Examples with AuthenticationInfoToken io.undertow.security.impl.AuthenticationInfoToken used on opensource projects

Example 1 with AuthenticationInfoToken

use of io.undertow.security.impl.AuthenticationInfoToken in project undertow by undertow-io.

the class DigestAuthenticationAuthTestCase method _testNonceCountReUse.

static void _testNonceCountReUse() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    String value = getAuthHeader(DIGEST, values);
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    assertEquals(DigestQop.AUTH.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.MESSAGE_QOP));
    String clientNonce = createNonce();
    int nonceCount = 1;
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String opaque = parsedHeader.get(DigestWWWAuthenticateToken.OPAQUE);
    assertNotNull(opaque);
    // Send 5 requests with an incrementing nonce count on each call.
    for (int i = 0; i < 2; i++) {
        client = new TestHttpClient();
        get = new HttpGet(DefaultServer.getDefaultServerURL());
        // Note - No increment
        int thisNonceCount = nonceCount;
        String authorization = createAuthorizationLine("userOne", "passwordOne", "GET", "/", nonce, thisNonceCount, clientNonce, opaque);
        get.addHeader(AUTHORIZATION.toString(), authorization);
        result = client.execute(get);
        if (i == 0) {
            assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
            assertSingleNotificationType(EventType.AUTHENTICATED);
            values = result.getHeaders("ProcessedBy");
            assertEquals(1, values.length);
            assertEquals("ResponseHandler", values[0].getValue());
            values = result.getHeaders("Authentication-Info");
            assertEquals(1, values.length);
            Map<AuthenticationInfoToken, String> parsedAuthInfo = AuthenticationInfoToken.parseHeader(values[0].getValue());
            assertEquals("Didn't expect a new nonce.", nonce, parsedAuthInfo.get(AuthenticationInfoToken.NEXT_NONCE));
            assertEquals(DigestQop.AUTH.getToken(), parsedAuthInfo.get(AuthenticationInfoToken.MESSAGE_QOP));
            String nonceCountString = toHex(thisNonceCount);
            assertEquals(createRspAuth("userOne", REALM_NAME, "passwordOne", "/", nonce, nonceCountString, clientNonce), parsedAuthInfo.get(AuthenticationInfoToken.RESPONSE_AUTH));
            assertEquals(clientNonce, parsedAuthInfo.get(AuthenticationInfoToken.CNONCE));
            assertEquals(nonceCountString, parsedAuthInfo.get(AuthenticationInfoToken.NONCE_COUNT));
        } else {
            assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
        }
    }
}

Example 2 with AuthenticationInfoToken

use of io.undertow.security.impl.AuthenticationInfoToken in project undertow by undertow-io.

the class DigestAuthentication2069TestCase method testDigestSuccess.

