LAST_MOD_FNAME = ".lastModTime"; + private static final String ATTR_LAST_MOD_TIME = "lastModTime"; + private static final String ATHENZ_SYS_DOMAIN = "sys.auth"; + private static final String ATHENZ_ZTS_SERVICE = "zts"; + + private static final String ZTS_PROP_ZMS_URL_OVERRIDE = "athenz.zts.zms_url"; + + public ZMSFileChangeLogStore(String rootDirectory, PrivateKey privateKey, String privateKeyId) { + + // save our private key and authority + + this.privateKey = privateKey; + this.privateKeyId = privateKeyId; + + // setup principal authority for our zms client + + authority = new com.yahoo.athenz.auth.impl.PrincipalAuthority(); + + // check to see if we need to override the ZMS url from the config file + + zmsUrl = System.getProperty(ZTS_PROP_ZMS_URL_OVERRIDE, System.getenv("ZMS_URL")); + + // setup our directory for storing domain files + + rootDir = new File(rootDirectory); + + if (!rootDir.exists()) { + if (!rootDir.mkdirs()) { + error("cannot create specified root: " + rootDirectory); + } + } else { + if (!rootDir.isDirectory()) { + error("specified root is not a directory: " + rootDirectory); + } + } + + // make sure only the user has access + + Path rootPath = rootDir.toPath(); + Set perms = EnumSet.of(PosixFilePermission.OWNER_READ, + PosixFilePermission.OWNER_WRITE, PosixFilePermission.OWNER_EXECUTE); + try { + Files.setPosixFilePermissions(rootPath, perms); + } catch (IOException e) { + error("unable to set directory owner permissions: " + e.getMessage()); + } + + // retrieve our last modification timestamp + + lastModTime = retrieveLastModificationTime(); + + // if we do not have a last modification timestamp then we're going to + // clean up all locally cached domain files + + if (lastModTime == null) { + List localDomains = getLocalDomainList(); + for (String domain : localDomains) { + delete(domain); + } + } + } + + @Override + public boolean supportsFullRefresh() { + return true; + } + + @Override + public SignedDomain getSignedDomain(String domainName) { + + return get(domainName, SignedDomain.class); + } + + @Override + public void removeLocalDomain(String domainName) { + delete(domainName); + } + + @Override + public void saveLocalDomain(String domainName, SignedDomain signedDomain) { + put(domainName, JSON.bytes(signedDomain)); + } + + void setupDomainFile(File file) { + + try { + new FileOutputStream(file).close(); + file.setLastModified(System.currentTimeMillis()); + Path path = file.toPath(); + Set perms = EnumSet.of(PosixFilePermission.OWNER_READ, + PosixFilePermission.OWNER_WRITE); + Files.setPosixFilePermissions(path, perms); + } catch (IOException ex) { + ex.printStackTrace(); + error("unable to setup domain file with permissions: " + ex.getMessage()); + } + } + + public synchronized T get(String name, Class classType) { + + File file = new File(rootDir, name); + if (!file.exists()) { + return null; + } + Path path = Paths.get(file.toURI()); + try { + return JSON.fromBytes(Files.readAllBytes(path), classType); + } catch (IOException ex) { + LOGGER.error("Unable to retrieve domain file: {} error: {}", file.getPath(), ex.getMessage()); + } + return null; + } + + public synchronized void put(String name, byte[] data) { + + File file = new File(rootDir, name); + if (!file.exists()) { + setupDomainFile(file); + } + Path path = Paths.get(file.toURI()); + try { + Files.write(path, data); + } catch (IOException ex) { + ex.printStackTrace(); + error("unable to save domain file: " + file.getPath() + " error: " + ex.getMessage()); + } + } + + public synchronized void delete(String name) { + File file = new File(rootDir, name); + if (!file.exists()) { + return; + } + + try { + Files.delete(file.toPath()); + } catch (Exception exc) { + error("Cannot delete file or directory: " + name + " : exc: " + exc); + } + } + + @Override + public List getLocalDomainList() { + return scan(); + } + + List scan() { + + List names = new ArrayList(); + for (String name : rootDir.list()) { + + // we are going to skip any hidden files + + if (name.charAt(0) != '.') { + names.add(name); + } + } + + return names; + } + + ZMSClient getZMSClient() { + + PrincipalToken token = new PrincipalToken.Builder("S1", ATHENZ_SYS_DOMAIN, ATHENZ_ZTS_SERVICE) + .expirationWindow(24 * 60 * 60L).keyId(privateKeyId).build(); + token.sign(privateKey); + + Principal principal = SimplePrincipal.create(ATHENZ_SYS_DOMAIN, ATHENZ_ZTS_SERVICE, + token.getSignedToken(), authority); + + ZMSClient zmsClient = new ZMSClient(zmsUrl); + zmsClient.addCredentials(principal); + return zmsClient; + } + + @Override + public Set getServerDomainList() { + + Set zmsDomainList = null; + try (ZMSClient zmsClient = getZMSClient()) { + zmsDomainList = new HashSet(zmsClient.getDomainList().getNames()); + } catch (ZMSClientException ex) { + LOGGER.error("Unable to retrieve domain list from ZMS: " + ex.getMessage()); + return null; + } + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Number of ZMS domains: " + zmsDomainList.size()); + } + + return zmsDomainList; + } + + public String retrieveLastModificationTime() { + Struct lastModStruct = get(LAST_MOD_FNAME, Struct.class); + if (lastModStruct == null) { + return null; + } + return lastModStruct.getString(ATTR_LAST_MOD_TIME); + } + + @Override + public void setLastModificationTimestamp(String newLastModTime) { + + lastModTime = newLastModTime; + if (lastModTime == null) { + delete(LAST_MOD_FNAME); + } else { + + // update the last modification timestamp + + Struct lastModStruct = new Struct(); + lastModStruct.put(ATTR_LAST_MOD_TIME, lastModTime); + put(LAST_MOD_FNAME, JSON.bytes(lastModStruct)); + } + } + + String retrieveTagHeader(Map> responseHeaders) { + + // our tag value is going to be returned from the server in the + // response headers as the value to the key "tag" + + List tagData = responseHeaders.get(ATTR_TAG); + if (tagData == null || tagData.isEmpty()) { + LOGGER.error("Response headers from ZMS does not include 'ETag/tag' value"); + return null; + } + return tagData.get(0); + } + + @Override + public SignedDomains getUpdatedSignedDomains(StringBuilder lastModTimeBuffer) { + + try (ZMSClient zmsClient = getZMSClient()) { + + // request all the changes from ZMS + + Map> responseHeaders = new HashMap>(); + SignedDomains signedDomains = zmsClient.getSignedDomains(lastModTime, null, null, responseHeaders); + + // retrieve the tag value for the request + + String newLastModTime = retrieveTagHeader(responseHeaders); + if (newLastModTime == null) { + return null; + } + + // set the last modification time to be returned to the caller + + lastModTimeBuffer.setLength(0); + lastModTimeBuffer.append(newLastModTime); + + return signedDomains; + + } catch (ZMSClientException e) { + LOGGER.error("Error when refreshing data from ZMS: " + e.getMessage()); + return null; + } + } + + public static void deleteDirectory(File file) { + if (!file.exists()) { + return; + } + + if (file.isDirectory()) { + + File[] fileList = file.listFiles(); + if (fileList != null) { + for (File ff : fileList) { + deleteDirectory(ff); + } + } + } + if (!file.delete()) { + error("Cannot delete file: " + file); + } + } + + static void error(String msg) { + LOGGER.error(msg); + throw new RuntimeException("ZMSFileChangeLogStore: " + msg); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreFactory.java new file mode 100644 index 00000000000..bce58c6ca3d --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreFactory.java @@ -0,0 +1,35 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.file; + +import java.io.File; +import java.security.PrivateKey; + +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.ChangeLogStoreFactory; +import com.yahoo.athenz.zts.store.CloudStore; + +public class ZMSFileChangeLogStoreFactory implements ChangeLogStoreFactory { + + private static final String ZTS_DATA_STORE = "zts_store"; + + public ChangeLogStore create(String ztsHomeDir, PrivateKey privateKey, + String privateKeyId, CloudStore cloudStore) { + + return new ZMSFileChangeLogStore(ztsHomeDir + File.separator + ZTS_DATA_STORE, privateKey, + privateKeyId); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStore.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStore.java new file mode 100644 index 00000000000..d3993dbaf35 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStore.java @@ -0,0 +1,234 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.s3; + +import java.io.BufferedReader; +import java.io.InputStreamReader; +import java.util.ArrayList; +import java.util.Collection; +import java.util.HashSet; +import java.util.List; +import java.util.Set; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.amazonaws.services.s3.AmazonS3; +import com.amazonaws.services.s3.model.GetObjectRequest; +import com.amazonaws.services.s3.model.ListObjectsRequest; +import com.amazonaws.services.s3.model.ObjectListing; +import com.amazonaws.services.s3.model.S3Object; +import com.amazonaws.services.s3.model.S3ObjectSummary; +import com.yahoo.athenz.zms.SignedDomain; +import com.yahoo.athenz.zms.SignedDomains; +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.CloudStore; +import com.yahoo.rdl.JSON; + +public class S3ChangeLogStore implements ChangeLogStore { + + private static final Logger LOGGER = LoggerFactory.getLogger(S3ChangeLogStore.class); + private static final String ZTS_PROP_BUCKET_NAME = "athenz.zts.aws_bucket_name"; + private static final String ZTS_BUCKET_DEFAULT = "athenz-domain-sys.auth"; + + long lastModTime = 0; + CloudStore cloudStore = null; + String s3BucketName = null; + + public S3ChangeLogStore(CloudStore cloudStore) { + this.cloudStore = cloudStore; + s3BucketName = System.getProperty(ZTS_PROP_BUCKET_NAME, ZTS_BUCKET_DEFAULT); + + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("AWSS3ChangeLog: S3 Bucket name: " + s3BucketName); + } + } + + @Override + public boolean supportsFullRefresh() { + return false; + } + + @Override + public SignedDomain getSignedDomain(String domainName) { + AmazonS3 s3 = getS3Client(); + return getSignedDomain(s3, domainName); + } + + SignedDomain getSignedDomain(AmazonS3 s3, String domainName) { + + SignedDomain signedDomain = null; + try { + S3Object object = s3.getObject(new GetObjectRequest(s3BucketName, domainName)); + if (object == null) { + LOGGER.error("AWSS3ChangeLog: getSignedDomain - domain not found " + domainName); + return null; + } + + BufferedReader reader = new BufferedReader(new InputStreamReader(object.getObjectContent())); + StringBuilder data = new StringBuilder(); + String line; + while ((line = reader.readLine()) != null) { + data.append(line); + } + reader.close(); + signedDomain = JSON.fromString(data.toString(), SignedDomain.class); + } catch (Exception ex) { + LOGGER.error("AWSS3ChangeLog: getSignedDomain - unable to get domain " + domainName + + " error: " + ex.getMessage()); + } + return signedDomain; + } + + @Override + public void removeLocalDomain(String domainName) { + + // in AWS our Athenz syncer is responsible for pushing new + // changes including removing deleted domain to S3 so this + // api is just a no-op + + return; + } + + @Override + public void saveLocalDomain(String domainName, SignedDomain signedDomain) { + + // in AWS our Athenz syncer is responsible for pushing new + // changes into S3 so this api is just a no-op + + return; + } + + /** + * list the objects in the zts bucket. If te mod time is specified as 0 + * then we want to list all objects otherwise, we only list objects + * that are newer than the specified timestamp + * @param s3 AWS S3 client object + * @param domains collection to be updated to include domain names + * @param modTime only include domains newer than this timestamp + */ + void listObjects(AmazonS3 s3, Collection domains, long modTime) { + + ObjectListing objectListing = s3.listObjects(new ListObjectsRequest() + .withBucketName(s3BucketName)); + + String objectName = null; + while (objectListing != null) { + + // process each entry in our result set and add the domain + // name to our return list + + for (S3ObjectSummary objectSummary : objectListing.getObjectSummaries()) { + + // if mod time is specified then make sure we automatically skip + // any domains older than the specified value + + if (modTime > 0 && objectSummary.getLastModified().getTime() <= modTime) { + continue; + } + + // for now skip any folders/objects that start with '.' + + objectName = objectSummary.getKey(); + if (objectName.charAt(0) == '.') { + continue; + } + domains.add(objectName); + } + + // check if the object listing is truncated or not (break out in this case) + // technically we can skip this call and just call listNextBatchOfResults + // since that returns null if the object listing is not truncated but + // this direct check here makes the logic easier to follow + + if (!objectListing.isTruncated()) { + break; + } + + objectListing = s3.listNextBatchOfObjects(objectListing); + } + } + + @Override + public List getLocalDomainList() { + + // check to see if we need to maintain our last modification time. + // this will be necessary if our last mod time field is null. We need + // to save the timestamp at the beginning just in case we end up getting + // paged results and while processing the last page, the Syncer pushes + // updated domains from the earlier pages + + if (lastModTime == 0) { + lastModTime = System.currentTimeMillis(); + } + + ArrayList domains = new ArrayList<>(); + listObjects(getS3Client(), domains, 0); + return domains; + } + + @Override + public Set getServerDomainList() { + + HashSet domains = new HashSet<>(); + listObjects(getS3Client(), domains, 0); + return domains; + } + + @Override + public SignedDomains getUpdatedSignedDomains(StringBuilder lastModTimeBuffer) { + + // We need save the timestamp at the beginning just in case we end up getting + // paged results and while processing the last page, S3 gets pushed + // updated domains from the earlier pages + + lastModTimeBuffer.append(System.currentTimeMillis()); + + // AWS S3 API does not provide support for listing objects filtered + // based on its last modification timestamp so we need to get + // the full list and filter ourselves + + AmazonS3 s3 = getS3Client(); + ArrayList domains = new ArrayList<>(); + listObjects(s3, domains, lastModTime); + + ArrayList signedDomainList = new ArrayList<>(); + SignedDomain signedDomain = null; + for (String domain : domains) { + signedDomain = getSignedDomain(s3, domain); + if (signedDomain != null) { + signedDomainList.add(signedDomain); + } + } + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(signedDomainList); + return signedDomains; + } + + @Override + public void setLastModificationTimestamp(String newLastModTime) { + if (newLastModTime == null) { + lastModTime = 0; + } else { + lastModTime = Long.parseLong(newLastModTime); + } + } + + AmazonS3 getS3Client() { + return cloudStore.getS3Client(); + } +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreFactory.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreFactory.java new file mode 100644 index 00000000000..a31a2bd49b0 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreFactory.java @@ -0,0 +1,33 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.s3; + +import java.security.PrivateKey; + +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.ChangeLogStoreFactory; +import com.yahoo.athenz.zts.store.CloudStore; + +public class S3ChangeLogStoreFactory implements ChangeLogStoreFactory { + + @Override + public ChangeLogStore create(String ztsHomeDir, PrivateKey privateKey, + String privateKeyId, CloudStore cloudStore) { + + return new S3ChangeLogStore(cloudStore); + } + +} diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/utils/ZTSUtils.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/utils/ZTSUtils.java new file mode 100644 index 00000000000..e04e199d989 --- /dev/null +++ b/servers/zts/src/main/java/com/yahoo/athenz/zts/utils/ZTSUtils.java @@ -0,0 +1,221 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.utils; + +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.eclipse.jetty.util.ssl.SslContextFactory; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.auth.util.CryptoException; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.zts.Identity; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.store.DataStore; + +import javax.naming.InvalidNameException; +import javax.naming.ldap.LdapName; +import javax.naming.ldap.Rdn; + +public class ZTSUtils { + + private static final Logger LOGGER = LoggerFactory.getLogger(DataStore.class); + + public static final String ZTS_DEFAULT_EXCLUDED_CIPHER_SUITES = "SSL_RSA_WITH_DES_CBC_SHA," + + "SSL_DHE_RSA_WITH_DES_CBC_SHA,SSL_DHE_DSS_WITH_DES_CBC_SHA," + + "SSL_RSA_EXPORT_WITH_RC4_40_MD5,SSL_RSA_EXPORT_WITH_DES40_CBC_SHA," + + "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"; + public static final String ZTS_DEFAULT_EXCLUDED_PROTOCOLS = "SSLv2,SSLv3"; + + public static int retrieveConfigSetting(String property, int defaultValue) { + + int settingValue; + try { + String propValue = System.getProperty(property); + if (propValue == null) { + return defaultValue; + } + + settingValue = Integer.parseInt(propValue); + + if (settingValue <= 0) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Invalid " + property + " value: " + propValue + + ", defaulting to " + defaultValue + " seconds"); + } + settingValue = defaultValue; + } + } catch (Exception ex) { + if (LOGGER.isDebugEnabled()) { + LOGGER.debug("Invalid " + property + " value, defaulting to " + + defaultValue + " seconds: " + ex.getMessage()); + } + settingValue = defaultValue; + } + + return settingValue; + } + + public static SslContextFactory createSSLContextObject(String[] clientProtocols) { + + String keyStorePath = System.getProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH); + String keyStorePassword = System.getProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD); + String keyStoreType = System.getProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE, "PKCS12"); + String keyManagerPassword = System.getProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD); + String trustStorePath = System.getProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH); + String trustStorePassword = System.getProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD); + String trustStoreType = System.getProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + String excludedCipherSuites = System.getProperty(ZTSConsts.ZTS_PROP_EXCLUDED_CIPHER_SUITES, + ZTS_DEFAULT_EXCLUDED_CIPHER_SUITES); + String excludedProtocols = System.getProperty(ZTSConsts.ZTS_PROP_EXCLUDED_PROTOCOLS, + ZTS_DEFAULT_EXCLUDED_PROTOCOLS); + Boolean wantClientAuth = Boolean.parseBoolean(System.getProperty(ZTSConsts.ZTS_PROP_WANT_CLIENT_CERT, "false")); + + SslContextFactory sslContextFactory = new SslContextFactory(); + if (keyStorePath != null) { + LOGGER.info("createSSLContextObject: using SSL KeyStore path: " + keyStorePath); + sslContextFactory.setKeyStorePath(keyStorePath); + } + if (keyStorePassword != null) { + sslContextFactory.setKeyStorePassword(keyStorePassword); + } + sslContextFactory.setKeyStoreType(keyStoreType); + + if (keyManagerPassword != null) { + sslContextFactory.setKeyManagerPassword(keyManagerPassword); + } + if (trustStorePath != null) { + LOGGER.info("createSSLContextObject: using SSL TrustStore path: " + trustStorePath); + sslContextFactory.setTrustStorePath(trustStorePath); + } + if (trustStorePassword != null) { + sslContextFactory.setTrustStorePassword(trustStorePassword); + } + sslContextFactory.setTrustStoreType(trustStoreType); + + if (excludedCipherSuites.length() != 0) { + sslContextFactory.setExcludeCipherSuites(excludedCipherSuites.split(",")); + } + + if (excludedProtocols.length() != 0) { + sslContextFactory.setExcludeProtocols(excludedProtocols.split(",")); + } + + sslContextFactory.setWantClientAuth(wantClientAuth); + if (clientProtocols != null) { + sslContextFactory.setIncludeProtocols(clientProtocols); + } + + return sslContextFactory; + } + + public static final boolean emitMonmetricError(int errorCode, String caller, String domainName, Metric metric) { + + if (errorCode < 1) { + return false; + } + if (caller == null || caller.length() == 0) { + return false; + } + caller = caller.trim(); + String alphanum = "^[a-zA-Z0-9]*$"; + if (!caller.matches(alphanum)) { + return false; + } + + // Set 3 scoreboard error metrics: + // (1) cumulative "ERROR" (of all zts request and error types) + // (2) cumulative granular zts request and error type (eg- + // "getdomainlist_error_400") + // (3) cumulative error type (of all zts requests) (eg- "error_404") + String errCode = Integer.toString(errorCode); + metric.increment("ERROR"); + if (domainName != null) { + metric.increment(caller.toLowerCase() + "_error_" + errCode, domainName); + } else { + metric.increment(caller.toLowerCase() + "_error_" + errCode); + } + metric.increment("error_" + errCode); + + return true; + } + + public static boolean validateCertificateRequest(PKCS10CertificationRequest certReq, String serviceYrn) { + String cnCertReq = null; + try { + LdapName ldapDN = new LdapName(certReq.getSubject().toString()); + for (Rdn rdn: ldapDN.getRdns()) { + if (rdn.getType().equalsIgnoreCase("cn")) { + cnCertReq = (String) rdn.getValue(); + break; + } + } + } catch (InvalidNameException ex) { + LOGGER.error("YSvcCertStore::validateCertificateRequest - unable to extract csr cn", ex); + return false; + } + + if (cnCertReq == null) { + LOGGER.error("YSvcCertStore::validateCertificateRequest - unable to extract csr cn: " + + certReq.toString()); + return false; + } + + if (!cnCertReq.equalsIgnoreCase(serviceYrn)) { + LOGGER.error("YSvcCertStore::validateCertificateRequest - cn mismatch: " + + cnCertReq + " vs. " + serviceYrn); + return false; + } + + return true; + } + + public static Identity generateIdentity(CertSigner certSigner, String csr, String serviceYrn, + String caPEMCertificate) { + + // first we need to validate our csr to make sure + // it contains the right common name + + try { + PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); + if (certReq == null) { + LOGGER.error("YSvcCertStore::generateIdentity: unable to parse PKCS10 cert request"); + return null; + } + + if (!validateCertificateRequest(certReq, serviceYrn)) { + LOGGER.error("YSvcCertStore::generateIdentity: unable to validate PKCS10 cert request"); + return null; + } + + } catch (CryptoException ex) { + LOGGER.error("generateIdentity: unable to generate identity certificate: ", ex); + return null; + } + + // generate a certificate for this certificate request + + String pemCert = certSigner.generateX509Certificate(csr); + if (pemCert == null || pemCert.isEmpty()) { + LOGGER.error("generateIdentity: CertSigner was unable to generate X509 certificate"); + return null; + } + + return new Identity().setName(serviceYrn).setCertificate(pemCert).setCaCertBundle(caPEMCertificate); + } +} diff --git a/servers/zts/src/main/rdl/ZTS.rdl b/servers/zts/src/main/rdl/ZTS.rdl new file mode 100644 index 00000000000..c33cf80772b --- /dev/null +++ b/servers/zts/src/main/rdl/ZTS.rdl @@ -0,0 +1,17 @@ +// Copyright 2016 Yahoo Inc. +// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms. + +// +// The Authorization Token Service (ZTS) API +// +name ZTS; +use "rdl"; +version 1; +namespace com.yahoo.athenz.zts; + +include "../../../../../core/zts/src/main/rdl/ZTS.rdl"; + +// Get RDL Schema +resource rdl.Schema GET "/schema" { + expected OK; +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ResourceExceptionTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ResourceExceptionTest.java new file mode 100644 index 00000000000..bd74898726e --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/ResourceExceptionTest.java @@ -0,0 +1,69 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; + +import org.testng.annotations.Test; + +public class ResourceExceptionTest { + + @Test + public void testCodeToString() { + + assertEquals("OK", ResourceException.codeToString(200)); + assertEquals("Created", ResourceException.codeToString(201)); + assertEquals("Accepted", ResourceException.codeToString(202)); + assertEquals("No Content", ResourceException.codeToString(204)); + assertEquals("Moved Permanently", ResourceException.codeToString(301)); + assertEquals("Found", ResourceException.codeToString(302)); + assertEquals("See Other", ResourceException.codeToString(303)); + assertEquals("Not Modified", ResourceException.codeToString(304)); + assertEquals("Temporary Redirect", ResourceException.codeToString(307)); + assertEquals("Bad Request", ResourceException.codeToString(400)); + assertEquals("Unauthorized", ResourceException.codeToString(401)); + assertEquals("Forbidden", ResourceException.codeToString(403)); + assertEquals("Not Found", ResourceException.codeToString(404)); + assertEquals("Conflict", ResourceException.codeToString(409)); + assertEquals("Gone", ResourceException.codeToString(410)); + assertEquals("Precondition Failed", ResourceException.codeToString(412)); + assertEquals("Unsupported Media Type", ResourceException.codeToString(415)); + assertEquals("Internal Server Error", ResourceException.codeToString(500)); + assertEquals("Not Implemented", ResourceException.codeToString(501)); + assertEquals("1001", ResourceException.codeToString(1001)); + } + + @Test + public void testCodeOnly() { + + ResourceException exc = new ResourceException(400); + assertEquals(exc.getData().toString(), "{code: 400, message: \"Bad Request\"}"); + } + + @Test + public void testGetData() { + + ResourceException exc = new ResourceException(400, "Invalid domain name"); + assertEquals(exc.getData(), "Invalid domain name"); + } + + @Test + public void testGetDataCast() { + + ResourceException exc = new ResourceException(400, new Integer(5000)); + assertEquals(exc.getData(Integer.class), new Integer(5000)); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ResultObjectTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ResultObjectTest.java new file mode 100644 index 00000000000..0c8e69e2313 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/ResultObjectTest.java @@ -0,0 +1,58 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; + +import javax.ws.rs.WebApplicationException; + +import org.testng.annotations.Test; + +public class ResultObjectTest { + + @Test + public void testDomainSignedPolicyDataResult() { + GetDomainSignedPolicyDataResult object = new GetDomainSignedPolicyDataResult(null); + assertFalse(object.isAsync()); + + try { + object.done(101); + fail(); + } catch (WebApplicationException ex) { + } + } + + @Test + public void testDoneException() { + GetDomainSignedPolicyDataResult object = new GetDomainSignedPolicyDataResult(null); + DomainSignedPolicyData data = new DomainSignedPolicyData().setKeyId("test"); + try { + object.done(101, data, "test"); + fail(); + } catch (WebApplicationException ex) { + } + } + + @Test + public void testDoneException2() { + GetDomainSignedPolicyDataResult object = new GetDomainSignedPolicyDataResult(null); + try { + object.done(101, "test"); + fail(); + } catch (WebApplicationException ex) { + } + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/RsrcCtxWrapperTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/RsrcCtxWrapperTest.java new file mode 100644 index 00000000000..5cb75cc2ae3 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/RsrcCtxWrapperTest.java @@ -0,0 +1,131 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Authorizer; +import com.yahoo.athenz.auth.Principal; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.yahoo.athenz.common.server.rest.Http.AuthorityList; + +public class RsrcCtxWrapperTest { + + @Test + public void TestRsrcCtxWrapperSimpleAssertion() { + HttpServletRequest reqMock = Mockito.mock(HttpServletRequest.class); + HttpServletResponse resMock = Mockito.mock(HttpServletResponse.class); + + AuthorityList authListMock = new AuthorityList(); + Authorizer authorizerMock = Mockito.mock(Authorizer.class); + Authority authMock = Mockito.mock(Authority.class); + + Principal prin = Mockito.mock(Principal.class); + + Mockito.when(authMock.getHeader()).thenReturn("testheader"); + Mockito.when(reqMock.getHeader("testheader")).thenReturn("testcred"); + Mockito.when(authMock.getCredSource()).thenReturn(com.yahoo.athenz.auth.Authority.CredSource.HEADER); + Mockito.when(authMock.authenticate(Mockito.anyString(), Mockito.anyString(), Mockito.anyString(), Mockito.any())) + .thenReturn(prin); + Mockito.when(reqMock.getRemoteAddr()).thenReturn("1.1.1.1"); + Mockito.when(reqMock.getMethod()).thenReturn("POST"); + authListMock.add(authMock); + + RsrcCtxWrapper wrapper = new RsrcCtxWrapper(reqMock, resMock, authListMock, authorizerMock); + + assertNotNull(wrapper.context()); + + // default principal should be null + assertEquals(wrapper.principal(), null); + + assertEquals(wrapper.request(), reqMock); + assertEquals(wrapper.response(), resMock); + + wrapper.authenticate(); + + // after authenticate, principal should be set + assertEquals(wrapper.principal(), prin); + + // invalid kerberos request + try { + wrapper.authenticateKerberos(); + fail(); + } catch (ResourceException ex) { + assertNotNull(ex); + } + } + + @Test + public void TestAuthorize() { + HttpServletRequest reqMock = Mockito.mock(HttpServletRequest.class); + HttpServletResponse resMock = Mockito.mock(HttpServletResponse.class); + + AuthorityList authListMock = new AuthorityList(); + Authorizer authorizerMock = Mockito.mock(Authorizer.class); + Authority authMock = Mockito.mock(Authority.class); + + Principal prin = Mockito.mock(Principal.class); + + Mockito.when(authMock.getHeader()).thenReturn("testheader"); + Mockito.when(reqMock.getHeader("testheader")).thenReturn("testcred"); + Mockito.when(authMock.getCredSource()).thenReturn(com.yahoo.athenz.auth.Authority.CredSource.HEADER); + Mockito.when(authMock.authenticate(Mockito.anyString(), Mockito.anyString(), Mockito.anyString(), Mockito.any())) + .thenReturn(prin); + Mockito.when(reqMock.getRemoteAddr()).thenReturn("1.1.1.1"); + Mockito.when(reqMock.getMethod()).thenReturn("POST"); + authListMock.add(authMock); + + // force true access right + Mockito.when(authorizerMock.access(Mockito.anyString(), Mockito.anyString(), Mockito.any(), Mockito.any())) + .thenReturn(true); + + RsrcCtxWrapper wrapper = new RsrcCtxWrapper(reqMock, resMock, authListMock, authorizerMock); + + wrapper.authorize("add-domain", "test", "test"); + + // after authorize success, principal should be set + assertEquals(wrapper.principal(), prin); + } + + @Test(expectedExceptions = { ResourceException.class }) + public void TestAuthorizeInvalid() { + HttpServletRequest reqMock = Mockito.mock(HttpServletRequest.class); + HttpServletResponse resMock = Mockito.mock(HttpServletResponse.class); + + AuthorityList authListMock = new AuthorityList(); + Authorizer authorizerMock = Mockito.mock(Authorizer.class); + + Mockito.when(reqMock.getHeader("testheader")).thenReturn("testcred"); + Mockito.when(reqMock.getRemoteAddr()).thenReturn("1.1.1.1"); + Mockito.when(reqMock.getMethod()).thenReturn("POST"); + + // force true access right + Mockito.when(authorizerMock.access(Mockito.anyString(), Mockito.anyString(), Mockito.any(), Mockito.any())) + .thenReturn(true); + + RsrcCtxWrapper wrapper = new RsrcCtxWrapper(reqMock, resMock, authListMock, authorizerMock); + + // when not set authority + wrapper.authorize("add-domain", "test", "test"); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSBinderTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSBinderTest.java new file mode 100644 index 00000000000..5d5602414b7 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSBinderTest.java @@ -0,0 +1,39 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; +import org.mockito.Mockito; + +import org.testng.annotations.Test; + +public class ZTSBinderTest { + + @Test + public void testZTSBinder() { + ZTSImpl handlerMock = Mockito.mock(ZTSImpl.class); + ZTSBinder binder = new ZTSBinder(handlerMock); + + assertTrue(binder.toString().contains("Binder:")); + } + + @Test(expectedExceptions = { IllegalArgumentException.class }) + public void testZTSBinderConfigure() { + // shouldn't accessed configure + ZTSImpl handlerMock = Mockito.mock(ZTSImpl.class); + new ZTSBinder(handlerMock).configure(); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSDaemonTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSDaemonTest.java new file mode 100644 index 00000000000..cebcfd4c2c7 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSDaemonTest.java @@ -0,0 +1,98 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import org.apache.commons.daemon.DaemonContext; +import org.mockito.Mockito; +import org.testng.annotations.Test; +import static org.testng.Assert.*; + +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.zts.cert.CertSigner; + +public class ZTSDaemonTest { + + @Test + public void testZTSDaemon() throws Exception { + + ZTSDaemon daemon = new ZTSDaemon(); + + DaemonContext ctxMock = Mockito.mock(DaemonContext.class); + Mockito.when(ctxMock.getArguments()).thenReturn(null); + + daemon.init(ctxMock); + + // nothing to do + daemon.start(); + daemon.stop(); + daemon.destroy(); + } + + @Test + public void testZTSGetAuditLogger() { + AuditLogger logger = ZTS.getAuditLogger(); + assertNotNull(logger); + } + + @Test + public void testZTSGetAuthority() { + assertNull(ZTS.getAuthority("test")); + } + + @Test + public void testZTSGetServerHostName() { + assertNotNull(ZTS.getServerHostName()); + } + + @Test + public void testZTSGetPortNumber() { + + // default + assertEquals(ZTS.getPortNumber("unsetproperty", 4080), 4080); + + // set appropriate property + System.setProperty("testportnum", "4444"); + assertEquals(ZTS.getPortNumber("testportnum", 4080), 4444); + + // set invalid port number -> should set default + System.setProperty("testportnum", "70000"); + assertEquals(ZTS.getPortNumber("testportnum", 4080), 4080); + + } + + @Test + public void testZTSGetCertSigner() { + assertNotNull(ZTS.getCertSigner()); + } + + @Test + public void testZTSGetSvcCertStore() { + CertSigner signer = ZTS.getCertSigner(); + + assertNotNull(ZTS.getSvcCertStore(signer)); + } + + @Test + public void testZTSGetMetric() { + assertNotNull(ZTS.getMetric()); + } + + @Test + public void testZTSGetPrivateKeyStore() { + assertNotNull(ZTS.getPrivateKeyStore("localhost")); + } + +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSImplTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSImplTest.java new file mode 100644 index 00000000000..fff61947a83 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSImplTest.java @@ -0,0 +1,3662 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.assertNull; +import static org.testng.Assert.assertTrue; +import static org.testng.Assert.fail; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.cert.X509Certificate; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.HashMap; +import java.util.HashSet; +import java.util.concurrent.TimeUnit; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.Authority; +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.server.log.AuditLogFactory; +import com.yahoo.athenz.common.server.log.AuditLogMsgBuilder; +import com.yahoo.athenz.common.server.log.AuditLogger; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zms.SignedDomain; +import com.yahoo.athenz.zts.ZTSAuthorizer.AccessStatus; +import com.yahoo.athenz.zts.cache.DataCache; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.MockCertSigner; +import com.yahoo.athenz.zts.cert.MockCertSignerFactory; +import com.yahoo.athenz.zts.cert.SvcCertStore; +import com.yahoo.athenz.zts.cert.impl.YSvcCertStore; +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.CloudStore; +import com.yahoo.athenz.zts.store.CloudStoreTest; +import com.yahoo.athenz.zts.store.DataStore; +import com.yahoo.athenz.zts.store.MockCloudStore; +import com.yahoo.athenz.zts.store.file.MockZMSFileChangeLogStore; +import com.yahoo.athenz.zts.store.file.ZMSFileChangeLogStore; +import com.yahoo.athenz.zts.utils.ZTSUtils; +import com.yahoo.rdl.Schema; +import com.yahoo.rdl.Timestamp; + +public class ZTSImplTest { + + int roleTokenDefaultTimeout = 2400; + int roleTokenMaxTimeout = 96000; + + ZTSImpl zts = null; + ZTSAuthorizer authorizer = null; + DataStore store = null; + PrivateKey privateKey = null; + PublicKey publicKey = null; + + static final String ZTS_DATA_STORE_PATH = "/tmp/zts_server_unit_tests/zts_root"; + static final String ZTS_Y64_CERT0 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FDMXRHU1ZDQTh3bDVldzVZNzZXajJySkFVRApZYW5FSmZLbUFseDVjUS84a" + + "EtFVWZTU2dwWHIzQ3pkaDFhMjZkbGI3bW1LMjlxbVhKWGg2dW1XOUF5ZlRPS1ZvCis2QVNsb1ZVM2F2dnVmbE" + + "dVT0VnMmpzbWRha1IyNEtjTGpBdTZRclVlNDE3bEczdDhxU1BJR2pTNUMrQ3NKVXcKaDA0aEh4NWYrUEV3eFY" + + "0cmJRSURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT0 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1tGSVCA8wl5ew5Y76Wj2rJAUD\n" + + "YanEJfKmAlx5cQ/8hKEUfSSgpXr3Czdh1a26dlb7mmK29qmXJXh6umW9AyfTOKVo\n" + + "+6ASloVU3avvuflGUOEg2jsmdakR24KcLjAu6QrUe417lG3t8qSPIGjS5C+CsJUw\n" + + "h04hHx5f+PEwxV4rbQIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + final static String AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_BEGIN = "{\n" + + " \"devpayProductCodes\" : null,\n" + + " \"availabilityZone\" : \"us-west-2a\",\n" + + " \"privateIp\" : \"10.10.10.10\",\n" + + " \"version\" : \"2010-08-31\",\n" + + " \"instanceId\" : \"i-056921225f1fbb47a\",\n" + + " \"billingProducts\" : null,\n" + + " \"instanceType\" : \"t2.micro\",\n" + + " \"accountId\" : \"111111111111\",\n" + + " \"pendingTime\" : \""; + final static String AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_END = "\",\n" + + " \"imageId\" : \"ami-c229c0a2\",\n" + + " \"architecture\" : \"x86_64\",\n" + + " \"kernelId\" : null,\n" + + " \"ramdiskId\" : null,\n" + + " \"region\" : \"us-west-2\"\n" + + "}"; + + private static final String MOCKCLIENTADDR = "10.11.12.13"; + @Mock HttpServletRequest mockServletRequest; + @Mock HttpServletResponse mockServletResponse; + + static class ZtsMetricTester extends com.yahoo.athenz.common.metrics.impl.NoOpMetric { + Map metrixMap = new HashMap<>(); + + public Map getMap() { return metrixMap; } + + public void increment(String metric, String domainName, int count) { + String key = metric + domainName; + metrixMap.put(key, count); + } + } + + ResourceContext createResourceContext(Principal principal) { + com.yahoo.athenz.common.server.rest.ResourceContext rsrcCtx = Mockito.mock(com.yahoo.athenz.common.server.rest.ResourceContext.class); + Mockito.when(rsrcCtx.principal()).thenReturn(principal); + Mockito.when(rsrcCtx.request()).thenReturn(mockServletRequest); + + RsrcCtxWrapper rsrcCtxWrapper = Mockito.mock(RsrcCtxWrapper.class); + Mockito.when(rsrcCtxWrapper.context()).thenReturn(rsrcCtx); + Mockito.when(rsrcCtxWrapper.principal()).thenReturn(principal); + Mockito.when(rsrcCtxWrapper.request()).thenReturn(mockServletRequest); + Mockito.when(rsrcCtxWrapper.response()).thenReturn(mockServletResponse); + return rsrcCtxWrapper; + } + + ResourceContext createResourceContext(Principal principal, HttpServletRequest request) { + if (request == null) { + return createResourceContext(principal); + } + + com.yahoo.athenz.common.server.rest.ResourceContext rsrcCtx = Mockito.mock(com.yahoo.athenz.common.server.rest.ResourceContext.class); + Mockito.when(rsrcCtx.principal()).thenReturn(principal); + Mockito.when(rsrcCtx.request()).thenReturn(request); + + RsrcCtxWrapper rsrcCtxWrapper = Mockito.mock(RsrcCtxWrapper.class); + Mockito.when(rsrcCtxWrapper.context()).thenReturn(rsrcCtx); + Mockito.when(rsrcCtxWrapper.principal()).thenReturn(principal); + Mockito.when(rsrcCtxWrapper.request()).thenReturn(request); + Mockito.when(rsrcCtxWrapper.response()).thenReturn(mockServletResponse); + return rsrcCtxWrapper; + } + + Object getWebAppExcEntity(javax.ws.rs.WebApplicationException wex) { + javax.ws.rs.core.Response resp = wex.getResponse(); + return resp.getEntity(); + } + + Object getWebAppExcMapValue(javax.ws.rs.WebApplicationException wex, String header) { + javax.ws.rs.core.MultivaluedMap mvmap = wex.getResponse().getMetadata(); + Object obj = mvmap.getFirst(header); + return obj; + } + + public static Role createRoleObject(String domainName, String roleName, + String trust) { + Role role = new Role(); + role.setName(domainName + ":role." + roleName); + role.setTrust(trust); + return role; + } + + public static Role createRoleObject(String domainName, String roleName, + String trust, String member1, String member2) { + + List members = new ArrayList(); + if (member1 != null) { + members.add(member1); + } + if (member2 != null) { + members.add(member2); + } + return createRoleObject(domainName, roleName, trust, members); + } + + public static Role createRoleObject(String domainName, String roleName, + String trust, List members) { + + Role role = new Role(); + role.setName(domainName + ":role." + roleName); + role.setMembers(members); + if (trust != null) { + role.setTrust(trust); + } + + return role; + } + + private Policy createPolicyObject(String domainName, String policyName, + String roleName, boolean generateRoleName, String action, + String resource, AssertionEffect effect) { + + Policy policy = new Policy(); + policy.setName(domainName + ":policy." + policyName); + + Assertion assertion = new Assertion(); + assertion.setAction(action); + assertion.setEffect(effect); + assertion.setResource(resource); + if (generateRoleName) { + assertion.setRole(domainName + ":role." + roleName); + } else { + assertion.setRole(roleName); + } + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + return policy; + } + + @BeforeClass + public void setUpClass() throws Exception { + MockitoAnnotations.initMocks(this); + Mockito.when(mockServletRequest.getRemoteAddr()).thenReturn(MOCKCLIENTADDR); + + System.setProperty(ZTSConsts.ZTS_PROP_METRIC_FACTORY_CLASS, ZTSConsts.ZTS_METRIC_FACTORY_CLASS); + System.setProperty(ZTSConsts.ZTS_PROP_STATS_ENABLED, "true"); + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY_STORE_CLASS, + "com.yahoo.athenz.zts.pkey.file.FilePrivateKeyStoreFactory"); + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/zts_private.pem"); + System.setProperty(ZTSConsts.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + } + + @BeforeMethod + public void setup() { + + // we want to make sure we start we clean dir structure + + ZMSFileChangeLogStore.deleteDirectory(new File(ZTS_DATA_STORE_PATH)); + + String privKeyName = System.getProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY); + System.out.println("private key file=" + privKeyName); + File privKeyFile = new File(privKeyName); + String privKey = Crypto.encodedFile(privKeyFile); + + privateKey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + /* create our data store */ + + roleTokenDefaultTimeout = 2400; + System.setProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_DEFAULT_TIMEOUT, + Integer.toString(roleTokenDefaultTimeout)); + + roleTokenMaxTimeout = 96000; + System.setProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_MAX_TIMEOUT, + Integer.toString(roleTokenMaxTimeout)); + + System.setProperty(ZTSConsts.ZTS_PROP_AUTHORIZED_PROXY_USERS, + "user_domain.proxy-user1,user_domain.proxy-user2"); + + ChangeLogStore structStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + privateKey, "0"); + + CloudStore cloudStore = new CloudStore(null); + cloudStore.setHttpClient(null); + + CertSigner certSigner = new MockCertSignerFactory().create(null); + SvcCertStore svcCertStore = new YSvcCertStore(certSigner); + + store = new DataStore(structStore, cloudStore); + + com.yahoo.athenz.common.metrics.Metric metric = getMetric(); + zts = new ZTSImpl("localhost", store, cloudStore, svcCertStore, metric, + privateKey, "0", AuditLogFactory.getLogger(), null); + authorizer = (ZTSAuthorizer) zts.getAuthorizer(); + } + + private Metric getMetric(){ + com.yahoo.athenz.common.metrics.MetricFactory metricFactory = null; + com.yahoo.athenz.common.metrics.Metric metric = null; + try { + metricFactory = (com.yahoo.athenz.common.metrics.MetricFactory) + Class.forName(System.getProperty(ZTSConsts.ZTS_PROP_METRIC_FACTORY_CLASS)).newInstance(); + metric = metricFactory.create(); + } catch (InstantiationException | IllegalAccessException | ClassNotFoundException exc) { + System.out.println("Invalid MetricFactory class: " + ZTSConsts.ZTS_METRIC_FACTORY_CLASS + + " error: " + exc.getMessage()); + metric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + } + return metric; + } + + @AfterMethod + public void shutdown() { + ZMSFileChangeLogStore.deleteDirectory(new File(ZTS_DATA_STORE_PATH)); + System.clearProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_MAX_TIMEOUT); + System.clearProperty(ZTSConsts.ZTS_PROP_ROLE_TOKEN_DEFAULT_TIMEOUT); + + } + + private String generateRoleName(String domain, String role) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append(":role."); + str.append(role); + return str.toString(); + } + + private String generatePolicyName(String domain, String policy) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append(":policy."); + str.append(policy); + return str.toString(); + } + + private String generateServiceIdentityName(String domain, String service) { + StringBuilder str = new StringBuilder(256); + str.append(domain); + str.append("."); + str.append(service); + return str.toString(); + } + + private SignedDomain createSignedDomain(String domainName, String tenantDomain, + String serviceName, boolean includeServices) { + + List writers = new ArrayList<>(); + writers.add("user_domain.user"); + writers.add("user_domain.user1"); + + List readers = new ArrayList<>(); + readers.add("user_domain.user3"); + readers.add("user_domain.user4"); + readers.add("user_domain.user1"); + + return createSignedDomain(domainName, tenantDomain, serviceName, writers, + readers, includeServices); + } + + private SignedDomain createSignedDomain(String domainName, String tenantDomain, + String serviceName, List writers, List readers, + boolean includeServices) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(generateRoleName(domainName, "admin")); + List members = new ArrayList<>(); + members.add("user_domain.adminuser"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "writers")); + role.setMembers(writers); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "readers")); + role.setMembers(readers); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "tenant.readers")); + role.setTrust(tenantDomain); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain + ".admin")); + role.setTrust(tenantDomain); + roles.add(role); + + List services = new ArrayList<>(); + + if (includeServices) { + + ServiceIdentity service = new ServiceIdentity(); + service.setName(generateServiceIdentityName(domainName, serviceName)); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + hosts.add("host2"); + service.setHosts(hosts); + services.add(service); + + service = new ServiceIdentity(); + service.setName(generateServiceIdentityName(domainName, "backup")); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + hosts = new ArrayList<>(); + hosts.add("host2"); + hosts.add("host3"); + service.setHosts(hosts); + services.add(service); + } + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":tenant." + tenantDomain + ".*"); + assertion.setAction("read"); + assertion.setRole(generateRoleName(domainName, "tenant.readers")); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "tenant.reader")); + policies.add(policy); + + // tenant admin domain + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":service." + serviceName + ".tenant." + tenantDomain + ".*"); + assertion.setAction("read"); + assertion.setRole(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain + ".admin")); + + assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, serviceName + ".tenant." + tenantDomain + ".admin")); + policies.add(policy); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setRoles(roles); + domain.setServices(services); + domain.setPolicies(signedPolicies); + domain.setModified(Timestamp.fromCurrentTime()); + + signedDomain.setDomain(domain); + + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + private SignedDomain createMultipleSignedDomains(String domainName, String tenantDomain1, + String tenantDomain2, String serviceName, boolean includeServices) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(generateRoleName(domainName, "admin")); + List members = new ArrayList<>(); + members.add("user_domain.adminuser"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain1 + ".admin")); + role.setTrust(tenantDomain1); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain2 + ".admin")); + role.setTrust(tenantDomain2); + roles.add(role); + + List services = new ArrayList<>(); + + if (includeServices) { + + ServiceIdentity service = new ServiceIdentity(); + service.setName(generateServiceIdentityName(domainName, serviceName)); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + hosts.add("host2"); + service.setHosts(hosts); + services.add(service); + } + + List policies = new ArrayList<>(); + + // tenant admin domain + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":service." + serviceName + ".tenant." + tenantDomain1 + ".*"); + assertion.setAction("read"); + assertion.setRole(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain1 + ".admin")); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, serviceName + ".tenant." + tenantDomain1 + ".admin")); + policies.add(policy); + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":service." + serviceName + ".tenant." + tenantDomain2 + ".*"); + assertion.setAction("read"); + assertion.setRole(generateRoleName(domainName, serviceName + ".tenant." + tenantDomain2 + ".admin")); + + assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, serviceName + ".tenant." + tenantDomain2 + ".admin")); + policies.add(policy); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setRoles(roles); + domain.setServices(services); + domain.setPolicies(signedPolicies); + domain.setModified(Timestamp.fromCurrentTime()); + + signedDomain.setDomain(domain); + + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + private SignedDomain createTenantSignedDomain(String domainName, String providerDomain, String providerService) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(generateRoleName(domainName, "admin")); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "tenancy." + providerDomain + "." + providerService + ".admin")); + members = new ArrayList<>(); + members.add("user_domain.user100"); + members.add("user_domain.user101"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "readers")); + members = new ArrayList<>(); + members.add("user_domain.user100"); + members.add("user_domain.user101"); + role.setMembers(members); + roles.add(role); + + ServiceIdentity service = new ServiceIdentity(); + service.setName(domainName + ".storage"); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + hosts.add("host2"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + services.add(service); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(generateRoleName(providerDomain, "tenant.readers")); + assertion.setAction("assume_role"); + assertion.setRole(generateRoleName(domainName, "readers")); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "tenancy.readers")); + policies.add(policy); + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(generateRoleName(providerDomain, providerService + ".tenant." + domainName + ".admin")); + assertion.setAction("assume_role"); + assertion.setRole(generateRoleName(domainName, "tenancy." + providerDomain + "." + providerService + ".admin")); + + assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "tenancy." + providerDomain + "." + providerService + ".admin")); + policies.add(policy); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setRoles(roles); + domain.setServices(services); + domain.setPolicies(signedPolicies); + + signedDomain.setDomain(domain); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + private SignedDomain createSignedDomainWildCard(String domainName, String tenantDomain) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(generateRoleName(domainName, "superusers")); + List members = new ArrayList<>(); + members.add("user_domain.admin_user"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "users")); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "netops_superusers")); + role.setTrust(tenantDomain); + roles.add(role); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":node.