public async Task WhenProjectAndInstanceMetadataAllowed_ThenAuthorizeKeyAsyncPushesKeyToProjectMetadata()
{
var computeEngineAdapter = CreateComputeEngineAdapterMock(
osLoginEnabledForProject: null,
osLoginEnabledForInstance: null,
osLogin2fa: false,
legacySshKeyPresent: false,
projectWideKeysBlockedForProject: false,
projectWideKeysBlockedForInstance: false);
var service = new AuthorizedKeyService(
CreateAuthorizationAdapterMock().Object,
computeEngineAdapter.Object,
CreateResourceManagerAdapterMock(true).Object,
CreateOsLoginServiceMock().Object);
using (var key = RsaSshKey.NewEphemeralKey())
{
var authorizedKey = await service.AuthorizeKeyAsync(
SampleLocator,
key,
TimeSpan.FromMinutes(1),
null,
AuthorizeKeyMethods.All,
CancellationToken.None);
Assert.IsNotNull(authorizedKey);
Assert.AreEqual(AuthorizeKeyMethods.ProjectMetadata, authorizedKey.AuthorizationMethod);
Assert.AreEqual("bob", authorizedKey.Username);
computeEngineAdapter.Verify(a => a.UpdateCommonInstanceMetadataAsync(
It.IsAny <string>(),
It.IsAny <Action <Metadata> >(),
It.IsAny <CancellationToken>()), Times.Once);
}
}
public async Task WhenOsLoginDisabledForProjectButEnabledForInstance_ThenAuthorizeKeyAsyncUsesOsLogin()
{
var service = new AuthorizedKeyService(
CreateAuthorizationAdapterMock().Object,
CreateComputeEngineAdapterMock(
osLoginEnabledForProject: false,
osLoginEnabledForInstance: true,
osLogin2fa: false,
legacySshKeyPresent: true,
projectWideKeysBlockedForProject: false,
projectWideKeysBlockedForInstance: false).Object,
CreateResourceManagerAdapterMock(true).Object,
CreateOsLoginServiceMock().Object);
var authorizedKey = await service.AuthorizeKeyAsync(
SampleLocator,
new Mock <ISshKey>().Object,
TimeSpan.FromMinutes(1),
null,
AuthorizeKeyMethods.All,
CancellationToken.None);
Assert.IsNotNull(authorizedKey);
Assert.AreEqual(AuthorizeKeyMethods.Oslogin, authorizedKey.AuthorizationMethod);
Assert.AreEqual("bob", authorizedKey.Username);
}
public async Task WhenConnected_ThenTryActivateReturnsTrue(
[LinuxInstance] ResourceTask <InstanceLocator> testInstance,
[Credential(Role = PredefinedRole.ComputeInstanceAdminV1)] ResourceTask <ICredential> credential)
{
var locator = await testInstance;
using (var key = new RsaSshKey(new RSACng()))
using (var gceAdapter = new ComputeEngineAdapter(
this.serviceProvider.GetService <IAuthorizationAdapter>()))
using (var keyAdapter = new AuthorizedKeyService(
this.serviceProvider.GetService <IAuthorizationAdapter>(),
new ComputeEngineAdapter(await credential),
new ResourceManagerAdapter(await credential),
new Mock <IOsLoginService>().Object))
{
var authorizedKey = await keyAdapter.AuthorizeKeyAsync(
locator,
key,
TimeSpan.FromMinutes(10),
null,
AuthorizeKeyMethods.InstanceMetadata,
CancellationToken.None)
.ConfigureAwait(true);
var instance = await gceAdapter.GetInstanceAsync(
locator,
CancellationToken.None)
.ConfigureAwait(true);
// Connect
var broker = new SshTerminalSessionBroker(this.serviceProvider);
ISshTerminalSession session = null;
await AssertRaisesEventAsync <SessionStartedEvent>(
