001: /*
002: * Copyright 2001-2007 Geert Bevin <gbevin[remove] at uwyn dot com> and
003: * Steven Grimm <koreth[remove] at midwinter dot com>
004: * Distributed under the terms of either:
005: * - the common development and distribution license (CDDL), v1.0; or
006: * - the GNU Lesser General Public License, v2.1 or later
007: * $Id: TestDatabaseAuthenticated.java 3714 2007-04-08 02:57:38Z gbevin $
008: */
009: package com.uwyn.rife.authentication.elements;
010:
011: import com.meterware.httpunit.GetMethodWebRequest;
012: import com.meterware.httpunit.WebConversation;
013: import com.meterware.httpunit.WebForm;
014: import com.meterware.httpunit.WebRequest;
015: import com.meterware.httpunit.WebResponse;
016: import com.uwyn.rife.authentication.credentialsmanagers.DatabaseUsers;
017: import com.uwyn.rife.authentication.credentialsmanagers.DatabaseUsersFactory;
018: import com.uwyn.rife.authentication.credentialsmanagers.RoleUserAttributes;
019: import com.uwyn.rife.authentication.exceptions.CredentialsManagerException;
020: import com.uwyn.rife.authentication.exceptions.RememberManagerException;
021: import com.uwyn.rife.authentication.exceptions.SessionManagerException;
022: import com.uwyn.rife.authentication.remembermanagers.DatabaseRemember;
023: import com.uwyn.rife.authentication.remembermanagers.RememberManagerFactoryFactory;
024: import com.uwyn.rife.authentication.sessionmanagers.DatabaseSessions;
025: import com.uwyn.rife.authentication.sessionmanagers.SessionManagerFactoryFactory;
026: import com.uwyn.rife.database.Datasource;
027: import com.uwyn.rife.database.Datasources;
028: import com.uwyn.rife.engine.SiteBuilder;
029: import com.uwyn.rife.resources.ResourceFinderClasspath;
030: import com.uwyn.rife.test.MockConversation;
031: import com.uwyn.rife.test.MockForm;
032: import com.uwyn.rife.test.MockRequest;
033: import com.uwyn.rife.test.MockResponse;
034: import com.uwyn.rife.test.ParsedHtml;
035: import com.uwyn.rife.tools.ExceptionUtils;
036: import com.uwyn.rife.tools.StringEncryptor;
037:
038: public class TestDatabaseAuthenticated extends
039: TestsuiteDatabaseAuthenticated {
040: private Datasource mDatasource = null;
041:
042: public TestDatabaseAuthenticated(String datasourceName,
043: int siteType, String name) {
044: super (datasourceName, siteType, name);
045:
046: mDatasource = Datasources.getRepInstance().getDatasource(
047: datasourceName);
048: mProperties.put("datasource", mDatasource);
049: mProperties
050: .put(
051: SessionManagerFactoryFactory.PROPERTYNAME_FACTORY_CLASS,
052: "DatabaseSessionsFactory");
053: mProperties
054: .put(
055: RememberManagerFactoryFactory.PROPERTYNAME_FACTORY_CLASS,
056: "DatabaseRememberFactory");
057: }
058:
059: public void setUp() throws Exception {
060: super .setUp();
061:
062: DatabaseUsers users = DatabaseUsersFactory
063: .getInstance(mDatasource);
064: try {
065: users.install();
066:
067: users.addRole("admin");
068: users.addRole("maint");
069:
070: users.addUser("guest", new RoleUserAttributes(43,
071: "guestpass"));
072: users.addUser("gbevin", new RoleUserAttributes(432,
073: "yeolpass", new String[] { "admin", "maint" }));
074: users.addUser("johndoe", new RoleUserAttributes(174,
075: "thepassofbass", new String[] { "maint" }));
076: users.setPasswordEncryptor(StringEncryptor.SHA);
077: users.addUser("guestencrypted", new RoleUserAttributes(44,
078: "guestpass"));
079: users
080: .addUser("gbevinencrypted", new RoleUserAttributes(
081: 433, "yeolpass", new String[] { "admin",
082: "maint" }));
083: users.setPasswordEncryptor(null);
084: } catch (CredentialsManagerException e) {
085: try {
086: users.remove();
087: } catch (CredentialsManagerException e2) {
088: assertTrue(ExceptionUtils.getExceptionStackTrace(e2),
089: false);
090: }
091: assertTrue(ExceptionUtils.getExceptionStackTrace(e), false);
092: }
093:
094: DatabaseSessions sessions = (DatabaseSessions) SessionManagerFactoryFactory
