http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java ---------------------------------------------------------------------- diff --git a/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java new file mode 100644 index 0000000..6cb8bcf --- /dev/null +++ b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java @@ -0,0 +1,163 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.cxf.fediz.systests.spring; + + +import java.io.File; +import java.io.IOException; + +import javax.servlet.ServletException; + +import org.apache.catalina.LifecycleException; +import org.apache.catalina.LifecycleState; +import org.apache.catalina.connector.Connector; +import org.apache.catalina.startup.Tomcat; +import org.apache.cxf.fediz.systests.common.AbstractTests; +import org.junit.AfterClass; +import org.junit.Assert; +import org.junit.BeforeClass; +import org.junit.Ignore; + +public class Spring3Test extends AbstractTests { + + static String idpHttpsPort; + static String rpHttpsPort; + + private static Tomcat idpServer; + private static Tomcat rpServer; + + @BeforeClass + public static void init() throws Exception { + System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog"); + + System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true"); + + System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "debug"); + + System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "debug"); + + idpHttpsPort = System.getProperty("idp.https.port"); + Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort); + rpHttpsPort = System.getProperty("rp.https.port"); + Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort); + + idpServer = startServer(true, idpHttpsPort); + rpServer = startServer(false, rpHttpsPort); + } + + @AfterClass + public static void cleanup() { + shutdownServer(idpServer); + shutdownServer(rpServer); + } + + private static void shutdownServer(Tomcat server) { + try { + if (server != null && server.getServer() != null + && server.getServer().getState() != LifecycleState.DESTROYED) { + if (server.getServer().getState() != LifecycleState.STOPPED) { + server.stop(); + } + server.destroy(); + } + } catch (Exception e) { + e.printStackTrace(); + } + } + + private static Tomcat startServer(boolean idp, String port) + throws ServletException, LifecycleException, IOException { + Tomcat server = new Tomcat(); + server.setPort(0); + String currentDir = new File(".").getCanonicalPath(); + String baseDir = currentDir + File.separator + "target"; + server.setBaseDir(baseDir); + + if (idp) { + server.getHost().setAppBase("tomcat/idp/webapps"); + } else { + server.getHost().setAppBase("tomcat/rp/webapps"); + } + server.getHost().setAutoDeploy(true); + server.getHost().setDeployOnStartup(true); + + Connector httpsConnector = new Connector(); + httpsConnector.setPort(Integer.parseInt(port)); + httpsConnector.setSecure(true); + httpsConnector.setScheme("https"); + //httpsConnector.setAttribute("keyAlias", keyAlias); + httpsConnector.setAttribute("keystorePass", "tompass"); + httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks"); + httpsConnector.setAttribute("truststorePass", "tompass"); + httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks"); + httpsConnector.setAttribute("clientAuth", "want"); + // httpsConnector.setAttribute("clientAuth", "false"); + httpsConnector.setAttribute("sslProtocol", "TLS"); + httpsConnector.setAttribute("SSLEnabled", true); + + server.getService().addConnector(httpsConnector); + + if (idp) { + File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts"); + server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath()); + + File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp"); + server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath()); + } else { + File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), + "fediz-systests-webapps-spring3"); + server.addWebapp("/fedizhelloworld_spring3", rpWebapp.getAbsolutePath()); + } + + server.start(); + + return server; + } + + @Override + public String getIdpHttpsPort() { + return idpHttpsPort; + } + + @Override + public String getRpHttpsPort() { + return rpHttpsPort; + } + + @Override + public String getServletContextName() { + return "fedizhelloworld_spring3"; + } + + @Ignore("This tests is currently failing on Spring") + @Override + public void testConcurrentRequests() throws Exception { + // super.testConcurrentRequests(); + } + + @Override + @org.junit.Test + public void testCSRFAttack() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/j_spring_fediz_security_check"; + csrfAttackTest(url); + } + +}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java ---------------------------------------------------------------------- diff --git a/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java new file mode 100644 index 0000000..4d7abba --- /dev/null +++ b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java @@ -0,0 +1,161 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.cxf.fediz.systests.spring; + +import java.io.File; +import java.io.IOException; + +import javax.servlet.ServletException; + +import org.apache.catalina.LifecycleException; +import org.apache.catalina.LifecycleState; +import org.apache.catalina.connector.Connector; +import org.apache.catalina.startup.Tomcat; +import org.apache.cxf.fediz.systests.common.AbstractTests; +import org.junit.AfterClass; +import org.junit.Assert; +import org.junit.BeforeClass; +import org.junit.Ignore; + +public class SpringTest extends AbstractTests { + + static String idpHttpsPort; + static String rpHttpsPort; + + private static Tomcat idpServer; + private static Tomcat rpServer; + + @BeforeClass + public static void init() throws Exception { + System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog"); + + System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true"); + + System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "debug"); + + System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "debug"); + + idpHttpsPort = System.getProperty("idp.https.port"); + Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort); + rpHttpsPort = System.getProperty("rp.https.port"); + Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort); + + idpServer = startServer(true, idpHttpsPort); + rpServer = startServer(false, rpHttpsPort); + } + + @AfterClass + public static void cleanup() { + shutdownServer(idpServer); + shutdownServer(rpServer); + } + + private static void shutdownServer(Tomcat server) { + try { + if (server != null && server.getServer() != null + && server.getServer().getState() != LifecycleState.DESTROYED) { + if (server.getServer().getState() != LifecycleState.STOPPED) { + server.stop(); + } + server.destroy(); + } + } catch (Exception e) { + e.printStackTrace(); + } + } + + private static Tomcat startServer(boolean idp, String port) + throws ServletException, LifecycleException, IOException { + Tomcat server = new Tomcat(); + server.setPort(0); + String currentDir = new File(".").getCanonicalPath(); + String baseDir = currentDir + File.separator + "target"; + server.setBaseDir(baseDir); + + if (idp) { + server.getHost().setAppBase("tomcat/idp/webapps"); + } else { + server.getHost().setAppBase("tomcat/rp/webapps"); + } + server.getHost().setAutoDeploy(true); + server.getHost().setDeployOnStartup(true); + + Connector httpsConnector = new Connector(); + httpsConnector.setPort(Integer.parseInt(port)); + httpsConnector.setSecure(true); + httpsConnector.setScheme("https"); + //httpsConnector.setAttribute("keyAlias", keyAlias); + httpsConnector.setAttribute("keystorePass", "tompass"); + httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks"); + httpsConnector.setAttribute("truststorePass", "tompass"); + httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks"); + httpsConnector.setAttribute("clientAuth", "want"); + // httpsConnector.setAttribute("clientAuth", "false"); + httpsConnector.setAttribute("sslProtocol", "TLS"); + httpsConnector.setAttribute("SSLEnabled", true); + + server.getService().addConnector(httpsConnector); + + if (idp) { + File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts"); + server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath()); + + File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp"); + server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath()); + } else { + File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), + "fediz-systests-webapps-spring"); + server.addWebapp("/fedizhelloworld", rpWebapp.getAbsolutePath()); + } + + server.start(); + + return server; + } + + @Override + public String getIdpHttpsPort() { + return idpHttpsPort; + } + + @Override + public String getRpHttpsPort() { + return rpHttpsPort; + } + + @Override + public String getServletContextName() { + return "fedizhelloworld"; + } + + @Ignore("This tests is currently failing on Spring") + @Override + public void testConcurrentRequests() throws Exception { + // super.testConcurrentRequests(); + } + + @Override + @org.junit.Test + public void testCSRFAttack() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + + "/j_spring_fediz_security_check"; + csrfAttackTest(url); + } +} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java ---------------------------------------------------------------------- diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java deleted file mode 100644 index 3f2e03a..0000000 --- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java +++ /dev/null @@ -1,179 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - -import java.net.URL; -import java.util.ArrayList; - -import com.gargoylesoftware.htmlunit.CookieManager; -import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException; -import com.gargoylesoftware.htmlunit.HttpMethod; -import com.gargoylesoftware.htmlunit.WebClient; -import com.gargoylesoftware.htmlunit.WebRequest; -import com.gargoylesoftware.htmlunit.html.DomElement; -import com.gargoylesoftware.htmlunit.html.DomNodeList; -import com.gargoylesoftware.htmlunit.html.HtmlForm; -import com.gargoylesoftware.htmlunit.html.HtmlPage; -import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; -import com.gargoylesoftware.htmlunit.util.NameValuePair; - -import org.apache.cxf.fediz.core.ClaimTypes; -import org.apache.wss4j.dom.engine.WSSConfig; -import org.junit.Assert; - -public abstract class AbstractClientCertTests { - - static { - WSSConfig.init(); - } - - public AbstractClientCertTests() { - super(); - } - - public abstract String getServletContextName(); - - public abstract String getIdpHttpsPort(); - - public abstract String getRpHttpsPort(); - - @org.junit.Test - public void testClientAuthentication() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; - - final WebClient webClient = new WebClient(); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setSSLClientCertificate( - this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks"); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - // Test the Subject Confirmation method here - DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); - - String wresult = null; - for (DomElement result : results) { - if ("wresult".equals(result.getAttributeNS(null, "name"))) { - wresult = result.getAttributeNS(null, "value"); - break; - } - } - Assert.assertTrue(wresult != null - && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key")); - - final HtmlPage rpPage = button.click(); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - final String bodyTextContent = rpPage.getBody().getTextContent(); - String user = "alice"; - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=false")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=false")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - - String claim = ClaimTypes.FIRSTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'", - bodyTextContent.contains(claim + "=Alice")); - claim = ClaimTypes.LASTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'", - bodyTextContent.contains(claim + "=Smith")); - claim = ClaimTypes.EMAILADDRESS.