async() => session = await broker.ConnectAsync(
locator,
new IPEndPoint(instance.PublicAddress(), 22),
authorizedKey,
null,
TimeSpan.FromSeconds(10)));
Assert.IsNull(this.ExceptionShown);
Assert.AreSame(session, SshTerminalPane.TryGetActivePane(this.mainForm));
Assert.AreSame(session, SshTerminalPane.TryGetExistingPane(this.mainForm, locator));
Assert.IsTrue(broker.IsConnected(locator));
Assert.IsTrue(broker.TryActivate(locator));
AssertRaisesEvent <SessionEndedEvent>(
() => session.Close());
}
}
private async Task <SshTerminalPane> ConnectSshTerminalPane(
InstanceLocator instanceLocator,
ICredential credential,
CultureInfo language = null)
{
var authorization = new Mock <IAuthorization>();
authorization
.SetupGet(a => a.Email)
.Returns("*****@*****.**");
var authorizationAdapter = new Mock <IAuthorizationAdapter>();
authorizationAdapter
.Setup(a => a.Authorization)
.Returns(authorization.Object);
using (var keyAdapter = new AuthorizedKeyService(
authorizationAdapter.Object,
new ComputeEngineAdapter(credential),
new ResourceManagerAdapter(credential),
new Mock <IOsLoginService>().Object))
{
var authorizedKey = await keyAdapter.AuthorizeKeyAsync(
instanceLocator,
new RsaSshKey(new RSACng()),
TimeSpan.FromMinutes(10),
null,
AuthorizeKeyMethods.InstanceMetadata,
CancellationToken.None)
.ConfigureAwait(true);
// Connect and wait for event
SessionStartedEvent connectedEvent = null;
this.eventService.BindHandler <SessionStartedEvent>(e => connectedEvent = e);
var broker = new SshTerminalSessionBroker(
this.serviceProvider);
var pane = await broker.ConnectAsync(
instanceLocator,
new IPEndPoint(await PublicAddressFromLocator(instanceLocator), 22),
authorizedKey,
language,
TimeSpan.FromSeconds(10))
.ConfigureAwait(true);
Assert.IsNotNull(connectedEvent, "ConnectionSuceededEvent event fired");
PumpWindowMessages();
return((SshTerminalPane)pane);
}
}
public async Task WhenExistingInvalidManagedKeyFound_ThenNewKeyIsPushed()
{
using (var key = RsaSshKey.NewEphemeralKey())
{
var existingProjectKeySet = MetadataAuthorizedKeySet
.FromMetadata(new Metadata())
.Add(new ManagedMetadataAuthorizedKey(
"bob",
"ssh-rsa",
key.PublicKeyString,
new ManagedKeyMetadata(SampleEmailAddress, DateTime.UtcNow.AddMinutes(-5))));
var computeEngineAdapter = CreateComputeEngineAdapterMock(
osLoginEnabledForProject: false,
osLoginEnabledForInstance: false,
osLogin2fa: false,
legacySshKeyPresent: false,
projectWideKeysBlockedForProject: false,
projectWideKeysBlockedForInstance: false,
existingProjectKeySet: existingProjectKeySet,
existingInstanceKeySet: null);
var service = new AuthorizedKeyService(
CreateAuthorizationAdapterMock().Object,
computeEngineAdapter.Object,
CreateResourceManagerAdapterMock(true).Object,
CreateOsLoginServiceMock().Object);
var authorizedKey = await service.AuthorizeKeyAsync(
SampleLocator,
key,
TimeSpan.FromMinutes(1),
"bob",
AuthorizeKeyMethods.All,
CancellationToken.None);
Assert.IsNotNull(authorizedKey);
Assert.AreEqual(AuthorizeKeyMethods.ProjectMetadata, authorizedKey.AuthorizationMethod);
Assert.AreEqual("bob", authorizedKey.Username);
