Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-694: Add check to LdapShaPasswordEncoder to detect use with non-SHA passwords

Browse Source 
http://jira.springframework.org/browse/SEC-694
This commit is contained in:
Luke Taylor
2008-03-05 13:29:26 +00:00
parent 426e526694
commit 5ec8aa797c
3 changed files with 64 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
core/src/test/java/org/springframework/security/providers/ldap/authenticator/LdapShaPasswordEncoderTests.java
View File

@@ -15,7 +15,10 @@
package org.springframework.security.providers.ldap.authenticator;
import junit.framework.TestCase;
import static org.junit.Assert.*;
import org.junit.Before;
import org.junit.Test;
/**
@@ -24,37 +27,39 @@ import junit.framework.TestCase;
* @author Luke Taylor
* @version $Id$
*/
public class LdapShaPasswordEncoderTests extends TestCase {
public class LdapShaPasswordEncoderTests {
//~ Instance fields ================================================================================================
LdapShaPasswordEncoder sha;
//~ Methods ========================================================================================================
protected void setUp() throws Exception {
super.setUp();
@Before
public void setUp() throws Exception {
sha = new LdapShaPasswordEncoder();
}
public void testInvalidPasswordFails() {
@Test
public void invalidPasswordFails() {
assertFalse(sha.isPasswordValid("{SHA}ddSFGmjXYPbZC+NXR2kCzBRjqiE=", "wrongpassword", null));
}
public void testInvalidSaltedPasswordFails() {
@Test
public void invalidSaltedPasswordFails() {
assertFalse(sha.isPasswordValid("{SSHA}25ro4PKC8jhQZ26jVsozhX/xaP0suHgX", "wrongpassword", null));
assertFalse(sha.isPasswordValid("{SSHA}PQy2j+6n5ytA+YlAKkM8Fh4p6u2JxfVd", "wrongpassword", null));
}
public void testNonByteArraySaltThrowsException() {
try {
sha.encodePassword("password", "AStringNotAByteArray");
} catch (IllegalArgumentException expected) {}
@Test(expected=IllegalArgumentException.class)
public void nonByteArraySaltThrowsException() {
sha.encodePassword("password", "AStringNotAByteArray");
}
/**
* Test values generated by 'slappasswd -h {SHA} -s boabspasswurd'
*/
public void testValidPasswordSucceeds() {
@Test
public void validPasswordSucceeds() {
sha.setForceLowerCasePrefix(false);
assertTrue(sha.isPasswordValid("{SHA}ddSFGmjXYPbZC+NXR2kCzBRjqiE=", "boabspasswurd", null));
assertTrue(sha.isPasswordValid("{sha}ddSFGmjXYPbZC+NXR2kCzBRjqiE=", "boabspasswurd", null));
@@ -66,7 +71,8 @@ public class LdapShaPasswordEncoderTests extends TestCase {
/**
* Test values generated by 'slappasswd -s boabspasswurd'
*/
public void testValidSaltedPasswordSucceeds() {
@Test
public void validSaltedPasswordSucceeds() {
sha.setForceLowerCasePrefix(false);
assertTrue(sha.isPasswordValid("{SSHA}25ro4PKC8jhQZ26jVsozhX/xaP0suHgX", "boabspasswurd", null));
assertTrue(sha.isPasswordValid("{ssha}PQy2j+6n5ytA+YlAKkM8Fh4p6u2JxfVd", "boabspasswurd", null));
@@ -75,7 +81,8 @@ public class LdapShaPasswordEncoderTests extends TestCase {
assertTrue(sha.isPasswordValid("{ssha}PQy2j+6n5ytA+YlAKkM8Fh4p6u2JxfVd", "boabspasswurd", null));
}
public void testCorrectPrefixCaseIsUsed() {
@Test
public void correctPrefixCaseIsUsed() {
sha.setForceLowerCasePrefix(false);
assertEquals("{SHA}ddSFGmjXYPbZC+NXR2kCzBRjqiE=", sha.encodePassword("boabspasswurd", null));
assertTrue(sha.encodePassword("somepassword", "salt".getBytes()).startsWith("{SSHA}"));
@@ -85,4 +92,15 @@ public class LdapShaPasswordEncoderTests extends TestCase {
assertTrue(sha.encodePassword("somepassword", "salt".getBytes()).startsWith("{ssha}"));
}
@Test(expected=IllegalArgumentException.class)
public void invalidPrefixIsRejected() {
sha.isPasswordValid("{MD9}xxxxxxxxxx" , "somepassword", null);
}
@Test(expected=IllegalArgumentException.class)
public void malformedPrefixIsRejected() {
// No right brace
sha.isPasswordValid("{SSHA25ro4PKC8jhQZ26jVsozhX/xaP0suHgX" , "somepassword", null);
}
}