*"); + assertion.setAction("node_user"); + assertion.setRole(generateRoleName(domainName, "users")); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "users")); + policies.add(policy); + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":node.*"); + assertion.setAction("node_sudo"); + assertion.setRole(generateRoleName(domainName, "netops_superusers")); + + assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "netops_superusers")); + policies.add(policy); + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":node.*"); + assertion.setAction("node_user"); + assertion.setRole(generateRoleName(domainName, "superusers")); + + assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "superusers")); + policies.add(policy); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setRoles(roles); + domain.setPolicies(signedPolicies); + domain.setModified(Timestamp.fromCurrentTime()); + + signedDomain.setDomain(domain); + + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + private SignedDomain createTenantSignedDomainWildCard(String domainName, String providerDomain) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(generateRoleName(domainName, "superusers")); + List members = new ArrayList<>(); + members.add("user_domain.siteops_user_1"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "users")); + roles.add(role); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource("*:role.netops_superusers"); + assertion.setAction("assume_role"); + assertion.setRole(generateRoleName(domainName, "superusers")); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "netops_superusers")); + policies.add(policy); + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + "netops:node.*"); + assertion.setAction("node_user"); + assertion.setRole(generateRoleName(domainName, "users")); + + assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "users")); + policies.add(policy); + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + "netops:node.*"); + assertion.setAction("node_sudo"); + assertion.setRole(generateRoleName(domainName, "superusers")); + + assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "superusers")); + policies.add(policy); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setRoles(roles); + domain.setPolicies(signedPolicies); + + signedDomain.setDomain(domain); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + private SignedDomain createAwsSignedDomain(String domainName, String account) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(generateRoleName(domainName, "admin")); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(generateRoleName(domainName, "aws_role")); + members = new ArrayList<>(); + members.add("user_domain.user100"); + members.add("user_domain.user101"); + role.setMembers(members); + roles.add(role); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":aws_role_name"); + assertion.setAction("assume_aws_role"); + assertion.setRole(generateRoleName(domainName, "aws_role")); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(generatePolicyName(domainName, "aws_policy")); + policies.add(policy); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setAccount(account); + domain.setRoles(roles); + domain.setPolicies(signedPolicies); + + signedDomain.setDomain(domain); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), privateKey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + private void setServicePublicKey(ServiceIdentity service, String id, String key) { + com.yahoo.athenz.zms.PublicKeyEntry keyEntry = new com.yahoo.athenz.zms.PublicKeyEntry(); + keyEntry.setId(id); + keyEntry.setKey(key); + List listKeys = new ArrayList<>(); + listKeys.add(keyEntry); + service.setPublicKeys(listKeys); + } + + private void setServicePublicKey(com.yahoo.athenz.zts.ServiceIdentity service, String id, String key) { + com.yahoo.athenz.zts.PublicKeyEntry keyEntry = new com.yahoo.athenz.zts.PublicKeyEntry(); + keyEntry.setId(id); + keyEntry.setKey(key); + List listKeys = new ArrayList<>(); + listKeys.add(keyEntry); + service.setPublicKeys(listKeys); + } + + @Test + public void testGetPublicKeyNotExistent() { + + String domain = "unknown"; + String service = "unknown"; + + String pubKey = zts.getPublicKey(domain, service, "0"); + assertNull(pubKey); + + pubKey = zts.getPublicKey(null, service, "0"); + assertNull(pubKey); + + pubKey = zts.getPublicKey(domain, null, "0"); + assertNull(pubKey); + } + + @Test + public void testGetPublicKey() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + String pubKey = zts.getPublicKey("coretech", "storage", "0"); + assertEquals(pubKey, ZTS_PEM_CERT0); + + pubKey = zts.getPublicKey("coretech", "storage", "100"); + assertNull(pubKey); + } + + @Test + public void testShouldRunDelegatedTrustCheckNullTrust() { + assertFalse(authorizer.shouldRunDelegatedTrustCheck(null, "TrustDomain")); + } + + @Test + public void testShouldRunDelegatedTrustCheckNullTrustDomain() { + assertTrue(authorizer.shouldRunDelegatedTrustCheck("TrustDomain", null)); + } + + @Test + public void testShouldRunDelegatedTrustCheckMatch() { + assertTrue(authorizer.shouldRunDelegatedTrustCheck("TrustDomain", "TrustDomain")); + } + + @Test + public void testShouldRunDelegatedTrustCheckNoMatch() { + assertFalse(authorizer.shouldRunDelegatedTrustCheck("TrustDomain1", "TrustDomain")); + } + + @Test + public void testEvaluateAccessNoAssertions() { + + DataCache domain = new DataCache(); + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domain.setDomainData(domainData); + domainData.setRoles(new ArrayList()); + Role role = new Role().setName("coretech:role.role1"); + domainData.getRoles().add(role); + Policy policy = new Policy().setName("coretech:policy.policy1"); + domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies()); + domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies()); + domainData.getPolicies().getContents().setPolicies(new ArrayList()); + domainData.getPolicies().getContents().getPolicies().add(policy); + assertEquals(authorizer.evaluateAccess(domain, null, null, null, null), AccessStatus.DENIED); + } + + @Test + public void testEvaluateAccessAssertionDeny() { + + DataCache domain = new DataCache(); + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domain.setDomainData(domainData); + domainData.setRoles(new ArrayList()); + Role role = createRoleObject("coretech", "role1", null, "user_domain.user1", null); + domainData.getRoles().add(role); + + Policy policy = new Policy().setName("coretech:policy.policy1"); + Assertion assertion = new Assertion(); + assertion.setAction("read"); + assertion.setEffect(AssertionEffect.DENY); + assertion.setResource("coretech:*"); + assertion.setRole("coretech:role.role1"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion); + domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies()); + domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies()); + domainData.getPolicies().getContents().setPolicies(new ArrayList()); + domainData.getPolicies().getContents().getPolicies().add(policy); + + assertEquals(authorizer.evaluateAccess(domain, "user_domain.user1", "read", "coretech:resource1", null), AccessStatus.DENIED); + } + + @Test + public void testEvaluateAccessAssertionAllow() { + + DataCache domain = new DataCache(); + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domain.setDomainData(domainData); + domainData.setRoles(new ArrayList()); + Role role = createRoleObject("coretech", "role1", null, "user_domain.user1", null); + domainData.getRoles().add(role); + + Policy policy = new Policy().setName("coretech:policy.policy1"); + Assertion assertion1 = new Assertion(); + assertion1.setAction("read"); + assertion1.setEffect(AssertionEffect.ALLOW); + assertion1.setResource("coretech:*"); + assertion1.setRole("coretech:role.role1"); + Assertion assertion2 = new Assertion(); + assertion2.setAction("read"); + assertion2.setEffect(AssertionEffect.ALLOW); + assertion2.setResource("coretech:resource1"); + assertion2.setRole("coretech:role.role1"); + policy.setAssertions(new ArrayList()); + policy.getAssertions().add(assertion1); + policy.getAssertions().add(assertion2); + domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies()); + domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies()); + domainData.getPolicies().getContents().setPolicies(new ArrayList()); + domainData.getPolicies().getContents().getPolicies().add(policy); + + assertEquals(authorizer.evaluateAccess(domain, "user_domain.user1", "read", "coretech:resource1", null), AccessStatus.ALLOWED); + } + + @Test + public void testGetHostServices() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + HostServices hosts = zts.getHostServices(null, "host1"); + assertTrue(hosts.getNames().size() == 1); + assertTrue(hosts.getNames().contains("coretech.storage")); + + hosts = zts.getHostServices(null, "host2"); + assertTrue(hosts.getNames().size() == 2); + assertTrue(hosts.getNames().contains("coretech.storage")); + assertTrue(hosts.getNames().contains("coretech.backup")); + + hosts = zts.getHostServices(null, "host3"); + assertTrue(hosts.getNames().size() == 1); + assertTrue(hosts.getNames().contains("coretech.backup")); + } + + @Test + public void testGetHostServicesInvalidHost() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + HostServices hosts = zts.getHostServices(null, "unknownHost"); + assertNull(hosts.getNames()); + } + + @Test + public void testGetPolicyList() { + + List policies = new ArrayList<>(); + List assertions = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource("coretech:tenant.weather.*"); + assertion.setAction("read"); + assertion.setRole("coretech:role.readers"); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName("coretech:policy.reader"); + policies.add(policy); + + policy = new com.yahoo.athenz.zms.Policy(); + assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource("coretech:tenant.weather.*"); + assertion.setAction("write"); + assertion.setRole("coretech:role.writers"); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName("coretech:policy.writer"); + policies.add(policy); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain("coretech"); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName("coretech"); + domain.setPolicies(signedPolicies); + domain.setModified(Timestamp.fromCurrentTime()); + + List policyList = zts.getPolicyList(domain); + assertEquals(policyList.size(), 2); + assertEquals(policyList.get(0).getName(), "coretech:policy.reader"); + assertEquals(policyList.get(1).getName(), "coretech:policy.writer"); + } + + @Test + public void testGetPolicyListPoliciesNull() { + + DomainData domain = new DomainData(); + domain.setName("coretech"); + domain.setPolicies(null); + domain.setModified(Timestamp.fromCurrentTime()); + + List policyList = zts.getPolicyList(domain); + assertEquals(policyList.size(), 0); + } + + @Test + public void testGetPolicyListPoliciesEmpty() { + + DomainData domain = new DomainData(); + domain.setName("coretech"); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain("coretech"); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), privateKey)); + signedPolicies.setKeyId("0"); + + domain.setPolicies(signedPolicies); + domain.setModified(Timestamp.fromCurrentTime()); + + List policyList = zts.getPolicyList(domain); + assertEquals(policyList.size(), 0); + } + + @Test + public void testGetRoleToken() { + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleToken roleToken = zts.getRoleToken(context, "coretech", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("writers")); + assertTrue(roleToken.getToken().contains(";h=localhost;")); + assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); + assertTrue(roleToken.getToken().contains(";p=user_domain.user;")); + assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); + + Principal principal1 = SimplePrincipal.create("user_domain", "user1", + "v=U1;d=user_domain;n=user1;s=signature", 0, null); + ResourceContext context1 = createResourceContext(principal1); + + roleToken = zts.getRoleToken(context1, "coretech", null, null, Integer.valueOf(1200), null); + token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 2); + assertTrue(token.getRoles().contains("readers")); + assertTrue(token.getRoles().contains("writers")); + + Principal principal4 = SimplePrincipal.create("user_domain", "user4", + "v=U1;d=user_domain;n=user4;s=signature", 0, null); + ResourceContext context4 = createResourceContext(principal4); + + roleToken = zts.getRoleToken(context4, "coretech", null, Integer.valueOf(600), + null, null); + token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("readers")); + assertTrue(roleToken.getToken().contains(";p=user_domain.user4;")); + } + + @Test + public void testGetRoleTokenEmptyArguments() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleToken roleToken = zts.getRoleToken(context, "coretech", "", null, null, null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("writers")); + } + + @Test + public void testGetRoleTokenNoRoleMatch() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "invalidUser", + "v=U1;d=user_domain;n=invalidUuser;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + try { + zts.getRoleToken(context, "coretech", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + } + + @Test + public void testGetRoleTokenInvalidDomain() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + try { + zts.getRoleToken(context, "invalidDomain", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testGetRoleTokenSpecifiedRoleValid() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleToken roleToken = zts.getRoleToken(context, "coretech", "writers", Integer.valueOf(600), + Integer.valueOf(1200), null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("writers")); + + Principal principal1 = SimplePrincipal.create("user_domain", "user1", + "v=U1;d=user_domain;n=user1;s=signature", 0, null); + ResourceContext context1 = createResourceContext(principal1); + + roleToken = zts.getRoleToken(context1, "coretech", "writers", null, Integer.valueOf(1200), null); + token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("writers")); + + Principal principal4 = SimplePrincipal.create("user_domain", "user4", + "v=U1;d=user_domain;n=user4;s=signature", 0, null); + ResourceContext context4 = createResourceContext(principal4); + + roleToken = zts.getRoleToken(context4, "coretech", "readers", Integer.valueOf(600), null, null); + token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("readers")); + } + + @Test + public void testGetRoleTokenSpecifiedRoleInValid() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + try { + zts.getRoleToken(context, "coretech", "coretech:role.readers", Integer.valueOf(600), + Integer.valueOf(1200), null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testGetRoleTokenSpecifiedRoleNoMatch() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + try { + zts.getRoleToken(context, "coretech", "updaters", Integer.valueOf(600), + Integer.valueOf(1200), null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + } + + @Test + public void testGetRoleTokenTrustDomainWildCard() { + + SignedDomain signedDomain = createSignedDomainWildCard("weather", "netops"); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomainWildCard("netops", "weather"); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "siteops_user_1", + "v=U1;d=user_domain;n=siteops_user_1;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleToken roleToken = zts.getRoleToken(context, "weather", null, null, null, null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("netops_superusers")); + } + + @Test + public void testGetRoleTokenTrustDomainWildCardGivenRole() { + + SignedDomain signedDomain = createSignedDomainWildCard("weather", "netops"); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomainWildCard("netops", "weather"); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "siteops_user_1", + "v=U1;d=user_domain;n=siteops_user_1;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleToken roleToken = zts.getRoleToken(context, "weather", "netops_superusers", null, null, null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("netops_superusers")); + } + + @Test + public void testGetRoleAccess() { + SignedDomain signedDomain = createSignedDomain("roleaccess", "tenantrole", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=sig", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleAccess roleAccess = zts.getRoleAccess(context, "roleaccess", "user_domain.user"); + assertEquals(roleAccess.getRoles().size(), 1); + assertTrue(roleAccess.getRoles().contains("writers")); + + Principal principal1 = SimplePrincipal.create("user_domain", "user1", "v=U1;d=user_domain;n=user1;s=sig", 0, null); + ResourceContext context1 = createResourceContext(principal1); + + roleAccess = zts.getRoleAccess(context1, "roleaccess", "user_domain.user1"); + assertEquals(roleAccess.getRoles().size(), 2); + assertTrue(roleAccess.getRoles().contains("readers")); + assertTrue(roleAccess.getRoles().contains("writers")); + + Principal principal4 = SimplePrincipal.create("user_domain", "user4", "v=U1;d=user_domain;n=user1;s=sig", 0, null); + ResourceContext context4 = createResourceContext(principal4); + + roleAccess = zts.getRoleAccess(context4, "roleaccess", "user_domain.user4"); + assertEquals(roleAccess.getRoles().size(), 1); + assertTrue(roleAccess.getRoles().contains("readers")); + } + + @Test + public void testGetRoleTokenUnauthorizedProxy() { + SignedDomain signedDomain = createSignedDomain("coretech-proxy1", "weather-proxy1", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", "v=U1;d=user_domain;n=user;s=sig", 0, null); + ResourceContext context = createResourceContext(principal); + + try { + zts.getRoleToken(context, "coretech-proxy1", null, Integer.valueOf(600), + Integer.valueOf(1200), "user_domain.unknown-proxy-user"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + assertTrue(ex.getMessage().contains("not authorized for proxy role token request")); + } + } + + @Test + public void testGetRoleTokenProxyUser() { + + List writers = new ArrayList<>(); + writers.add("user_domain.proxy-user1"); + writers.add("user_domain.joe"); + + List readers = new ArrayList<>(); + readers.add("user_domain.proxy-user2"); + readers.add("user_domain.jane"); + + SignedDomain signedDomain = createSignedDomain("coretech-proxy2", "weather-proxy2", "storage", + writers, readers, true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", + "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleToken roleToken = zts.getRoleToken(context, "coretech-proxy2", null, Integer.valueOf(600), + Integer.valueOf(1200), "user_domain.joe"); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("writers")); + assertTrue(roleToken.getToken().contains(";h=localhost;")); + assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); + assertTrue(roleToken.getToken().contains(";p=user_domain.joe;")); + assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user1;")); + assertTrue(roleToken.getToken().contains(";c=1;")); + assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); + + principal = SimplePrincipal.create("user_domain", "proxy-user2", + "v=U1;d=user_domain;n=proxy-user2;s=sig", 0, null); + context = createResourceContext(principal); + + roleToken = zts.getRoleToken(context, "coretech-proxy2", null, Integer.valueOf(600), + Integer.valueOf(1200), "user_domain.jane"); + token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("readers")); + assertTrue(roleToken.getToken().contains(";h=localhost;")); + assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); + assertTrue(roleToken.getToken().contains(";p=user_domain.jane;")); + assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user2;")); + assertTrue(roleToken.getToken().contains(";c=1;")); + assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); + } + + @Test + public void testGetRoleTokenProxyUserMismatchRoles() { + + List writers = new ArrayList<>(); + writers.add("user_domain.proxy-user1"); + writers.add("user_domain.joe"); + + List readers = new ArrayList<>(); + readers.add("user_domain.proxy-user2"); + readers.add("user_domain.jane"); + readers.add("user_domain.proxy-user1"); + + SignedDomain signedDomain = createSignedDomain("coretech-proxy3", "weather-proxy3", "storage", + writers, readers, true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", + "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null); + ResourceContext context = createResourceContext(principal); + + try { + zts.getRoleToken(context, "coretech-proxy3", null, Integer.valueOf(600), + Integer.valueOf(1200), "user_domain.joe"); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + assertTrue(ex.getMessage().contains("does not have access to the same set of roles as proxy")); + } + } + + @Test + public void testGetRoleTokenProxyUserSpecificRole() { + + List writers = new ArrayList<>(); + writers.add("user_domain.proxy-user1"); + writers.add("user_domain.joe"); + + List readers = new ArrayList<>(); + readers.add("user_domain.proxy-user2"); + readers.add("user_domain.jane"); + readers.add("user_domain.proxy-user1"); + + SignedDomain signedDomain = createSignedDomain("coretech-proxy4", "weather-proxy4", "storage", + writers, readers, true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "proxy-user1", + "v=U1;d=user_domain;n=proxy-user1;s=sig", 0, null); + ResourceContext context = createResourceContext(principal); + + RoleToken roleToken = zts.getRoleToken(context, "coretech-proxy4", "writers", Integer.valueOf(600), + Integer.valueOf(1200), "user_domain.joe"); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertEquals(token.getRoles().size(), 1); + assertTrue(token.getRoles().contains("writers")); + assertTrue(roleToken.getToken().contains(";h=localhost;")); + assertTrue(roleToken.getToken().contains(";i=10.11.12.13")); + assertTrue(roleToken.getToken().contains(";p=user_domain.joe;")); + assertTrue(roleToken.getToken().contains(";proxy=user_domain.proxy-user1;")); + assertEquals(roleToken.getExpiryTime(), token.getExpiryTime()); + } + + @Test + public void testLookupServiceIdentity() { + + List services = new ArrayList<>(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName(generateServiceIdentityName("coretech", "storage")); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + services.add(service); + + service = new ServiceIdentity(); + service.setName(generateServiceIdentityName("coretech", "backup")); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + services.add(service); + + DomainData domain = new DomainData(); + domain.setName("coretech"); + domain.setServices(services); + + com.yahoo.athenz.zts.ServiceIdentity svc = zts.lookupServiceIdentity(domain, "coretech.storage"); + assertNotNull(svc); + } + + @Test + public void testLookupServiceIdentityNull() { + DomainData domain = new DomainData(); + domain.setName("coretech"); + domain.setServices(null); + + com.yahoo.athenz.zts.ServiceIdentity svc = zts.lookupServiceIdentity(domain, "coretech.storage"); + assertNull(svc); + } + + @Test + public void testLookupServiceIdentityNoMatch() { + List services = new ArrayList<>(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName(generateServiceIdentityName("coretech", "storage")); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + services.add(service); + + service = new ServiceIdentity(); + service.setName(generateServiceIdentityName("coretech", "backup")); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + services.add(service); + + DomainData domain = new DomainData(); + domain.setName("coretech"); + domain.setServices(services); + + com.yahoo.athenz.zts.ServiceIdentity svc = zts.lookupServiceIdentity(domain, "coretech.sync"); + assertNull(svc); + } + + @Test + public void testGetPublicKeyEntry() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + PublicKeyEntry entry = zts.getPublicKeyEntry(null, "coretech", "storage", "0"); + assertEquals(entry.getId(), "0"); + assertEquals(entry.getKey(), ZTS_Y64_CERT0); + } + + @Test + public void testGetPublicKeyEntryInvalidKeyId() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + // with null we get 400 + try { + zts.getPublicKeyEntry(null, "coretech", "storage", null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + // with nonexistent we get 404 + try { + zts.getPublicKeyEntry(null, "coretech", "storage", "999999"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testGetPublicKeyEntryInvalidDomain() { + + try { + zts.getPublicKeyEntry(null, "nonexistentdomain", "storage", "0"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testGetPublicKeyEntryInvalidService() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + try { + zts.getPublicKeyEntry(null, "coretech", "nonexistentservice", "0"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testGetServiceIdentity() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + com.yahoo.athenz.zts.ServiceIdentity svc = zts.getServiceIdentity(null, "coretech", "storage"); + assertNotNull(svc); + assertEquals(svc.getName(), "coretech.storage"); + + svc = zts.getServiceIdentity(null, "coretech", "backup"); + assertNotNull(svc); + assertEquals(svc.getName(), "coretech.backup"); + } + + @Test + public void testGetServiceIdentityInvalid() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + try { + @SuppressWarnings("unused") + com.yahoo.athenz.zts.ServiceIdentity svc = zts.getServiceIdentity(null, "coretech", "storage2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + + try { + @SuppressWarnings("unused") + com.yahoo.athenz.zts.ServiceIdentity svc = zts.getServiceIdentity(null, "testDomain2", "storage"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testAddServiceNameToListValid() { + + List names = new ArrayList<>(); + zts.addServiceNameToList("coretech.storage", "coretech.", names); + + assertEquals(names.size(), 1); + assertTrue(names.contains("storage")); + } + + @Test + public void testAddServiceNameToListInValid() { + + List names = new ArrayList<>(); + zts.addServiceNameToList("coretech.storage", "weather.", names); + + assertEquals(names.size(), 0); + } + + @Test + public void testGetServiceIdentityList() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + com.yahoo.athenz.zts.ServiceIdentityList svcList = zts.getServiceIdentityList(null, "coretech"); + assertEquals(svcList.getNames().size(), 2); + assertTrue(svcList.getNames().contains("storage")); + assertTrue(svcList.getNames().contains("backup")); + } + + @Test + public void testGetServiceIdentityListInvalidDomain() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + try { + @SuppressWarnings("unused") + com.yahoo.athenz.zts.ServiceIdentityList svcList = zts.getServiceIdentityList(null, "testDomain2"); + fail(); + } catch (ResourceException ex) { + assertTrue(true); + } + } + + @Test + public void testGetServiceIdentityListNoServices() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", false); + store.processDomain(signedDomain, false); + + com.yahoo.athenz.zts.ServiceIdentityList svcList = zts.getServiceIdentityList(null, "coretech"); + assertEquals(svcList.getNames().size(), 0); + } + + @Test + public void testValidate() { + com.yahoo.athenz.zts.ServiceIdentity service = new com.yahoo.athenz.zts.ServiceIdentity(); + service.setName(generateServiceIdentityName("coretech", "storage")); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + zts.validate(service, "ServiceIdentity", "testValidate"); + assertTrue(true); + } + + @Test + public void testValidateObjNull() { + try { + zts.validate(null, "SignedDomain", "testValidate"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testValidateObjInvalid() { + com.yahoo.athenz.zts.ServiceIdentity service = new com.yahoo.athenz.zts.ServiceIdentity(); + service.setName(generateServiceIdentityName("coretech", "storage")); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + try { + zts.validate(service, "Policy", "testValidate"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testConvertEmptyStringToNullStringNull() { + assertNull(zts.convertEmptyStringToNull(null)); + } + + @Test + public void testConvertEmptyStringToNullStringEmpty() { + assertNull(zts.convertEmptyStringToNull("")); + } + + @Test + public void testConvertEmptyStringToNullStringNotEmpty() { + assertEquals(zts.convertEmptyStringToNull("test"), "test"); + } + + @Test + public void testEmitMonmetricError() { + int errorCode = 403; + String caller = "forbiddenError"; + boolean isEmitMonmetricError; + com.yahoo.athenz.common.metrics.Metric metric = getMetric(); + // negative tests + isEmitMonmetricError = ZTSUtils.emitMonmetricError(errorCode, null, ZTSConsts.ZTS_UNKNOWN_DOMAIN, metric); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZTSUtils.emitMonmetricError(errorCode, "", ZTSConsts.ZTS_UNKNOWN_DOMAIN, metric); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZTSUtils.emitMonmetricError(errorCode, new String(), null, metric); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZTSUtils.emitMonmetricError(errorCode, "invalidcharacterslike...$!?", null, metric); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZTSUtils.emitMonmetricError(errorCode, "spaces are not allowed", ZTSConsts.ZTS_UNKNOWN_DOMAIN, metric); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZTSUtils.emitMonmetricError(0, caller, null, metric); + assertFalse(isEmitMonmetricError); + + isEmitMonmetricError = ZTSUtils.emitMonmetricError(-100, caller, null, metric); + assertFalse(isEmitMonmetricError); + + // positive tests + isEmitMonmetricError = ZTSUtils.emitMonmetricError(errorCode, caller, null, metric); + assertTrue(isEmitMonmetricError); + + isEmitMonmetricError = ZTSUtils.emitMonmetricError(errorCode, " " + caller + " ", null, metric); + assertTrue(isEmitMonmetricError); + } + + @Test + public void testDetermineTokenTimeoutBothNull() { + assertEquals(zts.determineTokenTimeout(null, null), roleTokenDefaultTimeout); + } + + @Test + public void testDetermineTokenTimeoutMinNull() { + assertEquals(zts.determineTokenTimeout(null, Integer.valueOf(100)), 100); + } + + @Test + public void testDetermineTokenTimeoutMaxNull() { + assertEquals(zts.determineTokenTimeout(Integer.valueOf(100), null), roleTokenDefaultTimeout); + } + + @Test + public void testDetermineTokenTimeoutMinInvalid() { + assertEquals(zts.determineTokenTimeout(Integer.valueOf(-10), null), roleTokenDefaultTimeout); + } + + @Test + public void testDetermineTokenTimeoutMaxInvalid() { + assertEquals(zts.determineTokenTimeout(null, Integer.valueOf(-10)), roleTokenDefaultTimeout); + } + + @Test + public void testDetermineTokenTimeoutDefaultBigger() { + assertEquals(zts.determineTokenTimeout(Integer.valueOf(3200), null), 3200); + } + + @Test + public void testDetermineTokeTimeoutDefaultSmaller() { + assertEquals(zts.determineTokenTimeout(Integer.valueOf(1200), null), roleTokenDefaultTimeout); + } + + @Test + public void testDetermineTokeTimeoutMaxValueMaxExceeded() { + assertEquals(zts.determineTokenTimeout(null, Integer.valueOf(120000)), roleTokenMaxTimeout); + } + + @Test + public void testDetermineTokeTimeoutMinValueMaxExceeded() { + assertEquals(zts.determineTokenTimeout(Integer.valueOf(120000), null), roleTokenMaxTimeout); + } + + @Test + public void testRoleTokenAddrNoLoopbackAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("10.10.10.11"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + privateKey, "0"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + DataStore store = new DataStore(structStore, null); + zts = new ZTSImpl("localhost", store, null, null, debugMetric, privateKey, "0", alogger, null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + + RoleToken roleToken = zts.getRoleToken(context, "coretech", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertNotNull(token); + String unsignToken = token.getUnsignedToken(); + for (String msg: aLogMsgs) { + assertTrue(msg.contains("SUCCESS ROLETOKEN=(" + unsignToken)); + assertTrue(msg.contains("CLIENT-IP=(10.10.10.11)")); + break; + } + } + + @Test + public void testGetRoleTokenAddrLoopbackNoXFFAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + privateKey, "0"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + DataStore store = new DataStore(structStore, null); + zts = new ZTSImpl("localhost", store, null, null, debugMetric, privateKey, "0", alogger, null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + + RoleToken roleToken = zts.getRoleToken(context, "coretech", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertNotNull(token); + String unsignToken = token.getUnsignedToken(); + for (String msg: aLogMsgs) { + assertTrue(msg.contains("SUCCESS ROLETOKEN=(" + unsignToken)); + assertTrue(msg.contains("i=127.0.0.1")); + assertTrue(msg.contains("CLIENT-IP=(127.0.0.1)")); + break; + } + } + + @Test + public void testGetRoleTokenAddrLoopbackXFFSingeValueAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + Mockito.when(servletRequest.getHeader("X-Forwarded-For")).thenReturn("10.10.10.12"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + privateKey, "0"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + DataStore store = new DataStore(structStore, null); + zts = new ZTSImpl("localhost", store, null, null, debugMetric, privateKey, "0", alogger, null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + + RoleToken roleToken = zts.getRoleToken(context, "coretech", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertNotNull(token); + String unsignToken = token.getUnsignedToken(); + for (String msg: aLogMsgs) { + assertTrue(msg.contains("SUCCESS ROLETOKEN=(" + unsignToken)); + assertTrue(msg.contains("CLIENT-IP=(10.10.10.12)")); + break; + } + } + + @Test + public void testGetRoleTokenAddrLoopbackXFFMultipleValuesAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("127.0.0.1"); + Mockito.when(servletRequest.getHeader("X-Forwarded-For")).thenReturn("10.10.10.11, 10.11.11.11, 10.12.12.12"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + privateKey, "0"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + DataStore store = new DataStore(structStore, null); + zts = new ZTSImpl("localhost", store, null, null, debugMetric, privateKey, "0", alogger, null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + + RoleToken roleToken = zts.getRoleToken(context, "coretech", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken()); + assertNotNull(token); + String unsignToken = token.getUnsignedToken(); + for (String msg: aLogMsgs) { + assertTrue(msg.contains("SUCCESS ROLETOKEN=(" + unsignToken)); + assertTrue(msg.contains("CLIENT-IP=(10.12.12.12)")); + break; + } + } + + @Test + public void testGetRoleTokenNoRoleMatchAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("99.88.77.66"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + privateKey, "0"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + DataStore store = new DataStore(structStore, null); + zts = new ZTSImpl("localhost", store, null, null, debugMetric, privateKey, "0", alogger, null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "invalidUser", + "v=U1;d=user_domain;n=invalidUser;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + + try { + zts.getRoleToken(context, "coretech", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + + for (String msg: aLogMsgs) { + assertTrue(msg.contains("ERROR=(Principal Has No Access to Domain)")); + assertTrue(msg.contains("CLIENT-IP=(99.88.77.66)")); + assertTrue(msg.contains("WHO=(who-name=invalidUser,who-domain=user_domain,who-yrn=user_domain.invalidUser)")); + break; + } + } + + @Test + public void testGetRoleTokenInvalidDomainAuditLog() { + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + Mockito.when(servletRequest.getRemoteAddr()).thenReturn("55.88.77.66"); + + final java.util.Set aLogMsgs = new java.util.HashSet(); + AuditLogger alogger = new AuditLogger() { + public void log(String logMsg, String msgVersionTag) { + aLogMsgs.add(logMsg); + } + public void log(AuditLogMsgBuilder msgBldr) { + String msg = msgBldr.build(); + aLogMsgs.add(msg); + } + }; + + ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + privateKey, "0"); + + Metric debugMetric = new com.yahoo.athenz.common.metrics.impl.NoOpMetric(); + DataStore store = new DataStore(structStore, null); + zts = new ZTSImpl("localhost", store, null, null, debugMetric, privateKey, "0", alogger, null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal, servletRequest); + + try { + zts.getRoleToken(context, "invalidDomain", null, Integer.valueOf(600), + Integer.valueOf(1200), null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + + for (String msg: aLogMsgs) { + assertTrue(msg.contains("ERROR=(No Such Domain)")); + assertTrue(msg.contains("CLIENT-IP=(55.88.77.66)")); + assertTrue(msg.contains("WHO=(who-name=user,who-domain=user_domain,who-yrn=user_domain.user)")); + break; + } + } + + @Test + public void testRetrieveTenantDomainNameInvalidEntries() { + + // less than 4 components + + assertNull(zts.retrieveTenantDomainName("dom1", null)); + assertNull(zts.retrieveTenantDomainName("dom1.tenant", null)); + assertNull(zts.retrieveTenantDomainName("dom1.tenant.dom3", null)); + + // second component is not tenant + + assertNull(zts.retrieveTenantDomainName("dom1.dom2.dom3.admin", null)); + assertNull(zts.retrieveTenantDomainName("dom1.dom2.tenant.read", null)); + assertNull(zts.retrieveTenantDomainName("tenant.dom2.dom3.write", null)); + + // service name does not match to the given value + + assertNull(zts.retrieveTenantDomainName("service1.tenant.dom3.read", "service2")); + assertNull(zts.retrieveTenantDomainName("service2.tenant.dom3.dom4.admin", "service")); + } + + @Test + public void testRetrieveTenantDomainName4CompsValidDomain() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + assertEquals("coretech", zts.retrieveTenantDomainName("storage.tenant.coretech.admin", "storage")); + assertEquals("coretech", zts.retrieveTenantDomainName("storage.tenant.coretech.admin", null)); + } + + @Test + public void testRetrieveTenantDomainName4CompsInvalidDomain() { + + assertNull(zts.retrieveTenantDomainName("storage.tenant.coretech_unknown.admin", "storage")); + assertNull(zts.retrieveTenantDomainName("storage.tenant.coretech_unknown.admin", null)); + } + + @Test + public void testRetrieveTenantDomainName4PlusCompsValidDomainWithResourceGroup() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + assertEquals("coretech", zts.retrieveTenantDomainName("storage.tenant.coretech.resource_group.admin", "storage")); + assertEquals("coretech", zts.retrieveTenantDomainName("storage.tenant.coretech.resource_group.admin", null)); + + signedDomain = createSignedDomain("coretech.office.burbank", "weather", "storage", true); + store.processDomain(signedDomain, false); + + assertEquals("coretech.office.burbank", zts.retrieveTenantDomainName("storage.tenant.coretech.office.burbank.resource_group.admin", "storage")); + assertEquals("coretech.office.burbank", zts.retrieveTenantDomainName("storage.tenant.coretech.office.burbank.resource_group.admin", null)); + } + + + @Test + public void testRetrieveTenantDomainName4PlusCompsValidDomainWithOutResourceGroup() { + + SignedDomain signedDomain = createSignedDomain("coretech.office.burbank", "weather", "storage", true); + store.processDomain(signedDomain, false); + + assertEquals("coretech.office.burbank", zts.retrieveTenantDomainName("storage.tenant.coretech.office.burbank.admin", "storage")); + assertEquals("coretech.office.burbank", zts.retrieveTenantDomainName("storage.tenant.coretech.office.burbank.admin", null)); + } + + @Test + public void testRetrieveTenantDomainName4PlusCompsInvalidDomain() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + assertNull(zts.retrieveTenantDomainName("storage.tenant.coretech.office.glendale.admin", "storage")); + assertNull(zts.retrieveTenantDomainName("storage.tenant.coretech.office.glendale.resource_group.admin", null)); + } + + @Test + public void testGetTenantDomainsSingleDomainWithUserDomain() { + + SignedDomain signedDomain = createSignedDomain("athenz.product", "weather.frontpage", "storage", true); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomain("weather.frontpage", "athenz.product", "storage"); + store.processDomain(signedDomain, false); + + TenantDomains tenantDomains = zts.getTenantDomains(null, "athenz.product", "user_domain.user100", null, null); + assertNotNull(tenantDomains); + assertEquals(tenantDomains.getTenantDomainNames().size(), 1); + assertEquals(tenantDomains.getTenantDomainNames().get(0), "weather.frontpage"); + } + + @Test + public void testGetTenantDomainsSingleDomain() { + + SignedDomain signedDomain = createSignedDomain("athenz.product", "weather.frontpage", "storage", true); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomain("weather.frontpage", "athenz.product", "storage"); + store.processDomain(signedDomain, false); + + TenantDomains tenantDomains = zts.getTenantDomains(null, "athenz.product", "user_domain.user100", null, null); + assertNotNull(tenantDomains); + assertEquals(tenantDomains.getTenantDomainNames().size(), 1); + assertEquals(tenantDomains.getTenantDomainNames().get(0), "weather.frontpage"); + } + + @Test + public void testGetTenantDomainsMultipleDomains() { + + SignedDomain signedDomain = createMultipleSignedDomains("athenz.multiple", "hockey.kings", "hockey.stars", + "storage", true); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomain("hockey.kings", "athenz.multiple", "storage"); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomain("hockey.stars", "athenz.multiple", "storage"); + store.processDomain(signedDomain, false); + + TenantDomains tenantDomains = zts.getTenantDomains(null, "athenz.multiple", "user_domain.user100", null, null); + assertNotNull(tenantDomains); + assertEquals(tenantDomains.getTenantDomainNames().size(), 2); + assertTrue(tenantDomains.getTenantDomainNames().contains("hockey.kings")); + assertTrue(tenantDomains.getTenantDomainNames().contains("hockey.stars")); + } + + @Test + public void testGetTenantDomainsInvalidUser() { + + SignedDomain signedDomain = createSignedDomain("athenz.product", "weather.frontpage", "storage", true); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomain("weather.frontpage", "athenz.product", "storage"); + store.processDomain(signedDomain, false); + + TenantDomains tenantDomains = zts.getTenantDomains(null, "athenz.product", "user1099", null, null); + assertNotNull(tenantDomains); + assertEquals(tenantDomains.getTenantDomainNames().size(), 0); + } + + @Test + public void testGetTenantDomainsInvalidDomain() { + + SignedDomain signedDomain = createSignedDomain("athenz.product", "weather.frontpage", "storage", true); + store.processDomain(signedDomain, false); + + signedDomain = createTenantSignedDomain("weather.frontpage", "athenz.product", "storage"); + store.processDomain(signedDomain, false); + + try { + zts.getTenantDomains(null, "athenz.non_product", "user100", null, null); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testResourceContext() { + + RsrcCtxWrapper ctx = (RsrcCtxWrapper) zts.newResourceContext(mockServletRequest, mockServletResponse); + assertNotNull(ctx); + assertNotNull(ctx.context()); + assertNull(ctx.principal()); + assertEquals(ctx.request(), mockServletRequest); + assertEquals(ctx.response(), mockServletResponse); + + // throw exception without struct + try { + com.yahoo.athenz.common.server.rest.ResourceException restExc = new com.yahoo.athenz.common.server.rest.ResourceException(401, "failed message"); + ctx.throwZtsException(restExc); + fail(); + } catch (ResourceException ex) { + assertEquals(401, ex.getCode()); + assertEquals( ((ResourceError) ex.data).message, "failed message"); + } + } + + @Test + public void testVerifyAWSAssumeRoleInvalidDomain() { + assertFalse(zts.verifyAWSAssumeRole("unknown-domain", "role", "user_domain.user")); + } + + @Test + public void testVerifyAWSAssumeRoleNoRoles() { + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); + store.processDomain(signedDomain, false); + assertFalse(zts.verifyAWSAssumeRole("athenz.product", "role", "user_domain.user200")); + } + + @Test + public void testVerifyAWSAssumeRole() { + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); + store.processDomain(signedDomain, false); + + // our group includes user100 and user101 + assertTrue(zts.verifyAWSAssumeRole("athenz.product", "athenz.product:aws_role_name", "user_domain.user100")); + assertTrue(zts.verifyAWSAssumeRole("athenz.product", "athenz.product:aws_role_name", "user_domain.user101")); + assertFalse(zts.verifyAWSAssumeRole("athenz.product", "athenz.product:aws_role_name", "user_domain.user102")); + } + + @Test + public void testVerifyAWSAssumeRoleNoResourceMatch() { + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); + store.processDomain(signedDomain, false); + + assertFalse(zts.verifyAWSAssumeRole("athenz.product", "athenz.product:aws2_role_name", "user_domain.user100")); + assertFalse(zts.verifyAWSAssumeRole("athenz.product", "athenz.product:aws2_role_name", "user_domain.user101")); + assertFalse(zts.verifyAWSAssumeRole("athenz.product", "athenz.product:aws2_role_name", "user_domain.user102")); + } + + @Test + public void testGetAWSTemporaryCredentialsNoCloudStore() { + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); + store.processDomain(signedDomain, false); + + try { + zts.getAWSTemporaryCredentials(null, "athenz.product", "aws_role_name"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testGetAWSTemporaryCredentialsForbidden() { + + Principal principal = SimplePrincipal.create("user_domain", "user102", + "v=U1;d=user_domain;n=user102;s=signature", 0, null); + CloudStore cloudStore = Mockito.mock(CloudStore.class); + Mockito.when(cloudStore.isAwsEnabled()).thenReturn(true); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); + store.processDomain(signedDomain, false); + + try { + zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + } + + @Test + public void testGetAWSTemporaryCredentialsNoAwsAccount() { + + Principal principal = SimplePrincipal.create("user_domain", "user101", + "v=U1;d=user_domain;n=user101;s=signature", 0, null); + CloudStore cloudStore = new MockCloudStore(); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); + store.processDomain(signedDomain, false); + + try { + zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testGetAWSTemporaryCredentials() { + + Principal principal = SimplePrincipal.create("user_domain", "user101", + "v=U1;d=user_domain;n=user101;s=signature", 0, null); + CloudStore cloudStore = new MockCloudStore(); + ((MockCloudStore) cloudStore).setMockFields("1234", "aws_role_name", "user_domain.user101"); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234"); + store.processDomain(signedDomain, false); + + AWSTemporaryCredentials creds = zts.getAWSTemporaryCredentials( + createResourceContext(principal), "athenz.product", "aws_role_name"); + assertNotNull(creds); + + // now try a failure case + + try { + ((MockCloudStore) cloudStore).setMockFields("1234", "aws_role2_name", "user_domain.user101"); + zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testRetrieveResourceDomainAssumeRoleWithTrust() { + assertEquals("trustdomain", authorizer.retrieveResourceDomain("resource", "assume_role", "trustdomain")); + } + + @Test + public void testRetrieveResourceDomainAssumeRoleWithOutTrust() { + assertEquals("domain1", authorizer.retrieveResourceDomain("domain1:resource", "assume_role", null)); + } + + @Test + public void testRetrieveResourceDomainValidDomain() { + assertEquals("domain1", authorizer.retrieveResourceDomain("domain1:resource", "read", null)); + assertEquals("domain1", authorizer.retrieveResourceDomain("domain1:resource", "read", "trustdomain")); + } + + @Test + public void testRetrieveResourceDomainInvalidResource() { + assertEquals(null, authorizer.retrieveResourceDomain("domain1:resource:invalid", "read", null)); + assertEquals(null, authorizer.retrieveResourceDomain("domain1:a:b:c:d:e", "read", "trustdomain")); + } + + + @Test + public void testCheckKerberosAuthorityAuthorization() { + Authority authority = new com.yahoo.athenz.auth.impl.KerberosAuthority(); + Principal principal = SimplePrincipal.create("krb", "user1", "v=U1;d=krb;n=user1;s=signature", + 0, authority); + assertTrue(authorizer.authorityAuthorizationAllowed(principal)); + } + + @Test + public void testCheckNullAuthorityAuthorization() { + Principal principal = SimplePrincipal.create("user", "joe", "v=U1;d=user;n=joe;s=signature", + 0, null); + assertTrue(authorizer.authorityAuthorizationAllowed(principal)); + } + + @Test + public void testMatchDelegatedTrustAssertionInvalidAction() { + + Assertion assertion = new Assertion(); + assertion.setAction("READ"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain:*"); + assertion.setRole("domain:role.Role"); + + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, null, null, null)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoResPatternMatchWithOutPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("domain:role.Role"); + assertion.setRole("domain:role.Role"); + + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "domain:role.Role2", null, null)); + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, null)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoResPatternMatchWithPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("domain:role.Role"); + + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "domain:role.Role2", null, null)); + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "coretech:role.Role2", null, null)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoRoleMatchWithPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.*"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("coretech", "readers", null); + roles.add(role); + + role = createRoleObject("coretech", "writers", null); + roles.add(role); + + role = createRoleObject("coretech", "updaters", null); + roles.add(role); + + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoRoleMatchWithOutPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.Role"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("coretech", "Role1", null); + roles.add(role); + + role = createRoleObject("coretech", "Role2", null); + roles.add(role); + + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "weather:role.Role1", null, roles)); + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "coretech:role.Role", null, roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionNoMemberMatch() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.Role"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("weather", "Role1", null, "user_domain.user1", null); + roles.add(role); + + role = createRoleObject("weather", "Role", null, "user_domain.user2", null); + roles.add(role); + + assertFalse(authorizer.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user_domain.user1", roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionValidWithPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.*"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("weather", "Role1", null, "user_domain.user1", null); + roles.add(role); + + role = createRoleObject("weather", "Role", null, "user_domain.user2", null); + roles.add(role); + + assertTrue(authorizer.