|
1
17
18 package org.apache.geronimo.jetty;
19
20 import java.io.BufferedReader  ;
21 import java.io.IOException ;
22 import java.io.InputStreamReader ;
23 import java.net.HttpURLConnection ;
24 import java.net.URL ;
25 import java.security.PermissionCollection ;
26 import java.security.Permissions ;
27 import java.util.HashMap ;
28 import java.util.HashSet ;
29 import java.util.Iterator ;
30 import java.util.Map ;
31 import java.util.Set ;
32 import javax.security.auth.Subject ;
33 import javax.security.auth.x500.X500Principal ;
34 import javax.security.jacc.WebResourcePermission ;
35 import javax.security.jacc.WebUserDataPermission ;
36
37 import org.apache.geronimo.common.DeploymentException;
38 import org.apache.geronimo.security.RealmPrincipal;
39 import org.apache.geronimo.security.deploy.DefaultPrincipal;
40 import org.apache.geronimo.security.deploy.DistinguishedName;
41 import org.apache.geronimo.security.deploy.Principal;
42 import org.apache.geronimo.security.deploy.Realm;
43 import org.apache.geronimo.security.deploy.Role;
44 import org.apache.geronimo.security.deploy.Security;
45 import org.apache.geronimo.security.jacc.ComponentPermissions;
46 import org.apache.geronimo.security.util.ConfigurationUtil;
47
48
49
54 public class SecurityTest extends AbstractWebModuleTest {
55
56
61 public void testExplicitMapping() throws Exception {
62 Security securityConfig = new Security();
63 securityConfig.setUseContextHandler(false);
64
65 DefaultPrincipal defaultPrincipal = new DefaultPrincipal();
66 defaultPrincipal.setRealmName("demo-properties-realm");
67 Principal principal = new Principal ();
68 principal.setClassName("org.apache.geronimo.security.realm.providers.GeronimoUserPrincipal");
69 principal.setPrincipalName("izumi");
70 defaultPrincipal.setPrincipal(principal);
71
72 securityConfig.setDefaultPrincipal(defaultPrincipal);
73
74 Role role = new Role();
75 role.setRoleName("content-administrator");
76 principal = new Principal ();
77 principal.setClassName("org.apache.geronimo.security.realm.providers.GeronimoGroupPrincipal");
78 principal.setPrincipalName("it");
79 Realm realm = new Realm();
80 realm.setRealmName("demo-properties-realm");
81 realm.getPrincipals().add(principal);
82 role.getRealms().put(realm.getRealmName(), realm);
83
84 securityConfig.getRoleMappings().put(role.getRoleName(), role);
85
86 Map roleDesignates = new HashMap ();
87 Map principalRoleMap = new HashMap ();
88 buildPrincipalRoleMap(securityConfig, roleDesignates, principalRoleMap);
89
90 PermissionCollection uncheckedPermissions = new Permissions ();
91
92 PermissionCollection excludedPermissions = new Permissions ();
93 excludedPermissions.add(new WebResourcePermission ("/auth/login.html", ""));
94 excludedPermissions.add(new WebUserDataPermission ("/auth/login.html", ""));
95
96 Map rolePermissions = new HashMap ();
97 PermissionCollection permissions = new Permissions ();
98 permissions.add(new WebUserDataPermission ("/protected/*", ""));
99 permissions.add(new WebResourcePermission ("/protected/*", ""));
100 rolePermissions.put("content-administrator", permissions);
101 rolePermissions.put("auto-administrator", permissions);
102
103 PermissionCollection checked = permissions;
104
105 Set securityRoles = new HashSet ();
106 securityRoles.add("content-administrator");
107 securityRoles.add("auto-administrator");
108
109 ComponentPermissions componentPermissions = new ComponentPermissions(excludedPermissions, uncheckedPermissions, rolePermissions);
110
111 startWebApp(roleDesignates, principalRoleMap, componentPermissions, defaultPrincipal, checked, securityRoles);
112
113 HttpURLConnection connection = (HttpURLConnection ) new URL ("http://localhost:5678/test/protected/hello.txt").openConnection();
114 connection.setInstanceFollowRedirects(false);
115 assertEquals(HttpURLConnection.HTTP_MOVED_TEMP, connection.getResponseCode());
116
117 String cookie = connection.getHeaderField("Set-Cookie");
118 cookie = cookie.substring(0, cookie.lastIndexOf(';'));
119 String location = connection.getHeaderField("Location");
120
121 connection = (HttpURLConnection ) new URL (location).openConnection();
122 connection.setInstanceFollowRedirects(false);
123 assertEquals(HttpURLConnection.HTTP_OK, connection.getResponseCode());
124
125 location = location.substring(0, location.lastIndexOf('/')) + "/j_security_check?j_username=alan&j_password=starcraft";
126
127 connection = (HttpURLConnection ) new URL (location).openConnection();
128 connection.setRequestMethod("POST");
129 connection.setRequestProperty("Cookie", cookie);
130 connection.setInstanceFollowRedirects(false);
131 assertEquals(HttpURLConnection.HTTP_MOVED_TEMP, connection.getResponseCode());
132
133 connection = (HttpURLConnection ) new URL ("http://localhost:5678/test/protected/hello.txt").openConnection();
134 connection.setRequestProperty("Cookie", cookie);
135 connection.setInstanceFollowRedirects(false);
136 BufferedReader reader = new BufferedReader (new InputStreamReader (connection.getInputStream()));
137
138 assertEquals(HttpURLConnection.HTTP_OK, connection.getResponseCode());
139 assertEquals("Hello World", reader.readLine());
140 connection.disconnect();