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", - bodyTextContent.contains(claim + "[email protected]")); - - // webClient.close(); - } - - @org.junit.Test - public void testDifferentClientCertificate() throws Exception { - // Get the initial wresult from the IdP - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; - - CookieManager cookieManager = new CookieManager(); - final WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setSSLClientCertificate( - this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks"); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - // Test the Subject Confirmation method here - DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); - - String wresult = null; - String wa = "wsignin1.0"; - String wctx = null; - String wtrealm = null; - for (DomElement result : results) { - if ("wresult".equals(result.getAttributeNS(null, "name"))) { - wresult = result.getAttributeNS(null, "value"); - } else if ("wctx".equals(result.getAttributeNS(null, "name"))) { - wctx = result.getAttributeNS(null, "value"); - } else if ("wtrealm".equals(result.getAttributeNS(null, "name"))) { - wtrealm = result.getAttributeNS(null, "value"); - } - } - Assert.assertTrue(wctx != null && wtrealm != null); - Assert.assertTrue(wresult != null - && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key")); - // webClient.close(); - - // Now invoke on the RP using the saved parameters above, but a different client cert! - final WebClient webClient2 = new WebClient(); - webClient2.setCookieManager(cookieManager); - webClient2.getOptions().setUseInsecureSSL(true); - webClient2.getOptions().setSSLClientCertificate( - this.getClass().getClassLoader().getResource("server.jks"), "tompass", "jks"); - - WebRequest request = new WebRequest(new URL(url), HttpMethod.POST); - - request.setRequestParameters(new ArrayList<NameValuePair>()); - request.getRequestParameters().add(new NameValuePair("wctx", wctx)); - request.getRequestParameters().add(new NameValuePair("wa", wa)); - request.getRequestParameters().add(new NameValuePair("wtrealm", wtrealm)); - request.getRequestParameters().add(new NameValuePair("wresult", wresult)); - - try { - webClient2.getPage(request); - Assert.fail("Exception expected"); - } catch (FailingHttpStatusCodeException ex) { - // expected - Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode()); - } - - // webClient2.close(); - } - -} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java ---------------------------------------------------------------------- diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java deleted file mode 100644 index 65dead1..0000000 --- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java +++ /dev/null @@ -1,802 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - -import java.net.URL; -import java.net.URLEncoder; -import java.util.ArrayList; - -import org.w3c.dom.Document; -import org.w3c.dom.Element; -import org.w3c.dom.Node; - -import com.gargoylesoftware.htmlunit.CookieManager; -import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException; -import com.gargoylesoftware.htmlunit.HttpMethod; -import com.gargoylesoftware.htmlunit.WebClient; -import com.gargoylesoftware.htmlunit.WebRequest; -import com.gargoylesoftware.htmlunit.html.DomElement; -import com.gargoylesoftware.htmlunit.html.DomNodeList; -import com.gargoylesoftware.htmlunit.html.HtmlForm; -import com.gargoylesoftware.htmlunit.html.HtmlPage; -import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; -import com.gargoylesoftware.htmlunit.util.NameValuePair; -import com.gargoylesoftware.htmlunit.xml.XmlPage; - -import org.apache.commons.io.IOUtils; -import org.apache.cxf.fediz.core.ClaimTypes; -import org.apache.cxf.fediz.core.FederationConstants; -import org.apache.cxf.fediz.core.util.DOMUtils; -import org.apache.http.auth.AuthScope; -import org.apache.http.auth.UsernamePasswordCredentials; -import org.apache.wss4j.dom.engine.WSSConfig; -import org.apache.xml.security.keys.KeyInfo; -import org.apache.xml.security.signature.XMLSignature; -import org.junit.Assert; -import org.junit.Test; - -public abstract class AbstractTests { - - static { - WSSConfig.init(); - } - - public AbstractTests() { - super(); - } - - public abstract String getServletContextName(); - - public abstract String getIdpHttpsPort(); - - public abstract String getRpHttpsPort(); - - @Test - public void testAlice() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - final String bodyTextContent = - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=false")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=false")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - - String claim = ClaimTypes.FIRSTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'", - bodyTextContent.contains(claim + "=Alice")); - claim = ClaimTypes.LASTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'", - bodyTextContent.contains(claim + "=Smith")); - claim = ClaimTypes.EMAILADDRESS.