Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove ContextHolder and introduce SecurityContext.

Browse Source
This commit is contained in:
Ben Alex
2005-05-07 09:11:37 +00:00
parent 52064d5db4
commit 6a9abe5d90
74 changed files with 995 additions and 2208 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
core/src/test/java/org/acegisecurity/TargetObject.java
View File

@@ -15,9 +15,7 @@
package net.sf.acegisecurity;
import net.sf.acegisecurity.context.Context;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.SecurityContext;
/**
@@ -44,24 +42,18 @@ public class TargetObject implements ITargetObject {
* @param input the message to make lowercase
*
* @return the lowercase message, a space, the <code>Authentication</code>
* class that was on the <code>ContextHolder</code> at the time of
* method invocation, and a boolean indicating if the
* class that was on the <code>SecurityContext</code> at the time
* of method invocation, and a boolean indicating if the
* <code>Authentication</code> object is authenticated or not
*/
public String makeLowerCase(String input) {
Context context = ContextHolder.getContext();
Authentication auth = SecurityContext.getAuthentication();
if ((context != null) && (context instanceof SecureContext)) {
Authentication auth = ((SecureContext) context).getAuthentication();
if (auth == null) {
return input.toLowerCase() + " Authentication empty";
} else {
return input.toLowerCase() + " " + auth.getClass().getName()
+ " " + auth.isAuthenticated();
}
if (auth == null) {
return input.toLowerCase() + " Authentication empty";
} else {
return input.toLowerCase() + " ContextHolder Not Security Aware";
return input.toLowerCase() + " " + auth.getClass().getName() + " "
+ auth.isAuthenticated();
}
}
@@ -72,23 +64,12 @@ public class TargetObject implements ITargetObject {
* @param input the message to make uppercase
*
* @return the uppercase message, a space, the <code>Authentication</code>
* class that was on the <code>ContextHolder</code> at the time of
* method invocation, and a boolean indicating if the
* class that was on the <code>SecurityContext</code> at the time
* of method invocation, and a boolean indicating if the
* <code>Authentication</code> object is authenticated or not
*
* @throws AccessDeniedException if for some reason this method was being
* called and the <code>ContextHolder</code> was <code>null</code>
* or did not hold a <code>SecureContext</code>
*/
public String makeUpperCase(String input) {
Context context = ContextHolder.getContext();
if ((context == null) || !(context instanceof SecureContext)) {
throw new AccessDeniedException(
"For some reason the SecurityInterceptor allowed this call, meaning the ContextHolder should have been populated, but it was not.");
}
Authentication auth = ((SecureContext) context).getAuthentication();
Authentication auth = SecurityContext.getAuthentication();
return input.toUpperCase() + " " + auth.getClass().getName() + " "
+ auth.isAuthenticated();

21
core/src/test/java/org/acegisecurity/adapters/HttpRequestIntegrationFilterTests.java
View File

@@ -19,10 +19,9 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.util.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
@@ -58,17 +57,19 @@ public class HttpRequestIntegrationFilterTests extends TestCase {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setUserPrincipal(principal);
MockHttpServletResponse response = new MockHttpServletResponse();
MockFilterChain chain = new MockFilterChain(true);
filter.doFilter(request, response, chain);
if (!(SecureContextUtils.getSecureContext().getAuthentication() instanceof PrincipalAcegiUserToken)) {
if (!(SecurityContext.getAuthentication() instanceof PrincipalAcegiUserToken)) {
System.out.println(SecurityContext.getAuthentication());
fail("Should have returned PrincipalAcegiUserToken");
}
PrincipalAcegiUserToken castResult = (PrincipalAcegiUserToken) SecureContextUtils.getSecureContext()
.getAuthentication();
PrincipalAcegiUserToken castResult = (PrincipalAcegiUserToken) SecurityContext
.getAuthentication();
assertEquals(principal, castResult);
}
@@ -90,18 +91,18 @@ public class HttpRequestIntegrationFilterTests extends TestCase {
MockHttpServletResponse response = new MockHttpServletResponse();
MockFilterChain chain = new MockFilterChain(true);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
filter.doFilter(request, response, chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
protected void setUp() throws Exception {
super.setUp();
ContextHolder.setContext(new SecureContextImpl());
SecurityContext.setAuthentication(null);
}
protected void tearDown() throws Exception {
super.tearDown();
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
}

80
core/src/test/java/org/acegisecurity/context/ContextHolderTests.java
View File

@@ -1,80 +0,0 @@
/* Copyright 2004 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package net.sf.acegisecurity.context;
import junit.framework.TestCase;
/**
* Tests {@link ContextHolder}.
*
* @author Ben Alex
* @version $Id$
*/
public class ContextHolderTests extends TestCase {
//~ Constructors ===========================================================
public ContextHolderTests() {
super();
}
public ContextHolderTests(String arg0) {
super(arg0);
}
//~ Methods ================================================================
public final void setUp() throws Exception {
super.setUp();
}
public void tearDown() {
ContextHolder.setContext(null);
}
public static void main(String[] args) {
junit.textui.TestRunner.run(ContextHolderTests.class);
}
public void testContextHolderGetterSetter() {
assertEquals(null, ContextHolder.getContext());
MockContext context = new MockContext();
context.setColour("red");
ContextHolder.setContext(context);
MockContext offContext = (MockContext) ContextHolder.getContext();
assertEquals("red", offContext.getColour());
}
//~ Inner Classes ==========================================================
private class MockContext implements Context {
private String colour;
public void setColour(String colour) {
this.colour = colour;
}
public String getColour() {
return colour;
}
public void validate() throws ContextInvalidException {
return;
}
}
}

108
core/src/test/java/org/acegisecurity/context/ContextInterceptorTests.java
View File

@@ -1,108 +0,0 @@
/* Copyright 2004, 2005 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package net.sf.acegisecurity.context;
import junit.framework.TestCase;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import org.springframework.beans.factory.support.DefaultListableBeanFactory;
import org.springframework.beans.factory.support.PropertiesBeanDefinitionReader;
import java.util.Properties;
/**
* Tests {@link ContextInterceptor}.
*
* @author Ben Alex
* @version $Id$
*/
public class ContextInterceptorTests extends TestCase {
//~ Constructors ===========================================================
public ContextInterceptorTests() {
super();
}
public ContextInterceptorTests(String arg0) {
super(arg0);
}
//~ Methods ================================================================
public final void setUp() throws Exception {
super.setUp();
}
public static void main(String[] args) {
junit.textui.TestRunner.run(ContextInterceptorTests.class);
}
public ITargetObject makeInterceptedTarget() {
String PREFIX = "beans.";
DefaultListableBeanFactory lbf = new DefaultListableBeanFactory();
Properties p = new Properties();
p.setProperty(PREFIX + "contextInterceptor.class",
"net.sf.acegisecurity.context.ContextInterceptor");
p.setProperty(PREFIX + "targetObject.class",
"net.sf.acegisecurity.context.TargetObject");
p.setProperty(PREFIX + "target.class",
"org.springframework.aop.framework.ProxyFactoryBean");
p.setProperty(PREFIX + "target.proxyInterfaces",
"net.sf.acegisecurity.context.ITargetObject");
p.setProperty(PREFIX + "target.interceptorNames",
"contextInterceptor,targetObject");
int count = (new PropertiesBeanDefinitionReader(lbf))
.registerBeanDefinitions(p, PREFIX);
return (ITargetObject) lbf.getBean("target");
}
public void testInterceptorDetectsEmptyContextHolder()
throws Exception {
ITargetObject target = makeInterceptedTarget();
try {
target.makeUpperCase("hello");
fail("Should have thrown ContextHolderEmptyException");
} catch (ContextHolderEmptyException expected) {
assertTrue(true);
}
}
public void testInterceptorDetectsInvalidContext()
throws Exception {
ITargetObject target = makeInterceptedTarget();
ContextHolder.setContext(new SecureContextImpl()); // Authentication not set
try {
target.makeUpperCase("hello");
fail("Should have thrown ContextInvalidException");
} catch (ContextInvalidException expected) {
assertTrue(true);
}
}
public void testInterceptorNormalOperation() throws Exception {
ITargetObject target = makeInterceptedTarget();
ContextHolder.setContext(new ContextImpl());
String result = target.makeUpperCase("hello");
assertEquals("HELLO", result);
}
}

74
core/src/test/java/org/acegisecurity/context/HttpSessionContextIntegrationFilterTests.java
View File