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user_domain.user2", roles)); + } + + @Test + public void testMatchDelegatedTrustAssertionValidWithOutPattern() { + + Assertion assertion = new Assertion(); + assertion.setAction("ASSUME_ROLE"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*:role.Role"); + assertion.setRole("weather:role.Role"); + + Role role = null; + List roles = new ArrayList<>(); + + role = createRoleObject("weather", "Role1", null, "user_domain.user1", null); + roles.add(role); + + role = createRoleObject("weather", "Role", null, "user_domain.user2", null); + roles.add(role); + + assertTrue(authorizer.matchDelegatedTrustAssertion(assertion, "weather:role.Role", "user_domain.user2", roles)); + } + + @Test + public void testMatchDelegatedTrustPolicyNoAssertions() { + Policy policy = new Policy(); + assertFalse(authorizer.matchDelegatedTrustPolicy(policy, "roleName", "user_domain.user1", null)); + } + + @Test + public void testMatchPrincipalInRoleStdMemberMatch() { + + Role role = createRoleObject("weather", "Role", null, "user_domain.user2", null); + assertTrue(authorizer.matchPrincipalInRole(role, null, "user_domain.user2", null)); + } + + @Test + public void testMatchPrincipalInRoleStdMemberNoMatch() { + + Role role = createRoleObject("weather", "Role", null, "user_domain.user2", null); + assertFalse(authorizer.matchPrincipalInRole(role, null, "user_domain.user23", null)); + } + + @Test + public void testMatchPrincipalInRoleNoDelegatedTrust() { + Role role = createRoleObject("weather", "Role", null); + assertFalse(authorizer.matchPrincipalInRole(role, null, null, null)); + assertFalse(authorizer.matchPrincipalInRole(role, null, null, "weather")); + } + + @Test + public void testMatchPrincipalInRoleDelegatedTrustNoMatch() { + Role role = createRoleObject("weather", "Role", "coretech_not_present"); + assertFalse(authorizer.matchPrincipalInRole(role, "Role", "user_domain.user1", "coretech_not_present")); + } + + @Test + public void testMatchPrincipalInRoleDelegatedTrustMatch() { + + DataCache domain = new DataCache(); + DomainData domainData = new DomainData(); + domainData.setName("coretechtrust"); + domain.setDomainData(domainData); + domainData.setRoles(new ArrayList()); + Role role1 = createRoleObject("coretechtrust", "role1", null, "user_domain.user1", null); + Role role2 = createRoleObject("coretechtrust", "role2", null, "user_domain.user2", null); + domainData.getRoles().add(role1); + domainData.getRoles().add(role2); + + Policy policy = createPolicyObject("coretechtrust", "trust", "coretechtrust:role.role1", + false, "ASSUME_ROLE", "weather:role.role1", AssertionEffect.ALLOW); + domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies()); + domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies()); + domainData.getPolicies().getContents().setPolicies(new ArrayList()); + domainData.getPolicies().getContents().getPolicies().add(policy); + + store.getCacheStore().put("coretechtrust", domain); + Role role = createRoleObject("weather", "role1", "coretechtrust"); + assertTrue(authorizer.matchPrincipalInRole(role, "weather:role.role1", "user_domain.user1", "coretechtrust")); + assertFalse(authorizer.matchPrincipalInRole(role, "weather:role.role1", "user_domain.user1", "coretechtrust2")); + assertFalse(authorizer.matchPrincipalInRole(role, "weather:role.role1", "user_domain.user3", "coretechtrust")); + store.getCacheStore().invalidate("coretechtrust"); + } + + @Test + public void testAccessDelegatedTrust() { + + DataCache domain = new DataCache(); + DomainData domainData = new DomainData(); + domainData.setName("coretechtrust"); + domain.setDomainData(domainData); + domainData.setRoles(new ArrayList()); + Role role1 = createRoleObject("coretechtrust", "role1", null, "user_domain.user1", null); + Role role2 = createRoleObject("coretechtrust", "role2", null, "user_domain.user2", null); + domainData.getRoles().add(role1); + domainData.getRoles().add(role2); + + Policy policy = createPolicyObject("coretechtrust", "trust", "coretechtrust:role.role1", + false, "ASSUME_ROLE", "weather:role.role1", AssertionEffect.ALLOW); + domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies()); + domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies()); + domainData.getPolicies().getContents().setPolicies(new ArrayList()); + domainData.getPolicies().getContents().getPolicies().add(policy); + store.getCacheStore().put("coretechtrust", domain); + + domain = new DataCache(); + domainData = new DomainData(); + domainData.setName("weather"); + domain.setDomainData(domainData); + domainData.setRoles(new ArrayList()); + role1 = createRoleObject("weather", "role1", "coretechtrust"); + domainData.getRoles().add(role1); + + policy = createPolicyObject("weather", "access", "weather:role.role1", + false, "update", "weather:table1", AssertionEffect.ALLOW); + domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies()); + domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies()); + domainData.getPolicies().getContents().setPolicies(new ArrayList()); + domainData.getPolicies().getContents().getPolicies().add(policy); + store.getCacheStore().put("weather", domain); + + Principal principal1 = SimplePrincipal.create("user_domain", "user1", + "v=U1;d=user_domain;n=user1;s=signature", 0, null); + assertTrue(authorizer.access("update", "weather:table1", principal1, null)); + assertTrue(authorizer.access("update", "weather:table1", principal1, "coretechtrust")); + assertFalse(authorizer.access("update", "weather:table1", principal1, "unknowntrust")); + assertFalse(authorizer.access("update", "weather:table2", principal1, null)); + assertFalse(authorizer.access("delete", "weather:table1", principal1, null)); + + Principal principal2 = SimplePrincipal.create("user_domain", "user2", + "v=U1;d=user_domain;n=user2;s=signature", 0, null); + assertFalse(authorizer.access("update", "weather:table1", principal2, null)); + + Principal principal3 = SimplePrincipal.create("user_domain", "user3", + "v=U1;d=user_domain;n=user3;s=signature", 0, null); + assertFalse(authorizer.access("update", "weather:table1", principal3, null)); + + store.getCacheStore().invalidate("coretechtrust"); + store.getCacheStore().invalidate("weather"); + } + + @Test + public void testAccess() { + + DataCache domain = new DataCache(); + DomainData domainData = new DomainData(); + domainData.setName("coretechtrust"); + domain.setDomainData(domainData); + domainData.setRoles(new ArrayList()); + Role role1 = createRoleObject("coretechtrust", "role1", null, "user_domain.user1", null); + Role role2 = createRoleObject("coretechtrust", "role2", null, "user_domain.user2", null); + domainData.getRoles().add(role1); + domainData.getRoles().add(role2); + + Policy policy = createPolicyObject("coretechtrust", "access", "coretechtrust:role.role1", + false, "update", "coretechtrust:table1", AssertionEffect.ALLOW); + domainData.setPolicies(new com.yahoo.athenz.zms.SignedPolicies()); + domainData.getPolicies().setContents(new com.yahoo.athenz.zms.DomainPolicies()); + domainData.getPolicies().getContents().setPolicies(new ArrayList()); + domainData.getPolicies().getContents().getPolicies().add(policy); + store.getCacheStore().put("coretechtrust", domain); + + Principal principal1 = SimplePrincipal.create("user_domain", "user1", + "v=U1;d=user_domain;n=user1;s=signature", 0, null); + assertTrue(authorizer.access("update", "coretechtrust:table1", principal1, null)); + assertFalse(authorizer.access("update", "coretechtrust:table2", principal1, null)); + assertFalse(authorizer.access("delete", "coretechtrust:table1", principal1, null)); + + Principal principal2 = SimplePrincipal.create("user_domain", "user2", + "v=U1;d=user_domain;n=user2;s=signature", 0, null); + assertFalse(authorizer.access("update", "coretechtrust:table1", principal2, null)); + + Principal principal3 = SimplePrincipal.create("user_domain", "user3", + "v=U1;d=user_domain;n=user3;s=signature", 0, null); + assertFalse(authorizer.access("update", "coretechtrust:table1", principal3, null)); + + store.getCacheStore().invalidate("coretechtrust"); + } + + @Test + public void testAccessInvalidResource() { + + Principal principal1 = SimplePrincipal.create("user_domain", "user1", + "v=U1;d=user_domain;n=user1;s=signature", 0, null); + try { + authorizer.access("update", "coretechtrust:table1:test3", principal1, null); + fail(); + } catch (com.yahoo.athenz.zts.ResourceException ex) { + assertEquals(404, ex.getCode()); + } + } + + @Test + public void testAccessInvalidDomain() { + + Principal principal1 = SimplePrincipal.create("user_domain", "user1", + "v=U1;d=user_domain;n=user1;s=signature", 0, null); + try { + authorizer.access("update", "unknowndoamin:table1", principal1, null); + fail(); + } catch (com.yahoo.athenz.zts.ResourceException ex) { + assertEquals(404, ex.getCode()); + } + } + + @Test + public void testIsMemberOfRoleNoMembers() { + Role role1 = new Role(); + assertFalse(authorizer.isMemberOfRole(role1, "user_domain.user1")); + } + + @Test + public void testPostAWSCertificateRequestNoAwsAccount() { + + CloudStore cloudStore = new MockCloudStore(); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); + store.processDomain(signedDomain, false); + AWSCertificateRequest req = new AWSCertificateRequest(); + req.setCsr("csr"); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", + 0, new com.yahoo.athenz.auth.impl.CertificateAuthority()); + ResourceContext context = createResourceContext(principal); + + try { + zts.postAWSCertificateRequest(context, "athenz.product", "zts", req); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSCertificateRequestNoCloudStore() { + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); + store.processDomain(signedDomain, false); + AWSCertificateRequest req = new AWSCertificateRequest(); + req.setCsr("csr"); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", + 0, new com.yahoo.athenz.auth.impl.CertificateAuthority()); + ResourceContext context = createResourceContext(principal); + + try { + zts.postAWSCertificateRequest(context, "athenz.product", "zts", req); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSCertificateRequestInvalidAuthority() { + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); + store.processDomain(signedDomain, false); + AWSCertificateRequest req = new AWSCertificateRequest(); + req.setCsr("csr"); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", + 0, new com.yahoo.athenz.auth.impl.KerberosAuthority()); + ResourceContext context = createResourceContext(principal); + + try { + zts.postAWSCertificateRequest(context, "athenz.product", "zts", req); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + } + + @Test + public void testPostAWSCertificateRequestNullAuthority() { + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); + store.processDomain(signedDomain, false); + AWSCertificateRequest req = new AWSCertificateRequest(); + req.setCsr("csr"); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + + ResourceContext context = createResourceContext(principal); + + try { + zts.postAWSCertificateRequest(context, "athenz.product", "zts", req); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + } + + @Test + public void testPostAWSCertificateRequest() throws IOException { + + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + CertSigner certSigner = new MockCertSigner(caPrivateKey, caCertificate); + + CloudStore cloudStore = new MockCloudStore(certSigner); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz", "012345"); + store.processDomain(signedDomain, false); + + AWSCertificateRequest req = new AWSCertificateRequest(); + Path path = Paths.get("src/test/resources/valid.csr"); + String certStr = new String(Files.readAllBytes(path)); + req.setCsr(certStr); + + Principal principal = SimplePrincipal.create("athenz", "syncer", "user-credentials", + 0, new com.yahoo.athenz.auth.impl.CertificateAuthority()); + ResourceContext context = createResourceContext(principal); + + Identity identity = zts.postAWSCertificateRequest(context, "athenz", "syncer", req); + assertNotNull(identity); + } + + @Test + public void testPostAWSCertificateRequestInvalidCSR() throws IOException { + + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + CertSigner certSigner = new MockCertSigner(caPrivateKey, caCertificate); + + CloudStore cloudStore = new MockCloudStore(certSigner); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz", "012345"); + store.processDomain(signedDomain, false); + + AWSCertificateRequest req = new AWSCertificateRequest(); + req.setCsr("invalid-csr"); + + Principal principal = SimplePrincipal.create("athenz", "syncer", + "v=U1;d=athenz;n=syncer;s=signature", + 0, new com.yahoo.athenz.auth.impl.CertificateAuthority()); + ResourceContext context = createResourceContext(principal); + + try { + zts.postAWSCertificateRequest(context, "athenz", "syncer", req); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + } + + @Test + public void testPostAWSCertificateRequestMismatchPrincipal() throws IOException { + + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + CertSigner certSigner = new MockCertSigner(caPrivateKey, caCertificate); + + CloudStore cloudStore = new MockCloudStore(certSigner); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz", "012345"); + store.processDomain(signedDomain, false); + + AWSCertificateRequest req = new AWSCertificateRequest(); + req.setCsr("invalid-csr"); + + Principal principal = SimplePrincipal.create("athenz", "zts", + "v=U1;d=athenz;n=zts;s=signature", + 0, new com.yahoo.athenz.auth.impl.CertificateAuthority()); + ResourceContext context = createResourceContext(principal); + + try { + zts.postAWSCertificateRequest(context, "athenz", "zts", req); + } catch (ResourceException ex) { + assertEquals(400, ex.getCode()); + } + } + + private AWSInstanceInformation generateAWSInstanceInformation(String domain, String account, + String document, String signature) { + + AWSInstanceInformation info = new AWSInstanceInformation(); + if (document == null) { + info.setDocument(CloudStoreTest.AWS_INSTANCE_DOCUMENT); + } else { + info.setDocument(document); + } + info.setSignature(signature); + + info.setName(domain + ".syncer"); + info.setDomain(domain); + info.setAccount(account); + info.setCloud("athenz"); + info.setService("syncer"); + info.setSubnet("subnet"); + info.setAccess("access"); + info.setSecret("secret"); + info.setToken("token"); + info.setExpires(Timestamp.fromCurrentTime()); + info.setModified(Timestamp.fromCurrentTime()); + info.setFlavor("AWS-HMAC"); + + Path path = Paths.get("src/test/resources/valid.csr"); + try { + String certCsr = new String(Files.readAllBytes(path)); + info.setCsr(certCsr); + } catch (IOException e) { + } + + return info; + } + + @Test + public void testPostInstanceInformation() throws IOException { + Path path = Paths.get("src/test/resources/valid.csr"); + String certCsr = new String(Files.readAllBytes(path)); + + InstanceInformation info = new InstanceInformation() + .setCsr(certCsr) + .setDocument("Test Document") + .setSignature("Test Signature") + .setDomain("athenz") + .setService("syncer") + .setKeyId("0"); + + Identity identity = zts.postInstanceInformation(null, info); + + assertNotNull(identity); + + X509Certificate cert = Crypto.loadX509Certificate(identity.getCertificate()); + assertNotNull(cert); + } + + @Test + public void testPostInstanceInformationInvalidCsr() throws IOException { + InstanceInformation info = new InstanceInformation() + .setCsr("invalid-csr") + .setDocument("Test Document") + .setSignature("Test Signature") + .setDomain("iaas.athenz") + .setService("syncer"); + + try { + zts.postInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationNoAwsAccount() { + + CloudStore cloudStore = new MockCloudStore(); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); + store.processDomain(signedDomain, false); + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", null, null); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationInfoAwsAccountMismatch() { + + CloudStore cloudStore = new MockCloudStore(); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "12345"); + store.processDomain(signedDomain, false); + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", null, null); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationNoCloudStore() { + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", null); + store.processDomain(signedDomain, false); + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", null, null); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationInvalidSignature() { + + CloudStore cloudStore = new MockCloudStore(); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "111111111111"); + store.processDomain(signedDomain, false); + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", null, "invalid-signature"); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationInvalidDocument() { + + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.skipDocumentSignatureCheck(true); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "111111111111"); + store.processDomain(signedDomain, false); + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", "invalid-document", null); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationAccountMismatch() { + + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.skipDocumentSignatureCheck(true); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "12345"); + store.processDomain(signedDomain, false); + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "12345", null, null); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationInvalidBootTime() { + + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.setIdentityCheckResult(1); + cloudStore.skipDocumentSignatureCheck(true); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "111111111111"); + store.processDomain(signedDomain, false); + + // our default limit is 300 seconds so we're going to set + // the pending time to before 301 seconds to fail + + long pendingTime = System.currentTimeMillis() - 301 * 1000; + String instanceDocument = AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_BEGIN + + Timestamp.fromMillis(pendingTime).toString() + + AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_END; + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", instanceDocument, "signature"); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 403); + } + } + + @Test + public void testPostAWSInstanceInformationIdentityCheckFailure() { + + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.setIdentityCheckResult(-1); + cloudStore.skipDocumentSignatureCheck(true); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "111111111111"); + store.processDomain(signedDomain, false); + + long pendingTime = System.currentTimeMillis(); + String instanceDocument = AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_BEGIN + + Timestamp.fromMillis(pendingTime).toString() + + AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_END; + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", instanceDocument, null); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformationInvalidCSR() { + + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.setIdentityCheckResult(1); + cloudStore.skipDocumentSignatureCheck(true); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "111111111111"); + store.processDomain(signedDomain, false); + + long pendingTime = System.currentTimeMillis(); + String instanceDocument = AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_BEGIN + + Timestamp.fromMillis(pendingTime).toString() + + AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_END; + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz.product", + "111111111111", instanceDocument, null); + info.setCsr("invalid-csr"); + + try { + zts.postAWSInstanceInformation(null, info); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testPostAWSInstanceInformation() throws IOException { + + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + CertSigner certSigner = new MockCertSigner(caPrivateKey, caCertificate); + + MockCloudStore cloudStore = new MockCloudStore(certSigner); + cloudStore.setIdentityCheckResult(1); + cloudStore.skipDocumentSignatureCheck(true); + store.setCloudStore(cloudStore); + zts.cloudStore = cloudStore; + + SignedDomain signedDomain = createAwsSignedDomain("athenz", "111111111111"); + store.processDomain(signedDomain, false); + + long pendingTime = System.currentTimeMillis(); + String instanceDocument = AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_BEGIN + + Timestamp.fromMillis(pendingTime).toString() + + AWS_INSTANCE_DOCUMENT_WOUT_TIMESTAMP_END; + + Path path = Paths.get("src/test/resources/valid.csr"); + String certCsr = new String(Files.readAllBytes(path)); + + AWSInstanceInformation info = generateAWSInstanceInformation("athenz", + "111111111111", instanceDocument, "signature"); + info.setCsr(certCsr); + + Identity identity = zts.postAWSInstanceInformation(null, info); + assertNotNull(identity); + } + + @Test + public void testGetSchema() { + Schema schema = zts.getRdlSchema(null); + assertNotNull(schema); + } + + @Test + public void testGetSvcTokenExpiryTime() { + + long ZTS_NTOKEN_DEFAULT_EXPIRY = TimeUnit.SECONDS.convert(2, TimeUnit.HOURS); + long ZTS_NTOKEN_MAX_EXPIRY = TimeUnit.SECONDS.convert(7, TimeUnit.DAYS); + + assertEquals(zts.getSvcTokenExpiryTime(null), ZTS_NTOKEN_DEFAULT_EXPIRY); + assertEquals(zts.getSvcTokenExpiryTime(0), ZTS_NTOKEN_DEFAULT_EXPIRY); + assertEquals(zts.getSvcTokenExpiryTime(-1), ZTS_NTOKEN_DEFAULT_EXPIRY); + assertEquals(zts.getSvcTokenExpiryTime(100), 100); + assertEquals(zts.getSvcTokenExpiryTime(2 * 60 * 60), ZTS_NTOKEN_DEFAULT_EXPIRY); + assertEquals(zts.getSvcTokenExpiryTime(2 * 60 * 60 - 1), ZTS_NTOKEN_DEFAULT_EXPIRY - 1); + assertEquals(zts.getSvcTokenExpiryTime(604799), 604799); + assertEquals(zts.getSvcTokenExpiryTime(604800), ZTS_NTOKEN_MAX_EXPIRY); + assertEquals(zts.getSvcTokenExpiryTime(604801), ZTS_NTOKEN_MAX_EXPIRY); + } + + @Test + public void testPostInstanceRefreshRequestHcaCNMismatch() throws IOException { + Path path = Paths.get("src/test/resources/valid.csr"); + String certCsr = new String(Files.readAllBytes(path)); + + InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); + + SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("abc", "xyz", + "v=S1,d=abc;n=xyz;s=sig", 0, null); + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + ResourceContext context = createResourceContext(principal, servletRequest); + + try { + zts.postInstanceRefreshRequest(context, "abc", "xyz", req); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + + @Test + public void testPostInstanceRefreshRequestHcaPrincipalMismatch() throws IOException { + Path path = Paths.get("src/test/resources/valid.csr"); + String certCsr = new String(Files.readAllBytes(path)); + + InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr); + + SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("abc", "xyz", + "v=S1,d=abc;n=xyz;s=sig", 0, null); + HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); + ResourceContext context = createResourceContext(principal, servletRequest); + + try { + zts.postInstanceRefreshRequest(context, "iaas.athenz", "syncer", req); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + } + + @Test + public void testGetAccess() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + // user_domain.user only has access to writers + + Access access = zts.getAccess(context, "coretech", "writers", "user_domain.user"); + assertTrue(access.getGranted()); + + access = zts.getAccess(context, "coretech", "readers", "user_domain.user"); + assertFalse(access.getGranted()); + + // user_domain.user1 had access to readers and writers + + access = zts.getAccess(context, "coretech", "writers", "user_domain.user1"); + assertTrue(access.getGranted()); + + access = zts.getAccess(context, "coretech", "readers", "user_domain.user1"); + assertTrue(access.getGranted()); + + access = zts.getAccess(context, "coretech", "editors", "user_domain.user1"); + assertFalse(access.getGranted()); + + // user_domain.user4 only has access to readers + + access = zts.getAccess(context, "coretech", "readers", "user_domain.user4"); + assertTrue(access.getGranted()); + + access = zts.getAccess(context, "coretech", "writers", "user_domain.user4"); + assertFalse(access.getGranted()); + } + + @Test + public void testGetAccessInvalidData() { + + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + // null and empty arguments + + try { + zts.getAccess(context, "", "writers", "user_domain.user"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + zts.getAccess(context, null, "writers", "user_domain.user"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + zts.getAccess(context, "coretech", "", "user_domain.user"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + zts.getAccess(context, "coretech", null, "user_domain.user"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + zts.getAccess(context, "coretech", "writers", ""); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + try { + zts.getAccess(context, "coretech", "writers", null); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + } + + // now invalid domain + + try { + zts.getAccess(context, "coretech-unknown", "writers", "user_domain.user"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + } + } + + @Test + public void testPostDomainMetrics() { + SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", false); + store.processDomain(signedDomain, false); + + Principal principal = SimplePrincipal.create("user_domain", "user", + "v=U1;d=user_domain;n=user;s=signature", 0, null); + ResourceContext context = createResourceContext(principal); + + // create zts with a metric we can verify + CloudStore cloudStore = new CloudStore(null); + cloudStore.setHttpClient(null); + CertSigner certSigner = new MockCertSignerFactory().create(null); + SvcCertStore svcCertStore = new YSvcCertStore(certSigner); + ZtsMetricTester metric = new ZtsMetricTester(); + ZTSImpl ztsImpl = new ZTSImpl("localhost", store, cloudStore, svcCertStore, metric, + privateKey, "0", AuditLogFactory.getLogger(), null); + + String testDomain = "coretech"; + + // create some metrics + List metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(99)); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED). + setMetricVal(27)); + DomainMetrics req = new DomainMetrics(). + setDomainName(testDomain). + setMetricList(metricList); + + // send the metrics + ztsImpl.postDomainMetrics(context, testDomain, req); + + // verify metrics were recorded + Map metrixMap = metric.getMap(); + String key = "dom_metric_" + + DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH.toString().toLowerCase() + + testDomain; + Integer val = metrixMap.get(key); + assertNotNull(val); + assertEquals(val.intValue(), 99); + key = "dom_metric_" + + DomainMetricType.ACCESS_ALLOWED.toString().toLowerCase() + + testDomain; + val = metrixMap.get(key); + assertNotNull(val); + assertEquals(val.intValue(), 27); + + // test - failure case - invalid domain + // + testDomain = "not_coretech"; + // create some metrics + metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(999)); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED). + setMetricVal(277)); + req = new DomainMetrics(). + setDomainName(testDomain). + setMetricList(metricList); + + // send the metrics + metrixMap.clear(); + String errMsg = "No such domain"; + try { + ztsImpl.postDomainMetrics(context, testDomain, req); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 404); + assertTrue(ex.getMessage().contains(errMsg)); + } + + // verify no metrics were recorded + assertEquals(metrixMap.size(), 0); + + // test - failure case - missing domain name in metric data + // + testDomain = "coretech"; + // create some metrics + metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(999)); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED). + setMetricVal(277)); + req = new DomainMetrics(). + setMetricList(metricList); + + errMsg = "Missing required field: domainName"; + // send the metrics + metrixMap.clear(); + try { + ztsImpl.postDomainMetrics(context, testDomain, req); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains(errMsg), ex.getMessage()); + } + // verify no metrics were recorded + assertEquals(metrixMap.size(), 0); + + // test - failure case - mismatch domain in uri and metric data + // + testDomain = "coretech"; + // create some metrics + metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(999)); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED). + setMetricVal(277)); + req = new DomainMetrics(). + setDomainName("not_coretech"). + setMetricList(metricList); + + errMsg = "mismatched domain names"; + // send the metrics + metrixMap.clear(); + try { + ztsImpl.postDomainMetrics(context, testDomain, req); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains(errMsg), ex.getMessage()); + } + // verify no metrics were recorded + assertEquals(metrixMap.size(), 0); + + // test - failure case - empty metric list + // + testDomain = "coretech"; + // create some metrics + metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(999)); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED). + setMetricVal(277)); + req = new DomainMetrics(). + setDomainName(testDomain); + + errMsg = "Missing required field: metricList"; + // send the metrics + metrixMap.clear(); + try { + ztsImpl.postDomainMetrics(context, testDomain, req); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 400); + assertTrue(ex.getMessage().contains(errMsg), ex.getMessage()); + } + // verify no metrics were recorded + assertEquals(metrixMap.size(), 0); + + // test - failure case - metric count is missing + // + testDomain = "coretech"; + // create a single metric without a count + metricList = new ArrayList<>(); + metricList.add( + new DomainMetric(). + setMetricType(DomainMetricType.ACCESS_ALLOWED_DENY_NO_MATCH). + setMetricVal(-1)); + req = new DomainMetrics(). + setDomainName(testDomain). + setMetricList(metricList); + + // verify no metrics were recorded + metrixMap.clear(); + ztsImpl.postDomainMetrics(context, testDomain, req); + assertEquals(metrixMap.size(), 0); + } + + @Test + public void testIsAuthorizedProxyUser() { + assertFalse(zts.isAuthorizedProxyUser(null, "user.joe")); + + Set proxyUsers = new HashSet<>(); + proxyUsers.add("user.joe"); + proxyUsers.add("user.jane"); + + assertTrue(zts.isAuthorizedProxyUser(proxyUsers, "user.joe")); + assertTrue(zts.isAuthorizedProxyUser(proxyUsers, "user.jane")); + assertFalse(zts.isAuthorizedProxyUser(proxyUsers, "user.john")); + } + + @Test + public void testCompareRoleLists() { + List list1 = new ArrayList<>(); + List list2 = new ArrayList<>(); + + // emtpy sets should match + + assertTrue(zts.compareRoleLists(list1, list2)); + + // not the same size so mismatch + + list1.add("role1"); + list1.add("role2"); + + list2.add("role1"); + + assertFalse(zts.compareRoleLists(list1, list2)); + + // same size different values + + list2.add("role3"); + + assertFalse(zts.compareRoleLists(list1, list2)); + + // same values in both + + list1.add("role3"); + list2.add("role2"); + + assertTrue(zts.compareRoleLists(list1, list2)); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSJettyContainerTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSJettyContainerTest.java new file mode 100644 index 00000000000..12472797d75 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSJettyContainerTest.java @@ -0,0 +1,331 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; + +import org.eclipse.jetty.server.Connector; +import org.eclipse.jetty.server.Handler; +import org.eclipse.jetty.server.HttpConfiguration; +import org.eclipse.jetty.server.RequestLog; +import org.eclipse.jetty.server.Server; +import org.eclipse.jetty.server.Slf4jRequestLog; +import org.eclipse.jetty.server.handler.RequestLogHandler; +import org.eclipse.jetty.servlet.ServletContextHandler; +import org.eclipse.jetty.util.thread.ThreadPool; + +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.Test; + +import org.mockito.Mock; +import org.mockito.MockitoAnnotations; + +import com.yahoo.athenz.common.server.log.AthenzRequestLog; +import com.yahoo.athenz.common.server.log.AuditLogFactory; + +public class ZTSJettyContainerTest { + + @Mock com.yahoo.athenz.zts.ZTSHandler mockImpl; + + @BeforeClass + public void setUp() throws Exception { + MockitoAnnotations.initMocks(this); + } + + @AfterMethod + public void cleanup() { + System.clearProperty(ZTSConsts.ZTS_PROP_MAX_THREADS); + System.clearProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH); + System.clearProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE); + System.clearProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD); + System.clearProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH); + System.clearProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE); + System.clearProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD); + System.clearProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD); + System.clearProperty(ZTSConsts.ZTS_PROP_EXCLUDED_CIPHER_SUITES); + System.clearProperty(ZTSConsts.ZTS_PROP_EXCLUDED_PROTOCOLS); + System.clearProperty(ZTSConsts.ZTS_PROP_SEND_SERVER_VERSION); + System.clearProperty(ZTSConsts.ZTS_PROP_SEND_DATE_HEADER); + System.clearProperty(ZTSConsts.ZTS_PROP_OUTPUT_BUFFER_SIZE); + System.clearProperty(ZTSConsts.ZTS_PROP_REQUEST_HEADER_SIZE); + System.clearProperty(ZTSConsts.ZTS_PROP_RESPONSE_HEADER_SIZE); + System.clearProperty(ZTSConsts.ZTS_PROP_IDLE_TIMEOUT); + } + + @Test + public void testContainerThreadPool() { + + System.setProperty(ZTSConsts.ZTS_PROP_MAX_THREADS, "100"); + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.createServer(100); + + Server server = container.getServer(); + assertNotNull(server); + + ThreadPool threadPool = server.getThreadPool(); + assertNotNull(threadPool); + + // at this point we have no threads so the value is 0 + assertEquals(threadPool.getThreads(), 0); + assertEquals(threadPool.getIdleThreads(), 0); + } + + @Test + public void testRequestLogHandler() { + + System.setProperty(ZTSConsts.ZTS_PROP_ACCESS_LOG_RETAIN_DAYS, "3"); + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.resource(com.yahoo.athenz.zts.ZTSResources.class); + container.delegate(com.yahoo.athenz.zts.ZTSHandler.class, mockImpl); + container.createServer(100); + + container.addRequestLogHandler("/tmp/zts_log"); + + // now retrieve the request log handler + + Handler[] handlers = container.getHandlers().getHandlers(); + RequestLogHandler logHandler = null; + for (Handler handler : handlers) { + if (handler instanceof RequestLogHandler) { + logHandler = (RequestLogHandler) handler; + break; + } + } + + assertNotNull(logHandler); + + RequestLog reqLog = logHandler.getRequestLog(); + assertNotNull(reqLog); + assertEquals(reqLog.getClass(), AthenzRequestLog.class); + } + + @Test + public void testSlf4jRequestLogHandler() { + + System.setProperty(ZTSConsts.ZTS_PROP_ACCESS_SLF4J_LOGGER, "AthenzAccessLogger"); + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.resource(com.yahoo.athenz.zts.ZTSResources.class); + container.delegate(com.yahoo.athenz.zts.ZTSHandler.class, mockImpl); + container.createServer(100); + + container.addRequestLogHandler("/tmp/zts_log"); + + // now retrieve the request log handler + + Handler[] handlers = container.getHandlers().getHandlers(); + RequestLogHandler logHandler = null; + for (Handler handler : handlers) { + if (handler instanceof RequestLogHandler) { + logHandler = (RequestLogHandler) handler; + break; + } + } + + assertNotNull(logHandler); + + RequestLog reqLog = logHandler.getRequestLog(); + assertNotNull(reqLog); + assertEquals(reqLog.getClass(), Slf4jRequestLog.class); + assertEquals(((Slf4jRequestLog) reqLog).getLoggerName(), "AthenzAccessLogger"); + System.clearProperty(ZTSConsts.ZTS_PROP_ACCESS_SLF4J_LOGGER); + } + + @Test + public void testPrimaryContext() { + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.createServer(100); + container.resource(com.yahoo.athenz.zts.ZTSResources.class); + container.delegate(com.yahoo.athenz.zts.ZTSHandler.class, mockImpl); + container.addServletHandlers("/tmp", "localhost"); + + Handler[] handlers = container.getHandlers().getHandlers(); + ServletContextHandler srvHandler = null; + for (Handler handler : handlers) { + if (handler instanceof ServletContextHandler) { + srvHandler = (ServletContextHandler) handler; + break; + } + } + + assertNotNull(srvHandler); + assertEquals(srvHandler.getContextPath(), "/"); + } + + @Test + public void testHttpConfigurationValidHttpsPort() { + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.createServer(100); + + System.setProperty(ZTSConsts.ZTS_PROP_SEND_SERVER_VERSION, "true"); + System.setProperty(ZTSConsts.ZTS_PROP_SEND_DATE_HEADER, "false"); + System.setProperty(ZTSConsts.ZTS_PROP_OUTPUT_BUFFER_SIZE, "128"); + System.setProperty(ZTSConsts.ZTS_PROP_REQUEST_HEADER_SIZE, "256"); + System.setProperty(ZTSConsts.ZTS_PROP_RESPONSE_HEADER_SIZE, "512"); + + int httpsPort = 443; + + HttpConfiguration httpConfig = container.newHttpConfiguration(httpsPort); + assertNotNull(httpConfig); + + assertEquals(httpConfig.getOutputBufferSize(), 128); + assertFalse(httpConfig.getSendDateHeader()); + assertTrue(httpConfig.getSendServerVersion()); + assertEquals(httpConfig.getRequestHeaderSize(), 256); + assertEquals(httpConfig.getResponseHeaderSize(), 512); + assertEquals(httpConfig.getSecurePort(), httpsPort); + assertEquals(httpConfig.getSecureScheme(), "https"); + } + + @Test + public void testHttpConfigurationNoHttpsPort() { + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.createServer(100); + + System.setProperty(ZTSConsts.ZTS_PROP_SEND_SERVER_VERSION, "false"); + System.setProperty(ZTSConsts.ZTS_PROP_SEND_DATE_HEADER, "true"); + System.setProperty(ZTSConsts.ZTS_PROP_OUTPUT_BUFFER_SIZE, "64"); + System.setProperty(ZTSConsts.ZTS_PROP_REQUEST_HEADER_SIZE, "128"); + System.setProperty(ZTSConsts.ZTS_PROP_RESPONSE_HEADER_SIZE, "256"); + + HttpConfiguration httpConfig = container.newHttpConfiguration(0); + assertNotNull(httpConfig); + + assertEquals(httpConfig.getOutputBufferSize(), 64); + assertTrue(httpConfig.getSendDateHeader()); + assertFalse(httpConfig.getSendServerVersion()); + assertEquals(httpConfig.getRequestHeaderSize(), 128); + assertEquals(httpConfig.getResponseHeaderSize(), 256); + assertEquals(httpConfig.getSecurePort(), 0); + + // it defaults to https even if we have no value specified + assertEquals(httpConfig.getSecureScheme(), "https"); + } + + @Test + public void testHttpConnectorsBoth() { + + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_IDLE_TIMEOUT, "10001"); + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.createServer(100); + + HttpConfiguration httpConfig = container.newHttpConfiguration(8082); + container.addHTTPConnectors(httpConfig, 8081, 8082); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 2); + + assertEquals(connectors[0].getIdleTimeout(), 10001); + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + + System.out.println("Connectors: " + connectors[1].getProtocols().toString()); + assertTrue(connectors[1].getProtocols().contains("http/1.1")); + assertTrue(connectors[1].getProtocols().contains("ssl")); + } + + @Test + public void testHttpConnectorsHttpsOnly() { + + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_IDLE_TIMEOUT, "10001"); + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.createServer(100); + + HttpConfiguration httpConfig = container.newHttpConfiguration(8082); + container.addHTTPConnectors(httpConfig, 0, 8082); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertTrue(connectors[0].getProtocols().contains("ssl")); + } + + @Test + public void testHttpConnectorsHttpOnly() { + + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_IDLE_TIMEOUT, "10001"); + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.resource(com.yahoo.athenz.zts.ZTSResources.class); + container.delegate(com.yahoo.athenz.zts.ZTSHandler.class, mockImpl); + container.createServer(100); + + HttpConfiguration httpConfig = container.newHttpConfiguration(0); + container.addHTTPConnectors(httpConfig, 8081, 0); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + assertEquals(connectors[0].getIdleTimeout(), 10001); + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertFalse(connectors[0].getProtocols().contains("ssl")); + } + + @Test + public void testFilter() { + + ZTSJettyContainer container = new ZTSJettyContainer(AuditLogFactory.getLogger(), null); + container.createServer(100); + container.resource(com.yahoo.athenz.zts.ZTSResources.class); + container.delegate(com.yahoo.athenz.zts.ZTSHandler.class, mockImpl); + container.addServletHandlers("/tmp", "localhost"); + + Handler[] handlers = container.getHandlers().getHandlers(); + ServletContextHandler srvHandler = null; + for (Handler handler : handlers) { + if (handler instanceof ServletContextHandler) { + srvHandler = (ServletContextHandler) handler; + break; + } + } + assertNotNull(srvHandler); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSTest.java new file mode 100644 index 00000000000..c89252bd555 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSTest.java @@ -0,0 +1,219 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zts; + +import static org.testng.Assert.*; + +import org.eclipse.jetty.server.Connector; +import org.eclipse.jetty.server.Server; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +public class ZTSTest { + + private static final String ZTS_CHANGE_LOG_STORE_CLASS = "com.yahoo.athenz.zts.store.file.MockZMSFileChangeLogStoreFactory"; + private static final String ZTS_SVC_CERT_STORE_CLASS = "com.yahoo.athenz.zts.cert.MockCertSignerFactory"; + + @BeforeClass + public void setUp() throws Exception { + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY_STORE_CLASS, "com.yahoo.athenz.zts.pkey.file.FilePrivateKeyStoreFactory"); + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/zts_private.pem"); + System.setProperty(ZTSConsts.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + System.setProperty("logback.configurationFile", "src/test/resources/logback.xml"); + } + + @BeforeMethod + public void prepare() { + } + + @AfterMethod + public void cleanup() { + System.clearProperty(ZTSConsts.ZTS_PROP_HOME); + System.clearProperty(ZTSConsts.ZTS_PROP_HOSTNAME); + System.clearProperty(ZTSConsts.ZTS_PROP_HTTP_PORT); + System.clearProperty(ZTSConsts.ZTS_PROP_HTTPS_PORT); + } + + @Test + public void testGetServerHostNamePropertySet() { + System.setProperty(ZTSConsts.ZTS_PROP_HOSTNAME, "MyTestHost"); + assertEquals(ZTS.getServerHostName(), "MyTestHost"); + } + + @Test + public void testGetServerHostNameNoProperty() { + assertNotNull(ZTS.getServerHostName()); + } + + @Test + public void initContainerValidPorts() { + System.setProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS, ZTS_CHANGE_LOG_STORE_CLASS); + System.setProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS, ZTS_SVC_CERT_STORE_CLASS); + + System.setProperty(ZTSConsts.ZTS_PROP_HOME, "/tmp/zts_server"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "4080"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTPS_PORT, "4443"); + + ZTSJettyContainer container = ZTS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 2); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + + System.out.println("Connectors: " + connectors[1].getProtocols().toString()); + assertTrue(connectors[1].getProtocols().contains("http/1.1")); + assertTrue(connectors[1].getProtocols().contains("ssl")); + + System.clearProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS); + System.clearProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS); + + } + + @Test + public void initContainerOnlyHTTPSPort() { + System.setProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS, ZTS_CHANGE_LOG_STORE_CLASS); + System.setProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS, ZTS_SVC_CERT_STORE_CLASS); + + System.setProperty(ZTSConsts.ZTS_PROP_HOME, "/tmp/zts_server"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "0"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTPS_PORT, "4443"); + + ZTSJettyContainer container = ZTS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertTrue(connectors[0].getProtocols().contains("ssl")); + + System.clearProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS); + System.clearProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS); + } + + @Test + public void initContainerOnlyHTTPPort() { + System.setProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS, ZTS_CHANGE_LOG_STORE_CLASS); + System.setProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS, ZTS_SVC_CERT_STORE_CLASS); + + System.setProperty(ZTSConsts.ZTS_PROP_HOME, "/tmp/zts_server"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "4080"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTPS_PORT, "0"); + + ZTSJettyContainer container = ZTS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertFalse(connectors[0].getProtocols().contains("ssl")); + + System.clearProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS); + System.clearProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS); + } + + @Test + public void initContainerInvalidHTTPPort() { + System.setProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS, ZTS_CHANGE_LOG_STORE_CLASS); + System.setProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS, ZTS_SVC_CERT_STORE_CLASS); + + System.setProperty(ZTSConsts.ZTS_PROP_HOME, "/tmp/zts_server"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "-10"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTPS_PORT, "4443"); + + ZTSJettyContainer container = ZTS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 2); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + + System.out.println("Connectors: " + connectors[1].getProtocols().toString()); + assertTrue(connectors[1].getProtocols().contains("http/1.1")); + assertTrue(connectors[1].getProtocols().contains("ssl")); + + System.clearProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS); + System.clearProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS); + } + + @Test + public void initContainerInvalidHTTPSPort() { + System.setProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS, ZTS_CHANGE_LOG_STORE_CLASS); + System.setProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS, ZTS_SVC_CERT_STORE_CLASS); + + System.setProperty(ZTSConsts.ZTS_PROP_HOME, "/tmp/zts_server"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "4080"); + System.setProperty(ZTSConsts.ZTS_PROP_HTTPS_PORT, "-10"); + + ZTSJettyContainer container = ZTS.createJettyContainer(); + assertNotNull(container); + + Server server = container.getServer(); + Connector[] connectors = server.getConnectors(); + assertEquals(connectors.length, 1); + + System.out.println("Connectors: " + connectors[0].getProtocols().toString()); + assertTrue(connectors[0].getProtocols().contains("http/1.1")); + assertFalse(connectors[0].getProtocols().contains("ssl")); + + System.clearProperty(ZTSConsts.ZTS_PROP_DATA_CHANGE_LOG_STORE_CLASS); + System.clearProperty(ZTSConsts.ZTS_PROP_CERT_SIGNER_CLASS); + } + + @Test + public void testGetPortNumberDefault() { + assertEquals(ZTS.getPortNumber("NotExistantProperty", 4080), 4080); + } + + @Test + public void testGetPortNumberValid() { + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "4085"); + assertEquals(ZTS.getPortNumber(ZTSConsts.ZTS_PROP_HTTP_PORT, 4080), 4085); + } + + @Test + public void testGetPortNumberInvalidFormat() { + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "abc"); + assertEquals(ZTS.getPortNumber(ZTSConsts.ZTS_PROP_HTTP_PORT, 4080), 4080); + } + + @Test + public void testGetPortNumberOutOfRangeNegative() { + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "-1"); + assertEquals(ZTS.getPortNumber(ZTSConsts.ZTS_PROP_HTTP_PORT, 4080), 4080); + } + + @Test + public void testGetPortNumberOutOfRangePositive() { + System.setProperty(ZTSConsts.ZTS_PROP_HTTP_PORT, "65536"); + assertEquals(ZTS.getPortNumber(ZTSConsts.ZTS_PROP_HTTP_PORT, 4080), 4080); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/cache/DataCacheTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/cache/DataCacheTest.java new file mode 100644 index 00000000000..48f9fe7b8de --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/cache/DataCacheTest.java @@ -0,0 +1,862 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cache; + +import static org.testng.Assert.