095: .getManager(mProperties);
096:
097: try {
098: sessions.install();
099: } catch (SessionManagerException e) {
100: try {
101: sessions.remove();
102: } catch (SessionManagerException e2) {
103: assertTrue(ExceptionUtils.getExceptionStackTrace(e2),
104: false);
105: }
106: assertTrue(ExceptionUtils.getExceptionStackTrace(e), false);
107: }
108:
109: DatabaseRemember remember = (DatabaseRemember) RememberManagerFactoryFactory
110: .getManager(mProperties);
111:
112: try {
113: remember.install();
114: } catch (RememberManagerException e) {
115: try {
116: remember.remove();
117: } catch (RememberManagerException e2) {
118: assertTrue(ExceptionUtils.getExceptionStackTrace(e2),
119: false);
120: }
121: assertTrue(ExceptionUtils.getExceptionStackTrace(e), false);
122: }
123: }
124:
125: public void tearDown() throws Exception {
126: DatabaseUsers users = DatabaseUsersFactory
127: .getInstance(mDatasource);
128:
129: try {
130: users.remove();
131: } catch (CredentialsManagerException e) {
132: assertTrue(ExceptionUtils.getExceptionStackTrace(e), false);
133: }
134:
135: DatabaseSessions sessions = (DatabaseSessions) SessionManagerFactoryFactory
136: .getManager(mProperties);
137:
138: try {
139: sessions.remove();
140: } catch (SessionManagerException e) {
141: assertTrue(ExceptionUtils.getExceptionStackTrace(e), false);
142: }
143:
144: DatabaseRemember remember = (DatabaseRemember) RememberManagerFactoryFactory
145: .getManager(mProperties);
146:
147: try {
148: remember.remove();
149: } catch (RememberManagerException e) {
150: assertTrue(ExceptionUtils.getExceptionStackTrace(e), false);
151: }
152:
153: super .tearDown();
154: }
155:
156: public void testDatabaseAuthenticatedBasic() throws Exception {
157: setupSite("site/authentication_database.xml");
158:
159: WebConversation conversation = new WebConversation();
160: WebRequest request = null;
161: WebResponse response = null;
162: WebForm form = null;
163:
164: request = new GetMethodWebRequest(
165: "http://localhost:8181/authentication/database/basic");
166: response = conversation.getResponse(request);
167: form = response.getForms()[0];
168: form.setParameter("login", "guest");
169: form.setParameter("password", "guestpass");
170: response = form.submit();
171:
172: assertEquals(0, response.getForms().length);
173:
174: request = new GetMethodWebRequest(
175: "http://localhost:8181/authentication/database/basic");
176: response = conversation.getResponse(request);
177: form = response.getForms()[0];
178: form.setParameter("login", "gbevin");
179: form.setParameter("password", "yeolpass");
180: response = form.submit();
181:
182: assertEquals(0, response.getForms().length);
183:
184: request = new GetMethodWebRequest(
185: "http://localhost:8181/authentication/database/basic");
186: response = conversation.getResponse(request);
187: form = response.getForms()[0];
188: form.setParameter("login", "invalid");
189: form.setParameter("password", "invalid");
190: response = form.submit();
191:
192: assertEquals(1, response.getForms().length);
193: }
194:
195: public void testDatabaseAuthenticatedEncrypted() throws Exception {
196: setupSite("site/authentication_database.xml");
197:
198: WebConversation conversation = new WebConversation();
199: WebRequest request = null;
200: WebResponse response = null;
201: WebForm form = null;
202:
203: request = new GetMethodWebRequest(
204: "http://localhost:8181/authentication/database/encrypted");
205: response = conversation.getResponse(request);
206: form = response.getForms()[0];
207: form.setParameter("login", "guestencrypted");
208: form.setParameter("password", "guestpass");
209: response = form.submit();
210:
211: assertEquals(0, response.getForms().length);
212:
213: request = new GetMethodWebRequest(
214: "http://localhost:8181/authentication/database/encrypted");
215: response = conversation.getResponse(request);
