Examples with SecurityCollection org.apache.catalina.deploy.SecurityCollection used on opensource projects

Example 1 with SecurityCollection

use of org.apache.catalina.deploy.SecurityCollection in project tomcat70 by apache.

the class TestAbstractHttp11Processor method doTestNon2xxResponseAndExpectation.

private void doTestNon2xxResponseAndExpectation(boolean useExpectation) throws Exception {
    Tomcat tomcat = getTomcatInstance();
    // No file system docBase required
    Context ctx = tomcat.addContext("", null);
    Tomcat.addServlet(ctx, "echo", new EchoBodyServlet());
    ctx.addServletMapping("/echo", "echo");
    SecurityCollection collection = new SecurityCollection("All", "");
    collection.addPattern("/*");
    SecurityConstraint constraint = new SecurityConstraint();
    constraint.addAuthRole("Any");
    constraint.addCollection(collection);
    ctx.addConstraint(constraint);
    tomcat.start();
    Non2xxResponseClient client = new Non2xxResponseClient(useExpectation);
    client.setPort(getPort());
    client.doResourceRequest("GET http://localhost:" + getPort() + "/echo HTTP/1.1", "HelloWorld");
    Assert.assertTrue(client.isResponse403());
    Assert.assertTrue(client.checkConnectionHeader());
}

Example 2 with SecurityCollection

use of org.apache.catalina.deploy.SecurityCollection in project tomcat70 by apache.

the class TestWebSocketFrameClient method testConnectToDigestEndpoint.

@Test
public void testConnectToDigestEndpoint() throws Exception {
    Tomcat tomcat = getTomcatInstance();
    Context ctx = tomcat.addContext(URI_PROTECTED, null);
    ctx.addApplicationListener(TesterEchoServer.Config.class.getName());
    Tomcat.addServlet(ctx, "default", new DefaultServlet());
    ctx.addServletMapping("/", "default");
    SecurityCollection collection = new SecurityCollection();
    collection.addPattern("/*");
    tomcat.addUser(USER, PWD);
    tomcat.addRole(USER, ROLE);
    SecurityConstraint sc = new SecurityConstraint();
    sc.addAuthRole(ROLE);
    sc.addCollection(collection);
    ctx.addConstraint(sc);
    LoginConfig lc = new LoginConfig();
    lc.setAuthMethod("DIGEST");
    ctx.setLoginConfig(lc);
    AuthenticatorBase digestAuthenticator = new org.apache.catalina.authenticator.DigestAuthenticator();
    ctx.getPipeline().addValve(digestAuthenticator);
    tomcat.start();
    ClientEndpointConfig clientEndpointConfig = ClientEndpointConfig.Builder.create().build();
    clientEndpointConfig.getUserProperties().put(Constants.WS_AUTHENTICATION_USER_NAME, USER);
    clientEndpointConfig.getUserProperties().put(Constants.WS_AUTHENTICATION_PASSWORD, PWD);
    echoTester(URI_PROTECTED, clientEndpointConfig);
}

Example 3 with SecurityCollection

use of org.apache.catalina.deploy.SecurityCollection in project tomcat70 by apache.

the class TestMapperWebapps method testRedirect.

@Test
public void testRedirect() throws Exception {
    Tomcat tomcat = getTomcatInstance();
    // Use standard test webapp as ROOT
    File rootDir = new File("test/webapp-3.0");
    org.apache.catalina.Context root = tomcat.addWebapp(null, "", rootDir.getAbsolutePath());
    // Add a security constraint
    SecurityConstraint constraint = new SecurityConstraint();
    SecurityCollection collection = new SecurityCollection();
    collection.addPattern("/welcome-files/*");
    collection.addPattern("/welcome-files");
    constraint.addCollection(collection);
    constraint.addAuthRole("foo");
    root.addConstraint(constraint);
    // Also make examples available
    File examplesDir = new File(getBuildDirectory(), "webapps/examples");
    org.apache.catalina.Context examples = tomcat.addWebapp(null, "/examples", examplesDir.getAbsolutePath());
    examples.setMapperContextRootRedirectEnabled(false);
    // Then block access to the examples to test redirection
    RemoteAddrValve rav = new RemoteAddrValve();
    rav.setDeny(".*");
    rav.setDenyStatus(404);
    examples.getPipeline().addValve(rav);
    tomcat.start();
    // Redirects within a web application
    doRedirectTest("/welcome-files", 401);
    doRedirectTest("/welcome-files/", 401);
    doRedirectTest("/jsp", 302);
    doRedirectTest("/jsp/", 404);
    doRedirectTest("/WEB-INF", 404);
    doRedirectTest("/WEB-INF/", 404);
    // Redirects between web applications
    doRedirectTest("/examples", 404);
    doRedirectTest("/examples/", 404);
}