@@ -23,9 +23,9 @@ import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.MockFilterConfig;
import net.sf.acegisecurity.adapters.PrincipalAcegiUserToken;
import net.sf.acegisecurity.context.HttpSessionContextIntegrationFilter;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import java.io.IOException;
@@ -36,10 +36,6 @@ import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpSession;
import org.springframework.mock.web.MockHttpServletResponse;
/**
* Tests {@link HttpSessionContextIntegrationFilter}.
@@ -64,26 +60,6 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
junit.textui.TestRunner.run(HttpSessionContextIntegrationFilterTests.class);
}
public void testDetectsMissingOrInvalidContext() throws Exception {
HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
try {
filter.afterPropertiesSet();
fail("Shown have thrown IllegalArgumentException");
} catch (IllegalArgumentException expected) {
assertTrue(true);
}
try {
filter.setContext(Integer.class);
assertEquals(Integer.class, filter.getContext());
filter.afterPropertiesSet();
fail("Shown have thrown IllegalArgumentException");
} catch (IllegalArgumentException expected) {
assertTrue(true);
}
}
public void testExistingContextContentsCopiedIntoContextHolderFromSessionAndChangesToContextCopiedBackToSession()
throws Exception {
// Build an Authentication object we simulate came from HttpSession
@@ -96,15 +72,10 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
"someone", "password",
new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_DIFFERENT_ROLE")});
// Build a Context to store in HttpSession (simulating prior request)
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(sessionPrincipal);
// Build a mock request
MockHttpServletRequest request = new MockHttpServletRequest();
request.getSession().setAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY,
sc);
request.getSession().setAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY,
sessionPrincipal);
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = new MockFilterChain(sessionPrincipal,
@@ -112,17 +83,15 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
// Prepare filter
HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
filter.setContext(SecureContextImpl.class);
filter.afterPropertiesSet();
// Execute filter
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
request, response, chain);
// Obtain new/update Authentication from HttpSession
Context context = (Context) request.getSession().getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
assertEquals(updatedPrincipal,
((SecureContext) context).getAuthentication());
Authentication auth = (Authentication) request.getSession()
.getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY);
assertEquals(updatedPrincipal, auth);
}
public void testHttpSessionCreatedWhenContextHolderChanges()
@@ -139,16 +108,15 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
// Prepare filter
HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
filter.setContext(SecureContextImpl.class);
filter.afterPropertiesSet();
// Execute filter
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
request, response, chain);
// Obtain new/update Authentication from HttpSession
Context context = (Context) request.getSession(false).getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
assertEquals(updatedPrincipal, ((SecureContext) context).getAuthentication());
Authentication auth = (Authentication) request.getSession(false)
.getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY);
assertEquals(updatedPrincipal, auth);
}
public void testHttpSessionNotCreatedUnlessContextHolderChanges()
@@ -160,8 +128,6 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
// Prepare filter
HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
filter.setContext(SecureContextImpl.class);
filter.afterPropertiesSet();
// Execute filter
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
@@ -179,26 +145,24 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_DIFFERENT_ROLE")});
// Build a mock request
MockHttpServletRequest request = new MockHttpServletRequest();
request.getSession().setAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY,
request.getSession().setAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY,
"NOT_A_CONTEXT_OBJECT");
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = new MockFilterChain(null, updatedPrincipal);
// Prepare filter
HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
filter.setContext(SecureContextImpl.class);
filter.afterPropertiesSet();
// Execute filter
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
request, response, chain);
// Obtain new/update Authentication from HttpSession
Context context = (Context) request.getSession().getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
assertEquals(updatedPrincipal,
((SecureContext) context).getAuthentication());
Authentication auth = (Authentication) request.getSession()
.getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY);
assertEquals(updatedPrincipal, auth);
}
private void executeFilterInContainerSimulator(FilterConfig filterConfig,
@@ -227,13 +191,11 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
throws IOException, ServletException {
if (expectedOnContextHolder != null) {
assertEquals(expectedOnContextHolder,
SecureContextUtils.getSecureContext().getAuthentication());
SecurityContext.getAuthentication());
}
if (changeContextHolder != null) {
SecureContext sc = SecureContextUtils.getSecureContext();
sc.setAuthentication(changeContextHolder);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(changeContextHolder);
}
}
}

28
core/src/test/java/org/acegisecurity/context/ITargetObject.java
View File

@@ -1,28 +0,0 @@
/* Copyright 2004 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package net.sf.acegisecurity.context;
/**
* Represents the interface of a secured object.
*
* @author Ben Alex
* @version $Id$
*/
public interface ITargetObject {
//~ Methods ================================================================
public String makeUpperCase(String input);
}

93
core/src/test/java/org/acegisecurity/context/SecureContextImplTests.java
View File

@@ -1,93 +0,0 @@
/* Copyright 2004, 2005 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package net.sf.acegisecurity.context;
import junit.framework.TestCase;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
/**
* Tests {@link SecureContextImpl}.
*
* @author Ben Alex
* @version $Id$
*/
public class SecureContextImplTests extends TestCase {
//~ Constructors ===========================================================
public SecureContextImplTests() {
super();
}
public SecureContextImplTests(String arg0) {
super(arg0);
}
//~ Methods ================================================================
public final void setUp() throws Exception {
super.setUp();
}
public static void main(String[] args) {
junit.textui.TestRunner.run(SecureContextImplTests.class);
}
public void testEmptyObjectsAreEquals() {
SecureContextImpl obj1 = new SecureContextImpl();
SecureContextImpl obj2 = new SecureContextImpl();
assertTrue(obj1.equals(obj2));
}
public void testSecureContextCorrectOperation() {
SecureContext context = new SecureContextImpl();
Authentication auth = new UsernamePasswordAuthenticationToken("marissa",
"koala");
context.setAuthentication(auth);
context.validate();
assertEquals(auth, context.getAuthentication());
assertTrue(context.toString().lastIndexOf("marissa") != -1);
}
public void testSecureContextDetectsMissingAuthenticationObject() {
SecureContext context = new SecureContextImpl();
assertTrue(context.toString().lastIndexOf("Null authentication") != -1);
try {
context.validate();
fail("Should have thrown ContextInvalidException");
} catch (ContextInvalidException expected) {
assertTrue(true);
}
}
public void testSecureContextDetectsNullAuthenticationObject() {
SecureContext context = new SecureContextImpl();
context.setAuthentication(null);
try {
context.validate();
fail("Should have thrown ContextInvalidException");
} catch (ContextInvalidException expected) {
assertTrue(true);
}
}
}

30
core/src/test/java/org/acegisecurity/context/ContextImplTests.java → core/src/test/java/org/acegisecurity/context/SecurityContextTests.java
View File

@@ -1,4 +1,4 @@
/* Copyright 2004 Acegi Technology Pty Limited
/* Copyright 2004, 2005 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,21 +17,23 @@ package net.sf.acegisecurity.context;
import junit.framework.TestCase;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
/**
* Tests {@link ContextImpl}.
* Tests {@link SecurityContext}.
*
* @author Ben Alex
* @version $Id$
*/
public class ContextImplTests extends TestCase {
public class SecurityContextTests extends TestCase {
//~ Constructors ===========================================================
public ContextImplTests() {
public SecurityContextTests() {
super();
}
public ContextImplTests(String arg0) {
public SecurityContextTests(String arg0) {
super(arg0);
}
@@ -42,12 +44,20 @@ public class ContextImplTests extends TestCase {
}
public static void main(String[] args) {
junit.textui.TestRunner.run(ContextImplTests.class);
junit.textui.TestRunner.run(SecurityContextTests.class);
}
public void testConfirmsContextImplHasTheValidateMethod() {
Context context = new ContextImpl();
context.validate();
assertTrue(true);
public void tearDown() {
SecurityContext.setAuthentication(null);
}
public void testContextHolderGetterSetter() {
assertEquals(null, SecurityContext.getAuthentication());
SecurityContext.setAuthentication(new UsernamePasswordAuthenticationToken(
"ben", "12345"));
assertEquals("12345",
SecurityContext.getAuthentication().getCredentials());
}
}

30
core/src/test/java/org/acegisecurity/context/TargetObject.java
View File

@@ -1,30 +0,0 @@
/* Copyright 2004 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package net.sf.acegisecurity.context;
/**
* Represents a secured object.
*
* @author Ben Alex
* @version $Id$
*/
public class TargetObject implements ITargetObject {
//~ Methods ================================================================
public String makeUpperCase(String input) {
return input.toUpperCase();
}
}

29
core/src/test/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutorTests.java
View File

@@ -18,10 +18,8 @@ package net.sf.acegisecurity.context.httpinvoker;
import junit.framework.TestCase;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.context.httpinvoker.AuthenticationSimpleHttpInvokerRequestExecutor;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import java.io.IOException;
@@ -59,11 +57,9 @@ public class AuthenticationSimpleHttpInvokerRequestExecutorTests
public void testNormalOperation() throws Exception {
// Setup client-side context
SecureContext clientSideContext = new SecureContextImpl();
Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("Aladdin",
"open sesame");
clientSideContext.setAuthentication(clientSideAuthentication);
ContextHolder.setContext(clientSideContext);
SecurityContext.setAuthentication(clientSideAuthentication);
// Create a connection and ensure our executor sets its
// properties correctly
@@ -78,28 +74,11 @@ public class AuthenticationSimpleHttpInvokerRequestExecutorTests
assertEquals("Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==",
conn.getRequestProperty("Authorization"));
ContextHolder.setContext(null);
}
public void testNullAuthenticationIsNull() throws Exception {
// Setup client-side context
SecureContext clientSideContext = new SecureContextImpl();
clientSideContext.setAuthentication(null);
ContextHolder.setContext(clientSideContext);
// Create a connection and ensure our executor sets its
// properties correctly
AuthenticationSimpleHttpInvokerRequestExecutor executor = new AuthenticationSimpleHttpInvokerRequestExecutor();
HttpURLConnection conn = new MockHttpURLConnection(new URL(
"http://localhost/"));
executor.prepareConnection(conn, 10);
// Check connection properties (shouldn't be an Authorization header)
assertNull(conn.getRequestProperty("Authorization"));
SecurityContext.setAuthentication(null);
}
public void testNullContextHolderIsNull() throws Exception {
ContextHolder.setContext(null); // just to be explicit
SecurityContext.setAuthentication(null);
// Create a connection and ensure our executor sets its
// properties correctly

16
core/src/test/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocationTests.java
View File