*; + +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Set; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.zms.Assertion; +import com.yahoo.athenz.zms.AssertionEffect; +import com.yahoo.athenz.zms.Domain; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.Policy; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zts.cache.DataCache; + +public class DataCacheTest { + + static final String ZTS_Y64_CERT0 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FDMXRHU1ZDQTh3bDVldzVZNzZXajJySkFVRApZYW5FSmZLbUFseDVjUS84a" + + "EtFVWZTU2dwWHIzQ3pkaDFhMjZkbGI3bW1LMjlxbVhKWGg2dW1XOUF5ZlRPS1ZvCis2QVNsb1ZVM2F2dnVmbE" + + "dVT0VnMmpzbWRha1IyNEtjTGpBdTZRclVlNDE3bEczdDhxU1BJR2pTNUMrQ3NKVXcKaDA0aEh4NWYrUEV3eFY" + + "0cmJRSURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT0 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1tGSVCA8wl5ew5Y76Wj2rJAUD\n" + + "YanEJfKmAlx5cQ/8hKEUfSSgpXr3Czdh1a26dlb7mmK29qmXJXh6umW9AyfTOKVo\n" + + "+6ASloVU3avvuflGUOEg2jsmdakR24KcLjAu6QrUe417lG3t8qSPIGjS5C+CsJUw\n" + + "h04hHx5f+PEwxV4rbQIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + static final String ZTS_Y64_CERT1 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FETUhWaFRNZldJQWdvTEdhbkx2QkNNRytRdAoySU9pcml2cGRLSFNPSkpsYX" + + "VKRUNlWlY1MTVmWG91SjhRb09IczA4UGlsdXdjeHF5dmhJSlduNWFrVEhGSWh5CkdDNkdtUTUzbG9WSEtTVE1WO" + + "DM1M0FjNkhydzYxbmJZMVQ2TnA2bjdxdXI4a1UwR2tmdk5hWFZrK09LNVBaankKbkxzZ251UjlCeFZndlM4ZjJR" + + "SURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT1 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMHVhTMfWIAgoLGanLvBCMG+Qt\n" + + "2IOirivpdKHSOJJlauJECeZV515fXouJ8QoOHs08PiluwcxqyvhIJWn5akTHFIhy\n" + + "GC6GmQ53loVHKSTMV8353Ac6Hrw61nbY1T6Np6n7qur8kU0GkfvNaXVk+OK5PZjy\n" + + "nLsgnuR9BxVgvS8f2QIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + static final String ZTS_Y64_CERT2 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FEbmZsZVZ4d293aitRWStjQi8rbWs5YXZYZgpHUWVpTTdOMlMwby9LV3FWK2h" + + "GVWtDZkExMWxEYVJoZUY0alFhSzVaM2pPUE9nbklOZE5hd3VXQ081NUxKdVJRCmI1R0ZSbzhPNjNJNzA3M3ZDZ0V" + + "KdmNST09SdjJDYWhQbnBKbjc3bkhQdlV2Szl0M3JyRURhdi8vanA0UDN5REMKNEVNdHBScmduUXBXNmpJSWlRSUR" + + "BUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT2 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDnfleVxwowj+QY+cB/+mk9avXf\n" + + "GQeiM7N2S0o/KWqV+hFUkCfA11lDaRheF4jQaK5Z3jOPOgnINdNawuWCO55LJuRQ\n" + + "b5GFRo8O63I7073vCgEJvcROORv2CahPnpJn77nHPvUvK9t3rrEDav//jp4P3yDC\n" + + "4EMtpRrgnQpW6jIIiQIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + static final String ZTS_Y64_CERT3 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FETWRqSmUwY01wSGR4ZEJKTDcvR2poNTNVUAp5WTdVQ2VlYnZUa2M2S1ZmR0" + + "RnVVlrMUhtaWJ5U21lbnZOYitkNkhXQ1YySGVicUptN1krL2VuaFNkcTR3QTJrCnFtdmFHY09rV1R2cUU2a2J1" + + "MG5LemdUK21jck1sOVpqTHdBQXZPS1hTRi82MTJxQ0tlSElRd3ZtWlB1RkJJTjEKUnFteWgwT0k1aHN5VS9nYj" + + "Z3SURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT3 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMdjJe0cMpHdxdBJL7/Gjh53UP\n" + + "yY7UCeebvTkc6KVfGDgUYk1HmibySmenvNb+d6HWCV2HebqJm7Y+/enhSdq4wA2k\n" + + "qmvaGcOkWTvqE6kbu0nKzgT+mcrMl9ZjLwAAvOKXSF/612qCKeHIQwvmZPuFBIN1\n" + + "Rqmyh0OI5hsyU/gb6wIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + + @Test + public void testDomainSetGet() { + + DomainData domain = new DomainData(); + domain.setName("testDomain"); + + DataCache cache = new DataCache(); + cache.setDomainData(domain); + + DomainData dom = cache.getDomainData(); + assertNotNull(dom); + assertEquals(dom.getName(), "testDomain"); + } + + @Test + public void testRoleNoMembers() { + + Role role = new Role(); + role.setName("dom.role1"); + + DataCache cache = new DataCache(); + cache.processRole(role); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNull(set1); + } + + @Test + public void testSimpleRole() { + + Role role = new Role(); + role.setName("dom.role1"); + + List members = new ArrayList(); + members.add("user_domain.user1"); + members.add("user_domain.user2"); + role.setMembers(members); + + DataCache cache = new DataCache(); + cache.processRole(role); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("dom.role1")); + assertEquals(set1.size(), 1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("dom.role1")); + assertEquals(set2.size(), 1); + + Set set3 = cache.getMemberRoleSet("user_domain.user3"); + assertNull(set3); + + Map> map = cache.getTrustMap(); + assertNotNull(map); + assertEquals(map.size(), 0); + } + + @Test + public void testSimpleRoleDuplicateMember() { + + Role role = new Role(); + role.setName("dom.role1"); + + List members = new ArrayList(); + members.add("user_domain.user1"); + members.add("user_domain.user2"); + members.add("user_domain.user1"); + members.add("user_domain.user1"); + role.setMembers(members); + + DataCache cache = new DataCache(); + cache.processRole(role); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("dom.role1")); + assertEquals(set1.size(), 1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("dom.role1")); + assertEquals(set2.size(), 1); + + Set set3 = cache.getMemberRoleSet("user_domain.user3"); + assertNull(set3); + + Map> map = cache.getTrustMap(); + assertNotNull(map); + assertEquals(map.size(), 0); + } + + @Test + public void testMultipleRoles() { + + Role role1 = new Role(); + role1.setName("dom.role1"); + + List members1 = new ArrayList(); + members1.add("user_domain.user1"); + members1.add("user_domain.user2"); + role1.setMembers(members1); + + Role role2 = new Role(); + role2.setName("dom.role2"); + + List members2 = new ArrayList(); + members2.add("user_domain.user2"); + members2.add("user_domain.user3"); + role2.setMembers(members2); + + DataCache cache = new DataCache(); + + cache.processRole(role1); + cache.processRole(role2); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("dom.role1")); + assertEquals(set1.size(), 1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("dom.role1")); + assertTrue(set2.contains("dom.role2")); + assertEquals(set2.size(), 2); + + Set set3 = cache.getMemberRoleSet("user_domain.user3"); + assertNotNull(set3); + assertTrue(set3.contains("dom.role2")); + assertEquals(set3.size(), 1); + + Set set4 = cache.getMemberRoleSet("user_domain.user4"); + assertNull(set4); + } + + @Test + public void testProcessRoleMembers() { + + List members1 = new ArrayList(); + members1.add("user_domain.user1"); + members1.add("user_domain.user2"); + + DataCache cache = new DataCache(); + cache.processRoleMembers("dom.role1", members1); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("dom.role1")); + assertEquals(set1.size(), 1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("dom.role1")); + assertEquals(set2.size(), 1); + } + + @Test + public void testRoleWithTrust() { + + Role role1 = new Role(); + role1.setName("dom.role1"); + role1.setTrust("dom2"); + + DataCache cache = new DataCache(); + cache.processRole(role1); + + Map> map = cache.getTrustMap(); + assertNotNull(map); + assertEquals(map.size(), 1); + assertTrue(map.containsKey("dom2")); + assertEquals(map.get("dom2").size(), 1); + assertTrue(map.get("dom2").contains("dom.role1")); + } + + @Test + public void testProcessRoleTrustDomain() { + + DataCache cache = new DataCache(); + cache.processRoleTrustDomain("dom.role1", "trustD"); + + Map> map = cache.getTrustMap(); + assertNotNull(map); + assertEquals(map.size(), 1); + assertTrue(map.containsKey("trustD")); + assertEquals(map.get("trustD").size(), 1); + assertTrue(map.get("trustD").contains("dom.role1")); + } + + @Test + public void testRolesWithTrust() { + + Role role1 = new Role(); + role1.setName("dom.role1"); + role1.setTrust("dom2"); + + Role role2 = new Role(); + role2.setName("dom.role2"); + role2.setTrust("dom3"); + + Role role3 = new Role(); + role3.setName("dom.role3"); + role3.setTrust("dom3"); + + DataCache cache = new DataCache(); + cache.processRole(role1); + cache.processRole(role2); + cache.processRole(role3); + + Map> map = cache.getTrustMap(); + assertNotNull(map); + assertEquals(map.size(), 2); + + assertTrue(map.containsKey("dom2")); + assertEquals(map.get("dom2").size(), 1); + assertTrue(map.get("dom2").contains("dom.role1")); + + assertTrue(map.containsKey("dom3")); + assertEquals(map.get("dom3").size(), 2); + assertTrue(map.get("dom3").contains("dom.role2")); + assertTrue(map.get("dom3").contains("dom.role3")); + } + + @Test + public void testPolicyWithAssertions() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + Role role1 = new Role(); + role1.setName("testDomain.role.role1"); + + List members1 = new ArrayList(); + members1.add("user_domain.user1"); + members1.add("user_domain.user2"); + role1.setMembers(members1); + + Role role2 = new Role(); + role2.setName("testDomain.role.role2"); + + List members2 = new ArrayList(); + members2.add("user_domain.user2"); + role2.setMembers(members2); + + Role role3 = new Role(); + role3.setName("testDomain.role.role3"); + + List members3 = new ArrayList(); + members3.add("user_domain.user3"); + role3.setMembers(members3); + + Policy policy = new Policy(); + policy.setName("testDomain.policy.policy1"); + + Assertion assertion1 = new Assertion(); + assertion1.setAction("assume_role"); + assertion1.setEffect(AssertionEffect.ALLOW); + assertion1.setResource("testDomain.roleA"); + assertion1.setRole("testDomain.role.role1"); + + Assertion assertion2 = new Assertion(); + assertion2.setAction("read"); + assertion2.setEffect(AssertionEffect.ALLOW); + assertion2.setResource("testDomain.data:*"); + assertion2.setRole("testDomain.role.role1"); + + List assertList = new ArrayList(); + assertList.add(assertion1); + assertList.add(assertion2); + + policy.setAssertions(assertList); + + DataCache cache = new DataCache(); + cache.processRole(role1); + cache.processRole(role2); + cache.processRole(role3); + HashMap roleList = new HashMap<>(); + roleList.put(role1.getName(), role1); + roleList.put(role2.getName(), role2); + roleList.put(role3.getName(), role3); + cache.processPolicy(domain.getName(), policy, roleList); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("testDomain.role.role1")); + assertTrue(set1.contains("testDomain.roleA")); + assertEquals(set1.size(), 2); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("testDomain.role.role1")); + assertTrue(set2.contains("testDomain.role.role2")); + assertTrue(set2.contains("testDomain.roleA")); + assertEquals(set2.size(), 3); + + Set set3 = cache.getMemberRoleSet("user_domain.user3"); + assertNotNull(set3); + assertTrue(set3.contains("testDomain.role.role3")); + assertEquals(set3.size(), 1); + } + + @Test + public void testPolicyNoRoleProcessed() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + Role role1 = new Role(); + role1.setName("testDomain.role.role1"); + + List members1 = new ArrayList(); + members1.add("user_domain.user1"); + role1.setMembers(members1); + + Policy policy = new Policy(); + policy.setName("testDomain.policy.policy1"); + + Assertion assertion1 = new Assertion(); + assertion1.setAction("assume_role"); + assertion1.setEffect(AssertionEffect.ALLOW); + assertion1.setResource("testDomain.roleA"); + assertion1.setRole("testDomain.role.role1"); + + List assertList = new ArrayList(); + assertList.add(assertion1); + + policy.setAssertions(assertList); + + DataCache cache = new DataCache(); + HashMap roleList = new HashMap<>(); + roleList.put(role1.getName(), role1); + cache.processPolicy(domain.getName(), policy, roleList); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("testDomain.roleA")); + assertEquals(set1.size(), 1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNull(set2); + } + + @Test + public void testPolicyWithNoAssertions() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + Role role1 = new Role(); + role1.setName("testDomain.role.role1"); + + List members1 = new ArrayList(); + members1.add("user_domain.user1"); + members1.add("user_domain.user2"); + role1.setMembers(members1); + + Role role2 = new Role(); + role2.setName("testDomain.role.role2"); + + List members2 = new ArrayList(); + members2.add("user_domain.user2"); + role2.setMembers(members2); + + Role role3 = new Role(); + role3.setName("testDomain.role.role3"); + + List members3 = new ArrayList(); + members3.add("user_domain.user3"); + role3.setMembers(members3); + + Policy policy = new Policy(); + policy.setName("testDomain.policy.policy1"); + + HashMap roleList = new HashMap<>(); + roleList.put(role1.getName(), role1); + roleList.put(role2.getName(), role2); + roleList.put(role3.getName(), role3); + + DataCache cache = new DataCache(); + cache.processRole(role1); + cache.processRole(role2); + cache.processRole(role3); + cache.processPolicy(domain.getName(), policy, roleList); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("testDomain.role.role1")); + assertEquals(set1.size(), 1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("testDomain.role.role1")); + assertTrue(set2.contains("testDomain.role.role2")); + assertEquals(set2.size(), 2); + + Set set3 = cache.getMemberRoleSet("user_domain.user3"); + assertNotNull(set3); + assertTrue(set3.contains("testDomain.role.role3")); + assertEquals(set3.size(), 1); + } + + @Test + public void testPolicyWithInvalidAssertionRole() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + Role role1 = new Role(); + role1.setName("testDomain.role.role1"); + + List members1 = new ArrayList(); + members1.add("user_domain.user1"); + members1.add("user_domain.user2"); + role1.setMembers(members1); + + Role role2 = new Role(); + role2.setName("testDomain.role.role2"); + + List members2 = new ArrayList(); + members2.add("user_domain.user2"); + role2.setMembers(members2); + + Role role3 = new Role(); + role3.setName("testDomain.role.role3"); + + List members3 = new ArrayList(); + members3.add("user_domain.user3"); + role3.setMembers(members3); + + Policy policy = new Policy(); + policy.setName("testDomain.policy.policy1"); + + Assertion assertion = new Assertion(); + assertion.setAction("assume_role"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("testDomain.role"); + assertion.setRole("testDomain.role.Invalid"); + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + + HashMap roleList = new HashMap<>(); + roleList.put(role1.getName(), role1); + roleList.put(role2.getName(), role2); + roleList.put(role3.getName(), role3); + + DataCache cache = new DataCache(); + cache.processRole(role1); + cache.processRole(role2); + cache.processRole(role3); + cache.processPolicy(domain.getName(), policy, roleList); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNotNull(set1); + assertTrue(set1.contains("testDomain.role.role1")); + assertEquals(set1.size(), 1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("testDomain.role.role1")); + assertTrue(set2.contains("testDomain.role.role2")); + assertEquals(set2.size(), 2); + + Set set3 = cache.getMemberRoleSet("user_domain.user3"); + assertNotNull(set3); + assertTrue(set3.contains("testDomain.role.role3")); + assertEquals(set3.size(), 1); + } + + @Test + public void testPolicyWithInvalidDomainNoRoles() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + Policy policy = new Policy(); + policy.setName("testDomain.policy.policy1"); + + Assertion assertion = new Assertion(); + assertion.setAction("assume_role"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("testDomain.role"); + assertion.setRole("testDomain.role.role1"); + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + + HashMap roleList = new HashMap<>(); + + DataCache cache = new DataCache(); + cache.processPolicy(domain.getName(), policy, roleList); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNull(set1); + } + + @Test + public void testPolicyWithAssertionRoleNoMember() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + Role role1 = new Role(); + role1.setName("testDomain.role.role1"); + + Role role2 = new Role(); + role2.setName("testDomain.role.role2"); + + List members2 = new ArrayList(); + members2.add("user_domain.user2"); + role2.setMembers(members2); + + Role role3 = new Role(); + role3.setName("testDomain.role.role3"); + + List members3 = new ArrayList(); + members3.add("user_domain.user3"); + role3.setMembers(members3); + + Policy policy = new Policy(); + policy.setName("testDomain.policy.policy1"); + + Assertion assertion = new Assertion(); + assertion.setAction("assume_role"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("testDomain.roleA"); + assertion.setRole("testDomain.role.role1"); + + List assertList = new ArrayList(); + assertList.add(assertion); + + policy.setAssertions(assertList); + + HashMap roleList = new HashMap<>(); + roleList.put(role1.getName(), role1); + roleList.put(role2.getName(), role2); + roleList.put(role3.getName(), role3); + + DataCache cache = new DataCache(); + cache.processRole(role1); + cache.processRole(role2); + cache.processRole(role3); + cache.processPolicy(domain.getName(), policy, roleList); + + Set set1 = cache.getMemberRoleSet("user_domain.user1"); + assertNull(set1); + + Set set2 = cache.getMemberRoleSet("user_domain.user2"); + assertNotNull(set2); + assertTrue(set2.contains("testDomain.role.role2")); + assertEquals(set2.size(), 1); + + Set set3 = cache.getMemberRoleSet("user_domain.user3"); + assertNotNull(set3); + assertTrue(set3.contains("testDomain.role.role3")); + assertEquals(set3.size(), 1); + } + + @Test + public void testSingleHostSingleService() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("testDomain.storage"); + List hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + DataCache cache = new DataCache(); + cache.processServiceIdentity(service); + + Map> hostMap = cache.getHostMap(); + assertEquals(hostMap.size(), 1); + assertTrue(hostMap.containsKey("host1")); + + Set set = hostMap.get("host1"); + assertEquals(set.size(), 1); + assertTrue(set.contains("testDomain.storage")); + } + + @Test + public void testMultipleHostsSingleService() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("testDomain.storage"); + List hosts = new ArrayList<>(); + hosts.add("host1"); + hosts.add("host2"); + service.setHosts(hosts); + + DataCache cache = new DataCache(); + cache.processServiceIdentity(service); + + Map> hostMap = cache.getHostMap(); + assertEquals(hostMap.size(), 2); + assertTrue(hostMap.containsKey("host1")); + + Set set = hostMap.get("host1"); + assertEquals(set.size(), 1); + assertTrue(set.contains("testDomain.storage")); + + assertTrue(hostMap.containsKey("host2")); + + set = hostMap.get("host2"); + assertEquals(set.size(), 1); + assertTrue(set.contains("testDomain.storage")); + } + + @Test + public void testMultipleHostsSkipDuplicate() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("testDomain.storage"); + List hosts = new ArrayList<>(); + hosts.add("host1"); + hosts.add("host2"); + hosts.add("host1"); + service.setHosts(hosts); + + DataCache cache = new DataCache(); + cache.processServiceIdentity(service); + + Map> hostMap = cache.getHostMap(); + assertEquals(hostMap.size(), 2); + assertTrue(hostMap.containsKey("host1")); + + Set set = hostMap.get("host1"); + assertEquals(set.size(), 1); + assertTrue(set.contains("testDomain.storage")); + + assertTrue(hostMap.containsKey("host2")); + + set = hostMap.get("host2"); + assertEquals(set.size(), 1); + assertTrue(set.contains("testDomain.storage")); + } + + @Test + public void testSingleHostMultipleServices() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + ServiceIdentity service1 = new ServiceIdentity(); + service1.setName("testDomain.storage1"); + List hosts1 = new ArrayList<>(); + hosts1.add("host1"); + service1.setHosts(hosts1); + + ServiceIdentity service2 = new ServiceIdentity(); + service2.setName("testDomain.storage2"); + List hosts2 = new ArrayList<>(); + hosts2.add("host1"); + service2.setHosts(hosts2); + + DataCache cache = new DataCache(); + cache.processServiceIdentity(service1); + cache.processServiceIdentity(service2); + + Map> hostMap = cache.getHostMap(); + assertEquals(hostMap.size(), 1); + assertTrue(hostMap.containsKey("host1")); + + Set set = hostMap.get("host1"); + assertEquals(set.size(), 2); + assertTrue(set.contains("testDomain.storage1")); + assertTrue(set.contains("testDomain.storage2")); + } + + @Test + public void testMultipleHostsMultipleServices() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + ServiceIdentity service1 = new ServiceIdentity(); + service1.setName("testDomain.storage1"); + List hosts1 = new ArrayList<>(); + hosts1.add("host1"); + hosts1.add("host2"); + service1.setHosts(hosts1); + + ServiceIdentity service2 = new ServiceIdentity(); + service2.setName("testDomain.storage2"); + List hosts2 = new ArrayList<>(); + hosts2.add("host1"); + hosts2.add("host3"); + service2.setHosts(hosts2); + + DataCache cache = new DataCache(); + cache.processServiceIdentity(service1); + cache.processServiceIdentity(service2); + + Map> hostMap = cache.getHostMap(); + assertEquals(hostMap.size(), 3); + assertTrue(hostMap.containsKey("host1")); + assertTrue(hostMap.containsKey("host2")); + assertTrue(hostMap.containsKey("host3")); + + Set set = hostMap.get("host1"); + assertEquals(set.size(), 2); + assertTrue(set.contains("testDomain.storage1")); + assertTrue(set.contains("testDomain.storage2")); + + set = hostMap.get("host2"); + assertEquals(set.size(), 1); + assertTrue(set.contains("testDomain.storage1")); + + set = hostMap.get("host3"); + assertEquals(set.size(), 1); + assertTrue(set.contains("testDomain.storage2")); + } + + @Test + public void testPublicKeysMultipleVersionFormat() { + + Domain domain = new Domain(); + domain.setName("testDomain"); + + ServiceIdentity service1 = new ServiceIdentity(); + service1.setName("testDomain.storage1"); + com.yahoo.athenz.zms.PublicKeyEntry keyEntry0 = new com.yahoo.athenz.zms.PublicKeyEntry(); + keyEntry0.setId("0"); + keyEntry0.setKey(ZTS_Y64_CERT0); + List listKeys1 = new ArrayList<>(); + listKeys1.add(keyEntry0); + service1.setPublicKeys(listKeys1); + + ServiceIdentity service2 = new ServiceIdentity(); + service2.setName("testDomain.storage2"); + + com.yahoo.athenz.zms.PublicKeyEntry keyEntry1 = new com.yahoo.athenz.zms.PublicKeyEntry(); + keyEntry1.setId("0"); + keyEntry1.setKey(ZTS_Y64_CERT1); + + com.yahoo.athenz.zms.PublicKeyEntry keyEntry3 = new com.yahoo.athenz.zms.PublicKeyEntry(); + keyEntry3.setId("3"); + keyEntry3.setKey(ZTS_Y64_CERT2); + + com.yahoo.athenz.zms.PublicKeyEntry keyEntry4 = new com.yahoo.athenz.zms.PublicKeyEntry(); + keyEntry4.setId("4"); + keyEntry4.setKey(ZTS_Y64_CERT3); + + List listKeys = new ArrayList<>(); + listKeys.add(keyEntry1); + listKeys.add(keyEntry3); + listKeys.add(keyEntry4); + + service2.setPublicKeys(listKeys); + + ServiceIdentity service3 = new ServiceIdentity(); + service3.setName("testDomain.storage3"); + + DataCache cache = new DataCache(); + cache.processServiceIdentity(service1); + cache.processServiceIdentity(service2); + cache.processServiceIdentity(service3); + + Map publicKeyMap = cache.getPublicKeyMap(); + assertEquals(publicKeyMap.size(), 4); + assertEquals(publicKeyMap.get("testDomain.storage1_0"), ZTS_PEM_CERT0); + assertEquals(publicKeyMap.get("testDomain.storage2_0"), ZTS_PEM_CERT1); + assertEquals(publicKeyMap.get("testDomain.storage2_3"), ZTS_PEM_CERT2); + assertEquals(publicKeyMap.get("testDomain.storage2_4"), ZTS_PEM_CERT3); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/MockCertSigner.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/MockCertSigner.java new file mode 100644 index 00000000000..87a17cb35ac --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/MockCertSigner.java @@ -0,0 +1,51 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +import java.security.PrivateKey; +import java.security.cert.X509Certificate; + +import org.bouncycastle.pkcs.PKCS10CertificationRequest; + +import com.yahoo.athenz.auth.util.Crypto; + +public class MockCertSigner implements CertSigner { + + X509Certificate caCertificate = null; + PrivateKey caPrivateKey = null; + int certValidityTime = 30 * 24 * 60; // in minutes, default = 30 days + + public MockCertSigner(PrivateKey caPrivateKey, X509Certificate caCertificate) { + this.caCertificate = caCertificate; + this.caPrivateKey = caPrivateKey; + } + + @Override + public String generateX509Certificate(String csr) { + PKCS10CertificationRequest certReq = Crypto.getPKCS10CertRequest(csr); + X509Certificate cert = Crypto.generateX509Certificate(certReq, caPrivateKey, caCertificate, certValidityTime, false); + return Crypto.x509CertificateToPem(cert); + } + + @Override + public String getCACertificate() { + return Crypto.x509CertificateToPem(caCertificate); + } + + @Override + public void close() { + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/MockCertSignerFactory.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/MockCertSignerFactory.java new file mode 100644 index 00000000000..674c5ce0d85 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/MockCertSignerFactory.java @@ -0,0 +1,38 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +import org.eclipse.jetty.client.HttpClient; + +import com.yahoo.athenz.auth.util.Crypto; + +import java.io.File; +import java.security.PrivateKey; +import java.security.cert.X509Certificate; + +public class MockCertSignerFactory implements CertSignerFactory { + + @Override + public CertSigner create(HttpClient httpClient) { + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + + return new MockCertSigner(caPrivateKey, caCertificate); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/X509CertSignObjectTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/X509CertSignObjectTest.java new file mode 100644 index 00000000000..56c699fa646 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/X509CertSignObjectTest.java @@ -0,0 +1,42 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert; + +import static org.testng.Assert.*; + +import org.testng.annotations.Test; + +import com.yahoo.rdl.JSON; + +public class X509CertSignObjectTest { + + @Test + public void testX509CertSignObject() { + + X509CertSignObject cert = new X509CertSignObject(); + assertNull(cert.getPem()); + + cert.setPem("pem-value"); + assertEquals(cert.getPem(), "pem-value"); + } + + @Test + public void testX509CertSignObjectStruct() { + + X509CertSignObject cert = JSON.fromString("{\"pem\":\"pem-value\"}", X509CertSignObject.class); + assertEquals(cert.getPem(), "pem-value"); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/impl/YCertSignerTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/impl/YCertSignerTest.java new file mode 100644 index 00000000000..6f1eeb0ca4d --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/cert/impl/YCertSignerTest.java @@ -0,0 +1,257 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.cert.impl; + +import static org.testng.Assert.*; + +import java.util.concurrent.TimeoutException; + +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.impl.YCertSigner; +import com.yahoo.athenz.zts.cert.impl.YCertSignerFactory; +import com.yahoo.athenz.zts.utils.ZTSUtils; + +import org.eclipse.jetty.client.HttpClient; +import org.eclipse.jetty.client.api.ContentResponse; +import org.eclipse.jetty.client.api.Request; +import org.mockito.Mockito; +import org.testng.annotations.Test; + +public class YCertSignerTest { + + @Test + public void testYCertSignerFactory() { + YCertSignerFactory certFactory = new YCertSignerFactory(); + assertNotNull(certFactory); + + HttpClient httpClient = new HttpClient(ZTSUtils.createSSLContextObject(new String[] {"TLSv1.2"})); + httpClient.setFollowRedirects(false); + + CertSigner certSigner = certFactory.create(httpClient); + assertNotNull(certSigner); + + certSigner.close(); + } + + @Test + public void testGenerateX509CertificateException() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + Request request = Mockito.mock(Request.class); + Mockito.when(httpClient.POST("https://localhost:443/certsign/v2/x509")).thenReturn(request); + Mockito.when(request.send()).thenThrow(new TimeoutException()); + + assertNull(certSigner.generateX509Certificate("csr")); + } + + @Test + public void testGenerateX509CertificateInvalidStatus() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + Request request = Mockito.mock(Request.class); + Mockito.when(httpClient.POST("https://localhost:443/certsign/v2/x509")).thenReturn(request); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(request.send()).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(400); + + assertNull(certSigner.generateX509Certificate("csr")); + } + + @Test + public void testGenerateX509CertificateResponseNull() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + Request request = Mockito.mock(Request.class); + Mockito.when(httpClient.POST("https://localhost:443/certsign/v2/x509")).thenReturn(request); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(request.send()).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(201); + Mockito.when(response.getContentAsString()).thenReturn(null); + + assertNull(certSigner.generateX509Certificate("csr")); + } + + @Test + public void testGenerateX509CertificateResponseEmpty() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + Request request = Mockito.mock(Request.class); + Mockito.when(httpClient.POST("https://localhost:443/certsign/v2/x509")).thenReturn(request); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(request.send()).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(201); + Mockito.when(response.getContentAsString()).thenReturn(""); + + assertNull(certSigner.generateX509Certificate("csr")); + } + + @Test + public void testGenerateX509Certificate() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + Request request = Mockito.mock(Request.class); + Mockito.when(httpClient.POST("https://localhost:443/certsign/v2/x509")).thenReturn(request); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(request.send()).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(201); + Mockito.when(response.getContentAsString()).thenReturn("{\"pem\": \"pem-value\"}"); + + String pem = certSigner.generateX509Certificate("csr"); + assertEquals(pem, "pem-value"); + } + + @Test + public void testGenerateX509CertificateInvalidData() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + Request request = Mockito.mock(Request.class); + Mockito.when(httpClient.POST("https://localhost:443/certsign/v2/x509")).thenReturn(request); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(request.send()).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(201); + Mockito.when(response.getContentAsString()).thenReturn("{\"pem2\": \"pem-value\"}"); + + assertNull(certSigner.generateX509Certificate("csr")); + + Mockito.when(response.getContentAsString()).thenReturn("invalid-json"); + assertNull(certSigner.generateX509Certificate("csr")); + } + + @Test + public void testGetCACertificateException() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + Mockito.when(httpClient.GET("https://localhost:443/certsign/v2/x509")).thenThrow(new TimeoutException()); + + assertNull(certSigner.getCACertificate()); + } + + @Test + public void testGetCACertificateInvalidStatus() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(httpClient.GET("https://localhost:443/certsign/v2/x509")).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(400); + + assertNull(certSigner.getCACertificate()); + } + + @Test + public void testGetCACertificateResponseNull() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(httpClient.GET("https://localhost:443/certsign/v2/x509")).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn(null); + + assertNull(certSigner.getCACertificate()); + } + + @Test + public void testGetCACertificateResponseEmpty() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(httpClient.GET("https://localhost:443/certsign/v2/x509")).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn(""); + + assertNull(certSigner.getCACertificate()); + } + + @Test + public void testGetCACertificate() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(httpClient.GET("https://localhost:443/certsign/v2/x509")).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn("{\"pem\": \"pem-value\"}"); + + String pem = certSigner.getCACertificate(); + assertEquals(pem, "pem-value"); + } + + @Test + public void testGetCACertificateInvalidData() throws Exception { + + HttpClient httpClient = Mockito.mock(HttpClient.class); + + YCertSignerFactory certFactory = new YCertSignerFactory(); + YCertSigner certSigner = (YCertSigner) certFactory.create(httpClient); + + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(httpClient.GET("https://localhost:443/certsign/v2/x509")).thenReturn(response); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn("{\"pem2\": \"pem-value\"}"); + + assertNull(certSigner.getCACertificate()); + + Mockito.when(response.getContentAsString()).thenReturn("invalid-json"); + assertNull(certSigner.getCACertificate()); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStoreTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStoreTest.java new file mode 100644 index 00000000000..9cbe863fb36 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/pkey/file/FilePrivateKeyStoreTest.java @@ -0,0 +1,145 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey.file; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.fail; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.zts.ResourceException; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.pkey.PrivateKeyStore; + +public class FilePrivateKeyStoreTest { + + @Test + public void testCreateStore() { + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + assertNotNull(store); + } + + @Test + public void testGetHostPrivateKeyExist() { + + // set default filepath property + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/zts_private.pem"); + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + StringBuilder sbuilder = new StringBuilder(); + + assertNotNull(store.getHostPrivateKey(sbuilder)); + } + + @Test + public void testGetHostPrivateKeyPkeyNotExist() { + // set default filepath property + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/unknown.pem"); + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + StringBuilder sbuilder = new StringBuilder(); + + try { + store.getHostPrivateKey(sbuilder); + } catch (RuntimeException ex) { + assertNotNull(ex.getMessage()); + } + + // fix property + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/zts_private.pem"); + + } + + @Test + public void testGetHostPrivateKeyInvalidFormat() { + // set default filepath property + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/test_public.v1"); + + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + StringBuilder sbuilder = new StringBuilder(); + + try { + store.getHostPrivateKey(sbuilder); + } catch (ResourceException ex) { + assertNotNull(ex.getCode()); + } + + // fix property + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/zts_private.pem"); + + } + + @Test + public void testGetPrivateKeyExist() { + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + assertNotNull(store.getPrivateKey("src/test/resources/test_private", 1)); + + } + + @Test + public void testGetPrivateKeyInvalidFormat() { + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + try { + store.getPrivateKey("src/test/resources/test_public", 1); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 500); + } + } + + @Test + public void testGetPublicKeyExist() { + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + assertNotNull(store.getPublicKey("src/test/resources/test_public", 1)); + } + + @Test + public void testGetPublicKeyInvalidFormat() { + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + // not validate pubkey format + assertNotNull(store.getPublicKey("src/test/resources/test_private", 1)); + } + + @Test + public void testGetPublicKeyNotExist() { + FilePrivateKeyStoreFactory factory = new FilePrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + + try { + store.getPublicKey("src/test/resources/test_public", 2); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 500); + } + } + +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStoreTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStoreTest.java new file mode 100644 index 00000000000..66b885919ca --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/pkey/hsm/HSMPrivateKeyStoreTest.java @@ -0,0 +1,46 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.pkey.hsm; + +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.assertNull; + +import java.security.PrivateKey; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.zts.pkey.PrivateKeyStore; +import com.yahoo.athenz.zts.pkey.hsm.HSMPrivateKeyStore; +import com.yahoo.athenz.zts.pkey.hsm.HSMPrivateKeyStoreFactory; + +public class HSMPrivateKeyStoreTest { + + @Test + public void testCreateStore() { + HSMPrivateKeyStoreFactory factory = new HSMPrivateKeyStoreFactory(); + PrivateKeyStore store = factory.create("localhost"); + assertNotNull(store); + } + + @Test + public void testGetPrivateKey() { + + HSMPrivateKeyStore store = new HSMPrivateKeyStore(); + StringBuilder privateKeyId = new StringBuilder(256); + PrivateKey pkey = store.getHostPrivateKey(privateKeyId); + assertNull(pkey); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/CloudStoreTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/CloudStoreTest.java new file mode 100644 index 00000000000..a8b6a7a6b4b --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/CloudStoreTest.java @@ -0,0 +1,928 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store; + +import static org.testng.Assert.*; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.security.cert.X509Certificate; +import java.util.Date; +import java.util.concurrent.ExecutionException; +import java.util.concurrent.TimeoutException; + +import org.eclipse.jetty.client.HttpClient; +import org.eclipse.jetty.client.api.ContentResponse; +import org.mockito.Mockito; +import org.testng.annotations.Test; + +import com.amazonaws.auth.BasicSessionCredentials; +import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient; +import com.amazonaws.services.securitytoken.model.AssumeRoleRequest; +import com.amazonaws.services.securitytoken.model.AssumeRoleResult; +import com.amazonaws.services.securitytoken.model.Credentials; +import com.amazonaws.services.securitytoken.model.GetCallerIdentityResult; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.zts.AWSInstanceInformation; +import com.yahoo.athenz.zts.AWSTemporaryCredentials; +import com.yahoo.athenz.zts.Identity; +import com.yahoo.athenz.zts.ResourceException; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.cert.MockCertSigner; +import com.yahoo.athenz.zts.store.CloudStore; + +public class CloudStoreTest { + + public final static String AWS_INSTANCE_DOCUMENT = "{\n" + + " \"devpayProductCodes\" : null,\n" + + " \"availabilityZone\" : \"us-west-2a\",\n" + + " \"privateIp\" : \"10.10.10.10\",\n" + + " \"version\" : \"2010-08-31\",\n" + + " \"instanceId\" : \"i-056921225f1fbb47a\",\n" + + " \"billingProducts\" : null,\n" + + " \"instanceType\" : \"t2.micro\",\n" + + " \"accountId\" : \"111111111111\",\n" + + " \"pendingTime\" : \"2016-04-26T05:37:23Z\",\n" + + " \"imageId\" : \"ami-c229c0a2\",\n" + + " \"architecture\" : \"x86_64\",\n" + + " \"kernelId\" : null,\n" + + " \"ramdiskId\" : null,\n" + + " \"region\" : \"us-west-2\"\n" + + "}"; + + public final static String AWS_IAM_ROLE_INFO = "{\n" + + "\"Code\" : \"Success\",\n" + + "\"LastUpdated\" : \"2016-04-26T05:37:04Z\",\n" + + "\"InstanceProfileArn\" : \"arn:aws:iam::111111111111:instance-profile/athenz.zts,athenz\",\n" + + "\"InstanceProfileId\" : \"AIPAJAVNLUGEWFWTIDPRA\"\n" + + "}"; + + @Test + public void testGetS3ClientNullCreds() { + CloudStore store = new CloudStore(null); + store.awsEnabled = true; + store.credentials = null; + try { + store.getS3Client(); + fail(); + } catch (ResourceException ex) { + assertEquals(500, ex.getCode()); + } + store.close(); + } + + @Test + public void testGetS3ClientAWSNotEnabled() { + CloudStore store = new CloudStore(null); + store.credentials = null; + try { + store.getS3Client(); + fail(); + } catch (ResourceException ex) { + assertEquals(500, ex.getCode()); + } + store.close(); + } + + @Test + public void testGetS3Client() { + + CloudStore store = new CloudStore(null); + store.credentials = new BasicSessionCredentials("accessKey", "secretKey", "token"); + store.awsEnabled = true; + assertNotNull(store.getS3Client()); + + store.awsRegion = "us-west-2"; + assertNotNull(store.getS3Client()); + store.close(); + } + + @Test + public void testGetTokenServiceClient() { + CloudStore store = new CloudStore(null); + store.credentials = new BasicSessionCredentials("accessKey", "secretKey", "token"); + store.awsEnabled = true; + assertNotNull(store.getTokenServiceClient()); + store.close(); + } + + @Test + public void testUpdateAccountUpdate() { + + CloudStore store = new CloudStore(null); + assertNull(store.getAWSAccount("iaas")); + + // set the account to 1234 + + store.updateAccount("iaas", "1234"); + assertEquals("1234", store.getAWSAccount("iaas")); + + // update the account value + + store.updateAccount("iaas", "1235"); + assertEquals("1235", store.getAWSAccount("iaas")); + store.close(); + } + + @Test + public void testUpdateAccountDelete() { + + CloudStore store = new CloudStore(null); + + // set the account to 1234 + + store.updateAccount("iaas", "1234"); + assertEquals("1234", store.getAWSAccount("iaas")); + + // delete the account with null + + store.updateAccount("iaas", null); + assertNull(store.getAWSAccount("iaas")); + + // update the account value + + store.updateAccount("iaas", "1235"); + assertEquals("1235", store.getAWSAccount("iaas")); + + // delete the account with empty string + + store.updateAccount("iaas", ""); + assertNull(store.getAWSAccount("iaas")); + store.close(); + } + + @Test + public void testGetAssumeRoleRequest() { + + CloudStore store = new CloudStore(null); + AssumeRoleRequest req = store.getAssumeRoleRequest("1234", "admin", "sys.auth.zts"); + assertEquals("arn:aws:iam::1234:role/admin", req.getRoleArn()); + assertEquals("sys.auth.zts", req.getRoleSessionName()); + store.close(); + } + + @Test + public void testParseInstanceInfo() { + CloudStore store = new CloudStore(null); + assertTrue(store.parseInstanceInfo(AWS_INSTANCE_DOCUMENT)); + assertEquals(store.awsAccount, "111111111111"); + assertEquals(store.awsRegion, "us-west-2"); + store.close(); + } + + @Test + public void testParseInstanceInfoInvalid() { + + CloudStore store = new CloudStore(null); + assertFalse(store.parseInstanceInfo("some_invalid_doc")); + store.close(); + } + + @Test + public void testParseInstanceInfoRegion() { + + // first this should fail since we have no region + // override and the document has no region + + CloudStore store = new CloudStore(null); + assertFalse(store.parseInstanceInfo("{\"accountId\":\"012345678901\"}")); + + // now we're going to use the same doc with override + + System.setProperty(CloudStore.ZTS_PROP_AWS_REGION_NAME, "us-west-3"); + store.close(); + + store = new CloudStore(null); + assertTrue(store.parseInstanceInfo("{\"accountId\":\"012345678901\"}")); + assertEquals(store.awsAccount, "012345678901"); + assertEquals(store.awsRegion, "us-west-3"); + System.clearProperty(CloudStore.ZTS_PROP_AWS_REGION_NAME); + store.close(); + } + + @Test + public void testParseIamRoleInfoInvalid() { + + CloudStore store = new CloudStore(null); + assertFalse(store.parseIamRoleInfo("some_invalid_doc")); + store.close(); + } + + @Test + public void testParseIamRoleInfoMissingInstanceProfile() { + + CloudStore store = new CloudStore(null); + assertFalse(store.parseIamRoleInfo("{\"accountId\":\"012345678901\"}")); + assertFalse(store.parseIamRoleInfo("{\"accountId\":\"012345678901\",\"InstanceProfileArn\":\"\"}")); + store.close(); + } + + @Test + public void testParseIamRoleInfoInvalidInstanceProfile() { + + CloudStore store = new CloudStore(null); + assertFalse(store.parseIamRoleInfo("{\"accountId\":\"012345678901\"}")); + assertFalse(store.parseIamRoleInfo("{\"accountId\":\"012345678901\",\"InstanceProfileArn\":\"invalid\"}")); + store.close(); + } + + @Test + public void testParseIamRoleInfo() { + CloudStore store = new CloudStore(null); + assertTrue(store.parseIamRoleInfo(AWS_IAM_ROLE_INFO)); + assertEquals(store.awsAccount, "111111111111"); + assertEquals(store.awsCloud, "athenz"); + assertEquals(store.awsDomain, "athenz"); + assertEquals(store.awsRole, "athenz.zts"); + assertEquals(store.awsService, "zts"); + assertEquals(store.awsProfile, "athenz.zts,athenz"); + store.close(); + } + + @Test + public void testParseInstanceProfileArn() { + + CloudStore store = new CloudStore(null); + assertTrue(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile/athenz.zts,athenz")); + assertEquals(store.awsAccount, "111111111111"); + assertEquals(store.awsCloud, "athenz"); + assertEquals(store.awsDomain, "athenz"); + assertEquals(store.awsRole, "athenz.zts"); + assertEquals(store.awsService, "zts"); + assertEquals(store.awsProfile, "athenz.zts,athenz"); + store.close(); + } + + @Test + public void testParseInstanceProfileArnInvalidPrefix() { + + CloudStore store = new CloudStore(null); + + // invalid starting prefix + + assertFalse(store.parseInstanceProfileArn("arn:aws:iam:111111111111:instance-profile/athenz.zts,athenz")); + assertFalse(store.parseInstanceProfileArn("arn:aws:iam2:111111111111:instance-profile/athenz.zts,athenz")); + assertFalse(store.parseInstanceProfileArn("instance-profile/athenz.zts,athenz")); + store.close(); + } + + @Test + public void testParseInstanceProfileArnInvalidProfile() { + + CloudStore store = new CloudStore(null); + + // missing instance-profile part + + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile2/athenz.zts,athenz")); + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance/athenz.zts,athenz")); + store.close(); + } + + @Test + public void testParseInstanceProfileArnInvalidNoProfile() { + + CloudStore store = new CloudStore(null); + + // no profile name + + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile/")); + store.close(); + } + + @Test + public void testParseInstanceProfileArnInvalidAccount() { + + CloudStore store = new CloudStore(null); + + // missing account id + + assertFalse(store.parseInstanceProfileArn("arn:aws:iam:::instance-profile/athenz.zts,athenz")); + store.close(); + } + + @Test + public void testParseInstanceProfileArnInvalidCloud() { + + CloudStore store = new CloudStore(null); + + // missing/invalid cloud name + + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile/athenz.zts")); + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile/athenz.zts,athenz,test")); + store.close(); + } + + @Test + public void testParseInstanceProfileArnInvalidDomain() { + + CloudStore store = new CloudStore(null); + + // invalid domain/service names + + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile/iaas,athenz")); + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile/iaas.,athenz")); + assertFalse(store.parseInstanceProfileArn("arn:aws:iam::111111111111:instance-profile/.iaas,athenz")); + store.close(); + } + + @SuppressWarnings("unchecked") + @Test + public void testGetMetaDataExceptions() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/exc1")).thenThrow(InterruptedException.class); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/exc2")).thenThrow(ExecutionException.class); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/exc3")).thenThrow(TimeoutException.class); + + assertNull(store.getMetaData("/exc1")); + assertNull(store.getMetaData("/exc2")); + assertNull(store.getMetaData("/exc3")); + store.close(); + } + + @Test + public void testGetMetaDataFailureStatus() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(404); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/iam-info")).thenReturn(response); + + assertNull(store.getMetaData("/iam-info")); + store.close(); + } + + @Test + public void testGetMetaDataNullResponse() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn(null); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/iam-info")).thenReturn(response); + + assertNull(store.getMetaData("/iam-info")); + store.close(); + } + + @Test + public void testGetMetaDataEmptyResponse() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn(""); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/iam-info")).thenReturn(response); + + assertNull(store.getMetaData("/iam-info")); + store.close(); + } + + @Test + public void testGetMetaDataValidResponse() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn("json-document"); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/iam-info")).thenReturn(response); + + assertEquals(store.getMetaData("/iam-info"), "json-document"); + store.close(); + } + + @Test + public void testLoadBootMetaDataInvalidDocumentGet() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(404); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(response); + + assertFalse(store.loadBootMetaData()); + store.close(); + } + + @Test + public void testLoadBootMetaDataInvalidDocumentParse() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn("{\"accountId\":\"012345678901\"}"); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(response); + + assertFalse(store.loadBootMetaData()); + store.close(); + } + + @Test + public void testLoadBootMetaDataInvalidDocumentException() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn("json-document"); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(response); + + assertFalse(store.loadBootMetaData()); + store.close(); + } + + @Test + public void testLoadBootMetaDataInvalidSignature() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse responseDoc = Mockito.mock(ContentResponse.class); + Mockito.when(responseDoc.getStatus()).thenReturn(200); + Mockito.when(responseDoc.getContentAsString()).thenReturn(AWS_INSTANCE_DOCUMENT); + + ContentResponse responseSig = Mockito.mock(ContentResponse.class); + Mockito.when(responseSig.getStatus()).thenReturn(404); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(responseDoc); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7")).thenReturn(responseSig); + + assertFalse(store.loadBootMetaData()); + store.close(); + } + + @Test + public void testLoadBootMetaDataInvalidIamInfoGet() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + + ContentResponse responseDoc = Mockito.mock(ContentResponse.class); + Mockito.when(responseDoc.getStatus()).thenReturn(200); + Mockito.when(responseDoc.getContentAsString()).thenReturn(AWS_INSTANCE_DOCUMENT); + + ContentResponse responseSig = Mockito.mock(ContentResponse.class); + Mockito.when(responseSig.getStatus()).thenReturn(200); + Mockito.when(responseSig.getContentAsString()).thenReturn("pkcs7-signature"); + + ContentResponse responseInfo = Mockito.mock(ContentResponse.class); + Mockito.when(responseInfo.getStatus()).thenReturn(404); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(responseDoc); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7")).thenReturn(responseSig); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/info")).thenReturn(responseInfo); + + assertFalse(store.loadBootMetaData()); + store.close(); + } + + @Test + public void testLoadBootMetaDataInvalidIamInfoException() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + + ContentResponse responseDoc = Mockito.mock(ContentResponse.class); + Mockito.when(responseDoc.getStatus()).thenReturn(200); + Mockito.when(responseDoc.getContentAsString()).thenReturn(AWS_INSTANCE_DOCUMENT); + + ContentResponse responseSig = Mockito.mock(ContentResponse.class); + Mockito.when(responseSig.getStatus()).thenReturn(200); + Mockito.when(responseSig.getContentAsString()).thenReturn("pkcs7-signature"); + + ContentResponse responseInfo = Mockito.mock(ContentResponse.class); + Mockito.when(responseInfo.getStatus()).thenReturn(200); + Mockito.when(responseInfo.getContentAsString()).thenReturn("invalid-info"); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(responseDoc); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7")).thenReturn(responseSig); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/info")).thenReturn(responseInfo); + + assertFalse(store.loadBootMetaData()); + store.close(); + } + + @Test + public void testLoadBootMetaDataInvalidIamInfoParse() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + + ContentResponse responseDoc = Mockito.mock(ContentResponse.class); + Mockito.when(responseDoc.getStatus()).thenReturn(200); + Mockito.when(responseDoc.getContentAsString()).thenReturn(AWS_INSTANCE_DOCUMENT); + + ContentResponse responseSig = Mockito.mock(ContentResponse.class); + Mockito.when(responseSig.getStatus()).thenReturn(200); + Mockito.when(responseSig.getContentAsString()).thenReturn("pkcs7-signature"); + + ContentResponse responseInfo = Mockito.mock(ContentResponse.class); + Mockito.when(responseInfo.getStatus()).thenReturn(200); + Mockito.when(responseInfo.getContentAsString()).thenReturn("{\"accountId\":\"012345678901\",\"InstanceProfileArn\":\"invalid\"}"); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(responseDoc); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7")).thenReturn(responseSig); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/info")).thenReturn(responseInfo); + + assertFalse(store.loadBootMetaData()); + store.close(); + } + + @Test + public void testLoadBootMetaData() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + + ContentResponse responseDoc = Mockito.mock(ContentResponse.class); + Mockito.when(responseDoc.getStatus()).thenReturn(200); + Mockito.when(responseDoc.getContentAsString()).thenReturn(AWS_INSTANCE_DOCUMENT); + + ContentResponse responseSig = Mockito.mock(ContentResponse.class); + Mockito.when(responseSig.getStatus()).thenReturn(200); + Mockito.when(responseSig.getContentAsString()).thenReturn("pkcs7-signature"); + + ContentResponse responseInfo = Mockito.mock(ContentResponse.class); + Mockito.when(responseInfo.getStatus()).thenReturn(200); + Mockito.when(responseInfo.getContentAsString()).thenReturn(AWS_IAM_ROLE_INFO); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(responseDoc); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7")).thenReturn(responseSig); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/info")).thenReturn(responseInfo); + + assertTrue(store.loadBootMetaData()); + assertEquals(store.awsAccount, "111111111111"); + assertEquals(store.awsCloud, "athenz"); + assertEquals(store.awsDomain, "athenz"); + assertEquals(store.awsRole, "athenz.zts"); + assertEquals(store.awsService, "zts"); + assertEquals(store.awsProfile, "athenz.zts,athenz"); + assertEquals(store.awsRegion, "us-west-2"); + store.close(); + } + + @Test + public void testFetchRoleCredentialsNoRole() { + + CloudStore store = new CloudStore(null); + + store.awsRole = null; + assertFalse(store.fetchRoleCredentials()); + + store.awsRole = ""; + assertFalse(store.fetchRoleCredentials()); + store.close(); + } + + @Test + public void testFetchRoleCredentialsNoCreds() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + store.awsRole = "athenz.zts"; + + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(404); + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/security-credentials/athenz.zts")).thenReturn(response); + + assertFalse(store.fetchRoleCredentials()); + store.close(); + } + + @Test + public void testFetchRoleCredentialInvalidCreds() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + store.awsRole = "athenz.zts"; + + HttpClient httpClient = Mockito.mock(HttpClient.class); + ContentResponse response = Mockito.mock(ContentResponse.class); + Mockito.when(response.getStatus()).thenReturn(200); + Mockito.when(response.getContentAsString()).thenReturn("invalid-creds"); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/security-credentials/athenz.zts")).thenReturn(response); + + assertFalse(store.fetchRoleCredentials()); + store.close(); + } + + @Test + public void testInitializeAwsSupportInvalidDocument() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + + ContentResponse responseDoc = Mockito.mock(ContentResponse.class); + Mockito.when(responseDoc.getStatus()).thenReturn(200); + Mockito.when(responseDoc.getContentAsString()).thenReturn("invalid-document"); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(responseDoc); + + try { + store.awsEnabled = true; + store.initializeAwsSupport(); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 500); + } + store.close(); + } + + @Test + public void testInitializeAwsSupportInvalidCreds() throws InterruptedException, ExecutionException, TimeoutException { + + CloudStore store = new CloudStore(null); + HttpClient httpClient = Mockito.mock(HttpClient.class); + + ContentResponse responseDoc = Mockito.mock(ContentResponse.class); + Mockito.when(responseDoc.getStatus()).thenReturn(200); + Mockito.when(responseDoc.getContentAsString()).thenReturn(AWS_INSTANCE_DOCUMENT); + + ContentResponse