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", - bodyTextContent.contains(claim + "[email protected]")); - - } - - @Test - public void testAliceUser() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/user/fedservlet"; - String user = "alice"; - String password = "ecila"; - - final String bodyTextContent = - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=false")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=false")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - } - - @Test - public void testAliceAdminNoAccess() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/admin/fedservlet"; - String user = "alice"; - String password = "ecila"; - - try { - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - Assert.fail("Exception expected"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 403); - } - } - - @Test - public void testAliceManagerNoAccess() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/manager/fedservlet"; - String user = "alice"; - String password = "ecila"; - - try { - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - Assert.fail("Exception expected"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 403); - } - } - - @Test - public void testAliceWrongPasswordNoAccess() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "alice"; - String password = "alice"; - - try { - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - Assert.fail("Exception expected"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 401); - } - } - - @Test - public void testBob() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "bob"; - String password = "bob"; - - final String bodyTextContent = - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=true")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=true")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - - String claim = ClaimTypes.FIRSTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Bob'", - bodyTextContent.contains(claim + "=Bob")); - claim = ClaimTypes.LASTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Windsor'", - bodyTextContent.contains(claim + "=Windsor")); - claim = ClaimTypes.EMAILADDRESS.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", - bodyTextContent.contains(claim + "[email protected]")); - } - - @Test - public void testBobUser() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/user/fedservlet"; - String user = "bob"; - String password = "bob"; - - final String bodyTextContent = - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=true")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=true")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - } - - @Test - public void testBobManager() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/manager/fedservlet"; - String user = "bob"; - String password = "bob"; - - final String bodyTextContent = - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=true")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=true")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - } - - @Test - public void testBobAdmin() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/admin/fedservlet"; - String user = "bob"; - String password = "bob"; - - final String bodyTextContent = - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=true")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=true")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=true")); - } - - @Test - public void testTed() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "ted"; - String password = "det"; - - final String bodyTextContent = - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - - Assert.assertTrue("Principal not " + user, - bodyTextContent.contains("userPrincipal=" + user)); - Assert.assertTrue("User " + user + " does not have role Admin", - bodyTextContent.contains("role:Admin=false")); - Assert.assertTrue("User " + user + " does not have role Manager", - bodyTextContent.contains("role:Manager=false")); - Assert.assertTrue("User " + user + " must have role User", - bodyTextContent.contains("role:User=false")); - - String claim = ClaimTypes.FIRSTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Ted'", - bodyTextContent.contains(claim + "=Ted")); - claim = ClaimTypes.LASTNAME.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not 'Cooper'", - bodyTextContent.contains(claim + "=Cooper")); - claim = ClaimTypes.EMAILADDRESS.toString(); - Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", - bodyTextContent.contains(claim + "[email protected]")); - } - - @Test - public void testTedUserNoAccess() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/user/fedservlet"; - String user = "ted"; - String password = "det"; - - try { - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - Assert.fail("Exception expected"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 403); - } - } - - @Test - public void testTedAdminNoAccess() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/admin/fedservlet"; - String user = "ted"; - String password = "det"; - - try { - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - Assert.fail("Exception expected"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 403); - } - } - - @Test - public void testTedManagerNoAccess() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/manager/fedservlet"; - String user = "ted"; - String password = "det"; - - try { - HTTPTestUtils.login(url, user, password, getIdpHttpsPort()); - Assert.fail("Exception expected"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 403); - } - } - - @Test - public void testRPMetadata() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() - + "/" + getServletContextName() + "/FederationMetadata/2007-06/FederationMetadata.xml"; - - final WebClient webClient = new WebClient(); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setSSLClientCertificate( - this.getClass().getClassLoader().getResource("client.jks"), "storepass", "jks"); - - final XmlPage rpPage = webClient.getPage(url); - final String xmlContent = rpPage.asXml(); - Assert.assertTrue(xmlContent.startsWith("<md:EntityDescriptor")); - - // Now validate the Signature - Document doc = rpPage.getXmlDocument(); - - doc.getDocumentElement().setIdAttributeNS(null, "ID", true); - - Node signatureNode = - DOMUtils.getChild(doc.getDocumentElement(), "Signature"); - Assert.assertNotNull(signatureNode); - - XMLSignature signature = new XMLSignature((Element)signatureNode, ""); - KeyInfo ki = signature.getKeyInfo(); - Assert.assertNotNull(ki); - Assert.assertNotNull(ki.getX509Certificate()); - - Assert.assertTrue(signature.checkSignatureValue(ki.getX509Certificate())); - - // webClient.close(); - } - - @Test - public void testRPLogout() throws Exception { - - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - CookieManager cookieManager = new CookieManager(); - - // 1. Login - HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); - - // 2. Now we should have a cookie from the RP and IdP and should be able to do - // subsequent requests without authenticate again. Lets test this first. - WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - final HtmlPage rpPage = webClient.getPage(url); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - // 3. now we logout from RP - String rpLogoutUrl = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/logout"; - - HTTPTestUtils.logout(rpLogoutUrl, cookieManager); - - // 4. now we try to access the RP and idp without authentication but with the existing cookies - // to see if we are really logged out - - // webClient.close(); - webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); - final HtmlPage idpPage = webClient.getPage(url); - - Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); - - // webClient.close(); - } - - @Test - public void testRPLogoutViaAction() throws Exception { - - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - CookieManager cookieManager = new CookieManager(); - - // 1. Login - HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); - - // 2. Now we should have a cookie from the RP and IdP and should be able to do - // subsequent requests without authenticate again. Lets test this first. - WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - final HtmlPage rpPage = webClient.getPage(url); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - // 3. now we logout from RP - String rpLogoutUrl = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet?wa=" + FederationConstants.ACTION_SIGNOUT; - - HTTPTestUtils.logout(rpLogoutUrl, cookieManager); - - // 4. now we try to access the RP and idp without authentication but with the existing cookies - // to see if we are really logged out - - // webClient.close(); - webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); - final HtmlPage idpPage = webClient.getPage(url); - - Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); - - // webClient.close(); - } - - @Test - public void testIdPLogout() throws Exception { - - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - CookieManager cookieManager = new CookieManager(); - - // 1. Login - HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); - - // 2. Now we should have a cookie from the RP and IdP and should be able to do - // subsequent requests without authenticate again. Lets test this first. - WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - final HtmlPage rpPage = webClient.getPage(url); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - // 3. now we logout from IdP - String idpLogoutUrl = "https://localhost:"; + getIdpHttpsPort() + "/fediz-idp/federation?wa=" - + FederationConstants.ACTION_SIGNOUT; //todo logout url on idp?!? - - HTTPTestUtils.logout(idpLogoutUrl, cookieManager); - - // 4. now we try to access the RP and idp without authentication but with the existing cookies - // to see if we are really logged out - - // webClient.close(); - webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); - final HtmlPage idpPage = webClient.getPage(url); - - Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); - - // webClient.close(); - } - - @Test - public void testIdPLogoutCleanup() throws Exception { - - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - CookieManager cookieManager = new CookieManager(); - - // 1. Login - HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); - - // 2. Now we should have a cookie from the RP and IdP and should be able to do - // subsequent requests without authenticate again. Lets test this first. - WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - final HtmlPage rpPage = webClient.getPage(url); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - // 3. now we logout from IdP - String idpLogoutUrl = "https://localhost:"; + getIdpHttpsPort() + "/fediz-idp/federation?wa=" - + FederationConstants.ACTION_SIGNOUT_CLEANUP; - - HTTPTestUtils.logoutCleanup(idpLogoutUrl, cookieManager); - - // 4. now we try to access the RP and idp without authentication but with the existing cookies - // to see if we are really logged out - - // webClient.close(); - webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getOptions().setThrowExceptionOnFailingStatusCode(false); - final HtmlPage idpPage = webClient.getPage(url); - - Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode()); - - // webClient.close(); - } - - @Test - public void testAliceModifiedSignature() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() - + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - // Get the initial token - CookieManager cookieManager = new CookieManager(); - final WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - // Parse the form to get the token (wresult) - DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); - - for (DomElement result : results) { - if ("wresult".equals(result.getAttributeNS(null, "name"))) { - // Now modify the Signature - String value = result.getAttributeNS(null, "value"); - value = value.replace("alice", "bob"); - result.setAttributeNS(null, "value", value); - } - } - - // Invoke