001: /**
002: * Licensed to the Apache Software Foundation (ASF) under one or more
003: * contributor license agreements. See the NOTICE file distributed with
004: * this work for additional information regarding copyright ownership.
005: * The ASF licenses this file to You under the Apache License, Version 2.0
006: * (the "License"); you may not use this file except in compliance with
007: * the License. You may obtain a copy of the License at
008: *
009: * http://www.apache.org/licenses/LICENSE-2.0
010: *
011: * Unless required by applicable law or agreed to in writing, software
012: * distributed under the License is distributed on an "AS IS" BASIS,
013: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014: * See the License for the specific language governing permissions and
015: * limitations under the License.
016: */package org.apache.geronimo.tomcat;
017:
018: import java.io.BufferedReader;
019: import java.io.InputStreamReader;
020: import java.net.HttpURLConnection;
021: import java.net.URL;
022: import java.util.Map;
023: import java.util.HashMap;
024: import java.security.PermissionCollection;
025: import java.security.Permissions;
026:
027: import javax.management.ObjectName;
028:
029: import org.apache.geronimo.tomcat.util.SecurityHolder;
030: import org.apache.geronimo.security.jacc.ComponentPermissions;
031: import org.apache.geronimo.security.credentialstore.CredentialStore;
032:
033: /**
034: * Tests the JAAS security for Tomcat
035: *
036: * @version $Revision: 545781 $ $Date: 2007-06-09 10:44:02 -0700 (Sat, 09 Jun 2007) $
037: */
038: public class JAASSecurityTest extends AbstractWebModuleTest {
039:
040: ObjectName appName = null;
041:
042: public void testNotAuthorized() throws Exception {
043:
044: startWebApp();
045:
046: //Begin the test
047: HttpURLConnection connection = (HttpURLConnection) new URL(
048: connector.getConnectUrl() + "/test/protected/hello.txt")
049: .openConnection();
050: connection.setInstanceFollowRedirects(false);
051: assertEquals(HttpURLConnection.HTTP_OK, connection
052: .getResponseCode());
053: //Be sure we have been given the login page
054: BufferedReader reader = new BufferedReader(
055: new InputStreamReader(connection.getInputStream()));
056: assertEquals("<!-- Login Page -->", reader.readLine());
057: reader.close();
058:
059: String cookie = connection.getHeaderField("Set-Cookie");
060: cookie = cookie.substring(0, cookie.lastIndexOf(';'));
061: String location = connector.getConnectUrl()
062: + "/test/protected/j_security_check?j_username=alan&j_password=starcraft";
063: connection = (HttpURLConnection) new URL(location)
064: .openConnection();
065: connection.setRequestMethod("POST");
066: connection.setRequestProperty("Cookie", cookie);
067: connection.setInstanceFollowRedirects(false);
068: assertEquals(HttpURLConnection.HTTP_MOVED_TEMP, connection
069: .getResponseCode());
070:
071: location = connection.getHeaderField("Location");
072: connection = (HttpURLConnection) new URL(location)
073: .openConnection();
074: connection.setRequestProperty("Cookie", cookie);
075: connection.setInstanceFollowRedirects(true);
076: assertEquals(HttpURLConnection.HTTP_FORBIDDEN, connection
077: .getResponseCode());
078: connection.disconnect();
079:
080: stopWebApp();
081: }
082:
083: public void testBadAuthentication() throws Exception {
084:
085: startWebApp();
086:
087: //Begin the test
088: HttpURLConnection connection = (HttpURLConnection) new URL(
089: connector.getConnectUrl() + "/test/protected/hello.txt")
090: .openConnection();
091: connection.setInstanceFollowRedirects(false);
092: assertEquals(HttpURLConnection.HTTP_OK, connection
093: .getResponseCode());
094:
095: //Be sure we have been given the login page
096: BufferedReader reader = new BufferedReader(
097: new InputStreamReader(connection.getInputStream()));
098: assertEquals("<!-- Login Page -->", reader.readLine());
099: reader.close();
100:
101: String cookie = connection.getHeaderField("Set-Cookie");
102: cookie = cookie.substring(0, cookie.lastIndexOf(';'));
103: String location = connector.getConnectUrl()
104: + "/test/protected/j_security_check?j_username=alan&j_password=basspassword";
