Examples with CredentialGenerator org.apache.geode.security.generator.CredentialGenerator used on opensource projects

Example 26 with CredentialGenerator

use of org.apache.geode.security.generator.CredentialGenerator in project geode by apache.

the class ClientAuthorizationDUnitTest method testDisallowPutsGets.

@Test
public void testDisallowPutsGets() {
    AuthzCredentialGenerator gen = getXmlAuthzGenerator();
    CredentialGenerator cGen = gen.getCredentialGenerator();
    Properties extraAuthProps = cGen.getSystemProperties();
    Properties javaProps = cGen.getJavaProperties();
    Properties extraAuthzProps = gen.getSystemProperties();
    String authenticator = cGen.getAuthenticator();
    String authInit = cGen.getAuthInit();
    String accessor = gen.getAuthorizationCallback();
    getLogWriter().info("testDisallowPutsGets: Using authinit: " + authInit);
    getLogWriter().info("testDisallowPutsGets: Using authenticator: " + authenticator);
    getLogWriter().info("testDisallowPutsGets: Using accessor: " + accessor);
    // Check that we indeed can obtain valid credentials not allowed to do gets
    Properties createCredentials = gen.getAllowedCredentials(new OperationCode[] { OperationCode.PUT }, new String[] { regionName }, 1);
    Properties createJavaProps = cGen.getJavaProperties();
    getLogWriter().info("testDisallowPutsGets: For first client credentials: " + createCredentials);
    Properties getCredentials = gen.getDisallowedCredentials(new OperationCode[] { OperationCode.GET }, new String[] { regionName }, 2);
    Properties getJavaProps = cGen.getJavaProperties();
    getLogWriter().info("testDisallowPutsGets: For second client disallowed GET credentials: " + getCredentials);
    // Start servers with all required properties
    Properties serverProps = buildProperties(authenticator, accessor, false, extraAuthProps, extraAuthzProps);
    int port1 = createServer1(javaProps, serverProps);
    int port2 = createServer2(javaProps, serverProps);
    createClient1NoException(createJavaProps, authInit, port1, port2, createCredentials);
    createClient2NoException(getJavaProps, authInit, port1, port2, getCredentials);
    // Perform some put operations from client1
    client1.invoke(() -> doPuts(2, NO_EXCEPTION));
    // Gets as normal user should throw exception
    client2.invoke(() -> doGets(2, NOTAUTHZ_EXCEPTION));
    // Try to connect client2 with reader credentials
    getCredentials = gen.getAllowedCredentials(new OperationCode[] { OperationCode.GET }, new String[] { regionName }, 5);
    getJavaProps = cGen.getJavaProperties();
    getLogWriter().info("testDisallowPutsGets: For second client with GET credentials: " + getCredentials);
    createClient2NoException(getJavaProps, authInit, port1, port2, getCredentials);
    // Verify that the gets succeed
    client2.invoke(() -> doGets(2, NO_EXCEPTION));
    // Verify that the puts throw exception
    client2.invoke(() -> doNPuts(2, NOTAUTHZ_EXCEPTION));
}

Example 27 with CredentialGenerator

use of org.apache.geode.security.generator.CredentialGenerator in project geode by apache.

the class ClientAuthorizationDUnitTest method testInvalidAccessor.