responseSig = Mockito.mock(ContentResponse.class); + Mockito.when(responseSig.getStatus()).thenReturn(200); + Mockito.when(responseSig.getContentAsString()).thenReturn("pkcs7-signature"); + + ContentResponse responseInfo = Mockito.mock(ContentResponse.class); + Mockito.when(responseInfo.getStatus()).thenReturn(200); + Mockito.when(responseInfo.getContentAsString()).thenReturn(AWS_IAM_ROLE_INFO); + + ContentResponse responseCreds = Mockito.mock(ContentResponse.class); + Mockito.when(responseCreds.getStatus()).thenReturn(200); + Mockito.when(responseCreds.getContentAsString()).thenReturn("invalid-creds"); + + store.setHttpClient(httpClient); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/document")).thenReturn(responseDoc); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7")).thenReturn(responseSig); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/info")).thenReturn(responseInfo); + Mockito.when(httpClient.GET("http://169.254.169.254/latest/meta-data/iam/security-credentials/athenz.zts")).thenReturn(responseCreds); + + try { + store.awsEnabled = true; + store.initializeAwsSupport(); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 500); + } + store.close(); + } + + @Test + public void testGenerateIdentity() throws IOException { + + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + CertSigner certSigner = new MockCertSigner(caPrivateKey, caCertificate); + + CloudStore cloudStore = new CloudStore(certSigner); + + Path path = Paths.get("src/test/resources/valid.csr"); + String certCsr = new String(Files.readAllBytes(path)); + + Identity identity = cloudStore.generateIdentity(certCsr, "athenz.syncer"); + assertNotNull(identity); + cloudStore.close(); + } + + @Test + public void testGenerateIdentityInvalidCsr() throws IOException { + + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + CertSigner certSigner = new MockCertSigner(caPrivateKey, caCertificate); + + CloudStore cloudStore = new CloudStore(certSigner); + + Identity identity = cloudStore.generateIdentity("invalid-csr", "athenz.syncer"); + assertNull(identity); + cloudStore.close(); + } + + @Test + public void testGenerateIdentityMismatchCN() throws IOException { + + File caCert = new File("src/test/resources/valid_cn_x509.cert"); + X509Certificate caCertificate = Crypto.loadX509Certificate(caCert); + + File caKey = new File("src/test/resources/private_encrypted.key"); + PrivateKey caPrivateKey = Crypto.loadPrivateKey(caKey, "athenz"); + CertSigner certSigner = new MockCertSigner(caPrivateKey, caCertificate); + + CloudStore cloudStore = new CloudStore(certSigner); + + Path path = Paths.get("src/test/resources/valid.csr"); + String certCsr = new String(Files.readAllBytes(path)); + + Identity identity = cloudStore.generateIdentity(certCsr, "athenz.backup"); + assertNull(identity); + + identity = cloudStore.generateIdentity(certCsr, "athenz"); + assertNull(identity); + cloudStore.close(); + } + + @Test + public void testGetInstanceClient() { + AWSInstanceInformation info = new AWSInstanceInformation(); + info.setAccess("access"); + info.setSecret("secret"); + info.setToken("token"); + + CloudStore cloudStore = new CloudStore(null); + AWSSecurityTokenServiceClient client = cloudStore.getInstanceClient(info); + assertNotNull(client); + cloudStore.close(); + } + + @Test + public void testGetInstanceClientInvalidAccess() { + AWSInstanceInformation info = new AWSInstanceInformation(); + info.setAccess(""); + info.setSecret("secret"); + info.setToken("token"); + + CloudStore cloudStore = new CloudStore(null); + assertNull(cloudStore.getInstanceClient(info)); + + info = new AWSInstanceInformation(); + info.setSecret("secret"); + info.setToken("token"); + + assertNull(cloudStore.getInstanceClient(info)); + cloudStore.close(); + } + + @Test + public void testGetInstanceClientInvalidSecret() { + AWSInstanceInformation info = new AWSInstanceInformation(); + info.setAccess("access"); + info.setSecret(""); + info.setToken("token"); + + CloudStore cloudStore = new CloudStore(null); + assertNull(cloudStore.getInstanceClient(info)); + + info = new AWSInstanceInformation(); + info.setAccess("access"); + info.setToken("token"); + + assertNull(cloudStore.getInstanceClient(info)); + cloudStore.close(); + } + + @Test + public void testGetInstanceClientInvalidToken() { + AWSInstanceInformation info = new AWSInstanceInformation(); + info.setAccess("access"); + info.setSecret("secret"); + info.setToken(""); + + CloudStore cloudStore = new CloudStore(null); + assertNull(cloudStore.getInstanceClient(info)); + + info = new AWSInstanceInformation(); + info.setAccess("access"); + info.setSecret("secret"); + + assertNull(cloudStore.getInstanceClient(info)); + cloudStore.close(); + } + + @Test + public void testVerifyInstanceIdentityNullResult() { + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.setAssumeRoleResult(null); + AWSInstanceInformation info = new AWSInstanceInformation() + .setDomain("athenz") + .setService("zts") + .setAccount("12345"); + assertFalse(cloudStore.verifyInstanceIdentity(info)); + } + + @Test + public void testVerifyInstanceIdentityNullClient() { + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.setGetCallerIdentityResult(null); + cloudStore.setReturnNullClient(true); + AWSInstanceInformation info = new AWSInstanceInformation() + .setDomain("athenz") + .setService("zts") + .setAccount("12345"); + assertFalse(cloudStore.verifyInstanceIdentity(info)); + } + + @Test + public void testVerifyInstanceIdentityNullCreds() { + MockCloudStore cloudStore = new MockCloudStore(); + GetCallerIdentityResult mockResult = Mockito.mock(GetCallerIdentityResult.class); + Mockito.when(mockResult.getArn()).thenReturn(null); + cloudStore.setGetCallerIdentityResult(mockResult); + AWSInstanceInformation info = new AWSInstanceInformation() + .setDomain("athenz") + .setService("zts") + .setAccount("12345"); + assertFalse(cloudStore.verifyInstanceIdentity(info)); + } + + @Test + public void testVerifyInstanceIdentityMismatchCreds() { + MockCloudStore cloudStore = new MockCloudStore(); + GetCallerIdentityResult mockResult = Mockito.mock(GetCallerIdentityResult.class); + Mockito.when(mockResult.getArn()).thenReturn("arn:aws:sts::12345:assumed-role/athenz.zts2/i-13434"); + cloudStore.setGetCallerIdentityResult(mockResult); + AWSInstanceInformation info = new AWSInstanceInformation() + .setDomain("athenz") + .setService("zts") + .setAccount("12345"); + assertFalse(cloudStore.verifyInstanceIdentity(info)); + } + + @Test + public void testVerifyInstanceIdentity() { + MockCloudStore cloudStore = new MockCloudStore(); + GetCallerIdentityResult mockResult = Mockito.mock(GetCallerIdentityResult.class); + Mockito.when(mockResult.getArn()).thenReturn("arn:aws:sts::12345:assumed-role/athenz.zts/i-134343"); + cloudStore.setGetCallerIdentityResult(mockResult); + AWSInstanceInformation info = new AWSInstanceInformation() + .setDomain("athenz") + .setService("zts") + .setAccount("12345"); + assertTrue(cloudStore.verifyInstanceIdentity(info)); +} + + @Test + public void testAssumeAWSRoleAWSNotEnabled() { + CloudStore cloudStore = new CloudStore(null); + try { + cloudStore.assumeAWSRole("account", "sycner", "athenz.syncer"); + fail(); + } catch (ResourceException ex) { + assertEquals(ex.getCode(), 500); + } + cloudStore.close(); + } + + @Test + public void testAssumeAWSRole() { + MockCloudStore cloudStore = new MockCloudStore(); + cloudStore.awsEnabled = true; + AssumeRoleResult mockResult = Mockito.mock(AssumeRoleResult.class); + Credentials creds = Mockito.mock(Credentials.class); + Mockito.when(creds.getAccessKeyId()).thenReturn("accesskeyid"); + Mockito.when(creds.getSecretAccessKey()).thenReturn("secretaccesskey"); + Mockito.when(creds.getSessionToken()).thenReturn("sessiontoken"); + Mockito.when(creds.getExpiration()).thenReturn(new Date()); + Mockito.when(mockResult.getCredentials()).thenReturn(creds); + cloudStore.setAssumeRoleResult(mockResult); + cloudStore.setAssumeAWSRole(true); + + AWSTemporaryCredentials awsCreds = cloudStore.assumeAWSRole("account", "syncer", "athenz.syncer"); + assertNotNull(awsCreds); + assertEquals(awsCreds.getAccessKeyId(), "accesskeyid"); + assertEquals(awsCreds.getSessionToken(), "sessiontoken"); + assertEquals(awsCreds.getSecretAccessKey(), "secretaccesskey"); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/DataStoreTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/DataStoreTest.java new file mode 100644 index 00000000000..a46ab72d63d --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/DataStoreTest.java @@ -0,0 +1,3425 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store; + +import static org.testng.Assert.*; + +import java.io.File; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.io.PrintWriter; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Set; + +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.Role; +import com.yahoo.athenz.zms.ServiceIdentity; +import com.yahoo.athenz.zms.SignedDomain; +import com.yahoo.athenz.zms.SignedDomains; +import com.yahoo.athenz.zts.HostServices; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.cache.DataCache; +import com.yahoo.athenz.zts.store.DataStore.DataUpdater; +import com.yahoo.athenz.zts.store.file.MockZMSFileChangeLogStore; +import com.yahoo.athenz.zts.store.file.ZMSFileChangeLogStore; +import com.yahoo.rdl.JSON; + +public class DataStoreTest { + + private PrivateKey pkey; + private String userDomain; + + static final String ZTS_DATA_STORE_PATH = "/tmp/zts_server_unit_tests/zts_root"; + static final String ZTS_Y64_CERT0 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FDMXRHU1ZDQTh3bDVldzVZNzZXajJySkFVRApZYW5FSmZLbUFseDVjUS84a" + + "EtFVWZTU2dwWHIzQ3pkaDFhMjZkbGI3bW1LMjlxbVhKWGg2dW1XOUF5ZlRPS1ZvCis2QVNsb1ZVM2F2dnVmbE" + + "dVT0VnMmpzbWRha1IyNEtjTGpBdTZRclVlNDE3bEczdDhxU1BJR2pTNUMrQ3NKVXcKaDA0aEh4NWYrUEV3eFY" + + "0cmJRSURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT0 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1tGSVCA8wl5ew5Y76Wj2rJAUD\n" + + "YanEJfKmAlx5cQ/8hKEUfSSgpXr3Czdh1a26dlb7mmK29qmXJXh6umW9AyfTOKVo\n" + + "+6ASloVU3avvuflGUOEg2jsmdakR24KcLjAu6QrUe417lG3t8qSPIGjS5C+CsJUw\n" + + "h04hHx5f+PEwxV4rbQIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + static final String ZTS_Y64_CERT1 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FETUhWaFRNZldJQWdvTEdhbkx2QkNNRytRdAoySU9pcml2cGRLSFNPSkpsYX" + + "VKRUNlWlY1MTVmWG91SjhRb09IczA4UGlsdXdjeHF5dmhJSlduNWFrVEhGSWh5CkdDNkdtUTUzbG9WSEtTVE1WO" + + "DM1M0FjNkhydzYxbmJZMVQ2TnA2bjdxdXI4a1UwR2tmdk5hWFZrK09LNVBaankKbkxzZ251UjlCeFZndlM4ZjJR" + + "SURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT1 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMHVhTMfWIAgoLGanLvBCMG+Qt\n" + + "2IOirivpdKHSOJJlauJECeZV515fXouJ8QoOHs08PiluwcxqyvhIJWn5akTHFIhy\n" + + "GC6GmQ53loVHKSTMV8353Ac6Hrw61nbY1T6Np6n7qur8kU0GkfvNaXVk+OK5PZjy\n" + + "nLsgnuR9BxVgvS8f2QIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + static final String ZTS_Y64_CERT2 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FEbmZsZVZ4d293aitRWStjQi8rbWs5YXZYZgpHUWVpTTdOMlMwby9LV3FWK2h" + + "GVWtDZkExMWxEYVJoZUY0alFhSzVaM2pPUE9nbklOZE5hd3VXQ081NUxKdVJRCmI1R0ZSbzhPNjNJNzA3M3ZDZ0V" + + "KdmNST09SdjJDYWhQbnBKbjc3bkhQdlV2Szl0M3JyRURhdi8vanA0UDN5REMKNEVNdHBScmduUXBXNmpJSWlRSUR" + + "BUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT2 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDnfleVxwowj+QY+cB/+mk9avXf\n" + + "GQeiM7N2S0o/KWqV+hFUkCfA11lDaRheF4jQaK5Z3jOPOgnINdNawuWCO55LJuRQ\n" + + "b5GFRo8O63I7073vCgEJvcROORv2CahPnpJn77nHPvUvK9t3rrEDav//jp4P3yDC\n" + + "4EMtpRrgnQpW6jIIiQIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + static final String ZTS_Y64_CERT3 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlHZk1BMEdDU3FHU0liM0RR" + + "RUJBUVVBQTRHTkFEQ0JpUUtCZ1FETWRqSmUwY01wSGR4ZEJKTDcvR2poNTNVUAp5WTdVQ2VlYnZUa2M2S1ZmR0" + + "RnVVlrMUhtaWJ5U21lbnZOYitkNkhXQ1YySGVicUptN1krL2VuaFNkcTR3QTJrCnFtdmFHY09rV1R2cUU2a2J1" + + "MG5LemdUK21jck1sOVpqTHdBQXZPS1hTRi82MTJxQ0tlSElRd3ZtWlB1RkJJTjEKUnFteWgwT0k1aHN5VS9nYj" + + "Z3SURBUUFCCi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + static final String ZTS_PEM_CERT3 = "-----BEGIN PUBLIC KEY-----\n" + + "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMdjJe0cMpHdxdBJL7/Gjh53UP\n" + + "yY7UCeebvTkc6KVfGDgUYk1HmibySmenvNb+d6HWCV2HebqJm7Y+/enhSdq4wA2k\n" + + "qmvaGcOkWTvqE6kbu0nKzgT+mcrMl9ZjLwAAvOKXSF/612qCKeHIQwvmZPuFBIN1\n" + + "Rqmyh0OI5hsyU/gb6wIDAQAB\n" + + "-----END PUBLIC KEY-----\n"; + private static final String ROLE_POSTFIX = ":role."; + + @BeforeClass + public void setUpClass() throws Exception { + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY_STORE_CLASS, "com.yahoo.athenz.zts.pkey.file.FilePrivateKeyStoreFactory"); + System.setProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY, "src/test/resources/zts_private.pem"); + System.setProperty(ZTSConsts.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + } + + @BeforeMethod + public void setup() { + + // we want to make sure we start we clean dir structure + + ZMSFileChangeLogStore.deleteDirectory(new File(ZTS_DATA_STORE_PATH)); + + String privKeyName = System.getProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY); + System.out.println("private key file=" + privKeyName); + File privKeyFile = new File(privKeyName); + String privKey = Crypto.encodedFile(privKeyFile); + + pkey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + userDomain = System.getProperty(ZTSConsts.ZTS_PROP_USER_DOMAIN, "user"); + } + + @AfterMethod + public void cleanup() { + ZMSFileChangeLogStore.deleteDirectory(new File(ZTS_DATA_STORE_PATH)); + } + + private void setServicePublicKey(ServiceIdentity service, String id, String key) { + com.yahoo.athenz.zms.PublicKeyEntry keyEntry = new com.yahoo.athenz.zms.PublicKeyEntry(); + keyEntry.setId(id); + keyEntry.setKey(key); + List listKeys = new ArrayList<>(); + listKeys.add(keyEntry); + service.setPublicKeys(listKeys); + } + + @Test + public void DataStorContstructorTest() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + assertNotNull(store); + } + + @Test + public void testGetDomainListFromZMS() { + + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List list = new ArrayList<>(); + list.add("Test1"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(list); + + Set zmsDomainList = store.changeLogStore.getServerDomainList(); + assertEquals(zmsDomainList.size(), 1); + assertTrue(zmsDomainList.contains("Test1")); + } + + @Test + public void testGetDomainListFromZMSNullClient() { + + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List list = new ArrayList<>(); + list.add("Test1"); + list.add("Test2"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(list); + + Set zmsDomainList = store.changeLogStore.getServerDomainList(); + assertEquals(zmsDomainList.size(), 2); + assertTrue(zmsDomainList.contains("Test1")); + assertTrue(zmsDomainList.contains("Test2")); + } + + @Test + public void testGetDomainListFromZMSError() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(null); + + Set zmsDomainList = store.changeLogStore.getServerDomainList(); + assertNull(zmsDomainList); + } + + @Test + public void testLoadZMSPublicKeys() { + + System.setProperty(ZTSConsts.ZTS_PROP_ATHENZ_CONF, "src/test/resources/athenz.conf"); + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + PublicKey zmsKey = store.zmsPublicKeyCache.getIfPresent("0"); + assertNotNull(zmsKey); + assertNull(store.zmsPublicKeyCache.getIfPresent("1")); + } + + @Test + public void testRetrieveLastModificationTime() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + try (PrintWriter out = new PrintWriter("/tmp/zts_server_unit_tests/zts_root/.lastModTime")) { + out.write("{\"lastModTime\":\"12345\"}"); + } catch (FileNotFoundException e) { + e.printStackTrace(); + fail(); + } + + assertEquals(((MockZMSFileChangeLogStore) store.changeLogStore).retrieveLastModificationTime(), "12345"); + } + + @Test + public void testRetrieveLastModificationTimeNotValid() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).retrieveLastModificationTime(); + assertEquals(((MockZMSFileChangeLogStore) store.changeLogStore).lastModTime, null); + } + + @Test + public void testSaveLastModificationTime() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.changeLogStore.setLastModificationTimestamp("23456"); + + String data = null; + File f = new File("/tmp/zts_server_unit_tests/zts_root/.lastModTime"); + try { + data = new String(Files.readAllBytes(f.toPath()), "UTF-8"); + } catch (IOException e) { + e.printStackTrace(); + fail(); + } + + assertEquals(data, "{\"lastModTime\":\"23456\"}"); + } + + @Test + public void testResetLastModificationTime() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.changeLogStore.setLastModificationTimestamp("34567"); + store.changeLogStore.setLastModificationTimestamp(null); + + assertNull(((MockZMSFileChangeLogStore) store.changeLogStore).lastModTime); + File f = new File("/tmp/zts_server_unit_tests/zts_root/.lastModTime"); + assertFalse(f.exists()); + } + + @Test + public void testRemovePublicKeys() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map remKeys = new HashMap<>(); + remKeys.put("sports.storage_0", "PublicKey0"); + + store.removePublicKeys(remKeys); + assertEquals(store.publicKeyCache.size(), 2); + assertTrue(store.publicKeyCache.containsKey("coretech.storage_0")); + assertTrue(store.publicKeyCache.containsKey("sports.storage_1")); + } + + @Test + public void testRemovePublicKeysAll() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map remKeys = new HashMap<>(); + remKeys.put("coretech.storage_0", "PublicKey0"); + remKeys.put("sports.storage_0", "PublicKey0"); + remKeys.put("sports.storage_1", "PublicKey1"); + + store.removePublicKeys(remKeys); + assertEquals(store.publicKeyCache.size(), 0); + } + + @Test + public void testRemovePublicKeysInvalid() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map remKeys = new HashMap<>(); + remKeys.put("sports.storage_2", "PublicKey2"); + + store.removePublicKeys(remKeys); + assertEquals(store.publicKeyCache.size(), 3); + assertTrue(store.publicKeyCache.containsKey("coretech.storage_0")); + assertTrue(store.publicKeyCache.containsKey("sports.storage_0")); + assertTrue(store.publicKeyCache.containsKey("sports.storage_1")); + } + + @Test + public void testRemovePublicKeysEmpty() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + + Map remKeys = new HashMap<>(); + + store.removePublicKeys(remKeys); + assertEquals(store.publicKeyCache.size(), 1); + assertTrue(store.publicKeyCache.containsKey("coretech.storage_0")); + } + + @Test + public void testRemovePublicKeysNull() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + + store.removePublicKeys(null); + assertEquals(store.publicKeyCache.size(), 1); + assertTrue(store.publicKeyCache.containsKey("coretech.storage_0")); + } + + @Test + public void testAddPublicKeys() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map addKeys = new HashMap<>(); + addKeys.put("sports.storage_1", "PublicKey1"); + addKeys.put("sports.storage_2", "PublicKey2"); + + store.addPublicKeys(addKeys); + assertEquals(store.publicKeyCache.size(), 4); + assertTrue(store.publicKeyCache.containsKey("coretech.storage_0")); + assertTrue(store.publicKeyCache.containsKey("sports.storage_0")); + assertTrue(store.publicKeyCache.containsKey("sports.storage_1")); + assertTrue(store.publicKeyCache.containsKey("sports.storage_2")); + } + + @Test + public void testAddPublicKeysUpdateValue() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map addKeys = new HashMap<>(); + addKeys.put("coretech.storage_0", "PublicKey0"); + addKeys.put("sports.storage_0", "PublicKey100"); + addKeys.put("sports.storage_1", "PublicKey101"); + + store.addPublicKeys(addKeys); + assertEquals(store.publicKeyCache.size(), 3); + String value = store.publicKeyCache.get("coretech.storage_0"); + assertEquals(value, "PublicKey0"); + + value = store.publicKeyCache.get("sports.storage_0"); + assertEquals(value, "PublicKey100"); + + value = store.publicKeyCache.get("sports.storage_1"); + assertEquals(value, "PublicKey101"); + } + + @Test + public void testAddPublicKeysEmpty() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + + Map addKeys = new HashMap<>(); + + store.addPublicKeys(addKeys); + assertEquals(store.publicKeyCache.size(), 1); + assertTrue(store.publicKeyCache.containsKey("coretech.storage_0")); + } + + @Test + public void testAddPublicKeysNull() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + + store.addPublicKeys(null); + assertEquals(store.publicKeyCache.size(), 1); + assertTrue(store.publicKeyCache.containsKey("coretech.storage_0")); + } + + @Test + public void testGetPublicKey() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map addKeys = new HashMap<>(); + addKeys.put("sports.storage_1", "PublicKey1"); + addKeys.put("sports.storage_2", "PublicKey2"); + + store.addPublicKeys(addKeys); + assertEquals(store.getPublicKey("coretech", "storage", "0"), "PublicKey0"); + assertEquals(store.getPublicKey("sports", "storage", "0"), "PublicKey0"); + assertEquals(store.getPublicKey("sports", "storage", "1"), "PublicKey1"); + assertEquals(store.getPublicKey("sports", "storage", "2"), "PublicKey2"); + } + + @Test + public void testGetPublicKeyUpdated() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map addKeys = new HashMap<>(); + addKeys.put("coretech.storage_0", "PublicKey0"); + addKeys.put("sports.storage_0", "PublicKey100"); + addKeys.put("sports.storage_1", "PublicKey101"); + + store.addPublicKeys(addKeys); + + assertEquals(store.getPublicKey("coretech", "storage", "0"), "PublicKey0"); + assertEquals(store.getPublicKey("sports", "storage", "0"), "PublicKey100"); + assertEquals(store.getPublicKey("sports", "storage", "1"), "PublicKey101"); + } + + @Test + public void testGetPublicKeyInvalid() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.publicKeyCache.put("coretech.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_0", "PublicKey0"); + store.publicKeyCache.put("sports.storage_1", "PublicKey1"); + + Map addKeys = new HashMap<>(); + addKeys.put("sports.storage_1", "PublicKey1"); + addKeys.put("sports.storage_2", "PublicKey2"); + + store.addPublicKeys(addKeys); + assertNull(store.getPublicKey("weather", "storage", "0")); + assertNull(store.getPublicKey("sports", "storage", "101")); + assertNull(store.getPublicKey("sports", "backup", "0")); + assertNull(store.getPublicKey("sports", "storage", "-1")); + } + + @Test + public void testAddHostEntriesNotPresent() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + Map> hostMap = new HashMap<>(); + Set services = new HashSet<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + hostMap.put("host1", services); + + services = new HashSet<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + hostMap.put("host2", services); + + store.addHostEntries(hostMap); + assertEquals(store.hostCache.size(), 2); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + + retServices = store.hostCache.get("host2"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + } + + @Test + public void testAddHostEntriesAddValue() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host2", services); + + Map> hostMap = new HashMap<>(); + Set newServices = new HashSet<>(); + newServices.add("sports.storage"); + hostMap.put("host2", newServices); + hostMap.put("host3", newServices); + + store.addHostEntries(hostMap); + assertEquals(store.hostCache.size(), 3); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + + retServices = store.hostCache.get("host2"); + assertEquals(retServices.size(), 3); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + assertTrue(retServices.contains("sports.storage")); + + retServices = store.hostCache.get("host3"); + assertEquals(retServices.size(), 1); + assertTrue(retServices.contains("sports.storage")); + } + + @Test + public void testAddHostEntriesEmptyMap() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host1", services); + + Map> hostMap = new HashMap<>(); + + store.addHostEntries(hostMap); + assertEquals(store.hostCache.size(), 1); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + } + + @Test + public void testAddHostEntrieNullMap() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host2", services); + + store.addHostEntries(null); + assertEquals(store.hostCache.size(), 2); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + + retServices = store.hostCache.get("host2"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + } + + @Test + public void testRemoveHostEntriesNotPresent() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host2", services); + + Map> hostMap = new HashMap<>(); + Set newServices = new HashSet<>(); + newServices.add("coretech.storage"); + newServices.add("coretech.backup"); + hostMap.put("host3", newServices); + + store.removeHostEntries(hostMap); + assertEquals(store.hostCache.size(), 2); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + + retServices = store.hostCache.get("host2"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + } + + @Test + public void testRemoveHostEntriesRemoveValue() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host2", services); + + Map> hostMap = new HashMap<>(); + Set newServices = new HashSet<>(); + newServices.add("coretech.storage"); + hostMap.put("host1", newServices); + + newServices = new HashSet<>(); + newServices.add("coretech.backup"); + hostMap.put("host2", newServices); + + store.removeHostEntries(hostMap); + assertEquals(store.hostCache.size(), 2); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 1); + assertTrue(retServices.contains("coretech.backup")); + + retServices = store.hostCache.get("host2"); + assertEquals(retServices.size(), 1); + assertTrue(retServices.contains("coretech.storage")); + } + + @Test + public void testRemoveHostEntriesEmptyMap() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host1", services); + + Map> hostMap = new HashMap<>(); + + store.removeHostEntries(hostMap); + assertEquals(store.hostCache.size(), 1); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + } + + @Test + public void testRemoveHostEntrieNullMap() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("coretech.backup"); + store.hostCache.put("host2", services); + + store.removeHostEntries(null); + assertEquals(store.hostCache.size(), 2); + List retServices = store.hostCache.get("host1"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + + retServices = store.hostCache.get("host2"); + assertEquals(retServices.size(), 2); + assertTrue(retServices.contains("coretech.storage")); + assertTrue(retServices.contains("coretech.backup")); + } + + @Test + public void testGetHostServices() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("sports.storage"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("sports.storage"); + store.hostCache.put("host2", services); + + HostServices hostServices = store.getHostServices("host1"); + List hosts = hostServices.getNames(); + assertEquals(hosts.size(), 2); + assertTrue(hosts.contains("coretech.storage")); + assertTrue(hosts.contains("sports.storage")); + + hostServices = store.getHostServices("host2"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 2); + assertTrue(hosts.contains("coretech.storage")); + assertTrue(hosts.contains("sports.storage")); + } + + @Test + public void testGetHostServicesHostUpdated() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("sports.storage"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("sports.storage"); + store.hostCache.put("host2", services); + + Map> hostMap = new HashMap<>(); + Set newServices = new HashSet<>(); + newServices.add("coretech.backup"); + hostMap.put("host3", newServices); + + newServices = new HashSet<>(); + newServices.add("sports.backup"); + hostMap.put("host1", newServices); + + store.addHostEntries(hostMap); + + Map> remMap = new HashMap<>(); + Set remServices = new HashSet<>(); + remServices.add("sports.storage"); + remMap.put("host1", remServices); + + store.removeHostEntries(remMap); + + HostServices hostServices = store.getHostServices("host1"); + List hosts = hostServices.getNames(); + assertEquals(hosts.size(), 2); + assertTrue(hosts.contains("coretech.storage")); + assertTrue(hosts.contains("sports.backup")); + + hostServices = store.getHostServices("host2"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 2); + assertTrue(hosts.contains("coretech.storage")); + assertTrue(hosts.contains("sports.storage")); + + hostServices = store.getHostServices("host3"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 1); + assertTrue(hosts.contains("coretech.backup")); + } + + @Test + public void testGetHostServicesInvalid() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("sports.storage"); + store.hostCache.put("host1", services); + + services = new ArrayList<>(); + services.add("coretech.storage"); + services.add("sports.storage"); + store.hostCache.put("host2", services); + + HostServices hostServices = store.getHostServices("host3"); + List hosts = hostServices.getNames(); + assertNull(hosts); + } + + @Test + public void testGenerateServiceKeyName() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + assertEquals(store.generateServiceKeyName("coretech", "storage", "3"), "coretech.storage_3"); + } + + @Test + public void testGenerateServiceKeyNameLongValues() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + String domain = "coretech0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789"; + String service = "coretech0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789"; + String expectedValue = domain + "." + service + "_2"; + assertEquals(store.generateServiceKeyName(domain, service, "2"), expectedValue); + } + + @Test + public void testCheckRoleSet() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + Set checkSet = new HashSet<>(); + checkSet.add("role1"); + checkSet.add("role2"); + + assertTrue(store.checkRoleSet("test1", null)); + assertTrue(store.checkRoleSet("role1", checkSet)); + assertTrue(store.checkRoleSet("role2", checkSet)); + assertFalse(store.checkRoleSet("role3", checkSet)); + } + + @Test + public void testAddRoleToListPrefixNoMatch() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + List accessibleRoles = new ArrayList<>(); + store.addRoleToList("sports:role.admin", "coretech:role.", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testAddRoleToListNullSuffix() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + store.addRoleToList("coretech:role.admin", "coretech:role.", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertEquals(accessibleRoles.get(0), "admin"); + } + + @Test + public void testAddRoleToList() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + store.addRoleToList("coretech:role.admin", "coretech:role.", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertEquals(accessibleRoles.get(0), "admin"); + } + + @Test + public void testAddDomainToCacheNewDomain() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + + List roles = new ArrayList<>(); + roles.add(role); + + DomainData domainData = new DomainData(); + domainData.setRoles(roles); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + DomainData domain = store.getDomainData("coretech"); + assertNotNull(domain); + assertEquals(domain.getRoles().size(), 1); + assertEquals(domain.getRoles().get(0).getName(), "coretech:role.admin"); + assertEquals(domain.getRoles().get(0).getMembers().size(), 1); + assertTrue(domain.getRoles().get(0).getMembers().contains("user_domain.user")); + } + + @Test + public void testAddDomainToCacheUpdatedDomain() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + + List roles = new ArrayList<>(); + roles.add(role); + + DomainData domainData = new DomainData(); + domainData.setRoles(roles); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* update member list */ + + role = new Role(); + role.setName("coretech:role.admin"); + members = new ArrayList<>(); + members.add("user_domain.user1"); + members.add("user_domain.user2"); + role.setMembers(members); + + roles = new ArrayList<>(); + roles.add(role); + + dataCache = new DataCache(); + domainData = new DomainData(); + domainData.setRoles(roles); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + DomainData domain = store.getDomainData("coretech"); + assertNotNull(domain); + assertEquals(domain.getRoles().size(), 1); + assertEquals(domain.getRoles().get(0).getName(), "coretech:role.admin"); + assertEquals(domain.getRoles().get(0).getMembers().size(), 2); + assertTrue(domain.getRoles().get(0).getMembers().contains("user_domain.user1")); + assertTrue(domain.getRoles().get(0).getMembers().contains("user_domain.user2")); + } + + @Test + public void testAddDomainToCacheSameHosts() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* same hosts - no changes */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + HostServices hostServices = store.getHostServices("host1"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 1); + assertTrue(hosts.contains("coretech.storage")); + } + + @Test + public void testAddDomainToCacheAddedHosts() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + dataCache.processServiceIdentity(service); + services.add(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* added hosts */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + hosts = new ArrayList<>(); + hosts.add("host1"); + hosts.add("host2"); + service.setHosts(hosts); + + services = new ArrayList<>(); + dataCache.processServiceIdentity(service); + services.add(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + HostServices hostServices = store.getHostServices("host1"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 1); + assertTrue(hosts.contains("coretech.storage")); + + hostServices = store.getHostServices("host2"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 1); + assertTrue(hosts.contains("coretech.storage")); + } + + @Test + public void testAddDomainToCacheRemovedHosts() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + hosts.add("host2"); + hosts.add("host3"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* removed hosts */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + HostServices hostServices = store.getHostServices("host1"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 1); + assertTrue(hosts.contains("coretech.storage")); + + hostServices = store.getHostServices("host2"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 0); + + hostServices = store.getHostServices("host3"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 0); + } + + @Test + public void testAddDomainToCacheSamePublicKeys() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + com.yahoo.athenz.zms.PublicKeyEntry publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + + List publicKeys = new ArrayList(); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* same public keys - no changes */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + publicKeys = new ArrayList(); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT0); + publicKey.setId("0"); + publicKeys.add(publicKey); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + assertEquals(store.getPublicKey("coretech", "storage", "0"), ZTS_PEM_CERT0); + assertEquals(store.getPublicKey("coretech", "storage", "1"), ZTS_PEM_CERT1); + assertNull(store.getPublicKey("coretech", "storage", "2")); + } + + @Test + public void testAddDomainToCacheUpdatedPublicKeysV0() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + com.yahoo.athenz.zms.PublicKeyEntry publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + + List publicKeys = new ArrayList(); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* update V0 public key */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + publicKeys = new ArrayList(); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT2); + publicKey.setId("0"); + publicKeys.add(publicKey); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + assertEquals(store.getPublicKey("coretech", "storage", "0"), ZTS_PEM_CERT2); + assertEquals(store.getPublicKey("coretech", "storage", "1"), ZTS_PEM_CERT1); + assertNull(store.getPublicKey("coretech", "storage", "2")); + } + + @Test + public void testAddDomainToCacheUpdatedPublicKeysVersions() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + com.yahoo.athenz.zms.PublicKeyEntry publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + + List publicKeys = new ArrayList(); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* update multiple version public keys */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + publicKeys = new ArrayList(); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT0); + publicKey.setId("0"); + publicKeys.add(publicKey); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT3); + publicKey.setId("1"); + publicKeys.add(publicKey); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT2); + publicKey.setId("2"); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + assertEquals(store.getPublicKey("coretech", "storage", "0"), ZTS_PEM_CERT0); + assertEquals(store.getPublicKey("coretech", "storage", "1"), ZTS_PEM_CERT3); + assertEquals(store.getPublicKey("coretech", "storage", "2"), ZTS_PEM_CERT2); + assertNull(store.getPublicKey("coretech", "storage", "3")); + } + + @Test + public void testAddDomainToCacheRemovedPublicKeysV0() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + com.yahoo.athenz.zms.PublicKeyEntry publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + + List publicKeys = new ArrayList(); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* remove V0 public key */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + publicKeys = new ArrayList(); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + assertNull(store.getPublicKey("coretech", "storage", "0")); + assertEquals(store.getPublicKey("coretech", "storage", "1"), ZTS_PEM_CERT1); + assertNull(store.getPublicKey("coretech", "storage", "2")); + } + + @Test + public void testAddDomainToCacheRemovedPublicKeysVersions() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + List publicKeys = new ArrayList(); + + com.yahoo.athenz.zms.PublicKeyEntry publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + publicKeys.add(publicKey); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT2); + publicKey.setId("2"); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + /* update multiple version public keys */ + + dataCache = new DataCache(); + service = new ServiceIdentity(); + service.setName("coretech.storage"); + + publicKeys = new ArrayList(); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT0); + publicKey.setId("0"); + publicKeys.add(publicKey); + + publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT2); + publicKey.setId("2"); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + assertEquals(store.getPublicKey("coretech", "storage", "0"), ZTS_PEM_CERT0); + assertNull(store.getPublicKey("coretech", "storage", "1")); + assertEquals(store.getPublicKey("coretech", "storage", "2"), ZTS_PEM_CERT2); + assertNull(store.getPublicKey("coretech", "storage", "3")); + } + + @Test + public void testDeleteDomain() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domainData.setRoles(roles); + + signedDomain.setDomain(domainData); + signedDomain.setKeyId("0"); + ((MockZMSFileChangeLogStore) store.changeLogStore).put("coretech", JSON.bytes(signedDomain)); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + store.deleteDomainFromCache("coretech"); + store.changeLogStore.removeLocalDomain("coretech"); + + assertNull(store.getCacheStore().getIfPresent("coretech")); + + File file = new File("/tmp/zts_server_unit_tests/zts_root/coretech"); + assertFalse(file.exists()); + } + + @Test + public void testDeleteDomainFromCacheHosts() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + dataCache.processServiceIdentity(service); + services.add(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + store.deleteDomainFromCache("coretech"); + + HostServices hostServices = store.getHostServices("host1"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 0); + } + + @Test + public void testDeleteDomainFromCachePublicKeys() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + setServicePublicKey(service, "0", ZTS_Y64_CERT0); + + com.yahoo.athenz.zms.PublicKeyEntry publicKey = new com.yahoo.athenz.zms.PublicKeyEntry(); + publicKey.setKey(ZTS_Y64_CERT1); + publicKey.setId("1"); + + List publicKeys = new ArrayList(); + publicKeys.add(publicKey); + + service.setPublicKeys(publicKeys); + + List services = new ArrayList<>(); + services.add(service); + dataCache.processServiceIdentity(service); + + DomainData domainData = new DomainData(); + domainData.setServices(services); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + store.deleteDomainFromCache("coretech"); + + assertNull(store.getPublicKey("coretech", "storage", "0")); + assertNull(store.getPublicKey("coretech", "storage", "1")); + assertNull(store.getPublicKey("coretech", "storage", "2")); + } + + @Test + public void testDeleteDomainFromCacheServices() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domainData.setRoles(roles); + + signedDomain.setDomain(domainData); + signedDomain.setKeyId("0"); + ((MockZMSFileChangeLogStore) store.changeLogStore).put("coretech", JSON.bytes(signedDomain)); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.addDomainToCache("coretech", dataCache); + + store.deleteDomainFromCache("coretech"); + store.changeLogStore.removeLocalDomain("coretech"); + + assertNull(store.getCacheStore().getIfPresent("coretech")); + + File file = new File("/tmp/zts_server_unit_tests/zts_root/coretech"); + assertFalse(file.exists()); + } + + @Test + public void testRetrieveTagHeadersEmptyList() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader(null); + + Map> responseHeaders = new HashMap>(); + assertNull(((MockZMSFileChangeLogStore) store.changeLogStore).retrieveTagHeader(responseHeaders)); + } + + @Test + public void testRetrieveTagHeadersValueNotFound() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader(null); + + Map> responseHeaders = new HashMap>(); + List values = new ArrayList<>(); + values.add("Unit-Test"); + responseHeaders.put("User-Agent", values); + assertNull(((MockZMSFileChangeLogStore) store.changeLogStore).retrieveTagHeader(responseHeaders)); + } + + @Test + public void testRetrieveTagHeadersValidValue() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader(null); + + Map> responseHeaders = new HashMap>(); + List values = new ArrayList<>(); + values.add("Unit-Test"); + responseHeaders.put("tag", values); + assertEquals(((MockZMSFileChangeLogStore) store.changeLogStore).retrieveTagHeader(responseHeaders), "Unit-Test"); + } + + @Test + public void testValidateSignedDomainValid() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + assertTrue(store.validateSignedDomain(signedDomain)); + } + + @Test + public void testValidateSignedDomainInvalidSignature() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + + DomainData domain = new DomainData(); + domain.setRoles(roles); + + signedDomain.setDomain(domain); + signedDomain.setSignature("InvalidSignature"); + signedDomain.setKeyId("0"); + + assertFalse(store.validateSignedDomain(signedDomain)); + } + + @Test + public void testValidateSignedDomainInvalidVersion() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + + DomainData domain = new DomainData(); + domain.setRoles(roles); + + signedDomain.setDomain(domain); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), pkey)); + signedDomain.setKeyId("100"); + + assertFalse(store.validateSignedDomain(signedDomain)); + } + + @Test + public void testValidateSignedDomainMissingRole() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + DomainData domain = new DomainData(); + domain.setRoles(roles); + + signedDomain.setDomain(domain); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), pkey)); + signedDomain.setKeyId("0"); + + domain.setRoles(null); + signedDomain.setDomain(domain); + + assertFalse(store.validateSignedDomain(signedDomain)); + } + + @Test + public void testProcessDomainDeletesNoLocalDomains() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + assertTrue(store.processDomainDeletes()); + } + + private void addDomainToDataStore(DataStore store, String domainName) { + + SignedDomain signedDomain = new SignedDomain(); + + Role role = new Role(); + role.setName(domainName + ":role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + + List roles = new ArrayList<>(); + roles.add(role); + + DomainData domainData = new DomainData(); + domainData.setName(domainName); + domainData.setRoles(roles); + + signedDomain.setDomain(domainData); + signedDomain.setKeyId("0"); + ((MockZMSFileChangeLogStore) store.changeLogStore).put(domainName, JSON.bytes(signedDomain)); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.addDomainToCache(domainName, dataCache); + } + + @Test + public void testProcessDomainDeletesZMSFailure() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(null); + addDomainToDataStore(store, "coretech"); + + /* this should throw an exception when obtaining domain list from ZMS */ + + assertFalse(store.processDomainDeletes()); + } + + @Test + public void testProcessDomainDeletesZMSSingleDelete() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + addDomainToDataStore(store, "coretech"); + addDomainToDataStore(store, "sports"); + + List list = new ArrayList<>(); + list.add(userDomain); + list.add("sys.auth"); + list.add("coretech"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(list); + + assertTrue(store.processDomainDeletes()); + assertNull(store.getDomainData("sports")); + assertNotNull(store.getDomainData("coretech")); + } + + @Test + public void testProcessDomainDeletesZMSAllDelete() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + addDomainToDataStore(store, "coretech"); + addDomainToDataStore(store, "sports"); + + List list = new ArrayList<>(); + list.add(userDomain); + list.add("sys.auth"); + list.add("coretech2"); + list.add("sports2"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(list); + + assertTrue(store.processDomainDeletes()); + assertNull(store.getDomainData("sports")); + assertNull(store.getDomainData("coretech")); + } + + @Test + public void testGetAccessibleRoles() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user1", null, accessibleRoles, false); + + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("writers")); + } + + @Test + public void testGetAccessibleRolesInvalidDomain() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("sports"); + store.getAccessibleRoles(data, "sports", "user_domain.user", null, accessibleRoles, false); + + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testGetAccessibleRolesSpecifiedRole() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user", "coretech:role.admin", accessibleRoles, false); + + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("admin")); + } + + @Test + public void testGetAccessibleRolesNoRoles() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.nonexistentuser", null, accessibleRoles, false); + + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testGetAccessibleRolesMultipleRoles() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user", null, accessibleRoles, false); + + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("writers")); + } + + @Test + public void testStoreInitNoLastModTimeLocalDomainDelete() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.changeLogStore.setLastModificationTimestamp(null); + + /* this domain will be deleted since our last refresh is 0 */ + + addDomainToDataStore(store, "coretech"); + File file = new File("/tmp/zts_server_unit_tests/zts_root/coretech"); + assertTrue(file.exists()); + + /* initialize our datastore which will call init */ + + clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + store = new DataStore(clogStore, null); + assertNull(store.getDomainData("coretech")); + assertFalse(file.exists()); + } + + @Test + public void testStoreInitNoLocalDomains() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader("2014-01-01T12:00:00"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setLastModificationTimestamp(null); + + List domains = new ArrayList<>(); + + /* we're going to create a new domain */ + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + domains.add(signedDomain); + + /* we're going to update the coretech domain and set new roles */ + + signedDomain = createSignedDomain("sports", "weather"); + domains.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(domains); + + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(signedDomains); + + boolean result = store.init(); + assertTrue(result); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("writers")); + + accessibleRoles = new ArrayList<>(); + data = store.getDataCache("sports"); + store.getAccessibleRoles(data, "sports", "user_domain.user", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("writers")); + } + + @Test + public void testStoreInitNoLastModTimeDomainUpdateFailure() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + addDomainToDataStore(store, "coretech"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader(null); + + /* our mock is going to throw an exception for domain list so failure */ + + assertFalse(store.init()); + } + + @Test + public void testStoreInitLocalDomainUpdated() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore setupStore = new DataStore(clogStore, null); + setupStore.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + setupStore.processDomain(signedDomain, true); + + /* create a new store instance */ + + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader("2014-01-01T12:00:00"); + + List domains = new ArrayList<>(); + + /* we're going to create a new domain */ + + signedDomain = createSignedDomain("sports", "weather"); + domains.add(signedDomain); + + /* we're going to update the coretech domain and set new roles */ + + signedDomain = createSignedDomain("coretech", "weather"); + + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user8"); + role.setMembers(members); + + List roles = new ArrayList<>(); + roles.add(role); + signedDomain.getDomain().setRoles(roles); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(signedDomain.getDomain()), pkey)); + domains.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(domains); + + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(signedDomains); + + List domainNames = new ArrayList<>(); + domainNames.add("coretech"); + domainNames.add("sports"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(domainNames); + + boolean result = store.init(); + assertTrue(result); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user1", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + + accessibleRoles = new ArrayList<>(); + store.getAccessibleRoles(data, "coretech", "user_domain.user8", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("admin")); + + accessibleRoles = new ArrayList<>(); + data = store.getDataCache("sports"); + store.getAccessibleRoles(data, "sports", "user_domain.user", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("writers")); + } + + @Test + public void testStoreInitLastModTimeDomainCorrupted() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setLastModificationTimestamp("2014-01-01T12:00:00"); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + signedDomain.setSignature("ABCD"); /* invalid signature which will cause domain to be deleted */ + + ((MockZMSFileChangeLogStore) store.changeLogStore).put("coretech", JSON.bytes(signedDomain)); + + store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader("2014-01-01T12:00:00"); + + List list = new ArrayList<>(); + list.add("coretech"); + list.add("sports"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(list); + + List domains = new ArrayList<>(); + + /* we're going to create a new domain */ + + signedDomain = createSignedDomain("sports", "weather"); + domains.