216: form = response.getForms()[0];
217: form.setParameter("login", "gbevinencrypted");
218: form.setParameter("password", "yeolpass");
219: response = form.submit();
220:
221: assertEquals(0, response.getForms().length);
222:
223: request = new GetMethodWebRequest(
224: "http://localhost:8181/authentication/database/encrypted");
225: response = conversation.getResponse(request);
226: form = response.getForms()[0];
227: form.setParameter("login", "guest");
228: form.setParameter("password", "guestpass");
229: response = form.submit();
230:
231: assertEquals(1, response.getForms().length);
232:
233: request = new GetMethodWebRequest(
234: "http://localhost:8181/authentication/database/encrypted");
235: response = conversation.getResponse(request);
236: form = response.getForms()[0];
237: form.setParameter("login", "gbevin");
238: form.setParameter("password", "yeolpass");
239: response = form.submit();
240:
241: assertEquals(1, response.getForms().length);
242:
243: request = new GetMethodWebRequest(
244: "http://localhost:8181/authentication/database/encrypted");
245: response = conversation.getResponse(request);
246: form = response.getForms()[0];
247: form.setParameter("login", "invalid");
248: form.setParameter("password", "invalid");
249: response = form.submit();
250:
251: assertEquals(1, response.getForms().length);
252: }
253:
254: public void testDatabaseAuthenticatedRole() throws Exception {
255: setupSite("site/authentication_database.xml");
256:
257: WebConversation conversation = new WebConversation();
258: WebRequest request = null;
259: WebResponse response = null;
260: WebForm form = null;
261:
262: request = new GetMethodWebRequest(
263: "http://localhost:8181/authentication/database/role");
264: response = conversation.getResponse(request);
265: form = response.getForms()[0];
266: form.setParameter("login", "guest");
267: form.setParameter("password", "guestpass");
268: response = form.submit();
269:
270: assertEquals(1, response.getForms().length);
271:
272: request = new GetMethodWebRequest(
273: "http://localhost:8181/authentication/database/role");
274: response = conversation.getResponse(request);
275: form = response.getForms()[0];
276: form.setParameter("login", "gbevin");
277: form.setParameter("password", "yeolpass");
278: response = form.submit();
279:
280: assertEquals(0, response.getForms().length);
281:
282: request = new GetMethodWebRequest(
283: "http://localhost:8181/authentication/database/role2");
284: response = conversation.getResponse(request);
285: form = response.getForms()[0];
286: form.setParameter("login", "gbevin");
287: form.setParameter("password", "yeolpass");
288: response = form.submit();
289:
290: assertEquals(0, response.getForms().length);
291:
292: request = new GetMethodWebRequest(
293: "http://localhost:8181/authentication/database/role");
294: response = conversation.getResponse(request);
295: form = response.getForms()[0];
296: form.setParameter("login", "johndoe");
297: form.setParameter("password", "thepassofbass");
298: response = form.submit();
299:
300: assertEquals(1, response.getForms().length);
301:
302: request = new GetMethodWebRequest(
303: "http://localhost:8181/authentication/database/role2");
304: response = conversation.getResponse(request);
305: form = response.getForms()[0];
306: form.setParameter("login", "johndoe");
307: form.setParameter("password", "thepassofbass");
308: response = form.submit();
309:
310: assertEquals(0, response.getForms().length);
311:
312: request = new GetMethodWebRequest(
313: "http://localhost:8181/authentication/database/role");
314: response = conversation.getResponse(request);
315: form = response.getForms()[0];
316: form.setParameter("login", "invalid");
317: form.setParameter("password", "invalid");
318: response = form.submit();
319:
320: assertEquals(1, response.getForms().length);
321: }
322:
