diff --git a/security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java b/security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java index b8790cc9..2c4ff6d4 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java +++ b/security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java @@ -127,27 +127,33 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter * @see #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext) */ public final boolean handleResponse(MessageContext messageContext, Object endpoint) throws Exception { - if (secureResponse) { - Assert.isTrue(messageContext.hasResponse(), "MessageContext contains no response"); - Assert.isInstanceOf(SoapMessage.class, messageContext.getResponse()); - try { - secureMessage((SoapMessage) messageContext.getResponse(), messageContext); + try { + if (secureResponse) { + Assert.isTrue(messageContext.hasResponse(), "MessageContext contains no response"); + Assert.isInstanceOf(SoapMessage.class, messageContext.getResponse()); + try { + secureMessage((SoapMessage) messageContext.getResponse(), messageContext); + return true; + } + catch (WsSecuritySecurementException ex) { + return handleSecurementException(ex, messageContext); + } + catch (WsSecurityFaultException ex) { + return handleFaultException(ex, messageContext); + } + } + else { return true; } - catch (WsSecuritySecurementException ex) { - return handleSecurementException(ex, messageContext); - } - catch (WsSecurityFaultException ex) { - return handleFaultException(ex, messageContext); - } } - else { - return true; + finally { + cleanUp(); } } /** Returns true, i.e. fault responses are not secured. */ public boolean handleFault(MessageContext messageContext, Object endpoint) throws Exception { + cleanUp(); return true; } @@ -296,4 +302,6 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter */ protected abstract void secureMessage(SoapMessage soapMessage, MessageContext messageContext) throws WsSecuritySecurementException; + + protected abstract void cleanUp(); } diff --git a/security/src/main/java/org/springframework/ws/soap/security/callback/CleanupCallback.java b/security/src/main/java/org/springframework/ws/soap/security/callback/CleanupCallback.java new file mode 100644 index 00000000..ce8aa068 --- /dev/null +++ b/security/src/main/java/org/springframework/ws/soap/security/callback/CleanupCallback.java @@ -0,0 +1,33 @@ +/* + * Copyright 2008 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.ws.soap.security.callback; + +import java.io.Serializable; +import javax.security.auth.callback.Callback; + +/** + * Underlying security services instantiate and pass a CleanupCallback to the handle method of + * a CallbackHandler to clean up security state. + * + * @author Arjen Poutsma + * @since 1.0.4 + */ +public class CleanupCallback implements Callback, Serializable { + + private static final long serialVersionUID = 4744181820980888237L; + +} diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java index 4815688f..468e29c0 100755 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java @@ -16,9 +16,12 @@ package org.springframework.ws.soap.security.wss4j; +import java.io.IOException; import java.security.cert.X509Certificate; import java.util.Vector; +import javax.security.auth.callback.Callback; import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.callback.UnsupportedCallbackException; import org.apache.axiom.soap.SOAPEnvelope; import org.apache.axiom.soap.SOAPFactory; @@ -47,6 +50,7 @@ import org.springframework.ws.soap.security.AbstractWsSecurityInterceptor; import org.springframework.ws.soap.security.WsSecuritySecurementException; import org.springframework.ws.soap.security.WsSecurityValidationException; import org.springframework.ws.soap.security.callback.CallbackHandlerChain; +import org.springframework.ws.soap.security.callback.CleanupCallback; /** * A WS-Security endpoint interceptor based on Apache's WSS4J. This inteceptor supports messages created by the {@link @@ -599,4 +603,18 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } } + protected void cleanUp() { + if (validationCallbackHandler != null) { + try { + CleanupCallback cleanupCallback = new CleanupCallback(); + validationCallbackHandler.handle(new Callback[]{cleanupCallback}); + } + catch (IOException ex) { + logger.warn("Cleanup callback resulted in IOException", ex); + } + catch (UnsupportedCallbackException ex) { + // ignore + } + } + } } \ No newline at end of file diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/AbstractWsPasswordCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/AbstractWsPasswordCallbackHandler.java index 9e1f7423..fefeabba 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/AbstractWsPasswordCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/AbstractWsPasswordCallbackHandler.java @@ -23,6 +23,7 @@ import javax.security.auth.callback.UnsupportedCallbackException; import org.apache.ws.security.WSPasswordCallback; import org.springframework.ws.soap.security.callback.AbstractCallbackHandler; +import org.springframework.ws.soap.security.callback.CleanupCallback; /** * Abstract base class for {@link javax.security.auth.callback.CallbackHandler} implementations that handle {@link @@ -74,6 +75,10 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback "Unknown usage [" + passwordCallback.getUsage() + "]"); } } + else if (callback instanceof CleanupCallback) { + CleanupCallback cleanupCallback = (CleanupCallback) callback; + handleCleanup(cleanupCallback); + } else { throw new UnsupportedCallbackException(callback); } @@ -173,4 +178,13 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback protected void handleEncryptedKeyToken(Callback callback) throws IOException, UnsupportedCallbackException { throw new UnsupportedCallbackException(callback); } + + /** + * Invoked when a {@link CleanupCallback} is passed to {@link #handle(Callback[])}. + *

