Examples with SecurityFilterChain org.codice.ddf.platform.filter.SecurityFilterChain used on opensource projects

Example 6 with SecurityFilterChain

use of org.codice.ddf.platform.filter.SecurityFilterChain in project ddf by codice.

the class WebSSOFilterTest method testDoFilterReturnsGuestTokenWhenNoHandlersRegisteredAndGuestAccessEnabled.

@Test
public void testDoFilterReturnsGuestTokenWhenNoHandlersRegisteredAndGuestAccessEnabled() throws IOException, AuthenticationException {
    ContextPolicyManager policyManager = mock(ContextPolicyManager.class);
    when(policyManager.isWhiteListed(MOCK_CONTEXT)).thenReturn(false);
    when(policyManager.getGuestAccess()).thenReturn(true);
    when(policyManager.getSessionAccess()).thenReturn(true);
    WebSSOFilter filter = new WebSSOFilter();
    filter.setContextPolicyManager(policyManager);
    SecurityFilterChain filterChain = mock(SecurityFilterChain.class);
    HttpServletRequest request = mock(HttpServletRequest.class);
    when(request.getRequestURI()).thenReturn(MOCK_CONTEXT);
    HttpServletResponse response = mock(HttpServletResponse.class);
    filter.doFilter(request, response, filterChain);
    ArgumentCaptor<HandlerResult> handlerResult = ArgumentCaptor.forClass(HandlerResult.class);
    verify(request).setAttribute(eq(DDF_AUTHENTICATION_TOKEN), handlerResult.capture());
    assertTrue(handlerResult.getValue().getToken() instanceof GuestAuthenticationToken);
}

Example 7 with SecurityFilterChain

use of org.codice.ddf.platform.filter.SecurityFilterChain in project ddf by codice.

the class WebSSOFilterTest method testDoFilterSessionStorageDisabled.

@Test
public void testDoFilterSessionStorageDisabled() throws Exception {
    PrincipalCollection principalCollectionMock = mock(PrincipalCollection.class);
    PrincipalHolder principalHolderMock = mock(PrincipalHolder.class);
    when(principalHolderMock.getPrincipals()).thenReturn(principalCollectionMock);
    HttpSession sessionMock = mock(HttpSession.class);
    when(sessionMock.getAttribute(SECURITY_TOKEN_KEY)).thenReturn(principalHolderMock);
    HttpServletRequest requestMock = mock(HttpServletRequest.class);
    when(requestMock.getSession(any(Boolean.class))).thenReturn(sessionMock);
    when(requestMock.getRequestURI()).thenReturn(MOCK_CONTEXT);
    HttpServletResponse responseMock = mock(HttpServletResponse.class);
    ContextPolicyManager policyManager = mock(ContextPolicyManager.class);
    when(policyManager.getSessionAccess()).thenReturn(false);
    when(policyManager.isWhiteListed(MOCK_CONTEXT)).thenReturn(false);
    ContextPolicy testPolicy = mock(ContextPolicy.class);
    when(testPolicy.getAuthenticationMethods()).thenReturn(Collections.singletonList("basic"));
    when(policyManager.getContextPolicy(MOCK_CONTEXT)).thenReturn(testPolicy);
    AuthenticationHandler handlerMock = mock(AuthenticationHandler.class);
    when(handlerMock.getAuthenticationType()).thenReturn("basic");
    HandlerResult completedResult = mock(HandlerResult.class);
    when(completedResult.getStatus()).thenReturn(Status.COMPLETED);
    when(completedResult.getToken()).thenReturn(mock(BaseAuthenticationToken.class));
    when(handlerMock.getNormalizedToken(any(ServletRequest.class), any(ServletResponse.class), any(SecurityFilterChain.class), anyBoolean())).thenReturn(completedResult);
    SecurityFilterChain filterChain = mock(SecurityFilterChain.class);
    WebSSOFilter filter = new WebSSOFilter();
    filter.setContextPolicyManager(policyManager);
    filter.setHandlerList(Collections.singletonList(handlerMock));
    filter.doFilter(requestMock, responseMock, filterChain);
    verify(sessionMock, times(0)).getAttribute(SECURITY_TOKEN_KEY);
    verify(handlerMock, times(1)).getNormalizedToken(any(), any(), any(), anyBoolean());
    verify(requestMock, times(1)).setAttribute(eq(AUTHENTICATION_TOKEN_KEY), any());
}

Example 8 with SecurityFilterChain

use of org.codice.ddf.platform.filter.SecurityFilterChain in project ddf by codice.

the class AuthorizationFilterTest method testNoSubject.