/**
     * Test for a successful authentication.
     */
@Test
public void testDigestSuccess() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    assertEquals(1, values.length);
    String value = values[0].getValue();
    assertTrue(value.startsWith(DIGEST.toString()));
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    assertFalse(parsedHeader.containsKey(DigestWWWAuthenticateToken.MESSAGE_QOP));
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String response = createResponse("userOne", REALM_NAME, "passwordOne", "GET", "/", nonce);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    StringBuilder sb = new StringBuilder(DIGEST.toString());
    sb.append(" ");
    sb.append(DigestAuthorizationToken.USERNAME.getName()).append("=").append("\"userOne\"").append(",");
    sb.append(DigestAuthorizationToken.REALM.getName()).append("=\"").append(REALM_NAME).append("\",");
    sb.append(DigestAuthorizationToken.NONCE.getName()).append("=\"").append(nonce).append("\",");
    sb.append(DigestAuthorizationToken.DIGEST_URI.getName()).append("=\"/\",");
    sb.append(DigestAuthorizationToken.RESPONSE.getName()).append("=\"").append(response).append("\"");
    get.addHeader(AUTHORIZATION.toString(), sb.toString());
    result = client.execute(get);
    assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
    values = result.getHeaders("ProcessedBy");
    assertEquals(1, values.length);
    assertEquals("ResponseHandler", values[0].getValue());
    values = result.getHeaders("Authentication-Info");
    assertEquals(1, values.length);
    Map<AuthenticationInfoToken, String> parsedAuthInfo = AuthenticationInfoToken.parseHeader(values[0].getValue());
    nonce = parsedAuthInfo.get(AuthenticationInfoToken.NEXT_NONCE);
    response = createResponse("userOne", REALM_NAME, "passwordOne", "GET", "/", nonce);
    assertSingleNotificationType(EventType.AUTHENTICATED);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    sb = new StringBuilder(DIGEST.toString());
    sb.append(" ");
    sb.append(DigestAuthorizationToken.USERNAME.getName()).append("=").append("\"userOne\"").append(",");
    sb.append(DigestAuthorizationToken.REALM.getName()).append("=\"").append(REALM_NAME).append("\",");
    sb.append(DigestAuthorizationToken.NONCE.getName()).append("=\"").append(nonce).append("\",");
    sb.append(DigestAuthorizationToken.DIGEST_URI.getName()).append("=\"/\",");
    sb.append(DigestAuthorizationToken.RESPONSE.getName()).append("=\"").append(response).append("\"");
    get.addHeader(AUTHORIZATION.toString(), sb.toString());
    result = client.execute(get);
    assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
    values = result.getHeaders("ProcessedBy");
    assertEquals(1, values.length);
    assertEquals("ResponseHandler", values[0].getValue());
    assertSingleNotificationType(EventType.AUTHENTICATED);
}

Example 3 with AuthenticationInfoToken

use of io.undertow.security.impl.AuthenticationInfoToken in project undertow by undertow-io.

the class DigestAuthenticationAuthTestCase method _testDigestSuccess.

static void _testDigestSuccess() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    String value = getAuthHeader(DIGEST, values);
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    assertEquals(DigestQop.AUTH.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.MESSAGE_QOP));
    String clientNonce = createNonce();
    int nonceCount = 1;
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String opaque = parsedHeader.get(DigestWWWAuthenticateToken.OPAQUE);
    assertNotNull(opaque);
    // Send 5 requests with an incrementing nonce count on each call.
    for (int i = 0; i < 5; i++) {
        client = new TestHttpClient();
        get = new HttpGet(DefaultServer.getDefaultServerURL());
        int thisNonceCount = nonceCount++;
        String authorization = createAuthorizationLine("userOne", "passwordOne", "GET", "/", nonce, thisNonceCount, clientNonce, opaque);
        get.addHeader(AUTHORIZATION.toString(), authorization);
        result = client.execute(get);
        assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
        values = result.getHeaders("ProcessedBy");
        assertEquals(1, values.length);
        assertEquals("ResponseHandler", values[0].getValue());
        assertSingleNotificationType(EventType.AUTHENTICATED);
        values = result.getHeaders("Authentication-Info");
        assertEquals(1, values.length);
        Map<AuthenticationInfoToken, String> parsedAuthInfo = AuthenticationInfoToken.parseHeader(values[0].getValue());
        assertEquals("Didn't expect a new nonce.", nonce, parsedAuthInfo.get(AuthenticationInfoToken.NEXT_NONCE));
        assertEquals(DigestQop.AUTH.getToken(), parsedAuthInfo.get(AuthenticationInfoToken.MESSAGE_QOP));
        String nonceCountString = toHex(thisNonceCount);
        assertEquals(createRspAuth("userOne", REALM_NAME, "passwordOne", "/", nonce, nonceCountString, clientNonce), parsedAuthInfo.get(AuthenticationInfoToken.RESPONSE_AUTH));
        assertEquals(clientNonce, parsedAuthInfo.get(AuthenticationInfoToken.CNONCE));
        assertEquals(nonceCountString, parsedAuthInfo.get(AuthenticationInfoToken.NONCE_COUNT));
    }
}