back on the RP - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - try { - button.click(); - Assert.fail("Failure expected on a modified signature"); - } catch (FailingHttpStatusCodeException ex) { - // expected - Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode()); - } - - // webClient.close(); - } - - @Test - public void testConcurrentRequests() throws Exception { - - String url1 = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; - String url2 = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/test.html"; - String user = "bob"; - String password = "bob"; - - // Get the initial token - CookieManager cookieManager = new CookieManager(); - final WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage1 = webClient.getPage(url1); - final HtmlPage idpPage2 = webClient.getPage(url2); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage1.getTitleText()); - Assert.assertEquals("IDP SignIn Response Form", idpPage2.getTitleText()); - - // Invoke back on the page1 RP - final HtmlForm form = idpPage1.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - final HtmlPage rpPage1 = button.click(); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage1.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage1.getTitleText())); - - String bodyTextContent1 = rpPage1.getBody().getTextContent(); - - Assert.assertTrue("Principal not " + user, - bodyTextContent1.contains("userPrincipal=" + user)); - - // Invoke back on the page2 RP - final HtmlForm form2 = idpPage2.getFormByName("signinresponseform"); - final HtmlSubmitInput button2 = form2.getInputByName("_eventId_submit"); - final HtmlPage rpPage2 = button2.click(); - String bodyTextContent2 = rpPage2.getBody().getTextContent(); - - Assert.assertTrue("Unexpected content of RP page", bodyTextContent2.contains("Secure Test")); - - // webClient.close(); - } - - @org.junit.Test - public void testMaliciousRedirect() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - CookieManager cookieManager = new CookieManager(); - - // 1. Login - HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager); - - // 2. Now we should have a cookie from the RP and IdP and should be able to do - // subsequent requests without authenticate again. Lets test this first. - WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - HtmlPage rpPage = webClient.getPage(url); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - // 3. Now a malicious user sends the client a URL with a bad "wreply" address to the IdP - String maliciousURL = "https://www.apache.org/attack";; - String idpUrl - = "https://localhost:"; + getIdpHttpsPort() + "/fediz-idp/federation"; - idpUrl += "?wa=wsignin1.0&wreply=" + URLEncoder.encode(maliciousURL, "UTF-8"); - idpUrl += "&wtrealm=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Afedizhelloworld"; - idpUrl += "&whr=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Aidp%3Arealm-A"; - // webClient.close(); - - final WebClient webClient2 = new WebClient(); - webClient2.setCookieManager(cookieManager); - webClient2.getOptions().setUseInsecureSSL(true); - webClient2.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials(user, password)); - - webClient2.getOptions().setJavaScriptEnabled(false); - try { - webClient2.getPage(idpUrl); - Assert.fail("Failure expected on a bad wreply address"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 400); - } - // webClient2.close(); - } - - @Test - public void testEntityExpansionAttack() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - // Get the initial token - CookieManager cookieManager = new CookieManager(); - final WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - // Parse the form to get the token (wresult) - DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); - - String entity = IOUtils.toString(this.getClass().getClassLoader().getResource("entity.xml").openStream()); - String reference = "&m;"; - - for (DomElement result : results) { - if ("wresult".equals(result.getAttributeNS(null, "name"))) { - // Now modify the Signature - String value = result.getAttributeNS(null, "value"); - value = entity + value; - value = value.replace("alice", reference); - result.setAttributeNS(null, "value", value); - } - } - - // Invoke back on the RP - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - try { - button.click(); - Assert.fail("Failure expected on an entity expansion attack"); - } catch (FailingHttpStatusCodeException ex) { - // expected - Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode()); - } - - // webClient.close(); - } - - @org.junit.Test - public void testCSRFAttack() throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; - csrfAttackTest(url); - } - - protected void csrfAttackTest(String rpURL) throws Exception { - String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; - String user = "alice"; - String password = "ecila"; - - // 1. Log in as "alice" - WebClient webClient = new WebClient(); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - final HtmlPage rpPage = button.click(); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - - // 2. Log in as "bob" using another WebClient - WebClient webClient2 = new WebClient(); - webClient2.getOptions().setUseInsecureSSL(true); - webClient2.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())), - new UsernamePasswordCredentials("bob", "bob")); - - webClient2.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage2 = webClient2.getPage(url); - webClient2.