http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractTests.java ---------------------------------------------------------------------- diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractTests.java new file mode 100644 index 0000000..6c48d68 --- /dev/null +++ b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractTests.java @@ -0,0 +1,802 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.cxf.fediz.systests.common; + +import java.net.URL; +import java.net.URLEncoder; +import java.util.ArrayList; + +import org.w3c.dom.Document; +import org.w3c.dom.Element; +import org.w3c.dom.Node; + +import com.gargoylesoftware.htmlunit.CookieManager; +import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException; +import com.gargoylesoftware.htmlunit.HttpMethod; +import com.gargoylesoftware.htmlunit.WebClient; +import com.gargoylesoftware.htmlunit.WebRequest; +import com.gargoylesoftware.htmlunit.html.DomElement; +import com.gargoylesoftware.htmlunit.html.DomNodeList; +import com.gargoylesoftware.htmlunit.html.HtmlForm; +import com.gargoylesoftware.htmlunit.html.HtmlPage; +import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; +import com.gargoylesoftware.htmlunit.util.NameValuePair; +import com.gargoylesoftware.htmlunit.xml.XmlPage; + +import org.apache.commons.io.IOUtils; +import org.apache.cxf.fediz.core.ClaimTypes; +import org.apache.cxf.fediz.core.FederationConstants; +import org.apache.cxf.fediz.core.util.DOMUtils; +import org.apache.http.auth.AuthScope; +import org.apache.http.auth.UsernamePasswordCredentials; +import org.apache.wss4j.dom.engine.WSSConfig; +import org.apache.xml.security.keys.KeyInfo; +import org.apache.xml.security.signature.XMLSignature; +import org.junit.Assert; +import org.junit.Test; + +public abstract class AbstractTests { + + static { + WSSConfig.init(); + } + + public AbstractTests() { + super(); + } + + public abstract String getServletContextName(); + + public abstract String getIdpHttpsPort(); + + public abstract String getRpHttpsPort(); + + @Test + public void testAlice() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + final String bodyTextContent = + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=false")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=false")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=true")); + + String claim = ClaimTypes.FIRSTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'", + bodyTextContent.contains(claim + "=Alice")); + claim = ClaimTypes.LASTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'", + bodyTextContent.contains(claim + "=Smith")); + claim = ClaimTypes.EMAILADDRESS.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", + bodyTextContent.contains(claim + "[email protected]")); + + } + + @Test + public void testAliceUser() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/user/fedservlet"; + String user = "alice"; + String password = "ecila"; + + final String bodyTextContent = + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=false")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=false")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=true")); + } + + @Test + public void testAliceAdminNoAccess() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/admin/fedservlet"; + String user = "alice"; + String password = "ecila"; + + try { + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + Assert.fail("Exception expected"); + } catch (FailingHttpStatusCodeException ex) { + Assert.assertEquals(ex.getStatusCode(), 403); + } + } + + @Test + public void testAliceManagerNoAccess() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/manager/fedservlet"; + String user = "alice"; + String password = "ecila"; + + try { + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + Assert.fail("Exception expected"); + } catch (FailingHttpStatusCodeException ex) { + Assert.assertEquals(ex.getStatusCode(), 403); + } + } + + @Test + public void testAliceWrongPasswordNoAccess() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "alice"; + String password = "alice"; + + try { + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + Assert.fail("Exception expected"); + } catch (FailingHttpStatusCodeException ex) { + Assert.assertEquals(ex.getStatusCode(), 401); + } + } + + @Test + public void testBob() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "bob"; + String password = "bob"; + + final String bodyTextContent = + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=true")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=true")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=true")); + + String claim = ClaimTypes.FIRSTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Bob'", + bodyTextContent.contains(claim + "=Bob")); + claim = ClaimTypes.LASTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Windsor'", + bodyTextContent.contains(claim + "=Windsor")); + claim = ClaimTypes.EMAILADDRESS.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", + bodyTextContent.contains(claim + "[email protected]")); + } + + @Test + public void testBobUser() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/user/fedservlet"; + String user = "bob"; + String password = "bob"; + + final String bodyTextContent = + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=true")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=true")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=true")); + } + + @Test + public void testBobManager() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/manager/fedservlet"; + String user = "bob"; + String password = "bob"; + + final String bodyTextContent = + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=true")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=true")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=true")); + } + + @Test + public void testBobAdmin() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/admin/fedservlet"; + String user = "bob"; + String password = "bob"; + + final String bodyTextContent = + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=true")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=true")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=true")); + } + + @Test + public void testTed() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "ted"; + String password = "det"; + + final String bodyTextContent = + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=false")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=false")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=false")); + + String claim = ClaimTypes.FIRSTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Ted'", + bodyTextContent.contains(claim + "=Ted")); + claim = ClaimTypes.LASTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Cooper'", + bodyTextContent.contains(claim + "=Cooper")); + claim = ClaimTypes.EMAILADDRESS.