Examples with DigestWWWAuthenticateToken io.undertow.security.impl.DigestWWWAuthenticateToken used on opensource projects

Example 1 with DigestWWWAuthenticateToken

use of io.undertow.security.impl.DigestWWWAuthenticateToken in project undertow by undertow-io.

the class DigestAuthenticationAuthTestCase method _testNonceCountReUse.

static void _testNonceCountReUse() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    String value = getAuthHeader(DIGEST, values);
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    assertEquals(DigestQop.AUTH.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.MESSAGE_QOP));
    String clientNonce = createNonce();
    int nonceCount = 1;
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String opaque = parsedHeader.get(DigestWWWAuthenticateToken.OPAQUE);
    assertNotNull(opaque);
    // Send 5 requests with an incrementing nonce count on each call.
    for (int i = 0; i < 2; i++) {
        client = new TestHttpClient();
        get = new HttpGet(DefaultServer.getDefaultServerURL());
        // Note - No increment
        int thisNonceCount = nonceCount;
        String authorization = createAuthorizationLine("userOne", "passwordOne", "GET", "/", nonce, thisNonceCount, clientNonce, opaque);
        get.addHeader(AUTHORIZATION.toString(), authorization);
        result = client.execute(get);
        if (i == 0) {
            assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
            assertSingleNotificationType(EventType.AUTHENTICATED);
            values = result.getHeaders("ProcessedBy");
            assertEquals(1, values.length);
            assertEquals("ResponseHandler", values[0].getValue());
            values = result.getHeaders("Authentication-Info");
            assertEquals(1, values.length);
            Map<AuthenticationInfoToken, String> parsedAuthInfo = AuthenticationInfoToken.parseHeader(values[0].getValue());
            assertEquals("Didn't expect a new nonce.", nonce, parsedAuthInfo.get(AuthenticationInfoToken.NEXT_NONCE));
            assertEquals(DigestQop.AUTH.getToken(), parsedAuthInfo.get(AuthenticationInfoToken.MESSAGE_QOP));
            String nonceCountString = toHex(thisNonceCount);
            assertEquals(createRspAuth("userOne", REALM_NAME, "passwordOne", "/", nonce, nonceCountString, clientNonce), parsedAuthInfo.get(AuthenticationInfoToken.RESPONSE_AUTH));
            assertEquals(clientNonce, parsedAuthInfo.get(AuthenticationInfoToken.CNONCE));
            assertEquals(nonceCountString, parsedAuthInfo.get(AuthenticationInfoToken.NONCE_COUNT));
        } else {
            assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
        }
    }
}

Example 2 with DigestWWWAuthenticateToken

use of io.undertow.security.impl.DigestWWWAuthenticateToken in project undertow by undertow-io.

the class DigestAuthenticationAuthTestCase method _testBadUsername.

static void _testBadUsername() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    String value = getAuthHeader(DIGEST, values);
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    assertEquals(DigestQop.AUTH.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.MESSAGE_QOP));
    String clientNonce = createNonce();
    int nonceCount = 1;
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String opaque = parsedHeader.get(DigestWWWAuthenticateToken.OPAQUE);
    assertNotNull(opaque);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    int thisNonceCount = nonceCount++;
    String authorization = createAuthorizationLine("noUser", "passwordOne", "GET", "/", nonce, thisNonceCount, clientNonce, opaque);
    get.addHeader(AUTHORIZATION.toString(), authorization);
    result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    assertSingleNotificationType(EventType.FAILED_AUTHENTICATION);
}

Example 3 with DigestWWWAuthenticateToken

use of io.undertow.security.impl.DigestWWWAuthenticateToken in project undertow by undertow-io.

the class DigestAuthenticationAuthTestCase method _testBadPassword.

static void _testBadPassword() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    String value = getAuthHeader(DIGEST, values);
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    assertEquals(DigestQop.AUTH.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.MESSAGE_QOP));
    String clientNonce = createNonce();
    int nonceCount = 1;
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String opaque = parsedHeader.get(DigestWWWAuthenticateToken.OPAQUE);
    assertNotNull(opaque);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    int thisNonceCount = nonceCount++;
    String authorization = createAuthorizationLine("userOne", "badPassword", "GET", "/", nonce, thisNonceCount, clientNonce, opaque);
    get.addHeader(AUTHORIZATION.toString(), authorization);
    result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    assertSingleNotificationType(EventType.FAILED_AUTHENTICATION);
}

Example 4 with DigestWWWAuthenticateToken

use of io.undertow.security.impl.DigestWWWAuthenticateToken in project undertow by undertow-io.

the class DigestAuthentication2069TestCase method testNonceReUse.