Example 4 with SecurityCollection

use of org.apache.catalina.deploy.SecurityCollection in project tomcat70 by apache.

the class TestDigestAuthenticator method setUp.

@Override
public void setUp() throws Exception {
    super.setUp();
    // Configure a context with digest auth and a single protected resource
    Tomcat tomcat = getTomcatInstance();
    // No file system docBase required
    Context ctxt = tomcat.addContext(CONTEXT_PATH, null);
    // Add protected servlet
    Tomcat.addServlet(ctxt, "TesterServlet", new TesterServlet());
    ctxt.addServletMapping(URI, "TesterServlet");
    SecurityCollection collection = new SecurityCollection();
    collection.addPattern(URI);
    SecurityConstraint sc = new SecurityConstraint();
    sc.addAuthRole(ROLE);
    sc.addCollection(collection);
    ctxt.addConstraint(sc);
    // Configure the Realm
    MapRealm realm = new MapRealm();
    realm.addUser(USER, PWD);
    realm.addUserRole(USER, ROLE);
    ctxt.setRealm(realm);
    // Configure the authenticator
    LoginConfig lc = new LoginConfig();
    lc.setAuthMethod("DIGEST");
    lc.setRealmName(REALM);
    ctxt.setLoginConfig(lc);
    ctxt.getPipeline().addValve(new DigestAuthenticator());
}

Example 5 with SecurityCollection

use of org.apache.catalina.deploy.SecurityCollection in project tomcat70 by apache.

the class TestNonLoginAndBasicAuthenticator method setUpNonLogin.

private void setUpNonLogin() throws Exception {
    // No file system docBase required
    nonloginContext = tomcat.addContext(CONTEXT_PATH_NOLOGIN, null);
    nonloginContext.setSessionTimeout(LONG_SESSION_TIMEOUT_MINS);
    // Add protected servlet to the context
    Tomcat.addServlet(nonloginContext, "TesterServlet1", new TesterServlet());
    nonloginContext.addServletMapping(URI_PROTECTED, "TesterServlet1");
    SecurityCollection collection1 = new SecurityCollection();
    collection1.addPattern(URI_PROTECTED);
    SecurityConstraint sc1 = new SecurityConstraint();
    sc1.addAuthRole(ROLE);
    sc1.addCollection(collection1);
    nonloginContext.addConstraint(sc1);
    // Add unprotected servlet to the context
    Tomcat.addServlet(nonloginContext, "TesterServlet2", new TesterServlet());
    nonloginContext.addServletMapping(URI_PUBLIC, "TesterServlet2");
    SecurityCollection collection2 = new SecurityCollection();
    collection2.addPattern(URI_PUBLIC);
    SecurityConstraint sc2 = new SecurityConstraint();
    // do not add a role - which signals access permitted without one
    sc2.addCollection(collection2);
    nonloginContext.addConstraint(sc2);
    // Configure the authenticator and inherit the Realm from Engine
    LoginConfig lc = new LoginConfig();
    lc.setAuthMethod("NONE");
    nonloginContext.setLoginConfig(lc);
    AuthenticatorBase nonloginAuthenticator = new NonLoginAuthenticator();
    nonloginContext.getPipeline().addValve(nonloginAuthenticator);
}