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", + bodyTextContent.contains(claim + "[email protected]")); + } + + @Test + public void testTedUserNoAccess() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/user/fedservlet"; + String user = "ted"; + String password = "det"; + + try { + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + Assert.fail("Exception expected"); + } catch (FailingHttpStatusCodeException ex) { + Assert.assertEquals(ex.getStatusCode(), 403); + } + } + + @Test + public void testTedAdminNoAccess() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/admin/fedservlet"; + String user = "ted"; + String password = "det"; + + try { + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + Assert.fail("Exception expected"); + } catch (FailingHttpStatusCodeException ex) { + Assert.assertEquals(ex.getStatusCode(), 403); + } + } + + @Test + public void testTedManagerNoAccess() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/manager/fedservlet"; + String user = "ted"; + String password = "det"; + + try { + HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); + Assert.fail("Exception expected"); + } catch (FailingHttpStatusCodeException ex) { + Assert.assertEquals(ex.getStatusCode(), 403); + } + } + + @Test + public void testRPMetadata() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + + "/" + getServletContextName() + "/FederationMetadata/2007-06/FederationMetadata.xml"; + + final WebClient webClient = new WebClient(); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getOptions().setSSLClientCertificate( + this.getClass().getClassLoader().getResource("client.jks"), "storepass", "jks"); + + final XmlPage rpPage = webClient.getPage(url); + final String xmlContent = rpPage.asXml(); + Assert.assertTrue(xmlContent.startsWith("<md:EntityDescriptor")); + + // Now validate the Signature + Document doc = rpPage.getXmlDocument(); + + doc.getDocumentElement().setIdAttributeNS(null, "ID", true); + + Node signatureNode = + DOMUtils.getChild(doc.getDocumentElement(), "Signature"); + Assert.assertNotNull(signatureNode); + + XMLSignature signature = new XMLSignature((Element)signatureNode, ""); + KeyInfo ki = signature.getKeyInfo(); + Assert.assertNotNull(ki); + Assert.assertNotNull(ki.getX509Certificate()); + + Assert.assertTrue(signature.checkSignatureValue(ki.getX509Certificate())); + + // webClient.close(); + } + + @Test + public void testRPLogout() throws Exception { + + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + CookieManager cookieManager = new CookieManager(); + + // 1. Login + HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); + + // 2. Now we should have a cookie from the RP and IdP and should be able to do + // subsequent requests without authenticate again. Lets test this first. + WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + final HtmlPage rpPage = webClient.getPage(url); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + // 3. now we logout from RP + String rpLogoutUrl = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/logout"; + + HTTPTestUtils.logout(rpLogoutUrl, cookieManager); + + // 4. now we try to access the RP and idp without authentication but with the existing cookies + // to see if we are really logged out + + // webClient.close(); + webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); + final HtmlPage idpPage = webClient.getPage(url); + + Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); + + // webClient.close(); + } + + @Test + public void testRPLogoutViaAction() throws Exception { + + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + CookieManager cookieManager = new CookieManager(); + + // 1. Login + HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); + + // 2. Now we should have a cookie from the RP and IdP and should be able to do + // subsequent requests without authenticate again. Lets test this first. + WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + final HtmlPage rpPage = webClient.getPage(url); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + // 3. now we logout from RP + String rpLogoutUrl = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet?wa=" + FederationConstants.ACTION_SIGNOUT; + + HTTPTestUtils.logout(rpLogoutUrl, cookieManager); + + // 4. now we try to access the RP and idp without authentication but with the existing cookies + // to see if we are really logged out + + // webClient.close(); + webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); + final HtmlPage idpPage = webClient.getPage(url); + + Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); + + // webClient.close(); + } + + @Test + public void testIdPLogout() throws Exception { + + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + CookieManager cookieManager = new CookieManager(); + + // 1. Login + HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); + + // 2. Now we should have a cookie from the RP and IdP and should be able to do + // subsequent requests without authenticate again. Lets test this first. + WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + final HtmlPage rpPage = webClient.getPage(url); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + // 3. now we logout from IdP + String idpLogoutUrl = "https://localhost:"; + getIdpHttpsPort() + "/fediz-idp/federation?wa=" + + FederationConstants.ACTION_SIGNOUT; //todo logout url on idp?!? + + HTTPTestUtils.logout(idpLogoutUrl, cookieManager); + + // 4. now we try to access the RP and idp without authentication but with the existing cookies + // to see if we are really logged out + + // webClient.close(); + webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); + final HtmlPage idpPage = webClient.getPage(url); + + Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); + + // webClient.close(); + } + + @Test + public void testIdPLogoutCleanup() throws Exception { + + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + CookieManager cookieManager = new CookieManager(); + + // 1. Login + HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); + + // 2. Now we should have a cookie from the RP and IdP and should be able to do + // subsequent requests without authenticate again. Lets test this first. + WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + final HtmlPage rpPage = webClient.getPage(url); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + // 3. now we logout from IdP + String idpLogoutUrl = "https://localhost:"; + getIdpHttpsPort() + "/fediz-idp/federation?wa=" + + FederationConstants.ACTION_SIGNOUT_CLEANUP; + + HTTPTestUtils.logoutCleanup(idpLogoutUrl, cookieManager); + + // 4. now we try to access the RP and idp without authentication but with the existing cookies + // to see if we are really logged out + + // webClient.close(); + webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); + final HtmlPage idpPage = webClient.getPage(url); + + Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); + + // webClient.close(); + } + + @Test + public void testAliceModifiedSignature() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + // Get the initial token + CookieManager cookieManager = new CookieManager(); + final WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), + new UsernamePasswordCredentials(user, password)); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage = webClient.getPage(url); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + // Parse the form to get the token (wresult) + DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); + + for (DomElement result : results) { + if ("wresult".equals(result.getAttributeNS(null, "name"))) { + // Now modify the Signature + String value = result.getAttributeNS(null, "value"); + value = value.replace("alice", "bob"); + result.setAttributeNS(null, "value", value); + } + } + + // Invoke back on the RP + + final HtmlForm form = idpPage.getFormByName("signinresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + + try { + button.click(); + Assert.fail("Failure expected on a modified signature"); + } catch (FailingHttpStatusCodeException ex) { + // expected + Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode()); + } + + // webClient.close(); + } + + @Test + public void testConcurrentRequests() throws Exception { + + String url1 = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; + String url2 = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/test.html"; + String user = "bob"; + String password = "bob"; + + // Get the initial token + CookieManager cookieManager = new CookieManager(); + final WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), + new UsernamePasswordCredentials(user, password)); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage1 = webClient.getPage(url1); + final HtmlPage idpPage2 = webClient.getPage(url2); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage1.getTitleText()); + Assert.assertEquals("IDP SignIn Response Form", idpPage2.getTitleText()); + + // Invoke back on the page1 RP + final HtmlForm form = idpPage1.getFormByName("signinresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + final HtmlPage rpPage1 = button.click(); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage1.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage1.getTitleText())); + + String bodyTextContent1 = rpPage1.getBody().getTextContent(); + + Assert.assertTrue("Principal not " + user, + bodyTextContent1.contains("userPrincipal=" + user)); + + // Invoke back on the page2 RP + final HtmlForm form2 = idpPage2.getFormByName("signinresponseform"); + final HtmlSubmitInput button2 = form2.getInputByName("_eventId_submit"); + final HtmlPage rpPage2 = button2.click(); + String bodyTextContent2 = rpPage2.getBody().getTextContent(); + + Assert.assertTrue("Unexpected content of RP page", bodyTextContent2.contains("Secure Test")); + + // webClient.close(); + } + + @org.junit.Test + public void testMaliciousRedirect() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + CookieManager cookieManager = new CookieManager(); + + // 1. Login + HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); + + // 2. Now we should have a cookie from the RP and IdP and should be able to do + // subsequent requests without authenticate again. Lets test this first. + WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + HtmlPage rpPage = webClient.getPage(url); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + // 3. Now a malicious user sends the client a URL with a bad "wreply" address to the IdP + String maliciousURL = "https://www.apache.org/attack";; + String idpUrl + = "https://localhost:"; + getIdpHttpsPort() + "/fediz-idp/federation"; + idpUrl += "?wa=wsignin1.0&wreply=" + URLEncoder.encode(maliciousURL, "UTF-8"); + idpUrl += "&wtrealm=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Afedizhelloworld"; + idpUrl += "&whr=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Aidp%3Arealm-A"; + // webClient.close(); + + final WebClient webClient2 = new WebClient(); + webClient2.setCookieManager(cookieManager); + webClient2.getOptions().setUseInsecureSSL(true); + webClient2.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), + new UsernamePasswordCredentials(user, password)); + + webClient2.getOptions().setJavaScriptEnabled(false); + try { + webClient2.getPage(idpUrl); + Assert.fail("Failure expected on a bad wreply address"); + } catch (FailingHttpStatusCodeException ex) { + Assert.assertEquals(ex.getStatusCode(), 400); + } + // webClient2.close(); + } + + @Test + public void testEntityExpansionAttack() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + // Get the initial token + CookieManager cookieManager = new CookieManager(); + final WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), + new UsernamePasswordCredentials(user, password)); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage = webClient.getPage(url); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + // Parse the form to get the token (wresult) + DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); + + String entity = IOUtils.toString(this.getClass().getClassLoader().getResource("entity.xml").openStream()); + String reference = "&m;"; + + for (DomElement result : results) { + if ("wresult".equals(result.getAttributeNS(null, "name"))) { + // Now modify the Signature + String value = result.getAttributeNS(null, "value"); + value = entity + value; + value = value.replace("alice", reference); + result.setAttributeNS(null, "value", value); + } + } + + // Invoke back on the RP + + final HtmlForm form = idpPage.getFormByName("signinresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + + try { + button.click(); + Assert.fail("Failure expected on an entity expansion attack"); + } catch (FailingHttpStatusCodeException ex) { + // expected + Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode()); + } + + // webClient.close(); + } + + @org.junit.Test + public void testCSRFAttack() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; + csrfAttackTest(url); + } + + protected void csrfAttackTest(String rpURL) throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; + String user = "alice"; + String password = "ecila"; + + // 1. Log in as "alice" + WebClient webClient = new WebClient(); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), + new UsernamePasswordCredentials(user, password)); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage = webClient.getPage(url); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + final HtmlForm form = idpPage.getFormByName("signinresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + + final HtmlPage rpPage = button.click(); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + + // 2. Log in as "bob" using another WebClient + WebClient webClient2 = new WebClient(); + webClient2.getOptions().setUseInsecureSSL(true); + webClient2.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), + new UsernamePasswordCredentials("bob", "bob")); + + webClient2.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage2 = webClient2.getPage(url); + webClient2.