@Test
public void testNoSubject() {
    ContextPolicyManager contextPolicyManager = new TestPolicyManager();
    contextPolicyManager.setContextPolicy(PATH, getMockContextPolicy());
    AuthorizationFilter loginFilter = new AuthorizationFilter(contextPolicyManager);
    loginFilter.setSecurityLogger(mock(SecurityLogger.class));
    loginFilter.init();
    HttpServletRequest servletRequest = getMockServletRequest();
    HttpServletResponse servletResponse = mock(HttpServletResponse.class);
    SecurityFilterChain filterChain = (request, response) -> fail("Should not have called doFilter without a valid Subject");
    try {
        loginFilter.doFilter(servletRequest, servletResponse, filterChain);
    } catch (IOException | AuthenticationException e) {
        fail(e.getMessage());
    }
}

Example 9 with SecurityFilterChain

use of org.codice.ddf.platform.filter.SecurityFilterChain in project ddf by codice.

the class AuthorizationFilterTest method testUnAuthorizedSubject.

@Test
public void testUnAuthorizedSubject() {
    ContextPolicyManager contextPolicyManager = new TestPolicyManager();
    contextPolicyManager.setContextPolicy(PATH, getMockContextPolicy());
    AuthorizationFilter loginFilter = new AuthorizationFilter(contextPolicyManager);
    loginFilter.setSecurityLogger(mock(SecurityLogger.class));
    loginFilter.init();
    Subject subject = mock(Subject.class);
    when(subject.isPermitted(any(CollectionPermission.class))).thenReturn(false);
    ThreadContext.bind(subject);
    HttpServletRequest servletRequest = getMockServletRequest();
    HttpServletResponse servletResponse = mock(HttpServletResponse.class);
    SecurityFilterChain filterChain = (request, response) -> fail("Should not have called doFilter without a valid Subject");
    try {
        loginFilter.doFilter(servletRequest, servletResponse, filterChain);
    } catch (IOException | AuthenticationException e) {
        fail(e.getMessage());
    }
    ThreadContext.unbindSubject();
}

Example 10 with SecurityFilterChain

use of org.codice.ddf.platform.filter.SecurityFilterChain in project ddf by codice.

the class BasicAuthenticationHandlerTest method testGetNormalizedTokenResolveWithCredentials.

/**
 * This test case handles the scenario in which the credentials should be obtained (i.e. resolve
 * flag is set) - both requests without and with the credentials are tested.
 */
@Test
public void testGetNormalizedTokenResolveWithCredentials() throws Exception {
    BasicAuthenticationHandler handler = new BasicAuthenticationHandler();
    HttpServletRequest request = mock(HttpServletRequest.class);
    HttpServletResponse response = mock(HttpServletResponse.class);
    SecurityFilterChain chain = mock(SecurityFilterChain.class);
    when(request.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn("Basic " + Base64.getEncoder().encodeToString(CREDENTIALS.getBytes()));
    HandlerResult result = handler.getNormalizedToken(request, response, chain, true);
    assertNotNull(result);
    assertEquals(HandlerResult.Status.COMPLETED, result.getStatus());
    assertEquals("admin", getAttributeValue(result.getToken(), USERNAME_ATTR));
    assertEquals("password", getAttributeValue(result.getToken(), PASSWORD_ATTR));
    // confirm that no responses were sent through the HttpResponse
    Mockito.verify(response, never()).setHeader(anyString(), anyString());
    Mockito.verify(response, never()).setStatus(anyInt());
    Mockito.verify(response, never()).setContentLength(anyInt());
    Mockito.verify(response, never()).flushBuffer();
}