auth: Make luci-go services trust signatures produced by the token server.

server/auth/delegation/checker_test.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package delegation
 
 import (
         "encoding/base64"
         "os"
         "strings"
@@ skipping 86 matching lines @@
                 _, err := CheckToken(c, CheckTokenParams{
                         Token:                strings.Repeat("aaaa", 10000),
                         PeerID:               "user:to@example.com",
                         CertificatesProvider: minter,
                         GroupsChecker:        &fakeGroups{},
                         OwnServiceIdentity:   "service:service-id",
                 })
                 So(err, ShouldEqual, ErrMalformedDelegationToken)
         })
 
+        Convey("Untrusted signer", t, func() {
+                tok := minter.mintToken(c, subtoken(c, "user:from@example.com", "user:to@example.com"))
+                minter.signerID = "service:nah-i-renamed-myself"
+                _, err := CheckToken(c, CheckTokenParams{
+                        Token:                tok,
+                        PeerID:               "user:to@example.com",
+                        CertificatesProvider: minter,
+                        GroupsChecker:        &fakeGroups{},
+                        OwnServiceIdentity:   "service:service-id",
+                })
+                So(err, ShouldEqual, ErrUnsignedDelegationToken)
+        })
+
         Convey("Bad signature", t, func() {
                 tok := minter.mintToken(c, subtoken(c, "user:from@example.com", "user:to@example.com"))
                 // An offset in serialized token that points to Subtoken field. Replace one
                 // byte there to "break" the signature.
                 sigOffset := len(tok) - 10
                 So(tok[sigOffset], ShouldNotEqual, 'A')
                 _, err := CheckToken(c, CheckTokenParams{
                         Token:                tok[:sigOffset] + "A" + tok[sigOffset+1:],
                         PeerID:               "user:to@example.com",
                         CertificatesProvider: minter,
@@ skipping 64 matching lines @@
         signerID string
 }
 
 func newFakeTokenMinter() *fakeTokenMinter {
         return &fakeTokenMinter{
                 signer:   signingtest.NewSigner(0, nil),
                 signerID: "service:fake-signer",
         }
 }
 
-func (f *fakeTokenMinter) GetAuthServiceCertificates(c context.Context) (*signing.PublicCertificates, error) {
+func (f *fakeTokenMinter) GetCertificates(c context.Context, id identity.Identity) (*signing.PublicCertificates, error) {
+        if string(id) != f.signerID {
+                return nil, nil
+        }
         return f.signer.Certificates(c)
 }
 
 func (f *fakeTokenMinter) mintToken(c context.Context, subtoken *messages.Subtoken) string {
         blob, err := proto.Marshal(subtoken)
         if err != nil {
                 panic(err)
         }
         keyID, sig, err := f.signer.SignBytes(c, blob)
         if err != nil {
@@ skipping 15 matching lines @@
 type fakeGroups struct {
         groups map[string]string // if nil == no group checks
 }
 
 func (f *fakeGroups) IsMember(c context.Context, id identity.Identity, group string) (bool, error) {
         if f.groups == nil {
                 return true, nil
         }
         return f.groups[group] == string(id), nil
 }