Examples with AuthorizationService org.eclipse.hono.service.auth.AuthorizationService used on opensource projects

Example 1 with AuthorizationService

use of org.eclipse.hono.service.auth.AuthorizationService in project hono by eclipse.

the class AmqpServiceBaseTest method testHandleReceiverOpenRejectsUnauthorizedClient.

/**
 * Verifies that the service rejects sender links on resources that
 * the client is not authorized to write to.
 */
@Test
public void testHandleReceiverOpenRejectsUnauthorizedClient() {
    // GIVEN a server with a endpoint
    final ResourceIdentifier restrictedTargetAddress = ResourceIdentifier.from(ENDPOINT, "RESTRICTED_TENANT", null);
    final AmqpEndpoint endpoint = mock(AmqpEndpoint.class);
    when(endpoint.getName()).thenReturn(ENDPOINT);
    final AuthorizationService authService = mock(AuthorizationService.class);
    when(authService.isAuthorized(Constants.PRINCIPAL_ANONYMOUS, restrictedTargetAddress, Activity.WRITE)).thenReturn(Future.succeededFuture(Boolean.FALSE));
    final AmqpServiceBase<ServiceConfigProperties> server = createServer(endpoint);
    server.setAuthorizationService(authService);
    // WHEN a client connects to the server using a address for a tenant it is not authorized to write to
    final Target target = getTarget(restrictedTargetAddress);
    final ProtonReceiver receiver = mock(ProtonReceiver.class);
    when(receiver.getRemoteTarget()).thenReturn(target);
    when(receiver.setCondition(any())).thenReturn(receiver);
    server.handleReceiverOpen(newConnection(Constants.PRINCIPAL_ANONYMOUS), receiver);
    // THEN the server closes the link with the client
    verify(receiver).close();
}

Example 2 with AuthorizationService

use of org.eclipse.hono.service.auth.AuthorizationService in project hono by eclipse.

the class AmqpServiceBaseTest method testHandleReceiverOpenForwardsToEndpoint.

/**
 * Verifies that the service notifies a registered endpoint about a client
 * that has established a link.
 */
@Test
public void testHandleReceiverOpenForwardsToEndpoint() {
    // GIVEN a server with an endpoint
    final ResourceIdentifier targetAddress = ResourceIdentifier.from(ENDPOINT, Constants.DEFAULT_TENANT, null);
    final AmqpEndpoint endpoint = mock(AmqpEndpoint.class);
    when(endpoint.getName()).thenReturn(ENDPOINT);
    final AuthorizationService authService = mock(AuthorizationService.class);
    when(authService.isAuthorized(Constants.PRINCIPAL_ANONYMOUS, targetAddress, Activity.WRITE)).thenReturn(Future.succeededFuture(Boolean.TRUE));
    final AmqpServiceBase<ServiceConfigProperties> server = createServer(endpoint);
    server.setAuthorizationService(authService);
    // WHEN a client connects to the server using this endpoint
    final Target target = getTarget(targetAddress);
    final ProtonReceiver receiver = mock(ProtonReceiver.class);
    when(receiver.getRemoteTarget()).thenReturn(target);
    when(receiver.attachments()).thenReturn(mock(Record.class));
    server.handleReceiverOpen(newConnection(Constants.PRINCIPAL_ANONYMOUS), receiver);
    // THEN the server delegates link establishment to the endpoint
    verify(endpoint).onLinkAttach(any(ProtonConnection.class), eq(receiver), eq(targetAddress));
}

Example 3 with AuthorizationService

use of org.eclipse.hono.service.auth.AuthorizationService in project hono by eclipse.

the class RequestResponseEndpointTest method testHandleMessageProcessesAuthorizedRequests.

/**
 * Verifies that the endpoint processes request messages for operations the client
 * is authorized to invoke.
 */
@Test
public void testHandleMessageProcessesAuthorizedRequests() {
    Message msg = ProtonHelper.message();
    msg.setSubject("get");
    ProtonConnection con = mock(ProtonConnection.class);
    ProtonDelivery delivery = mock(ProtonDelivery.class);
    AuthorizationService authService = mock(AuthorizationService.class);
    when(authService.isAuthorized(any(HonoUser.class), any(ResourceIdentifier.class), anyString())).thenReturn(Future.succeededFuture(Boolean.TRUE));
    Future<Void> processingTracker = Future.future();
    RequestResponseEndpoint<ServiceConfigProperties> endpoint = getEndpoint(true, processingTracker);
    endpoint.setAuthorizationService(authService);
    // WHEN a request for an operation is received that the client is authorized to invoke
    endpoint.handleMessage(con, receiver, resource, delivery, msg);
    // THEN then the message gets processed
    ArgumentCaptor<DeliveryState> deliveryState = ArgumentCaptor.forClass(DeliveryState.class);
    verify(delivery).disposition(deliveryState.capture(), booleanThat(is(Boolean.TRUE)));
    assertThat(deliveryState.getValue(), instanceOf(Accepted.class));
    verify(receiver, never()).close();
    verify(authService).isAuthorized(Constants.PRINCIPAL_ANONYMOUS, resource, "get");
    assertTrue(processingTracker.isComplete());
}

Example 4 with AuthorizationService

use of org.eclipse.hono.service.auth.AuthorizationService in project hono by eclipse.

the class RequestResponseEndpointTest method testHandleMessageRejectsUnauthorizedRequests.

/**
 * Verifies that the endpoint rejects request messages for operations the client
 * is not authorized to invoke.
 */
@Test
public void testHandleMessageRejectsUnauthorizedRequests() {
    Message msg = ProtonHelper.message();
    msg.setSubject("unauthorized");
    ProtonConnection con = mock(ProtonConnection.class);
    ProtonDelivery delivery = mock(ProtonDelivery.class);
    AuthorizationService authService = mock(AuthorizationService.class);
    when(authService.isAuthorized(any(HonoUser.class), any(ResourceIdentifier.class), anyString())).thenReturn(Future.succeededFuture(Boolean.FALSE));
    Future<Void> processingTracker = Future.future();
    RequestResponseEndpoint<ServiceConfigProperties> endpoint = getEndpoint(true, processingTracker);
    endpoint.setAuthorizationService(authService);
    // WHEN a request for an operation is received that the client is not authorized to invoke
    endpoint.handleMessage(con, receiver, resource, delivery, msg);
    // THEN the the message is rejected
    ArgumentCaptor<DeliveryState> deliveryState = ArgumentCaptor.forClass(DeliveryState.class);
    verify(delivery).disposition(deliveryState.capture(), booleanThat(is(Boolean.TRUE)));
    assertThat(deliveryState.getValue(), instanceOf(Rejected.class));
    verify(receiver, never()).close();
    verify(authService).isAuthorized(Constants.PRINCIPAL_ANONYMOUS, resource, "unauthorized");
    assertFalse(processingTracker.isComplete());
}