Skip to content
This repository was archived by the owner on Nov 15, 2022. It is now read-only.

Commit ea4fd9a

Browse files
SAMEER PANDITyaminikb
SAMEER PANDIT
authored and
yaminikb
committed
NoBug: Security devtests for EL support in JSR 375 (#22255)
1 parent e6a5dbd commit ea4fd9a

13 files changed

Lines changed: 918 additions & 7 deletions

File tree

‎appserver/tests/appserv-tests/devtests/security/soteria/app-custom-identity-store-handler/src/main/java/org/glassfish/soteria/test/ConfigBean.java‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2017 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* https://oss.oracle.com/licenses/CDDL+GPL-1.1
12+
* or LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
package org.glassfish.soteria.test;
41+
42+
import javax.security.enterprise.identitystore.IdentityStore.ValidationType;
43+
import static javax.security.enterprise.identitystore.IdentityStore.ValidationType.PROVIDE_GROUPS;
44+
import static javax.security.enterprise.identitystore.IdentityStore.ValidationType.VALIDATE;
45+
46+
import javax.security.enterprise.identitystore.LdapIdentityStoreDefinition.LdapSearchScope;
47+
import static javax.security.enterprise.identitystore.LdapIdentityStoreDefinition.LdapSearchScope.ONE_LEVEL;
48+
import static javax.security.enterprise.identitystore.LdapIdentityStoreDefinition.LdapSearchScope.SUBTREE;
49+
50+
import javax.enterprise.context.RequestScoped;
51+
import javax.inject.Named;
52+
53+
@RequestScoped
54+
@Named
55+
public class ConfigBean {
56+
private int priority300=300;
57+
private int priority100=100;
58+
private ValidationType[] useforBoth = {ValidationType.VALIDATE, ValidationType.PROVIDE_GROUPS};
59+
private ValidationType[] useforValidate = {ValidationType.VALIDATE};
60+
private ValidationType[] useforProvideGroup = {ValidationType.PROVIDE_GROUPS};
61+
private LdapSearchScope searchScopeOneLevel = ONE_LEVEL;
62+
private LdapSearchScope searchScopeSubTree = SUBTREE;
63+
64+
public int getPriority300(){
65+
return priority300;
66+
}
67+
68+
public int getPriority100(){
69+
return priority100;
70+
}
71+
72+
public ValidationType[] getUseforBoth(){
73+
return useforBoth;
74+
}
75+
76+
public ValidationType[] getUseforValidate(){
77+
return useforValidate;
78+
}
79+
80+
public ValidationType[] getUseforProvideGroup(){
81+
return useforProvideGroup;
82+
}
83+
84+
public LdapSearchScope getSearchScopeOneLevel(){
85+
return ONE_LEVEL;
86+
}
87+
88+
public LdapSearchScope getSearchScopeSubTree(){
89+
return SUBTREE;
90+
}
91+
}

‎appserver/tests/appserv-tests/devtests/security/soteria/app-custom-identity-store-handler/src/main/java/org/glassfish/soteria/test/GroupProviderIdentityStore.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,21 @@
5454
import javax.security.enterprise.identitystore.CredentialValidationResult;
5555
import javax.security.enterprise.identitystore.IdentityStore;
5656
import javax.security.enterprise.identitystore.LdapIdentityStoreDefinition;
57+
import javax.security.enterprise.identitystore.LdapIdentityStoreDefinition.LdapSearchScope;
58+
import javax.security.enterprise.identitystore.IdentityStore.ValidationType;
59+
import static javax.security.enterprise.identitystore.LdapIdentityStoreDefinition.LdapSearchScope.SUBTREE;
60+
import static javax.security.enterprise.identitystore.IdentityStore.ValidationType.VALIDATE;
5761

