Skip to content

Commit 3ce94fd

Browse files
kwartkwart
committed
JBPAPP6-1061 extend EJB JACC policy module tests
1 parent 9fee85d commit 3ce94fd

File tree

6 files changed

+528
-6
lines changed

6 files changed

+528
-6
lines changed

‎testsuite/integration/basic/src/test/java/org/jboss/as/test/integration/security/common/Utils.java‎

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,9 @@
2121
*/
2222
package org.jboss.as.test.integration.security.common;
2323

24-
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP;
25-
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP_ADDR;
26-
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.REMOVE;
27-
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUBSYSTEM;
24+
import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.*;
2825
import static org.jboss.as.security.Constants.SECURITY_DOMAIN;
29-
import static org.junit.Assert.assertEquals;
30-
import static org.junit.Assert.assertTrue;
26+
import static org.junit.Assert.*;
3127

3228
import java.io.File;
3329
import java.io.FileOutputStream;
@@ -642,4 +638,29 @@ public static Asset getJBossWebXmlAsset(final String securityDomain) {
642638
sb.append("\n</jboss-web>");
643639
return new StringAsset(sb.toString());
644640
}
641+
642+
/**
643+
* Creates content of users.properties and/or roles.properties files for given array of role names.
644+
* <p>
645+
* For instance if you provide 2 roles - "role1", "role2" then the result will be:
646+
*
647+
* <pre>
648+
* role1=role1
649+
* role2=role2
650+
* </pre>
651+
*
652+
* If you use it as users.properties and roles.properties, then <code>roleName == userName == password</code>
653+
*
654+
* @param roles role names (used also as user names and passwords)
655+
* @return not-<code>null</code> content of users.properties and/or roles.properties
656+
*/
657+
public static String createUsersFromRoles(String... roles) {
658+
final StringBuilder sb = new StringBuilder();
659+
if (roles != null) {
660+
for (String role : roles) {
661+
sb.append(role).append("=").append(role).append("\n");
662+
}
663+
}
664+
return sb.toString();
665+
}
645666
}