323: public void testDatabaseAuthenticatedRoleIsolation()
324: throws Exception {
325: setupSite("site/authentication_database.xml");
326:
327: WebConversation conversation = new WebConversation();
328: WebRequest request = null;
329: WebResponse response = null;
330: WebForm form = null;
331: String auth_id = null;
332:
333: request = new GetMethodWebRequest(
334: "http://localhost:8181/authentication/database/role");
335: response = conversation.getResponse(request);
336: form = response.getForms()[0];
337: form.setParameter("login", "gbevin");
338: form.setParameter("password", "yeolpass");
339: response = form.submit();
340:
341: assertEquals(0, response.getForms().length);
342: auth_id = response.getTitle();
343:
344: request = new GetMethodWebRequest(
345: "http://localhost:8181/authentication/database/role");
346: request.setParameter("authid", auth_id);
347: response = conversation.getResponse(request);
348:
349: assertEquals(auth_id, response.getTitle());
350:
351: request = new GetMethodWebRequest(
352: "http://localhost:8181/authentication/database/role2");
353: request.setParameter("authid", auth_id);
354: response = conversation.getResponse(request);
355:
356: assertEquals(auth_id, response.getTitle());
357:
358: request = new GetMethodWebRequest(
359: "http://localhost:8181/authentication/database/role2");
360: response = conversation.getResponse(request);
361: form = response.getForms()[0];
362: form.setParameter("login", "johndoe");
363: form.setParameter("password", "thepassofbass");
364: response = form.submit();
365:
366: assertEquals(0, response.getForms().length);
367: auth_id = response.getTitle();
368:
369: request = new GetMethodWebRequest(
370: "http://localhost:8181/authentication/database/role2");
371: request.setParameter("authid", auth_id);
372: response = conversation.getResponse(request);
373:
374: assertEquals(auth_id, response.getTitle());
375:
376: request = new GetMethodWebRequest(
377: "http://localhost:8181/authentication/database/role");
378: request.setParameter("authid", auth_id);
379: response = conversation.getResponse(request);
380:
381: assertEquals(1, response.getForms().length);
382: }
383:
384: public void testDatabaseAuthenticatedRemember() throws Exception {
385: setupSite("site/authentication_database.xml");
386:
387: WebConversation conversation = new WebConversation();
388: WebRequest request = null;
389: WebResponse response = null;
390: WebForm form = null;
391:
392: // verify if regular authentication still works, without flagging the remember checkbox
393: request = new GetMethodWebRequest(
394: "http://localhost:8181/authentication/database/remember");
395: response = conversation.getResponse(request);
396: form = response.getForms()[0];
397: form.setParameter("login", "guest");
398: form.setParameter("password", "guestpass");
399: response = form.submit();
400: assertNull(conversation.getCookieValue("authid"));
401: assertNull(conversation.getCookieValue("rememberid"));
402:
403: assertEquals(0, response.getForms().length);
404:
405: request = new GetMethodWebRequest(
406: "http://localhost:8181/authentication/database/remember");
407: response = conversation.getResponse(request);
408: form = response.getForms()[0];
409: form.setParameter("login", "gbevin");
410: form.setParameter("password", "yeolpass");
411: response = form.submit();
412: assertNull(conversation.getCookieValue("authid"));
413: assertNull(conversation.getCookieValue("rememberid"));
414:
415: assertEquals(0, response.getForms().length);
416:
417: request = new GetMethodWebRequest(
418: "http://localhost:8181/authentication/database/remember");
419: response = conversation.getResponse(request);
420: form = response.getForms()[0];
421: form.setParameter("login", "invalid");
422: form.setParameter("password", "invalid");
423: response = form.submit();
424: assertNull(conversation.getCookieValue("authid"));
