1 files changed, 5 insertions, 35 deletions

diff --git a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java
index e51fb1a5c9a..cb153ecb1fc 100644
--- a/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java
+++ b/jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java
@@ -6,20 +6,15 @@ import com.yahoo.jdisc.Response;
 import com.yahoo.jdisc.http.filter.DiscFilterRequest;
 import com.yahoo.jdisc.http.filter.security.base.JsonSecurityRequestFilterBase;
 import com.yahoo.vespa.athenz.api.AthenzPrincipal;
-import com.yahoo.vespa.athenz.api.NToken;
 import com.yahoo.vespa.athenz.utils.AthenzIdentities;
-import com.yahoo.vespa.athenz.utils.ntoken.NTokenValidator;
 
-import java.nio.file.Paths;
 import java.security.cert.X509Certificate;
 import java.util.List;
 import java.util.Optional;
 
 
 /**
- * Authenticates Athenz principal, either through:
- *  1. TLS client authentication (based on Athenz x509 identity certficiate).
- *  2. The principal token (NToken) header.
+ * Authenticates Athenz principal through TLS client authentication (Athenz identity certificate).
  * The TLS authentication is based on the following assumptions:
  *  - The underlying connector is configured with 'clientAuth' set to either WANT_AUTH or NEED_AUTH.
  *  - The trust store is configured with the Athenz CA certificates only.
@@ -33,22 +28,14 @@ public class AthenzPrincipalFilter extends JsonSecurityRequestFilterBase {
     public static final String RESULT_ERROR_MESSAGE_ATTRIBUTE = RESULT_ATTRIBUTE_PREFIX + ".error.message";
     public static final String RESULT_PRINCIPAL = RESULT_ATTRIBUTE_PREFIX + ".principal";
 
-    private final NTokenValidator validator;
-    private final String principalTokenHeader;
     private final boolean passthroughMode;
 
     @Inject
     public AthenzPrincipalFilter(AthenzPrincipalFilterConfig athenzPrincipalFilterConfig) {
-        this(new NTokenValidator(Paths.get(athenzPrincipalFilterConfig.athenzConfFile())),
-             athenzPrincipalFilterConfig.principalHeaderName(),
-             athenzPrincipalFilterConfig.passthroughMode());
+        this(athenzPrincipalFilterConfig.passthroughMode());
     }
 
-    AthenzPrincipalFilter(NTokenValidator validator,
-                          String principalTokenHeader,
-                          boolean passthroughMode) {
-        this.validator = validator;
-        this.principalTokenHeader = principalTokenHeader;
+    AthenzPrincipalFilter(boolean passthroughMode) {
         this.passthroughMode = passthroughMode;
     }
 
@@ -58,23 +45,12 @@ public class AthenzPrincipalFilter extends JsonSecurityRequestFilterBase {
             Optional<AthenzPrincipal> certificatePrincipal = getClientCertificate(request)
                     .map(AthenzIdentities::from)
                     .map(AthenzPrincipal::new);
-            Optional<AthenzPrincipal> nTokenPrincipal = getPrincipalToken(request, principalTokenHeader)
-                    .map(validator::validate);
-
-            if (certificatePrincipal.isEmpty() && nTokenPrincipal.isEmpty()) {
+            if (certificatePrincipal.isEmpty()) {
                 String errorMessage = "Unable to authenticate Athenz identity. " +
                                       "Either client certificate or principal token is required.";
                 return createResponse(request, Response.Status.UNAUTHORIZED, errorMessage);
             }
-            if (certificatePrincipal.isPresent() && nTokenPrincipal.isPresent()
-                    && !certificatePrincipal.get().getIdentity().equals(nTokenPrincipal.get().getIdentity())) {
-                String errorMessage = String.format(
-                        "Identity in principal token does not match x509 CN: token-identity=%s, cert-identity=%s",
-                        nTokenPrincipal.get().getIdentity().getFullName(),
-                        certificatePrincipal.get().getIdentity().getFullName());
-                return createResponse(request, Response.Status.UNAUTHORIZED, errorMessage);
-            }
-            AthenzPrincipal principal = nTokenPrincipal.orElseGet(certificatePrincipal::get);
+            AthenzPrincipal principal = certificatePrincipal.get();
             request.setUserPrincipal(principal);
             request.setRemoteUser(principal.getName());
             request.setAttribute(RESULT_PRINCIPAL, principal);
@@ -90,12 +66,6 @@ public class AthenzPrincipalFilter extends JsonSecurityRequestFilterBase {
         return Optional.of(chain.get(0));
     }
 
-    private static Optional<NToken> getPrincipalToken(DiscFilterRequest request, String principalTokenHeaderName) {
-        return Optional.ofNullable(request.getHeader(principalTokenHeaderName))
-                .filter(token -> !token.isEmpty())
-                .map(NToken::new);
-    }
-
     private Optional<ErrorResponse> createResponse(DiscFilterRequest request, int statusCode, String message) {
         request.setAttribute(RESULT_ERROR_CODE_ATTRIBUTE, statusCode);
         request.setAttribute(RESULT_ERROR_MESSAGE_ATTRIBUTE, message);