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(domains); + + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(signedDomains); + + boolean result = store.init(); + assertTrue(result); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + + File file = new File("/tmp/zts_server_unit_tests/zts_root/coretech"); + assertFalse(file.exists()); + + accessibleRoles = new ArrayList<>(); + data = store.getDataCache("sports"); + store.getAccessibleRoles(data, "sports", "user_domain.user", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("writers")); + } + + @Test + public void testProcessDomainRoles() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName("coretech:role.readers"); + members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domainData.setRoles(roles); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.processDomainRoles(domainData, dataCache); + assertEquals(dataCache.getMemberRoleSet("user_domain.user").size(), 2); + + assertTrue(dataCache.getMemberRoleSet("user_domain.user").contains("coretech:role.admin")); + assertTrue(dataCache.getMemberRoleSet("user_domain.user").contains("coretech:role.readers")); + } + + @Test + public void testProcessDomainRolesNullRoles() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.processDomainRoles(domainData, dataCache); + assertEquals(dataCache.getMemberCount(), 0); + } + + @Test + public void testProcessDomainPolicies() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource("sports:role.readers"); + assertion.setAction("assume_role"); + assertion.setRole("coretech:role.readers"); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policies.add(policy); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName("coretech:role.readers"); + members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain("coretech"); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), pkey)); + signedPolicies.setKeyId("0"); + + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domainData.setPolicies(signedPolicies); + domainData.setRoles(roles); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.processDomainRoles(domainData, dataCache); + assertEquals(dataCache.getMemberRoleSet("user_domain.user").size(), 2); + assertTrue(dataCache.getMemberRoleSet("user_domain.user").contains("coretech:role.admin")); + assertTrue(dataCache.getMemberRoleSet("user_domain.user").contains("coretech:role.readers")); + } + + @Test + public void testProcessDomainPoliciesNullPolicies() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.processDomainPolicies(domainData, dataCache); + assertEquals(dataCache.getMemberCount(), 0); + } + + @Test + public void testProcessDomainServiceIdentities() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + ServiceIdentity service = new ServiceIdentity(); + service.setName("coretech.storage"); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + services.add(service); + + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + domainData.setServices(services); + + DataCache dataCache = new DataCache(); + dataCache.setDomainData(domainData); + + store.processDomainServiceIdentities(domainData, dataCache); + store.addDomainToCache(domainData.getName(), dataCache); + + HostServices hostServices = store.getHostServices("host1"); + hosts = hostServices.getNames(); + assertEquals(hosts.size(), 1); + assertTrue(hosts.contains("coretech.storage")); + } + + @Test + public void testProcessDomainServiceIdentitiesNullPolicies() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + DataCache dataCache = new DataCache(); + DomainData domainData = new DomainData(); + domainData.setName("coretech"); + dataCache.setDomainData(domainData); + + store.processDomainServiceIdentities(domainData, dataCache); + + HostServices hostServices = store.getHostServices("host1"); + List hosts = hostServices.getNames(); + assertNull(hosts); + } + + private SignedDomain createSignedDomain(String domainName, String tenantDomain) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(domainName + ":role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(domainName + ":role.writers"); + members = new ArrayList<>(); + members.add("user_domain.user"); + members.add("user_domain.user1"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(domainName + ":role.readers"); + members = new ArrayList<>(); + members.add("user_domain.user3"); + members.add("user_domain.user4"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(domainName + ":role.tenant.readers"); + role.setTrust(tenantDomain); + roles.add(role); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(domainName + ":tenant.weather.*"); + assertion.setAction("read"); + assertion.setRole(domainName + ":role.tenant.readers"); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(domainName + ":policy.tenant.reader"); + policies.add(policy); + + ServiceIdentity service = new ServiceIdentity(); + service.setName(domainName + ".storage"); + setServicePublicKey(service, "0", "abcdefgh"); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + services.add(service); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), pkey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setRoles(roles); + domain.setServices(services); + domain.setPolicies(signedPolicies); + + signedDomain.setDomain(domain); + + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), pkey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + private SignedDomain createTenantSignedDomain(String domainName, String providerDomain) { + + SignedDomain signedDomain = new SignedDomain(); + + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(domainName + ":role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user"); + role.setMembers(members); + roles.add(role); + + role = new Role(); + role.setName(domainName + ":role.readers"); + members = new ArrayList<>(); + members.add("user_domain.user100"); + members.add("user_domain.user101"); + role.setMembers(members); + roles.add(role); + + List policies = new ArrayList<>(); + + com.yahoo.athenz.zms.Policy policy = new com.yahoo.athenz.zms.Policy(); + com.yahoo.athenz.zms.Assertion assertion = new com.yahoo.athenz.zms.Assertion(); + assertion.setResource(providerDomain + ":role.tenant.readers"); + assertion.setAction("assume_role"); + assertion.setRole(domainName + ":role.readers"); + + List assertions = new ArrayList<>(); + assertions.add(assertion); + + policy.setAssertions(assertions); + policy.setName(domainName + ":policy.tenancy.readers"); + policies.add(policy); + + ServiceIdentity service = new ServiceIdentity(); + service.setName(domainName + ".storage"); + setServicePublicKey(service, "0", "abcdefgh"); + + List hosts = new ArrayList<>(); + hosts.add("host1"); + service.setHosts(hosts); + + List services = new ArrayList<>(); + services.add(service); + + com.yahoo.athenz.zms.DomainPolicies domainPolicies = new com.yahoo.athenz.zms.DomainPolicies(); + domainPolicies.setDomain(domainName); + domainPolicies.setPolicies(policies); + + com.yahoo.athenz.zms.SignedPolicies signedPolicies = new com.yahoo.athenz.zms.SignedPolicies(); + signedPolicies.setContents(domainPolicies); + signedPolicies.setSignature(Crypto.sign(SignUtils.asCanonicalString(domainPolicies), pkey)); + signedPolicies.setKeyId("0"); + + DomainData domain = new DomainData(); + domain.setName(domainName); + domain.setRoles(roles); + domain.setServices(services); + domain.setPolicies(signedPolicies); + + signedDomain.setDomain(domain); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(domain), pkey)); + signedDomain.setKeyId("0"); + + return signedDomain; + } + + @Test + public void testProcessDomainSaveInStore() throws IOException { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + File file = new File("/tmp/zts_server_unit_tests/zts_root/coretech"); + assertTrue(file.exists()); + + Path path = Paths.get(file.toURI()); + SignedDomain signedDomain2 = JSON.fromBytes(Files.readAllBytes(path), SignedDomain.class); + assertEquals(signedDomain2.getDomain().getName(), "coretech"); + + assertNotNull(store.getDomainData("coretech")); + } + + @Test + public void testProcessDomainNotSaveInStore() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, false); + + File file = new File("/tmp/zts_server_unit_tests/zts_root/coretech"); + assertFalse(file.exists()); + + assertNotNull(store.getDomainData("coretech")); + } + + @Test + public void testProcessLocalDomain() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + store = new DataStore(clogStore, null); + boolean result = store.processLocalDomain("coretech"); + assertTrue(result); + assertNotNull(store.getDomainData("coretech")); + } + + @Test + public void testProcessLocalDomainInvalidFile() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + boolean result = store.processLocalDomain("coretech"); + assertFalse(result); + } + + @Test + public void testProcessLocalDomains() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore setupStore = new DataStore(clogStore, null); + setupStore.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + setupStore.processDomain(signedDomain, true); + + signedDomain = createSignedDomain("sports", "weather"); + setupStore.processDomain(signedDomain, true); + + DataStore store = new DataStore(clogStore, null); + + List list = new ArrayList<>(); + list.add("coretech"); + list.add("sports"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(list); + + boolean result = store.processLocalDomains(list); + assertTrue(result); + + assertNotNull(store.getDomainData("coretech")); + assertNotNull(store.getDomainData("sports")); + } + + @Test + public void testProcessLocalDomainsZMSDomainListNull() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore setupStore = new DataStore(clogStore, null); + setupStore.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + setupStore.processDomain(signedDomain, true); + + signedDomain = createSignedDomain("sports", "weather"); + setupStore.processDomain(signedDomain, true); + + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(null); + + List list = new ArrayList<>(); + list.add("coretech"); + list.add("sports"); + + boolean result = store.processLocalDomains(list); + assertFalse(result); + } + + @Test + public void testProcessLocalDomainsDeletedDomain() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore setupStore = new DataStore(clogStore, null); + setupStore.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + setupStore.processDomain(signedDomain, true); + + signedDomain = createSignedDomain("sports", "weather"); + setupStore.processDomain(signedDomain, true); + + DataStore store = new DataStore(clogStore, null); + List zmsList = new ArrayList<>(); + zmsList.add("coretech"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(zmsList); + + List list = new ArrayList<>(); + list.add("coretech"); + list.add("sports"); + + boolean result = store.processLocalDomains(list); + assertTrue(result); + + assertNotNull(store.getDomainData("coretech")); + assertNull(store.getDomainData("sports")); + File file = new File("/tmp/zts_server_unit_tests/zts_root/sports"); + assertFalse(file.exists()); + } + + @Test + public void testProcessLocalDomainsInvalidLocalDomain() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore setupStore = new DataStore(clogStore, null); + setupStore.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + setupStore.processDomain(signedDomain, true); + + signedDomain = createSignedDomain("sports", "weather"); + setupStore.processDomain(signedDomain, true); + + DataStore store = new DataStore(clogStore, null); + List zmsList = new ArrayList<>(); + zmsList.add("coretech"); + zmsList.add("sports"); + zmsList.add("invalid"); + ((MockZMSFileChangeLogStore) store.changeLogStore).setDomainList(zmsList); + + List list = new ArrayList<>(); + list.add("coretech"); + list.add("sports"); + list.add("invalid"); + + boolean result = store.processLocalDomains(list); + assertFalse(result); + } + + @Test + public void testProcessSignedDomains() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List list = new ArrayList<>(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + list.add(signedDomain); + + signedDomain = createSignedDomain("sports", "weather"); + list.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(list); + + boolean result = store.processSignedDomains(signedDomains); + assertTrue(result); + assertNotNull(store.getDomainData("coretech")); + assertNotNull(store.getDomainData("sports")); + } + + @Test + public void testProcessSignedDomainsNullList() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + boolean result = store.processSignedDomains(null); + assertTrue(result); + } + + @Test + public void testProcessSignedDomainsEmptyList() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(null); + + boolean result = store.processSignedDomains(signedDomains); + assertTrue(result); + } + + @Test + public void testProcessSignedDomainsInvalidDomain() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List list = new ArrayList<>(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + list.add(signedDomain); + + signedDomain = createSignedDomain("sports", "weather"); + signedDomain.setSignature("Invalid0"); + list.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(list); + + boolean result = store.processSignedDomains(signedDomains); + assertFalse(result); + } + + private DataCache createDataCache(String domainName) { + + DataCache dataCache = new DataCache(); + List roles = new ArrayList<>(); + + Role role = new Role(); + role.setName(domainName + ":role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user1"); + role.setMembers(members); + roles.add(role); + dataCache.processRole(role); + + role = new Role(); + role.setName(domainName + ":role.readers"); + members = new ArrayList<>(); + members.add("user_domain.user1"); + members.add("user_domain.user2"); + role.setMembers(members); + roles.add(role); + dataCache.processRole(role); + + role = new Role(); + role.setName(domainName + ":role.writers"); + role.setTrust(domainName + "Trust"); + roles.add(role); + dataCache.processRole(role); + + DomainData domainData = new DomainData(); + domainData.setName(domainName); + domainData.setRoles(roles); + + dataCache.setDomainData(domainData); + return dataCache; + } + + @Test + public void testProcessTrustedDomainDataNull() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user1"; + String role = "coretech:role.admin"; + + Set trustedResources = new HashSet<>(); + trustedResources.add("coretech:role.admin"); + trustedResources.add("coretech:role.readers"); + + store.processTrustedDomain(null, identity, prefix, role, trustedResources, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessTrustedDomainResourcesNull() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + DataCache dataCache = createDataCache("coretech"); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user1"; + String role = "coretech:role.admin"; + + store.processTrustedDomain(dataCache, identity, prefix, role, null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessTrustedDomainMemberRolesNull() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + DataCache dataCache = createDataCache("coretech"); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user3"; + String role = "coretech:role.admin"; + + Set trustedResources = new HashSet<>(); + trustedResources.add("coretech:role.admin"); + trustedResources.add("coretech:role.readers"); + + store.processTrustedDomain(dataCache, identity, prefix, role, trustedResources, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessTrustedDomainNoRole() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + DataCache dataCache = createDataCache("coretech"); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user1"; + + Set trustedResources = new HashSet<>(); + trustedResources.add("coretech:role.admin"); + trustedResources.add("coretech:role.readers"); + + store.processTrustedDomain(dataCache, identity, prefix, null, trustedResources, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("readers")); + } + + @Test + public void testProcessTrustedDomainMemberRoleNotValid() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + DataCache dataCache = createDataCache("coretech"); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user1"; + String role = "coretech:role.writers"; /* invalid role causing no match */ + + Set trustedResources = new HashSet<>(); + trustedResources.add("coretech:role.admin"); + trustedResources.add("coretech:role.readers"); + + store.processTrustedDomain(dataCache, identity, prefix, role, trustedResources, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessTrustedDomainRoleValid() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + DataCache dataCache = createDataCache("coretech"); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user1"; + String role = "coretech:role.admin"; + + Set trustedResources = new HashSet<>(); + trustedResources.add("coretech:role.admin"); + trustedResources.add("coretech:role.readers"); + + store.processTrustedDomain(dataCache, identity, prefix, role, trustedResources, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("admin")); + } + + @Test + public void testProcessTrustedDomainRoleInvalid() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + DataCache dataCache = createDataCache("coretech"); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech2" + ROLE_POSTFIX; /* invalid prefix to cause no match */ + String identity = "user_domain.user1"; + String role = "coretech:role.readers"; + + Set trustedResources = new HashSet<>(); + trustedResources.add("coretech:role.admin"); + trustedResources.add("coretech:role.readers"); + + store.processTrustedDomain(dataCache, identity, prefix, role, trustedResources, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessStandardMembershipMemberRolesNull() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + + store.processStandardMembership(null, prefix, null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessStandardMembershipRoleCheckNull() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processStandardMembership(memberRoles, prefix, null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("readers")); + } + + @Test + public void testProcessStandardMembershipRoleValid() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String roleCheck = "coretech:role.admin"; + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processStandardMembership(memberRoles, prefix, roleCheck, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + } + + @Test + public void testProcessStandardMembershipRoleSuffixValid() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String roleCheck = "admin"; + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processStandardMembership(memberRoles, prefix, roleCheck, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + } + + @Test + public void testProcessStandardMembershipRoleInvalid() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech2" + ROLE_POSTFIX; /* invalid prefix causing no match */ + String roleCheck = "coretech:role.admin"; + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processStandardMembership(memberRoles, prefix, roleCheck, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessStandardMembershipRoleSuffixInValid() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String roleCheck = "2admin"; + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processStandardMembership(memberRoles, prefix, roleCheck, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessTrustMembershipNoTrustDomainMatch() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + signedDomain = createTenantSignedDomain("weather", "coretech"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user100"; + + store.processTrustMembership(store.getCacheStore().getIfPresent("coretech"), identity, + prefix, null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("tenant.readers")); + } + + @Test + public void testProcessTrustMembershipNoTrustDomainMatchRoleCheck() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + signedDomain = createTenantSignedDomain("weather", "coretech"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user100"; + + store.processTrustMembership(store.getCacheStore().getIfPresent("coretech"), identity, prefix, + "coretech:role.tenant.readers", accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("tenant.readers")); + } + + @Test + public void testProcessTrustMembershipNoTrustDomainNoMatch() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + signedDomain = createTenantSignedDomain("weather", "coretech"); + store.processDomain(signedDomain, true); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String identity = "user_domain.user400"; + + store.processTrustMembership(store.getCacheStore().getIfPresent("coretech"), identity, + prefix, null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessDomainUpdatesFromZMSFailure() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).lastModTime = "2014-01-01T12:00:00"; + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(null); + + boolean result = store.processDomainUpdates(); + assertFalse(result); + } + + @Test + public void testProcessDomainUpdatesFromZMSNoTagHeader() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader(null); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + + List domains = new ArrayList<>(); + domains.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(domains); + + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(signedDomains); + + boolean result = store.processDomainUpdates(); + assertFalse(result); + } + + @Test + public void testProcessDomainUpdatesFromZMSInvalidSignedDomain() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader("2014-01-01T12:00:00"); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + signedDomain.setSignature("ABCD"); /* invalidate the signature */ + + List domains = new ArrayList<>(); + domains.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(domains); + + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(signedDomains); + + boolean result = store.processDomainUpdates(); + assertFalse(result); + } + + @Test + public void testProcessDomainUpdatesFromZMS() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader("2014-01-01T12:00:00"); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + List domains = new ArrayList<>(); + + /* we're going to create a new domain */ + + signedDomain = createSignedDomain("sports", "weather"); + domains.add(signedDomain); + + /* we're going to update the coretech domain and set new roles */ + + signedDomain = createSignedDomain("coretech", "weather"); + + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user8"); + role.setMembers(members); + + List roles = new ArrayList<>(); + roles.add(role); + signedDomain.getDomain().setRoles(roles); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(signedDomain.getDomain()), pkey)); + domains.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(domains); + + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(signedDomains); + + boolean result = store.processDomainUpdates(); + assertTrue(result); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user1", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + + accessibleRoles = new ArrayList<>(); + store.getAccessibleRoles(data, "coretech", "user_domain.user8", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("admin")); + + accessibleRoles = new ArrayList<>(); + data = store.getDataCache("sports"); + store.getAccessibleRoles(data, "sports", "user_domain.user", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("writers")); + } + + @Test + public void testProcessDomainUpdatesFromZMSWithUpdater() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + ((MockZMSFileChangeLogStore) store.changeLogStore).setTagHeader("2014-01-01T12:00:00"); + store.loadZMSPublicKeys(); + + SignedDomain signedDomain = createSignedDomain("coretech", "weather"); + store.processDomain(signedDomain, true); + + List domains = new ArrayList<>(); + + /* we're going to create a new domain */ + + signedDomain = createSignedDomain("sports", "weather"); + domains.add(signedDomain); + + /* we're going to update the coretech domain and set new roles */ + + signedDomain = createSignedDomain("coretech", "weather"); + + Role role = new Role(); + role.setName("coretech:role.admin"); + List members = new ArrayList<>(); + members.add("user_domain.user8"); + role.setMembers(members); + + List roles = new ArrayList<>(); + roles.add(role); + signedDomain.getDomain().setRoles(roles); + signedDomain.setSignature(Crypto.sign(SignUtils.asCanonicalString(signedDomain.getDomain()), pkey)); + domains.add(signedDomain); + + SignedDomains signedDomains = new SignedDomains(); + signedDomains.setDomains(domains); + + ((MockZMSFileChangeLogStore) store.changeLogStore).setSignedDomains(signedDomains); + + store.lastDeleteRunTime = System.currentTimeMillis() - 24 * 60 * 60; + DataUpdater updater = store.new DataUpdater(); + updater.run(); + + List accessibleRoles = new ArrayList<>(); + DataCache data = store.getDataCache("coretech"); + store.getAccessibleRoles(data, "coretech", "user_domain.user1", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + + accessibleRoles = new ArrayList<>(); + store.getAccessibleRoles(data, "coretech", "user_domain.user8", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 1); + assertTrue(accessibleRoles.contains("admin")); + + accessibleRoles = new ArrayList<>(); + data = store.getDataCache("sports"); + store.getAccessibleRoles(data, "sports", "user_domain.user", null, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 2); + assertTrue(accessibleRoles.contains("admin")); + assertTrue(accessibleRoles.contains("writers")); + } + + @Test + public void testRoleCheckValueRoleNull() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + assertNull(store.roleCheckValue(null, "coretech:role.")); + } + + @Test + public void testRoleCheckValuePrefixStart() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + String roleCheck = store.roleCheckValue("coretech:role.readers", "coretech:role."); + assertEquals(roleCheck, "coretech:role.readers"); + } + + @Test + public void testRoleCheckValueNoPrefixMatch() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + String roleCheck = store.roleCheckValue("readers", "coretech:role."); + assertEquals(roleCheck, "coretech:role.readers"); + } + + @Test + public void testRoleMatchInSetPlain() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + Set checkSet = new HashSet<>(); + checkSet.add("writers"); + checkSet.add("readers"); + + assertTrue(store.roleMatchInSet("writers", checkSet)); + assertTrue(store.roleMatchInSet("readers", checkSet)); + assertFalse(store.roleMatchInSet("admin", checkSet)); + assertFalse(store.roleMatchInSet("testwriters", checkSet)); + assertFalse(store.roleMatchInSet("writerstest", checkSet)); + } + + @Test + public void testRoleMatchInSetRegex() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + Set checkSet = new HashSet<>(); + checkSet.add("coretech:role.readers"); + checkSet.add("coretech:role.writers"); + checkSet.add("*:role.update"); + checkSet.add("weather:role.*"); + + assertTrue(store.roleMatchInSet("coretech:role.readers", checkSet)); + assertTrue(store.roleMatchInSet("coretech:role.writers", checkSet)); + assertTrue(store.roleMatchInSet("sports:role.update", checkSet)); + assertTrue(store.roleMatchInSet("weather:role.update", checkSet)); + assertFalse(store.roleMatchInSet("coretech:role.admin", checkSet)); + } + + @Test + public void testProcessSingleTrustedDomainRoleNoMatchInSet() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String role = "coretech:role.writers"; /* invalid role causing no match */ + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processSingleTrustedDomainRole(role, prefix, null, memberRoles, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testProcessSingleTrustedDomainRoleAddRoleTrue() { + + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech" + ROLE_POSTFIX; + String role = "coretech:role.readers"; /* invalid role causing no match */ + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processSingleTrustedDomainRole(role, prefix, null, memberRoles, accessibleRoles, false); + assertTrue(accessibleRoles.contains("readers")); + } + + @Test + public void testProcessSingleTrustedDomainRoleAddRoleFalse() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + + List accessibleRoles = new ArrayList<>(); + String prefix = "coretech2" + ROLE_POSTFIX; + String role = "coretech:role.readers"; /* invalid role causing no match */ + + Set memberRoles = new HashSet<>(); + memberRoles.add("coretech:role.admin"); + memberRoles.add("coretech:role.readers"); + + store.processSingleTrustedDomainRole(role, prefix, null, memberRoles, accessibleRoles, false); + assertEquals(accessibleRoles.size(), 0); + } + + @Test + public void testValidDomainListResponseEmpty() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + Set domainList = new HashSet<>(); + assertFalse(store.validDomainListResponse(domainList)); + } + + @Test + public void testValidDomainListResponse() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + Set domainList = new HashSet<>(); + domainList.add("sys.auth"); + domainList.add("coretech"); + domainList.add(userDomain); + assertTrue(store.validDomainListResponse(domainList)); + } + + @Test + public void testValidDomainListResponseNoSysAuth() { + ChangeLogStore clogStore = new MockZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", + pkey, "0"); + DataStore store = new DataStore(clogStore, null); + Set domainList = new HashSet<>(); + domainList.add(userDomain); + domainList.add("coretech"); + assertFalse(store.validDomainListResponse(domainList)); + } +} \ No newline at end of file diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/MockCloudStore.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/MockCloudStore.java new file mode 100644 index 00000000000..03560b2aaab --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/MockCloudStore.java @@ -0,0 +1,148 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store; + +import org.mockito.Mockito; + +import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient; +import com.amazonaws.services.securitytoken.model.AssumeRoleRequest; +import com.amazonaws.services.securitytoken.model.AssumeRoleResult; +import com.amazonaws.services.securitytoken.model.GetCallerIdentityRequest; +import com.amazonaws.services.securitytoken.model.GetCallerIdentityResult; +import com.yahoo.athenz.zts.AWSInstanceInformation; +import com.yahoo.athenz.zts.AWSTemporaryCredentials; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.store.CloudStore; + +public class MockCloudStore extends CloudStore { + + String account = null; + String roleName = null; + String principal = null; + boolean skipSigCheck = false; + boolean returnNullClient = false; + boolean returnSuperAWSRole = false; + int identityCheck = 0; // 0 call super, 1 - true, -1 false + private AssumeRoleResult assumeRoleResult = null; + private GetCallerIdentityResult callerIdentityResult = null; + + public MockCloudStore() { + super(null); + } + + public MockCloudStore(CertSigner certSigner) { + super(certSigner); + } + + @Override + public + boolean isAwsEnabled() { + return true; + } + + public void setMockFields(String account, String roleName, String principal) { + this.account = account; + this.roleName = roleName; + this.principal = principal; + } + + public void skipDocumentSignatureCheck(boolean skipCheck) { + skipSigCheck = skipCheck; + } + + public void setIdentityCheckResult(int idCheck) { + identityCheck = idCheck; + } + + @Override + public + boolean verifyInstanceIdentity(AWSInstanceInformation info) { + boolean result = false; + switch (identityCheck) { + case 0: + result = super.verifyInstanceIdentity(info); + break; + case 1: + result = true; + break; + case -1: + result = false; + break; + } + return result; + } + + @Override + public + boolean validateInstanceDocument(String document, String signature) { + if (skipSigCheck) { + return true; + } + return super.validateInstanceDocument(document, signature); + } + + void setAssumeRoleResult(AssumeRoleResult assumeRoleResult) { + this.assumeRoleResult = assumeRoleResult; + } + + void setGetCallerIdentityResult(GetCallerIdentityResult callerIdentityResult) { + this.callerIdentityResult = callerIdentityResult; + } + + void setReturnNullClient(boolean returnNullClient) { + this.returnNullClient = returnNullClient; + } + + @Override + AWSSecurityTokenServiceClient getTokenServiceClient() { + AWSSecurityTokenServiceClient client = Mockito.mock(AWSSecurityTokenServiceClient.class); + Mockito.when(client.assumeRole(Mockito.any(AssumeRoleRequest.class))).thenReturn(assumeRoleResult); + Mockito.when(client.getCallerIdentity(Mockito.any(GetCallerIdentityRequest.class))).thenReturn(callerIdentityResult); + return client; + } + + @Override + AWSSecurityTokenServiceClient getInstanceClient(AWSInstanceInformation info) { + if (returnNullClient) { + return null; + } else { + AWSSecurityTokenServiceClient client = Mockito.mock(AWSSecurityTokenServiceClient.class); + Mockito.when(client.assumeRole(Mockito.any(AssumeRoleRequest.class))).thenReturn(assumeRoleResult); + Mockito.when(client.getCallerIdentity(Mockito.any(GetCallerIdentityRequest.class))).thenReturn(callerIdentityResult); + return client; + } + } + + void setAssumeAWSRole(boolean returnSuperAWSRole) { + this.returnSuperAWSRole = returnSuperAWSRole; + } + + @Override + public AWSTemporaryCredentials assumeAWSRole(String account, String roleName, String principal) { + + if (!returnSuperAWSRole) { + AWSTemporaryCredentials tempCreds = null; + if (this.account.equals(account) && this.roleName.equals(roleName) + && this.principal.equals(principal)) { + tempCreds = new AWSTemporaryCredentials(); + } + + return tempCreds; + } else { + return super.assumeAWSRole(account, roleName, principal); + } + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/MockZMSFileChangeLogStore.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/MockZMSFileChangeLogStore.java new file mode 100644 index 00000000000..4970b85b32e --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/MockZMSFileChangeLogStore.java @@ -0,0 +1,104 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.file; + +import static org.mockito.Matchers.any; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.security.PrivateKey; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; + +import com.yahoo.athenz.zms.DomainList; +import com.yahoo.athenz.zms.SignedDomains; +import com.yahoo.athenz.zms.ZMSClient; +import com.yahoo.athenz.zms.ZMSClientException; +import com.yahoo.athenz.zts.store.file.ZMSFileChangeLogStore; + +public class MockZMSFileChangeLogStore extends ZMSFileChangeLogStore { + + ZMSClient zms = null; + DomainList domList = null; + String tagHeader = null; + String userDomain; + + private static final String ZMS_USER_DOMAIN = "yahoo.zms.user_domain"; + + public MockZMSFileChangeLogStore(String rootDirectory, PrivateKey privateKey, String privateKeyId) { + + super(rootDirectory, privateKey, privateKeyId); + zms = mock(ZMSClient.class); + + // setup some default values to return when the store is initialized + // we're going to return on domain for local list and then another + // for server list - thus ending up with initialized store with no domains + + userDomain = System.getProperty(ZMS_USER_DOMAIN, "user"); + + DomainList localDomainList = new DomainList(); + List localDomains = new ArrayList<>(); + localDomains.add(userDomain); + localDomainList.setNames(localDomains); + + DomainList serverDomainList = new DomainList(); + List serverDomains = new ArrayList<>(); + serverDomains.add("sys"); + serverDomainList.setNames(serverDomains); + + tagHeader = "2014-01-01T12:00:00"; + when(zms.getDomainList()).thenReturn(localDomainList).thenReturn(serverDomainList); + + } + + @Override + public ZMSClient getZMSClient() { + return zms; + } + + public void setDomainList(List domains) { + if (domains != null) { + domList = new DomainList(); + domList.setNames(domains); + when(zms.getDomainList()).thenReturn(domList); + } else { + when(zms.getDomainList()).thenThrow(new ZMSClientException(500, "Invalid request")); + } + } + + @SuppressWarnings("unchecked") + public void setSignedDomains(SignedDomains signedDomains) { + if (signedDomains != null) { + when(zms.getSignedDomains(any(String.class), any(String.class), any(String.class), any(Map.class))).thenReturn(signedDomains); + } else { + when(zms.getSignedDomains(any(String.class), any(String.class), any(String.class), any(Map.class))).thenThrow(new ZMSClientException(500, "Invalid request")); + } + } + + public void setTagHeader(String tagHeader) { + this.tagHeader = tagHeader; + } + + @Override + public String retrieveTagHeader(Map> responseHeaders) { + if (tagHeader == null) { + return super.retrieveTagHeader(responseHeaders); + } else { + return tagHeader; + } + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/MockZMSFileChangeLogStoreFactory.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/MockZMSFileChangeLogStoreFactory.java new file mode 100644 index 00000000000..91ea96f2461 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/MockZMSFileChangeLogStoreFactory.java @@ -0,0 +1,31 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.file; + +import java.security.PrivateKey; + +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.ChangeLogStoreFactory; +import com.yahoo.athenz.zts.store.CloudStore; + +public class MockZMSFileChangeLogStoreFactory implements ChangeLogStoreFactory { + + @Override + public ChangeLogStore create(String ztsHomeDir, PrivateKey privateKey, + String privateKeyId, CloudStore cloudStore) { + return new MockZMSFileChangeLogStore(ztsHomeDir, privateKey, privateKeyId); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreFactoryTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreFactoryTest.java new file mode 100644 index 00000000000..5f3a39c1b1a --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreFactoryTest.java @@ -0,0 +1,46 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.file; + +import static org.testng.Assert.assertNotNull; + +import java.io.File; +import java.security.PrivateKey; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.file.ZMSFileChangeLogStoreFactory; + +public class ZMSFileChangeLogStoreFactoryTest { + + static final String ZTS_DATA_STORE_PATH = "/tmp/zts_server_unit_tests/zts_root"; + + @Test + public void testCreateStore() { + + String privKeyName = System.getProperty(ZTSConsts.ZTS_PROP_PRIVATE_KEY); + File privKeyFile = new File(privKeyName); + String privKey = Crypto.encodedFile(privKeyFile); + PrivateKey pkey = Crypto.loadPrivateKey(Crypto.ybase64DecodeString(privKey)); + + ZMSFileChangeLogStoreFactory factory = new ZMSFileChangeLogStoreFactory(); + ChangeLogStore store = factory.create(ZTS_DATA_STORE_PATH, pkey, "0", null); + assertNotNull(store); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreTest.java new file mode 100644 index 00000000000..e9b6e7474b9 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/file/ZMSFileChangeLogStoreTest.java @@ -0,0 +1,219 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.file; + +import static org.testng.Assert.*; + +import java.io.File; +import java.io.FileOutputStream; +import java.io.IOException; +import java.util.List; + +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zts.store.file.ZMSFileChangeLogStore; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Struct; + +public class ZMSFileChangeLogStoreTest { + + private final String FSTORE_PATH = "/tmp/zts_file_store_unit_test"; + + private void touch(String fname) throws IOException { + + File file = new File(fname); + + if (!file.exists()) { + new FileOutputStream(file).close(); + } + + file.setLastModified(System.currentTimeMillis()); + } + + @BeforeMethod + public void setup() { + ZMSFileChangeLogStore.deleteDirectory(new File(FSTORE_PATH)); + } + + @AfterMethod + public void shutdown() { + ZMSFileChangeLogStore.deleteDirectory(new File(FSTORE_PATH)); + } + + @Test + public void FileStructStoreValidDir() { + + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + assertNotNull(fstore); + } + + @Test + public void FileStructStoreInvalid() { + + try { + File rootDir = new File(FSTORE_PATH); + rootDir.mkdirs(); + + String fpath = FSTORE_PATH + "/zts_file.tmp"; + touch(fpath); + + @SuppressWarnings("unused") + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(fpath, null, null); + fail(); + } catch (RuntimeException | IOException ex) { + assertTrue(true); + } + } + + @Test + public void getNonExistent() { + + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + Struct st = fstore.get("NotExistent", Struct.class); + assertNull(st); + } + + @Test + public void getExistent() { + + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + Struct data = new Struct(); + data.put("key", "val1"); + fstore.put("test1", JSON.bytes(data)); + + Struct st = fstore.get("test1", Struct.class); + assertNotNull(st); + assertEquals(st.get("key"), "val1"); + } + + @Test + public void deleteExistent() { + + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + Struct data = new Struct(); + data.put("key", "val1"); + fstore.put("test1", JSON.bytes(data)); + + fstore.delete("test1"); + Struct st = fstore.get("test1", Struct.class); + assertNull(st); + } + + @Test + public void deleteNonExistent() { + + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + + fstore.delete("test1"); + assertTrue(true); + } + + @Test + public void scanEmpty() { + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + List ls = fstore.scan(); + assertEquals(ls.size(), 0); + } + + @Test + public void scanSingle() { + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + Struct data = new Struct(); + data.put("key", "val1"); + fstore.put("test1", JSON.bytes(data)); + + List ls = fstore.scan(); + assertEquals(ls.size(), 1); + assertTrue(ls.contains("test1")); + } + + @Test + public void scanMultiple() { + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + + Struct data = new Struct(); + data.put("key", "val1"); + fstore.put("test1", JSON.bytes(data)); + + data = new Struct(); + data.put("key", "val1"); + fstore.put("test2", JSON.bytes(data)); + + data = new Struct(); + data.put("key", "val1"); + fstore.put("test3", JSON.bytes(data)); + + List ls = fstore.scan(); + assertEquals(ls.size(), 3); + assertTrue(ls.contains("test1")); + assertTrue(ls.contains("test2")); + assertTrue(ls.contains("test3")); + } + + @Test + public void scanHidden() { + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + + Struct data = new Struct(); + data.put("key", "val1"); + fstore.put("test1", JSON.bytes(data)); + + data = new Struct(); + data.put("key", "val1"); + fstore.put(".test2", JSON.bytes(data)); + + data = new Struct(); + data.put("key", "val1"); + fstore.put(".test3", JSON.bytes(data)); + + List ls = fstore.scan(); + assertEquals(ls.size(), 1); + assertTrue(ls.contains("test1")); + } + + @Test + public void scanDelete() { + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + + Struct data = new Struct(); + data.put("key", "val1"); + fstore.put("test1", JSON.bytes(data)); + + data = new Struct(); + data.put("key", "val1"); + fstore.put("test2", JSON.bytes(data)); + + data = new Struct(); + data.put("key", "val1"); + fstore.put("test3", JSON.bytes(data)); + + fstore.delete("test2"); + + List ls = fstore.scan(); + assertEquals(ls.size(), 2); + assertTrue(ls.contains("test1")); + assertTrue(ls.contains("test3")); + } + + @Test + public void testFullRefreshSupport() { + + ZMSFileChangeLogStore fstore = new ZMSFileChangeLogStore(FSTORE_PATH, null, null); + assertTrue(fstore.supportsFullRefresh()); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/MockS3ChangeLogStore.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/MockS3ChangeLogStore.java new file mode 100644 index 00000000000..3a2cf2ddf66 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/MockS3ChangeLogStore.java @@ -0,0 +1,38 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.s3; + +import static org.mockito.Mockito.mock; + +import com.amazonaws.services.s3.AmazonS3; +import com.yahoo.athenz.zts.store.CloudStore; +import com.yahoo.athenz.zts.store.s3.S3ChangeLogStore; + +public class MockS3ChangeLogStore extends S3ChangeLogStore { + + AmazonS3 s3 = null; + + public MockS3ChangeLogStore(CloudStore cloudStore) { + super(cloudStore); + s3 = mock(AmazonS3.class); + } + + @Override + AmazonS3 getS3Client() { + return s3; + } + +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/MockS3ChangeLogStoreFactory.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/MockS3ChangeLogStoreFactory.java new file mode 100644 index 00000000000..c704e7bfc49 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/MockS3ChangeLogStoreFactory.java @@ -0,0 +1,31 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.s3; + +import java.security.PrivateKey; + +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.CloudStore; +import com.yahoo.athenz.zts.store.s3.S3ChangeLogStoreFactory; + +public class MockS3ChangeLogStoreFactory extends S3ChangeLogStoreFactory { + + @Override + public ChangeLogStore create(String ztsHomeDir, PrivateKey privateKey, + String privateKeyId, CloudStore cloudStore) { + return new MockS3ChangeLogStore(cloudStore); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreFactoryTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreFactoryTest.java new file mode 100644 index 00000000000..a85c26131ba --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreFactoryTest.java @@ -0,0 +1,33 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.s3; + +import org.testng.annotations.Test; + +import com.yahoo.athenz.zts.store.ChangeLogStore; +import com.yahoo.athenz.zts.store.s3.S3ChangeLogStoreFactory; + +import static org.testng.Assert.*; + +public class S3ChangeLogStoreFactoryTest { + + @Test + public void testCreateStore() { + S3ChangeLogStoreFactory factory = new S3ChangeLogStoreFactory(); + ChangeLogStore store = factory.create(null, null, null, null); + assertNotNull(store); + } +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreTest.java new file mode 100644 index 00000000000..cf0f8395303 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/store/s3/S3ChangeLogStoreTest.java @@ -0,0 +1,457 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.store.s3; + +import static org.mockito.Matchers.any; +import static org.mockito.Mockito.*; +import static org.testng.Assert.*; + +import java.io.FileInputStream; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.Date; +import java.util.List; +import java.util.Set; + +import org.apache.http.client.methods.HttpRequestBase; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.BeforeMethod; +import org.testng.annotations.Test; + +import com.amazonaws.AmazonClientException; +import com.amazonaws.AmazonServiceException; +import com.amazonaws.services.s3.model.GetObjectRequest; +import com.amazonaws.services.s3.model.ListObjectsRequest; +import com.amazonaws.services.s3.model.ObjectListing; +import com.amazonaws.services.s3.model.S3Object; +import com.amazonaws.services.s3.model.S3ObjectInputStream; +import com.amazonaws.services.s3.model.S3ObjectSummary; +import com.yahoo.athenz.zms.DomainData; +import com.yahoo.athenz.zms.SignedDomain; +import com.yahoo.athenz.zms.SignedDomains; +import com.yahoo.athenz.zts.store.s3.S3ChangeLogStore; + +public class S3ChangeLogStoreTest { + + @BeforeMethod + public void setup() { + } + + @AfterMethod + public void shutdown() { + } + + @Test + public void testFullRefreshSupport() { + + S3ChangeLogStore store = new S3ChangeLogStore(null); + assertFalse(store.supportsFullRefresh()); + } + + @Test + public void testNoOpMethods() { + S3ChangeLogStore store = new S3ChangeLogStore(null); + store.removeLocalDomain("iaas.athenz"); + store.saveLocalDomain("iaas.athenz", null); + } + + @Test + public void testSetLastModificationTimestamp() { + S3ChangeLogStore store = new S3ChangeLogStore(null); + assertEquals(store.lastModTime, 0); + + store.setLastModificationTimestamp("12345"); + assertEquals(store.lastModTime, 12345); + + store.setLastModificationTimestamp(null); + assertEquals(store.lastModTime, 0); + } + + @Test + public void testListObjectsAllObjectsNoPage() { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + ArrayList objectList = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectList.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectList.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()).thenReturn(objectList); + when(objectListing.isTruncated()).thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + + ArrayList domains = new ArrayList<>(); + store.listObjects(store.s3, domains, 0); + + assertEquals(domains.size(), 2); + assertTrue(domains.contains("iaas")); + assertTrue(domains.contains("iaas.athenz")); + } + + @Test + public void testListObjectsAllObjectsNoPageModTime() { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + ArrayList objectList = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectSummary.setLastModified(new Date(100)); + objectList.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectSummary.setLastModified(new Date(200)); + objectList.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()).thenReturn(objectList); + when(objectListing.isTruncated()).thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + + ArrayList domains = new ArrayList<>(); + store.listObjects(store.s3, domains, (new Date(150)).getTime()); + + assertEquals(domains.size(), 1); + assertTrue(domains.contains("iaas.athenz")); + } + + @Test + public void testListObjectsAllObjectsMultiplePages() { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + ArrayList objectList1 = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectList1.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectList1.add(objectSummary); + + ArrayList objectList2 = new ArrayList<>(); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("cd"); + objectList2.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("cd.docker"); + objectList2.add(objectSummary); + + ArrayList objectList3 = new ArrayList<>(); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("platforms"); + objectList3.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("platforms.mh2"); + objectList3.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()) + .thenReturn(objectList1) + .thenReturn(objectList2) + .thenReturn(objectList3); + when(objectListing.isTruncated()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + when(store.s3.listNextBatchOfObjects(any(ObjectListing.class))).thenReturn(objectListing); + + ArrayList domains = new ArrayList<>(); + store.listObjects(store.s3, domains, 0); + + assertEquals(domains.size(), 6); + assertTrue(domains.contains("iaas")); + assertTrue(domains.contains("iaas.athenz")); + assertTrue(domains.contains("cd")); + assertTrue(domains.contains("cd.docker")); + assertTrue(domains.contains("platforms")); + assertTrue(domains.contains("platforms.mh2")); + } + + @Test + public void testListObjectsAllObjectsMultiplePagesModTime() { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + ArrayList objectList1 = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectSummary.setLastModified(new Date(100)); + objectList1.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectSummary.setLastModified(new Date(100)); + objectList1.add(objectSummary); + + ArrayList objectList2 = new ArrayList<>(); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("cd"); + objectSummary.setLastModified(new Date(100)); + objectList2.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("cd.docker"); + objectSummary.setLastModified(new Date(200)); + objectList2.add(objectSummary); + + ArrayList objectList3 = new ArrayList<>(); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("platforms"); + objectSummary.setLastModified(new Date(200)); + objectList3.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("platforms.mh2"); + objectSummary.setLastModified(new Date(200)); + objectList3.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()) + .thenReturn(objectList1) + .thenReturn(objectList2) + .thenReturn(objectList3); + when(objectListing.isTruncated()) + .thenReturn(true) + .thenReturn(true) + .thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + when(store.s3.listNextBatchOfObjects(any(ObjectListing.class))).thenReturn(objectListing); + + ArrayList domains = new ArrayList<>(); + store.listObjects(store.s3, domains, (new Date(150)).getTime()); + + assertEquals(domains.size(), 3); + assertTrue(domains.contains("cd.docker")); + assertTrue(domains.contains("platforms")); + assertTrue(domains.contains("platforms.mh2")); + } + + @Test + public void testGetLocalDomains() { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + ArrayList objectList = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectList.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectList.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()).thenReturn(objectList); + when(objectListing.isTruncated()).thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + + // verify that our last mod time is 0 before the call + + assertEquals(store.lastModTime, 0); + + // retrieve the list of domains + + List domains = store.getLocalDomainList(); + + assertEquals(domains.size(), 2); + assertTrue(domains.contains("iaas")); + assertTrue(domains.contains("iaas.athenz")); + + // also verify that last mod time is updated + + assertTrue(store.lastModTime > 0); + } + + @Test + public void testGetServerDomains() { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + ArrayList objectList = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectList.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectList.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()).thenReturn(objectList); + when(objectListing.isTruncated()).thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + + // verify that our last mod time is 0 before the call + + assertEquals(store.lastModTime, 0); + + // retrieve the list of domains + + Set domains = store.getServerDomainList(); + + assertEquals(domains.size(), 2); + assertTrue(domains.contains("iaas")); + assertTrue(domains.contains("iaas.athenz")); + + // also verify that last mod time is not updated + + assertEquals(store.lastModTime, 0); + } + + @Test + public void testGetSignedDomainNotFound() { + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + when(store.s3.getObject(any(GetObjectRequest.class))).thenReturn((S3Object) null); + + assertNull(store.getSignedDomain(store.s3, "iaas")); + } + + @Test + public void testGetSignedDomainClientException() { + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + when(store.s3.getObject(any(GetObjectRequest.class))).thenThrow(new AmazonClientException("failed client operation")); + assertNull(store.getSignedDomain(store.s3, "iaas")); + } + + @Test + public void testGetSignedDomainServiceException() { + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + when(store.s3.getObject(any(GetObjectRequest.class))).thenThrow(new AmazonServiceException("failed server operation")); + assertNull(store.getSignedDomain(store.s3, "iaas")); + } + + private class MockS3ObjectInputStream extends S3ObjectInputStream { + public MockS3ObjectInputStream(InputStream in, HttpRequestBase httpRequest) { + super(in, httpRequest); + } + } + + @Test + public void testGetSignedDomainInternal() throws IOException { + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + InputStream is = new FileInputStream("src/test/resources/iaas.json"); + MockS3ObjectInputStream s3Is = new MockS3ObjectInputStream(is, null); + + S3Object object = mock(S3Object.class); + when(object.getObjectContent()).thenReturn(s3Is); + + when(store.s3.getObject(any(GetObjectRequest.class))).thenReturn(object); + + SignedDomain signedDomain = store.getSignedDomain(store.s3, "iaas"); + assertNotNull(signedDomain); + DomainData domainData = signedDomain.getDomain(); + assertNotNull(domainData); + assertEquals(domainData.getName(), "iaas"); + is.close(); + } + + @Test + public void testGetSignedDomain() throws IOException { + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + InputStream is = new FileInputStream("src/test/resources/iaas.json"); + MockS3ObjectInputStream s3Is = new MockS3ObjectInputStream(is, null); + + S3Object object = mock(S3Object.class); + when(object.getObjectContent()).thenReturn(s3Is); + + when(store.s3.getObject(any(GetObjectRequest.class))).thenReturn(object); + + SignedDomain signedDomain = store.getSignedDomain("iaas"); + assertNotNull(signedDomain); + DomainData domainData = signedDomain.getDomain(); + assertNotNull(domainData); + assertEquals(domainData.getName(), "iaas"); + is.close(); + } + + @Test + public void testGetUpdatedSignedDomainsNoChanges() { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + ArrayList objectList = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectSummary.setLastModified(new Date(100)); + objectList.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectSummary.setLastModified(new Date(200)); + objectList.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()).thenReturn(objectList); + when(objectListing.isTruncated()).thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + + // set the last modification time to not return any of the domains + store.lastModTime = (new Date(250)).getTime(); + + StringBuilder lastModTimeBuffer = new StringBuilder(512); + SignedDomains signedDomains = store.getUpdatedSignedDomains(lastModTimeBuffer); + assertTrue(lastModTimeBuffer.length() > 0); + assertEquals(signedDomains.getDomains().size(), 0); + } + + @Test + public void testGetUpdatedSignedDomainsWithChange() throws FileNotFoundException { + + MockS3ChangeLogStore store = new MockS3ChangeLogStore(null); + + ArrayList objectList = new ArrayList<>(); + S3ObjectSummary objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas"); + objectSummary.setLastModified(new Date(100)); + objectList.add(objectSummary); + objectSummary = new S3ObjectSummary(); + objectSummary.setKey("iaas.athenz"); + objectSummary.setLastModified(new Date(200)); + objectList.add(objectSummary); + + ObjectListing objectListing = mock(ObjectListing.class); + when(objectListing.getObjectSummaries()).thenReturn(objectList); + when(objectListing.isTruncated()).thenReturn(false); + when(store.s3.listObjects(any(ListObjectsRequest.class))).thenReturn(objectListing); + + InputStream is = new FileInputStream("src/test/resources/iaas.json"); + MockS3ObjectInputStream s3Is = new MockS3ObjectInputStream(is, null); + + S3Object object = mock(S3Object.class); + when(object.getObjectContent()).thenReturn(s3Is); + + when(store.s3.getObject(any(GetObjectRequest.class))).thenReturn(object); + + // set the last modification time to return one of the domains + store.lastModTime = (new Date(150)).getTime(); + + StringBuilder lastModTimeBuffer = new StringBuilder(512); + SignedDomains signedDomains = store.getUpdatedSignedDomains(lastModTimeBuffer); + assertTrue(lastModTimeBuffer.length() > 0); + + List domainList = signedDomains.getDomains(); + assertEquals(domainList.size(), 1); + + DomainData domainData = domainList.get(0).getDomain(); + assertNotNull(domainData); + assertEquals(domainData.getName(), "iaas"); + } + +} diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/utils/ZTSUtilsTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/utils/ZTSUtilsTest.java new file mode 100644 index 00000000000..7c66ef026a4 --- /dev/null +++ b/servers/zts/src/test/java/com/yahoo/athenz/zts/utils/ZTSUtilsTest.java @@ -0,0 +1,164 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zts.utils; + +import static org.testng.Assert.assertEquals; +import static org.testng.Assert.assertFalse; +import static org.testng.Assert.assertNotNull; +import static org.testng.Assert.assertNull; +import static org.testng.Assert.assertTrue; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; + +import org.eclipse.jetty.util.ssl.SslContextFactory; +import org.mockito.Mockito; +import org.testng.annotations.AfterMethod; +import org.testng.annotations.Test; + +import com.yahoo.athenz.zts.Identity; +import com.yahoo.athenz.zts.ZTSConsts; +import com.yahoo.athenz.zts.cert.CertSigner; +import com.yahoo.athenz.zts.utils.ZTSUtils; + +public class ZTSUtilsTest { + + @AfterMethod + public void cleanup() { + System.clearProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH); + System.clearProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE); + System.clearProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD); + System.clearProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH); + System.clearProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE); + System.clearProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD); + System.clearProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD); + System.clearProperty(ZTSConsts.ZTS_PROP_EXCLUDED_CIPHER_SUITES); + System.clearProperty(ZTSConsts.ZTS_PROP_EXCLUDED_PROTOCOLS); + System.clearProperty(ZTSConsts.ZTS_PROP_WANT_CLIENT_CERT); + } + + @Test + public void testRetrieveConfigSetting() { + + System.setProperty("prop1", "1001"); + assertEquals(1001, ZTSUtils.retrieveConfigSetting("prop1", 99)); + assertEquals(99, ZTSUtils.retrieveConfigSetting("prop2", 99)); + + System.setProperty("prop1", "-101"); + assertEquals(99, ZTSUtils.retrieveConfigSetting("prop1", 99)); + + System.setProperty("prop1", "0"); + assertEquals(99, ZTSUtils.retrieveConfigSetting("prop1", 99)); + + System.setProperty("prop1", "abc"); + assertEquals(99, ZTSUtils.retrieveConfigSetting("prop1", 99)); + } + + @Test + public void testCreateSSLContextObject() { + + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_EXCLUDED_CIPHER_SUITES, ZTSUtils.ZTS_DEFAULT_EXCLUDED_CIPHER_SUITES); + System.setProperty(ZTSConsts.ZTS_PROP_EXCLUDED_PROTOCOLS, ZTSUtils.ZTS_DEFAULT_EXCLUDED_PROTOCOLS); + System.setProperty(ZTSConsts.ZTS_PROP_WANT_CLIENT_CERT, "true"); + + SslContextFactory sslContextFactory = ZTSUtils.createSSLContextObject(null); + assertNotNull(sslContextFactory); + assertEquals(sslContextFactory.getKeyStorePath(), "file:///tmp/keystore"); + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getTrustStoreResource().toString(), "file:///tmp/truststore"); + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getExcludeCipherSuites(), ZTSUtils.ZTS_DEFAULT_EXCLUDED_CIPHER_SUITES.split(",")); + assertEquals(sslContextFactory.getExcludeProtocols(), ZTSUtils.ZTS_DEFAULT_EXCLUDED_PROTOCOLS.split(",")); + assertTrue(sslContextFactory.getWantClientAuth()); + } + + @Test + public void testCreateSSLContextObjectNoValues() { + + SslContextFactory sslContextFactory = ZTSUtils.createSSLContextObject(null); + + assertNotNull(sslContextFactory); + assertFalse(sslContextFactory.getWantClientAuth()); + assertNull(sslContextFactory.getKeyStoreResource()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertNull(sslContextFactory.getTrustStore()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + } + + @Test + public void testCreateSSLContextObjectNoKeyStore() { + + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PATH, "file:///tmp/truststore"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_TRUSTSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYMANAGER_PASSWORD, "pass123"); + + SslContextFactory sslContextFactory = ZTSUtils.createSSLContextObject(null); + assertNotNull(sslContextFactory); + assertFalse(sslContextFactory.getWantClientAuth()); + assertNull(sslContextFactory.getKeyStoreResource()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getTrustStoreResource().toString(), "file:///tmp/truststore"); + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + } + + @Test + public void testCreateSSLContextObjectNoTrustStore() { + + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PATH, "file:///tmp/keystore"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_TYPE, "PKCS12"); + System.setProperty(ZTSConsts.ZTS_PROP_KEYSTORE_PASSWORD, "pass123"); + System.setProperty(ZTSConsts.ZTS_PROP_EXCLUDED_CIPHER_SUITES, ZTSUtils.ZTS_DEFAULT_EXCLUDED_CIPHER_SUITES); + System.setProperty(ZTSConsts.ZTS_PROP_EXCLUDED_PROTOCOLS, ZTSUtils.ZTS_DEFAULT_EXCLUDED_PROTOCOLS); + System.setProperty(ZTSConsts.ZTS_PROP_WANT_CLIENT_CERT, "true"); + + SslContextFactory sslContextFactory = ZTSUtils.createSSLContextObject(null); + assertNotNull(sslContextFactory); + assertTrue(sslContextFactory.getWantClientAuth()); + assertEquals(sslContextFactory.getKeyStorePath(), "file:///tmp/keystore"); + assertEquals(sslContextFactory.getKeyStoreType(), "PKCS12"); + assertNull(sslContextFactory.getTrustStoreResource()); + // store type always defaults to PKCS12 + assertEquals(sslContextFactory.getTrustStoreType(), "PKCS12"); + assertEquals(sslContextFactory.getExcludeCipherSuites(), ZTSUtils.ZTS_DEFAULT_EXCLUDED_CIPHER_SUITES.split(",")); + assertEquals(sslContextFactory.getExcludeProtocols(), ZTSUtils.ZTS_DEFAULT_EXCLUDED_PROTOCOLS.split(",")); + } + + @Test + public void testGenerateIdentityFailure() throws IOException { + + CertSigner certSigner = Mockito.mock(CertSigner.class); + Mockito.when(certSigner.generateX509Certificate(Mockito.anyString())).thenReturn(null); + + Path path = Paths.get("src/test/resources/valid.csr"); + String csr = new String(Files.readAllBytes(path)); + + Identity identity = ZTSUtils.generateIdentity(certSigner, csr, "iaas.athens.syncer", "pem"); + assertNull(identity); + } +} diff --git a/servers/zts/src/test/resources/athenz.conf b/servers/zts/src/test/resources/athenz.conf new file mode 100644 index 00000000000..ec0debdf29d --- /dev/null +++ b/servers/zts/src/test/resources/athenz.conf @@ -0,0 +1,20 @@ +{ +"zmsUrl": "http://localhost:10080/", +"ztsUrl": "http://localhost:8080/", +"ztsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } +], +"zmsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + }, + { + "id": "zms.dev.0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFSXJ1ZTJtUkF1WkdmdEZyZmQ2RW55bEFCNnFpSgpUQXE0bE11TTQ0alZOVHNTb0JBVlAzYmVwRFZuWDdZOTZOT1JtMHdENE01RzVNTm44czBhUys1TzdnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg--" + } +] +} diff --git a/servers/zts/src/test/resources/iaas.json b/servers/zts/src/test/resources/iaas.json new file mode 100644 index 00000000000..bb701e3dd9d --- /dev/null +++ b/servers/zts/src/test/resources/iaas.json @@ -0,0 +1 @@ +{"domain":{"roles":[{"modified":"2016-03-31T16:40:44.544Z","name":"iaas:role.admin","members":["yby.hga","yby.zms_test_admin"]}],"policies":{"contents":{"domain":"iaas","policies":[{"modified":"2016-03-31T16:40:44.546Z","assertions":[{"role":"iaas:role.admin","action":"*","effect":"ALLOW","resource":"iaas:*"}],"name":"iaas:policy.admin"}]},"keyId":"zms.dev.0","signature":"MEUCID0ciS7zBGIEJbUo2aIamnwcA4K_Sx4HtE1LZkPCtZKKAiEA9sAufsEnjODZM8U1p4EOqObJZ9L2Szna_qwsFtinm0U-"},"modified":"2016-03-31T16:40:45.128Z","services":[],"name":"iaas"},"keyId":"zms.dev.0","signature":"MEQCIBl9i0P.apXlpPJ7NCl1FMOHCHTPBgazwtHcEflDIIB1AiA3IUSh7CEDRUXM3PkjU8hBT6XNnXQRLT2ywi2Q0ZciMw--"} \ No newline at end of file diff --git a/servers/zts/src/test/resources/logback.xml b/servers/zts/src/test/resources/logback.xml new file mode 100644 index 00000000000..9e4d06ad246 --- /dev/null +++ b/servers/zts/src/test/resources/logback.xml @@ -0,0 +1,57 @@ + + + + + + + System.out + + >%d{HH:mm:ss.SSS} [%thread] %-5level %class - %msg%n + + + + + + + ${LOG_DIR}/server.log + true + + + ${LOG_DIR}/server.%d{yyyy-MM-dd}.log + 7 + true + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n + + + + + + + ${LOG_DIR}/audit.log + true + + + ${LOG_DIR}/audit.%d{yyyy-MM-dd}.log + 7 + true + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n + + + + + + + + + + + + + + diff --git a/servers/zts/src/test/resources/private_encrypted.key b/servers/zts/src/test/resources/private_encrypted.key new file mode 100644 index 00000000000..dbefd0227b0 --- /dev/null +++ b/servers/zts/src/test/resources/private_encrypted.key @@ -0,0 +1,10 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIBeTAbBgkqhkiG9w0BBQMwDgQITzfDOS9/ungCAggABIIBWEc5vdvKj55j5NRs +fFmvBeF/OoTJ2/M1yClq4D3RILOzwb8HQ2EN6YtlOxzQK9r/5FXUi9sgYPi9nrHG +4pQFFpQapZ7TbIYZ1As6WXHDaju1Dt+mO5See11TV8VW6SvAk1V8mWcGnwpaqH2g +ZdGb1tmOxky0kCr31rb0mpWp6kFccvkjX+dve2K4AWS59SeK5MVdjiBFRyQ2+qga +rFp4kCn15orSc2xrkyiAXiacUvs1ixp7poJCv2y7oAcItEJ1pAjV8UHEzau0rgHq +JJhJGD6d5o1Pt4dMtQhdxOvjpPfz6d3qFHIoYNwYAtkVxHowQ8Uv0I3sXjKFwMqU +zqztXXYH23BOq+OrxDNIiqnNtbOOhrv2SE2Tn342OGd001JfgXhyJSPugztN5NvB +L5o4dPYUp1wbBBoG52nzqd44LDy1v5tyzijhlyoo+YzVwfiMHK1rb8sEwO4U +-----END ENCRYPTED PRIVATE KEY----- diff --git a/servers/zts/src/test/resources/test_private.v1 b/servers/zts/src/test/resources/test_private.v1 new file mode 100644 index 00000000000..0044591884d --- /dev/null +++ b/servers/zts/src/test/resources/test_private.v1 @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- \ No newline at end of file diff --git a/servers/zts/src/test/resources/test_public.v1 b/servers/zts/src/test/resources/test_public.v1 new file mode 100644 index 00000000000..61accb7bc31 --- /dev/null +++ b/servers/zts/src/test/resources/test_public.v1 @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- \ No newline at end of file diff --git a/servers/zts/src/test/resources/valid.csr b/servers/zts/src/test/resources/valid.csr new file mode 100644 index 00000000000..6c6bbd517be --- /dev/null +++ b/servers/zts/src/test/resources/valid.csr @@ -0,0 +1,8 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIIBGjCBxQIBADBgMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcT +CVN1bm55dmFsZTEYMBYGA1UEChMPTXkgVGVzdCBDb21wYW55MRYwFAYDVQQDEw1h +dGhlbnouc3luY2VyMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrvfvBgXWqWAorw +5hYJu3dpOJe0gp3nTgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwm +Yw2uMK8CAwEAAaAAMA0GCSqGSIb3DQEBBQUAA0EANa7mSdMKoQc1OZPM6qhpp2Vi +49bRxbXLvRLE9f6rbIDkvjgPenpLw2xWgOdtwYcTy9TK0PCWB6dOSk4fkN+bBQ== +-----END CERTIFICATE REQUEST----- diff --git a/servers/zts/src/test/resources/valid_cn_x509.cert b/servers/zts/src/test/resources/valid_cn_x509.cert new file mode 100644 index 00000000000..805615e10e5 --- /dev/null +++ b/servers/zts/src/test/resources/valid_cn_x509.cert @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE----- +MIICfzCCAimgAwIBAgIJAMIRugkwe7mwMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV +BAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU3Vubnl2YWxlMRgwFgYDVQQK +Ew9NeSBUZXN0IENvbXBhbnkxFjAUBgNVBAMTDWF0aGVuei5zeW5jZXIwHhcNMTYx +MjA5MjE1NDQ2WhcNMTcxMjA5MjE1NDQ2WjBgMQswCQYDVQQGEwJVUzELMAkGA1UE +CBMCQ0ExEjAQBgNVBAcTCVN1bm55dmFsZTEYMBYGA1UEChMPTXkgVGVzdCBDb21w +YW55MRYwFAYDVQQDEw1hdGhlbnouc3luY2VyMFwwDQYJKoZIhvcNAQEBBQADSwAw +SAJBANImoEeD7LU+x6x5dAnNRFtrbab2yxrDXFXdwKQxlIs2PWfLeo3Xq0e2bOU6 +kQDgFz/IkMN3tEyDgQ/Nv0eAbckCAwEAAaOBxTCBwjAdBgNVHQ4EFgQUBi0msMNX +iC2XLpKjXPz1DMf9PoEwgZIGA1UdIwSBijCBh4AUBi0msMNXiC2XLpKjXPz1DMf9 +PoGhZKRiMGAxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU3Vu +bnl2YWxlMRgwFgYDVQQKEw9NeSBUZXN0IENvbXBhbnkxFjAUBgNVBAMTDWF0aGVu +ei5zeW5jZXKCCQDCEboJMHu5sDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA +A0EAPnVkUdicQzk1809lHNyhSqb6p+kxjC52RfI8bZ+kACOppLLCpNu3nuuh+9yT +J1U2YLjE774n48u74k7EEmvJ3A== +-----END CERTIFICATE----- diff --git a/servers/zts/src/test/resources/zts_private.pem b/servers/zts/src/test/resources/zts_private.pem new file mode 100644 index 00000000000..356e1edf8bd --- /dev/null +++ b/servers/zts/src/test/resources/zts_private.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- diff --git a/servers/zts/src/test/resources/zts_public.pem b/servers/zts/src/test/resources/zts_public.pem new file mode 100644 index 00000000000..727c3c67f22 --- /dev/null +++ b/servers/zts/src/test/resources/zts_public.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- diff --git a/utils/zms_cli/README.md b/utils/zms_cli/README.md new file mode 100644 index 00000000000..3de1d5720b1 --- /dev/null +++ b/utils/zms_cli/README.md @@ -0,0 +1,11 @@ +zms-cli +======= + +ZMS Client application in go to manage your Athenz domain in ZMS Server. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() + diff --git a/utils/zms_cli/zms-cli.go b/utils/zms_cli/zms-cli.go new file mode 100644 index 00000000000..780a849e285 --- /dev/null +++ b/utils/zms_cli/zms-cli.go @@ -0,0 +1,312 @@ +package main + +import ( + "bytes" + "crypto/tls" + "encoding/base64" + "errors" + "flag" + "fmt" + "golang.org/x/crypto/ssh/terminal" + "golang.org/x/net/proxy" + "io/ioutil" + "log" + "net" + "net/http" + "os" + "strings" + "syscall" + "time" + + "../../clients/go/zms" + "../../libs/go/zmscli" +) + +//these get set by the build script via the LDFLAGS +var VERSION string +var BUILD_DATE string + +func defaultZmsUrl() string { + s := os.Getenv("ZMS") + if s != "" { + return s + } + return "https://localhost:4443/zms/v1" +} + +func defaultIdentity() string { + return "user." + os.Getenv("USER") +} + +func defaultSocksProxy() string { + return os.Getenv("SOCKS5_PROXY") +} + +func defaultDebug() bool { + sDebug := os.Getenv("ZMS_DEBUG") + if sDebug == "true" { + return true + } + return false +} + +func debugAuthNToken(identity string) string { + i := strings.LastIndex(identity, ".") + domain := identity[0:i] + name := identity[i+1:] + var buf bytes.Buffer + buf.WriteString("v=U1;d=" + domain + ";n=" + name + ";s=fakesignature") + return "v=U1;d=" + domain + ";n=" + name + ";s=fakesignature" +} + +func isFreshFile(filename string, maxAge float64) bool { + info, err := os.Stat(filename) + if err != nil { + return false + } + delta := time.Since(info.ModTime()) + duration := delta + if duration.Minutes() > maxAge { + return false + } + return true +} + +func getCachedNToken() string { + ntokenFile := os.Getenv("HOME") + "/.ntoken" + if isFreshFile(ntokenFile, 45) { + data, err := ioutil.ReadFile(ntokenFile) + if err == nil { + return string(data) + } else { + fmt.Printf("Couldn't read the file, error: %v\n", err) + } + } + return "" +} + +func getAuthNToken(identity, authorizedServices, zmsUrl string, tr *http.Transport) (string, error) { + // our identity must be user + if !strings.HasPrefix(identity, "user.") { + return "", errors.New("Identity must start with user.") + } + user := identity[5:] + ntoken := getCachedNToken() + if ntoken != "" { + return ntoken, nil + } + + fmt.Fprintf(os.Stderr, "Enter password for "+user+": ") + pass, err := terminal.ReadPassword(syscall.Stdin) + if err != nil { + return "", err + } + password := string(pass) + // The user types during terminal.ReadPassword() however + // since echo is turned off the cursor doesn't make it to the next line. + fmt.Fprint(os.Stderr, "\n") + + data := []byte(user + ":" + password) + str := base64.StdEncoding.EncodeToString(data) + + var authHeader = "Authorization" + var authCreds = "Basic " + str + zmsClient := zms.ZMSClient{ + URL: zmsUrl, + Transport: tr, + CredsHeader: &authHeader, + CredsToken: &authCreds, + Timeout: 0, + } + tok, err := zmsClient.GetUserToken(zms.SimpleName(user), authorizedServices) + if err != nil { + return "", fmt.Errorf("Cannot get user token for user: %s error: %v", user, err) + } + if tok.Token != "" { + ntokenFile := os.Getenv("HOME") + "/.ntoken" + data := []byte(tok.Token) + ioutil.WriteFile(ntokenFile, data, 0600) + } + return string(tok.Token), nil +} + +func usage() string { + var buf bytes.Buffer + buf.WriteString("usage: zms-cli [flags] command [params]\n") + buf.WriteString(" flags:\n") + buf.WriteString(" -a auditRef Audit Reference Token if auditing is required for domain\n") + buf.WriteString(" -b Bulk import/update mode. Do not read/display updated role/policy/service objects (default=false)\n") + buf.WriteString(" -d domain The domain used for every command that takes a domain argument\n") + buf.WriteString(" -f ntoken_file Principal Authority NToken file used for authentication\n") + buf.WriteString(" -i identity User identity to authenticate as if NToken file is not specified\n") + buf.WriteString(" (default=" + defaultIdentity() + ")\n") + buf.WriteString(" -k Disable peer verification of SSL certificates.\n") + buf.WriteString(" -s host:port The SOCKS5 proxy to route requests through\n") + buf.WriteString(" -v Verbose mode. YRNs are included in output (default=false)\n") + buf.WriteString(" -z zms_url Base URL of the ZMS server to use\n") + buf.WriteString(" (default ZMS=" + defaultZmsUrl() + ")\n") + buf.WriteString(" -debug Debug mode. Generates debug NTokens (default=false)\n") + buf.WriteString("\n") + buf.WriteString(" type 'zms-cli help' to see all available commands\n") + buf.WriteString(" type 'zms-cli help [command]' for usage of the specified command\n") + return buf.String() +} + +func loadNtokenFromFile(fileName string) (string, error) { + buf, err := ioutil.ReadFile(fileName) + if err != nil { + return "", err + } + return string(buf), nil +} + +func main() { + pZMS := flag.String("z", defaultZmsUrl(), "Base URL of the ZMS server to use") + pIdentity := flag.String("i", defaultIdentity(), "the identity to authenticate as") + pNtokenFile := flag.String("f", "", "ntoken file path") + pVerbose := flag.Bool("v", false, "verbose mode. YRNs are included in output") + pBulkmode := flag.Bool("b", false, "bulk mode. Do not display updated role/policy/service in output") + pProductIdSupport := flag.Bool("p", false, "Top Level Domain add operations require product ids") + pDomain := flag.String("d", "", "The domain for the command to execute in. If not specified, only certain commands are available") + pUserDomain := flag.String("u", "user", "User domain name as configured in Athens systems") + pSocks := flag.String("s", defaultSocksProxy(), "The SOCKS5 proxy to route requests through, i.e. 127.0.0.1:1080") + pSkipVerify := flag.Bool("k", false, "Disable peer verification of SSL certificates") + pDebug := flag.Bool("debug", defaultDebug(), "debug mode (for authentication, mainly)") + pAuditRef := flag.String("a", "", "Audit Reference Token if auditing is enabled for the domain") + flag.Usage = func() { + fmt.Println(usage()) + } + + // first we need to parse our arguments based + // on the flags we defined above + + flag.Parse() + + if *pZMS == "" { + fmt.Println("No ZMS Url specified") + return + } + + // before processing our arguments verify that the zms + // url is of expected format and return failure right + // away otherwise the error message is somewhat + // confusing when the hostname/port is valid but the + // uri part is invalid resulting in 404 responses + + if !strings.HasSuffix(*pZMS, "/zms/v1") { + fmt.Println("Invalid ZMS Url specified: " + *pZMS) + fmt.Println("Valid ZMS Url has the following form: https://:/zms/v1") + return + } + + // now process our request + + args := flag.Args() + if len(args) == 0 { + fmt.Println(usage()) + return + } else if args[0] == "help" { + cli := zmscli.Zms{} + cli.UserDomain = *pUserDomain + if len(args) == 2 { + fmt.Println(cli.HelpSpecificCommand(false, args[1])) + } else { + fmt.Println(cli.HelpListCommand()) + } + return + } else if args[0] == "version" { + if VERSION == "" { + fmt.Println("zms-cli (development version)") + } else { + fmt.Println("zms-cli " + VERSION + " " + BUILD_DATE) + } + return + } + + if *pSocks == "" { + pSocks = nil + } + identity := *pIdentity + if strings.Index(identity, ".") < 0 { + identity = "user." + identity + } + tr := getHttpTransport(pSocks, *pSkipVerify) + var ntoken string + var err error + if *pNtokenFile == "" { + if *pDebug { + ntoken = debugAuthNToken(identity) + } else { + ntoken, err = getAuthNToken(identity, "", *pZMS, tr) + if err != nil { + log.Fatalf("Unable to get NToken: %v", err) + } + } + } else { + ntoken, err = loadNtokenFromFile(*pNtokenFile) + if err != nil { + log.Fatalf("Unable to load ntoken from file: '%s' err: %v", *pNtokenFile, err) + } + } + var authHeader = "Athenz-Principal-Auth" + + cli := zmscli.Zms{ + ZmsUrl: *pZMS, + Identity: *pIdentity, + Verbose: *pVerbose, + Bulkmode: *pBulkmode, + Interactive: false, + Domain: *pDomain, + AuditRef: *pAuditRef, + UserDomain: *pUserDomain, + ProductIdSupport: *pProductIdSupport, + Debug: *pDebug, + } + cli.SetClient(tr, &authHeader, &ntoken) + + if len(args) > 0 { + switch args[0] { + case "get-user-token": + if len(args) == 2 { + ntoken, err = getAuthNToken(identity, args[1], *pZMS, tr) + if err != nil { + log.Fatalf("Unable to get NToken for service: %s error: %v", args[1], err) + } + } + fmt.Println("Athenz-Principal-Auth: " + ntoken) + return + case "repl": + cli.Interactive = true + cli.Repl() + return + default: + break + } + } + msg, err := cli.EvalCommand(args) + if err != nil { + fmt.Println("***", err) + os.Exit(1) + } else if msg != nil { + fmt.Println(*msg) + os.Exit(0) + } +} + +func getHttpTransport(socksProxy *string, skipVerify bool) *http.Transport { + tr := http.Transport{} + if socksProxy == nil && skipVerify == false { + return &tr + } + if socksProxy != nil { + dialer := &net.Dialer{} + dialSocksProxy, err := proxy.SOCKS5("tcp", *socksProxy, nil, dialer) + if err == nil { + tr.Dial = dialSocksProxy.Dial + } + } + if skipVerify { + tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: skipVerify} + } + return &tr +} diff --git a/utils/zpe_policy_updater/README.md b/utils/zpe_policy_updater/README.md new file mode 100644 index 00000000000..3276756dab5 --- /dev/null +++ b/utils/zpe_policy_updater/README.md @@ -0,0 +1,9 @@ +ZPE Policy Updater Application + +Like ZTS and ZPE, ZPU is only needed to support the decentralized authorization. The policy updater is the utility that retrieves from ZTS the policy files for provisioned domains on a host, which ZPE uses to evaluate access requests.This application must be setup as a cron job to periodically (e.g. every 2 hours) to update the policy files. + +## License + +Copyright 2016 Yahoo Inc. + +Licensed under the Apache License, Version 2.0: [http://www.apache.org/licenses/LICENSE-2.0]() diff --git a/utils/zpe_policy_updater/conf/logback.xml b/utils/zpe_policy_updater/conf/logback.xml new file mode 100755 index 00000000000..2fb966be627 --- /dev/null +++ b/utils/zpe_policy_updater/conf/logback.xml @@ -0,0 +1,29 @@ + + + + + + + + + ${LOG_DIR}/application.log + true + + + ${LOG_DIR}/application.%d.log + 7 + true + + + + %d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg%n + + + + + + + + + + diff --git a/utils/zpe_policy_updater/conf/utility_settings b/utils/zpe_policy_updater/conf/utility_settings new file mode 100644 index 00000000000..7246e532d4c --- /dev/null +++ b/utils/zpe_policy_updater/conf/utility_settings @@ -0,0 +1,13 @@ +#!/usr/bin/env bash + +# ** directory location for zpu to store policy files +UTILITY_POLICY_FILE_DIR="${ROOT}/var/zpe" + +# ** athenz configuration file +UTILITY_ATHENZ_CONF="conf/zpe_policy_updater/athenz.conf" + +# ** logback configuration file +UTILITY_LOG_CONFIG="${ROOT}/conf/zpe_policy_updater/logback.xml" + +# ** truststore path +UTILITY_SSL_TRUSTSTORE="${ROOT}/var/zpe_policy_updater/certs/zpu_truststore.jks" diff --git a/utils/zpe_policy_updater/conf/zpu.conf b/utils/zpe_policy_updater/conf/zpu.conf new file mode 100644 index 00000000000..0d139dcfbc4 --- /dev/null +++ b/utils/zpe_policy_updater/conf/zpu.conf @@ -0,0 +1,3 @@ +{ + "domains": "," +} \ No newline at end of file diff --git a/utils/zpe_policy_updater/pom.xml b/utils/zpe_policy_updater/pom.xml new file mode 100644 index 00000000000..c7f952b685e --- /dev/null +++ b/utils/zpe_policy_updater/pom.xml @@ -0,0 +1,91 @@ + + + + 4.0.0 + + + com.yahoo.athenz + athenz + 1.0-SNAPSHOT + ../../pom.xml + + + zpe_policy_updater + jar + zpe_policy_updater + ZPE Policy Updater + + + + ${project.groupId} + zts_core + ${project.parent.version} + + + ${project.groupId} + auth_core + ${project.parent.version} + + + ${project.groupId} + zts_java_client + ${project.parent.version} + + + ${project.groupId} + client_common + ${project.parent.version} + + + ch.qos.logback + logback-classic + 1.1.3 + + + + + + + org.apache.maven.plugins + maven-shade-plugin + 2.3 + + + package + + shade + + + + + + + + *:* + + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + + + + + + + diff --git a/utils/zpe_policy_updater/scripts/zpu_run.sh b/utils/zpe_policy_updater/scripts/zpu_run.sh new file mode 100755 index 00000000000..d6e68b91aea --- /dev/null +++ b/utils/zpe_policy_updater/scripts/zpu_run.sh @@ -0,0 +1,33 @@ +#!/bin/bash + +if [ -z "${ROOT}" ]; then + ROOT="/home/athenz" +fi + +UTILITY_NAME=zpe_policy_updater +UTILITY_CLASSPATH=${ROOT}/lib/jar/zpe_policy_updater*.jar:${ROOT}/lib/jars/* +UTILITY_BOOTSTRAP_CLASS=com.yahoo.athenz.zpe_policy_updater.PolicyUpdater + +## pick up our service settings which should override +# some of the default values set by the code +if [ ! -f ${ROOT}/conf/${UTILITY_NAME}/utility_settings ]; then + echo "Unable to find utility settings: ${ROOT}/conf/${UTILITY_NAME}/utility_settings aborting" + exit -1 +fi + +. "${ROOT}/conf/${UTILITY_NAME}/utility_settings" + +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.zpe_policy_updater.dir=${UTILITY_POLICY_FILE_DIR}" +export JAVA_OPTS="${JAVA_OPTS} -Dlogback.configurationFile=${UTILITY_LOG_CONFIG}" +export JAVA_OPTS="${JAVA_OPTS} -Dathenz.athenz_conf=${UTILITY_ATHENZ_CONF}" +export JAVA_OPTS="${JAVA_OPTS} -Djavax.net.ssl.trustStore=${UTILITY_SSL_TRUSTSTORE}" + +if [ ! -d "${UTILITY_POLICY_FILE_DIR}" ]; then + mkdir -p ${UTILITY_POLICY_FILE_DIR} +fi + +date + +echo "Executing: java -classpath ${UTILITY_CLASSPATH} ${JAVA_OPTS} ${UTILITY_BOOTSTRAP_CLASS}" + +java -classpath ${UTILITY_CLASSPATH} ${JAVA_OPTS} ${UTILITY_BOOTSTRAP_CLASS} 2>&1 < /dev/null diff --git a/utils/zpe_policy_updater/scripts/zpu_set_ownership.pl b/utils/zpe_policy_updater/scripts/zpu_set_ownership.pl new file mode 100755 index 00000000000..3d505146c9c --- /dev/null +++ b/utils/zpe_policy_updater/scripts/zpu_set_ownership.pl @@ -0,0 +1,42 @@ +#!/usr/local/bin/perl -w + +use strict; + +my $ROOT = $ENV{ROOT}; +if (!$ROOT) { + $ROOT = "/home/athenz"; +} + +my $num_args = $#ARGV + 1; +if ($num_args != 1) { + exit 1; +} + +my $zpu_user = $ARGV[0]; + +system("chown -R $zpu_user $ROOT/var/zpe"); +my $ret = $?; +if ($ret != 0) { + print "Unable to chown $zpu_user for file $ROOT/var/zpe\n"; + exit 2; +} +# before running chown on tmp/zpe directory +# make sure it exists. it's possible that +# it was cleaned up which is ok since zpu +# will create it with the ownership of the +# running user when it gets executed +if (-d "$ROOT/tmp/zpe") { + system("chown -R $zpu_user $ROOT/tmp/zpe"); + $ret = $?; + if ($ret != 0) { + print "Unable to chown $zpu_user for file $ROOT/tmp/zpe\n"; + exit 3; + } +} +system("chown -R $zpu_user $ROOT/logs/zpe_policy_updater"); +$ret = $?; +if ($ret != 0) { + print "Unable to chown $zpu_user for file $ROOT/logs/zpe_policy_updater\n"; + exit 4; +} +exit 0; diff --git a/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdater.java b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdater.java new file mode 100644 index 00000000000..e96876da509 --- /dev/null +++ b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdater.java @@ -0,0 +1,423 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.nio.file.StandardCopyOption; +import java.security.PublicKey; +import java.util.List; +import java.util.Map; +import java.util.Random; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Timestamp; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.sia.SIA; +import com.yahoo.athenz.zts.DomainMetrics; +import com.yahoo.athenz.zts.DomainSignedPolicyData; +import com.yahoo.athenz.zts.PolicyData; +import com.yahoo.athenz.zts.SignedPolicyData; +import com.yahoo.athenz.zts.ZTSClient; +import com.yahoo.athenz.zts.ZTSClientException; + +public class PolicyUpdater { + + private static final Logger LOG = LoggerFactory.getLogger(PolicyUpdater.class); + + private static final String POLICY_FILE_EXTENSION = ".pol"; + private static final String TEMP_FILE_EXTENSION = ".tmp"; + + public static final String ZPE_METRIC_FILE_PATH = "/var/zpe_stat/"; + public static final String ZPE_PROP_METRIC_FILE_PATH = "athenz.zpe.metric_file_path"; + + static final String METRIC_GENERAL_FAILURE = "zpu_general_fail_sum"; + static final String METRIC_PROCESS_SUM = "zpu_process_sum"; + static final String METRIC_DOMAIN_FAILURE = "domain_fail_sum"; + static final String METRIC_DOMAIN_SUCCESS = "domain_good_sum"; + static final String METRIC_DOMAIN_FAIL = "domain_fail"; + static final String METRIC_DOMAIN_GOOD = "domain_good"; + + private enum ZPUExitCode { + SUCCESS(0), + CONFIG_CREATE_FAILURE(1), + CONFIG_INIT_FAILURE(2), + MAX_INSTANCE_FAILURE(3), + POLICY_UPDATE_FAILURE(4); + + private int code; + ZPUExitCode(int code) { + this.code = code; + } + int getCode() { + return code; + } + }; + + public static void main(String[] args) throws IOException, InterruptedException { + + PolicyUpdaterConfiguration configuration = null; + try { + configuration = new PolicyUpdaterConfiguration(); + } catch (Exception ex) { + LOG.error("Unable to create configuration object: ", ex); + System.exit(ZPUExitCode.CONFIG_CREATE_FAILURE.getCode()); + } + + Random randomGenerator = new Random(); + int randmonSleepInterval = 0; + + if (configuration.getStartupDelayIntervalInSecs() > 0) { + randmonSleepInterval = randomGenerator.nextInt(configuration.getStartupDelayIntervalInSecs()); + LOG.info("Launching zpe_policy_updater in " + randmonSleepInterval + " seconds..."); + for (int i = 0; i < randmonSleepInterval; i++) { + Thread.sleep(1000); + } + } else { + LOG.info("Launching zpe_policy_updater with no delay..."); + } + + ZPUExitCode exitCode = ZPUExitCode.SUCCESS; + try { + try { + configuration.init(null, null); + } catch (Exception ex) { + LOG.error("Unable to initialize configuration object: ", ex); + exitCode = ZPUExitCode.CONFIG_INIT_FAILURE; + throw ex; + } + + try { + PolicyUpdater.policyUpdater(configuration, new SIAClientFactoryImpl(), new ZTSClientFactoryImpl()); + } catch (Exception ex) { + LOG.error("PolicyUpdater: Unable to update policy data: ", ex); + exitCode = ZPUExitCode.POLICY_UPDATE_FAILURE; + throw ex; + } + } catch (Exception exc) { + LOG.error("PolicyUpdater: Exiting upon error: " + exc.getMessage()); + } finally { + System.exit(exitCode.getCode()); + } + } + + static void policyUpdater(PolicyUpdaterConfiguration configuration, SIAClientFactory siaFactory, + ZTSClientFactory ztsFactory) throws Exception { + + try (ZTSClient zts = ztsFactory.create()) { + + List domainList = configuration.getDomainList(); + if (domainList == null) { + SIA siaClient = siaFactory.create(); + domainList = siaClient.getDomainList(); + LOG.info("policyUpdater: Number of domains returned from SIA:" + (domainList == null ? 0 : domainList.size())); + } + + LOG.info("policyUpdater: Number of domains to process:" + (domainList == null ? 0 : domainList.size())); + if (domainList == null) { + LOG.error("policyUpdater: no domain list to process from configuration or SIA"); + throw new Exception("no configured domains to process"); + } + + for (String domain : domainList) { + + LOG.info("Fetching signed policies for domain:" + domain); + + String matchingTag = getEtagForExistingPolicy(zts, configuration, domain); + + Map> responseHeaders = null; + DomainSignedPolicyData domainSignedPolicyData = null; + try { + domainSignedPolicyData = zts.getDomainSignedPolicyData(domain, matchingTag, responseHeaders); + } catch (Exception exc) { + domainSignedPolicyData = null; + LOG.error("PolicyUpdater: Unable to retrieve policies from zts for domain=" + domain, exc); + } + if (domainSignedPolicyData == null) { + if (matchingTag != null && !matchingTag.isEmpty()) { + LOG.info("PolicyUpdater: Policies not updated since last fetch time"); + } + } else if (validateSignedPolicies(zts, configuration, domainSignedPolicyData, domain)) { + writePolicies(configuration, domain, domainSignedPolicyData); + } + } + + // now push the domain metrics files + + postDomainMetrics(zts); + } + } + + static boolean validateSignedPolicies(ZTSClient zts, PolicyUpdaterConfiguration configuration, + DomainSignedPolicyData domainSignedPolicyData, String domain) { + + if (domainSignedPolicyData == null || domain == null) { + throw new IllegalArgumentException("null parameters are not valid arguments"); + } + + LOG.info("Checking expiration time for:" + domain); + + Timestamp expires = domainSignedPolicyData.getSignedPolicyData().getExpires(); + if (System.currentTimeMillis() > expires.millis()) { + LOG.error("Signed policy for domain:" + domain + " was expired."); + return false; + } + + // first we're going to verify the ZTS signature for the data + + LOG.info("Verifying ZTS signature for: " + domain); + SignedPolicyData signedPolicyData = domainSignedPolicyData.getSignedPolicyData(); + + LOG.debug("Policies retrieved from the ZTS server: " + signedPolicyData); + + String signature = domainSignedPolicyData.getSignature(); + String keyId = domainSignedPolicyData.getKeyId(); + LOG.debug("validateSignedPolicies: domain=" + domain + " zts key id=" + keyId + " Digital ZTS signature=" + signature); + + PublicKey ztsPublicKey = configuration.getZtsPublicKey(zts, keyId); + if (ztsPublicKey == null) { + LOG.error("validateSignedPolicies: Missing ZTS Public key for id: " + keyId); + return false; + } + + boolean verified = Crypto.verify(SignUtils.asCanonicalString(signedPolicyData), ztsPublicKey, signature); + if (verified == false) { + LOG.error("Signed policy for domain:" + domain + " failed ZTS signature verification."); + LOG.error("ZTS Signature: " + signature + ". Policies data returned from ZTS: " + signedPolicyData); + return false; + } + + // then we're going to verify the ZMS signature for the policy data + + LOG.info("Verifying ZMS signature for: " + domain); + PolicyData policyData = signedPolicyData.getPolicyData(); + + signature = signedPolicyData.getZmsSignature(); + LOG.debug("Digital ZMS signature: " + signature); + keyId = signedPolicyData.getZmsKeyId(); + LOG.debug("Digital ZMS signature key Id: " + keyId); + + PublicKey zmsPublicKey = configuration.getZmsPublicKey(zts, keyId); + if (zmsPublicKey == null) { + LOG.error("Missing ZMS Public key with id: " + keyId); + return false; + } + + verified = Crypto.verify(SignUtils.asCanonicalString(policyData), zmsPublicKey, signature); + if (verified == false) { + LOG.error("Signed policy for domain:" + domain + " failed ZMS signature verification."); + LOG.error("ZMS Signature: " + signature + ". Policies data returned from ZTS: " + policyData); + } + + return verified; + } + + static void verifyTmpDirSetup(PolicyUpdaterConfiguration configuration) throws IOException { + // ensure tmp dir exists + String policyTmpDir = configuration.getPolicyFileTmpDir(); + Path tmpDir = Paths.get(policyTmpDir); + if (java.nio.file.Files.exists(tmpDir)) { + return; + } + + LOG.warn("The temp dir doesnt exist so will create it: " + tmpDir); + java.nio.file.Files.createDirectory(tmpDir); + + // get the user from config file to perform chown aginst the tmp dir + // chown -R $zpu_user $ROOT/tmp/zpe + String user = configuration.getZpuDirOwner(); + if (user == null) { + LOG.warn("Cannot chown of the temp dir: " + tmpDir + " : no configured user"); + return; + } + + try { + java.nio.file.attribute.UserPrincipalLookupService lookupSvc = + java.nio.file.FileSystems.getDefault().getUserPrincipalLookupService(); + java.nio.file.attribute.UserPrincipal uprinc = lookupSvc.lookupPrincipalByName(user); + Files.setOwner(tmpDir, uprinc); + } catch (Exception exc) { + LOG.warn("Failed to chown of the temp dir: " + tmpDir + " : user: " + user + " : exc: " + exc); + } + } + + static void writePolicies(PolicyUpdaterConfiguration configuration, String domain, + DomainSignedPolicyData domainSignedPolicyData) throws IOException { + + if (configuration == null) { + throw new IllegalArgumentException("null configuration"); + } + String policyTmpDir = configuration.getPolicyFileTmpDir(); + String policyDir = configuration.getPolicyFileDir(); + if (policyTmpDir == null || policyDir == null || domain == null || domainSignedPolicyData == null) { + throw new IllegalArgumentException("null parameters are not valid arguments"); + } + + String pathToTempFile = policyTmpDir + File.separator + domain + TEMP_FILE_EXTENSION; + String pathToPolicyFile = policyDir + File.separator + domain + POLICY_FILE_EXTENSION; + + // ensure tmp dir exists + verifyTmpDirSetup(configuration); + + LOG.info("Writing temp policy file: " + pathToTempFile); + // Make a file object from the path name + File file = new File(pathToTempFile); + file.createNewFile(); + Files.write(file.toPath(), JSON.bytes(domainSignedPolicyData)); + + Path sourceFile = Paths.get(pathToTempFile); + Path destinationFile = Paths.get(pathToPolicyFile); + try { + LOG.info("Moving temp file : " + sourceFile + " to destination: " + destinationFile); + Files.copy(sourceFile, destinationFile, StandardCopyOption.REPLACE_EXISTING); + Files.deleteIfExists(sourceFile); + } catch (IOException exc) { + LOG.error("PolicyUpdater: Moving temp file failure. source: " + sourceFile + " : destination: " + destinationFile + " : exc: " + exc); + exc.printStackTrace(); + } + } + + static String getEtagForExistingPolicy(ZTSClient zts, PolicyUpdaterConfiguration configuration, + String domain) { + + if (domain == null) { + throw new IllegalArgumentException("getEtagForExistingPolicy: null parameters are not valid arguments"); + } + + String policyDir = configuration.getPolicyFileDir(); + if (policyDir == null) { + throw new IllegalArgumentException("getEtagForExistingPolicy: Invalid configuration: no policy directory path"); + } + + String policyDirPath; + if (policyDir.length() - 1 != policyDir.lastIndexOf(File.separator)) { + policyDirPath = policyDir + File.separator; + } else { + policyDirPath = policyDir; + } + + String etag = null; + String policyFile = policyDirPath + domain + POLICY_FILE_EXTENSION; + + LOG.info("Decoding " + policyFile + " to retrieve eTag from policy file."); + File file = new File(policyFile); + + if (file.exists() == false) { + LOG.info("Policy file not found."); + return etag; + } + + DomainSignedPolicyData domainSignedPolicyData = null; + try { + domainSignedPolicyData = JSON.fromBytes(Files.readAllBytes(file.toPath()), + DomainSignedPolicyData.class); + } catch (Exception ex) { + LOG.info("Unable to parse domain signed policy file: " + policyFile); + return etag; + } + + // validate the signature before checking for expiration + + if (validateSignedPolicies(zts, configuration, domainSignedPolicyData, domain) == false) { + LOG.info("Unable to validate domain signed policy file: " + policyFile); + return etag; + } + + // Check expiration of policies and if its less than the configured interval defined by user + // to get updated policy then return null so that the policies are updated + + LOG.info("Checking expiration time for: " + domain); + long now = System.currentTimeMillis() / 1000; + + Timestamp expires = domainSignedPolicyData.getSignedPolicyData().getExpires(); + + long startupDelayInterval = configuration.getStartupDelayIntervalInSecs(); + + LOG.info("Expiration time for " + domain + " is: " + (expires.millis() / 1000)); + LOG.info("Startup delay: " + startupDelayInterval); + LOG.info("Current time: " + now); + + if (((expires.millis() / 1000) - now) < (startupDelayInterval)) { + LOG.info("Signed policies for domain:" + domain + " are expired, returning null."); + return null; + } + + if (domainSignedPolicyData.getSignedPolicyData().getModified() != null) { + + // ETags are quoted-strings based on the HTTP RFC + // http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.11 + // so we're going to quote our modified timestamp + + etag = "\"" + domainSignedPolicyData.getSignedPolicyData().getModified().toString() + "\""; + LOG.info("ETag: " + etag); + } else { + LOG.info("No ETag found."); + } + + return etag; + } + + static String getFilePath() { + String rootDir = System.getenv("ROOT"); + if (rootDir == null) { + rootDir = "/home/athenz"; + } + final String defaultPath = rootDir + ZPE_METRIC_FILE_PATH; + String filePath = System.getProperty(ZPE_PROP_METRIC_FILE_PATH, defaultPath); + + // verify it ends with the separator and handle accordingly + + if (!filePath.endsWith(File.separator)) { + filePath = filePath.concat(File.separator); + } + return filePath; + } + + public static void postDomainMetrics(ZTSClient zts) { + + final String filepath = getFilePath(); + File dir = new File(filepath); + File[] filenames = dir.listFiles(); + + // make sure we have valid list of metric files + + if (filenames == null) { + return; + } + + for (int i = 0; i < filenames.length; i++) { + String domainName = filenames[i].getName().split("_")[0]; + DomainMetrics domainMetrics = null; + final String metricFile = filepath + filenames[i].getName(); + try { + Path path = Paths.get(metricFile); + domainMetrics = JSON.fromBytes(Files.readAllBytes(path), DomainMetrics.class); + zts.postDomainMetrics(domainName, domainMetrics); + Files.deleteIfExists(path); + } catch (ZTSClientException | IOException ex) { + LOG.error("Unable to push domain metrics from {} - error: {}", + metricFile, ex.getMessage()); + } + } + } +} diff --git a/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdaterConfiguration.java b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdaterConfiguration.java new file mode 100644 index 00000000000..9cc022b7b02 --- /dev/null +++ b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdaterConfiguration.java @@ -0,0 +1,277 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.Arrays; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.security.PublicKey; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Struct; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.config.AthenzConfig; +import com.yahoo.athenz.zms.PublicKeyEntry; +import com.yahoo.athenz.zts.ZTSClient; + +public class PolicyUpdaterConfiguration { + + private static final Logger LOG = LoggerFactory.getLogger(PolicyUpdaterConfiguration.class); + + private static final String ZPU_PROP_ATHENZ_CONF = "athenz.athenz_conf"; + private static final String ZPU_PROP_DEBUG = "athenz.zpe_policy_updater.debug"; + private static final String ZPU_PROP_POLDIR = "athenz.zpe_policy_updater.dir"; + private static final String ZPU_PROP_POL_TMP_DIR = "athenz.zpe_policy_updater.tmp_dir"; + static final String ZPU_PROP_TEST_ROOT_PATH = "athenz.zpe_policy_updater.test_root_path"; + static final String ZPU_PROP_METRIC_FACTORY = "athenz.zpe_policy_updater.metric_factory_class"; + + static final String ZPU_METRIC_FACT_DEF_CLASS = "com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory"; + + private static final String ATHENZ_CONFIG_FILE = "/conf/athenz/athenz.conf"; + private static final String ZPU_CONFIG_FILE = "/conf/zpe_policy_updater/zpu.conf"; + private static final String ZPU_CONFIG_DOMAINS = "domains"; + private static final String ZPU_CONFIG_USER = "user"; + private static final String ZPU_USER_DEFAULT = "root"; + + private static final String STARTUP_DELAY = "STARTUP_DELAY"; + private static final int DEFAULT_STARTUP_DELAY = 0; + private static final int MAX_STARTUP_DELAY = 86400; + + public static final String ZTS_PUBLIC_KEY_PREFIX = "zts.public_key."; + public static final String ZMS_PUBLIC_KEY_PREFIX = "zms.public_key."; + + private boolean debugMode = false; + private int startupDelay = 0; + private Map ztsPublicKeyMap = new HashMap(); + private Map zmsPublicKeyMap = new HashMap(); + private String rootDir; + private String policyFileDir; + private String policyFileTmpDir; + private String defaultAthenzConfigFile; + private String defaultZPUConfigFile; + private List domainList = null; + private String zpuDirOwner = null; + + public PolicyUpdaterConfiguration() { + + debugMode = Boolean.parseBoolean(System.getProperty(ZPU_PROP_DEBUG, "false")); + + rootDir = System.getenv("ROOT"); + if (null == rootDir) { + rootDir = File.separator + "home" + File.separator + "athenz"; + } + rootDir = System.getProperty(ZPU_PROP_TEST_ROOT_PATH, rootDir); + + // default configuration file paths + + defaultAthenzConfigFile = System.getProperty(ZPU_PROP_ATHENZ_CONF, + rootDir + ATHENZ_CONFIG_FILE); + defaultZPUConfigFile = rootDir + ZPU_CONFIG_FILE; + + // Final destination of signed policy files + String policyFileDirDefault = rootDir + File.separator + "var" + + File.separator + "zpe"; + + policyFileDir = System.getProperty(ZPU_PROP_POLDIR, policyFileDirDefault); + + // Temporary destination of signed policy files + String policyFileTmpDirDefault = rootDir + File.separator + "tmp" + + File.separator + "zpe"; + + policyFileTmpDir = System.getProperty(ZPU_PROP_POL_TMP_DIR, policyFileTmpDirDefault); + + String startupDelayString = System.getenv(STARTUP_DELAY); + + if (startupDelayString != null) { + startupDelay = Integer.parseInt(startupDelayString); + } else { + startupDelay = DEFAULT_STARTUP_DELAY; + } + + startupDelay *= 60; // convert from min to secs + + if (startupDelay < 0) { + startupDelay = DEFAULT_STARTUP_DELAY; + } + + if (startupDelay > MAX_STARTUP_DELAY) { + startupDelay = MAX_STARTUP_DELAY; + } + + LOG.info("debug mode: " + debugMode); + LOG.info("policyFileDir: " + policyFileDir); + LOG.info("startup delay: " + startupDelay + " seconds"); + } + + public void init(String pathToAthenzConfigFile, String pathToZPUConfigFile) throws Exception { + + AthenzConfig athenzConfFile = null; + if (pathToAthenzConfigFile == null) { + athenzConfFile = readAthenzConfiguration(defaultAthenzConfigFile); + } else { + athenzConfFile = readAthenzConfiguration(pathToAthenzConfigFile); + } + + LOG.info("Policy Updater configuration is set to:"); + LOG.info("policyFileDir: " + policyFileDir); + + List publicKeys = athenzConfFile.getZtsPublicKeys(); + if (publicKeys != null) { + for (PublicKeyEntry publicKey : publicKeys) { + String keyId = publicKey.getId(); + String key = publicKey.getKey(); + if (key == null || keyId == null) { + continue; + } + addZtsPublicKey(keyId, Crypto.loadPublicKey(Crypto.ybase64DecodeString(key))); + LOG.info("Loaded ztsPublicKey keyId: " + keyId + " key: " + key); + } + } + + publicKeys = athenzConfFile.getZmsPublicKeys(); + if (publicKeys != null) { + for (PublicKeyEntry publicKey : publicKeys) { + String keyId = publicKey.getId(); + String key = publicKey.getKey(); + if (key == null || keyId == null) { + continue; + } + addZmsPublicKey(keyId, Crypto.loadPublicKey(Crypto.ybase64DecodeString(key))); + LOG.info("Loaded zmsPublicKey keyId: " + keyId + " key: " + key); + } + } + + Struct zpuConfFile = null; + if (pathToZPUConfigFile == null) { + zpuConfFile = readZpuConfiguration(defaultZPUConfigFile); + } else { + zpuConfFile = readZpuConfiguration(pathToZPUConfigFile); + } + String domains = zpuConfFile.getString(ZPU_CONFIG_DOMAINS); + if (domains != null && !domains.isEmpty()) { + domainList = Arrays.asList(domains.split(",")); + } + zpuDirOwner = zpuConfFile.getString(ZPU_CONFIG_USER); + if (zpuDirOwner == null || zpuDirOwner.isEmpty()) { + zpuDirOwner = ZPU_USER_DEFAULT; + } + if (isDebugMode()) { + LOG.debug("config-init: user: " + zpuDirOwner + " file=" + pathToZPUConfigFile); + } + } + + private AthenzConfig readAthenzConfiguration(String pathToFile) throws IOException { + LOG.info("Reading configuration file: " + pathToFile); + AthenzConfig conf = null; + try { + Path path = Paths.get(pathToFile); + conf = JSON.fromBytes(Files.readAllBytes(path), AthenzConfig.class); + } catch (Exception e) { + e.printStackTrace(); + } + + return conf; + } + + private Struct readZpuConfiguration(String pathToFile) throws IOException { + LOG.info("Reading configuration file: " + pathToFile); + Struct conf = null; + try { + Path path = Paths.get(pathToFile); + conf = JSON.fromBytes(Files.readAllBytes(path), Struct.class); + } catch (Exception e) { + e.printStackTrace(); + } + + return conf; + } + + public PublicKey getZtsPublicKey(ZTSClient zts, String keyId) { + PublicKey pKey = ztsPublicKeyMap.get(keyId); + + return pKey; + } + + public PublicKey getZmsPublicKey(ZTSClient zts, String keyId) { + PublicKey pKey = zmsPublicKeyMap.get(keyId); + return pKey; + } + + public void addZtsPublicKey(String keyId, PublicKey ztsPublicKey) { + ztsPublicKeyMap.put(keyId, ztsPublicKey); + } + + public void addZmsPublicKey(String keyId, PublicKey zmsPublicKey) { + zmsPublicKeyMap.put(keyId, zmsPublicKey); + } + + public String getRootDir() { + return rootDir; + } + + public void setRootDir(String rootDir) { + this.rootDir = rootDir; + } + + public String getPolicyFileDir() { + return policyFileDir; + } + + public void setPolicyFileDir(String policyFileDir) { + this.policyFileDir = policyFileDir; + } + + public String getPolicyFileTmpDir() { + return policyFileTmpDir; + } + + public void setPolicyFileTmpDir(String policyFileTmpDir) { + this.policyFileTmpDir = policyFileTmpDir; + } + + public boolean isDebugMode() { + return debugMode; + } + + public void setDebugMode(boolean debugMode) { + this.debugMode = debugMode; + } + + public int getStartupDelayIntervalInSecs() { + return startupDelay; + } + + public void setStartupDelayInterval(int startupDelayIntervalInMin) { + this.startupDelay = startupDelayIntervalInMin * 60; + } + + public List getDomainList() { + return domainList; + } + + public String getZpuDirOwner() { + return zpuDirOwner; + } +} diff --git a/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/SIAClientFactory.java b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/SIAClientFactory.java new file mode 100644 index 00000000000..813eb494146 --- /dev/null +++ b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/SIAClientFactory.