001: /*
002: * JBoss, Home of Professional Open Source.
003: * Copyright 2006, Red Hat Middleware LLC, and individual contributors
004: * as indicated by the @author tags. See the copyright.txt file in the
005: * distribution for a full listing of individual contributors.
006: *
007: * This is free software; you can redistribute it and/or modify it
008: * under the terms of the GNU Lesser General Public License as
009: * published by the Free Software Foundation; either version 2.1 of
010: * the License, or (at your option) any later version.
011: *
012: * This software is distributed in the hope that it will be useful,
013: * but WITHOUT ANY WARRANTY; without even the implied warranty of
014: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
015: * Lesser General Public License for more details.
016: *
017: * You should have received a copy of the GNU Lesser General Public
018: * License along with this software; if not, write to the Free
019: * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
020: * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
021: */
022: package org.jboss.test.web.security.jacc;
023:
024: import java.security.Policy;
025: import java.security.ProtectionDomain;
026: import java.util.ArrayList;
027: import java.util.List;
028: import javax.security.jacc.PolicyConfiguration;
029: import javax.security.jacc.PolicyContext;
030: import javax.security.jacc.WebResourcePermission;
031:
032: import junit.framework.TestCase;
033: import org.jboss.metadata.WebMetaData;
034: import org.jboss.metadata.WebSecurityMetaData;
035: import org.jboss.security.SimplePrincipal;
036: import org.jboss.security.jacc.DelegatingPolicy;
037: import org.jboss.security.jacc.JBossPolicyConfigurationFactory;
038: import org.jboss.web.WebPermissionMapping;
039:
040: /**
041: * Test
042: * @author Scott.Stark@jboss.org
043: * @version $Revision: 57206 $
044: */
045: public class UncheckedExactWebConstraintsUnitTestCase extends TestCase {
046: private PolicyConfiguration pc;
047:
048: public void testUncheckedExact() throws Exception {
049: Policy p = Policy.getPolicy();
050: SimplePrincipal[] caller = null;
051: ProtectionDomain pd = new ProtectionDomain(null, null, null,
052: caller);
053:
054: WebResourcePermission wrp = new WebResourcePermission(
055: "/protected/exact/get/roleA", "GET");
056: assertFalse("/protected/exact/get/roleA GET", p
057: .implies(pd, wrp));
058: wrp = new WebResourcePermission("/protected/exact/get/roleA",
059: "POST");
060: assertFalse("/protected/exact/get/roleA POST", p.implies(pd,
061: wrp));
062:
063: caller = new SimplePrincipal[] { new SimplePrincipal("RoleA") };
064: wrp = new WebResourcePermission("/protected/exact/get/roleA",
065: "GET");
066: assertFalse("/protected/exact/get/roleA GET", p
067: .implies(pd, wrp));
068: wrp = new WebResourcePermission("/protected/exact/get/roleA",
069: "POST");
070: assertFalse("/protected/exact/get/roleA POST", p.implies(pd,
071: wrp));
072:
073: caller = new SimplePrincipal[] { new SimplePrincipal("RoleB") };
074: pd = new ProtectionDomain(null, null, null, caller);
075: wrp = new WebResourcePermission("/protected/exact/get/roleA",
076: "GET");
077: assertFalse("/protected/exact/get/roleA GET", p
078: .implies(pd, wrp));
079: wrp = new WebResourcePermission("/protected/exact/get/roleA",
080: "POST");
081: assertTrue("/protected/exact/get/roleA POST", p
082: .implies(pd, wrp));
083: }
084:
085: protected void setUp() throws Exception {
086: WebMetaData metaData = new WebMetaData();
087: ArrayList securityContraints = new ArrayList();
088: addProtectedASC(securityContraints);
089: addProtectedBSC(securityContraints);
090: metaData.setSecurityConstraints(securityContraints);
091:
092: DelegatingPolicy policy = new DelegatingPolicy();
093: Policy.setPolicy(policy);
094: JBossPolicyConfigurationFactory pcf = new JBossPolicyConfigurationFactory();
095: pc = pcf.getPolicyConfiguration(
096: "UncheckedWebConstraintsUnitTestCase", true);
097: WebPermissionMapping.createPermissions(metaData, pc);
098: pc.commit();
099: System.out.println(policy.listContextPolicies());
100: PolicyContext
101: .setContextID("UncheckedWebConstraintsUnitTestCase");
102: }
103:
104: /*
105: <security-constraint>
106: <web-resource-collection>
107: <web-resource-name>exact, get method, roleA</web-resource-name>
108: <url-pattern>/protected/exact/get/roleA</url-pattern>
109: <http-method>GET</http-method>
110: </web-resource-collection>
111: <auth-constraint>
112: <role-name>RoleA</role-name>
113: </auth-constraint>
114: <user-data-constraint>
115: <transport-guarantee>NONE</transport-guarantee>
116: </user-data-constraint>
117: </security-constraint>
118: */
119: private void addProtectedASC(List securityContraints) {
120: WebSecurityMetaData wsmd = new WebSecurityMetaData();
121: securityContraints.add(wsmd);
122: // web-resource-collection/web-resource-name = exact, get method, roleA
123: WebSecurityMetaData.WebResourceCollection wrc = wsmd
124: .addWebResource("exact, get method, roleA");
125: wrc.addPattern("/protected/exact/get/roleA");
126: wrc.addHttpMethod("GET");
127:
128: // auth-constraint/role-name = RoleA
129: wsmd.addRole("RoleA");
130:
131: // user-data-constraint/transport-guarantee
132: wsmd.setTransportGuarantee("NONE");
133: }
134:
135: /*
136: <security-constraint>
137: <web-resource-collection>
138: <web-resource-name>exact, get method, roleA verifier</web-resource-name>
139: <url-pattern>/protected/exact/get/roleA</url-pattern>
140: <http-method>POST</http-method>
141: <http-method>PUT</http-method>
142: <http-method>HEAD</http-method>
143: <http-method>TRACE</http-method>
144: <http-method>OPTIONS</http-method>
145: <http-method>DELETE</http-method>
146: </web-resource-collection>
147: <auth-constraint>
148: <role-name>RoleB</role-name>
149: </auth-constraint>
150: </security-constraint>
151: */
152: private void addProtectedBSC(List securityContraints) {
153: WebSecurityMetaData wsmd = new WebSecurityMetaData();
154: securityContraints.add(wsmd);
155: // web-resource-collection/web-resource-name = exact, get method, roleA verifier
156: WebSecurityMetaData.WebResourceCollection wrc = wsmd
157: .addWebResource("exact, get method, roleA verifier");
158: wrc.addPattern("/protected/exact/get/roleA");
159: wrc.addHttpMethod("POST");
160: wrc.addHttpMethod("PUT");
161: wrc.addHttpMethod("HEAD");
162: wrc.addHttpMethod("TRACE");
163: wrc.addHttpMethod("OPTIONS");
164: wrc.addHttpMethod("DELETE");
165:
166: // auth-constraint/role-name = RoleB
167: wsmd.addRole("RoleB");
168: }
169: }
|