Skip to content

Commit 8891f53

Browse files
richard-salacrichard-salac
committed
wip
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
1 parent e2371c9 commit 8891f53

File tree

4 files changed

+76
-34
lines changed

4 files changed

+76
-34
lines changed

‎zaas-service/src/main/java/org/zowe/apiml/zaas/security/service/AuthenticationService.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@
6767
import java.util.Optional;
6868
import java.util.Set;
6969

70+
import static org.zowe.apiml.security.common.token.QueryResponse.Source.ZOWE;
7071
import static org.zowe.apiml.security.common.util.JwtUtils.getJwtClaims;
7172
import static org.zowe.apiml.security.common.util.JwtUtils.handleJwtParserException;
7273
import static org.zowe.apiml.zaas.security.service.zosmf.ZosmfService.TokenType.JWT;
@@ -381,17 +382,16 @@ public TokenAuthentication validateJwtToken(String jwtToken) {
381382
}
382383

383384
QueryResponse queryResponse = parseJwtToken(jwtToken);
384-
boolean isValid = switch (queryResponse.getSource()) {
385-
case ZOWE -> {
386-
validateAndParseLocalJwtToken(jwtToken);
387-
yield true;
388-
}
385+
386+
switch (queryResponse.getSource()) {
387+
case ZOWE -> validateAndParseLocalJwtToken(jwtToken);
389388
case ZOSMF -> zosmfService.validate(jwtToken);
390389
default -> throw new TokenNotValidException("Unknown token type.");
391-
};
390+
}
391+
392392
boolean notInvalidated = !isInvalidated(jwtToken);
393393
TokenAuthentication tokenAuthentication = new TokenAuthentication(queryResponse.getUserId(), jwtToken, TokenAuthentication.Type.JWT);
394-
tokenAuthentication.setAuthenticated(notInvalidated && isValid);
394+
tokenAuthentication.setAuthenticated(notInvalidated);
395395

396396
putValidationCache(jwtToken, tokenAuthentication);
397397
log.debug("JWT validation result: {}", tokenAuthentication.isAuthenticated());
@@ -457,9 +457,9 @@ public TokenAuthentication validateJwtToken(TokenAuthentication token) {
457457
throw new TokenNotValidException("Null token.");
458458
}
459459
parseJwtToken(token.getCredentials()); // throws on expired token, this needs to happen before cache
460-
460+
461461
var tokenAuth = validateJwtToken(token.getCredentials());
462-
462+
463463
return tokenAuth;
464464
}
465465

‎zaas-service/src/main/java/org/zowe/apiml/zaas/security/service/zosmf/ZosmfService.java‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,7 @@
6060
import java.io.IOException;
6161
import java.net.MalformedURLException;
6262
import java.net.URL;
63-
import java.util.Collections;
64-
import java.util.EnumMap;
65-
import java.util.HashMap;
66-
import java.util.List;
67-
import java.util.Map;
63+
import java.util.*;
6864

6965
import static org.zowe.apiml.zaas.security.service.zosmf.ZosmfService.TokenType.JWT;
7066
import static org.zowe.apiml.zaas.security.service.zosmf.ZosmfService.TokenType.LTPA;
@@ -487,24 +483,47 @@ public boolean jwtBuilderEndpointExists() {
487483
return meAsProxy.jwtEndpointExists(headers);
488484
}
489485

486+
/**
487+
* Validates jwt token with all available strategies.
488+
*
489+
* @param token
490+
* @return true if at least one validation strategy evaluates token as valid
491+
* @throws ServiceNotAccessibleException if all validation strategies failed because of an error
492+
* @throws TokenNotValidException if all token validation strategies evaluate token as invalid
493+
*/
490494
public boolean validate(String token) {
491495
log.debug("ZosmfService validating token: ....{}", StringUtils.right(token, 15));
492496
TokenValidationRequest request = new TokenValidationRequest(TokenType.JWT, token, getURI(getZosmfServiceId()), getEndpointMap());
493497

498+
var isTokenValid = Optional.<Boolean>empty();
499+
494500
for (TokenValidationStrategy s : tokenValidationStrategy) {
495501
log.debug("Trying to validate token with strategy: {}", s.toString());
496502
try {
497503
s.validate(request);
498504
if (requestIsAuthenticated(request)) {
499505
log.debug("Token validity has been successfully determined: {}", request.getAuthenticated());
500-
return true;
506+
isTokenValid = Optional.of(true);
507+
break;
508+
} else {
509+
isTokenValid = Optional.of(false);
501510
}
502511
} catch (RuntimeException re) {
503512
log.debug("Exception during token validation:", re);
504513
}
505514
}
515+
506516
log.debug("Token validation strategies exhausted, final validation status: {}", request.getAuthenticated());
507-
return false;
517+
518+
if (isTokenValid.isPresent()) {
519+
if (isTokenValid.get()) {
520+
return true;
521+
} else {
522+
throw new TokenNotValidException("Token is not valid by any of zosmf validation strategies");
523+
}
524+
}
525+
526+
throw new ServiceNotAccessibleException("All token validation strategies has failed with " + request.getZosmfBaseUrl());
508527
}
509528

510529
private boolean requestIsAuthenticated(TokenValidationRequest request) {

‎zaas-service/src/test/java/org/zowe/apiml/zaas/security/service/AuthenticationServiceTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ class GivenCorrectInputsTest {
140140
@BeforeEach
141141
void setup() {
142142
stubJWTSecurityForSign();
143-
143+
144144
}
145145