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage2.getTitleText()); - - // 3. Now instead of clicking on the form, send the form via alice's WebClient instead - - // Send with context... - WebRequest request = new WebRequest(new URL(rpURL), HttpMethod.POST); - request.setRequestParameters(new ArrayList<NameValuePair>()); - - DomNodeList<DomElement> results = idpPage2.getElementsByTagName("input"); - - for (DomElement result : results) { - if ("wresult".equals(result.getAttributeNS(null, "name")) - || "wa".equals(result.getAttributeNS(null, "name")) - || "wctx".equals(result.getAttributeNS(null, "name"))) { - String value = result.getAttributeNS(null, "value"); - request.getRequestParameters().add(new NameValuePair(result.getAttributeNS(null, "name"), value)); - } - } - - try { - webClient.getPage(request); - Assert.fail("Failure expected on a CSRF attack"); - } catch (FailingHttpStatusCodeException ex) { - // expected - } - - // webClient.close(); - - } - -} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java ---------------------------------------------------------------------- diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java deleted file mode 100644 index f5a530d..0000000 --- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java +++ /dev/null @@ -1,155 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -package org.apache.cxf.fediz.integrationtests; - -import java.io.IOException; - -import com.gargoylesoftware.htmlunit.CookieManager; -import com.gargoylesoftware.htmlunit.WebClient; -import com.gargoylesoftware.htmlunit.html.DomElement; -import com.gargoylesoftware.htmlunit.html.DomNodeList; -import com.gargoylesoftware.htmlunit.html.HtmlForm; -import com.gargoylesoftware.htmlunit.html.HtmlPage; -import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; - -import org.apache.http.auth.AuthScope; -import org.apache.http.auth.UsernamePasswordCredentials; -import org.junit.Assert; - -/** - * Some basic HTTP-based functionality for use in the tests - */ -public final class HTTPTestUtils { - - private HTTPTestUtils() { - // complete - } - - public static String login(String url, String user, String password, String idpPort) throws IOException { - final WebClient webClient = new WebClient(); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(idpPort)), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - final HtmlPage rpPage = button.click(); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - // webClient.close(); - return rpPage.getBody().getTextContent(); - } - - public static String loginForSAMLSSO(String url, String user, String password, String idpPort) throws IOException { - final WebClient webClient = new WebClient(); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(idpPort)), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage rpPage = webClient.getPage(url); - - // webClient.close(); - return rpPage.getBody().getTextContent(); - } - - public static String loginWithCookieManager(String url, String user, String password, - String idpPort, CookieManager cookieManager) throws IOException { - final WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - webClient.getCredentialsProvider().setCredentials( - new AuthScope("localhost", Integer.parseInt(idpPort)), - new UsernamePasswordCredentials(user, password)); - - webClient.getOptions().setJavaScriptEnabled(false); - final HtmlPage idpPage = webClient.getPage(url); - webClient.getOptions().setJavaScriptEnabled(true); - Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - - final HtmlForm form = idpPage.getFormByName("signinresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - - final HtmlPage rpPage = button.click(); - Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) - || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); - - // webClient.close(); - return rpPage.getBody().getTextContent(); - } - - public static void logout(String url, CookieManager cookieManager) throws IOException { - final WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - final HtmlPage idpPage = webClient.getPage(url); - - Assert.assertEquals("IDP SignOut Confirmation Response Page", idpPage.getTitleText()); - - final HtmlForm form = idpPage.getFormByName("signoutconfirmationresponseform"); - final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); - final HtmlPage idpLogoutPage = button.click(); - - DomNodeList<DomElement> images = idpLogoutPage.getElementsByTagName("img"); - Assert.assertEquals(1, images.getLength()); - for (int i = 0; i < images.size(); i++) { - DomElement domElement = images.get(i); - String imgSrc = domElement.getAttribute("src"); - - //we should get a fault if the image isn't available. - webClient.getPage(imgSrc); - } - - // webClient.close(); - } - - public static void logoutCleanup(String url, CookieManager cookieManager) throws IOException { - final WebClient webClient = new WebClient(); - webClient.setCookieManager(cookieManager); - webClient.getOptions().setUseInsecureSSL(true); - final HtmlPage idpPage = webClient.getPage(url); - - Assert.assertEquals("IDP SignOut Response Page", idpPage.getTitleText()); - - Assert.assertTrue(idpPage.asText().contains("CXF Fediz IDP successful logout")); - - DomNodeList<DomElement> images = idpPage.getElementsByTagName("img"); - Assert.assertEquals(1, images.getLength()); - for (int i = 0; i < images.size(); i++) { - DomElement domElement = images.get(i); - String imgSrc = domElement.getAttribute("src"); - - //we should get a fault if the image isn't available. - webClient.getPage(imgSrc); - } - - // webClient.close(); - } - -} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java ---------------------------------------------------------------------- diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java new file mode 100644 index 0000000..0599559 --- /dev/null +++ b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java @@ -0,0 +1,179 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.cxf.fediz.systests.common; + +import java.net.URL; +import java.util.ArrayList; + +import