+ * Default implementation throws an {@link UnsupportedCallbackException}. + */ + protected void handleCleanup(CleanupCallback callback) throws IOException, UnsupportedCallbackException { + throw new UnsupportedCallbackException(callback); + } } diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java index 5cb34b55..7acc2e27 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java @@ -19,6 +19,7 @@ package org.springframework.ws.soap.security.wss4j.callback.acegi; import java.io.IOException; import javax.security.auth.callback.UnsupportedCallbackException; +import org.acegisecurity.context.SecurityContextHolder; import org.acegisecurity.providers.dao.UserCache; import org.acegisecurity.providers.dao.cache.NullUserCache; import org.acegisecurity.userdetails.UserDetails; @@ -28,6 +29,7 @@ import org.apache.ws.security.WSPasswordCallback; import org.springframework.dao.DataAccessException; import org.springframework.util.Assert; +import org.springframework.ws.soap.security.callback.CleanupCallback; import org.springframework.ws.soap.security.wss4j.callback.AbstractWsPasswordCallbackHandler; /** @@ -70,6 +72,10 @@ public class AcegiDigestPasswordValidationCallbackHandler extends AbstractWsPass } } + protected void handleCleanup(CleanupCallback callback) throws IOException, UnsupportedCallbackException { + SecurityContextHolder.clearContext(); + } + private UserDetails loadUserDetails(String username) throws DataAccessException { UserDetails user = userCache.getUserFromCache(username); diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java index cbce2e1e..8a95664e 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java @@ -28,6 +28,7 @@ import org.apache.ws.security.WSPasswordCallback; import org.apache.ws.security.WSSecurityException; import org.springframework.util.Assert; +import org.springframework.ws.soap.security.callback.CleanupCallback; import org.springframework.ws.soap.security.wss4j.callback.AbstractWsPasswordCallbackHandler; /** @@ -62,6 +63,10 @@ public class AcegiPlainTextPasswordValidationCallbackHandler extends AbstractWsP Assert.notNull(authenticationManager, "authenticationManager is required"); } + protected void handleCleanup(CleanupCallback callback) throws IOException, UnsupportedCallbackException { + SecurityContextHolder.clearContext(); + } + protected void handleUsernameTokenUnknown(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException { String identifier = callback.getIdentifer(); @@ -77,7 +82,7 @@ public class AcegiPlainTextPasswordValidationCallbackHandler extends AbstractWsP if (logger.isDebugEnabled()) { logger.debug("Authentication request for user '" + identifier + "' failed: " + failed.toString()); } - SecurityContextHolder.getContext().setAuthentication(null); + SecurityContextHolder.clearContext(); if (!ignoreFailure) { throw new WSSecurityException(WSSecurityException.FAILED_AUTHENTICATION); } diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptor.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptor.java index f9c85b63..7a654e94 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptor.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptor.java @@ -16,8 +16,11 @@ package org.springframework.ws.soap.security.xwss; +import java.io.IOException; import java.io.InputStream; +import javax.security.auth.callback.Callback; import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.callback.UnsupportedCallbackException; import javax.xml.soap.SOAPMessage; import com.sun.xml.wss.ProcessingContext; @@ -34,6 +37,7 @@ import org.springframework.ws.soap.SoapMessage; import org.springframework.ws.soap.saaj.SaajSoapMessage; import org.springframework.ws.soap.security.AbstractWsSecurityInterceptor; import org.springframework.ws.soap.security.WsSecurityValidationException; +import org.springframework.ws.soap.security.callback.CleanupCallback; import org.springframework.ws.soap.security.xwss.callback.XwssCallbackHandlerChain; /** @@ -164,4 +168,18 @@ public class XwsSecurityInterceptor extends AbstractWsSecurityInterceptor implem } } + protected void cleanUp() { + if (callbackHandler != null) { + try { + CleanupCallback cleanupCallback = new CleanupCallback(); + callbackHandler.handle(new Callback[]{cleanupCallback}); + } + catch (IOException ex) { + logger.warn("Cleanup callback resulted in IOException", ex); + } + catch (UnsupportedCallbackException ex) { + // ignore + } + } + } } diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandler.java index 5f35cda6..91b887b8 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandler.java @@ -30,6 +30,7 @@ import org.acegisecurity.providers.x509.X509AuthenticationToken; import org.springframework.util.Assert; import org.springframework.ws.soap.security.callback.AbstractCallbackHandler; +import org.springframework.ws.soap.security.callback.CleanupCallback; /** * Callback handler that validates a certificate using an Acegi AuthenticationManager. Logic based on @@ -76,6 +77,9 @@ public class AcegiCertificateValidationCallbackHandler extends AbstractCallbackH if (callback instanceof CertificateValidationCallback) { ((CertificateValidationCallback) callback).setValidator(new AcegiCertificateValidator()); } + else if (callback instanceof CleanupCallback) { + SecurityContextHolder.clearContext(); + } else { throw new UnsupportedCallbackException(callback); } @@ -101,7 +105,7 @@ public class AcegiCertificateValidationCallbackHandler extends AbstractCallbackH logger.debug("Authentication request for certificate with DN [" + certificate.getSubjectX500Principal().getName() + "] failed: " + failed.toString()); } - SecurityContextHolder.getContext().setAuthentication(null); + SecurityContextHolder.clearContext(); result = ignoreFailure; } return result; diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java index 3d023503..5f05c397 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandler.java @@ -33,6 +33,7 @@ import org.acegisecurity.userdetails.UsernameNotFoundException; import org.springframework.dao.DataAccessException; import org.springframework.util.Assert; import org.springframework.ws.soap.security.callback.AbstractCallbackHandler; +import org.springframework.ws.soap.security.callback.CleanupCallback; import org.springframework.ws.soap.security.xwss.callback.DefaultTimestampValidator; /** @@ -99,6 +100,10 @@ public class AcegiDigestPasswordValidationCallbackHandler extends AbstractCallba timestampCallback.setValidator(new DefaultTimestampValidator()); } + else if (callback instanceof CleanupCallback) { + SecurityContextHolder.clearContext(); + return; + } throw new UnsupportedCallbackException(callback); } diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java index 3bfd5519..0884f19f 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandler.java @@ -29,6 +29,7 @@ import org.acegisecurity.providers.UsernamePasswordAuthenticationToken; import org.springframework.util.Assert; import org.springframework.ws.soap.security.callback.AbstractCallbackHandler; +import org.springframework.ws.soap.security.callback.CleanupCallback; /** * Callback handler that validates a certificate uses an Acegi AuthenticationManager. Logic based on @@ -81,6 +82,10 @@ public class AcegiPlainTextPasswordValidationCallbackHandler extends AbstractCal return; } } + else if (callback instanceof CleanupCallback) { + SecurityContextHolder.clearContext(); + return; + } throw new UnsupportedCallbackException(callback); } @@ -104,7 +109,7 @@ public class AcegiPlainTextPasswordValidationCallbackHandler extends AbstractCal logger.debug("Authentication request for user '" + plainTextRequest.getUsername() + "' failed: " + failed.toString()); } - SecurityContextHolder.getContext().setAuthentication(null); + SecurityContextHolder.clearContext(); return ignoreFailure; } } diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasCertificateValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasCertificateValidationCallbackHandler.java index edd3f44c..9e4c7dd4 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasCertificateValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasCertificateValidationCallbackHandler.java @@ -58,9 +58,9 @@ public class JaasCertificateValidationCallbackHandler extends AbstractJaasValida public boolean validate(X509Certificate certificate) throws CertificateValidationCallback.CertificateValidationException { - LoginContext loginContext = null; Subject subject = new Subject(); subject.getPrincipals().add(certificate.getSubjectX500Principal()); + LoginContext loginContext; try { loginContext = new LoginContext(getLoginContextName(), subject); } diff --git a/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorAcegiCallbackHandlerTestCase.java b/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorAcegiCallbackHandlerTestCase.java index 33db8016..f9d9142f 100755 --- a/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorAcegiCallbackHandlerTestCase.java +++ b/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorAcegiCallbackHandlerTestCase.java @@ -35,6 +35,7 @@ public abstract class Wss4jMessageInterceptorAcegiCallbackHandlerTestCase extend protected void tearDown() throws Exception { control.verify(); + SecurityContextHolder.clearContext(); } public void testValidateUsernameTokenPlainText() throws Exception { @@ -43,6 +44,11 @@ public abstract class Wss4jMessageInterceptorAcegiCallbackHandlerTestCase extend MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory()); interceptor.handleRequest(messageContext, null); assertValidateUsernameToken(message); + + // test clean