specs use rsa keys for token validation

Previously specs used HMAC token signing / validation which is not used
in production. This commit updates the uaa helper code to use RSA based
"pkey" token signing / validation.

Author: aramprice

src/bosh-director/spec/support/uaa_helpers.rb

@@ -1,5 +1,13 @@
+require 'openssl'
+
 module Support
   module UaaHelpers
+    RSA_KEY = OpenSSL::PKey::RSA.generate(2048)
+
+    def uaa_token_public_key
+      RSA_KEY.public_key.to_pem
+    end
+
     def uaa_token_info(token_id, expiration_time = Time.now.to_i + 3600)
       token_data = {
           'jti' => token_id,
@@ -15,7 +23,7 @@ def uaa_token_info(token_id, expiration_time = Time.now.to_i + 3600)
           'iss' => 'https://fake-url/oauth/token',
           'aud' =>['test']
       }
-      access_token = CF::UAA::TokenCoder.encode(token_data, {verify: false, skey: 's3cr3t'})
+      access_token = CF::UAA::TokenCoder.encode(token_data, pkey: RSA_KEY, algorithm: 'RS256')
 
       CF::UAA::TokenInfo.new(
           token_type: 'bearer',

src/bosh-director/spec/unit/bosh/director/config_server/uaa_auth_provider_spec.rb

@@ -11,7 +11,8 @@
         'client_id' => 'fake-client',
         'client_secret' => 'fake-client-secret',
         'url' => uaa_url,
-        'ca_cert_path' => 'fake-ca-cert-path'
+        'ca_cert_path' => 'fake-ca-cert-path',
+        'public_key' => uaa_token_public_key,
     }
   end
   let(:logger) { double(:logger) }
@@ -101,8 +102,19 @@
 
   context 'token decoding' do
     context 'when public_key is not configured' do
+      let(:config) do
+        {
+          'client_id' => 'fake-client',
+          'client_secret' => 'fake-client-secret',
+          'url' => uaa_url,
+          'ca_cert_path' => 'fake-ca-cert-path',
+        }
+      end
+
       it 'decodes UAA tokens without verifying the signature' do
-        expect(CF::UAA::TokenCoder).to receive(:decode).with(anything, { verify: false }).and_call_original
+        expect(CF::UAA::TokenCoder).to receive(:decode)
+          .with(anything, { verify: false })
+          .and_return('exp' => Time.now.to_i + 3600)
         token.auth_header
       end
     end

src/bosh-monitor/spec/support/uaa_helpers.rb

@@ -1,5 +1,13 @@
+require 'openssl'
+
 module Support
   module UaaHelpers
+    RSA_KEY = OpenSSL::PKey::RSA.generate(2048)
+
+    def uaa_token_public_key
+      RSA_KEY.public_key.to_pem
+    end
+
     def uaa_token_info(token_id, expiration_time = Time.now.to_i + 3600)
       token_data = {
         'jti' => token_id,
@@ -15,7 +23,7 @@ def uaa_token_info(token_id, expiration_time = Time.now.to_i + 3600)
         'iss' => 'https://fake-url/oauth/token',
         'aud' => ['test'],
       }
-      access_token = CF::UAA::TokenCoder.encode(token_data, verify: false, skey: 's3cr3t')
+      access_token = CF::UAA::TokenCoder.encode(token_data, pkey: RSA_KEY, algorithm: 'RS256')
 
       CF::UAA::TokenInfo.new(
         token_type: 'bearer',

src/bosh-monitor/spec/unit/bosh/monitor/auth_provider_spec.rb

@@ -61,6 +61,7 @@
     context 'user provides director_ca_cert' do
       before do
         config['director_ca_cert'] = 'fake-ca-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-ca-cert-path').and_return(true)
         allow(File).to receive(:read).with('fake-ca-cert-path').and_return('test')
@@ -78,6 +79,7 @@
       before do
         config['director_ca_cert'] = 'fake-dir-cert-path'
         config['uaa_ca_cert'] = 'fake-uaa-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-uaa-cert-path').and_return(true)
         allow(File).to receive(:read).with('fake-uaa-cert-path').and_return('uaa-pem')
@@ -95,6 +97,7 @@
       before do
         config['director_ca_cert'] = 'fake-dir-cert-path'
         config['uaa_ca_cert'] = 'fake-uaa-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-uaa-cert-path').and_return(true)
         allow(File).to receive(:read).with('fake-uaa-cert-path').and_return("  \n")
@@ -114,6 +117,7 @@
       before do
         config['director_ca_cert'] = 'fake-dir-cert-path'
         config['uaa_ca_cert'] = 'fake-uaa-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-uaa-cert-path').and_return(false)
         allow(File).to receive(:exist?).with('fake-dir-cert-path').and_return(true)
@@ -132,6 +136,8 @@
       let(:cert_store) { instance_double(OpenSSL::X509::Store) }
 