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage2.getTitleText()); + + // 3. Now instead of clicking on the form, send the form via alice's WebClient instead + + // Send with context... + WebRequest request = new WebRequest(new URL(rpURL), HttpMethod.POST); + request.setRequestParameters(new ArrayList<NameValuePair>()); + + DomNodeList<DomElement> results = idpPage2.getElementsByTagName("input"); + + for (DomElement result : results) { + if ("wresult".equals(result.getAttributeNS(null, "name")) + || "wa".equals(result.getAttributeNS(null, "name")) + || "wctx".equals(result.getAttributeNS(null, "name"))) { + String value = result.getAttributeNS(null, "value"); + request.getRequestParameters().add(new NameValuePair(result.getAttributeNS(null, "name"), value)); + } + } + + try { + webClient.getPage(request); + Assert.fail("Failure expected on a CSRF attack"); + } catch (FailingHttpStatusCodeException ex) { + // expected + } + + // webClient.close(); + + } + +}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/HTTPTestUtils.java ---------------------------------------------------------------------- diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/HTTPTestUtils.java b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/HTTPTestUtils.java new file mode 100644 index 0000000..4c2a694 --- /dev/null +++ b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/HTTPTestUtils.java @@ -0,0 +1,155 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.cxf.fediz.systests.common; + +import java.io.IOException; + +import com.gargoylesoftware.htmlunit.CookieManager; +import com.gargoylesoftware.htmlunit.WebClient; +import com.gargoylesoftware.htmlunit.html.DomElement; +import com.gargoylesoftware.htmlunit.html.DomNodeList; +import com.gargoylesoftware.htmlunit.html.HtmlForm; +import com.gargoylesoftware.htmlunit.html.HtmlPage; +import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; + +import org.apache.http.auth.AuthScope; +import org.apache.http.auth.UsernamePasswordCredentials; +import org.junit.Assert; + +/** + * Some basic HTTP-based functionality for use in the tests + */ +public final class HTTPTestUtils { + + private HTTPTestUtils() { + // complete + } + + public static String login(String url, String user, String password, String idpPort) throws IOException { + final WebClient webClient = new WebClient(); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(idpPort)), + new UsernamePasswordCredentials(user, password)); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage = webClient.getPage(url); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + final HtmlForm form = idpPage.getFormByName("signinresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + + final HtmlPage rpPage = button.click(); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + // webClient.close(); + return rpPage.getBody().getTextContent(); + } + + public static String loginForSAMLSSO(String url, String user, String password, String idpPort) throws IOException { + final WebClient webClient = new WebClient(); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(idpPort)), + new UsernamePasswordCredentials(user, password)); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage rpPage = webClient.getPage(url); + + // webClient.close(); + return rpPage.getBody().getTextContent(); + } + + public static String loginWithCookieManager(String url, String user, String password, + String idpPort, CookieManager cookieManager) throws IOException { + final WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getCredentialsProvider().setCredentials( + new AuthScope("localhost", Integer.parseInt(idpPort)), + new UsernamePasswordCredentials(user, password)); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage = webClient.getPage(url); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + final HtmlForm form = idpPage.getFormByName("signinresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + + final HtmlPage rpPage = button.click(); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + // webClient.close(); + return rpPage.getBody().getTextContent(); + } + + public static void logout(String url, CookieManager cookieManager) throws IOException { + final WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + final HtmlPage idpPage = webClient.getPage(url); + + Assert.assertEquals("IDP SignOut Confirmation Response Page", idpPage.getTitleText()); + + final HtmlForm form = idpPage.getFormByName("signoutconfirmationresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + final HtmlPage idpLogoutPage = button.click(); + + DomNodeList<DomElement> images = idpLogoutPage.getElementsByTagName("img"); + Assert.assertEquals(1, images.getLength()); + for (int i = 0; i < images.size(); i++) { + DomElement domElement = images.get(i); + String imgSrc = domElement.getAttribute("src"); + + //we should get a fault if the image isn't available. + webClient.getPage(imgSrc); + } + + // webClient.close(); + } + + public static void logoutCleanup(String url, CookieManager cookieManager) throws IOException { + final WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + final HtmlPage idpPage = webClient.getPage(url); + + Assert.assertEquals("IDP SignOut Response Page", idpPage.getTitleText()); + + Assert.assertTrue(idpPage.asText().contains("CXF Fediz IDP successful logout")); + + DomNodeList<DomElement> images = idpPage.getElementsByTagName("img"); + Assert.assertEquals(1, images.getLength()); + for (int i = 0; i < images.size(); i++) { + DomElement domElement = images.get(i); + String imgSrc = domElement.getAttribute("src"); + + //we should get a fault if the image isn't available. + webClient.getPage(imgSrc); + } + + // webClient.close(); + } + +} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tomcat8/pom.xml ---------------------------------------------------------------------- diff --git a/systests/tomcat8/pom.xml b/systests/tomcat8/pom.xml index c824443..254ca34 100644 --- a/systests/tomcat8/pom.xml +++ b/systests/tomcat8/pom.xml @@ -190,7 +190,7 @@ <java.util.logging.config.file>${basedir}/target/test-classes/logging.properties</java.util.logging.config.file> </systemPropertyVariables> <includes> - <include>**/integrationtests/**</include> + <include>**/systests/**</include> </includes> <argLine>-Xms512m -Xmx1024m -XX:MaxPermSize=256m </argLine> <!