5862
/**
5963
*
6064
*/
6165
@LdapIdentityStoreDefinition(
6266
url = "ldap://localhost:33389/",
6367
callerBaseDn = "ou=caller,dc=jsr375,dc=net",
68+
callerSearchScope = LdapSearchScope.SUBTREE,
6469
groupSearchBase = "ou=group,dc=jsr375,dc=net",
65-
useForExpression = "#{'VALIDATE'}" // usage of expression just for test
70+
useForExpression = "#{'VALIDATE'}",
71+
groupSearchScopeExpression = "${configBean.searchScopeOneLevel}"
6672
)
6773
@ApplicationScoped
6874
public class GroupProviderIdentityStore implements IdentityStore {

‎appserver/tests/appserv-tests/devtests/security/soteria/app-custom-rememberme/src/main/java/org/glassfish/soteria/test/RememberMeConfigBean.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2017 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* https://oss.oracle.com/licenses/CDDL+GPL-1.1
12+
* or LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
41+
package org.glassfish.soteria.test;
42+
43+
44+
import javax.enterprise.context.RequestScoped;
45+
import javax.inject.Named;
46+
47+
@RequestScoped
48+
@Named
49+
public class RememberMeConfigBean {
50+
51+
private int maxAgeSeconds = 500;
52+
private String cookieName = "GLASSFISHCOOKIE";
53+
private boolean secureOnly = false;
54+
private boolean httpOnly = true;
55+
56+
public int getMaxAgeSeconds() {
57+
return maxAgeSeconds;
58+
}
59+
60+
public String getCookieName() {
61+
return cookieName;
62+
}
63+
64+
public boolean isSecureOnly() {
65+
return secureOnly;
66+
}
67+
68+
public boolean isHttpOnly() {
69+
return httpOnly;
70+
}
71+
}
72+

‎appserver/tests/appserv-tests/devtests/security/soteria/app-custom-rememberme/src/main/java/org/glassfish/soteria/test/TestAuthenticationMechanism.java‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,21 @@
5858
import static javax.security.enterprise.identitystore.CredentialValidationResult.Status.VALID;
5959

6060
@RememberMe(
61-
cookieMaxAgeSeconds = 3600,
62-
cookieSecureOnly = false,
61+
cookieName = "#{self.rememberMeConfigBean.getCookieName()}",
62+
cookieMaxAgeSecondsExpression = "#{self.rememberMeConfigBean.maxAgeSeconds}",
63+
cookieSecureOnlyExpression = "#{self.rememberMeConfigBean.isSecureOnly()}",
64+
cookieHttpOnlyExpression = "#{self.rememberMeConfigBean.httpOnly}",
6365
isRememberMeExpression ="#{self.isRememberMe(httpMessageContext)}"
6466
)
6567
@RequestScoped
6668
public class TestAuthenticationMechanism implements HttpAuthenticationMechanism {
69+
70+
public RememberMeConfigBean getRememberMeConfigBean() {
71+
return rememberMeConfigBean;
72+
}
73+
74+
@Inject
75+
private RememberMeConfigBean rememberMeConfigBean;
6776

6877
@Inject
6978
private IdentityStoreHandler identityStoreHandler;

‎appserver/tests/appserv-tests/devtests/security/soteria/app-custom-rememberme/src/test/java/org/glassfish/soteria/test/AppCustomRememberMeIT.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,17 +77,17 @@ public static Archive<?> createDeployment() {
7777

7878

7979
@Test
80-
public void testHttpOnlyIsFalse() {
80+
public void testHttpOnlyIsTrue() {
8181
readFromServer("/servlet?name=reza&password=secret1&rememberme=true");
8282

83-
assertTrue(getWebClient().getCookieManager().getCookie("JREMEMBERMEID").isHttpOnly());
83+
assertTrue(getWebClient().getCookieManager().getCookie("GLASSFISHCOOKIE").isHttpOnly());
8484
}
8585

8686
@Test
8787
public void testSecureOnlyIsFalse() {
8888
readFromServer("/servlet?name=reza&password=secret1&rememberme=true");
8989

90-
assertFalse(getWebClient().getCookieManager().getCookie("JREMEMBERMEID").isSecure());
90+
assertFalse(getWebClient().getCookieManager().getCookie("GLASSFISHCOOKIE").isSecure());
9191
}
9292

