SWS-252

security/src/test/java/org/springframework/ws/soap/security/wss4j/AxiomWss4jMessageInterceptorSpringSecurityCallbackHandlerTest.java

@@ -0,0 +1,6 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class AxiomWss4jMessageInterceptorSpringSecurityCallbackHandlerTest
+        extends Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/SaajWss4jMessageInterceptorSpringSecurityCallbackHandlerTest.java

@@ -0,0 +1,6 @@
+package org.springframework.ws.soap.security.wss4j;
+
+public class SaajWss4jMessageInterceptorSpringSecurityCallbackHandlerTest
+        extends Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase {
+
+}

security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase.java

@@ -0,0 +1,110 @@
+package org.springframework.ws.soap.security.wss4j;
+
+import java.util.Properties;
+
+import org.apache.ws.security.WSConstants;
+import org.easymock.MockControl;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationManager;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.TestingAuthenticationToken;
+import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
+import org.springframework.security.userdetails.memory.InMemoryDaoImpl;
+import org.springframework.ws.context.DefaultMessageContext;
+import org.springframework.ws.context.MessageContext;
+import org.springframework.ws.server.EndpointInterceptor;
+import org.springframework.ws.soap.SoapMessage;
+import org.springframework.ws.soap.security.wss4j.callback.springsecurity.SpringSecurityDigestPasswordValidationCallbackHandler;
+import org.springframework.ws.soap.security.wss4j.callback.springsecurity.SpringSecurityPlainTextPasswordValidationCallbackHandler;
+
+public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase extends Wss4jTestCase {
+
+    private Properties users = new Properties();
+
+    private MockControl control;
+
+    private AuthenticationManager mock;
+
+    protected void onSetup() throws Exception {
+        control = MockControl.createControl(AuthenticationManager.class);
+        mock = (AuthenticationManager) control.getMock();
+        users.setProperty("Bert", "Ernie,ROLE_TEST");
+    }
+
+    protected void tearDown() throws Exception {
+        control.verify();
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testValidateUsernameTokenPlainText() throws Exception {
+        EndpointInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
+        SoapMessage message = loadMessage("usernameTokenPlainText-soap.xml");
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.handleRequest(messageContext, null);
+        assertValidateUsernameToken(message);
+
+        // test clean up
+        messageContext.getResponse();
+        interceptor.handleResponse(messageContext, null);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+    }
+
+    public void testValidateUsernameTokenDigest() throws Exception {
+        EndpointInterceptor interceptor = prepareInterceptor("UsernameToken", true, true);
+        SoapMessage message = loadMessage("usernameTokenDigest-soap.xml");
+        MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
+        interceptor.handleRequest(messageContext, null);
+        assertValidateUsernameToken(message);
+
+        // test clean up
+        messageContext.getResponse();
+        interceptor.handleResponse(messageContext, null);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+    }
+
+    protected void assertValidateUsernameToken(SoapMessage message) throws Exception {
+        Object result = getMessage(message);
+        assertNotNull("No result returned", result);
+        assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
+                getDocument(message));
+        assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication());
+    }
+
+    protected EndpointInterceptor prepareInterceptor(String actions, boolean validating, boolean digest)
+            throws Exception {
+        Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
+        if (validating) {
+            interceptor.setValidationActions(actions);
+        }
+        else {
+            interceptor.setSecurementActions(actions);
+        }
+        if (digest) {
+            SpringSecurityDigestPasswordValidationCallbackHandler callbackHandler =
+                    new SpringSecurityDigestPasswordValidationCallbackHandler();
+            InMemoryDaoImpl userDetailsService = new InMemoryDaoImpl();
+            userDetailsService.setUserProperties(users);
+            userDetailsService.afterPropertiesSet();
+            callbackHandler.setUserDetailsService(userDetailsService);
+            interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
+            interceptor.setValidationCallbackHandler(callbackHandler);
+            interceptor.afterPropertiesSet();
+        }
+        else {
+            SpringSecurityPlainTextPasswordValidationCallbackHandler callbackHandler =
+                    new SpringSecurityPlainTextPasswordValidationCallbackHandler();
+            Authentication authResult = new TestingAuthenticationToken("Bert", "Ernie", new GrantedAuthority[0]);
+            control.expectAndReturn(mock.authenticate(new UsernamePasswordAuthenticationToken("Bert", "Ernie")),
+                    authResult);
+            callbackHandler.setAuthenticationManager(mock);
+            callbackHandler.afterPropertiesSet();
+            interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
+            interceptor.setValidationCallbackHandler(callbackHandler);
+            interceptor.afterPropertiesSet();
+        }
+        control.replay();
+        return interceptor;
+    }
+}

security/src/test/java/org/springframework/ws/soap/security/xwss/callback/springsecurity/SpringSecurityCertificateValidationCallbackHandlerTest.java