@Test
public void testInvalidAccessor() {
    AuthzCredentialGenerator gen = getXmlAuthzGenerator();
    CredentialGenerator cGen = gen.getCredentialGenerator();
    Properties extraAuthProps = cGen.getSystemProperties();
    Properties javaProps = cGen.getJavaProperties();
    Properties extraAuthzProps = gen.getSystemProperties();
    String authenticator = cGen.getAuthenticator();
    String authInit = cGen.getAuthInit();
    String accessor = gen.getAuthorizationCallback();
    getLogWriter().info("testInvalidAccessor: Using authinit: " + authInit);
    getLogWriter().info("testInvalidAccessor: Using authenticator: " + authenticator);
    // Start server1 with invalid accessor
    Properties serverProps = buildProperties(authenticator, "org.apache.none", false, extraAuthProps, extraAuthzProps);
    int port1 = createServer1(javaProps, serverProps);
    int port2 = getRandomAvailablePort(SOCKET);
    // Client creation should throw exceptions
    Properties createCredentials = gen.getAllowedCredentials(new OperationCode[] { OperationCode.PUT }, new String[] { regionName }, 3);
    Properties createJavaProps = cGen.getJavaProperties();
    getLogWriter().info("testInvalidAccessor: For first client CREATE credentials: " + createCredentials);
    Properties getCredentials = gen.getAllowedCredentials(new OperationCode[] { OperationCode.GET }, new String[] { regionName }, 7);
    Properties getJavaProps = cGen.getJavaProperties();
    getLogWriter().info("testInvalidAccessor: For second client GET credentials: " + getCredentials);
    client1.invoke(() -> ClientAuthenticationTestUtils.createCacheClient(authInit, createCredentials, createJavaProps, port1, port2, 0, false, false, NO_EXCEPTION));
    client1.invoke(() -> doPuts(1, AUTHFAIL_EXCEPTION));
    client2.invoke(() -> ClientAuthenticationTestUtils.createCacheClient(authInit, getCredentials, getJavaProps, port1, port2, 0, false, false, NO_EXCEPTION));
    client2.invoke(() -> doPuts(1, AUTHFAIL_EXCEPTION));
    // Now start server2 that has valid accessor
    getLogWriter().info("testInvalidAccessor: Using accessor: " + accessor);
    serverProps = buildProperties(authenticator, accessor, false, extraAuthProps, extraAuthzProps);
    createServer2(javaProps, serverProps, port2);
    server1.invoke(() -> closeCache());
    createClient1NoException(createJavaProps, authInit, port1, port2, createCredentials);
    createClient2NoException(getJavaProps, authInit, port1, port2, getCredentials);
    // Now perform some put operations from client1
    client1.invoke(() -> doPuts(4, NO_EXCEPTION));
    // Verify that the gets succeed
    client2.invoke(() -> doGets(4, NO_EXCEPTION));
}

Example 28 with CredentialGenerator

use of org.apache.geode.security.generator.CredentialGenerator in project geode by apache.

the class ClientAuthorizationTestCase method executeOpBlock.

protected void executeOpBlock(final List<OperationWithAction> opBlock, final int port1, final int port2, final String authInit, final Properties extraAuthProps, final Properties extraAuthzProps, final TestCredentialGenerator credentialGenerator, final Random random) throws InterruptedException {
    for (Iterator<OperationWithAction> opIter = opBlock.iterator(); opIter.hasNext(); ) {
        // Start client with valid credentials as specified in OperationWithAction
        OperationWithAction currentOp = opIter.next();
        OperationCode opCode = currentOp.getOperationCode();
        int opFlags = currentOp.getFlags();
        int clientNum = currentOp.getClientNum();
        VM clientVM = null;
        boolean useThisVM = false;
        switch(clientNum) {
            case 1:
                clientVM = client1;
                break;
            case 2:
                clientVM = client2;
                break;
            case 3:
                useThisVM = true;
                break;
            default:
                fail("executeOpBlock: Unknown client number " + clientNum);
                break;
        }
        System.out.println("executeOpBlock: performing operation number [" + currentOp.getOpNum() + "]: " + currentOp);
        if ((opFlags & OpFlags.USE_OLDCONN) == 0) {
            Properties opCredentials;
            int newRnd = random.nextInt(100) + 1;
            String currentRegionName = '/' + regionName;
            if ((opFlags & OpFlags.USE_SUBREGION) > 0) {
                currentRegionName += ('/' + SUBREGION_NAME);
            }
            String credentialsTypeStr;
            OperationCode authOpCode = currentOp.getAuthzOperationCode();
            int[] indices = currentOp.getIndices();
            CredentialGenerator cGen = credentialGenerator.getCredentialGenerator();
            final Properties javaProps = cGen == null ? null : cGen.getJavaProperties();
            if ((opFlags & OpFlags.CHECK_NOTAUTHZ) > 0 || (opFlags & OpFlags.USE_NOTAUTHZ) > 0) {
                opCredentials = credentialGenerator.getDisallowedCredentials(new OperationCode[] { authOpCode }, new String[] { currentRegionName }, indices, newRnd);
                credentialsTypeStr = " unauthorized " + authOpCode;
            } else {
                opCredentials = credentialGenerator.getAllowedCredentials(new OperationCode[] { opCode, authOpCode }, new String[] { currentRegionName }, indices, newRnd);
                credentialsTypeStr = " authorized " + authOpCode;
            }
            Properties clientProps = concatProperties(new Properties[] { opCredentials, extraAuthProps, extraAuthzProps });
            // Start the client with valid credentials but allowed or disallowed to perform an operation
            System.out.println("executeOpBlock: For client" + clientNum + credentialsTypeStr + " credentials: " + opCredentials);
            boolean setupDynamicRegionFactory = (opFlags & OpFlags.ENABLE_DRF) > 0;
            if (useThisVM) {
                SecurityTestUtils.createCacheClientWithDynamicRegion(authInit, clientProps, javaProps, 0, setupDynamicRegionFactory, NO_EXCEPTION);
            } else {
                clientVM.invoke("SecurityTestUtils.createCacheClientWithDynamicRegion", () -> SecurityTestUtils.createCacheClientWithDynamicRegion(authInit, clientProps, javaProps, 0, setupDynamicRegionFactory, NO_EXCEPTION));
            }
        }
        int expectedResult;
        if ((opFlags & OpFlags.CHECK_NOTAUTHZ) > 0) {
            expectedResult = NOTAUTHZ_EXCEPTION;
        } else if ((opFlags & OpFlags.CHECK_EXCEPTION) > 0) {
            expectedResult = OTHER_EXCEPTION;
        } else {
            expectedResult = NO_EXCEPTION;
        }
        // Perform the operation from selected client
        if (useThisVM) {
            doOp(opCode, currentOp.getIndices(), new Integer(opFlags), new Integer(expectedResult));
        } else {
            int[] indices = currentOp.getIndices();
            clientVM.invoke("ClientAuthorizationTestCase.doOp", () -> ClientAuthorizationTestCase.doOp(opCode, indices, new Integer(opFlags), new Integer(expectedResult)));
        }
    }
}

