Examples with SecurityCollection org.apache.tomcat.util.descriptor.web.SecurityCollection used on opensource projects

Example 26 with SecurityCollection

use of org.apache.tomcat.util.descriptor.web.SecurityCollection in project tomcat by apache.

the class TestSSOnonLoginAndBasicAuthenticator method setUpLogin.

private void setUpLogin() throws Exception {
    // Must have a real docBase for webapps - just use temp
    basicContext = tomcat.addContext(CONTEXT_PATH_LOGIN, System.getProperty("java.io.tmpdir"));
    basicContext.setSessionTimeout(SHORT_SESSION_TIMEOUT_MINS);
    // Add protected servlet to the context
    Tomcat.addServlet(basicContext, "TesterServlet3", new TesterServletEncodeUrl());
    basicContext.addServletMappingDecoded(URI_PROTECTED, "TesterServlet3");
    SecurityCollection collection = new SecurityCollection();
    collection.addPatternDecoded(URI_PROTECTED);
    SecurityConstraint sc = new SecurityConstraint();
    sc.addAuthRole(ROLE);
    sc.addCollection(collection);
    basicContext.addConstraint(sc);
    // Add unprotected servlet to the context
    Tomcat.addServlet(basicContext, "TesterServlet4", new TesterServletEncodeUrl());
    basicContext.addServletMappingDecoded(URI_PUBLIC, "TesterServlet4");
    SecurityCollection collection2 = new SecurityCollection();
    collection2.addPatternDecoded(URI_PUBLIC);
    SecurityConstraint sc2 = new SecurityConstraint();
    // do not add a role - which signals access permitted without one
    sc2.addCollection(collection2);
    basicContext.addConstraint(sc2);
    // Configure the authenticator and inherit the Realm from Engine
    LoginConfig lc = new LoginConfig();
    lc.setAuthMethod("BASIC");
    basicContext.setLoginConfig(lc);
    AuthenticatorBase basicAuthenticator = new BasicAuthenticator();
    basicContext.getPipeline().addValve(basicAuthenticator);
}

Example 27 with SecurityCollection

use of org.apache.tomcat.util.descriptor.web.SecurityCollection in project tomcat by apache.

the class TestSSOnonLoginAndBasicAuthenticator method setUpNonLogin.

private void setUpNonLogin() throws Exception {
    // Must have a real docBase for webapps - just use temp
    nonloginContext = tomcat.addContext(CONTEXT_PATH_NOLOGIN, System.getProperty("java.io.tmpdir"));
    nonloginContext.setSessionTimeout(LONG_SESSION_TIMEOUT_MINS);
    // Add protected servlet to the context
    Tomcat.addServlet(nonloginContext, "TesterServlet1", new TesterServletEncodeUrl());
    nonloginContext.addServletMappingDecoded(URI_PROTECTED, "TesterServlet1");
    SecurityCollection collection1 = new SecurityCollection();
    collection1.addPatternDecoded(URI_PROTECTED);
    SecurityConstraint sc1 = new SecurityConstraint();
    sc1.addAuthRole(ROLE);
    sc1.addCollection(collection1);
    nonloginContext.addConstraint(sc1);
    // Add unprotected servlet to the context
    Tomcat.addServlet(nonloginContext, "TesterServlet2", new TesterServletEncodeUrl());
    nonloginContext.addServletMappingDecoded(URI_PUBLIC, "TesterServlet2");
    SecurityCollection collection2 = new SecurityCollection();
    collection2.addPatternDecoded(URI_PUBLIC);
    SecurityConstraint sc2 = new SecurityConstraint();
    // do not add a role - which signals access permitted without one
    sc2.addCollection(collection2);
    nonloginContext.addConstraint(sc2);
    // Configure the authenticator and inherit the Realm from Engine
    LoginConfig lc = new LoginConfig();
    lc.setAuthMethod("NONE");
    nonloginContext.setLoginConfig(lc);
    AuthenticatorBase nonloginAuthenticator = new NonLoginAuthenticator();
    nonloginContext.getPipeline().addValve(nonloginAuthenticator);
}

Example 28 with SecurityCollection

use of org.apache.tomcat.util.descriptor.web.SecurityCollection in project tomcat by apache.

the class TestAuthenticatorBaseCorsPreflight method test.