@@ -0,0 +1,106 @@
+/*
+ * Copyright 2006 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.xwss.callback.springsecurity;
+
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.security.cert.X509Certificate;
+
+import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
+import junit.framework.TestCase;
+import org.easymock.MockControl;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.security.AuthenticationManager;
+import org.springframework.security.BadCredentialsException;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.TestingAuthenticationToken;
+import org.springframework.security.providers.x509.X509AuthenticationToken;
+import org.springframework.ws.soap.security.callback.CleanupCallback;
+
+public class SpringSecurityCertificateValidationCallbackHandlerTest extends TestCase {
+
+    private SpringSecurityCertificateValidationCallbackHandler callbackHandler;
+
+    private MockControl control;
+
+    private AuthenticationManager mock;
+
+    private X509Certificate certificate;
+
+    private CertificateValidationCallback callback;
+
+    protected void setUp() throws Exception {
+        callbackHandler = new SpringSecurityCertificateValidationCallbackHandler();
+        control = MockControl.createControl(AuthenticationManager.class);
+        mock = (AuthenticationManager) control.getMock();
+        callbackHandler.setAuthenticationManager(mock);
+        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+        InputStream is = null;
+        try {
+            is = new ClassPathResource("/org/springframework/ws/soap/security/xwss/test-keystore.jks").getInputStream();
+            keyStore.load(is, "password".toCharArray());
+        }
+        finally {
+            if (is != null) {
+                is.close();
+            }
+        }
+        certificate = (X509Certificate) keyStore.getCertificate("alias");
+        callback = new CertificateValidationCallback(certificate);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testValidateCertificateValid() throws Exception {
+        mock.authenticate(new X509AuthenticationToken(certificate));
+        control.setMatcher(MockControl.ALWAYS_MATCHER);
+        control.setReturnValue(new TestingAuthenticationToken(certificate, null, new GrantedAuthority[0]));
+        control.replay();
+        callbackHandler.handleInternal(callback);
+        boolean authenticated = callback.getResult();
+        assertTrue("Not authenticated", authenticated);
+        assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication());
+        control.verify();
+    }
+
+    public void testValidateCertificateInvalid() throws Exception {
+        mock.authenticate(new X509AuthenticationToken(certificate));
+        control.setMatcher(MockControl.ALWAYS_MATCHER);
+        control.setThrowable(new BadCredentialsException(""));
+        control.replay();
+        callbackHandler.handleInternal(callback);
+        boolean authenticated = callback.getResult();
+        assertFalse("Authenticated", authenticated);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+        control.verify();
+    }
+
+    public void testCleanUp() throws Exception {
+        TestingAuthenticationToken authentication =
+                new TestingAuthenticationToken(new Object(), new Object(), new GrantedAuthority[0]);
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+
+        CleanupCallback cleanupCallback = new CleanupCallback();
+        callbackHandler.handleInternal(cleanupCallback);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+    }
+
+}

security/src/test/java/org/springframework/ws/soap/security/xwss/callback/springsecurity/SpringSecurityDigestPasswordValidationCallbackHandlerTest.java

@@ -0,0 +1,106 @@
+/*
+ * Copyright 2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.xwss.callback.springsecurity;
+
+import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
+import junit.framework.TestCase;
+import org.easymock.MockControl;
+
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.TestingAuthenticationToken;
+import org.springframework.security.userdetails.User;
+import org.springframework.security.userdetails.UserDetailsService;
+import org.springframework.security.userdetails.UsernameNotFoundException;
+import org.springframework.ws.soap.security.callback.CleanupCallback;
+
+public class SpringSecurityDigestPasswordValidationCallbackHandlerTest extends TestCase {
+
+    private SpringSecurityDigestPasswordValidationCallbackHandler callbackHandler;
+
+    private MockControl control;
+
+    private UserDetailsService mock;
+
+    private String username;
+
+    private String password;
+
+    private PasswordValidationCallback callback;
+
+    protected void setUp() throws Exception {
+        callbackHandler = new SpringSecurityDigestPasswordValidationCallbackHandler();
+        control = MockControl.createControl(UserDetailsService.class);
+        mock = (UserDetailsService) control.getMock();
+        callbackHandler.setUserDetailsService(mock);
+        username = "Bert";
+        password = "Ernie";
+        String nonce = "9mdsYDCrjjYRur0rxzYt2oD7";
+        String passwordDigest = "kwNstEaiFOrI7B31j7GuETYvdgk=";
+        String creationTime = "2006-06-01T23:48:42Z";
+        PasswordValidationCallback.DigestPasswordRequest request =
+                new PasswordValidationCallback.DigestPasswordRequest(username, passwordDigest, nonce, creationTime);
+        callback = new PasswordValidationCallback(request);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAuthenticateUserDigestUserNotFound() throws Exception {
+        control.expectAndThrow(mock.loadUserByUsername(username), new UsernameNotFoundException(username));
+        control.replay();
+        callbackHandler.handleInternal(callback);
+        boolean authenticated = callback.getResult();
+        assertFalse("Authenticated", authenticated);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+        control.verify();
+    }
+
+    public void testAuthenticateUserDigestValid() throws Exception {
+        User user = new User(username, password, true, true, true, true, new GrantedAuthority[0]);
+        control.expectAndReturn(mock.loadUserByUsername(username), user);
+        control.replay();
+        callbackHandler.handleInternal(callback);
+        boolean authenticated = callback.getResult();
+        assertTrue("Not authenticated", authenticated);
+        assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication());
+        control.verify();
+    }
+
+    public void testAuthenticateUserDigestValidInvalid() throws Exception {
+        User user = new User(username, "Big bird", true, true, true, true, new GrantedAuthority[0]);
+        control.expectAndReturn(mock.loadUserByUsername(username), user);
+        control.replay();
+        callbackHandler.handleInternal(callback);
+        boolean authenticated = callback.getResult();
+        assertFalse("Authenticated", authenticated);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+        control.verify();
+    }
+
+    public void testCleanUp() throws Exception {
+        TestingAuthenticationToken authentication =
+                new TestingAuthenticationToken(new Object(), new Object(), new GrantedAuthority[0]);
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+
+        CleanupCallback cleanupCallback = new CleanupCallback();
+        callbackHandler.handleInternal(cleanupCallback);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+    }
+
+}

