zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-13 07:57:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

Add an action to download encrypted service account credentials

Browse source 
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=222902380
This commit is contained in:
jianglai 2018-11-26 15:57:30 -08:00
parent 886aa62d46
commit a86d6588f3
7 changed files with 175 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

5
java/google/registry/env/common/tools/WEB-INF/web.xml vendored
View file

@ -48,6 +48,11 @@
<url-pattern>/_dr/loadtest</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>tools-servlet</servlet-name>
<url-pattern>/_dr/admin/downloadCredential</url-pattern>
</servlet-mapping>
<!-- The nomulus command line tool uses this endpoint to write to Datastore. -->
<servlet>
<display-name>Remote API Servlet</display-name>

15
java/google/registry/keyring/kms/KmsKeyring.java
View file

@ -41,29 +41,32 @@ import org.bouncycastle.openpgp.PGPPublicKey;
*/
public class KmsKeyring implements Keyring {
enum PrivateKeyLabel {
/** Key labels for private key secrets. */
public enum PrivateKeyLabel {
BRDA_SIGNING_PRIVATE,
RDE_SIGNING_PRIVATE,
RDE_STAGING_PRIVATE;
String getLabel() {
public String getLabel() {
return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
}
}
enum PublicKeyLabel {
/** Key labels for public key secrets. */
public enum PublicKeyLabel {
BRDA_RECEIVER_PUBLIC,
BRDA_SIGNING_PUBLIC,
RDE_RECEIVER_PUBLIC,
RDE_SIGNING_PUBLIC,
RDE_STAGING_PUBLIC;
String getLabel() {
public String getLabel() {
return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
}
}
enum StringKeyLabel {
/** Key labels for string secrets. */
public enum StringKeyLabel {
SAFE_BROWSING_API_KEY,
ICANN_REPORTING_PASSWORD_STRING,
JSON_CREDENTIAL_STRING,
@ -73,7 +76,7 @@ public class KmsKeyring implements Keyring {
RDE_SSH_CLIENT_PRIVATE_STRING,
RDE_SSH_CLIENT_PUBLIC_STRING;
String getLabel() {
public String getLabel() {
return UPPER_UNDERSCORE.to(LOWER_HYPHEN, name());
}
}

2
java/google/registry/module/tools/ToolsRequestComponent.java
View file

@ -32,6 +32,7 @@ import google.registry.request.RequestScope;
import google.registry.tools.server.CreateGroupsAction;
import google.registry.tools.server.CreatePremiumListAction;
import google.registry.tools.server.DeleteEntityAction;
import google.registry.tools.server.DownloadServiceAccountCredentialAction;
import google.registry.tools.server.GenerateZoneFilesAction;
import google.registry.tools.server.KillAllCommitLogsAction;
import google.registry.tools.server.KillAllEppResourcesAction;
@ -64,6 +65,7 @@ import google.registry.tools.server.VerifyOteAction;
interface ToolsRequestComponent {
CreateGroupsAction createGroupsAction();
CreatePremiumListAction createPremiumListAction();
DownloadServiceAccountCredentialAction downloadServiceAccountCredentialAction();
DeleteEntityAction deleteEntityAction();
EppToolAction eppToolAction();
FlowComponent.Builder flowComponentBuilder();

1
java/google/registry/tools/server/BUILD
View file

@ -14,6 +14,7 @@ java_library(
"//java/google/registry/flows",
"//java/google/registry/gcs",
"//java/google/registry/groups",
"//java/google/registry/keyring/kms",
"//java/google/registry/mapreduce",
"//java/google/registry/mapreduce/inputs",
"//java/google/registry/model",

70
java/google/registry/tools/server/DownloadServiceAccountCredentialAction.java Normal file
View file