9393
@Test
@@ -180,7 +180,7 @@ public void testAuthenticatedRememberMe() {
180180
// remember me cookie
181181

182182
for (Cookie cookie : getWebClient().getCookieManager().getCookies()) {
183-
if (!"JREMEMBERMEID".equals(cookie.getName())) {
183+
if (!"GLASSFISHCOOKIE".equals(cookie.getName())) {
184184
getWebClient().getCookieManager().removeCookie(cookie);
185185
}
186186
}

‎appserver/tests/appserv-tests/devtests/security/soteria/app-mem-form/pom.xml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
<!--
2+
3+
DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
4+
5+
Copyright (c) 2017 Oracle and/or its affiliates. All rights reserved.
6+
7+
The contents of this file are subject to the terms of either the GNU
8+
General Public License Version 2 only ("GPL") or the Common Development
9+
and Distribution License("CDDL") (collectively, the "License"). You
10+
may not use this file except in compliance with the License. You can
11+
obtain a copy of the License at
12+
https://oss.oracle.com/licenses/CDDL+GPL-1.1
13+
or LICENSE.txt. See the License for the specific
14+
language governing permissions and limitations under the License.
15+
16+
When distributing the software, include this License Header Notice in each
17+
file and include the License file at LICENSE.txt.
18+
19+
GPL Classpath Exception:
20+
Oracle designates this particular file as subject to the "Classpath"
21+
exception as provided by Oracle in the GPL Version 2 section of the License
22+
file that accompanied this code.
23+
24+
Modifications:
25+
If applicable, add the following below the License Header, with the fields
26+
enclosed by brackets [] replaced by your own identifying information:
27+
"Portions Copyright [year] [name of copyright owner]"
28+
29+
Contributor(s):
30+
If you wish your version of this file to be governed by only the CDDL or
31+
only the GPL Version 2, indicate your decision by adding "[Contributor]
32+
elects to include this software in this distribution under the [CDDL or GPL
33+
Version 2] license." If you don't indicate a single choice of license, a
34+
recipient has the option to distribute your version of this file under
35+
either the CDDL, the GPL Version 2 or to extend the choice of license to
36+
its licensees as provided above. However, if you add GPL Version 2 code
37+
and therefore, elected the GPL Version 2 license, then the option applies
38+
only if the new code is made subject to such option by the copyright
39+
holder.
40+
41+
-->
42+
43+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
44+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
45+
<modelVersion>4.0.0</modelVersion>
46+
<parent>
47+
<groupId>org.glassfish.soteria.test</groupId>
48+
<artifactId>soteria</artifactId>
49+
<version>5.0-SNAPSHOT</version>
50+
</parent>
51+
52+
<artifactId>app-mem-form</artifactId>
53+
<packaging>war</packaging>
54+
55+
<build>
56+
<finalName>app-mem-form</finalName>
57+
</build>
58+
59+
<properties>
60+
<failOnMissingWebXml>false</failOnMissingWebXml>
61+
</properties>
62+
63+
<dependencies>
64+
<dependency>
65+
<groupId>org.glassfish.soteria.test</groupId>
66+
<artifactId>common</artifactId>
67+
<version>5.0-SNAPSHOT</version>
68+
<scope>test</scope>
69+
</dependency>
70+
</dependencies>
71+
72+
</project>

‎appserver/tests/appserv-tests/devtests/security/soteria/app-mem-form/src/main/java/org/glassfish/soteria/test/ApplicationConfig.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2017 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* https://oss.oracle.com/licenses/CDDL+GPL-1.1
12+
* or LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
41+
package org.glassfish.soteria.test;
42+
43+
import javax.enterprise.context.ApplicationScoped;
44+
import javax.inject.Named;
45+
46+
47+
@ApplicationScoped
48+
@Named("appConfig")
49+
public class ApplicationConfig {
50+
public String getLoginPage(){
51+
return login_page;
52+
}
53+
private String login_page = "/login-servlet";
54+
private String error_page = "/login-error-servlet";
55+
56+
public String getErrorPage() {
57+
return error_page;
58+
}
59+
}

0 commit comments

Comments
 (0)