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.IOException; + +import com.yahoo.athenz.sia.SIA; + +public interface SIAClientFactory { + + public SIA create() throws IOException; + +} diff --git a/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/SIAClientFactoryImpl.java b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/SIAClientFactoryImpl.java new file mode 100644 index 00000000000..4c5604c596d --- /dev/null +++ b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/SIAClientFactoryImpl.java @@ -0,0 +1,28 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import com.yahoo.athenz.sia.SIA; +import com.yahoo.athenz.sia.impl.SIAClient; + +public class SIAClientFactoryImpl implements SIAClientFactory { + + @Override + public SIA create() { + return new SIAClient(); + } + +} diff --git a/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/ZTSClientFactory.java b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/ZTSClientFactory.java new file mode 100644 index 00000000000..2677862e79f --- /dev/null +++ b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/ZTSClientFactory.java @@ -0,0 +1,25 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.IOException; + +import com.yahoo.athenz.zts.ZTSClient; + +public interface ZTSClientFactory { + public ZTSClient create() throws IOException; + +} diff --git a/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/ZTSClientFactoryImpl.java b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/ZTSClientFactoryImpl.java new file mode 100644 index 00000000000..ca92d247c30 --- /dev/null +++ b/utils/zpe_policy_updater/src/main/java/com/yahoo/athenz/zpe_policy_updater/ZTSClientFactoryImpl.java @@ -0,0 +1,26 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import com.yahoo.athenz.zts.ZTSClient; + +public class ZTSClientFactoryImpl implements ZTSClientFactory { + + @Override + public ZTSClient create() { + return new ZTSClient(null); + } +} diff --git a/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/DebugSIAClientFactory.java b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/DebugSIAClientFactory.java new file mode 100644 index 00000000000..a5d29eae4ff --- /dev/null +++ b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/DebugSIAClientFactory.java @@ -0,0 +1,39 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.IOException; + +import com.yahoo.athenz.sia.SIA; +import com.yahoo.athenz.zpe_policy_updater.SIAClientFactory; + +public class DebugSIAClientFactory implements SIAClientFactory { + + private boolean emptyDomainList; + + public DebugSIAClientFactory() { + emptyDomainList = false; + } + + public DebugSIAClientFactory(boolean emptyList) { + emptyDomainList = emptyList; + } + @Override + public SIA create() throws IOException { + return new SIAClientMock(emptyDomainList); + } + +} diff --git a/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/DebugZTSClientFactory.java b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/DebugZTSClientFactory.java new file mode 100644 index 00000000000..48f8b5526a6 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/DebugZTSClientFactory.java @@ -0,0 +1,39 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.IOException; + +import com.yahoo.athenz.zpe_policy_updater.ZTSClientFactory; +import com.yahoo.athenz.zts.ZTSClient; + +public class DebugZTSClientFactory implements ZTSClientFactory { + + private String keyId = "0"; + public void setPublicKeyId(String keyId) { + this.keyId = keyId; + } + + @Override + public ZTSClient create() throws IOException { + ZTSMock zts = new ZTSMock(); + zts.setPublicKeyId(keyId); + ZTSClient client = new ZTSClient("http://localhost:10080", null, null); + client.setZTSRDLGeneratedClient(zts); + client.setSIAClient(new DebugSIAClientFactory().create()); + return client; + } +} diff --git a/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/MockMetricFactory.java b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/MockMetricFactory.java new file mode 100644 index 00000000000..8587a7177d8 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/MockMetricFactory.java @@ -0,0 +1,94 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.util.Map; + +import com.yahoo.athenz.common.metrics.Metric; +import com.yahoo.athenz.common.metrics.MetricFactory; + +import java.util.HashMap; + +public class MockMetricFactory implements MetricFactory { + + @Override + public Metric create() { + return new MockMetric(); + } + + public static class MockMetric implements Metric { + + Map metricMap = new HashMap<>(); + + public void increment(String metric, int count) { + Integer mcnt = metricMap.get(metric); + if (mcnt == null) { + metricMap.put(metric, new Integer(count)); + System.out.println("MockMetric:increment: " + metric + "=" + count); + } else { + int cnt = mcnt.intValue() + count; + metricMap.put(metric, new Integer(cnt)); + System.out.println("MockMetric:increment: " + metric + "=" + cnt); + } + } + + @Override + public void increment(String metric) { + increment(metric, 1); + } + + @Override + public void increment(String metric, String domainName, int count) { + increment(metric + domainName, count); + } + + @Override + public void increment(String metric, String domainName) { + increment(metric + domainName, 1); + } + + public int metricCount(String metric) { + Integer icnt = metricMap.get(metric); + if (icnt == null) { + return -1; + } + return icnt.intValue(); + } + public int metricCount(String metric, String domainName) { + return metricCount(metric + domainName); + } + + @Override + public Object startTiming(String metric, String domainName) { + return null; + } + + @Override + public void stopTiming(Object timerMetric) { + } + + @Override + public void flush() { + metricMap.clear(); + } + + @Override + public void quit() { + metricMap.clear(); + } + } +} + diff --git a/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdaterTest.java b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdaterTest.java new file mode 100644 index 00000000000..af444658c2e --- /dev/null +++ b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/PolicyUpdaterTest.java @@ -0,0 +1,524 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.File; +import java.io.IOException; +import java.lang.reflect.Field; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PublicKey; +import java.util.Collections; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.sia.SIA; +import com.yahoo.athenz.sia.impl.SIAClient; +import com.yahoo.athenz.zts.DomainSignedPolicyData; +import com.yahoo.athenz.zts.ZTSClient; +import com.yahoo.rdl.JSON; + +import org.testng.Assert; +import org.testng.annotations.Test; +import org.testng.annotations.BeforeClass; +import org.testng.annotations.AfterClass; +import org.mockito.Mockito; + +public class PolicyUpdaterTest { + + private final String pathToAthenzConfigFile = "./src/test/resources/athenz.conf"; + private final String pathToZPUConfigFile = "./src/test/resources/zpu.conf"; + private final String pathToZPUEmptyConfigFile = "./src/test/resources/zpu_empty.conf"; + private final String EXPECTED_ROOT_DIR = "/home/athenz"; + private final String TEST_ROOT_DIR = "/home/myroot"; + + private final String EXPECTED_ZTS_PUBLIC_KEY_K0 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + private final String EXPECTED_ZTS_PUBLIC_KEY_K1 = "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBUFpyWkMxelBhNXBQZloxaXFtcjdnWW9YaHVIbGlSUApVbnlLelliWWhRZXpUSlJlSDBsdWhvVVdQdTZxeWRHSm54RVUyTldNQ1hZLzhuL1VGSUZvakYwQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-"; + + private final String EXPECTED_POLICY_FILE_TMP_DIR_SUFFIX = "/tmp/zpe"; + private final String TEST_POLICY_DIR = "/pol_dir"; + private final String TEST_POLICY_TEMP_DIR = "/tmp"; + + private final int TEST_STARTUP_DELAY = 1339; + + private PolicyUpdaterConfiguration pupConfig = null; + + @BeforeClass + public void beforeClass() throws Exception { + System.setProperty("athenz.zpe_policy_updater.dir", "src/test/resources"); + System.setProperty("logback.configurationFile", "src/test/resources/logback.xml"); + System.setProperty("athenz.zpe_policy_updater.test_root_path", "src/test/resources"); + System.setProperty("athenz.zpe_policy_updater.metric_factory_class", "com.yahoo.athenz.common.metrics.impl.NoOpMetricFactory"); + + pupConfig = new PolicyUpdaterConfiguration(); + pupConfig.init(pathToAthenzConfigFile, pathToZPUConfigFile); + pupConfig.setPolicyFileTmpDir(pupConfig.getRootDir() + TEST_POLICY_TEMP_DIR); + pupConfig.setPolicyFileDir(pupConfig.getRootDir() + TEST_POLICY_DIR); + } + + @AfterClass + public void afterClass() { + } + + // main has exit, so temporary exclude.. + @Test(enabled=false, expectedExceptions = {Exception.class}) + public void TestMainConfigInitializeFail() throws IOException, InterruptedException { + PolicyUpdater.main(null); + Assert.fail(); + } + + @Test + public void TestPolicyUpdaterConfiguration() throws Exception { + + String rootPath = System.clearProperty(PolicyUpdaterConfiguration.ZPU_PROP_TEST_ROOT_PATH); + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + Assert.assertEquals(configuration.getRootDir(), EXPECTED_ROOT_DIR); + Assert.assertEquals(configuration.getPolicyFileDir(), "src/test/resources"); //set in pom.xml + Assert.assertEquals(configuration.getPolicyFileTmpDir(), EXPECTED_ROOT_DIR + EXPECTED_POLICY_FILE_TMP_DIR_SUFFIX); + Assert.assertEquals(configuration.getZtsPublicKey(null, "0"), Crypto.loadPublicKey(Crypto.ybase64DecodeString(EXPECTED_ZTS_PUBLIC_KEY_K0))); + Assert.assertEquals(configuration.getZtsPublicKey(null, "1"), Crypto.loadPublicKey(Crypto.ybase64DecodeString(EXPECTED_ZTS_PUBLIC_KEY_K1))); + + List domainList = configuration.getDomainList(); + Assert.assertNotNull(domainList); + Assert.assertEquals(domainList.size(), 2); + Assert.assertTrue(domainList.contains("athenz.ci")); + Assert.assertTrue(domainList.contains("coretech.hosted")); + + // Set the ROOT env variable to /home/myroot + Map newenv = new HashMap(); + newenv.put("ROOT", TEST_ROOT_DIR); + setEnvironmentVar(newenv); + configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + Assert.assertEquals(configuration.getRootDir(), TEST_ROOT_DIR); + Assert.assertEquals(configuration.getPolicyFileDir(), "src/test/resources"); + Assert.assertEquals(configuration.getPolicyFileTmpDir(), TEST_ROOT_DIR + EXPECTED_POLICY_FILE_TMP_DIR_SUFFIX); + + // use the test root + // + System.setProperty(PolicyUpdaterConfiguration.ZPU_PROP_TEST_ROOT_PATH, rootPath); + + configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + Assert.assertEquals(configuration.getRootDir(), "src/test/resources"); + Assert.assertEquals(configuration.getPolicyFileDir(), "src/test/resources"); //set in pom.xml + Assert.assertEquals(configuration.getPolicyFileTmpDir(), "src/test/resources" + EXPECTED_POLICY_FILE_TMP_DIR_SUFFIX); + Assert.assertEquals(configuration.getZpuDirOwner(), "root"); + } + + @Test + public void TestVerifySignature() throws Exception { + + System.setProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY, "com.yahoo.athenz.zpe_policy_updater.MockMetricFactory"); + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + + SignPoliciesUtility.signPolicies("./src/test/resources/zts_private_k0.pem", + "./src/test/resources/zms_private_k0.pem", "./src/test/resources/sys.auth.pol", + "./src/test/resources/sys.auth.new.pol"); + + Path path = Paths.get("./src/test/resources/sys.auth.new.pol"); + DomainSignedPolicyData domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + Assert.assertTrue(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new")); + + // negative test with tampered publickey - zts pubkey failure + PolicyUpdaterConfiguration confMock = Mockito.mock(PolicyUpdaterConfiguration.class); + Mockito.when(confMock.getZtsPublicKey(Mockito.any(ZTSClient.class), Mockito.anyString())).thenReturn(null); + Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, confMock, domainPolicySignedData, "sys.auth.new")); + + // negative test with tampered publickey - zms pubkey failure + confMock = Mockito.mock(PolicyUpdaterConfiguration.class); + PublicKey pKey = Crypto.loadPublicKey(Crypto.ybase64DecodeString("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0" + + "RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TD" + + "Nza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbX" + + "ZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIF" + + "BVQkxJQyBLRVktLS0tLQo-")); + Mockito.when(confMock.getZtsPublicKey(Mockito.any(ZTSClient.class), Mockito.anyString())).thenReturn(pKey); + Mockito.when(confMock.getZmsPublicKey(Mockito.any(ZTSClient.class), Mockito.anyString())).thenReturn(null); + Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, confMock, domainPolicySignedData, "sys.auth.new")); + + // negative test with tampered expiration - zts signature failure + path = Paths.get("./src/test/resources/sys.auth.pol.tampered.zts"); + domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new")); + + // negative test with tampered actions - zms signature failure + path = Paths.get("./src/test/resources/sys.auth.pol.tampered.zms"); + domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new")); + + // Test error handling for illegal arguments + boolean exceptionCaught = false; + try { + PolicyUpdater.validateSignedPolicies(null, configuration, null, "sys.auth.new"); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + + exceptionCaught = false; + try { + PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, null); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + + System.clearProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY); + } + + @Test + public void TestValidateExpiredPolicies() throws Exception { + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + + ZTSMock zts = new ZTSMock(); + zts.setPublicKeyId("0"); + DomainSignedPolicyData domainPolicySignedData = zts.getDomainSignedPolicyData("expiredDomain", null, null); + Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "expiredDomain")); + } + + @Test + public void TestValidateExpiredPolicies_defaultConfDir() throws Exception { + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + try { + configuration.init(null, null); + Assert.fail(); + } catch (Exception e) { + } + } + + @Test + public void TestWritePolicies() throws Exception { + Path path = Paths.get("./src/test/resources/sys.auth.pol"); + DomainSignedPolicyData domainPolicySignedDataInput = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + PolicyUpdater.writePolicies(pupConfig, "sys.auth", domainPolicySignedDataInput); + + path = Paths.get(pupConfig.getRootDir() + TEST_POLICY_DIR + "/sys.auth.pol"); + JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + + // test handling of missing tmp dir + // + Path sysauthPath = Paths.get(pupConfig.getRootDir() + TEST_POLICY_TEMP_DIR + "/tmp/sys.auth"); + Files.deleteIfExists(sysauthPath); + sysauthPath = Paths.get(pupConfig.getRootDir() + TEST_POLICY_TEMP_DIR + "/tmp"); + Files.deleteIfExists(sysauthPath); + java.io.File polFile = path.toFile(); + long flen = polFile.length(); + long fmod = polFile.lastModified(); + Thread.sleep(1000); + + System.setProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY, "com.yahoo.athenz.zpe_policy_updater.MockMetricFactory"); + + PolicyUpdaterConfiguration config = new PolicyUpdaterConfiguration(); + config.init(pathToAthenzConfigFile, pathToZPUConfigFile); + config.setPolicyFileTmpDir(pupConfig.getRootDir() + TEST_POLICY_TEMP_DIR + "/tmp"); + config.setPolicyFileDir(pupConfig.getRootDir() + TEST_POLICY_DIR); + PolicyUpdater.writePolicies(config, "sys.auth", domainPolicySignedDataInput); + long flen2 = polFile.length(); + long fmod2 = polFile.lastModified(); + Assert.assertTrue(flen == flen2); + Assert.assertTrue(fmod < fmod2); + + // Test error handling for illegal arguments + boolean exceptionCaught = false; + try { + PolicyUpdater.writePolicies(null, "sys.auth", domainPolicySignedDataInput); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + + exceptionCaught = false; + try { + config.setPolicyFileTmpDir(null); + PolicyUpdater.writePolicies(config, "sys.auth", domainPolicySignedDataInput); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + + exceptionCaught = false; + try { + config.setPolicyFileTmpDir(TEST_POLICY_TEMP_DIR); + config.setPolicyFileDir(null); + PolicyUpdater.writePolicies(config, "sys.auth", domainPolicySignedDataInput); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + + try { + config.setPolicyFileDir(TEST_POLICY_DIR); + PolicyUpdater.writePolicies(config, null, domainPolicySignedDataInput); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + + try { + PolicyUpdater.writePolicies(config, "sys.auth", null); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + + Files.delete(path); + + System.clearProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY); + } + + @Test + public void TestGetEtagForExistingPolicy() throws Exception, IOException { + String expectedEtag = SignPoliciesUtility.signPolicies("./src/test/resources/zts_private_k0.pem", + "./src/test/resources/zms_private_k0.pem", "./src/test/resources/sys.auth.pol", + "./src/test/resources/sys.auth.new.pol"); + + Map newenv = new HashMap(); + newenv.put("STARTUP_DELAY", Integer.toString(TEST_STARTUP_DELAY)); + setEnvironmentVar(newenv); + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + + String matchingTag = PolicyUpdater.getEtagForExistingPolicy(null, configuration, "sys.auth.new"); + Assert.assertEquals(matchingTag, expectedEtag); + + matchingTag = PolicyUpdater.getEtagForExistingPolicy(null, configuration, "sys.auth.new"); + Assert.assertEquals(matchingTag, expectedEtag); + } + + @Test + public void TestGetEtagForExistingPolicy_ExpirationLessThanStartUpDelay() throws Exception, IOException { + + Map newenv = new HashMap(); + newenv.put("STARTUP_DELAY", Integer.toString(TEST_STARTUP_DELAY)); + setEnvironmentVar(newenv); + System.setProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY, "com.yahoo.athenz.zpe_policy_updater.MockMetricFactory"); + + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + + String matchingTag = PolicyUpdater.getEtagForExistingPolicy(null, configuration, "sys.auth"); + Assert.assertNull(matchingTag); + + matchingTag = PolicyUpdater.getEtagForExistingPolicy(null, configuration, "sys.auth"); + Assert.assertNull(matchingTag); + + System.clearProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY); + } + + @Test + public void TestGetEtagForExistingPolicy_NoPolicyFile() throws Exception { + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + + // Negative test, getEtagForExistingPolicy should return null when no policy file is found + String matchingTag = PolicyUpdater.getEtagForExistingPolicy(null, configuration, "testDomain"); + Assert.assertNull(matchingTag); + } + + @Test + public void TestGetEtagForExistingPolicy_IllegalArgs() throws Exception { + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + + // Test error handling for illegal arguments + boolean exceptionCaught = false; + + try { + PolicyUpdater.getEtagForExistingPolicy(null, configuration, null); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + } + + @Test + public void TestGetEtagForExistingPolicy_BadPolicyFileDir_IllegalArgs() throws Exception { + + PolicyUpdaterConfiguration configMock = Mockito.mock(PolicyUpdaterConfiguration.class); + Mockito.when(configMock.getPolicyFileDir()).thenReturn(null); + + // Test error handling for illegal arguments + boolean exceptionCaught = false; + + try { + PolicyUpdater.getEtagForExistingPolicy(null, configMock, "testDomain"); + } catch (IllegalArgumentException ex) { + exceptionCaught = true; + } + Assert.assertTrue(exceptionCaught); + } + + @Test + public void TestPolicyUpdater() throws Exception { + System.setProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY, "com.yahoo.athenz.zpe_policy_updater.MockMetricFactory"); + + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUEmptyConfigFile); + configuration.setPolicyFileDir(configuration.getRootDir() + TEST_POLICY_DIR); + configuration.setPolicyFileTmpDir(configuration.getRootDir() + TEST_POLICY_TEMP_DIR); + + DebugZTSClientFactory ztsFactory = new DebugZTSClientFactory(); + ztsFactory.setPublicKeyId("0"); + PolicyUpdater.policyUpdater(configuration, new DebugSIAClientFactory(), ztsFactory); + + Path path = Paths.get(configuration.getRootDir() + TEST_POLICY_DIR + File.separator + "sports.pol"); + DomainSignedPolicyData domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + + // Validate that the SignedPolicy written to target/classes is correct, return value is true when policies are correctly validated + Assert.assertTrue(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sports")); + + Files.delete(path); + + path = Paths.get(configuration.getRootDir() + TEST_POLICY_DIR + File.separator + "sys.auth.pol"); + domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); + + // Validate that the SignedPolicy written to target/classes is correct, return value is true when policies are correctly validated + Assert.assertTrue(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.pol")); + + Files.delete(path); + + System.clearProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY); + } + + @Test + public void TestPolicyUpdaterEmptyDomainList() throws Exception { + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUEmptyConfigFile); + configuration.setPolicyFileDir("./target/classes"); + + PolicyUpdater.policyUpdater(configuration, new DebugSIAClientFactory(true), new DebugZTSClientFactory()); + + // Domain list was empty so no file should be found + Path path = Paths.get("./target/classes/sports.pol"); + try { + @SuppressWarnings("unused") + String fileBufferOutput = new String(Files.readAllBytes(path)); + Assert.fail(); + } catch (IOException ex) { + Assert.assertTrue(true); + } + } + + @Test + public void TestPolicyUpdaterSIANotHasDomainList() throws Exception { + + PolicyUpdaterConfiguration confMock = Mockito.mock(PolicyUpdaterConfiguration.class); + Mockito.when(confMock.getDomainList()).thenReturn(null); + + // sia has no domainList + SIA siaMock = Mockito.mock(SIA.class); + Mockito.when(siaMock.getDomainList()).thenReturn(null); + + SIAClientFactory siafactoryMock = Mockito.mock(SIAClientFactory.class); + Mockito.when(siafactoryMock.create()).thenReturn(siaMock); + + try { + PolicyUpdater.policyUpdater(confMock, siafactoryMock, new DebugZTSClientFactory()); + Assert.fail(); + } catch(Exception e) { + Assert.assertEquals(e.getMessage(), "no configured domains to process"); + } + } + + @Test + public void TestPolicyUpdaterZTSException() throws Exception { + System.setProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY, "com.yahoo.athenz.zpe_policy_updater.MockMetricFactory"); + + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUEmptyConfigFile); + configuration.setPolicyFileDir(configuration.getRootDir() + TEST_POLICY_DIR); + configuration.setPolicyFileTmpDir(configuration.getRootDir() + TEST_POLICY_TEMP_DIR); + + DebugZTSClientFactory ztsFactory = new DebugZTSClientFactory(); + ztsFactory.setPublicKeyId("4"); // not exist id + PolicyUpdater.policyUpdater(configuration, new DebugSIAClientFactory(), ztsFactory); + } + + @Test + public void TestPolicyUpdaterConfiguraturationZTSKeyRetrieval() throws Exception { + + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); + Assert.assertNotNull(configuration.getZtsPublicKey(null, "0")); + Assert.assertNotNull(configuration.getZtsPublicKey(null, "1")); + Assert.assertNull(configuration.getZtsPublicKey(null, "2")); + } + + // URI null is not allow + @Test(expectedExceptions={java.lang.NullPointerException.class}) + public void TestZTSClientFactoryImpl() { + ZTSClientFactoryImpl factory = new ZTSClientFactoryImpl(); + factory.create(); + } + + @Test + public void TestSIAClientFactoryImpl() { + SIAClientFactoryImpl siafactory = new SIAClientFactoryImpl(); + Assert.assertEquals(siafactory.create().getClass(), SIAClient.class); + } + + @Test + public void TestPolicyUpdaterConfigGetSet() { + PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); + configuration.setRootDir("/home/root"); + configuration.setDebugMode(true); + configuration.setStartupDelayInterval(2); + + Assert.assertEquals(configuration.getRootDir(), "/home/root"); + Assert.assertEquals(configuration.isDebugMode(), true); + Assert.assertEquals(configuration.getStartupDelayIntervalInSecs(), 2*60); + + } + + @Test + public void TestverifyTmpDirSetupUserNull() throws Exception { + System.setProperty(PolicyUpdaterConfiguration.ZPU_PROP_METRIC_FACTORY, "com.yahoo.athenz.zpe_policy_updater.MockMetricFactory"); + + PolicyUpdaterConfiguration config = Mockito.mock(PolicyUpdaterConfiguration.class); + Mockito.when(config.getPolicyFileTmpDir()).thenReturn(pupConfig.getRootDir() + TEST_POLICY_TEMP_DIR + "/tmpnon"); + Mockito.when(config.getZpuDirOwner()).thenReturn(null); + + boolean expectedCaught = true; + try { + PolicyUpdater.verifyTmpDirSetup(config); + } catch (Exception e) { + } + Assert.assertTrue(expectedCaught); + } + + private void setEnvironmentVar(Map newenv) throws Exception { + @SuppressWarnings("rawtypes") + Class[] classes = Collections.class.getDeclaredClasses(); + Map env = System.getenv(); + for (@SuppressWarnings("rawtypes") Class cl : classes) { + if ("java.util.Collections$UnmodifiableMap".equals(cl.getName())) { + Field field = cl.getDeclaredField("m"); + field.setAccessible(true); + Object obj = field.get(env); + @SuppressWarnings("unchecked") + Map map = (Map) obj; + map.clear(); + map.putAll(newenv); + } + } + } +} diff --git a/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/SIAClientMock.java b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/SIAClientMock.java new file mode 100644 index 00000000000..e33bafcc2cf --- /dev/null +++ b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/SIAClientMock.java @@ -0,0 +1,103 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.util.ArrayList; +import java.util.List; + +import com.yahoo.athenz.auth.Principal; +import com.yahoo.athenz.auth.impl.PrincipalAuthority; +import com.yahoo.athenz.auth.impl.SimplePrincipal; +import com.yahoo.athenz.auth.token.PrincipalToken; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.sia.SIA; + +public class SIAClientMock implements SIA { + + private final String svcVersion = "S1"; + private final String host = "somehost.somecompany.com"; + private final String salt = "saltvalue"; + private final long expirationTime = 10; // 10 seconds + private PrivateKey servicePrivateKeyK0 = null; + private PrivateKey servicePrivateKeyK1 = null; + private String keyId = "0"; + + private List domainList = new ArrayList(); + + public SIAClientMock(boolean emptyDomainList) throws IOException + { + loadKeys(); + + if (emptyDomainList) { + setDomainListEmpty(); + } else { + setDomainList(); + } + } + + public void setDomainListEmpty() { + domainList.clear(); + } + + public void setDomainList() { + domainList.add("sports"); + domainList.add("sys.auth"); + } + + private void loadKeys() throws IOException { + Path path = Paths.get("./src/test/resources/zts_private_k0.pem"); + servicePrivateKeyK0 = Crypto.loadPrivateKey(new String(Files.readAllBytes(path))); + + path = Paths.get("./src/test/resources/zts_private_k1.pem"); + servicePrivateKeyK1 = Crypto.loadPrivateKey(new String(Files.readAllBytes(path))); + } + + public void setPublicKeyId(String keyId) { + this.keyId = keyId; + } + + @Override + public ArrayList getDomainList() throws IOException { + return (ArrayList) domainList; + } + + @Override + public Principal getServicePrincipal(String domain, String service, + Integer minExpiryTime, Integer maxExpiryTime, boolean ignoreCache) throws IOException { + // Create and sign token + PrincipalToken token = new PrincipalToken.Builder(svcVersion, domain, service) + .host(host).salt(salt).issueTime(System.currentTimeMillis()) + .expirationWindow(expirationTime).keyId(keyId).build(); + + if ("0".equals(keyId)) { + token.sign(servicePrivateKeyK0); + }else if ("1".equals(keyId)) { + token.sign(servicePrivateKeyK1); + } + + Principal principal = SimplePrincipal.create(domain, service, token.getSignedToken(), new PrincipalAuthority()); + + // Create a token for validation using the signed data + return principal; + } + +} diff --git a/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/SignPoliciesUtility.java b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/SignPoliciesUtility.java new file mode 100644 index 00000000000..53a6947c3e3 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/SignPoliciesUtility.java @@ -0,0 +1,94 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.File; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; + +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zts.DomainSignedPolicyData; +import com.yahoo.athenz.zts.PolicyData; +import com.yahoo.athenz.zts.SignedPolicyData; +import com.yahoo.rdl.JSON; +import com.yahoo.rdl.Timestamp; + +/** + * Sign policy files + * + */ +public class SignPoliciesUtility +{ + private static void usage() { + System.out.println("usage: java -cp "); + System.exit(-1); + } + + static String signPolicies(String ztsPrivateKeyPath, String zmsPrivateKeyPath, String signedPolicyFile, + String newPolicyFile) { + + String etag = null; + try { + Path path = Paths.get(ztsPrivateKeyPath); + PrivateKey ztsPrivateKey = Crypto.loadPrivateKey(new String((Files.readAllBytes(path)))); + + path = Paths.get(zmsPrivateKeyPath); + PrivateKey zmsPrivateKey = Crypto.loadPrivateKey(new String((Files.readAllBytes(path)))); + + path = Paths.get(signedPolicyFile); + DomainSignedPolicyData domainSignedPolicyData = JSON.fromBytes(Files.readAllBytes(path), + DomainSignedPolicyData.class); + SignedPolicyData signedPolicyData = domainSignedPolicyData.getSignedPolicyData(); + + PolicyData policyData = signedPolicyData.getPolicyData(); + signedPolicyData.setZmsSignature(Crypto.sign(SignUtils.asCanonicalString(policyData), zmsPrivateKey)); + signedPolicyData.setZmsKeyId("0"); + + long curTime = System.currentTimeMillis(); + Timestamp modified = Timestamp.fromMillis(curTime); + signedPolicyData.setModified(modified); + + Timestamp expires = Timestamp.fromMillis(curTime + (1000L * 60 * 60 * 24 * 7)); + signedPolicyData.setExpires(expires); + + String signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData), ztsPrivateKey); + domainSignedPolicyData.setSignature(signature).setKeyId("0"); + File file = new File(newPolicyFile); + file.createNewFile(); + Files.write(file.toPath(), JSON.bytes(domainSignedPolicyData)); + + etag = "\"" + modified.toString() + "\""; + } catch (IOException e) { + System.out.println("Exception: " + e.getMessage()); + System.exit(-1); + } + + System.out.println("Signed " + newPolicyFile + " policy file"); + return etag; + } + + public static void main(String[] args) { + if (args.length != 4) { + usage(); + } + + signPolicies(args[0], args[1], args[2], args[3]); + } +} diff --git a/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/ZTSMock.java b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/ZTSMock.java new file mode 100644 index 00000000000..751b86b4d4f --- /dev/null +++ b/utils/zpe_policy_updater/src/test/java/com/yahoo/athenz/zpe_policy_updater/ZTSMock.java @@ -0,0 +1,238 @@ +/** + * Copyright 2016 Yahoo Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.yahoo.athenz.zpe_policy_updater; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.security.PrivateKey; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; + +import com.yahoo.rdl.Timestamp; +import com.yahoo.athenz.auth.util.Crypto; +import com.yahoo.athenz.common.utils.SignUtils; +import com.yahoo.athenz.zts.AWSCertificateRequest; +import com.yahoo.athenz.zts.AWSInstanceInformation; +import com.yahoo.athenz.zts.AWSTemporaryCredentials; +import com.yahoo.athenz.zts.Access; +import com.yahoo.athenz.zts.Assertion; +import com.yahoo.athenz.zts.AssertionEffect; +import com.yahoo.athenz.zts.DomainMetrics; +import com.yahoo.athenz.zts.DomainSignedPolicyData; +import com.yahoo.athenz.zts.HostServices; +import com.yahoo.athenz.zts.Identity; +import com.yahoo.athenz.zts.InstanceInformation; +import com.yahoo.athenz.zts.InstanceRefreshRequest; +import com.yahoo.athenz.zts.Policy; +import com.yahoo.athenz.zts.PolicyData; +import com.yahoo.athenz.zts.PublicKeyEntry; +import com.yahoo.athenz.zts.RoleToken; +import com.yahoo.athenz.zts.ServiceIdentity; +import com.yahoo.athenz.zts.ServiceIdentityList; +import com.yahoo.athenz.zts.SignedPolicyData; +import com.yahoo.athenz.zts.TenantDomains; +import com.yahoo.athenz.zts.ZTSClientException; +import com.yahoo.athenz.zts.ZTSRDLGeneratedClient; + +public class ZTSMock extends ZTSRDLGeneratedClient { + private PrivateKey ztsPrivateKeyK0 = null; + private PrivateKey ztsPrivateKeyK1 = null; + private PrivateKey zmsPrivateKeyK0 = null; + private String keyId = "0"; + + public ZTSMock() throws IOException { + super("http://localhost:10080"); + loadKeys(); + } + + private void loadKeys() throws IOException { + Path path = Paths.get("./src/test/resources/zts_private_k0.pem"); + ztsPrivateKeyK0 = Crypto.loadPrivateKey(new String(Files.readAllBytes(path))); + + path = Paths.get("./src/test/resources/zts_private_k1.pem"); + ztsPrivateKeyK1 = Crypto.loadPrivateKey(new String(Files.readAllBytes(path))); + + path = Paths.get("./src/test/resources/zms_private_k0.pem"); + zmsPrivateKeyK0 = Crypto.loadPrivateKey(new String(Files.readAllBytes(path))); + } + + void setPublicKeyId(String keyId) { + this.keyId = keyId; + } + + @Override + public DomainSignedPolicyData getDomainSignedPolicyData(String domainName, + String matchingTag, Map> responseHeaders) { + + DomainSignedPolicyData result = null; + if (!domainName.equals("sports") && + !domainName.equals("sys.auth") && + !domainName.equals("expiredDomain")) { + return result; + } + + SignedPolicyData signedPolicyData = new SignedPolicyData(); + + Timestamp expires; + if (domainName.equals("expiredDomain")) { + expires = Timestamp.fromMillis(System.currentTimeMillis() + - (1000L * 60)); + } else { + expires = Timestamp.fromMillis(System.currentTimeMillis() + + (1000L * 60 * 60 * 24 * 7)); + } + signedPolicyData.setExpires(expires); + + Timestamp modified = Timestamp.fromMillis(System.currentTimeMillis()); + signedPolicyData.setModified(modified); + + String policyName = domainName + ":policy." + "admin"; + Policy policy = new Policy(); + policy.setName(policyName); + + Assertion assertion = new Assertion(); + assertion.setAction("*"); + assertion.setEffect(AssertionEffect.ALLOW); + assertion.setResource("*"); + + String roleName = domainName + ":role." + "admin"; + assertion.setRole(roleName); + + List assertList = new ArrayList(); + assertList.add(assertion); + + assertion = new Assertion(); + assertion.setAction("*"); + assertion.setEffect(AssertionEffect.DENY); + assertion.setResource("*"); + + roleName = domainName + ":role." + "non-admin"; + assertion.setRole(roleName); + assertList.add(assertion); + + policy.setAssertions(assertList); + + List listOfPolicies = new ArrayList(); + listOfPolicies.add(policy); + + PolicyData policyData = new PolicyData(); + policyData.setPolicies(listOfPolicies); + policyData.setDomain(domainName); + + signedPolicyData.setPolicyData(policyData); + signedPolicyData.setZmsKeyId("0"); + signedPolicyData.setZmsSignature(Crypto.sign(SignUtils.asCanonicalString(policyData), zmsPrivateKeyK0)); + + DomainSignedPolicyData domainSignedPolicyData = new DomainSignedPolicyData(); + domainSignedPolicyData.setSignedPolicyData(signedPolicyData); + + PrivateKey ztsKey = null; + if ("0".equals(keyId)) { + ztsKey = ztsPrivateKeyK0; + } else if ("1".equals(keyId)) { + ztsKey = ztsPrivateKeyK1; + } + + String signature = Crypto.sign(SignUtils.asCanonicalString(signedPolicyData), ztsKey); + domainSignedPolicyData.setKeyId(keyId); + domainSignedPolicyData.setSignature(signature); + + return domainSignedPolicyData; + } + + @Override + public HostServices getHostServices(String arg0) { + return null; + } + + @Override + public RoleToken getRoleToken(String domainName, String role, + Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal) { + return null; + } + + @Override + public ServiceIdentity getServiceIdentity(String domainName, String serviceName) { + return null; + } + + @Override + public ServiceIdentityList getServiceIdentityList(String domainName) { + return null; + } + + @Override + public PublicKeyEntry getPublicKeyEntry(String domainName, String serviceName, + String keyId) { + PublicKeyEntry keyEntry = null; + if ("2".equals(keyId)) { + keyEntry = new PublicKeyEntry(); + Path path = Paths.get("./src/test/resources/zts_public_k1.pem"); + keyEntry.setId(keyId); + try { + keyEntry.setKey(Crypto.ybase64(Files.readAllBytes(path))); + } catch (IOException e) { + e.printStackTrace(); + } + } + if (keyEntry == null) { + throw new ZTSClientException(404, "Unknown ZTS Public Key"); + } else { + return keyEntry; + } + } + + @Override + public AWSTemporaryCredentials getAWSTemporaryCredentials(String domainName, String roleName) { + return null; + } + @Override + public Identity postInstanceInformation(InstanceInformation info) { + return null; + } + @Override + public TenantDomains getTenantDomains(String providerDomainName, String userName, String roleName, String serviceName) { + return null; + } + + @Override + public Access getAccess(String arg0, String arg1, String arg2) { + return null; + } + + @Override + public Identity postAWSCertificateRequest(String arg0, String arg1, AWSCertificateRequest arg2) { + return null; + } + + @Override + public Identity postAWSInstanceInformation(AWSInstanceInformation arg0) { + return null; + } + + @Override + public DomainMetrics postDomainMetrics(String arg0, DomainMetrics arg1) { + return null; + } + + @Override + public Identity postInstanceRefreshRequest(String arg0, String arg1, InstanceRefreshRequest arg2) { + return null; + } +} diff --git a/utils/zpe_policy_updater/src/test/resources/athenz.conf b/utils/zpe_policy_updater/src/test/resources/athenz.conf new file mode 100755 index 00000000000..2ec9767b4f1 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/athenz.conf @@ -0,0 +1,24 @@ +{ + "zmsUrl": "http://dev.zms.athenzcompany.com:4443/", + "ztsUrl": "https://dev.zts.athenzcompany.com:4443/", + "ztsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + }, + { + "id": "1", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBUFpyWkMxelBhNXBQZloxaXFtcjdnWW9YaHVIbGlSUApVbnlLelliWWhRZXpUSlJlSDBsdWhvVVdQdTZxeWRHSm54RVUyTldNQ1hZLzhuL1VGSUZvakYwQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ], + "zmsPublicKeys": [ + { + "id": "0", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + }, + { + "id": "1", + "key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TDNza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbXZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo-" + } + ] +} diff --git a/utils/zpe_policy_updater/src/test/resources/logback.xml b/utils/zpe_policy_updater/src/test/resources/logback.xml new file mode 100644 index 00000000000..2ce05abfc06 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/logback.xml @@ -0,0 +1,17 @@ + + + + + System.out + + %d{HH:mm:ss.SSS} [%thread] %-5level %class - %msg%n + + + + + + + + + + diff --git a/utils/zpe_policy_updater/src/test/resources/pol_dir/.keepme b/utils/zpe_policy_updater/src/test/resources/pol_dir/.keepme new file mode 100644 index 00000000000..e69de29bb2d diff --git a/utils/zpe_policy_updater/src/test/resources/sports.pol b/utils/zpe_policy_updater/src/test/resources/sports.pol new file mode 100644 index 00000000000..bd92c395671 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/sports.pol @@ -0,0 +1,28 @@ +{ + "contents": { + "domain": "sports", + "modified": "2015-01-13T19:13:18.601Z", + "policies": [ + { + "name": "sports:policy.admin", + "assertions": [ + { + "resource": "*", + "role": "sports:role.admin", + "action": "*", + "effect": "ALLOW" + }, + { + "resource": "*", + "role": "sports:role.non-admin", + "action": "*", + "effect": "DENY" + } + ] + } + ], + "expires": "2015-01-20T19:13:18.599Z" + }, + "signature": "qJXtTXPI0aQcxUgerT9X4BM6HoKVM1pNClt86UViintmC5.IK9uYoFhtdMfDLq7Kzc8jdyT1iCqv_OmEyMHLCA--", + "keyId": "0" +} diff --git a/utils/zpe_policy_updater/src/test/resources/sys.auth.pol b/utils/zpe_policy_updater/src/test/resources/sys.auth.pol new file mode 100644 index 00000000000..5031cfe7bad --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/sys.auth.pol @@ -0,0 +1,32 @@ +{ + "signedPolicyData": { + "modified": "2015-01-13T19:13:37.745Z", + "policyData": { + "domain": "sys.auth", + "policies": [ + { + "name": "sys.auth:policy.admin", + "assertions": [ + { + "resource": "*", + "role": "sys.auth:role.admin", + "action": "*", + "effect": "ALLOW" + }, + { + "resource": "*", + "role": "sys.auth:role.non-admin", + "action": "*", + "effect": "DENY" + } + ] + } + ] + }, + "expires": "2015-01-20T19:13:37.744Z", + "zmsSignature": "eN5aZiqCof3HjHctjkYB2itNvI.90u.bq6zzLoXG8CJ8hSwG6IBMaIQ0yf.Q_SR5HTFi7Tmrc1quQuH17H0PJg--", + "zmsKeyId": "0" + }, + "signature": "eN5aZiqCof3HjHctjkYB2itNvI.90u.bq6zzLoXG8CJ8hSwG6IBMaIQ0yf.Q_SR5HTFi7Tmrc1quQuH17H0PJg--", + "keyId": "0" +} diff --git a/utils/zpe_policy_updater/src/test/resources/sys.auth.pol.tampered.zms b/utils/zpe_policy_updater/src/test/resources/sys.auth.pol.tampered.zms new file mode 100644 index 00000000000..a02d42c273a --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/sys.auth.pol.tampered.zms @@ -0,0 +1,32 @@ +{ + "signature": "e7Nuk70agdFv54UOWf4EauTYuAQ3ww_G5A_5OiBt22DQVv23DVTCLovtWNBdzcsmDgdDAxGwWO2CG1T4uT0KhA--", + "keyId": "0", + "signedPolicyData": { + "zmsSignature": "Y2HuXmgL86PL1WnleGFHwPmNEqUdWgDxmmIsDnF5f5oqakacqTtwt9JNqDV9nuJ7LnKl3zsZoDQSAtcHMu4IGA--", + "zmsKeyId": "0", + "expires": "2015-10-16T05:29:29.507Z", + "policyData": { + "policies": [ + { + "name": "sys.auth:policy.admin", + "assertions": [ + { + "resource": "*", + "role": "sys.auth:role.admin", + "action": "*", + "effect": "DENY" + }, + { + "resource": "*", + "role": "sys.auth:role.non-admin", + "action": "*", + "effect": "ALLOW" + } + ] + } + ], + "domain": "sys.auth" + }, + "modified": "2015-10-09T05:29:29.507Z" + } +} diff --git a/utils/zpe_policy_updater/src/test/resources/sys.auth.pol.tampered.zts b/utils/zpe_policy_updater/src/test/resources/sys.auth.pol.tampered.zts new file mode 100644 index 00000000000..43a15a2c9c4 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/sys.auth.pol.tampered.zts @@ -0,0 +1,32 @@ +{ + "signature": "e7Nuk70agdFv54UOWf4EauTYuAQ3ww_G5A_5OiBt22DQVv23DVTCLovtWNBdzcsmDgdDAxGwWO2CG1T4uT0KhA--", + "keyId": "0", + "signedPolicyData": { + "zmsSignature": "Y2HuXmgL86PL1WnleGFHwPmNEqUdWgDxmmIsDnF5f5oqakacqTtwt9JNqDV9nuJ7LnKl3zsZoDQSAtcHMu4IGA--", + "zmsKeyId": "0", + "expires": "2015-10-16T05:29:28.507Z", + "policyData": { + "policies": [ + { + "name": "sys.auth:policy.admin", + "assertions": [ + { + "resource": "*", + "role": "sys.auth:role.admin", + "action": "*", + "effect": "ALLOW" + }, + { + "resource": "*", + "role": "sys.auth:role.non-admin", + "action": "*", + "effect": "DENY" + } + ] + } + ], + "domain": "sys.auth" + }, + "modified": "2015-10-09T05:29:29.507Z" + } +} diff --git a/utils/zpe_policy_updater/src/test/resources/tmp/.keepme b/utils/zpe_policy_updater/src/test/resources/tmp/.keepme new file mode 100644 index 00000000000..e69de29bb2d diff --git a/utils/zpe_policy_updater/src/test/resources/zms_private_k0.pem b/utils/zpe_policy_updater/src/test/resources/zms_private_k0.pem new file mode 100644 index 00000000000..356e1edf8bd --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zms_private_k0.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- diff --git a/utils/zpe_policy_updater/src/test/resources/zms_public_k0.pem b/utils/zpe_policy_updater/src/test/resources/zms_public_k0.pem new file mode 100644 index 00000000000..727c3c67f22 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zms_public_k0.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- diff --git a/utils/zpe_policy_updater/src/test/resources/zpu.conf b/utils/zpe_policy_updater/src/test/resources/zpu.conf new file mode 100644 index 00000000000..73e9af4948e --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zpu.conf @@ -0,0 +1,4 @@ +{ + "domains": "athenz.ci,coretech.hosted", + "user": "root" +} diff --git a/utils/zpe_policy_updater/src/test/resources/zpu_empty.conf b/utils/zpe_policy_updater/src/test/resources/zpu_empty.conf new file mode 100644 index 00000000000..0e09533bca3 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zpu_empty.conf @@ -0,0 +1,3 @@ +{ + "domains": "" +} diff --git a/utils/zpe_policy_updater/src/test/resources/zpu_private.pem b/utils/zpe_policy_updater/src/test/resources/zpu_private.pem new file mode 100644 index 00000000000..356e1edf8bd --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zpu_private.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- diff --git a/utils/zpe_policy_updater/src/test/resources/zpu_public.pem b/utils/zpe_policy_updater/src/test/resources/zpu_public.pem new file mode 100644 index 00000000000..727c3c67f22 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zpu_public.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- diff --git a/utils/zpe_policy_updater/src/test/resources/zts_private_k0.pem b/utils/zpe_policy_updater/src/test/resources/zts_private_k0.pem new file mode 100644 index 00000000000..356e1edf8bd --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zts_private_k0.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOgIBAAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTqa+RwOH3ZcMKyoGxOJo9A +yeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQJARpQBv09w/j6O7TmgtJm4 +Ws5bIxMgOkrHaqPs2Epq8rX8FUyaYSHBL4yYhqWlno4j1TrLzWneni8kJCUNJydU +AQIhAPXBXPQ3UzzNeQC5gbcweMMIQOYHyF7W/NAEILSKgy6hAiEAxL7hOjpdYGtj +hjG1nVIs+HW6z5TnRig7JjTwqA8RMdECIQC4oPCIuRfb0jJaDQQa8FuJiqXXK3mp +ZrLARJmdiYJMgQIgZxpAnWsIlAay2RgjvJXbyzim9TFrIXDjzlnf47JBqIECIBue +3ht9BnawOQqGzFjD89dFQ6nZtbiAaqORj276/SzZ +-----END RSA PRIVATE KEY----- diff --git a/utils/zpe_policy_updater/src/test/resources/zts_private_k1.pem b/utils/zpe_policy_updater/src/test/resources/zts_private_k1.pem new file mode 100644 index 00000000000..5d5faa50a71 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zts_private_k1.pem @@ -0,0 +1,9 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIBOwIBAAJBAPZrZC1zPa5pPfZ1iqmr7gYoXhuHliRPUnyKzYbYhQezTJReH0lu +hoUWPu6qydGJnxEU2NWMCXY/8n/UFIFojF0CAwEAAQJAALfZZ+SBFoQKATDggZQV +soDlnVDs2Bg/FkvVQ4JYCOi0ZqOGjsqplvw7vfML14zPbT7g7gnFCT5TXYzO8qYB +xQIhAPzUNTbMbiQCf5leOn5tLj5imgDtFfy185wbjIt1Sx/DAiEA+YKakkhvHqBP ++cJQaBRneLt5RJXDsEB7xc3uaER4AV8CIHYApYWaDJ4J/Hwcmrh/ROIhKzfbcDOu +yLDHuuUsLY/5AiEAt+LVYHIZ0wx7ZKsc71f6WjRwz2dA7ajYj5OR3S548ykCIQCC +W9QxTqfLoDGTj3Oe5rSyDquXyOz+45hfsZCuLniQkA== +-----END RSA PRIVATE KEY----- diff --git a/utils/zpe_policy_updater/src/test/resources/zts_public_k0.pem b/utils/zpe_policy_updater/src/test/resources/zts_public_k0.pem new file mode 100644 index 00000000000..727c3c67f22 --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zts_public_k0.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALzfSOTQJfEm1em4L3skyNVQ/bx0MOTq +a+RwOH3ZcMKyoGxOJo9AyeRa6FXMmvJJGYs5P34YszFpnj2uAbi24nECAwEAAQ== +-----END PUBLIC KEY----- diff --git a/utils/zpe_policy_updater/src/test/resources/zts_public_k1.pem b/utils/zpe_policy_updater/src/test/resources/zts_public_k1.pem new file mode 100644 index 00000000000..3c715a4b69d --- /dev/null +++ b/utils/zpe_policy_updater/src/test/resources/zts_public_k1.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAPZrZC1zPa5pPfZ1iqmr7gYoXhuHliRP +UnyKzYbYhQezTJReH0luhoUWPu6qydGJnxEU2NWMCXY/8n/UFIFojF0CAwEAAQ== +-----END PUBLIC KEY-----