more final version of the various PasswordEncoder implementations.

add unit tests for PasswordEncoder implementations.
remove ignore password case and ignore username case flags and handling from DaoAuthenticationProvider.
remove requirement described in JavaDoc for AuthenticationDao that it ignore case when returning a user by username. Implementations may still do so if configured as such.

core/src/test/java/org/acegisecurity/adapters/adaptertest-valid.xml

@@ -36,8 +36,6 @@
 	<!-- Authentication provider that queries our data access object  -->
 	<bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
      	<property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property>
- 		<property name="ignorePasswordCase"><value>false</value></property>
- 		<property name="ignoreUsernameCase"><value>true</value></property>
 	</bean>
 
 	<!-- The authentication manager that iterates through our only authentication provider -->

core/src/test/java/org/acegisecurity/intercept/web/securityfiltertest-valid.xml

@@ -34,8 +34,6 @@
 	
 	<bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
      	<property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property>
- 		<property name="ignorePasswordCase"><value>false</value></property>
- 		<property name="ignoreUsernameCase"><value>true</value></property>
 	</bean>
 
 	<bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager">

core/src/test/java/org/acegisecurity/providers/dao/DaoAuthenticationProviderTests.java

@@ -37,15 +37,6 @@ import org.springframework.dao.DataRetrievalFailureException;
  * @version $Id$
  */
 public class DaoAuthenticationProviderTests extends TestCase {
-    //~ Constructors ===========================================================
-
-    public DaoAuthenticationProviderTests() {
-        super();
-    }
-
-    public DaoAuthenticationProviderTests(String arg0) {
-        super(arg0);
-    }
 
     //~ Methods ================================================================
 
@@ -63,7 +54,6 @@ public class DaoAuthenticationProviderTests extends TestCase {
 
         DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
         provider.setAuthenticationDao(new MockAuthenticationDaoUserMarissa());
-        assertTrue(!provider.isIgnorePasswordCase()); // default
 
         try {
             provider.authenticate(token);
@@ -139,9 +129,6 @@ public class DaoAuthenticationProviderTests extends TestCase {
 
         DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
         provider.setAuthenticationDao(new MockAuthenticationDaoUserMarissa());
-        assertTrue(provider.isIgnoreUsernameCase()); // default
-        provider.setIgnoreUsernameCase(false);
-        assertTrue(!provider.isIgnoreUsernameCase()); // changed
 
         try {
             provider.authenticate(token);
@@ -151,32 +138,6 @@ public class DaoAuthenticationProviderTests extends TestCase {
         }
     }
 
-    public void testAuthenticateSuccessfulWithMixedCaseIfDefaultChanged() {
-        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("marissa",
-                "KOAla");
-
-        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
-        provider.setAuthenticationDao(new MockAuthenticationDaoUserMarissa());
-        assertTrue(!provider.isIgnorePasswordCase()); // default
-        provider.setIgnorePasswordCase(true);
-        assertTrue(provider.isIgnorePasswordCase()); // changed
-
-        Authentication result = provider.authenticate(token);
-        assertEquals("marissa", result.getPrincipal().toString());
-    }
-
-    public void testAuthenticateSuccessfulWithMixedCaseUsername() {
-        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("MaRiSSA",
-                "koala");
-
-        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
-        provider.setAuthenticationDao(new MockAuthenticationDaoUserMarissa());
-        assertTrue(provider.isIgnoreUsernameCase()); // default
-
-        Authentication result = provider.authenticate(token);
-        assertEquals("marissa", result.getPrincipal().toString());
-    }
-
     public void testAuthenticates() {
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("marissa",
                 "koala");
@@ -239,7 +200,7 @@ public class DaoAuthenticationProviderTests extends TestCase {
     private class MockAuthenticationDaoUserMarissa implements AuthenticationDao {
         public User loadUserByUsername(String username)
             throws UsernameNotFoundException, DataAccessException {
-            if ("marissa".equals(username.toLowerCase())) {
+            if ("marissa".equals(username)) {
                 return new User("marissa", "koala", true,
                     new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_ONE"), new GrantedAuthorityImpl(
                             "ROLE_TWO")});
@@ -253,7 +214,7 @@ public class DaoAuthenticationProviderTests extends TestCase {
     private class MockAuthenticationDaoUserPeter implements AuthenticationDao {
         public User loadUserByUsername(String username)
             throws UsernameNotFoundException, DataAccessException {
-            if ("peter".equals(username.toLowerCase())) {
+            if ("peter".equals(username)) {
                 return new User("peter", "opal", false,
                     new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_ONE"), new GrantedAuthorityImpl(
                             "ROLE_TWO")});

