diff options
author | Bjørn Christian Seime <bjorncs@verizonmedia.com> | 2019-09-11 11:29:51 +0200 |
---|---|---|
committer | Bjørn Christian Seime <bjorncs@verizonmedia.com> | 2019-09-11 11:29:51 +0200 |
commit | bf95a07154e11446ff4f2985e5b9951567a751a9 (patch) | |
tree | eb11cbfb414ab737a7b30b1db714f5d360fece73 /jdisc-security-filters/src/main/java/com/yahoo | |
parent | 9be8547f8720e71d4e80582a9ce5f720d2c22d20 (diff) |
Remove NToken support from AthenzPrincipalFilter
Diffstat (limited to 'jdisc-security-filters/src/main/java/com/yahoo')
-rw-r--r-- | jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java | 40 |
1 files changed, 5 insertions, 35 deletions
diff --git a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java index e51fb1a5c9a..cb153ecb1fc 100644 --- a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java +++ b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java @@ -6,20 +6,15 @@ import com.yahoo.jdisc.Response; import com.yahoo.jdisc.http.filter.DiscFilterRequest; import com.yahoo.jdisc.http.filter.security.base.JsonSecurityRequestFilterBase; import com.yahoo.vespa.athenz.api.AthenzPrincipal; -import com.yahoo.vespa.athenz.api.NToken; import com.yahoo.vespa.athenz.utils.AthenzIdentities; -import com.yahoo.vespa.athenz.utils.ntoken.NTokenValidator; -import java.nio.file.Paths; import java.security.cert.X509Certificate; import java.util.List; import java.util.Optional; /** - * Authenticates Athenz principal, either through: - * 1. TLS client authentication (based on Athenz x509 identity certficiate). - * 2. The principal token (NToken) header. + * Authenticates Athenz principal through TLS client authentication (Athenz identity certificate). * The TLS authentication is based on the following assumptions: * - The underlying connector is configured with 'clientAuth' set to either WANT_AUTH or NEED_AUTH. * - The trust store is configured with the Athenz CA certificates only. @@ -33,22 +28,14 @@ public class AthenzPrincipalFilter extends JsonSecurityRequestFilterBase { public static final String RESULT_ERROR_MESSAGE_ATTRIBUTE = RESULT_ATTRIBUTE_PREFIX + ".error.message"; public static final String RESULT_PRINCIPAL = RESULT_ATTRIBUTE_PREFIX + ".principal"; - private final NTokenValidator validator; - private final String principalTokenHeader; private final boolean passthroughMode; @Inject public AthenzPrincipalFilter(AthenzPrincipalFilterConfig athenzPrincipalFilterConfig) { - this(new NTokenValidator(Paths.get(athenzPrincipalFilterConfig.athenzConfFile())), - athenzPrincipalFilterConfig.principalHeaderName(), - athenzPrincipalFilterConfig.passthroughMode()); + this(athenzPrincipalFilterConfig.passthroughMode()); } - AthenzPrincipalFilter(NTokenValidator validator, - String principalTokenHeader, - boolean passthroughMode) { - this.validator = validator; - this.principalTokenHeader = principalTokenHeader; + AthenzPrincipalFilter(boolean passthroughMode) { this.passthroughMode = passthroughMode; } @@ -58,23 +45,12 @@ public class AthenzPrincipalFilter extends JsonSecurityRequestFilterBase { Optional<AthenzPrincipal> certificatePrincipal = getClientCertificate(request) .map(AthenzIdentities::from) .map(AthenzPrincipal::new); - Optional<AthenzPrincipal> nTokenPrincipal = getPrincipalToken(request, principalTokenHeader) - .map(validator::validate); - - if (certificatePrincipal.isEmpty() && nTokenPrincipal.isEmpty()) { + if (certificatePrincipal.isEmpty()) { String errorMessage = "Unable to authenticate Athenz identity. " + "Either client certificate or principal token is required."; return createResponse(request, Response.Status.UNAUTHORIZED, errorMessage); } - if (certificatePrincipal.isPresent() && nTokenPrincipal.isPresent() - && !certificatePrincipal.get().getIdentity().equals(nTokenPrincipal.get().getIdentity())) { - String errorMessage = String.format( - "Identity in principal token does not match x509 CN: token-identity=%s, cert-identity=%s", - nTokenPrincipal.get().getIdentity().getFullName(), - certificatePrincipal.get().getIdentity().getFullName()); - return createResponse(request, Response.Status.UNAUTHORIZED, errorMessage); - } - AthenzPrincipal principal = nTokenPrincipal.orElseGet(certificatePrincipal::get); + AthenzPrincipal principal = certificatePrincipal.get(); request.setUserPrincipal(principal); request.setRemoteUser(principal.getName()); request.setAttribute(RESULT_PRINCIPAL, principal); @@ -90,12 +66,6 @@ public class AthenzPrincipalFilter extends JsonSecurityRequestFilterBase { return Optional.of(chain.get(0)); } - private static Optional<NToken> getPrincipalToken(DiscFilterRequest request, String principalTokenHeaderName) { - return Optional.ofNullable(request.getHeader(principalTokenHeaderName)) - .filter(token -> !token.isEmpty()) - .map(NToken::new); - } - private Optional<ErrorResponse> createResponse(DiscFilterRequest request, int statusCode, String message) { request.setAttribute(RESULT_ERROR_CODE_ATTRIBUTE, statusCode); request.setAttribute(RESULT_ERROR_MESSAGE_ATTRIBUTE, message); |