up + messageContext.getResponse(); + interceptor.handleResponse(messageContext, null); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); } public void testValidateUsernameTokenDigest() throws Exception { @@ -51,6 +57,11 @@ public abstract class Wss4jMessageInterceptorAcegiCallbackHandlerTestCase extend MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory()); interceptor.handleRequest(messageContext, null); assertValidateUsernameToken(message); + + // test clean up + messageContext.getResponse(); + interceptor.handleResponse(messageContext, null); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); } protected void assertValidateUsernameToken(SoapMessage message) throws Exception { @@ -58,9 +69,7 @@ public abstract class Wss4jMessageInterceptorAcegiCallbackHandlerTestCase extend assertNotNull("No result returned", result); assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security", getDocument(message)); - Authentication authentication = SecurityContextHolder.getContext() - .getAuthentication(); - assertNotNull("authentication must not be null", authentication); + assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication()); } protected EndpointInterceptor prepareInterceptor(String actions, boolean validating, boolean digest) diff --git a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandlerTest.java b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandlerTest.java index e8076e84..586d9955 100644 --- a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandlerTest.java +++ b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiCertificateValidationCallbackHandlerTest.java @@ -25,11 +25,13 @@ import junit.framework.TestCase; import org.acegisecurity.AuthenticationManager; import org.acegisecurity.BadCredentialsException; import org.acegisecurity.GrantedAuthority; +import org.acegisecurity.context.SecurityContextHolder; import org.acegisecurity.providers.TestingAuthenticationToken; import org.acegisecurity.providers.x509.X509AuthenticationToken; import org.easymock.MockControl; import org.springframework.core.io.ClassPathResource; +import org.springframework.ws.soap.security.callback.CleanupCallback; public class AcegiCertificateValidationCallbackHandlerTest extends TestCase { @@ -63,6 +65,10 @@ public class AcegiCertificateValidationCallbackHandlerTest extends TestCase { callback = new CertificateValidationCallback(certificate); } + protected void tearDown() throws Exception { + SecurityContextHolder.clearContext(); + } + public void testValidateCertificateValid() throws Exception { mock.authenticate(new X509AuthenticationToken(certificate)); control.setMatcher(MockControl.ALWAYS_MATCHER); @@ -71,6 +77,7 @@ public class AcegiCertificateValidationCallbackHandlerTest extends TestCase { callbackHandler.handleInternal(callback); boolean authenticated = callback.getResult(); assertTrue("Not authenticated", authenticated); + assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication()); control.verify(); } @@ -82,7 +89,18 @@ public class AcegiCertificateValidationCallbackHandlerTest extends TestCase { callbackHandler.handleInternal(callback); boolean authenticated = callback.getResult(); assertFalse("Authenticated", authenticated); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); control.verify(); } + public void testCleanUp() throws Exception { + TestingAuthenticationToken authentication = + new TestingAuthenticationToken(new Object(), new Object(), new GrantedAuthority[0]); + SecurityContextHolder.getContext().setAuthentication(authentication); + + CleanupCallback cleanupCallback = new CleanupCallback(); + callbackHandler.handleInternal(cleanupCallback); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); + } + } \ No newline at end of file diff --git a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandlerTest.java b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandlerTest.java index 0742a944..0d355e60 100644 --- a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandlerTest.java +++ b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiDigestPasswordValidationCallbackHandlerTest.java @@ -19,11 +19,15 @@ package org.springframework.ws.soap.security.xwss.callback.acegi; import com.sun.xml.wss.impl.callback.PasswordValidationCallback; import junit.framework.TestCase; import org.acegisecurity.GrantedAuthority; +import org.acegisecurity.context.SecurityContextHolder; +import org.acegisecurity.providers.TestingAuthenticationToken; import org.acegisecurity.userdetails.User; import org.acegisecurity.userdetails.UserDetailsService; import org.acegisecurity.userdetails.UsernameNotFoundException; import org.easymock.MockControl; +import org.springframework.ws.soap.security.callback.CleanupCallback; + public class AcegiDigestPasswordValidationCallbackHandlerTest extends TestCase { private AcegiDigestPasswordValidationCallbackHandler callbackHandler; @@ -53,12 +57,17 @@ public class AcegiDigestPasswordValidationCallbackHandlerTest extends TestCase { callback = new PasswordValidationCallback(request); } + protected void tearDown() throws Exception { + SecurityContextHolder.clearContext(); + } + public void