Examples with AuthorizationResponse io.helidon.security.AuthorizationResponse used on opensource projects

Example 11 with AuthorizationResponse

use of io.helidon.security.AuthorizationResponse in project helidon by oracle.

the class AtzProviderSyncTest method testPublic.

@Test
public void testPublic() {
    SecurityEnvironment se = SecurityEnvironment.builder().path("/public/some/path").build();
    EndpointConfig ep = EndpointConfig.create();
    ProviderRequest request = mock(ProviderRequest.class);
    when(request.env()).thenReturn(se);
    when(request.endpointConfig()).thenReturn(ep);
    AtzProviderSync provider = new AtzProviderSync();
    AuthorizationResponse response = provider.syncAuthorize(request);
    assertThat(response.status(), is(SecurityResponse.SecurityStatus.SUCCESS));
}

Example 12 with AuthorizationResponse

use of io.helidon.security.AuthorizationResponse in project helidon by oracle.

the class AtzProviderSyncTest method testDenied.

@Test
public void testDenied() {
    SecurityContext context = mock(SecurityContext.class);
    when(context.isAuthenticated()).thenReturn(false);
    SecurityEnvironment se = SecurityEnvironment.builder().path("/private/some/path").build();
    EndpointConfig ep = EndpointConfig.create();
    ProviderRequest request = mock(ProviderRequest.class);
    when(request.securityContext()).thenReturn(context);
    when(request.env()).thenReturn(se);
    when(request.endpointConfig()).thenReturn(ep);
    AtzProviderSync provider = new AtzProviderSync();
    AuthorizationResponse response = provider.syncAuthorize(request);
    assertThat(response.status(), is(SecurityResponse.SecurityStatus.FAILURE));
}

Example 13 with AuthorizationResponse

use of io.helidon.security.AuthorizationResponse in project helidon by oracle.

the class AuditerTest method integrateIt.

@Test
public void integrateIt() throws InterruptedException {
    Auditer auditer = new Auditer();
    Security sec = Security.builder().addAuthorizationProvider(new AtzProviderSync()).addAuditProvider(auditer).build();
    SecurityContext context = sec.createContext("unit-test");
    context.env(SecurityEnvironment.builder().path("/public/path"));
    AuthorizationResponse response = context.authorize();
    // as auditing is asynchronous, we must give it some time to process
    Thread.sleep(100);
    List<AuditProvider.TracedAuditEvent> messages = auditer.getMessages();
    // there should be two messages - configuration of security and authorization
    List<AuditProvider.TracedAuditEvent> atzEvents = messages.stream().filter(event -> event.eventType().startsWith(AuditEvent.AUTHZ_TYPE_PREFIX)).collect(Collectors.toList());
    assertThat("We only expect a single authorization event", atzEvents.size(), is(1));
}

Example 14 with AuthorizationResponse

use of io.helidon.security.AuthorizationResponse in project helidon by oracle.

the class ProviderSelectorTest method integrateIt.

@Test
public void integrateIt() {
    Security security = Security.builder().providerSelectionPolicy(ProviderSelector::create).addProvider(new AtnProviderSync()).addProvider(new AtzProviderSync()).build();
    SecurityContext context = security.createContext("unit-test");
    context.env(SecurityEnvironment.builder().path("/public/path"));
    AuthorizationResponse response = context.authorize();
// if we reached here, the policy worked
}

Example 15 with AuthorizationResponse

use of io.helidon.security.AuthorizationResponse in project helidon by oracle.

the class SecurityFilterTest method testAtzThrowException.

@Test
void testAtzThrowException() {
    SecurityFeature feature = SecurityFeature.builder(security).useAbortWith(false).build();
    SecurityContext securityContext = security.createContext("testNotAbortWith");
    SecurityFilter sf = new SecurityFilter(feature.featureConfig(), security, serverConfig, securityContext);
    ContainerRequest request = mock(ContainerRequest.class);
    SecurityFilter.FilterContext filterContext = new SecurityFilter.FilterContext();
    filterContext.setJerseyRequest(request);
    SecurityDefinition methodSecurity = mock(SecurityDefinition.class);
    SecurityClientBuilder<AuthorizationResponse> clientBuilder = mock(SecurityClientBuilder.class);
    when(clientBuilder.buildAndGet()).thenReturn(AuthorizationResponse.builder().description("Unit-test").status(SecurityResponse.SecurityStatus.FAILURE).build());
    WebApplicationException e = Assertions.assertThrows(WebApplicationException.class, () -> sf.processAuthorization(filterContext, clientBuilder));
    Response response = e.getResponse();
    String message = e.getMessage();
    assertThat(response.getStatus(), is(403));
    assertThat(message, is("Unit-test"));
}