@@ -20,11 +20,9 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.MockMethodInvocation;
import net.sf.acegisecurity.TargetObject;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.context.rmi.ContextPropagatingRemoteInvocation;
import net.sf.acegisecurity.context.rmi.ContextPropagatingRemoteInvocationFactory;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.aopalliance.intercept.MethodInvocation;
@@ -58,18 +56,16 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
public void testNormalOperation() throws Exception {
// Setup client-side context
SecureContext clientSideContext = new SecureContextImpl();
Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("marissa",
"koala");
clientSideContext.setAuthentication(clientSideAuthentication);
ContextHolder.setContext(clientSideContext);
SecurityContext.setAuthentication(clientSideAuthentication);
ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation();
// Set to null, as ContextPropagatingRemoteInvocation already obtained
// a copy and nulling is necessary to ensure the Context delivered by
// ContextPropagatingRemoteInvocation is used on server-side
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
// The result from invoking the TargetObject should contain the
// Authentication class delivered via the ContextHolder
@@ -79,12 +75,12 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase {
public void testNullContextHolderDoesNotCauseInvocationProblems()
throws Exception {
ContextHolder.setContext(null); // just to be explicit
SecurityContext.setAuthentication(null); // just to be explicit
ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation();
ContextHolder.setContext(null); // unnecessary, but for explicitness
SecurityContext.setAuthentication(null); // unnecessary, but for explicitness
assertEquals("some_string ContextHolder Not Security Aware",
assertEquals("some_string Authentication empty",
remoteInvocation.invoke(new TargetObject()));
}

16
core/src/test/java/org/acegisecurity/intercept/method/MethodDefinitionAttributesTests.java
View File

@@ -27,9 +27,7 @@ import net.sf.acegisecurity.OtherTargetObject;
import net.sf.acegisecurity.SecurityConfig;
import net.sf.acegisecurity.TargetObject;
import net.sf.acegisecurity.acl.basic.SomeDomain;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.springframework.context.ApplicationContext;
@@ -167,29 +165,25 @@ public class MethodDefinitionAttributesTests extends TestCase {
}
public void testMethodCallWithRunAsReplacement() throws Exception {
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_INTERFACE_METHOD_MAKE_UPPER_CASE")});
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
ITargetObject target = makeInterceptedTarget();
String result = target.makeUpperCase("hello");
assertEquals("HELLO net.sf.acegisecurity.MockRunAsAuthenticationToken true",
result);
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testMethodCallWithoutRunAsReplacement()
throws Exception {
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_INTERFACE_METHOD_MAKE_LOWER_CASE")});
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
ITargetObject target = makeInterceptedTarget();
String result = target.makeLowerCase("HELLO");
@@ -197,7 +191,7 @@ public class MethodDefinitionAttributesTests extends TestCase {
assertEquals("hello net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken true",
result);
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testNullReturnedIfZeroAttributesDefinedForMethodInvocation()

85
core/src/test/java/org/acegisecurity/intercept/method/aopalliance/MethodSecurityInterceptorTests.java
View File

@@ -33,10 +33,7 @@ import net.sf.acegisecurity.MockAfterInvocationManager;
import net.sf.acegisecurity.MockAuthenticationManager;
import net.sf.acegisecurity.MockRunAsManager;
import net.sf.acegisecurity.RunAsManager;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.ContextImpl;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.intercept.method.AbstractMethodDefinitionSource;
import net.sf.acegisecurity.intercept.method.MockMethodDefinitionSource;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
@@ -79,50 +76,34 @@ public class MethodSecurityInterceptorTests extends TestCase {
public void testCallingAPublicMethodFacadeWillNotRepeatSecurityChecksWhenPassedToTheSecuredMethodItFronts()
throws Exception {
ITargetObject target = makeInterceptedTarget();
String result = target.publicMakeLowerCase("HELLO");
assertEquals("hello ContextHolder Not Security Aware", result);
ContextHolder.setContext(null);
}
public void testCallingAPublicMethodWhenPresentingASecureContextButWithoutAnyAuthenticationObject()
throws Exception {
SecureContext context = new SecureContextImpl();
ContextHolder.setContext(context);
ITargetObject target = makeInterceptedTarget();
String result = target.publicMakeLowerCase("HELLO");
assertEquals("hello Authentication empty", result);
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testCallingAPublicMethodWhenPresentingAnAuthenticationObjectWillProperlySetItsIsAuthenticatedProperty()
throws Exception {
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_THIS_IS_NOT_REQUIRED_AS_IT_IS_PUBLIC")});
assertTrue(!token.isAuthenticated());
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
ITargetObject target = makeInterceptedTarget();
String result = target.publicMakeLowerCase("HELLO");
assertEquals("hello net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken false",
result);
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testDeniesWhenAppropriate() throws Exception {
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_NO_BENEFIT_TO_THIS_GRANTED_AUTHORITY")});
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
ITargetObject target = makeInterceptedTarget();
@@ -133,7 +114,7 @@ public class MethodSecurityInterceptorTests extends TestCase {
assertTrue(true);
}
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testGetters() {
@@ -159,30 +140,26 @@ public class MethodSecurityInterceptorTests extends TestCase {
}
public void testMethodCallWithRunAsReplacement() throws Exception {
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_UPPER")});
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
ITargetObject target = makeInterceptedTarget();
String result = target.makeUpperCase("hello");
assertEquals("HELLO net.sf.acegisecurity.MockRunAsAuthenticationToken true",
result);
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testMethodCallWithoutRunAsReplacement()
throws Exception {
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_LOWER")});
assertTrue(!token.isAuthenticated());
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
ITargetObject target = makeInterceptedTargetWithoutAnAfterInvocationManager();
String result = target.makeLowerCase("HELLO");
@@ -191,10 +168,10 @@ public class MethodSecurityInterceptorTests extends TestCase {
assertEquals("hello net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken true",
result);
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testRejectionOfEmptyContextHolder() throws Exception {
public void testRejectionOfEmptySecurityContext() throws Exception {
ITargetObject target = makeInterceptedTarget();
try {
@@ -206,40 +183,6 @@ public class MethodSecurityInterceptorTests extends TestCase {
}
}
public void testRejectionOfNonSecureContextOnContextHolder()
throws Exception {
ContextHolder.setContext(new ContextImpl());
ITargetObject target = makeInterceptedTarget();
try {
target.makeUpperCase("hello");
fail(
"Should have thrown AuthenticationCredentialsNotFoundException");
} catch (AuthenticationCredentialsNotFoundException expected) {
assertTrue(true);
}
ContextHolder.setContext(null);
}
public void testRejectionOfSecureContextThatContainsNoAuthenticationObject()
throws Exception {
ContextHolder.setContext(new SecureContextImpl());
ITargetObject target = makeInterceptedTarget();
try {
target.makeUpperCase("hello");
fail(
"Should have thrown AuthenticationCredentialsNotFoundException");
} catch (AuthenticationCredentialsNotFoundException expected) {
assertTrue(true);
}
ContextHolder.setContext(null);
}
public void testRejectsAccessDecisionManagersThatDoNotSupportMethodInvocation()
throws Exception {
MethodSecurityInterceptor si = new MethodSecurityInterceptor();
@@ -259,13 +202,11 @@ public class MethodSecurityInterceptorTests extends TestCase {
public void testRejectsCallsWhenAuthenticationIsIncorrect()
throws Exception {
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_LOWER")});
assertTrue(!token.isAuthenticated());
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
ITargetObject target = makeInterceptedTargetRejectsAuthentication();
@@ -276,7 +217,7 @@ public class MethodSecurityInterceptorTests extends TestCase {
assertTrue(true);
}
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testRejectsCallsWhenObjectDefinitionSourceDoesNotSupportObject()

16
core/src/test/java/org/acegisecurity/intercept/method/aspectj/AspectJSecurityInterceptorTests.java
View File

@@ -26,9 +26,7 @@ import net.sf.acegisecurity.MockAuthenticationManager;
import net.sf.acegisecurity.MockJoinPoint;
import net.sf.acegisecurity.MockRunAsManager;
import net.sf.acegisecurity.TargetObject;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.intercept.method.MethodDefinitionMap;
import net.sf.acegisecurity.intercept.method.MethodDefinitionSourceEditor;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
@@ -88,17 +86,15 @@ public class AspectJSecurityInterceptorTests extends TestCase {
MockAspectJCallback aspectJCallback = new MockAspectJCallback();
SecureContext secureContext = new SecureContextImpl();
secureContext.setAuthentication(new TestingAuthenticationToken(
SecurityContext.setAuthentication(new TestingAuthenticationToken(
"marissa", "koala",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_ONE")}));
ContextHolder.setContext(secureContext);
Object result = si.invoke(joinPoint, aspectJCallback);
assertEquals("object proceeded", result);
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testCallbackIsNotInvokedWhenPermissionDenied()
@@ -126,10 +122,8 @@ public class AspectJSecurityInterceptorTests extends TestCase {
MockAspectJCallback aspectJCallback = new MockAspectJCallback();
aspectJCallback.setThrowExceptionIfInvoked(true);
SecureContext secureContext = new SecureContextImpl();
secureContext.setAuthentication(new TestingAuthenticationToken(
SecurityContext.setAuthentication(new TestingAuthenticationToken(
"marissa", "koala", new GrantedAuthority[] {}));
ContextHolder.setContext(secureContext);
try {
si.invoke(joinPoint, aspectJCallback);
@@ -138,7 +132,7 @@ public class AspectJSecurityInterceptorTests extends TestCase {
assertTrue(true);
}
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
//~ Inner Classes ==========================================================

22
core/src/test/java/org/acegisecurity/intercept/web/FilterSecurityInterceptorTests.java
View File