@Test
public void test() throws Exception {
    Tomcat tomcat = getTomcatInstance();
    File appDir = new File("test/webapp");
    Context ctx = tomcat.addContext("", appDir.getAbsolutePath());
    Tomcat.addServlet(ctx, "default", new DefaultServlet());
    ctx.addServletMappingDecoded("/", "default");
    LoginConfig loginConfig = new LoginConfig();
    loginConfig.setAuthMethod("BASIC");
    ctx.setLoginConfig(loginConfig);
    BasicAuthenticator basicAuth = new BasicAuthenticator();
    basicAuth.setAllowCorsPreflight(allowCorsPreflight.toString());
    ctx.getPipeline().addValve(basicAuth);
    Realm realm = new NullRealm();
    ctx.setRealm(realm);
    SecurityCollection securityCollection = new SecurityCollection();
    securityCollection.addPattern("/*");
    SecurityConstraint constraint = new SecurityConstraint();
    constraint.setAuthConstraint(true);
    constraint.addCollection(securityCollection);
    ctx.addConstraint(constraint);
    // For code coverage
    FilterDef otherFilter = new FilterDef();
    otherFilter.setFilterName("other");
    otherFilter.setFilterClass(AddDefaultCharsetFilter.class.getName());
    FilterMap otherMap = new FilterMap();
    otherMap.setFilterName("other");
    otherMap.addURLPatternDecoded("/other");
    ctx.addFilterDef(otherFilter);
    ctx.addFilterMap(otherMap);
    FilterDef corsFilter = new FilterDef();
    corsFilter.setFilterName("cors");
    corsFilter.setFilterClass(CorsFilter.class.getName());
    corsFilter.addInitParameter(CorsFilter.PARAM_CORS_ALLOWED_ORIGINS, ALLOWED_ORIGIN);
    corsFilter.addInitParameter(CorsFilter.PARAM_CORS_ALLOWED_METHODS, ALLOWED_METHOD);
    FilterMap corsFilterMap = new FilterMap();
    corsFilterMap.setFilterName("cors");
    corsFilterMap.addURLPatternDecoded(filterMapping);
    ctx.addFilterDef(corsFilter);
    ctx.addFilterMap(corsFilterMap);
    tomcat.start();
    Map<String, List<String>> reqHead = new HashMap<>();
    if (origin != null) {
        List<String> values = new ArrayList<>();
        if (SAME_ORIGIN.equals(origin)) {
            values.add(origin + ":" + getPort());
        } else {
            values.add(origin);
        }
        reqHead.put(CorsFilter.REQUEST_HEADER_ORIGIN, values);
    }
    if (accessControl != null) {
        List<String> values = new ArrayList<>();
        values.add(accessControl);
        reqHead.put(CorsFilter.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD, values);
    }
    ByteChunk out = new ByteChunk();
    int rc = methodUrl("http://localhost:" + getPort() + "/target", out, 300000, reqHead, null, method, false);
    if (allow) {
        Assert.assertEquals(200, rc);
    } else {
        Assert.assertEquals(403, rc);
    }
}

Example 29 with SecurityCollection

use of org.apache.tomcat.util.descriptor.web.SecurityCollection in project tomcat by apache.

the class TestNonLoginAndBasicAuthenticator method setUpNonLogin.

private void setUpNonLogin() throws Exception {
    // Must have a real docBase for webapps - just use temp
    nonloginContext = tomcat.addContext(CONTEXT_PATH_NOLOGIN, System.getProperty("java.io.tmpdir"));
    // Add protected servlet to the context
    Tomcat.addServlet(nonloginContext, "TesterServlet1", new TesterServlet());
    nonloginContext.addServletMappingDecoded(URI_PROTECTED, "TesterServlet1");
    SecurityCollection collection1 = new SecurityCollection();
    collection1.addPatternDecoded(URI_PROTECTED);
    SecurityConstraint sc1 = new SecurityConstraint();
    sc1.addAuthRole(ROLE);
    sc1.addCollection(collection1);
    nonloginContext.addConstraint(sc1);
    // Add unprotected servlet to the context
    Tomcat.addServlet(nonloginContext, "TesterServlet2", new TesterServlet());
    nonloginContext.addServletMappingDecoded(URI_PUBLIC, "TesterServlet2");
    SecurityCollection collection2 = new SecurityCollection();
    collection2.addPatternDecoded(URI_PUBLIC);
    SecurityConstraint sc2 = new SecurityConstraint();
    // do not add a role - which signals access permitted without one
    sc2.addCollection(collection2);
    nonloginContext.addConstraint(sc2);
    // Configure the authenticator and inherit the Realm from Engine
    LoginConfig lc = new LoginConfig();
    lc.setAuthMethod("NONE");
    nonloginContext.setLoginConfig(lc);
    AuthenticatorBase nonloginAuthenticator = new NonLoginAuthenticator();
    nonloginContext.getPipeline().addValve(nonloginAuthenticator);
}

Example 30 with SecurityCollection

use of org.apache.tomcat.util.descriptor.web.SecurityCollection in project tomcat by apache.

the class TestSSOnonLoginAndDigestAuthenticator method setUpNonLogin.

private void setUpNonLogin(Tomcat tomcat) throws Exception {
    // Must have a real docBase for webapps - just use temp
    Context ctxt = tomcat.addContext(CONTEXT_PATH_NOLOGIN, System.getProperty("java.io.tmpdir"));
    ctxt.setSessionTimeout(LONG_TIMEOUT_SECS);
    // Add protected servlet
    Tomcat.addServlet(ctxt, "TesterServlet1", new TesterServlet());
    ctxt.addServletMappingDecoded(URI_PROTECTED, "TesterServlet1");
    SecurityCollection collection1 = new SecurityCollection();
    collection1.addPatternDecoded(URI_PROTECTED);
    SecurityConstraint sc1 = new SecurityConstraint();
    sc1.addAuthRole(ROLE);
    sc1.addCollection(collection1);
    ctxt.addConstraint(sc1);
    // Add unprotected servlet
    Tomcat.addServlet(ctxt, "TesterServlet2", new TesterServlet());
    ctxt.addServletMappingDecoded(URI_PUBLIC, "TesterServlet2");
    SecurityCollection collection2 = new SecurityCollection();
    collection2.addPatternDecoded(URI_PUBLIC);
    SecurityConstraint sc2 = new SecurityConstraint();
    // do not add a role - which signals access permitted without one
    sc2.addCollection(collection2);
    ctxt.addConstraint(sc2);
    // Configure the appropriate authenticator
    LoginConfig lc = new LoginConfig();
    lc.setAuthMethod("NONE");
    ctxt.setLoginConfig(lc);
    ctxt.getPipeline().addValve(new NonLoginAuthenticator());
}