Set ztsUrl/sisUrl in identity document

2 files changed, 30 insertions, 4 deletions

diff --git a/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/athenz/instanceproviderservice/IdentityDocumentGenerator.java b/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/athenz/instanceproviderservice/IdentityDocumentGenerator.java
index 5143a38b2c1..5138bee1ff6 100644
--- a/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/athenz/instanceproviderservice/IdentityDocumentGenerator.java
+++ b/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/athenz/instanceproviderservice/IdentityDocumentGenerator.java
@@ -3,7 +3,10 @@ package com.yahoo.vespa.hosted.athenz.instanceproviderservice;
 
 import com.yahoo.component.annotation.Inject;
 import com.yahoo.config.provision.Zone;
+import com.yahoo.container.jdisc.secretstore.SecretStore;
 import com.yahoo.net.HostName;
+import com.yahoo.security.KeyUtils;
+
 import com.yahoo.vespa.athenz.api.AthenzService;
 import com.yahoo.vespa.athenz.identityprovider.api.ClusterType;
 import com.yahoo.vespa.athenz.identityprovider.api.IdentityType;
@@ -32,17 +35,20 @@ public class IdentityDocumentGenerator {
     private final NodeRepository nodeRepository;
     private final Zone zone;
     private final KeyProvider keyProvider;
+    private final SecretStore secretStore;
     private final AthenzProviderServiceConfig athenzProviderServiceConfig;
 
     @Inject
     public IdentityDocumentGenerator(AthenzProviderServiceConfig config,
                                      NodeRepository nodeRepository,
                                      Zone zone,
-                                     KeyProvider keyProvider) {
+                                     KeyProvider keyProvider,
+                                     SecretStore secretStore) {
         this.athenzProviderServiceConfig = config;
         this.nodeRepository = nodeRepository;
         this.zone = zone;
         this.keyProvider = keyProvider;
+        this.secretStore = secretStore;
     }
 
     public SignedIdentityDocument generateSignedIdentityDocument(String hostname, IdentityType identityType) {
@@ -61,7 +67,7 @@ public class IdentityDocumentGenerator {
 
             Set<String> ips = new HashSet<>(node.ipConfig().primary());
 
-            PrivateKey privateKey = keyProvider.getPrivateKey(athenzProviderServiceConfig.secretVersion());
+            PrivateKey privateKey = privateKey(node);
             AthenzService providerService = new AthenzService(athenzProviderServiceConfig.domain(), athenzProviderServiceConfig.serviceName());
 
             String configServerHostname = HostName.getLocalhost();
@@ -73,11 +79,28 @@ public class IdentityDocumentGenerator {
             return new SignedIdentityDocument(
                     signature, athenzProviderServiceConfig.secretVersion(), providerUniqueId, providerService,
                     SignedIdentityDocument.DEFAULT_DOCUMENT_VERSION, configServerHostname, node.hostname(),
-                    createdAt, ips, identityType, clusterType);
+                    createdAt, ips, identityType, clusterType, ztsUrl(node));
         } catch (Exception e) {
             throw new RuntimeException("Exception generating identity document: " + e.getMessage(), e);
         }
     }
 
+    private PrivateKey privateKey(Node node) {
+        // return sisSecret for public non-enclave hosts. secret otherwise
+        if (zone.system().isPublic() && !node.cloudAccount().isEnclave(zone)) {
+            String keyPem = secretStore.getSecret(athenzProviderServiceConfig.sisSecretName(), athenzProviderServiceConfig.sisSecretVersion());
+            return KeyUtils.fromPemEncodedPrivateKey(keyPem);
+        } else {
+            return keyProvider.getPrivateKey(athenzProviderServiceConfig.secretVersion());
+        }
+    }
+    private String ztsUrl(Node node) {
+        // return sisUrl for public non-enclave hosts, ztsUrl otherwise
+        if (zone.system().isPublic() && !node.cloudAccount().isEnclave(zone)) {
+            return athenzProviderServiceConfig.sisUrl();
+        } else {
+            return athenzProviderServiceConfig.ztsUrl();
+        }
+    }
 }
 
diff --git a/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/restapi/InstanceSerializer.java b/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/restapi/InstanceSerializer.java
index fec03afab69..8c575a6403b 100644
--- a/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/restapi/InstanceSerializer.java
+++ b/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/restapi/InstanceSerializer.java
@@ -49,6 +49,7 @@ public class InstanceSerializer {
     private static final String IDD_IPADDRESSES_FIELD = "ip-addresses";
     private static final String IDD_IDENTITY_TYPE_FIELD = "identity-type";
     private static final String IDD_CLUSTER_TYPE_FIELD = "cluster-type";
+    private static final String IDD_ZTS_URL_FIELD = "zts-url";
 
     private static final ObjectMapper objectMapper = new ObjectMapper();
     static {
@@ -100,10 +101,12 @@ public class InstanceSerializer {
         IdentityType identityType = IdentityType.fromId(requireField(IDD_IDENTITY_TYPE_FIELD, root).asString());
         var clusterTypeField = root.field(IDD_CLUSTER_TYPE_FIELD);
         var clusterType = clusterTypeField.valid() ? ClusterType.from(clusterTypeField.asString()) : null;
+        var ztsUrlField = root.field(IDD_ZTS_URL_FIELD);
+        var ztsUrl = ztsUrlField.valid() ? ztsUrlField.asString() : "";
 
 
         return new SignedIdentityDocument(signature, (int)signingKeyVersion, providerUniqueId, athenzService, (int)documentVersion,
-                                          configserverHostname, instanceHostname, createdAt, ips, identityType, clusterType);
+                                          configserverHostname, instanceHostname, createdAt, ips, identityType, clusterType, ztsUrl);
     }
 
     private static Instant getJsr310Instant(double v) {