146146
@Test

‎zaas-service/src/test/java/org/zowe/apiml/zaas/security/service/zosmf/ZosmfServiceTest.java‎

Lines changed: 40 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,6 @@
9393
import static org.mockito.Mockito.doAnswer;
9494
import static org.mockito.Mockito.doReturn;
9595
import static org.mockito.Mockito.doThrow;
96-
import static org.mockito.Mockito.lenient;
9796
import static org.mockito.Mockito.mock;
9897
import static org.mockito.Mockito.spy;
9998
import static org.mockito.Mockito.times;
@@ -523,33 +522,66 @@ void setUp() {
523522
}
524523

525524
@Test
526-
void givenException_thenHandleExceptions() {
527-
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(Collections.singletonList(tokenValidationStrategy1));
525+
void givenFirstValidationStrategyFailed_thenSecondSucceeds() {
526+
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(validationStrategyList);
528527

529528
doThrow(RuntimeException.class).when(tokenValidationStrategy1).validate(any());
530-
assertDoesNotThrow(() -> zosmfService.validate("TOKN"));
529+
doValidate(tokenValidationStrategy2, TokenValidationRequest.STATUS.AUTHENTICATED);
530+
531+
var validationResult = assertDoesNotThrow(() -> zosmfService.validate("TOKN"));
532+
assertTrue(validationResult);
533+
534+
verify(tokenValidationStrategy1, times(1)).validate(any());
535+
verify(tokenValidationStrategy2, times(1)).validate(any());
536+
}
537+
538+
@Test
539+
void givenAllValidationStrategiesFail_thenThrowException() {
540+
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(validationStrategyList);
541+
542+
doThrow(RuntimeException.class).when(tokenValidationStrategy1).validate(any());
543+
doThrow(RuntimeException.class).when(tokenValidationStrategy2).validate(any());
544+
545+
assertThrows(ServiceNotAccessibleException.class, () -> zosmfService.validate("TOKN"));
546+
547+
verify(tokenValidationStrategy1, times(1)).validate(any());
548+
verify(tokenValidationStrategy2, times(1)).validate(any());
531549
}
532550

551+
@Test
552+
void givenAllValidationStrategiesReturnInvalid_thenReturnFalse() {
553+
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(validationStrategyList);
554+
555+
doValidate(tokenValidationStrategy1, TokenValidationRequest.STATUS.INVALID);
556+
doValidate(tokenValidationStrategy2, TokenValidationRequest.STATUS.INVALID);
557+
558+
assertThrows(TokenNotValidException.class, () -> zosmfService.validate("TOKN"));
559+
560+
verify(tokenValidationStrategy1, times(1)).validate(any());
561+
verify(tokenValidationStrategy2, times(1)).validate(any());
562+
}
563+
564+
533565
@Test
534566
void givenOneValidationStrategy_thenReturnValidationStrategyResult() {
535567
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(Collections.singletonList(tokenValidationStrategy1));
536568

537569
//UNKNOWN by default
538-
assertThat(zosmfService.validate("TOKN"), is(false));
570+
assertThrows(TokenNotValidException.class, () -> zosmfService.validate("TOKN"));
539571

540572
doValidate(tokenValidationStrategy1, TokenValidationRequest.STATUS.AUTHENTICATED);
541573

542574
assertThat(zosmfService.validate("TOKN"), is(true));
543575

544576
doValidate(tokenValidationStrategy1, TokenValidationRequest.STATUS.INVALID);
545-
assertThat(zosmfService.validate("TOKN"), is(false));
577+
assertThrows(TokenNotValidException.class, () -> zosmfService.validate("TOKN"));
546578
}
547579

548580
@Test
549581
void givenFirstValidationStrategyAuthentications_thenDontUseSecondValidationStrategy() {
550582
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(validationStrategyList);
551583

552-
assertThat(zosmfService.validate("TOKN"), is(false));
584+
assertThrows(TokenNotValidException.class, () -> zosmfService.validate("TOKN"));
553585
verify(tokenValidationStrategy1, times(1)).validate(any());
554586
verify(tokenValidationStrategy2, times(1)).validate(any());
555587

@@ -571,19 +603,10 @@ void givenFirstStrategyInvalidAndSecondValid_thenTokenIsValid() {
571603
verify(tokenValidationStrategy2, times(1)).validate(any());
572604
}
573605

574-
@Test
575-
void doesNotRethrowExceptionsFromValidationStrategies() {
576-
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(Collections.singletonList(tokenValidationStrategy1));
577-
TokenValidationRequest request = mock(TokenValidationRequest.class);
578-
579-
lenient().doThrow(RuntimeException.class).when(tokenValidationStrategy1).validate(request);
580-
assertDoesNotThrow(() -> zosmfService.validate("TOKN"));
581-
}
582-
583606
@Test
584607
void suppliesValidationRequestWithVerifiedEndpointsList() {
585608
ZosmfService zosmfService = getZosmfServiceWithValidationStrategy(validationStrategyList);
586-
zosmfService.validate("TOKN");
609+
assertThrows(TokenNotValidException.class, () -> zosmfService.validate("TOKN"));
587610
verify(tokenValidationStrategy1).validate(argThat(request -> !request.getEndpointExistenceMap().isEmpty()));
588611
}
589612

0 commit comments

Comments
 (0)