/**
     * Test that in RFC2069 mode nonce re-use is rejected.
     */
@Test
public void testNonceReUse() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    assertEquals(1, values.length);
    String value = values[0].getValue();
    assertTrue(value.startsWith(DIGEST.toString()));
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String response = createResponse("userOne", REALM_NAME, "passwordOne", "GET", "/", nonce);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    StringBuilder sb = new StringBuilder(DIGEST.toString());
    sb.append(" ");
    sb.append(DigestAuthorizationToken.USERNAME.getName()).append("=").append("\"userOne\"").append(",");
    sb.append(DigestAuthorizationToken.REALM.getName()).append("=\"").append(REALM_NAME).append("\",");
    sb.append(DigestAuthorizationToken.NONCE.getName()).append("=\"").append(nonce).append("\",");
    sb.append(DigestAuthorizationToken.DIGEST_URI.getName()).append("=\"/\",");
    sb.append(DigestAuthorizationToken.RESPONSE.getName()).append("=\"").append(response).append("\"");
    get.addHeader(AUTHORIZATION.toString(), sb.toString());
    result = client.execute(get);
    assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
    values = result.getHeaders("ProcessedBy");
    assertEquals(1, values.length);
    assertEquals("ResponseHandler", values[0].getValue());
    assertSingleNotificationType(EventType.AUTHENTICATED);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    get.addHeader(AUTHORIZATION.toString(), sb.toString());
    result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    values = result.getHeaders(WWW_AUTHENTICATE.toString());
    assertEquals(1, values.length);
    value = values[0].getValue();
    assertTrue(value.startsWith(DIGEST.toString()));
    parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    assertEquals("true", parsedHeader.get(DigestWWWAuthenticateToken.STALE));
    nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    response = createResponse("userOne", REALM_NAME, "passwordOne", "GET", "/", nonce);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    sb = new StringBuilder(DIGEST.toString());
    sb.append(" ");
    sb.append(DigestAuthorizationToken.USERNAME.getName()).append("=").append("\"userOne\"").append(",");
    sb.append(DigestAuthorizationToken.REALM.getName()).append("=\"").append(REALM_NAME).append("\",");
    sb.append(DigestAuthorizationToken.NONCE.getName()).append("=\"").append(nonce).append("\",");
    sb.append(DigestAuthorizationToken.DIGEST_URI.getName()).append("=\"/\",");
    sb.append(DigestAuthorizationToken.RESPONSE.getName()).append("=\"").append(response).append("\"");
    get.addHeader(AUTHORIZATION.toString(), sb.toString());
    result = client.execute(get);
    assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
    values = result.getHeaders("ProcessedBy");
    assertEquals(1, values.length);
    assertEquals("ResponseHandler", values[0].getValue());
    // The additional round trip for the bad nonce should not trigger a security notification.
    assertSingleNotificationType(EventType.AUTHENTICATED);
}

Example 5 with DigestWWWAuthenticateToken

use of io.undertow.security.impl.DigestWWWAuthenticateToken in project undertow by undertow-io.

the class DigestAuthentication2069TestCase method testBadPassword.

/**
     * Test that a request is correctly rejected if a bad password is used to generate the response value.
     */
@Test
public void testBadPassword() throws Exception {
    TestHttpClient client = new TestHttpClient();
    HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL());
    HttpResponse result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
    assertEquals(1, values.length);
    String value = values[0].getValue();
    assertTrue(value.startsWith(DIGEST.toString()));
    Map<DigestWWWAuthenticateToken, String> parsedHeader = DigestWWWAuthenticateToken.parseHeader(value.substring(7));
    assertEquals(REALM_NAME, parsedHeader.get(DigestWWWAuthenticateToken.REALM));
    assertEquals(DigestAlgorithm.MD5.getToken(), parsedHeader.get(DigestWWWAuthenticateToken.ALGORITHM));
    String nonce = parsedHeader.get(DigestWWWAuthenticateToken.NONCE);
    String response = createResponse("userOne", REALM_NAME, "badPassword", "GET", "/", nonce);
    client = new TestHttpClient();
    get = new HttpGet(DefaultServer.getDefaultServerURL());
    StringBuilder sb = new StringBuilder(DIGEST.toString());
    sb.append(" ");
    sb.append(DigestAuthorizationToken.USERNAME.getName()).append("=").append("\"userOne\"").append(",");
    sb.append(DigestAuthorizationToken.REALM.getName()).append("=\"").append(REALM_NAME).append("\",");
    sb.append(DigestAuthorizationToken.NONCE.getName()).append("=\"").append(nonce).append("\",");
    sb.append(DigestAuthorizationToken.DIGEST_URI.getName()).append("=\"/\",");
    sb.append(DigestAuthorizationToken.RESPONSE.getName()).append("=\"").append(response).append("\"");
    get.addHeader(AUTHORIZATION.toString(), sb.toString());
    result = client.execute(get);
    assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
    assertSingleNotificationType(EventType.FAILED_AUTHENTICATION);
}