Examples with Constraint org.eclipse.jetty.util.security.Constraint used on opensource projects

Example 51 with Constraint

use of org.eclipse.jetty.util.security.Constraint in project jetty.project by eclipse.

the class ConstraintTest method testBasic.

@Test
public void testBasic() throws Exception {
    List<ConstraintMapping> list = new ArrayList<>(_security.getConstraintMappings());
    Constraint constraint6 = new Constraint();
    constraint6.setAuthenticate(true);
    constraint6.setName("omit HEAD and GET");
    constraint6.setRoles(new String[] { "user" });
    ConstraintMapping mapping6 = new ConstraintMapping();
    mapping6.setPathSpec("/omit/*");
    mapping6.setConstraint(constraint6);
    //requests for every method except GET and HEAD must be in role "user"
    mapping6.setMethodOmissions(new String[] { "GET", "HEAD" });
    list.add(mapping6);
    Constraint constraint7 = new Constraint();
    constraint7.setAuthenticate(true);
    constraint7.setName("non-omitted GET");
    constraint7.setRoles(new String[] { "administrator" });
    ConstraintMapping mapping7 = new ConstraintMapping();
    mapping7.setPathSpec("/omit/*");
    mapping7.setConstraint(constraint7);
    //requests for GET must be in role "admin"
    mapping7.setMethod("GET");
    list.add(mapping7);
    Constraint constraint8 = new Constraint();
    constraint8.setAuthenticate(true);
    constraint8.setName("non specific");
    constraint8.setRoles(new String[] { "foo" });
    ConstraintMapping mapping8 = new ConstraintMapping();
    mapping8.setPathSpec("/omit/*");
    //requests for all methods must be in role "foo"
    mapping8.setConstraint(constraint8);
    list.add(mapping8);
    Set<String> knownRoles = new HashSet<>();
    knownRoles.add("user");
    knownRoles.add("administrator");
    knownRoles.add("foo");
    _security.setConstraintMappings(list, knownRoles);
    _security.setAuthenticator(new BasicAuthenticator());
    _server.start();
    String response;
    response = _connector.getResponse("GET /ctx/noauth/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 200 OK"));
    response = _connector.getResponse("GET /ctx/forbid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 403 Forbidden"));
    response = _connector.getResponse("GET /ctx/auth/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 401 Unauthorized"));
    Assert.assertThat(response, Matchers.containsString("WWW-Authenticate: basic realm=\"TestRealm\""));
    response = _connector.getResponse("GET /ctx/auth/info HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("user:wrong") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 401 Unauthorized"));
    Assert.assertThat(response, Matchers.containsString("WWW-Authenticate: basic realm=\"TestRealm\""));
    response = _connector.getResponse("GET /ctx/auth/info HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("user:password") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 200 OK"));
    // test admin
    response = _connector.getResponse("GET /ctx/admin/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 401 Unauthorized"));
    Assert.assertThat(response, Matchers.containsString("WWW-Authenticate: basic realm=\"TestRealm\""));
    response = _connector.getResponse("GET /ctx/admin/info HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("admin:wrong") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 401 Unauthorized"));
    Assert.assertThat(response, Matchers.containsString("WWW-Authenticate: basic realm=\"TestRealm\""));
    response = _connector.getResponse("GET /ctx/admin/info HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("user:password") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 403 "));
    Assert.assertThat(response, Matchers.containsString("!role"));
    response = _connector.getResponse("GET /ctx/admin/info HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("admin:password") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 200 OK"));
    response = _connector.getResponse("GET /ctx/admin/relax/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 200 OK"));
    //check GET is in role administrator 
    response = _connector.getResponse("GET /ctx/omit/x HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("admin:password") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 200 OK"));
    //check POST is in role user
    response = _connector.getResponse("POST /ctx/omit/x HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("user2:password") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 200 OK"));
    //check POST can be in role foo too      
    response = _connector.getResponse("POST /ctx/omit/x HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("user3:password") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 200 OK"));
    //check HEAD cannot be in role user
    response = _connector.getResponse("HEAD /ctx/omit/x HTTP/1.0\r\n" + "Authorization: Basic " + B64Code.encode("user2:password") + "\r\n" + "\r\n");
    Assert.assertThat(response, Matchers.startsWith("HTTP/1.1 403 "));
}

Example 52 with Constraint

use of org.eclipse.jetty.util.security.Constraint in project jetty.project by eclipse.

the class DataConstraintsTest method testConfidentialWithNoRolesSetAndMethodRestriction.