@@ -30,11 +30,12 @@ import net.sf.acegisecurity.MockAuthenticationManager;
import net.sf.acegisecurity.MockRunAsManager;
import net.sf.acegisecurity.RunAsManager;
import net.sf.acegisecurity.SecurityConfig;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import java.io.IOException;
import java.util.Iterator;
@@ -44,9 +45,6 @@ import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockHttpServletRequest;
/**
* Tests {@link FilterSecurityInterceptor}.
@@ -169,19 +167,17 @@ public class FilterSecurityInterceptorTests extends TestCase {
request.setServerPort(443);
// Setup a Context
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_OK")});
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
// Create and test our secure object
FilterInvocation fi = new FilterInvocation(request, response, chain);
interceptor.invoke(fi);
// Destroy the Context
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testNormalStartupAndGetter() throws Exception {
@@ -229,19 +225,17 @@ public class FilterSecurityInterceptorTests extends TestCase {
request.setServletPath("/secure/page.html");
// Setup a Context
SecureContext context = new SecureContextImpl();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("Test",
"Password",
new GrantedAuthority[] {new GrantedAuthorityImpl("MOCK_OK")});
context.setAuthentication(token);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(token);
// Create and test our secure object
FilterInvocation fi = new FilterInvocation(request, response, chain);
interceptor.invoke(fi);
// Destroy the Context
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
//~ Inner Classes ==========================================================

23
core/src/test/java/org/acegisecurity/intercept/web/SecurityEnforcementFilterTests.java
View File

@@ -17,10 +17,13 @@ package net.sf.acegisecurity.intercept.web;
import junit.framework.TestCase;
import net.sf.acegisecurity.*;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.AccessDeniedException;
import net.sf.acegisecurity.BadCredentialsException;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.MockAuthenticationEntryPoint;
import net.sf.acegisecurity.MockPortResolver;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.anonymous.AnonymousAuthenticationToken;
import net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter;
@@ -80,11 +83,9 @@ public class SecurityEnforcementFilterTests extends TestCase {
false, false, false);
// Setup ContextHolder, as filter needs to check if user is anonymous
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(new AnonymousAuthenticationToken("ignored",
"ignored",
SecurityContext.setAuthentication(new AnonymousAuthenticationToken(
"ignored", "ignored",
new GrantedAuthority[] {new GrantedAuthorityImpl("IGNORED")}));
ContextHolder.setContext(sc);
// Test
SecurityEnforcementFilter filter = new SecurityEnforcementFilter();
@@ -112,9 +113,7 @@ public class SecurityEnforcementFilterTests extends TestCase {
false, false, false);
// Setup ContextHolder, as filter needs to check if user is anonymous
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(null);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(null);
// Test
SecurityEnforcementFilter filter = new SecurityEnforcementFilter();
@@ -357,7 +356,7 @@ public class SecurityEnforcementFilterTests extends TestCase {
protected void tearDown() throws Exception {
super.tearDown();
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
//~ Inner Classes ==========================================================

34
core/src/test/java/org/acegisecurity/providers/anonymous/AnonymousProcessingFilterTests.java
View File

@@ -21,16 +21,13 @@ import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.MockFilterConfig;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import net.sf.acegisecurity.providers.dao.memory.UserAttribute;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import java.io.IOException;
import javax.servlet.Filter;
@@ -40,9 +37,6 @@ import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
/**
* Tests {@link AnonymousProcessingFilter}.
@@ -112,12 +106,10 @@ public class AnonymousProcessingFilterTests extends TestCase {
public void testOperationWhenAuthenticationExistsInContextHolder()
throws Exception {
// Put an Authentication object into the ContextHolder
SecureContext sc = SecureContextUtils.getSecureContext();
Authentication originalAuth = new TestingAuthenticationToken("user",
"password",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_A")});
sc.setAuthentication(originalAuth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(originalAuth);
// Setup our filter correctly
UserAttribute user = new UserAttribute();
@@ -133,12 +125,10 @@ public class AnonymousProcessingFilterTests extends TestCase {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("x");
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
request, new MockHttpServletResponse(),
new MockFilterChain(true));
request, new MockHttpServletResponse(), new MockFilterChain(true));
// Ensure filter didn't change our original object
assertEquals(originalAuth,
SecureContextUtils.getSecureContext().getAuthentication());
assertEquals(originalAuth, SecurityContext.getAuthentication());
}
public void testOperationWhenNoAuthenticationInContextHolder()
@@ -155,11 +145,9 @@ public class AnonymousProcessingFilterTests extends TestCase {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("x");
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
request, new MockHttpServletResponse(),
new MockFilterChain(true));
request, new MockHttpServletResponse(), new MockFilterChain(true));
Authentication auth = SecureContextUtils.getSecureContext()
.getAuthentication();
Authentication auth = SecurityContext.getAuthentication();
assertEquals("anonymousUsername", auth.getPrincipal());
assertEquals(new GrantedAuthorityImpl("ROLE_ANONYMOUS"),
auth.getAuthorities()[0]);
@@ -167,12 +155,12 @@ public class AnonymousProcessingFilterTests extends TestCase {
protected void setUp() throws Exception {
super.setUp();
ContextHolder.setContext(new SecureContextImpl());
SecurityContext.setAuthentication(null);
}
protected void tearDown() throws Exception {
super.tearDown();
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
private void executeFilterInContainerSimulator(FilterConfig filterConfig,

74
core/src/test/java/org/acegisecurity/providers/jaas/SecureContextLoginModuleTest.java
View File

@@ -17,10 +17,7 @@ package net.sf.acegisecurity.providers.jaas;
import junit.framework.TestCase;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.ContextImpl;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import java.util.HashSet;
@@ -40,69 +37,66 @@ public class SecureContextLoginModuleTest extends TestCase {
private SecureContextLoginModule module = null;
private Subject subject = new Subject(false, new HashSet(), new HashSet(),
new HashSet());
private UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken("principal", "credentials");
private UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken("principal",
"credentials");
//~ Methods ================================================================
public void testAbort() throws Exception {
assertFalse("Should return false, no auth is set", module.abort());
SecurityContext.setAuthentication(auth);
module.login();
module.commit();
assertTrue(module.abort());
}
public void testLoginException() throws Exception {
try {
module.login();
fail("LoginException expected, there is no Authentication in the SecureContext");
} catch (LoginException e) {
}
fail(
"LoginException expected, there is no Authentication in the SecureContext");
} catch (LoginException e) {}
}
public void testLoginSuccess() throws Exception {
SecureContext sc = (SecureContext) ContextHolder.getContext();
sc.setAuthentication(auth);
assertTrue("Login should succeed, there is an authentication set", module.login());
assertTrue("The authentication is not null, this should return true", module.commit());
assertTrue("Principals should contain the authentication", subject.getPrincipals().contains(auth));
}
public void testNoContext() throws Exception {
ContextHolder.setContext(null);
assertFalse("Should return false and ask to be ignored", module.login());
}
public void testUnsupportedContext() throws Exception {
ContextHolder.setContext(new ContextImpl());
assertFalse("Should return false and ask to be ignored", module.login());
SecurityContext.setAuthentication(auth);
assertTrue("Login should succeed, there is an authentication set",
module.login());
assertTrue("The authentication is not null, this should return true",
module.commit());
assertTrue("Principals should contain the authentication",
subject.getPrincipals().contains(auth));
}
public void testLogout() throws Exception {
SecureContext sc = (SecureContext) ContextHolder.getContext();
sc.setAuthentication(auth);
SecurityContext.setAuthentication(auth);
module.login();
assertTrue("Should return true as it succeeds", module.logout());
assertEquals("Authentication should be null", null, module.getAuthentication());
assertEquals("Authentication should be null", null,
module.getAuthentication());
assertFalse("Principals should not contain the authentication after logout", subject.getPrincipals().contains(auth));
assertFalse("Principals should not contain the authentication after logout",
subject.getPrincipals().contains(auth));
}
public void testNullAuthenticationInSecureContext()
throws Exception {
SecurityContext.setAuthentication(null);
assertFalse("Should return false and ask to be ignored", module.login());
}
public void testNullLogout() throws Exception {
assertFalse(module.logout());
}
public void testAbort() throws Exception {
assertFalse("Should return false, no auth is set", module.abort());
SecureContext sc = (SecureContext) ContextHolder.getContext();
sc.setAuthentication(auth);
module.login();
module.commit();
assertTrue(module.abort());
}
protected void setUp() throws Exception {
module = new SecureContextLoginModule();
module.initialize(subject, null, null, null);
ContextHolder.setContext(new SecureContextImpl());
SecurityContext.setAuthentication(null);
}
protected void tearDown() throws Exception {
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
module = null;
}
}