‎testsuite/integration/basic/src/test/java/org/jboss/as/test/integration/security/jacc/JACCAuthzPropagationTestCase.java‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
/*
2+
* JBoss, Home of Professional Open Source.
3+
* Copyright 2012, Red Hat, Inc., and individual contributors
4+
* as indicated by the @author tags. See the copyright.txt file in the
5+
* distribution for a full listing of individual contributors.
6+
*
7+
* This is free software; you can redistribute it and/or modify it
8+
* under the terms of the GNU Lesser General Public License as
9+
* published by the Free Software Foundation; either version 2.1 of
10+
* the License, or (at your option) any later version.
11+
*
12+
* This software is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15+
* Lesser General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU Lesser General Public
18+
* License along with this software; if not, write to the Free
19+
* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20+
* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
21+
*/
22+
package org.jboss.as.test.integration.security.jacc;
23+
24+
import static org.junit.Assert.assertEquals;
25+
26+
import java.io.IOException;
27+
import java.io.UnsupportedEncodingException;
28+
import java.net.MalformedURLException;
29+
import java.net.URISyntaxException;
30+
import java.net.URL;
31+
32+
import org.apache.http.client.ClientProtocolException;
33+
import org.jboss.arquillian.container.test.api.Deployment;
34+
import org.jboss.arquillian.container.test.api.RunAsClient;
35+
import org.jboss.arquillian.junit.Arquillian;
36+
import org.jboss.arquillian.test.api.ArquillianResource;
37+
import org.jboss.as.arquillian.api.ServerSetup;
38+
import org.jboss.as.arquillian.api.ServerSetupTask;
39+
import org.jboss.as.security.Constants;
40+
import org.jboss.as.test.integration.security.common.AbstractSecurityDomainsServerSetupTask;
41+
import org.jboss.as.test.integration.security.common.Utils;
42+
import org.jboss.as.test.integration.security.common.config.SecurityDomain;
43+
import org.jboss.as.test.integration.security.common.config.SecurityModule;
44+
import org.jboss.as.test.integration.security.jacc.propagation.BridgeBean;
45+
import org.jboss.as.test.integration.security.jacc.propagation.Manage;
46+
import org.jboss.as.test.integration.security.jacc.propagation.PropagationTestServlet;
47+
import org.jboss.as.test.integration.security.jacc.propagation.TargetBean;
48+
import org.jboss.as.test.integration.security.loginmodules.UsersRolesLoginModuleTestCase;
49+
import org.jboss.logging.Logger;
50+
import org.jboss.shrinkwrap.api.ShrinkWrap;
51+
import org.jboss.shrinkwrap.api.asset.StringAsset;
52+
import org.jboss.shrinkwrap.api.spec.WebArchive;
53+
import org.junit.Ignore;
54+
import org.junit.Test;
55+
import org.junit.runner.RunWith;
56+
57+
/**
58+
* Tests, which checks run-as identity handling in EJB JACC authorization module.
59+
*
60+
* @author Josef Cacek
61+
*/
62+
@RunWith(Arquillian.class)
63+
@ServerSetup({ JACCAuthzPropagationTestCase.SecurityDomainsSetup.class })
64+
@RunAsClient
65+
public class JACCAuthzPropagationTestCase {
66+
67+
private static final Logger LOGGER = Logger.getLogger(JACCAuthzPropagationTestCase.class);
68+
69+
private static final String TEST_NAME = Manage.TEST_NAME;
70+
71+
// Public methods --------------------------------------------------------
72+
73+
/**
74+
* Creates {@link WebArchive} deployment.
75+
*/
76+
@Deployment(name = "war")
77+
public static WebArchive warDeployment() {
78+
LOGGER.info("Start WAR deployment");
79+
final WebArchive war = ShrinkWrap.create(WebArchive.class, TEST_NAME + ".war");
80+
war.addClasses(PropagationTestServlet.class, Manage.class, BridgeBean.class, TargetBean.class);
81+
final StringAsset usersRolesAsset = new StringAsset(Utils.createUsersFromRoles(Manage.ROLES_ALL));
82+
war.addAsResource(usersRolesAsset, "users.properties");
83+
war.addAsResource(usersRolesAsset, "roles.properties");
84+
85+
war.addAsWebInfResource(UsersRolesLoginModuleTestCase.class.getPackage(), "web-basic-authn.xml", "web.xml");
86+
war.addAsWebInfResource(Utils.getJBossWebXmlAsset(TEST_NAME), "jboss-web.xml");
87+
war.addAsWebInfResource(Utils.getJBossEjb3XmlAsset(TEST_NAME), "jboss-ejb3.xml");
88+
LOGGER.info(war.toString(true));
89+
return war;
90+
91+
}
92+
93+
/**
94+
* Tests direct permissions (RolesAllowed).
95+
*
96+
* @param webAppURL
97+
* @throws Exception
98+
*/
99+
@Test
100+
public void testTarget(@ArquillianResource URL webAppURL) throws Exception {
101+
assertAccessAllowed(webAppURL, Manage.BEAN_NAME_TARGET, PropagationTestServlet.METHOD_NAME_ADMIN, Manage.ROLE_ADMIN);
102+
assertAccessAllowed(webAppURL, Manage.BEAN_NAME_TARGET, PropagationTestServlet.METHOD_NAME_MANAGE, Manage.ROLE_MANAGER);
103+
assertAccessAllowed(webAppURL, Manage.BEAN_NAME_TARGET, PropagationTestServlet.METHOD_NAME_WORK, Manage.ROLE_ADMIN);
104+
105+
assertAccessDenied(webAppURL, Manage.BEAN_NAME_TARGET, PropagationTestServlet.METHOD_NAME_ADMIN, Manage.ROLE_MANAGER);
106+
}
107+
108+
/**
109+
* Tests run-as permissions.
110+
*
111+
* @param webAppURL
112+
* @throws Exception
113+
*/
114+
@Test
115+
@Ignore("JBPAPP6-1686")
116+
public void testBridge(@ArquillianResource URL webAppURL) throws Exception {
117+
assertAccessAllowed(webAppURL, Manage.BEAN_NAME_BRIDGE, PropagationTestServlet.METHOD_NAME_MANAGE, Manage.ROLE_ADMIN);
118+
assertAccessAllowed(webAppURL, Manage.BEAN_NAME_BRIDGE, PropagationTestServlet.METHOD_NAME_MANAGE, Manage.ROLE_MANAGER);
119+
assertAccessAllowed(webAppURL, Manage.BEAN_NAME_BRIDGE, PropagationTestServlet.METHOD_NAME_MANAGE, Manage.ROLE_USER);
120+
assertAccessAllowed(webAppURL, Manage.BEAN_NAME_BRIDGE, PropagationTestServlet.METHOD_NAME_WORK, Manage.ROLE_USER);
121+
122+
assertAccessDenied(webAppURL, Manage.BEAN_NAME_BRIDGE, PropagationTestServlet.METHOD_NAME_ADMIN, Manage.ROLE_ADMIN);
123+
assertAccessDenied(webAppURL, Manage.BEAN_NAME_BRIDGE, PropagationTestServlet.METHOD_NAME_ADMIN, Manage.ROLE_MANAGER);
124+
}
125+
126+
// Private methods -------------------------------------------------------
127+
128+
/**
129+
* Asserts the access to the given method in the given bean is allowed for given role.
130+
*
131+
* @param webAppURL
132+
* @param beanName
133+
* @param methodName
134+
* @param roleName
135+
* @throws ClientProtocolException
136+
* @throws IOException
137+
* @throws URISyntaxException
138+
*/
139+
private void assertAccessAllowed(URL webAppURL, String beanName, String methodName, String roleName)
140+
throws ClientProtocolException, IOException, URISyntaxException {
141+
final URL testUrl = getTestURL(webAppURL, beanName, methodName);
142+
assertEquals("Access of role " + roleName + " to " + methodName + " method in " + beanName + " should be allowed.",
143+
Manage.RESULT, Utils.makeCallWithBasicAuthn(testUrl, roleName, roleName, 200));
144+
}
145+
146+
/**
147+
* Asserts the access to the given method in the given bean is denied for given role.
148+
*
149+
* @param webAppURL
150+
* @param beanName
151+
* @param methodName
152+
* @param roleName
153+
* @throws ClientProtocolException
154+
* @throws IOException
155+
* @throws URISyntaxException
156+
*/
157+
private void assertAccessDenied(URL webAppURL, String beanName, String methodName, String roleName)
158+
throws ClientProtocolException, IOException, URISyntaxException {
159+
final URL testUrl = getTestURL(webAppURL, beanName, methodName);
160+
assertEquals("Access of role " + roleName + " to " + methodName + " method in " + beanName + " should be denied.",
161+
PropagationTestServlet.RESULT_EJB_ACCESS_EXCEPTION,
162+
Utils.makeCallWithBasicAuthn(testUrl, roleName, roleName, 200));
163+
}
164+
165+
/**
166+
* Creates URL of the test application with the given values of request parameters.
167+
*
168+
* @param webAppURL
169+
* @param beanName
170+
* @param method
171+
* @return
172+
* @throws MalformedURLException
173+
* @throws UnsupportedEncodingException
174+
*/
175+
private URL getTestURL(URL webAppURL, String beanName, String method) throws MalformedURLException,
176+
UnsupportedEncodingException {
177+
return new URL(webAppURL.toExternalForm() + PropagationTestServlet.SERVLET_PATH.substring(1) + "?" //
178+
+ PropagationTestServlet.PARAM_BEAN_NAME + "=" + beanName + "&" //
179+
+ PropagationTestServlet.PARAM_METHOD_NAME + "=" + method);
180+
}
181+
182+
// Embedded classes ------------------------------------------------------
183+
184+
/**
185+
* A {@link ServerSetupTask} instance which creates security domains for this test case.
186+
*
187+
* @author Josef Cacek
188+
*/
189+
static class SecurityDomainsSetup extends AbstractSecurityDomainsServerSetupTask {
190+
/**
191+
* @see org.jboss.as.test.integration.security.common.AbstractSecurityDomainsServerSetupTask#getSecurityDomains()
192+
*/
193+
@Override
194+
protected SecurityDomain[] getSecurityDomains() {
195+
return new SecurityDomain[] { new SecurityDomain.Builder().name(TEST_NAME)
196+
.loginModules(new SecurityModule.Builder().name("UsersRoles").flag(Constants.REQUIRED).build()) //
197+
.authorizationModules(new SecurityModule.Builder().name("JACC").flag(Constants.REQUIRED).build()) //
198+
.cacheType("default") //
199+
.build() };
200+
}
201+
}
202+
}