425: assertNull(conversation.getCookieValue("rememberid"));
426:
427: assertEquals(1, response.getForms().length);
428:
429: // try the remember feature
430: request = new GetMethodWebRequest(
431: "http://localhost:8181/authentication/database/remember");
432: response = conversation.getResponse(request);
433:
434: assertEquals(1, response.getForms().length);
435:
436: // indicate that the authentication should be remembered
437: request = new GetMethodWebRequest(
438: "http://localhost:8181/authentication/database/remember");
439: response = conversation.getResponse(request);
440: form = response.getForms()[0];
441: form.setParameter("login", "guest");
442: form.setParameter("password", "guestpass");
443: form.setCheckbox("remember", true);
444: response = form.submit();
445: assertNull(conversation.getCookieValue("authid"));
446: assertNotNull(conversation.getCookieValue("rememberid"));
447: String authid1 = response.getTitle();
448: String rememberid1 = conversation.getCookieValue("rememberid");
449: assertEquals(0, response.getForms().length);
450:
451: // check that the remember cookie works
452: request = new GetMethodWebRequest(
453: "http://localhost:8181/authentication/database/remember");
454: response = conversation.getResponse(request);
455: assertNotNull(conversation.getCookieValue("rememberid"));
456: String authid2 = response.getTitle();
457: String rememberid2 = conversation.getCookieValue("rememberid");
458: assertEquals(0, response.getForms().length);
459:
460: // ensure that a new one is assigned everytime one is used
461: assertFalse(authid1.equals(authid2));
462: assertFalse(rememberid1.equals(rememberid2));
463:
464: // check that the remember cookie isn't replaced when the user is already authenticated
465: response = response.getLinkWith("reload").click();
466: assertNotNull(conversation.getCookieValue("rememberid"));
467: String authid3 = response.getTitle();
468: String rememberid3 = conversation.getCookieValue("rememberid");
469: assertEquals(0, response.getForms().length);
470:
471: assertTrue(authid2.equals(authid3));
472: assertTrue(rememberid2.equals(rememberid3));
473:
474: // check if the new remember id still works
475: request = new GetMethodWebRequest(
476: "http://localhost:8181/authentication/database/remember");
477: response = conversation.getResponse(request);
478: assertEquals(0, response.getForms().length);
479: String rememberid4 = conversation.getCookieValue("rememberid");
480:
481: // start a new web conversation and check that a rememberid is invalidated after each use
482: conversation = new WebConversation();
483: conversation.addCookie("rememberid", rememberid1);
484: request = new GetMethodWebRequest(
485: "http://localhost:8181/authentication/database/remember");
486: response = conversation.getResponse(request);
487: assertEquals(1, response.getForms().length);
488:
489: conversation = new WebConversation();
490: conversation.addCookie("rememberid", rememberid2);
491: request = new GetMethodWebRequest(
492: "http://localhost:8181/authentication/database/remember");
493: response = conversation.getResponse(request);
494: assertEquals(1, response.getForms().length);
495:
496: conversation = new WebConversation();
497: conversation.addCookie("rememberid", rememberid3);
498: request = new GetMethodWebRequest(
499: "http://localhost:8181/authentication/database/remember");
500: response = conversation.getResponse(request);
501: assertEquals(1, response.getForms().length);
502:
503: conversation = new WebConversation();
504: conversation.addCookie("rememberid", rememberid4);
505: request = new GetMethodWebRequest(
506: "http://localhost:8181/authentication/database/remember");
507: response = conversation.getResponse(request);
508: assertEquals(0, response.getForms().length);
509: }
510:
511: public void testDatabaseAuthenticatedProhibitRemember()
512: throws Exception {
513: setupSite("site/authentication_database.xml");