       before do
+        config['uaa_public_key'] = uaa_token_public_key
+
         allow(OpenSSL::X509::Store).to receive(:new).and_return(cert_store)
         allow(cert_store).to receive(:set_default_paths)
         allow(CF::UAA::TokenIssuer).to receive(:new).with(
@@ -155,7 +161,9 @@
 
       context 'when uaa_public_key is not configured' do
         it 'decodes UAA tokens without verifying the signature' do
-          expect(CF::UAA::TokenCoder).to receive(:decode).with(anything, { verify: false }).and_call_original
+          expect(CF::UAA::TokenCoder).to receive(:decode)
+            .with(anything, { verify: false })
+            .and_return('exp' => Time.now.to_i + 3600)
           auth_provider.auth_header
         end
       end

src/bosh-monitor/spec/unit/bosh/monitor/director_spec.rb

@@ -17,6 +17,7 @@
         'client_secret' => 'secret',
         'director_ca_cert' => 'fake-ca-cert',
         'uaa_ca_cert' => '',
+        'uaa_public_key' => uaa_token_public_key,
       }, double(:logger)
     )
   end

src/bosh-monitor/spec/unit/bosh/monitor/plugins/event_logger_spec.rb

@@ -13,6 +13,7 @@
         'client_secret' => 'client-secret',
         'director_ca_cert' => 'ca-cert',
         'uaa_ca_cert' => '',
+        'uaa_public_key' => uaa_token_public_key,
       },
     }
   end

src/bosh-monitor/spec/unit/bosh/monitor/plugins/resurrector_spec.rb

@@ -13,6 +13,7 @@ module Bosh::Monitor::Plugins
           'client_secret' => 'client-secret',
           'director_ca_cert' => 'ca-cert',
           'uaa_ca_cert' => '',
+          'uaa_public_key' => uaa_token_public_key,
         },
       }
     end

src/bosh-nats-sync/spec/nats_sync/auth_provider_spec.rb

@@ -68,6 +68,7 @@
     context 'user provides director_ca_cert' do
       before do
         config['director_ca_cert'] = 'fake-ca-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-ca-cert-path').and_return(true)
         allow(File).to receive(:read).with('fake-ca-cert-path').and_return('test')
@@ -85,6 +86,7 @@
       before do
         config['director_ca_cert'] = 'fake-dir-cert-path'
         config['uaa_ca_cert'] = 'fake-uaa-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-uaa-cert-path').and_return(true)
         allow(File).to receive(:read).with('fake-uaa-cert-path').and_return('uaa-pem')
@@ -102,6 +104,7 @@
       before do
         config['director_ca_cert'] = 'fake-dir-cert-path'
         config['uaa_ca_cert'] = 'fake-uaa-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-uaa-cert-path').and_return(true)
         allow(File).to receive(:read).with('fake-uaa-cert-path').and_return("  \n")
@@ -121,6 +124,7 @@
       before do
         config['director_ca_cert'] = 'fake-dir-cert-path'
         config['uaa_ca_cert'] = 'fake-uaa-cert-path'
+        config['uaa_public_key'] = uaa_token_public_key
 
         allow(File).to receive(:exist?).with('fake-uaa-cert-path').and_return(false)
         allow(File).to receive(:exist?).with('fake-dir-cert-path').and_return(true)
@@ -139,6 +143,8 @@
       let(:cert_store) { instance_double(OpenSSL::X509::Store) }
 
       before do
+        config['uaa_public_key'] = uaa_token_public_key
+
         allow(OpenSSL::X509::Store).to receive(:new).and_return(cert_store)
         allow(cert_store).to receive(:set_default_paths)
         allow(CF::UAA::TokenIssuer).to receive(:new).with(
@@ -162,7 +168,9 @@
 
       context 'when uaa_public_key is not configured' do
         it 'decodes UAA tokens without verifying the signature' do
-          expect(CF::UAA::TokenCoder).to receive(:decode).with(anything, { verify: false }).and_call_original
+          expect(CF::UAA::TokenCoder).to receive(:decode)
+            .with(anything, { verify: false })
+            .and_return('exp' => Time.now.to_i + 3600)
           auth_provider.auth_header
         end
       end

src/bosh-nats-sync/spec/support/uaa_helpers.rb

@@ -1,5 +1,13 @@
+require 'openssl'
+
 module Support
   module UaaHelpers
+    RSA_KEY = OpenSSL::PKey::RSA.generate(2048)
+
+    def uaa_token_public_key
+      RSA_KEY.public_key.to_pem
+    end
+
     def uaa_token_info(token_id, expiration_time = Time.now.to_i + 3600)
       token_data = {
         'jti' => token_id,
@@ -15,7 +23,7 @@ def uaa_token_info(token_id, expiration_time = Time.now.to_i + 3600)
         'iss' => 'https://fake-url/oauth/token',
         'aud' => ['test'],
       }
-      access_token = CF::UAA::TokenCoder.encode(token_data, verify: false, skey: 's3cr3t')
+      access_token = CF::UAA::TokenCoder.encode(token_data, pkey: RSA_KEY, algorithm: 'RS256')
 
       CF::UAA::TokenInfo.new(
         token_type: 'bearer',