--argLine>-Xms512m -Xmx1024m -XX:MaxPermSize=256m -Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=y</argLine--> @@ -205,16 +205,6 @@ </execution> </executions> </plugin> - <plugin> - <groupId>org.apache.maven.plugins</groupId> - <artifactId>maven-surefire-plugin</artifactId> - <inherited>true</inherited> - <configuration> - <excludes> - <exclude>**/integrationtests/**</exclude> - </excludes> - </configuration> - </plugin> </plugins> </build> </project> http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/AudienceRestrictionTest.java ---------------------------------------------------------------------- diff --git a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/AudienceRestrictionTest.java b/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/AudienceRestrictionTest.java deleted file mode 100644 index efcecbf..0000000 --- a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/AudienceRestrictionTest.java +++ /dev/null @@ -1,210 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - - -import java.io.File; -import java.io.FileInputStream; -import java.io.FileOutputStream; -import java.io.IOException; - -import javax.servlet.ServletException; - -import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException; -import com.gargoylesoftware.htmlunit.WebClient; -import com.gargoylesoftware.htmlunit.html.HtmlForm; -import com.gargoylesoftware.htmlunit.html.HtmlPage; -import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; - -import org.apache.catalina.Context; -import org.apache.catalina.LifecycleException; -import org.apache.catalina.LifecycleState; -import org.apache.catalina.connector.Connector; -import org.apache.catalina.startup.Tomcat; -import org.apache.commons.io.IOUtils; -import org.apache.cxf.fediz.tomcat8.FederationAuthenticator; -import org.apache.http.auth.AuthScope; -import org.apache.http.auth.UsernamePasswordCredentials; -import org.junit.AfterClass; -import org.junit.Assert; -import org.junit.BeforeClass; - -/** - * A test to make sure that audience restriction validation is working correctly in the plugin. - */ -public class AudienceRestrictionTest { - - static String idpHttpsPort; - static String rpHttpsPort; - - private static Tomcat idpServer; - private static Tomcat rpServer; - - @BeforeClass - public static void init() throws Exception { - System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog"); - System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true"); - System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.webflow", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.security.web", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf.fediz", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf", "info"); - - idpHttpsPort = System.getProperty("idp.https.port"); - Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort); - rpHttpsPort = System.getProperty("rp.https.port"); - Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort); - - idpServer = startServer(true, idpHttpsPort); - rpServer = startServer(false, rpHttpsPort); - } - - private static Tomcat startServer(boolean idp, String port) - throws ServletException, LifecycleException, IOException { - Tomcat server = new Tomcat(); - server.setPort(0); - String currentDir = new File(".").getCanonicalPath(); - String baseDir = currentDir + File.separator + "target"; - server.setBaseDir(baseDir); - - if (idp) { - server.getHost().setAppBase("tomcat/idp/webapps"); - } else { - server.getHost().setAppBase("tomcat/rp/webapps"); - } - server.getHost().setAutoDeploy(true); - server.getHost().setDeployOnStartup(true); - - Connector httpsConnector = new Connector(); - httpsConnector.setPort(Integer.parseInt(port)); - httpsConnector.setSecure(true); - httpsConnector.setScheme("https"); - //httpsConnector.setAttribute("keyAlias", keyAlias); - httpsConnector.setAttribute("keystorePass", "tompass"); - httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("truststorePass", "tompass"); - httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("clientAuth", "want"); - // httpsConnector.setAttribute("clientAuth", "false"); - httpsConnector.setAttribute("sslProtocol", "TLS"); - httpsConnector.setAttribute("SSLEnabled", true); - - server.getService().addConnector(httpsConnector); - - if (idp) { - File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts"); - server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath()); - - File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp"); - server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath()); - } else { - File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "simpleWebapp"); - Context cxt = server.addWebapp("/fedizhelloworld", rpWebapp.getAbsolutePath()); - - // Substitute the IDP port. Necessary if running the test in eclipse where port filtering doesn't seem - // to work - File f = new File(currentDir + "/src/test/resources/fediz_config_aud_restr.xml"); - FileInputStream inputStream = new FileInputStream(f); - String content = IOUtils.toString(inputStream, "UTF-8"); - inputStream.close(); - if (content.contains("idp.https.port")) { - content = content.replaceAll("\\$\\{idp.https.port\\}", "" + idpHttpsPort); - - File f2 = new File(baseDir + "/test-classes/fediz_config_aud_restr.xml"); - try (FileOutputStream outputStream = new FileOutputStream(f2)) { - IOUtils.write(content, outputStream, "UTF-8"); - } - } - - FederationAuthenticator fa = new FederationAuthenticator(); - fa.setConfigFile(currentDir + File.separator + "target" + File.separator - + "test-classes" + File.separator + "fediz_config_aud_restr.xml"); - cxt.getPipeline().addValve(fa); - } - - server.start(); - - return server; - } - - @AfterClass - public static void cleanup() { - shutdownServer(idpServer); - shutdownServer(rpServer); - } - - private static void shutdownServer(Tomcat server) { - try { - if (server != null && server.getServer() != null - && server.getServer().getState() != LifecycleState.DESTROYED) { - if (server.getServer().getState() != LifecycleState.STOPPED) { - server.stop(); - } - server.destroy(); - } - } catch (Exception e) { - e.printStackTrace(); - } - } - - public String getIdpHttpsPort() { - return idpHttpsPort; - } - - public String getRpHttpsPort() { - return rpHttpsPort; - } - - public String getServletContextName() { - return "fedizhelloworld"; - } - - @org.junit.Test - public void testSAMLTokenWithNonMatchingAudienceRestriction() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/fedizhelloworld/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - final WebClient webClient = new WebClient(); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - try { - button.click(); - Assert.fail("Failure expected on a bad audience restriction value"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 401); - } - - webClient.close(); - } - -} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/ClientCertificateTest.java ---------------------------------------------------------------------- diff --git a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/ClientCertificateTest.java b/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/ClientCertificateTest.java deleted file mode 100644 index a2c5a6b..0000000 --- a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/ClientCertificateTest.java +++ /dev/null @@ -1,172 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - -import java.io.File; -import java.io.FileInputStream; -import java.io.FileOutputStream; -import java.io.IOException; - -import