141
142 connection = (HttpURLConnection ) new URL ("http://localhost:5678/test/protected/hello.txt").openConnection();
143 connection.setInstanceFollowRedirects(false);
144 assertEquals(HttpURLConnection.HTTP_MOVED_TEMP, connection.getResponseCode());
145
146 cookie = connection.getHeaderField("Set-Cookie");
147 cookie = cookie.substring(0, cookie.lastIndexOf(';'));
148 location = connection.getHeaderField("Location");
149
150 connection = (HttpURLConnection ) new URL (location).openConnection();
151 connection.setInstanceFollowRedirects(false);
152 assertEquals(HttpURLConnection.HTTP_OK, connection.getResponseCode());
153
154 location = location.substring(0, location.lastIndexOf('/')) + "/j_security_check?j_username=izumi&j_password=violin";
155
156 connection = (HttpURLConnection ) new URL (location).openConnection();
157 connection.setRequestMethod("POST");
158 connection.setRequestProperty("Cookie", cookie);
159 connection.setInstanceFollowRedirects(false);
160 assertEquals(HttpURLConnection.HTTP_MOVED_TEMP, connection.getResponseCode());
161
162 try {
163 connection = (HttpURLConnection ) new URL ("http://localhost:5678/test/protected/hello.txt").openConnection();
164 connection.setRequestProperty("Cookie", cookie);
165 connection.setInstanceFollowRedirects(false);
166 reader = new BufferedReader (new InputStreamReader (connection.getInputStream()));
167
168 fail("Should throw an IOException for HTTP 403 response");
169 } catch (IOException e) {
170 }
171
172 assertEquals(HttpURLConnection.HTTP_FORBIDDEN, connection.getResponseCode());
173 connection.disconnect();
174
175 stopWebApp();
176 }
177
178 protected void startWebApp(Map roleDesignates, Map principalRoleMap, ComponentPermissions componentPermissions, DefaultPrincipal defaultPrincipal, PermissionCollection checked, Set securityRoles) throws Exception {
179 setUpSecureAppContext(roleDesignates, principalRoleMap, componentPermissions, defaultPrincipal, checked, securityRoles);
180 setUpStaticContentServlet();
181 }
183
184 protected void stopWebApp() throws Exception {
185 }
187
188 protected void setUp() throws Exception {
189 super.setUp();
190 setUpSecurity();
191 }
192
193 protected void tearDown() throws Exception {
194 tearDownSecurity();
195 super.tearDown();
196 }
197
198 public static void buildPrincipalRoleMap(Security security, Map roleDesignates, Map principalRoleMap) throws DeploymentException {
200 Map roleToPrincipalMap = new HashMap ();
201 buildRolePrincipalMap(security, roleDesignates, roleToPrincipalMap);
202 invertMap(roleToPrincipalMap, principalRoleMap);
203 }
204
205 private static Map invertMap(Map roleToPrincipalMap, Map principalRoleMapping) {
206 for (Iterator roles = roleToPrincipalMap.entrySet().iterator(); roles.hasNext();) {
207 Map.Entry entry = (Map.Entry ) roles.next();
208 String role = (String ) entry.getKey();
209 Set principals = (Set ) entry.getValue();
210 for (Iterator iter = principals.iterator(); iter.hasNext();) {
211 java.security.Principal principal = (java.security.Principal ) iter.next();
212
213 HashSet roleSet = (HashSet ) principalRoleMapping.get(principal);
214 if (roleSet == null) {
215 roleSet = new HashSet ();
216 principalRoleMapping.put(principal, roleSet);
217 }
218 roleSet.add(role);
219 }
220 }
221 return principalRoleMapping;
222 }
223
224 private static void buildRolePrincipalMap(Security security, Map roleDesignates, Map roleToPrincipalMap) throws DeploymentException {
225
226 Iterator rollMappings = security.getRoleMappings().values().iterator();
227 while (rollMappings.hasNext()) {
228 Role role = (Role) rollMappings.next();
229
230 String roleName = role.getRoleName();
231 Subject roleDesignate = new Subject ();
232 Set principalSet = new HashSet ();
233
234 Iterator realms = role.getRealms().values().iterator();
235 while (realms.hasNext()) {
236 Realm realm = (Realm) realms.next();
237
238 Iterator principals = realm.getPrincipals().iterator();
239 while (principals.hasNext()) {
240 Principal principal = (Principal ) principals.next();
241
242 RealmPrincipal realmPrincipal = ConfigurationUtil.generateRealmPrincipal(principal, realm.getRealmName());
243
244 if (realmPrincipal == null) throw new DeploymentException("Unable to create realm principal");
245
246 principalSet.add(realmPrincipal);
247 if (principal.isDesignatedRunAs()) roleDesignate.getPrincipals().add(realmPrincipal);
248 }
249 }
250
251 for (Iterator names = role.getDNames().iterator(); names.hasNext();) {
252 DistinguishedName dn = (DistinguishedName) names.next();
253
254 X500Principal x500Principal = ConfigurationUtil.generateX500Principal(dn.getName());
255
256 principalSet.add(x500Principal);
257 if (dn.isDesignatedRunAs()) {
258 roleDesignate.getPrincipals().add(x500Principal);
259 }
260 }
261
262 Set roleMapping = (Set ) roleToPrincipalMap.get(roleName);
263 if (roleMapping == null) {
264 roleMapping = new HashSet ();
265 roleToPrincipalMap.put(roleName, roleMapping);
266 }
267 roleMapping.addAll(principalSet);
268
269 if (roleDesignate.getPrincipals().size() > 0) {
270 roleDesignates.put(roleName, roleDesignate);
271 }
272 }
273 }
274 }
275 |
Popular Tags |
Java API By Example, From Geeks To Geeks.