82
core/src/test/java/org/acegisecurity/taglibs/authz/AclTagTests.java
View File

@@ -25,9 +25,7 @@ import net.sf.acegisecurity.acl.AclEntry;
import net.sf.acegisecurity.acl.AclManager;
import net.sf.acegisecurity.acl.basic.MockAclObjectIdentity;
import net.sf.acegisecurity.acl.basic.SimpleAclEntry;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import org.springframework.context.ApplicationContext;
@@ -55,64 +53,34 @@ public class AclTagTests extends TestCase {
throws JspException {
Authentication auth = new TestingAuthenticationToken("marissa",
"koala", new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
aclTag.setHasPermission(new Long(SimpleAclEntry.ADMINISTRATION)
.toString());
aclTag.setDomainObject(new Integer(54));
assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
ContextHolder.setContext(null);
}
public void testInclusionDeniedWhenAuthenticationEmpty()
throws JspException {
ContextHolder.setContext(new SecureContextImpl());
aclTag.setHasPermission(new Long(SimpleAclEntry.ADMINISTRATION)
.toString());
aclTag.setDomainObject("object1");
assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
ContextHolder.setContext(null);
}
public void testInclusionDeniedWhenContextHolderEmpty()
throws JspException {
ContextHolder.setContext(null);
aclTag.setHasPermission(new Long(SimpleAclEntry.ADMINISTRATION)
.toString());
aclTag.setDomainObject("object1");
assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testInclusionDeniedWhenNoListOfPermissionsGiven()
throws JspException {
Authentication auth = new TestingAuthenticationToken("marissa",
"koala", new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
aclTag.setHasPermission(null);
aclTag.setDomainObject("object1");
assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testInclusionDeniedWhenPrincipalDoesNotHoldAnyPermissions()
throws JspException {
Authentication auth = new TestingAuthenticationToken("john", "crow",
new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
aclTag.setHasPermission(new Integer(SimpleAclEntry.ADMINISTRATION)
+ "," + new Integer(SimpleAclEntry.READ));
@@ -122,22 +90,32 @@ public class AclTagTests extends TestCase {
assertEquals("object1", aclTag.getDomainObject());
assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testInclusionDeniedWhenPrincipalDoesNotHoldRequiredPermissions()
throws JspException {
Authentication auth = new TestingAuthenticationToken("marissa",
"koala", new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
aclTag.setHasPermission(new Integer(SimpleAclEntry.DELETE).toString());
aclTag.setDomainObject("object1");
assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testInclusionDeniedWhenSecurityContextEmpty()
throws JspException {
SecurityContext.setAuthentication(null);
aclTag.setHasPermission(new Long(SimpleAclEntry.ADMINISTRATION)
.toString());
aclTag.setDomainObject("object1");
assertEquals(Tag.SKIP_BODY, aclTag.doStartTag());
SecurityContext.setAuthentication(null);
}
public void testInclusionPermittedWhenDomainObjectIsNull()
@@ -151,9 +129,7 @@ public class AclTagTests extends TestCase {
throws JspException {
Authentication auth = new TestingAuthenticationToken("john", "crow",
new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
aclTag.setHasPermission("0,5, 6"); // shouldn't be any space
@@ -164,38 +140,34 @@ public class AclTagTests extends TestCase {
assertTrue(true);
}
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testOperationWhenPrincipalHoldsPermissionOfMultipleList()
throws JspException {
Authentication auth = new TestingAuthenticationToken("marissa",
"koala", new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
aclTag.setHasPermission(new Integer(SimpleAclEntry.ADMINISTRATION)
+ "," + new Integer(SimpleAclEntry.READ));
aclTag.setDomainObject("object1");
assertEquals(Tag.EVAL_BODY_INCLUDE, aclTag.doStartTag());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testOperationWhenPrincipalHoldsPermissionOfSingleList()
throws JspException {
Authentication auth = new TestingAuthenticationToken("marissa",
"koala", new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
aclTag.setHasPermission(new Integer(SimpleAclEntry.READ).toString());
aclTag.setDomainObject("object1");
assertEquals(Tag.EVAL_BODY_INCLUDE, aclTag.doStartTag());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
//~ Inner Classes ==========================================================

47
core/src/test/java/org/acegisecurity/taglibs/authz/AuthenticationTagTests.java
View File

@@ -19,9 +19,7 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import net.sf.acegisecurity.providers.dao.User;
@@ -42,32 +40,10 @@ public class AuthenticationTagTests extends TestCase {
//~ Methods ================================================================
public void testOperationWhenAuthenticationIsNull()
throws JspException {
ContextHolder.setContext(new SecureContextImpl());
authenticationTag.setOperation("principal");
assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
assertEquals(null, authenticationTag.getLastMessage());
ContextHolder.setContext(null);
}
public void testOperationWhenContextHolderIsNull()
throws JspException {
ContextHolder.setContext(null);
authenticationTag.setOperation("principal");
assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
assertEquals(null, authenticationTag.getLastMessage());
}
public void testOperationWhenPrincipalIsAString() throws JspException {
Authentication auth = new TestingAuthenticationToken("marissaAsString",
"koala", new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
authenticationTag.setOperation("principal");
assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
@@ -80,9 +56,7 @@ public class AuthenticationTagTests extends TestCase {
"marissaUserDetails", "koala", true, true, true, true,
new GrantedAuthority[] {}), "koala",
new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
authenticationTag.setOperation("principal");
assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
@@ -92,14 +66,23 @@ public class AuthenticationTagTests extends TestCase {
public void testOperationWhenPrincipalIsNull() throws JspException {
Authentication auth = new TestingAuthenticationToken(null, "koala",
new GrantedAuthority[] {});
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
authenticationTag.setOperation("principal");
assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
}
public void testOperationWhenSecurityContextIsNull()
throws JspException {
SecurityContext.setAuthentication(null);
authenticationTag.setOperation("principal");
assertEquals(Tag.SKIP_BODY, authenticationTag.doStartTag());
assertEquals(null, authenticationTag.getLastMessage());
SecurityContext.setAuthentication(null);
}
public void testSkipsBodyIfNullOrEmptyOperation() throws Exception {
authenticationTag.setOperation("");
assertEquals("", authenticationTag.getOperation());

11
core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagAttributeTests.java
View File

@@ -19,8 +19,7 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import javax.servlet.jsp.JspException;
@@ -37,7 +36,6 @@ public class AuthorizeTagAttributeTests extends TestCase {
//~ Instance fields ========================================================
private final AuthorizeTag authorizeTag = new AuthorizeTag();
private SecureContextImpl context;
private TestingAuthenticationToken currentUser;
//~ Methods ================================================================
@@ -95,13 +93,10 @@ public class AuthorizeTagAttributeTests extends TestCase {
"ROLE_SUPERVISOR"), new GrantedAuthorityImpl(
"ROLE_RESTRICTED"),});
context = new SecureContextImpl();
context.setAuthentication(currentUser);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(currentUser);
}
protected void tearDown() throws Exception {
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
}

14
core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagCustomGrantedAuthorityTests.java
View File

@@ -18,8 +18,7 @@ package net.sf.acegisecurity.taglibs.authz;
import junit.framework.TestCase;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import javax.servlet.jsp.JspException;
@@ -36,7 +35,6 @@ public class AuthorizeTagCustomGrantedAuthorityTests extends TestCase {
//~ Instance fields ========================================================
private final AuthorizeTag authorizeTag = new AuthorizeTag();
private SecureContextImpl context;
private TestingAuthenticationToken currentUser;
//~ Methods ================================================================
@@ -51,7 +49,8 @@ public class AuthorizeTagCustomGrantedAuthorityTests extends TestCase {
public void testRejectsRequestWhenCustomAuthorityReturnsNull()
throws JspException {
authorizeTag.setIfAnyGranted("ROLE_TELLER");
context.setAuthentication(new TestingAuthenticationToken("abc", "123",
SecurityContext.setAuthentication(new TestingAuthenticationToken(
"abc", "123",
new GrantedAuthority[] {new CustomGrantedAuthority(null)}));
try {
@@ -69,14 +68,11 @@ public class AuthorizeTagCustomGrantedAuthorityTests extends TestCase {
new GrantedAuthority[] {new CustomGrantedAuthority(
"ROLE_TELLER")});
context = new SecureContextImpl();
context.setAuthentication(currentUser);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(currentUser);
}
protected void tearDown() throws Exception {
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
//~ Inner Classes ==========================================================

11
core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagExpressionLanguageTests.java
View File

@@ -19,8 +19,7 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import org.springframework.mock.web.MockPageContext;
@@ -37,7 +36,6 @@ public class AuthorizeTagExpressionLanguageTests extends TestCase {
private final AuthorizeTag authorizeTag = new AuthorizeTag();
private MockPageContext pageContext;
private SecureContextImpl context;
private TestingAuthenticationToken currentUser;
//~ Methods ================================================================
@@ -78,13 +76,10 @@ public class AuthorizeTagExpressionLanguageTests extends TestCase {
currentUser = new TestingAuthenticationToken("abc", "123",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_TELLER"),});
context = new SecureContextImpl();
context.setAuthentication(currentUser);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(currentUser);
}
protected void tearDown() throws Exception {
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
}

15
core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagTests.java
View File

@@ -19,8 +19,7 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import javax.servlet.jsp.JspException;
@@ -37,14 +36,13 @@ public class AuthorizeTagTests extends TestCase {
//~ Instance fields ========================================================
private final AuthorizeTag authorizeTag = new AuthorizeTag();
private SecureContextImpl context;
private TestingAuthenticationToken currentUser;
//~ Methods ================================================================
public void testAlwaysReturnsUnauthorizedIfNoUserFound()
throws JspException {
context.setAuthentication(null);
SecurityContext.setAuthentication(null);
authorizeTag.setIfAllGranted("ROLE_TELLER");
assertEquals("prevents request - no principal in Context",
@@ -82,7 +80,7 @@ public class AuthorizeTagTests extends TestCase {
public void testPreventsBodyOutputIfNoSecureContext()
throws JspException {
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
authorizeTag.setIfAnyGranted("ROLE_BANKER");
assertEquals("prevents output - no context defined", Tag.SKIP_BODY,
@@ -117,13 +115,10 @@ public class AuthorizeTagTests extends TestCase {
"ROLE_SUPERVISOR"), new GrantedAuthorityImpl(
"ROLE_TELLER"),});
context = new SecureContextImpl();
context.setAuthentication(currentUser);
ContextHolder.setContext(context);
SecurityContext.setAuthentication(currentUser);
}
protected void tearDown() throws Exception {
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
}

91
core/src/test/java/org/acegisecurity/ui/AbstractProcessingFilterTests.java
View File