core/src/test/java/org/acegisecurity/providers/dao/MD5PasswordEncoderTest.java

@@ -0,0 +1,47 @@
+/* Copyright 2004 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package net.sf.acegisecurity.providers.dao;
+
+import junit.framework.TestCase;
+
+/**
+ * <p>
+ * TestCase for PlaintextPasswordEncoder.
+ * </p>
+ *
+ * @author colin sampaleanu
+ * @version $Id$
+ */
+public class MD5PasswordEncoderTest extends TestCase {
+
+  public void testBasicFunctionality() {
+    
+    MD5PasswordEncoder pe = new MD5PasswordEncoder();
+    String raw = "abc123";
+    String badRaw = "abc321";
+    String encoded = pe.encodePassword(raw, null);   // no SALT source
+    assertTrue(pe.isPasswordValid(encoded, raw, null));
+    assertFalse(pe.isPasswordValid(encoded, badRaw, null));
+    assertTrue(encoded.length() == 32);
+    
+    // now try Base64
+    pe.setEncodeHashAsBase64(true);
+    encoded = pe.encodePassword(raw, null);   // no SALT source
+    assertTrue(pe.isPasswordValid(encoded, raw, null));
+    assertFalse(pe.isPasswordValid(encoded, badRaw, null));
+    assertTrue(encoded.length() != 32);
+  }
+
+}

core/src/test/java/org/acegisecurity/providers/dao/PlaintextPasswordEncoderTest.java

@@ -0,0 +1,59 @@
+/* Copyright 2004 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package net.sf.acegisecurity.providers.dao;
+
+import junit.framework.TestCase;
+
+/**
+ * <p>
+ * TestCase for PlaintextPasswordEncoder.
+ * </p>
+ *
+ * @author colin sampaleanu
+ * @version $Id$
+ */
+public class PlaintextPasswordEncoderTest extends TestCase {
+
+  public void testBasicFunctionality() {
+    PlaintextPasswordEncoder pe = new PlaintextPasswordEncoder();
+
+    String raw = "abc123";
+    String rawDiffCase = "AbC123";
+    String badRaw = "abc321";
+    // should be able to validate even without encoding
+    String encoded = raw;
+    assertTrue(pe.isPasswordValid(encoded, raw, null));   // no SALT source
+    assertFalse(pe.isPasswordValid(encoded, badRaw, null));
+
+    // now make sure encoded version it gives us back is comparable as well
+    encoded = pe.encodePassword(raw, null);
+    assertTrue(pe.isPasswordValid(encoded, raw, null));   // no SALT source
+    assertFalse(pe.isPasswordValid(encoded, badRaw, null));
+    
+    // make sure default is not to ignore password case
+    encoded = pe.encodePassword(rawDiffCase, null);
+    assertFalse(pe.isPasswordValid(encoded, raw, null));
+    
+    // now check for ignore password case
+    pe = new PlaintextPasswordEncoder();
+    pe.setIgnorePasswordCase(true);
+
+    // should be able to validate even without encoding
+    encoded = pe.encodePassword(rawDiffCase, null);
+    assertTrue(pe.isPasswordValid(encoded, raw, null));
+    assertFalse(pe.isPasswordValid(encoded, badRaw, null));
+  }
+
+}

core/src/test/java/org/acegisecurity/providers/dao/SHAPasswordEncoderTest.java

@@ -0,0 +1,47 @@
+/* Copyright 2004 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package net.sf.acegisecurity.providers.dao;
+
+import junit.framework.TestCase;
+
+/**
+ * <p>
+ * TestCase for SHAPasswordEncoder.
+ * </p>
+ *
+ * @author colin sampaleanu
+ * @version $Id$
+ */
+public class SHAPasswordEncoderTest extends TestCase {
+
+  public void testBasicFunctionality() {
+    
+    SHAPasswordEncoder pe = new SHAPasswordEncoder();
+    String raw = "abc123";
+    String badRaw = "abc321";
+    String encoded = pe.encodePassword(raw, null);   // no SALT source
+    assertTrue(pe.isPasswordValid(encoded, raw, null));
+    assertFalse(pe.isPasswordValid(encoded, badRaw, null));
+    assertTrue(encoded.length() == 40);
+    
+    // now try Base64
+    pe.setEncodeHashAsBase64(true);
+    encoded = pe.encodePassword(raw, null);   // no SALT source
+    assertTrue(pe.isPasswordValid(encoded, raw, null));
+    assertFalse(pe.isPasswordValid(encoded, badRaw, null));
+    assertTrue(encoded.length() != 40);
+    
+  }
+}

core/src/test/java/org/acegisecurity/ui/webapp/filtertest-valid.xml

@@ -36,8 +36,6 @@
 	<!-- Authentication provider that queries our data access object  -->
 	<bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
      	<property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property>
- 		<property name="ignorePasswordCase"><value>false</value></property>
- 		<property name="ignoreUsernameCase"><value>true</value></property>
 	</bean>
 
 	<!-- The authentication manager that iterates through our only authentication provider -->