105:
106: connection = (HttpURLConnection) new URL(location)
107: .openConnection();
108: connection.setRequestMethod("POST");
109: connection.setRequestProperty("Cookie", cookie);
110: connection.setInstanceFollowRedirects(true);
111:
112: //Be sure we have been given the login error page
113: reader = new BufferedReader(new InputStreamReader(connection
114: .getInputStream()));
115: assertEquals(HttpURLConnection.HTTP_OK, connection
116: .getResponseCode());
117:
118: location = connection.getHeaderField("Location");
119: assertEquals("<!-- Not Authorized -->", reader.readLine());
120: reader.close();
121:
122: connection.disconnect();
123:
124: stopWebApp();
125: }
126:
127: public void testGoodAuthentication() throws Exception {
128: startWebApp();
129:
130: //Begin the test
131: HttpURLConnection connection = (HttpURLConnection) new URL(
132: connector.getConnectUrl() + "/test/protected/hello.txt")
133: .openConnection();
134: connection.setInstanceFollowRedirects(false);
135: assertEquals(HttpURLConnection.HTTP_OK, connection
136: .getResponseCode());
137:
138: //Be sure we have been given the login page
139: BufferedReader reader = new BufferedReader(
140: new InputStreamReader(connection.getInputStream()));
141: assertEquals("<!-- Login Page -->", reader.readLine());
142: reader.close();
143:
144: String cookie = connection.getHeaderField("Set-Cookie");
145: cookie = cookie.substring(0, cookie.lastIndexOf(';'));
146: String location = connector.getConnectUrl()
147: + "/test/protected/j_security_check?j_username=izumi&j_password=violin";
148:
149: connection = (HttpURLConnection) new URL(location)
150: .openConnection();
151: connection.setRequestMethod("POST");
152: connection.setRequestProperty("Referer", connector
153: .getConnectUrl()
154: + "/test/auth/logon.html?param=test");
155: connection.setRequestProperty("Cookie", cookie);
156: connection.setInstanceFollowRedirects(false);
157: assertEquals(HttpURLConnection.HTTP_MOVED_TEMP, connection
158: .getResponseCode());
159:
160: connection = (HttpURLConnection) new URL(connector
161: .getConnectUrl()
162: + "/test/protected/hello.txt").openConnection();
163: connection.setRequestProperty("Cookie", cookie);
164: connection.setInstanceFollowRedirects(false);
165: reader = new BufferedReader(new InputStreamReader(connection
166: .getInputStream()));
167:
168: assertEquals(HttpURLConnection.HTTP_OK, connection
169: .getResponseCode());
170: assertEquals("Hello World", reader.readLine());
171: connection.disconnect();
172:
173: stopWebApp();
174: }
175:
176: protected void startWebApp() throws Exception {
177: //Set a context level Realm and ignore the Engine level to test that
178: //the override along with a Security Realm Name set overrides the Engine
179: Map initParams = new HashMap();
180: initParams
181: .put("userClassNames",
182: "org.apache.geronimo.security.realm.providers.GeronimoUserPrincipal");
183: initParams
184: .put("roleClassNames",
185: "org.apache.geronimo.security.realm.providers.GeronimoGroupPrincipal");
186:
187: RealmGBean realm = new RealmGBean(
188: "org.apache.geronimo.tomcat.realm.TomcatJAASRealm",
189: initParams);
190: realm.doStart();
191:
192: PermissionCollection excludedPermissions = new Permissions();
193: PermissionCollection uncheckedPermissions = new Permissions();
194: ComponentPermissions componentPermissions = new ComponentPermissions(
195: excludedPermissions, uncheckedPermissions,
196: new HashMap());
197: //Force a new realm name and ignore the application name
198: SecurityHolder securityHolder = new SecurityHolder();
199: securityHolder.setSecurityRealm(securityRealmName);
200: CredentialStore credentialStore = null;
201: setUpSecureAppContext(new HashMap(), new HashMap(),
202: componentPermissions, realm, securityHolder,
203: credentialStore);
204: }
205:
206: protected void stopWebApp() throws Exception {
207: }
208:
209: protected void setUp() throws Exception {
210: super .setUp();
211: super .init("org.apache.geronimo.tomcat.realm.TomcatJAASRealm");
212: setUpSecurity();
213: }
214:
215: protected void tearDown() throws Exception {
216: tearDownSecurity();
217: super.tearDown();
218: }
219:
220: }
|