514:
515: WebConversation conversation = new WebConversation();
516: WebRequest request = null;
517: WebResponse response = null;
518: WebForm form = null;
519:
520: // indicate that the authentication should be remembered
521: request = new GetMethodWebRequest(
522: "http://localhost:8181/authentication/database/remember");
523: response = conversation.getResponse(request);
524: form = response.getForms()[0];
525: form.setParameter("login", "guest");
526: form.setParameter("password", "guestpass");
527: form.setCheckbox("remember", true);
528: response = form.submit();
529: assertNull(conversation.getCookieValue("authid"));
530: assertNotNull(conversation.getCookieValue("rememberid"));
531: assertEquals(0, response.getForms().length);
532:
533: // check that the remember cookie works
534: request = new GetMethodWebRequest(
535: "http://localhost:8181/authentication/database/remember");
536: response = conversation.getResponse(request);
537: assertNotNull(conversation.getCookieValue("rememberid"));
538: String authid2 = response.getTitle();
539: assertEquals(0, response.getForms().length);
540:
541: // check that the authid works when remembered authentication is allowed
542: conversation = new WebConversation();
543: request = new GetMethodWebRequest(
544: "http://localhost:8181/authentication/database/remember?authid="
545: + authid2);
546: response = conversation.getResponse(request);
547: assertEquals(0, response.getForms().length);
548:
549: // check that the remember cookie is prohibited
550: conversation = new WebConversation();
551: request = new GetMethodWebRequest(
552: "http://localhost:8181/authentication/database/prohibitremember?authid="
553: + authid2);
554: response = conversation.getResponse(request);
555: assertEquals(1, response.getForms().length);
556: }
557:
558: /**
559: * Tests that we can get through an authenticated element that has its
560: * "enforce_authenticated" flag set to false.
561: */
562: public void testDatabaseAuthenticatedNotEnforced() throws Exception {
563: SiteBuilder builder = new SiteBuilder(
564: "site/authentication_database.xml",
565: ResourceFinderClasspath.getInstance());
566: MockConversation conversation = new MockConversation(builder
567: .getSite());
568:
569: MockResponse response;
570: MockRequest request;
571: MockForm form;
572: ParsedHtml parsed;
573: String auth_id;
574:
575: /* Can we get through the page as an anonymous user? */
576: response = conversation
577: .doRequest("/authentication/database/enforce");
578: parsed = response.getParsedHtml();
579:
580: assertEquals("forms", 0, parsed.getForms().size());
581: assertEquals("login name", "(none)", parsed.getLinkWithId(
582: "userLogin").getText());
583:
584: /* Now hit a protected page so we can get an authid value. */
585: response = conversation
586: .doRequest("/authentication/database/enforce2");
587: parsed = response.getParsedHtml();
588: form = parsed.getForms().get(0);
589: form.setParameter("login", "guest");
590: form.setParameter("password", "guestpass");
591: response = form.submit();
592: parsed = response.getParsedHtml();
593:
594: assertEquals("forms (after login)", 0, parsed.getForms().size());
595: assertEquals("login name (after login)", "guest", parsed
596: .getLinkWithId("userLogin").getText());
597:
598: auth_id = parsed.getTitle();
599:
600: /* And hit the unprotected page again to be sure it recognizes us. */
601: conversation = new MockConversation(builder.getSite());
602: request = new MockRequest();
603: request.setParameter("authid", auth_id);
604: response = conversation.doRequest(
605: "/authentication/database/enforce", request);
606: parsed = response.getParsedHtml();
607:
608: assertEquals("forms (unenforced after login)", 0, parsed
609: .getForms().size());
610: assertEquals("login name (unenforced after login)", "guest",
611: parsed.getLinkWithId("userLogin").getText());
612: }
613: }
|