Example 29 with CredentialGenerator

use of org.apache.geode.security.generator.CredentialGenerator in project geode by apache.

the class ClientAuthorizationTestCase method getXmlAuthzGenerator.

protected AuthzCredentialGenerator getXmlAuthzGenerator() {
    AuthzCredentialGenerator authzGen = new XmlAuthzCredentialGenerator();
    CredentialGenerator cGen = new DummyCredentialGenerator();
    cGen.init();
    authzGen.init(cGen);
    return authzGen;
}

Example 30 with CredentialGenerator

use of org.apache.geode.security.generator.CredentialGenerator in project geode by apache.

the class DeltaClientAuthorizationDUnitTest method testAllowPutsGets.

@Test
public void testAllowPutsGets() throws Exception {
    AuthzCredentialGenerator gen = this.getXmlAuthzGenerator();
    CredentialGenerator cGen = gen.getCredentialGenerator();
    Properties extraAuthProps = cGen.getSystemProperties();
    Properties javaProps = cGen.getJavaProperties();
    Properties extraAuthzProps = gen.getSystemProperties();
    String authenticator = cGen.getAuthenticator();
    String authInit = cGen.getAuthInit();
    String accessor = gen.getAuthorizationCallback();
    getLogWriter().info("testAllowPutsGets: Using authinit: " + authInit);
    getLogWriter().info("testAllowPutsGets: Using authenticator: " + authenticator);
    getLogWriter().info("testAllowPutsGets: Using accessor: " + accessor);
    // Start servers with all required properties
    Properties serverProps = buildProperties(authenticator, accessor, false, extraAuthProps, extraAuthzProps);
    int port1 = createServer1(javaProps, serverProps);
    int port2 = createServer2(javaProps, serverProps);
    // Start client1 with valid CREATE credentials
    Properties createCredentials = gen.getAllowedCredentials(new OperationCode[] { OperationCode.PUT }, new String[] { REGION_NAME }, 1);
    javaProps = cGen.getJavaProperties();
    getLogWriter().info("testAllowPutsGets: For first client credentials: " + createCredentials);
    createClient1(javaProps, authInit, port1, port2, createCredentials);
    // Start client2 with valid GET credentials
    Properties getCredentials = gen.getAllowedCredentials(new OperationCode[] { OperationCode.GET }, new String[] { REGION_NAME }, 2);
    javaProps = cGen.getJavaProperties();
    getLogWriter().info("testAllowPutsGets: For second client credentials: " + getCredentials);
    createClient2(javaProps, authInit, port1, port2, getCredentials);
    // Perform some put operations from client1
    client1.invoke(() -> doPuts(2, NO_EXCEPTION));
    Thread.sleep(5000);
    assertTrue("Delta feature NOT used", client1.invoke(() -> DeltaTestImpl.toDeltaFeatureUsed()));
    // Verify that the gets succeed
    client2.invoke(() -> doGets(2, NO_EXCEPTION));
}