@Test
public void testConfidentialWithNoRolesSetAndMethodRestriction() throws Exception {
    Constraint constraint0 = new Constraint();
    constraint0.setName("confid");
    constraint0.setDataConstraint(Constraint.DC_CONFIDENTIAL);
    ConstraintMapping mapping0 = new ConstraintMapping();
    mapping0.setPathSpec("/confid/*");
    mapping0.setMethod(HttpMethod.POST.asString());
    mapping0.setConstraint(constraint0);
    _security.setConstraintMappings(Arrays.asList(new ConstraintMapping[] { mapping0 }));
    _server.start();
    String response;
    response = _connector.getResponses("GET /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
    response = _connectorS.getResponses("GET /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
    response = _connector.getResponses("POST /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 302 Found"));
    response = _connectorS.getResponses("POST /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
}

Example 53 with Constraint

use of org.eclipse.jetty.util.security.Constraint in project jetty.project by eclipse.

the class DataConstraintsTest method testConfidentialWithRolesSetAndMethodRestriction.

@Test
public void testConfidentialWithRolesSetAndMethodRestriction() throws Exception {
    Constraint constraint0 = new Constraint();
    constraint0.setRoles(new String[] { "admin" });
    constraint0.setName("confid");
    constraint0.setDataConstraint(Constraint.DC_CONFIDENTIAL);
    ConstraintMapping mapping0 = new ConstraintMapping();
    mapping0.setPathSpec("/confid/*");
    mapping0.setMethod(HttpMethod.POST.asString());
    mapping0.setConstraint(constraint0);
    _security.setConstraintMappings(Arrays.asList(new ConstraintMapping[] { mapping0 }));
    _server.start();
    String response;
    response = _connector.getResponses("GET /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
    response = _connectorS.getResponses("GET /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
    response = _connector.getResponses("POST /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 302 Found"));
    response = _connectorS.getResponses("POST /ctx/confid/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
}

Example 54 with Constraint

use of org.eclipse.jetty.util.security.Constraint in project jetty.project by eclipse.

the class DataConstraintsTest method testRestricted.

@Test
public void testRestricted() throws Exception {
    Constraint constraint0 = new Constraint();
    constraint0.setAuthenticate(true);
    constraint0.setRoles(new String[] { "admin" });
    constraint0.setName("restricted");
    ConstraintMapping mapping0 = new ConstraintMapping();
    mapping0.setPathSpec("/restricted/*");
    mapping0.setMethod("GET");
    mapping0.setConstraint(constraint0);
    _security.setConstraintMappings(Arrays.asList(new ConstraintMapping[] { mapping0 }));
    DefaultIdentityService identityService = new DefaultIdentityService();
    _security.setLoginService(new CustomLoginService(identityService));
    _security.setIdentityService(identityService);
    _security.setAuthenticator(new BasicAuthenticator());
    _server.start();
    String response;
    response = _connector.getResponses("GET /ctx/restricted/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 401 Unauthorized"));
    response = _connectorS.getResponses("GET /ctx/restricted/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 401 Unauthorized"));
    response = _connector.getResponses("GET /ctx/restricted/info HTTP/1.0\nAuthorization: Basic YWRtaW46cGFzc3dvcmQ=\n\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
    response = _connectorS.getResponses("GET /ctx/restricted/info HTTP/1.0\nAuthorization: Basic YWRtaW46cGFzc3dvcmQ=\n\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 404 Not Found"));
}

Example 55 with Constraint

use of org.eclipse.jetty.util.security.Constraint in project jetty.project by eclipse.

the class DataConstraintsTest method testRestrictedWithoutAuthenticatorAndMethod.

@Test
public void testRestrictedWithoutAuthenticatorAndMethod() throws Exception {
    Constraint constraint0 = new Constraint();
    constraint0.setAuthenticate(true);
    constraint0.setRoles(new String[] { "admin" });
    constraint0.setName("restricted");
    ConstraintMapping mapping0 = new ConstraintMapping();
    mapping0.setPathSpec("/restricted/*");
    mapping0.setMethod("GET");
    mapping0.setConstraint(constraint0);
    _security.setConstraintMappings(Arrays.asList(new ConstraintMapping[] { mapping0 }));
    _server.start();
    String response;
    response = _connector.getResponses("GET /ctx/restricted/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 403 Forbidden"));
    response = _connectorS.getResponses("GET /ctx/restricted/info HTTP/1.0\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 403 Forbidden"));
    response = _connector.getResponses("GET /ctx/restricted/info HTTP/1.0\r\nAuthorization: Basic YWRtaW46cGFzc3dvcmQ=\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 403 Forbidden"));
    response = _connectorS.getResponses("GET /ctx/restricted/info HTTP/1.0\r\nAuthorization: Basic YWRtaW46cGFzc3dvcmQ=\r\n\r\n");
    Assert.assertThat(response, Matchers.containsString("HTTP/1.1 403 Forbidden"));
}