testAuthenticateUserDigestUserNotFound() throws Exception { control.expectAndThrow(mock.loadUserByUsername(username), new UsernameNotFoundException(username)); control.replay(); callbackHandler.handleInternal(callback); boolean authenticated = callback.getResult(); assertFalse("Authenticated", authenticated); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); control.verify(); } @@ -69,6 +78,7 @@ public class AcegiDigestPasswordValidationCallbackHandlerTest extends TestCase { callbackHandler.handleInternal(callback); boolean authenticated = callback.getResult(); assertTrue("Not authenticated", authenticated); + assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication()); control.verify(); } @@ -79,6 +89,18 @@ public class AcegiDigestPasswordValidationCallbackHandlerTest extends TestCase { callbackHandler.handleInternal(callback); boolean authenticated = callback.getResult(); assertFalse("Authenticated", authenticated); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); control.verify(); } + + public void testCleanUp() throws Exception { + TestingAuthenticationToken authentication = + new TestingAuthenticationToken(new Object(), new Object(), new GrantedAuthority[0]); + SecurityContextHolder.getContext().setAuthentication(authentication); + + CleanupCallback cleanupCallback = new CleanupCallback(); + callbackHandler.handleInternal(cleanupCallback); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); + } + } \ No newline at end of file diff --git a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandlerTest.java b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandlerTest.java index 353dcd44..33177cae 100644 --- a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandlerTest.java +++ b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/acegi/AcegiPlainTextPasswordValidationCallbackHandlerTest.java @@ -22,10 +22,13 @@ import org.acegisecurity.Authentication; import org.acegisecurity.AuthenticationManager; import org.acegisecurity.BadCredentialsException; import org.acegisecurity.GrantedAuthority; +import org.acegisecurity.context.SecurityContextHolder; import org.acegisecurity.providers.TestingAuthenticationToken; import org.acegisecurity.providers.UsernamePasswordAuthenticationToken; import org.easymock.MockControl; +import org.springframework.ws.soap.security.callback.CleanupCallback; + public class AcegiPlainTextPasswordValidationCallbackHandlerTest extends TestCase { private AcegiPlainTextPasswordValidationCallbackHandler callbackHandler; @@ -52,6 +55,10 @@ public class AcegiPlainTextPasswordValidationCallbackHandlerTest extends TestCas callback = new PasswordValidationCallback(request); } + protected void tearDown() throws Exception { + SecurityContextHolder.clearContext(); + } + public void testAuthenticateUserPlainTextValid() throws Exception { Authentication authResult = new TestingAuthenticationToken(username, password, new GrantedAuthority[0]); control.expectAndReturn(mock.authenticate(new UsernamePasswordAuthenticationToken(username, password)), @@ -60,6 +67,7 @@ public class AcegiPlainTextPasswordValidationCallbackHandlerTest extends TestCas callbackHandler.handleInternal(callback); boolean authenticated = callback.getResult(); assertTrue("Not authenticated", authenticated); + assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication()); control.verify(); } @@ -70,7 +78,18 @@ public class AcegiPlainTextPasswordValidationCallbackHandlerTest extends TestCas callbackHandler.handleInternal(callback); boolean authenticated = callback.getResult(); assertFalse("Authenticated", authenticated); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); control.verify(); } + public void testCleanUp() throws Exception { + TestingAuthenticationToken authentication = + new TestingAuthenticationToken(new Object(), new Object(), new GrantedAuthority[0]); + SecurityContextHolder.getContext().setAuthentication(authentication); + + CleanupCallback cleanupCallback = new CleanupCallback(); + callbackHandler.handleInternal(cleanupCallback); + assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication()); + } + } \ No newline at end of file diff --git a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/CertificateLoginModule.java b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/CertificateLoginModule.java index 9ab46094..1957f565 100644 --- a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/CertificateLoginModule.java +++ b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/CertificateLoginModule.java @@ -18,7 +18,6 @@ package org.springframework.ws.soap.security.xwss.callback.jaas; import java.security.Principal; import java.util.Iterator; - import javax.security.auth.Subject; import javax.security.auth.callback.CallbackHandler; import javax.security.auth.login.LoginException; @@ -72,7 +71,7 @@ public class CertificateLoginModule implements LoginModule { for (Iterator iterator = subject.getPrincipals().iterator(); iterator.hasNext();) { Principal principal = (Principal) iterator.next(); if (principal instanceof X500Principal) { - return ((X500Principal) principal).getName(); + return principal.getName(); } } return null;