@ -0,0 +1,70 @@
// Copyright 2018 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.tools.server;
import static google.registry.request.Action.Method.GET;
import static java.nio.charset.StandardCharsets.UTF_8;
import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
import com.google.common.flogger.FluentLogger;
import com.google.common.io.BaseEncoding;
import com.google.common.net.MediaType;
import google.registry.keyring.kms.KmsKeyring.StringKeyLabel;
import google.registry.request.Action;
import google.registry.request.Response;
import google.registry.request.auth.Auth;
import java.util.function.Function;
import javax.inject.Inject;
import javax.inject.Named;
/**
* An action that returns KMS encrypted service account credential in its payload.
*
* <p>This credential can be stored locally, and a {@code RemoteApiOptions} can use it to initialize
* an {@code AppEngineConnection}.
*/
@Action(
path = DownloadServiceAccountCredentialAction.PATH,
method = {GET},
auth = Auth.AUTH_INTERNAL_OR_ADMIN)
public class DownloadServiceAccountCredentialAction implements Runnable {
private static final FluentLogger logger = FluentLogger.forEnclosingClass();
public static final String PATH = "/_dr/admin/downloadCredential";
@Inject
@Named("encryptedDataRetriever")
Function<String, String> encryptedDataRetriever;
@Inject Response response;
@Inject
DownloadServiceAccountCredentialAction() {}
@Override
public void run() {
try {
String encryptedJsonCredential =
encryptedDataRetriever.apply(StringKeyLabel.JSON_CREDENTIAL_STRING.getLabel());
response.setContentType(MediaType.APPLICATION_BINARY);
response.setPayload(BaseEncoding.base64().encode(encryptedJsonCredential.getBytes(UTF_8)));
} catch (Exception e) {
logger.atSevere().withCause(e).log("Cannot retrieve encrypted service account credential.");
response.setPayload(e.getMessage());
response.setStatus(SC_INTERNAL_SERVER_ERROR);
}
}
}

1
javatests/google/registry/module/tools/testdata/tools_routing.txt vendored
View file

@ -2,6 +2,7 @@ PATH CLASS METHODS OK AUTH
/_dr/admin/createGroups CreateGroupsAction POST n INTERNAL,API APP ADMIN
/_dr/admin/createPremiumList CreatePremiumListAction POST n INTERNAL,API APP ADMIN
/_dr/admin/deleteEntity DeleteEntityAction GET n INTERNAL,API APP ADMIN
/_dr/admin/downloadCredential DownloadServiceAccountCredentialAction GET n INTERNAL,API APP ADMIN
/_dr/admin/list/domains ListDomainsAction GET,POST n INTERNAL,API APP ADMIN
/_dr/admin/list/hosts ListHostsAction GET,POST n INTERNAL,API APP ADMIN
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n INTERNAL,API APP ADMIN

66
javatests/google/registry/tools/server/DownloadServiceAccountCredentialActionTest.java Normal file
View file

@ -0,0 +1,66 @@
// Copyright 2018 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.tools.server;
import static com.google.common.truth.Truth.assertThat;
import static java.nio.charset.StandardCharsets.UTF_8;
import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
import static javax.servlet.http.HttpServletResponse.SC_OK;
import com.google.common.io.BaseEncoding;
import com.google.common.net.MediaType;
import google.registry.testing.FakeResponse;
import java.util.function.Function;
import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;
/** Unit tests for {@link google.registry.tools.server.DownloadServiceAccountCredentialAction}. */
@RunWith(JUnit4.class)
public class DownloadServiceAccountCredentialActionTest {
private final DownloadServiceAccountCredentialAction action =
new DownloadServiceAccountCredentialAction();
private final FakeResponse response = new FakeResponse();
private final Function<String, String> encryptedDataRetriever = input -> input + "_mohaha";
@Before
public void setUp() {
action.response = response;
action.encryptedDataRetriever = encryptedDataRetriever;
}
@Test
public void testSuccess_returnServiceAccountCredential() {
action.run();
assertThat(response.getStatus()).isEqualTo(SC_OK);
assertThat(response.getContentType()).isEqualTo(MediaType.APPLICATION_BINARY);
assertThat(new String(BaseEncoding.base64().decode(response.getPayload()), UTF_8))
.isEqualTo("json-credential-string_mohaha");
}
@Test
public void testFailure_cannotGetEncryptedCredential() {
action.encryptedDataRetriever =
input -> {
throw new RuntimeException("Something went wrong.");
};
action.run();
assertThat(response.getStatus()).isEqualTo(SC_INTERNAL_SERVER_ERROR);
assertThat(response.getContentType()).isEqualTo(MediaType.HTML_UTF_8);
assertThat(response.getPayload()).isEqualTo("Something went wrong.");
}
}