‎testsuite/integration/basic/src/test/java/org/jboss/as/test/integration/security/jacc/propagation/BridgeBean.java‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
* JBoss, Home of Professional Open Source.
3+
* Copyright 2012, Red Hat, Inc., and individual contributors
4+
* as indicated by the @author tags. See the copyright.txt file in the
5+
* distribution for a full listing of individual contributors.
6+
*
7+
* This is free software; you can redistribute it and/or modify it
8+
* under the terms of the GNU Lesser General Public License as
9+
* published by the Free Software Foundation; either version 2.1 of
10+
* the License, or (at your option) any later version.
11+
*
12+
* This software is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15+
* Lesser General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU Lesser General Public
18+
* License along with this software; if not, write to the Free
19+
* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20+
* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
21+
*/
22+
package org.jboss.as.test.integration.security.jacc.propagation;
23+
24+
import javax.annotation.security.DeclareRoles;
25+
import javax.annotation.security.RolesAllowed;
26+
import javax.annotation.security.RunAs;
27+
import javax.ejb.EJB;
28+
import javax.ejb.Stateless;
29+
30+
/**
31+
* Implementation of {@link Manage} interface which has injected {@link TargetBean} EJB and calls it's methods as
32+
* {@link Manage#ROLE_MANAGER} role (using {@link javax.annotation.security.RunAs} annotation). This class is protected, it
33+
* allows access to all test roles. Methods of this class are not protected.
34+
*
35+
* @author Josef Cacek
36+
*/
37+
@Stateless(name = Manage.BEAN_NAME_BRIDGE)
38+
@DeclareRoles({ Manage.ROLE_ADMIN, Manage.ROLE_MANAGER, Manage.ROLE_USER })
39+
@RunAs(Manage.ROLE_MANAGER)
40+
@RolesAllowed({ Manage.ROLE_ADMIN, Manage.ROLE_MANAGER, Manage.ROLE_USER })
41+
public class BridgeBean implements Manage {
42+
43+
@EJB(beanName = Manage.BEAN_NAME_TARGET)
44+
private Manage targetBean = null;
45+
46+
// Public methods --------------------------------------------------------
47+
48+
public String admin() {
49+
return targetBean.admin();
50+
}
51+
52+
public String manage() {
53+
return targetBean.manage();
54+
}
55+
56+
public String work() {
57+
return targetBean.work();
58+
}
59+
60+
}