com.gargoylesoftware.htmlunit.CookieManager; +import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException; +import com.gargoylesoftware.htmlunit.HttpMethod; +import com.gargoylesoftware.htmlunit.WebClient; +import com.gargoylesoftware.htmlunit.WebRequest; +import com.gargoylesoftware.htmlunit.html.DomElement; +import com.gargoylesoftware.htmlunit.html.DomNodeList; +import com.gargoylesoftware.htmlunit.html.HtmlForm; +import com.gargoylesoftware.htmlunit.html.HtmlPage; +import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput; +import com.gargoylesoftware.htmlunit.util.NameValuePair; + +import org.apache.cxf.fediz.core.ClaimTypes; +import org.apache.wss4j.dom.engine.WSSConfig; +import org.junit.Assert; + +public abstract class AbstractClientCertTests { + + static { + WSSConfig.init(); + } + + public AbstractClientCertTests() { + super(); + } + + public abstract String getServletContextName(); + + public abstract String getIdpHttpsPort(); + + public abstract String getRpHttpsPort(); + + @org.junit.Test + public void testClientAuthentication() throws Exception { + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; + + final WebClient webClient = new WebClient(); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getOptions().setSSLClientCertificate( + this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks"); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage = webClient.getPage(url); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + final HtmlForm form = idpPage.getFormByName("signinresponseform"); + final HtmlSubmitInput button = form.getInputByName("_eventId_submit"); + + // Test the Subject Confirmation method here + DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); + + String wresult = null; + for (DomElement result : results) { + if ("wresult".equals(result.getAttributeNS(null, "name"))) { + wresult = result.getAttributeNS(null, "value"); + break; + } + } + Assert.assertTrue(wresult != null + && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key")); + + final HtmlPage rpPage = button.click(); + Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText()) + || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText())); + + final String bodyTextContent = rpPage.getBody().getTextContent(); + String user = "alice"; + Assert.assertTrue("Principal not " + user, + bodyTextContent.contains("userPrincipal=" + user)); + Assert.assertTrue("User " + user + " does not have role Admin", + bodyTextContent.contains("role:Admin=false")); + Assert.assertTrue("User " + user + " does not have role Manager", + bodyTextContent.contains("role:Manager=false")); + Assert.assertTrue("User " + user + " must have role User", + bodyTextContent.contains("role:User=true")); + + String claim = ClaimTypes.FIRSTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'", + bodyTextContent.contains(claim + "=Alice")); + claim = ClaimTypes.LASTNAME.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'", + bodyTextContent.contains(claim + "=Smith")); + claim = ClaimTypes.EMAILADDRESS.toString(); + Assert.assertTrue("User " + user + " claim " + claim + " is not '[email protected]'", + bodyTextContent.contains(claim + "[email protected]")); + + // webClient.close(); + } + + @org.junit.Test + public void testDifferentClientCertificate() throws Exception { + // Get the initial wresult from the IdP + String url = "https://localhost:"; + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet"; + + CookieManager cookieManager = new CookieManager(); + final WebClient webClient = new WebClient(); + webClient.setCookieManager(cookieManager); + webClient.getOptions().setUseInsecureSSL(true); + webClient.getOptions().setSSLClientCertificate( + this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks"); + + webClient.getOptions().setJavaScriptEnabled(false); + final HtmlPage idpPage = webClient.getPage(url); + webClient.getOptions().setJavaScriptEnabled(true); + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + // Test the Subject Confirmation method here + DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); + + String wresult = null; + String wa = "wsignin1.0"; + String wctx = null; + String wtrealm = null; + for (DomElement result : results) { + if ("wresult".equals(result.getAttributeNS(null, "name"))) { + wresult = result.getAttributeNS(null, "value"); + } else if ("wctx".equals(result.getAttributeNS(null, "name"))) { + wctx = result.getAttributeNS(null, "value"); + } else if ("wtrealm".equals(result.getAttributeNS(null, "name"))) { + wtrealm = result.getAttributeNS(null, "value"); + } + } + Assert.assertTrue(wctx != null && wtrealm != null); + Assert.assertTrue(wresult != null + && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key")); + // webClient.close(); + + // Now invoke on the RP using the saved parameters above, but a different client cert! + final WebClient webClient2 = new WebClient(); + webClient2.setCookieManager(cookieManager); + webClient2.getOptions().setUseInsecureSSL(true); + webClient2.getOptions().setSSLClientCertificate( + this.getClass().getClassLoader().getResource("server.jks"), "tompass", "jks"); + + WebRequest request = new WebRequest(new URL(url), HttpMethod.POST); + + request.setRequestParameters(new ArrayList<NameValuePair>()); + request.getRequestParameters().add(new NameValuePair("wctx", wctx)); + request.getRequestParameters().add(new NameValuePair("wa", wa)); + request.getRequestParameters().add(new NameValuePair("wtrealm", wtrealm)); + request.getRequestParameters().add(new NameValuePair("wresult", wresult)); + + try { + webClient2.getPage(request); + Assert.fail("Exception expected"); + } catch (FailingHttpStatusCodeException ex) { + // expected + Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode()); + } + + // webClient2.close(); + } + +}