javax.servlet.ServletException; - -import org.apache.catalina.Context; -import org.apache.catalina.LifecycleException; -import org.apache.catalina.LifecycleState; -import org.apache.catalina.connector.Connector; -import org.apache.catalina.startup.Tomcat; -import org.apache.commons.io.IOUtils; -import org.apache.cxf.fediz.tomcat8.FederationAuthenticator; -import org.junit.AfterClass; -import org.junit.Assert; -import org.junit.BeforeClass; - -/** - * In this test-case, the IdP is set up to require client authentication, rather than authenticating using a - * username + password, or via Kerberos. - */ -public class ClientCertificateTest extends AbstractClientCertTests { - - static String idpHttpsPort; - static String rpHttpsPort; - - private static Tomcat idpServer; - private static Tomcat rpServer; - - @BeforeClass - public static void init() throws Exception { - System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog"); - System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true"); - System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.webflow", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.security.web", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf.fediz", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf", "info"); - - idpHttpsPort = System.getProperty("idp.https.port"); - Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort); - rpHttpsPort = System.getProperty("rp.https.port"); - Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort); - - idpServer = startServer(true, idpHttpsPort); - rpServer = startServer(false, rpHttpsPort); - } - - private static Tomcat startServer(boolean idp, String port) - throws ServletException, LifecycleException, IOException { - Tomcat server = new Tomcat(); - server.setPort(0); - String currentDir = new File(".").getCanonicalPath(); - String baseDir = currentDir + File.separator + "target"; - server.setBaseDir(baseDir); - - if (idp) { - server.getHost().setAppBase("tomcat/idp/webapps"); - } else { - server.getHost().setAppBase("tomcat/rp/webapps"); - } - server.getHost().setAutoDeploy(true); - server.getHost().setDeployOnStartup(true); - - Connector httpsConnector = new Connector(); - httpsConnector.setPort(Integer.parseInt(port)); - httpsConnector.setSecure(true); - httpsConnector.setScheme("https"); - //httpsConnector.setAttribute("keyAlias", keyAlias); - httpsConnector.setAttribute("keystorePass", "tompass"); - httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("truststorePass", "tompass"); - httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("clientAuth", "want"); - // httpsConnector.setAttribute("clientAuth", "false"); - httpsConnector.setAttribute("sslProtocol", "TLS"); - httpsConnector.setAttribute("SSLEnabled", true); - - server.getService().addConnector(httpsConnector); - - if (idp) { - File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts"); - server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath()); - - File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp"); - server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath()); - } else { - File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "simpleWebapp"); - Context cxt = server.addWebapp("/fedizhelloworld", rpWebapp.getAbsolutePath()); - - // Substitute the IDP port. Necessary if running the test in eclipse where port filtering doesn't seem - // to work - File f = new File(currentDir + "/src/test/resources/fediz_config_client_cert.xml"); - FileInputStream inputStream = new FileInputStream(f); - String content = IOUtils.toString(inputStream, "UTF-8"); - inputStream.close(); - if (content.contains("idp.https.port")) { - content = content.replaceAll("\\$\\{idp.https.port\\}", "" + idpHttpsPort); - - File f2 = new File(baseDir + "/test-classes/fediz_config_client_cert.xml"); - try (FileOutputStream outputStream = new FileOutputStream(f2)) { - IOUtils.write(content, outputStream, "UTF-8"); - } - } - - FederationAuthenticator fa = new FederationAuthenticator(); - fa.setConfigFile(currentDir + File.separator + "target" + File.separator - + "test-classes" + File.separator + "fediz_config_client_cert.xml"); - cxt.getPipeline().addValve(fa); - } - - server.start(); - - return server; - } - - @AfterClass - public static void cleanup() { - shutdownServer(idpServer); - shutdownServer(rpServer); - } - - private static void shutdownServer(Tomcat server) { - try { - if (server != null && server.getServer() != null - && server.getServer().getState() != LifecycleState.DESTROYED) { - if (server.getServer().getState() != LifecycleState.STOPPED) { - server.stop(); - } - server.destroy(); - } - } catch (Exception e) { - e.printStackTrace(); - } - } - - public String getIdpHttpsPort() { - return idpHttpsPort; - } - - public String getRpHttpsPort() { - return rpHttpsPort; - } - - public String getServletContextName() { - return "fedizhelloworld"; - } - -} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HOKCallbackHandler.java ---------------------------------------------------------------------- diff --git a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HOKCallbackHandler.java b/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HOKCallbackHandler.java deleted file mode 100644 index a323696..0000000 --- a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HOKCallbackHandler.java +++ /dev/null @@ -1,48 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - -import java.io.IOException; - -import javax.security.auth.callback.Callback; -import javax.security.auth.callback.CallbackHandler; -import javax.security.auth.callback.UnsupportedCallbackException; - -import org.apache.cxf.fediz.core.spi.WReqCallback; - -public class HOKCallbackHandler implements CallbackHandler { - - static final String HOK_WREQ = - "<RequestSecurityToken xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\";>" - + "<KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</KeyType>" - + "</RequestSecurityToken>"; - - public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { - for (int i = 0; i < callbacks.length; i++) { - if (callbacks[i] instanceof WReqCallback) { - WReqCallback callback = (WReqCallback) callbacks[i]; - callback.setWreq(HOK_WREQ); - } else { - throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback"); - } - } - } - -} \ No newline at end of file http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HolderOfKeyTest.java ---------------------------------------------------------------------- diff --git a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HolderOfKeyTest.java b/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HolderOfKeyTest.java deleted file mode 100644 index 2abb4b4..0000000 --- a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/HolderOfKeyTest.java +++ /dev/null @@ -1,244 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - -import java.io.File; -import java.io.FileInputStream; -import java.io.FileOutputStream; -import