@@ -18,21 +18,23 @@ package net.sf.acegisecurity.ui;
import junit.framework.TestCase;
import net.sf.acegisecurity.AccountExpiredException;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.AuthenticationException;
import net.sf.acegisecurity.BadCredentialsException;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.MockAuthenticationManager;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import net.sf.acegisecurity.ui.rememberme.TokenBasedRememberMeServices;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockFilterConfig;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import java.io.IOException;
import java.util.Properties;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
@@ -42,8 +44,6 @@ import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Properties;
/**
@@ -69,6 +69,17 @@ public class AbstractProcessingFilterTests extends TestCase {
junit.textui.TestRunner.run(AbstractProcessingFilterTests.class);
}
public void testDefaultProcessesFilterUrlWithPathParameter() {
MockHttpServletRequest request = createMockRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter();
filter.setFilterProcessesUrl("/j_acegi_security_check");
request.setRequestURI(
"/mycontext/j_acegi_security_check;jsessionid=I8MIONOSTHOR");
assertTrue(filter.requiresAuthentication(request, response));
}
public void testDoFilterWithNonHttpServletRequestDetected()
throws Exception {
AbstractProcessingFilter filter = new MockAbstractProcessingFilter();
@@ -118,7 +129,7 @@ public class AbstractProcessingFilterTests extends TestCase {
chain);
assertEquals("/myApp/failed.jsp", response.getRedirectedUrl());
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
//Prepare again, this time using the exception mapping
filter = new MockAbstractProcessingFilter(new AccountExpiredException(
@@ -136,7 +147,7 @@ public class AbstractProcessingFilterTests extends TestCase {
chain);
assertEquals("/myApp/accountExpired.jsp", response.getRedirectedUrl());
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testFilterProcessesUrlVariationsRespected()
@@ -162,10 +173,9 @@ public class AbstractProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertEquals("/logged_in.jsp", response.getRedirectedUrl());
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
assertEquals("test",
SecureContextUtils.getSecureContext().getAuthentication()
.getPrincipal().toString());
SecurityContext.getAuthentication().getPrincipal().toString());
}
public void testGettersSetters() {
@@ -237,20 +247,9 @@ public class AbstractProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertEquals("/logged_in.jsp", response.getRedirectedUrl());
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
assertEquals("test",
SecureContextUtils.getSecureContext().getAuthentication()
.getPrincipal().toString());
}
public void testDefaultProcessesFilterUrlWithPathParameter() {
MockHttpServletRequest request = createMockRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter();
filter.setFilterProcessesUrl("/j_acegi_security_check");
request.setRequestURI("/mycontext/j_acegi_security_check;jsessionid=I8MIONOSTHOR");
assertTrue(filter.requiresAuthentication(request, response));
SecurityContext.getAuthentication().getPrincipal().toString());
}
public void testStartupDetectsInvalidAuthenticationFailureUrl()
@@ -339,10 +338,9 @@ public class AbstractProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertEquals("/logged_in.jsp", response.getRedirectedUrl());
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
assertEquals("test",
SecureContextUtils.getSecureContext().getAuthentication()
.getPrincipal().toString());
SecurityContext.getAuthentication().getPrincipal().toString());
// Now try again but this time have filter deny access
// Setup our HTTP request
@@ -358,7 +356,7 @@ public class AbstractProcessingFilterTests extends TestCase {
// Test
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testSuccessfulAuthenticationButWithAlwaysUseDefaultTargetUrlCausesRedirectToDefaultTargetUrl()
@@ -387,7 +385,7 @@ public class AbstractProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertEquals("/foobar", response.getRedirectedUrl());
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
}
public void testSuccessfulAuthenticationCausesRedirectToSessionSpecifiedUrl()
@@ -412,25 +410,17 @@ public class AbstractProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertEquals("/my-destination", response.getRedirectedUrl());
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
}
protected void setUp() throws Exception {
super.setUp();
ContextHolder.setContext(new SecureContextImpl());
SecurityContext.setAuthentication(null);
}
protected void tearDown() throws Exception {
super.tearDown();
ContextHolder.setContext(null);
}
private void executeFilterInContainerSimulator(FilterConfig filterConfig,
Filter filter, ServletRequest request, ServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
filter.init(filterConfig);
filter.doFilter(request, response, filterChain);
filter.destroy();
SecurityContext.setAuthentication(null);
}
private MockHttpServletRequest createMockRequest() {
@@ -444,6 +434,14 @@ public class AbstractProcessingFilterTests extends TestCase {
return request;
}
private void executeFilterInContainerSimulator(FilterConfig filterConfig,
Filter filter, ServletRequest request, ServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
filter.init(filterConfig);
filter.doFilter(request, response, filterChain);
filter.destroy();
}
//~ Inner Classes ==========================================================
private class MockAbstractProcessingFilter extends AbstractProcessingFilter {
@@ -462,10 +460,6 @@ public class AbstractProcessingFilterTests extends TestCase {
this.exceptionToThrow = exceptionToThrow;
}
public boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
return super.requiresAuthentication(request, response);
}
private MockAbstractProcessingFilter() {
super();
}
@@ -485,6 +479,11 @@ public class AbstractProcessingFilterTests extends TestCase {
}
public void init(FilterConfig arg0) throws ServletException {}
public boolean requiresAuthentication(HttpServletRequest request,
HttpServletResponse response) {
return super.requiresAuthentication(request, response);
}
}
private class MockFilterChain implements FilterChain {

34
core/src/test/java/org/acegisecurity/ui/basicauth/BasicProcessingFilterTests.java
View File

@@ -21,16 +21,15 @@ import net.sf.acegisecurity.MockAuthenticationEntryPoint;
import net.sf.acegisecurity.MockAuthenticationManager;
import net.sf.acegisecurity.MockFilterConfig;
import net.sf.acegisecurity.UserDetails;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import net.sf.acegisecurity.context.SecurityContext;
import org.apache.commons.codec.binary.Base64;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import java.io.IOException;
@@ -116,7 +115,7 @@ public class BasicProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testGettersSetters() {
@@ -134,7 +133,8 @@ public class BasicProcessingFilterTests extends TestCase {
// Setup our HTTP request
String token = "NOT_A_VALID_TOKEN_AS_MISSING_COLON";
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes())));
request.addHeader("Authorization",
"Basic " + new String(Base64.encodeBase64(token.getBytes())));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -154,7 +154,7 @@ public class BasicProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testNormalOperation() throws Exception {
@@ -182,10 +182,9 @@ public class BasicProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
assertEquals("marissa",
((UserDetails) SecureContextUtils.getSecureContext()
.getAuthentication().getPrincipal())
((UserDetails) SecurityContext.getAuthentication().getPrincipal())
.getUsername());
}
@@ -213,7 +212,7 @@ public class BasicProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testStartupDetectsMissingAuthenticationEntryPoint()
@@ -269,10 +268,9 @@ public class BasicProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
assertEquals("marissa",
((UserDetails) SecureContextUtils.getSecureContext()
.getAuthentication().getPrincipal())
((UserDetails) SecurityContext.getAuthentication().getPrincipal())
.getUsername());
// NOW PERFORM FAILED AUTHENTICATION
@@ -291,7 +289,7 @@ public class BasicProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -320,18 +318,18 @@ public class BasicProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
protected void setUp() throws Exception {
super.setUp();
ContextHolder.setContext(new SecureContextImpl());
SecurityContext.setAuthentication(null);
}
protected void tearDown() throws Exception {
super.tearDown();
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
private void executeFilterInContainerSimulator(FilterConfig filterConfig,

115
core/src/test/java/org/acegisecurity/ui/digestauth/DigestProcessingFilterTests.java
View File

@@ -20,9 +20,7 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.DisabledException;
import net.sf.acegisecurity.MockFilterConfig;
import net.sf.acegisecurity.UserDetails;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.dao.AuthenticationDao;
import net.sf.acegisecurity.providers.dao.UserCache;
import net.sf.acegisecurity.providers.dao.UsernameNotFoundException;
@@ -32,12 +30,16 @@ import org.apache.commons.codec.binary.Base64;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.dao.DataAccessException;
import org.springframework.util.StringUtils;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.util.StringUtils;
import java.io.IOException;
import java.util.Map;
import javax.servlet.Filter;
@@ -117,7 +119,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -138,10 +141,11 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
String header = response.getHeader("WWW-Authenticate").toString().substring(7);
String header = response.getHeader("WWW-Authenticate").toString()
.substring(7);
String[] headerEntries = StringUtils.commaDelimitedListToStringArray(header);
Map headerMap = StringSplitUtils.splitEachArrayElementAndCreateMap(headerEntries,
"=", "\"");
@@ -171,7 +175,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testGettersSetters() {
@@ -216,7 +220,7 @@ public class DigestProcessingFilterTests extends TestCase {
chain);
assertEquals(401, response.getStatus());
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testMalformedHeaderReturnsForbidden() throws Exception {
@@ -242,7 +246,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -264,7 +268,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -284,7 +289,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -307,7 +312,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -327,7 +333,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -350,7 +356,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -370,7 +377,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -393,7 +400,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest();
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -413,7 +421,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -434,7 +442,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -454,10 +463,9 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
assertEquals("marissa",
((UserDetails) SecureContextUtils.getSecureContext()
.getAuthentication().getPrincipal())
((UserDetails) SecurityContext.getAuthentication().getPrincipal())
.getUsername());
}
@@ -485,7 +493,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
}
public void testStartupDetectsMissingAuthenticationDao()
@@ -532,7 +540,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -552,7 +561,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNotNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNotNull(SecurityContext.getAuthentication());
// Now retry, giving an invalid nonce
password = "WRONG_PASSWORD";
@@ -561,12 +570,13 @@ public class DigestProcessingFilterTests extends TestCase {
request = new MockHttpServletRequest();
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
executeFilterInContainerSimulator(config, filter, request, response,
chain);
// Check we lost our previous authentication
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -588,7 +598,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -608,7 +619,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -629,7 +640,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -649,7 +661,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -670,7 +682,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -690,7 +703,7 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
@@ -711,7 +724,8 @@ public class DigestProcessingFilterTests extends TestCase {
// Setup our HTTP request
MockHttpServletRequest request = new MockHttpServletRequest("GET", uri);
request.addHeader("Authorization",
createAuthorizationHeader(username, realm, nonce, uri, responseDigest, qop, nc, cnonce));
createAuthorizationHeader(username, realm, nonce, uri,
responseDigest, qop, nc, cnonce));
request.setServletPath("/some_file.html");
// Launch an application context and access our bean
@@ -731,18 +745,27 @@ public class DigestProcessingFilterTests extends TestCase {
executeFilterInContainerSimulator(config, filter, request, response,
chain);
assertNull(SecureContextUtils.getSecureContext().getAuthentication());
assertNull(SecurityContext.getAuthentication());
assertEquals(401, response.getStatus());
}
protected void setUp() throws Exception {
super.setUp();
ContextHolder.setContext(new SecureContextImpl());
SecurityContext.setAuthentication(null);
}
protected void tearDown() throws Exception {
super.tearDown();
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
private String createAuthorizationHeader(String username, String realm,
String nonce, String uri, String responseDigest, String qop, String nc,
String cnonce) {
return "Digest username=\"" + username + "\", realm=\"" + realm
+ "\", nonce=\"" + nonce + "\", uri=\"" + uri + "\", response=\""
+ responseDigest + "\", qop=" + qop + ", nc=" + nc + ", cnonce=\""
+ cnonce + "\"";
}
private void executeFilterInContainerSimulator(FilterConfig filterConfig,
@@ -763,32 +786,20 @@ public class DigestProcessingFilterTests extends TestCase {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/some_path");
MockHttpServletResponse response = new MockHttpServletResponse();
ep.commence(request, response, new DisabledException("foobar"));
// Break up response header
String header = response.getHeader("WWW-Authenticate").toString().substring(7);
String header = response.getHeader("WWW-Authenticate").toString()
.substring(7);
String[] headerEntries = StringUtils.commaDelimitedListToStringArray(header);
Map headerMap = StringSplitUtils.splitEachArrayElementAndCreateMap(headerEntries,
"=", "\"");
return headerMap;
}
private String createAuthorizationHeader(String username,
String realm,
String nonce,
String uri,
String responseDigest,
String qop,
String nc,
String cnonce) {
return "Digest username=\"" + username + "\", realm=\"" + realm
+ "\", nonce=\"" + nonce + "\", uri=\"" + uri + "\", response=\""
+ responseDigest + "\", qop=" + qop + ", nc=" + nc + ", cnonce=\""
+ cnonce + "\"";
}
//~ Inner Classes ==========================================================