security/src/test/java/org/springframework/ws/soap/security/xwss/callback/springsecurity/SpringSecurityPlainTextPasswordValidationCallbackHandlerTest.java

@@ -0,0 +1,95 @@
+/*
+ * Copyright 2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.xwss.callback.springsecurity;
+
+import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
+import junit.framework.TestCase;
+import org.easymock.MockControl;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationManager;
+import org.springframework.security.BadCredentialsException;
+import org.springframework.security.GrantedAuthority;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.TestingAuthenticationToken;
+import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
+import org.springframework.ws.soap.security.callback.CleanupCallback;
+
+public class SpringSecurityPlainTextPasswordValidationCallbackHandlerTest extends TestCase {
+
+    private SpringSecurityPlainTextPasswordValidationCallbackHandler callbackHandler;
+
+    private MockControl control;
+
+    private AuthenticationManager mock;
+
+    private PasswordValidationCallback callback;
+
+    private String username;
+
+    private String password;
+
+    protected void setUp() throws Exception {
+        callbackHandler = new SpringSecurityPlainTextPasswordValidationCallbackHandler();
+        control = MockControl.createControl(AuthenticationManager.class);
+        mock = (AuthenticationManager) control.getMock();
+        callbackHandler.setAuthenticationManager(mock);
+        username = "Bert";
+        password = "Ernie";
+        PasswordValidationCallback.PlainTextPasswordRequest request =
+                new PasswordValidationCallback.PlainTextPasswordRequest(username, password);
+        callback = new PasswordValidationCallback(request);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testAuthenticateUserPlainTextValid() throws Exception {
+        Authentication authResult = new TestingAuthenticationToken(username, password, new GrantedAuthority[0]);
+        control.expectAndReturn(mock.authenticate(new UsernamePasswordAuthenticationToken(username, password)),
+                authResult);
+        control.replay();
+        callbackHandler.handleInternal(callback);
+        boolean authenticated = callback.getResult();
+        assertTrue("Not authenticated", authenticated);
+        assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication());
+        control.verify();
+    }
+
+    public void testAuthenticateUserPlainTextInvalid() throws Exception {
+        control.expectAndThrow(mock.authenticate(new UsernamePasswordAuthenticationToken(username, password)),
+                new BadCredentialsException(""));
+        control.replay();
+        callbackHandler.handleInternal(callback);
+        boolean authenticated = callback.getResult();
+        assertFalse("Authenticated", authenticated);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+        control.verify();
+    }
+
+    public void testCleanUp() throws Exception {
+        TestingAuthenticationToken authentication =
+                new TestingAuthenticationToken(new Object(), new Object(), new GrantedAuthority[0]);
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+
+        CleanupCallback cleanupCallback = new CleanupCallback();
+        callbackHandler.handleInternal(cleanupCallback);
+        assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
+    }
+
+}

security/src/test/java/org/springframework/ws/soap/security/xwss/callback/springsecurity/SpringSecurityUsernamePasswordCallbackHandlerTest.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright ${YEAR} the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.xwss.callback.springsecurity;
+
+import com.sun.xml.wss.impl.callback.PasswordCallback;
+import com.sun.xml.wss.impl.callback.UsernameCallback;
+import junit.framework.TestCase;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
+
+public class SpringSecurityUsernamePasswordCallbackHandlerTest extends TestCase {
+
+    private SpringSecurityUsernamePasswordCallbackHandler handler;
+
+    protected void setUp() throws Exception {
+        handler = new SpringSecurityUsernamePasswordCallbackHandler();
+        Authentication authentication = new UsernamePasswordAuthenticationToken("Bert", "Ernie");
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+    }
+
+    protected void tearDown() throws Exception {
+        SecurityContextHolder.clearContext();
+    }
+
+    public void testUsernameCallback() throws Exception {
+        UsernameCallback usernameCallback = new UsernameCallback();
+        handler.handleInternal(usernameCallback);
+        assertEquals("Invalid username", "Bert", usernameCallback.getUsername());
+    }
+
+    public void testPasswordCallback() throws Exception {
+        PasswordCallback passwordCallback = new PasswordCallback();
+        handler.handleInternal(passwordCallback);
+        assertEquals("Invalid username", "Ernie", passwordCallback.getPassword());
+    }
+}