java.io.IOException; - -import javax.servlet.ServletException; - -import com.gargoylesoftware.htmlunit.WebClient; -import com.gargoylesoftware.htmlunit.html.DomElement; -import com.gargoylesoftware.htmlunit.html.DomNodeList; -import com.gargoylesoftware.htmlunit.html.HtmlForm; -import com.gargoylesoftware.htmlunit.html.HtmlPage; -import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; - -import org.apache.catalina.Context; -import org.apache.catalina.LifecycleException; -import org.apache.catalina.LifecycleState; -import org.apache.catalina.connector.Connector; -import org.apache.catalina.startup.Tomcat; -import org.apache.commons.io.IOUtils; -import org.apache.cxf.fediz.core.ClaimTypes; -import org.apache.cxf.fediz.tomcat8.FederationAuthenticator; -import org.apache.http.auth.AuthScope; -import org.apache.http.auth.UsernamePasswordCredentials; -import org.junit.AfterClass; -import org.junit.Assert; -import org.junit.BeforeClass; - -/** - * A test for sending a "PublicKey" KeyType request to the IdP via the "wreq" parameter. This - * will cause the IdP/STS to issue a "HolderOfKey" SAML Assertion. - */ -public class HolderOfKeyTest { - - static String idpHttpsPort; - static String rpHttpsPort; - - private static Tomcat idpServer; - private static Tomcat rpServer; - - @BeforeClass - public static void init() throws Exception { - System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog"); - System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true"); - System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.webflow", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.security.web", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf.fediz", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf", "info"); - - idpHttpsPort = System.getProperty("idp.https.port"); - Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort); - rpHttpsPort = System.getProperty("rp.https.port"); - Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort); - - idpServer = startServer(true, idpHttpsPort); - rpServer = startServer(false, rpHttpsPort); - } - - private static Tomcat startServer(boolean idp, String port) - throws ServletException, LifecycleException, IOException { - Tomcat server = new Tomcat(); - server.setPort(0); - String currentDir = new File(".").getCanonicalPath(); - String baseDir = currentDir + File.separator + "target"; - server.setBaseDir(baseDir); - - if (idp) { - server.getHost().setAppBase("tomcat/idp/webapps"); - } else { - server.getHost().setAppBase("tomcat/rp/webapps"); - } - server.getHost().setAutoDeploy(true); - server.getHost().setDeployOnStartup(true); - - Connector httpsConnector = new Connector(); - httpsConnector.setPort(Integer.parseInt(port)); - httpsConnector.setSecure(true); - httpsConnector.setScheme("https"); - //httpsConnector.setAttribute("keyAlias", keyAlias); - httpsConnector.setAttribute("keystorePass", "tompass"); - httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("truststorePass", "tompass"); - httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("clientAuth", "want"); - // httpsConnector.setAttribute("clientAuth", "false"); - httpsConnector.setAttribute("sslProtocol", "TLS"); - httpsConnector.setAttribute("SSLEnabled", true); - - server.getService().addConnector(httpsConnector); - - if (idp) { - File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts"); - server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath()); - - File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp"); - server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath()); - } else { - File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "simpleWebapp"); - Context cxt = server.addWebapp("/fedizhelloworld", rpWebapp.getAbsolutePath()); - - // Substitute the IDP port. Necessary if running the test in eclipse where port filtering doesn't seem - // to work - File f = new File(currentDir + "/src/test/resources/fediz_config_hok.xml"); - FileInputStream inputStream = new FileInputStream(f); - String content = IOUtils.toString(inputStream, "UTF-8"); - inputStream.close(); - if (content.contains("idp.https.port")) { - content = content.replaceAll("\\$\\{idp.https.port\\}", "" + idpHttpsPort); - - File f2 = new File(baseDir + "/test-classes/fediz_config_hok.xml"); - try (FileOutputStream outputStream = new FileOutputStream(f2)) { - IOUtils.write(content, outputStream, "UTF-8"); - } - } - - FederationAuthenticator fa = new FederationAuthenticator(); - fa.setConfigFile(currentDir + File.separator + "target" + File.separator - + "test-classes" + File.separator + "fediz_config_hok.xml"); - cxt.getPipeline().addValve(fa); - } - - server.start(); - - return server; - } - - @AfterClass - public static void cleanup() { - shutdownServer(idpServer); - shutdownServer(rpServer); - } - - private static void shutdownServer(Tomcat server) { - try { - if (server != null && server.getServer() != null - && server.getServer().getState() != LifecycleState.DESTROYED) { - if (server.getServer().getState() != LifecycleState.STOPPED) { - server.stop(); - } - server.destroy(); - } - } catch (Exception e) { - e.printStackTrace(); - } - } - - public String getIdpHttpsPort() { - return idpHttpsPort; - } - - public String getRpHttpsPort() { - return rpHttpsPort; - } - - public String getServletContextName() { - return "fedizhelloworld"; - } - - @org.junit.Test - public void testHolderOfKey() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/fedizhelloworld/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - final WebClient webClient = new WebClient(); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setSSLClientCertificate( - this.getClass().getClassLoader().getResource("client.jks"), "storepass", "jks"); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - // Test the Subject Confirmation method here - DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); - - String wresult = null; - for (DomElement result : results) { - if ("wresult".equals(result.getAttributeNS(null, "name"))) { - wresult = result.getAttributeNS(null, "value"); - break; - } - } - Assert.assertTrue(wresult != null - && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key")); - - - final HtmlPage rpPage = button.click(); - Assert.assertEquals("WS Federation Systests Examples", rpPage.getTitleText()); - - final String bodyTextContent = rpPage.getBody().getTextContent(); - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=false")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=false")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - - String claim = ClaimTypes.FIRSTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'", - bodyTextContent.contains(claim + "=Alice")); - claim = ClaimTypes.LASTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'", - bodyTextContent.contains(claim + "=Smith")); - claim = ClaimTypes.EMAILADDRESS.