‎testsuite/integration/basic/src/test/java/org/jboss/as/test/integration/security/jacc/propagation/Manage.java‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
/*
2+
* JBoss, Home of Professional Open Source.
3+
* Copyright 2012, Red Hat, Inc., and individual contributors
4+
* as indicated by the @author tags. See the copyright.txt file in the
5+
* distribution for a full listing of individual contributors.
6+
*
7+
* This is free software; you can redistribute it and/or modify it
8+
* under the terms of the GNU Lesser General Public License as
9+
* published by the Free Software Foundation; either version 2.1 of
10+
* the License, or (at your option) any later version.
11+
*
12+
* This software is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15+
* Lesser General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU Lesser General Public
18+
* License along with this software; if not, write to the Free
19+
* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20+
* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
21+
*/
22+
package org.jboss.as.test.integration.security.jacc.propagation;
23+
24+
/**
25+
* Interface used for testing authorization propagation in the JACC policy module.
26+
*
27+
* @author Josef Cacek
28+
*/
29+
public interface Manage {
30+
31+
String TEST_NAME = "jacc-propagation-test";
32+
33+
String ROLE_ADMIN = "Admin";
34+
String ROLE_MANAGER = "Manager";
35+
String ROLE_USER = "User";
36+
37+
/** All test roles */
38+
String[] ROLES_ALL = { ROLE_ADMIN, ROLE_MANAGER, ROLE_USER };
39+
40+
String BEAN_NAME_TARGET = "TargetBean";
41+
String BEAN_NAME_BRIDGE = "BridgeBean";
42+
43+
/** Default result of methods defined in this interface. */
44+
String RESULT = "OK";
45+
46+
String admin();
47+
48+
String manage();
49+
50+
String work();
51+
52+
}

0 commit comments

Comments
 (0)