170
core/src/test/java/org/acegisecurity/ui/rememberme/RememberMeProcessingFilterTests.java
View File

@@ -15,6 +15,18 @@
package net.sf.acegisecurity.ui.rememberme;
import junit.framework.TestCase;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.MockFilterConfig;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import java.io.IOException;
import javax.servlet.Filter;
@@ -26,22 +38,6 @@ import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import junit.framework.TestCase;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.MockFilterConfig;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
/**
* Tests {@link RememberMeProcessingFilter}.
@@ -65,48 +61,23 @@ public class RememberMeProcessingFilterTests extends TestCase {
public static void main(String[] args) {
junit.textui.TestRunner.run(RememberMeProcessingFilterTests.class);
}
public void testDoFilterWithNonHttpServletRequestDetected()
throws Exception {
public void testDetectsRememberMeServicesProperty()
throws Exception {
RememberMeProcessingFilter filter = new RememberMeProcessingFilter();
try {
filter.doFilter(null, new MockHttpServletResponse(),
new MockFilterChain());
fail("Should have thrown ServletException");
} catch (ServletException expected) {
assertEquals("Can only process HttpServletRequest",
expected.getMessage());
}
}
public void testDoFilterWithNonHttpServletResponseDetected()
throws Exception {
RememberMeProcessingFilter filter = new RememberMeProcessingFilter();
try {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("dc");
filter.doFilter(request, null,
new MockFilterChain());
fail("Should have thrown ServletException");
} catch (ServletException expected) {
assertEquals("Can only process HttpServletResponse",
expected.getMessage());
}
}
public void testDetectsRememberMeServicesProperty() throws Exception {
RememberMeProcessingFilter filter = new RememberMeProcessingFilter();
// check default is NullRememberMeServices
assertEquals(NullRememberMeServices.class, filter.getRememberMeServices().getClass());
assertEquals(NullRememberMeServices.class,
filter.getRememberMeServices().getClass());
// check getter/setter
filter.setRememberMeServices(new TokenBasedRememberMeServices());
assertEquals(TokenBasedRememberMeServices.class, filter.getRememberMeServices().getClass());
assertEquals(TokenBasedRememberMeServices.class,
filter.getRememberMeServices().getClass());
// check detects if made null
filter.setRememberMeServices(null);
try {
filter.afterPropertiesSet();
fail("Should have thrown IllegalArgumentException");
@@ -115,18 +86,45 @@ public class RememberMeProcessingFilterTests extends TestCase {
}
}
public void testDoFilterWithNonHttpServletRequestDetected()
throws Exception {
RememberMeProcessingFilter filter = new RememberMeProcessingFilter();
try {
filter.doFilter(null, new MockHttpServletResponse(),
new MockFilterChain());
fail("Should have thrown ServletException");
} catch (ServletException expected) {
assertEquals("Can only process HttpServletRequest",
expected.getMessage());
}
}
public void testDoFilterWithNonHttpServletResponseDetected()
throws Exception {
RememberMeProcessingFilter filter = new RememberMeProcessingFilter();
try {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("dc");
filter.doFilter(request, null, new MockFilterChain());
fail("Should have thrown ServletException");
} catch (ServletException expected) {
assertEquals("Can only process HttpServletResponse",
expected.getMessage());
}
}
public void testOperationWhenAuthenticationExistsInContextHolder()
throws Exception {
// Put an Authentication object into the ContextHolder
SecureContext sc = SecureContextUtils.getSecureContext();
Authentication originalAuth = new TestingAuthenticationToken("user",
"password",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_A")});
sc.setAuthentication(originalAuth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(originalAuth);
// Setup our filter correctly
Authentication remembered = new TestingAuthenticationToken("remembered",
Authentication remembered = new TestingAuthenticationToken("remembered",
"password",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_REMEMBERED")});
RememberMeProcessingFilter filter = new RememberMeProcessingFilter();
@@ -137,17 +135,15 @@ public class RememberMeProcessingFilterTests extends TestCase {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("x");
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
request, new MockHttpServletResponse(),
new MockFilterChain(true));
request, new MockHttpServletResponse(), new MockFilterChain(true));
// Ensure filter didn't change our original object
assertEquals(originalAuth,
SecureContextUtils.getSecureContext().getAuthentication());
assertEquals(originalAuth, SecurityContext.getAuthentication());
}
public void testOperationWhenNoAuthenticationInContextHolder()
throws Exception {
Authentication remembered = new TestingAuthenticationToken("remembered",
Authentication remembered = new TestingAuthenticationToken("remembered",
"password",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_REMEMBERED")});
RememberMeProcessingFilter filter = new RememberMeProcessingFilter();
@@ -157,25 +153,22 @@ public class RememberMeProcessingFilterTests extends TestCase {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("x");
executeFilterInContainerSimulator(new MockFilterConfig(), filter,
request, new MockHttpServletResponse(),
new MockFilterChain(true));
request, new MockHttpServletResponse(), new MockFilterChain(true));
Authentication auth = SecurityContext.getAuthentication();
Authentication auth = SecureContextUtils.getSecureContext()
.getAuthentication();
// Ensure filter setup with our remembered authentication object
assertEquals(remembered,
SecureContextUtils.getSecureContext().getAuthentication());
assertEquals(remembered, SecurityContext.getAuthentication());
}
protected void setUp() throws Exception {
super.setUp();
ContextHolder.setContext(new SecureContextImpl());
SecurityContext.setAuthentication(null);
}
protected void tearDown() throws Exception {
super.tearDown();
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
private void executeFilterInContainerSimulator(FilterConfig filterConfig,
@@ -208,25 +201,24 @@ public class RememberMeProcessingFilterTests extends TestCase {
}
}
}
private class MockRememberMeServices implements RememberMeServices
{
private Authentication authToReturn;
public MockRememberMeServices(Authentication authToReturn) {
this.authToReturn = authToReturn;
}
public Authentication autoLogin(HttpServletRequest request,
HttpServletResponse response) {
return authToReturn;
}
public void loginFail(HttpServletRequest request,
HttpServletResponse response) {
}
public void loginSuccess(HttpServletRequest request,
HttpServletResponse response,
Authentication successfulAuthentication) {
}
}
private class MockRememberMeServices implements RememberMeServices {
private Authentication authToReturn;
public MockRememberMeServices(Authentication authToReturn) {
this.authToReturn = authToReturn;
}
public Authentication autoLogin(HttpServletRequest request,
HttpServletResponse response) {
return authToReturn;
}
public void loginFail(HttpServletRequest request,
HttpServletResponse response) {}
public void loginSuccess(HttpServletRequest request,
HttpServletResponse response,
Authentication successfulAuthentication) {}
}
}

178
core/src/test/java/org/acegisecurity/ui/x509/X509ProcessingFilterTests.java
View File