computeEngineAdapter.Verify(a => a.UpdateMetadataAsync(
It.IsAny <InstanceLocator>(),
It.IsAny <Action <Metadata> >(),
It.IsAny <CancellationToken>()), Times.Never);
computeEngineAdapter.Verify(a => a.UpdateCommonInstanceMetadataAsync(
It.IsAny <string>(),
It.IsAny <Action <Metadata> >(),
It.IsAny <CancellationToken>()), Times.Once);
}
}
public void WhenMetadataUpdatesFails_ThenAuthorizeKeyAsyncThrowsSshKeyPushFailedException(
[Values(
HttpStatusCode.Forbidden,
HttpStatusCode.BadRequest)] HttpStatusCode httpStatus)
{
var computeEngineAdapter = CreateComputeEngineAdapterMock(
osLoginEnabledForProject: null,
osLoginEnabledForInstance: null,
osLogin2fa: false,
legacySshKeyPresent: false,
projectWideKeysBlockedForProject: false,
projectWideKeysBlockedForInstance: false);
computeEngineAdapter
.Setup(a => a.UpdateCommonInstanceMetadataAsync(
It.IsAny <string>(),
It.IsAny <Action <Metadata> >(),
It.IsAny <CancellationToken>()))
.Throws(new GoogleApiException("GCE", "mock-error")
{
HttpStatusCode = httpStatus
});
var service = new AuthorizedKeyService(
CreateAuthorizationAdapterMock().Object,
computeEngineAdapter.Object,
CreateResourceManagerAdapterMock(true).Object,
CreateOsLoginServiceMock().Object);
using (var key = RsaSshKey.NewEphemeralKey())
{
AssertEx.ThrowsAggregateException <SshKeyPushFailedException>(
() => service.AuthorizeKeyAsync(
SampleLocator,
key,
TimeSpan.FromMinutes(1),
null,
AuthorizeKeyMethods.All,
CancellationToken.None).Wait());
}
}
public void WhenLegacySshKeyPresent_ThenAuthorizeKeyAsyncThrowsUnsupportedLegacySshKeyEncounteredException()
{
var service = new AuthorizedKeyService(
CreateAuthorizationAdapterMock().Object,
CreateComputeEngineAdapterMock(
osLoginEnabledForProject: null,
osLoginEnabledForInstance: null,
osLogin2fa: false,
legacySshKeyPresent: true,
projectWideKeysBlockedForProject: false,
projectWideKeysBlockedForInstance: false).Object,
CreateResourceManagerAdapterMock(true).Object,
CreateOsLoginServiceMock().Object);
AssertEx.ThrowsAggregateException <UnsupportedLegacySshKeyEncounteredException>(
() => service.AuthorizeKeyAsync(
SampleLocator,
new Mock <ISshKey>().Object,
TimeSpan.FromMinutes(1),
null,
AuthorizeKeyMethods.All,
CancellationToken.None).Wait());
}
public void WhenProjectWideSshKeysBlockedButInstanceMetadataNotAllowed_ThenAuthorizeKeyThrowsInvalidOperationException()
{
var computeEngineAdapter = CreateComputeEngineAdapterMock(
osLoginEnabledForProject: null,
osLoginEnabledForInstance: null,
osLogin2fa: false,
legacySshKeyPresent: false,
projectWideKeysBlockedForProject: true,
projectWideKeysBlockedForInstance: false);
var service = new AuthorizedKeyService(
CreateAuthorizationAdapterMock().Object,
computeEngineAdapter.Object,
CreateResourceManagerAdapterMock(true).Object,
CreateOsLoginServiceMock().Object);
AssertEx.ThrowsAggregateException <InvalidOperationException>(
() => service.AuthorizeKeyAsync(
SampleLocator,
new Mock <ISshKey>().Object,
TimeSpan.FromMinutes(1),
null,
AuthorizeKeyMethods.Oslogin | AuthorizeKeyMethods.ProjectMetadata,
CancellationToken.None).Wait());
}