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", - bodyTextContent.contains(claim + "[email protected]")); - - webClient.close(); - } - -} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TestCallbackHandler.java ---------------------------------------------------------------------- diff --git a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TestCallbackHandler.java b/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TestCallbackHandler.java deleted file mode 100644 index 776b458..0000000 --- a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TestCallbackHandler.java +++ /dev/null @@ -1,48 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - -import java.io.IOException; - -import javax.security.auth.callback.Callback; -import javax.security.auth.callback.CallbackHandler; -import javax.security.auth.callback.UnsupportedCallbackException; - -import org.apache.cxf.fediz.core.spi.WReqCallback; - -public class TestCallbackHandler implements CallbackHandler { - - static final String TEST_WREQ = - "<RequestSecurityToken xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\";>" - + "<TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</TokenType>" - + "</RequestSecurityToken>"; - - public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { - for (int i = 0; i < callbacks.length; i++) { - if (callbacks[i] instanceof WReqCallback) { - WReqCallback callback = (WReqCallback) callbacks[i]; - callback.setWreq(TEST_WREQ); - } else { - throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback"); - } - } - } - -} \ No newline at end of file http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TomcatTest.java ---------------------------------------------------------------------- diff --git a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TomcatTest.java b/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TomcatTest.java deleted file mode 100644 index 66acdc0..0000000 --- a/systests/tomcat8/src/test/java/org/apache/cxf/fediz/integrationtests/TomcatTest.java +++ /dev/null @@ -1,172 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - - -import java.io.File; -import java.io.FileInputStream; -import java.io.FileOutputStream; -import java.io.IOException; - -import javax.servlet.ServletException; - -import org.apache.catalina.Context; -import org.apache.catalina.LifecycleException; -import org.apache.catalina.LifecycleState; -import org.apache.catalina.connector.Connector; -import org.apache.catalina.startup.Tomcat; -import org.apache.commons.io.IOUtils; -import org.apache.cxf.fediz.tomcat8.FederationAuthenticator; -import org.junit.AfterClass; -import org.junit.Assert; -import org.junit.BeforeClass; - -public class TomcatTest extends AbstractTests { - - static String idpHttpsPort; - static String rpHttpsPort; - - private static Tomcat idpServer; - private static Tomcat rpServer; - - @BeforeClass - public static void init() throws Exception { - System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog"); - System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true"); - System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.webflow", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.springframework.security.web", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf.fediz", "info"); - System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.cxf", "info"); - - idpHttpsPort = System.getProperty("idp.https.port"); - Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort); - rpHttpsPort = System.getProperty("rp.https.port"); - Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort); - - idpServer = startServer(true, idpHttpsPort); - rpServer = startServer(false, rpHttpsPort); - } - - private static Tomcat startServer(boolean idp, String port) - throws ServletException, LifecycleException, IOException { - Tomcat server = new Tomcat(); - server.setPort(0); - String currentDir = new File(".").getCanonicalPath(); - String baseDir = currentDir + File.separator + "target"; - server.setBaseDir(baseDir); - - if (idp) { - server.getHost().setAppBase("tomcat/idp/webapps"); - } else { - server.getHost().setAppBase("tomcat/rp/webapps"); - } - server.getHost().setAutoDeploy(true); - server.getHost().setDeployOnStartup(true); - - Connector httpsConnector = new Connector(); - httpsConnector.setPort(Integer.parseInt(port)); - httpsConnector.setSecure(true); - httpsConnector.setScheme("https"); - //httpsConnector.setAttribute("keyAlias", keyAlias); - httpsConnector.setAttribute("keystorePass", "tompass"); - httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("truststorePass", "tompass"); - httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks"); - httpsConnector.setAttribute("clientAuth", "want"); - // httpsConnector.setAttribute("clientAuth", "false"); - httpsConnector.setAttribute("sslProtocol", "TLS"); - httpsConnector.setAttribute("SSLEnabled", true); - - server.getService().addConnector(httpsConnector); - - if (idp) { - File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts"); - server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath()); - - File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp"); - server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath()); - } else { - File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "simpleWebapp"); - Context cxt = server.addWebapp("/fedizhelloworld", rpWebapp.getAbsolutePath()); - - // Substitute the IDP port. Necessary if running the test in eclipse where port filtering doesn't seem - // to work - File f = new File(currentDir + "/src/test/resources/fediz_config.xml"); - FileInputStream inputStream = new FileInputStream(f); - String content = IOUtils.toString(inputStream, "UTF-8"); - inputStream.close(); - if (content.contains("idp.https.port")) { - content = content.replaceAll("\\$\\{idp.https.port\\}", "" + idpHttpsPort); - - File f2 = new File(baseDir + "/test-classes/fediz_config.xml"); - try (FileOutputStream outputStream = new FileOutputStream(f2)) { - IOUtils.write(content, outputStream, "UTF-8"); - } - } - - FederationAuthenticator fa = new FederationAuthenticator(); - fa.setConfigFile(currentDir + File.separator + "target" + File.separator - + "test-classes" + File.separator + "fediz_config.xml"); - cxt.getPipeline().addValve(fa); - } - - server.start(); - - return server; - } - - @AfterClass - public static void cleanup() { - shutdownServer(idpServer); - shutdownServer(rpServer); - } - - private static void shutdownServer(Tomcat server) { - try { - if (server != null && server.getServer() != null - && server.getServer().getState() != LifecycleState.DESTROYED) { - if (server.getServer().getState() != LifecycleState.STOPPED) { - server.stop(); - } - server.destroy(); - } - } catch (Exception e) { - e.printStackTrace(); - } - } - - @Override - public String getIdpHttpsPort() { - return idpHttpsPort; - } - - @Override - public String getRpHttpsPort() { - return rpHttpsPort; - } - - @Override - public String getServletContextName() { - return "fedizhelloworld"; - } - -}