@@ -17,28 +17,24 @@ package net.sf.acegisecurity.ui.x509;
import junit.framework.TestCase;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextUtils;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.providers.x509.X509TestUtils;
import net.sf.acegisecurity.providers.x509.X509AuthenticationToken;
import net.sf.acegisecurity.providers.anonymous.AnonymousAuthenticationToken;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.AuthenticationManager;
import net.sf.acegisecurity.BadCredentialsException;
import net.sf.acegisecurity.MockAuthenticationManager;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.x509.X509AuthenticationToken;
import net.sf.acegisecurity.providers.x509.X509TestUtils;
import net.sf.acegisecurity.ui.AbstractProcessingFilter;
import net.sf.acegisecurity.util.MockFilterChain;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import java.security.cert.X509Certificate;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import java.security.cert.X509Certificate;
/**
* Tests {@link net.sf.acegisecurity.ui.x509.X509ProcessingFilter}.
@@ -64,18 +60,29 @@ public class X509ProcessingFilterTests extends TestCase {
}
public void tearDown() {
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testNeedsAuthenticationManager() throws Exception {
public void testAuthenticationIsNullWithNoCertificate()
throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = new MockFilterChain(true);
AuthenticationManager authMgr = new MockX509AuthenticationManager();
X509ProcessingFilter filter = new X509ProcessingFilter();
try {
filter.afterPropertiesSet();
fail("Expected IllegalArgumentException");
} catch (IllegalArgumentException failed) {
// ignored
}
filter.setAuthenticationManager(authMgr);
SecurityContext.setAuthentication(null);
filter.doFilter(request, response, chain);
Object lastException = request.getSession().getAttribute(AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY);
assertNull("Authentication should be null",
SecurityContext.getAuthentication());
assertTrue("BadCredentialsException should have been thrown",
lastException instanceof BadCredentialsException);
}
public void testDoFilterWithNonHttpServletRequestDetected()
@@ -106,6 +113,41 @@ public class X509ProcessingFilterTests extends TestCase {
}
}
public void testFailedAuthentication() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = new MockFilterChain(true);
request.setAttribute("javax.servlet.request.X509Certificate",
new X509Certificate[] {X509TestUtils.buildTestCertificate()});
AuthenticationManager authMgr = new MockAuthenticationManager(false);
SecurityContext.setAuthentication(null);
X509ProcessingFilter filter = new X509ProcessingFilter();
filter.setAuthenticationManager(authMgr);
filter.afterPropertiesSet();
filter.init(null);
filter.doFilter(request, response, chain);
filter.destroy();
Authentication result = SecurityContext.getAuthentication();
assertNull(result);
}
public void testNeedsAuthenticationManager() throws Exception {
X509ProcessingFilter filter = new X509ProcessingFilter();
try {
filter.afterPropertiesSet();
fail("Expected IllegalArgumentException");
} catch (IllegalArgumentException failed) {
// ignored
}
}
public void testNormalOperation() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
@@ -113,15 +155,11 @@ public class X509ProcessingFilterTests extends TestCase {
FilterChain chain = new MockFilterChain(true);
request.setAttribute("javax.servlet.request.X509Certificate",
new X509Certificate[] {X509TestUtils.buildTestCertificate()});
new X509Certificate[] {X509TestUtils.buildTestCertificate()});
AuthenticationManager authMgr = new MockX509AuthenticationManager();
ContextHolder.setContext(new SecureContextImpl());
SecureContext ctx = SecureContextUtils.getSecureContext();
ctx.setAuthentication(null);
SecurityContext.setAuthentication(null);
X509ProcessingFilter filter = new X509ProcessingFilter();
@@ -131,99 +169,27 @@ public class X509ProcessingFilterTests extends TestCase {
filter.doFilter(request, response, chain);
filter.destroy();
Authentication result = ctx.getAuthentication();
Authentication result = SecurityContext.getAuthentication();
assertNotNull(result);
}
public void testFailedAuthentication() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = new MockFilterChain(true);
request.setAttribute("javax.servlet.request.X509Certificate",
new X509Certificate[] {X509TestUtils.buildTestCertificate()});
AuthenticationManager authMgr = new MockAuthenticationManager(false);
ContextHolder.setContext(new SecureContextImpl());
SecureContext ctx = SecureContextUtils.getSecureContext();
ctx.setAuthentication(null);
X509ProcessingFilter filter = new X509ProcessingFilter();
filter.setAuthenticationManager(authMgr);
filter.afterPropertiesSet();
filter.init(null);
filter.doFilter(request, response, chain);
filter.destroy();
Authentication result = ctx.getAuthentication();
assertNull(result);
}
public void testAuthenticationIsNullWithNoCertificate() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = new MockFilterChain(true);
AuthenticationManager authMgr = new MockX509AuthenticationManager();
X509ProcessingFilter filter = new X509ProcessingFilter();
filter.setAuthenticationManager(authMgr);
ContextHolder.setContext(new SecureContextImpl());
filter.doFilter(request, response, chain);
SecureContext ctx = SecureContextUtils.getSecureContext();
Object lastException = request.getSession().getAttribute(
AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY);
assertNull("Authentication should be null", ctx.getAuthentication());
assertTrue("BadCredentialsException should have been thrown",
lastException instanceof BadCredentialsException);
}
public void testDoesNothingWithExistingSecurityContext() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain chain = new MockFilterChain(true);
Authentication token = new AnonymousAuthenticationToken("dummy", "dummy",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_A")});
ContextHolder.setContext(new SecureContextImpl());
SecureContext ctx = SecureContextUtils.getSecureContext();
ctx.setAuthentication(token);
X509ProcessingFilter filter = new X509ProcessingFilter();
filter.doFilter(request, response, chain);
assertEquals("Existing token should be unchanged", token, ctx.getAuthentication());
}
//~ Inner Classes ==========================================================
private static class MockX509AuthenticationManager implements AuthenticationManager {
private static class MockX509AuthenticationManager
implements AuthenticationManager {
public Authentication authenticate(Authentication a) {
if(!(a instanceof X509AuthenticationToken)) {
TestCase.fail("Needed an X509Authentication token but found " + a);
if (!(a instanceof X509AuthenticationToken)) {
TestCase.fail("Needed an X509Authentication token but found "
+ a);
}
if(a.getCredentials() == null) {
throw new BadCredentialsException("Mock authentication manager rejecting null certificate");
if (a.getCredentials() == null) {
throw new BadCredentialsException(
"Mock authentication manager rejecting null certificate");
}
return a;
}
}
}

46
core/src/test/java/org/acegisecurity/wrapper/ContextHolderAwareRequestWrapperTests.java
View File

@@ -20,14 +20,11 @@ import junit.framework.TestCase;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.context.SecurityContext;
import net.sf.acegisecurity.providers.TestingAuthenticationToken;
import net.sf.acegisecurity.providers.dao.User;
import net.sf.acegisecurity.wrapper.ContextHolderAwareRequestWrapper;
import org.springframework.mock.web.MockHttpServletRequest;
@@ -60,15 +57,14 @@ public class ContextHolderAwareRequestWrapperTests extends TestCase {
public void testCorrectOperationWithStringBasedPrincipal()
throws Exception {
SecureContext sc = new SecureContextImpl();
Authentication auth = new TestingAuthenticationToken("marissa",
"koala",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_FOO")});
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/");
ContextHolderAwareRequestWrapper wrapper = new ContextHolderAwareRequestWrapper(request);
assertEquals("marissa", wrapper.getRemoteUser());
@@ -76,22 +72,21 @@ public class ContextHolderAwareRequestWrapperTests extends TestCase {
assertFalse(wrapper.isUserInRole("ROLE_NOT_GRANTED"));
assertEquals(auth, wrapper.getUserPrincipal());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testCorrectOperationWithUserDetailsBasedPrincipal()
throws Exception {
SecureContext sc = new SecureContextImpl();
Authentication auth = new TestingAuthenticationToken(new User(
"marissaAsUserDetails", "koala", true, true, true, true,
new GrantedAuthority[] {}), "koala",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_HELLO"), new GrantedAuthorityImpl(
"ROLE_FOOBAR")});
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/");
ContextHolderAwareRequestWrapper wrapper = new ContextHolderAwareRequestWrapper(request);
assertEquals("marissaAsUserDetails", wrapper.getRemoteUser());
@@ -101,45 +96,32 @@ public class ContextHolderAwareRequestWrapperTests extends TestCase {
assertTrue(wrapper.isUserInRole("ROLE_HELLO"));
assertEquals(auth, wrapper.getUserPrincipal());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
public void testNullAuthenticationHandling() throws Exception {
SecureContext sc = new SecureContextImpl();
sc.setAuthentication(null);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(null);
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/");
ContextHolderAwareRequestWrapper wrapper = new ContextHolderAwareRequestWrapper(request);
assertNull(wrapper.getRemoteUser());
assertFalse(wrapper.isUserInRole("ROLE_ANY"));
assertNull(wrapper.getUserPrincipal());
ContextHolder.setContext(null);
}
public void testNullContextHolderHandling() throws Exception {
ContextHolder.setContext(null);
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/");
ContextHolderAwareRequestWrapper wrapper = new ContextHolderAwareRequestWrapper(request);
assertNull(wrapper.getRemoteUser());
assertFalse(wrapper.isUserInRole("ROLE_ANY"));
assertNull(wrapper.getUserPrincipal());
SecurityContext.setAuthentication(null);
}
public void testNullPrincipalHandling() throws Exception {
SecureContext sc = new SecureContextImpl();
Authentication auth = new TestingAuthenticationToken(null, "koala",
new GrantedAuthority[] {new GrantedAuthorityImpl("ROLE_HELLO"), new GrantedAuthorityImpl(
"ROLE_FOOBAR")});
sc.setAuthentication(auth);
ContextHolder.setContext(sc);
SecurityContext.setAuthentication(auth);
MockHttpServletRequest request = new MockHttpServletRequest();
request.setRequestURI("/");
ContextHolderAwareRequestWrapper wrapper = new ContextHolderAwareRequestWrapper(request);
assertNull(wrapper.getRemoteUser());
@@ -147,6 +129,6 @@ public class ContextHolderAwareRequestWrapperTests extends TestCase {
assertFalse(wrapper.isUserInRole("ROLE_FOOBAR")); // principal is null, so reject
assertNull(wrapper.getUserPrincipal());
ContextHolder.setContext(null);
SecurityContext.setAuthentication(null);
}
}