Examples with AuthSubject org.neo4j.kernel.api.security.AuthSubject used on opensource projects

Example 6 with AuthSubject

use of org.neo4j.kernel.api.security.AuthSubject in project neo4j by neo4j.

the class MultiRealmAuthManagerTest method shouldFailAuthenticationAndEscapeIfUserIsNotFound.

@Test
public void shouldFailAuthenticationAndEscapeIfUserIsNotFound() throws Throwable {
    // Given
    manager.start();
    // When
    AuthSubject authSubject = manager.login(authToken("unknown\n\t\r\"haxx0r\"", "abc123")).subject();
    AuthenticationResult result = authSubject.getAuthenticationResult();
    // Then
    assertThat(result, equalTo(AuthenticationResult.FAILURE));
    logProvider.assertExactly(error("[%s]: failed to log in: invalid principal or credentials", escape("unknown\n\t\r\"haxx0r\"")));
}

Example 7 with AuthSubject

use of org.neo4j.kernel.api.security.AuthSubject in project neo4j by neo4j.

the class MultiRealmAuthManagerTest method shouldFailAuthenticationIfUserIsNotFound.

@Test
public void shouldFailAuthenticationIfUserIsNotFound() throws Throwable {
    // Given
    manager.start();
    // When
    AuthSubject authSubject = manager.login(authToken("unknown", "abc123")).subject();
    AuthenticationResult result = authSubject.getAuthenticationResult();
    // Then
    assertThat(result, equalTo(AuthenticationResult.FAILURE));
    logProvider.assertExactly(error("[%s]: failed to log in: invalid principal or credentials", "unknown"));
}

Example 8 with AuthSubject

use of org.neo4j.kernel.api.security.AuthSubject in project neo4j by neo4j.

the class AuthorizationFilterTest method shouldNotAuthorizeInvalidCredentials.

@Test
public void shouldNotAuthorizeInvalidCredentials() throws Exception {
    // Given
    final AuthorizationEnabledFilter filter = new AuthorizationEnabledFilter(() -> authManager, logProvider);
    String credentials = Base64.encodeBase64String("foo:bar".getBytes(StandardCharsets.UTF_8));
    BasicSecurityContext securityContext = mock(BasicSecurityContext.class);
    AuthSubject authSubject = mock(AuthSubject.class);
    when(servletRequest.getMethod()).thenReturn("GET");
    when(servletRequest.getContextPath()).thenReturn("/db/data");
    when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn("BASIC " + credentials);
    when(servletRequest.getRemoteAddr()).thenReturn("remote_ip_address");
    when(authManager.login(authToken("foo", "bar"))).thenReturn(securityContext);
    when(securityContext.subject()).thenReturn(authSubject);
    when(authSubject.getAuthenticationResult()).thenReturn(AuthenticationResult.FAILURE);
    // When
    filter.doFilter(servletRequest, servletResponse, filterChain);
    // Then
    verifyNoMoreInteractions(filterChain);
    logProvider.assertExactly(inLog(AuthorizationEnabledFilter.class).warn("Failed authentication attempt for '%s' from %s", "foo", "remote_ip_address"));
    verify(servletResponse).setStatus(401);
    verify(servletResponse).addHeader(HttpHeaders.CONTENT_TYPE, "application/json; charset=UTF-8");
    assertThat(outputStream.toString(StandardCharsets.UTF_8.name()), containsString("\"code\" : \"Neo.ClientError.Security.Unauthorized\""));
    assertThat(outputStream.toString(StandardCharsets.UTF_8.name()), containsString("\"message\" : \"Invalid username or password.\""));
}

Example 9 with AuthSubject

use of org.neo4j.kernel.api.security.AuthSubject in project neo4j by neo4j.

the class AuthorizationFilterTest method shouldNotAuthorizeWhenTooManyAttemptsMade.

@Test
public void shouldNotAuthorizeWhenTooManyAttemptsMade() throws Exception {
    // Given
    final AuthorizationEnabledFilter filter = new AuthorizationEnabledFilter(() -> authManager, logProvider);
    String credentials = Base64.encodeBase64String("foo:bar".getBytes(StandardCharsets.UTF_8));
    BasicSecurityContext securityContext = mock(BasicSecurityContext.class);
    AuthSubject authSubject = mock(AuthSubject.class);
    when(servletRequest.getMethod()).thenReturn("GET");
    when(servletRequest.getContextPath()).thenReturn("/db/data");
    when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn("BASIC " + credentials);
    when(authManager.login(authToken("foo", "bar"))).thenReturn(securityContext);
    when(securityContext.subject()).thenReturn(authSubject);
    when(authSubject.getAuthenticationResult()).thenReturn(AuthenticationResult.TOO_MANY_ATTEMPTS);
    // When
    filter.doFilter(servletRequest, servletResponse, filterChain);
    // Then
    verifyNoMoreInteractions(filterChain);
    verify(servletResponse).setStatus(429);
    verify(servletResponse).addHeader(HttpHeaders.CONTENT_TYPE, "application/json; charset=UTF-8");
    assertThat(outputStream.toString(StandardCharsets.UTF_8.name()), containsString("\"code\" : \"Neo.ClientError.Security.AuthenticationRateLimit\""));
    assertThat(outputStream.toString(StandardCharsets.UTF_8.name()), containsString("\"message\" : \"Too many failed authentication requests. Please wait 5 seconds and try again.\""));
}

Example 10 with AuthSubject

use of org.neo4j.kernel.api.security.AuthSubject in project neo4j by neo4j.

the class AuthorizationFilterTest method shouldAuthorizeWhenPasswordChangeRequiredForWhitelistedPath.

@Test
public void shouldAuthorizeWhenPasswordChangeRequiredForWhitelistedPath() throws Exception {
    // Given
    final AuthorizationEnabledFilter filter = new AuthorizationEnabledFilter(() -> authManager, logProvider);
    String credentials = Base64.encodeBase64String("foo:bar".getBytes(StandardCharsets.UTF_8));
    BasicSecurityContext securityContext = mock(BasicSecurityContext.class);
    AuthSubject authSubject = mock(AuthSubject.class);
    when(servletRequest.getMethod()).thenReturn("GET");
    when(servletRequest.getContextPath()).thenReturn("/user/foo");
    when(servletRequest.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn("BASIC " + credentials);
    when(authManager.login(authToken("foo", "bar"))).thenReturn(securityContext);
    when(securityContext.subject()).thenReturn(authSubject);
    when(authSubject.getAuthenticationResult()).thenReturn(AuthenticationResult.PASSWORD_CHANGE_REQUIRED);
    // When
    filter.doFilter(servletRequest, servletResponse, filterChain);
    // Then
    verify(filterChain).doFilter(eq(new AuthorizedRequestWrapper(BASIC_AUTH, "foo", servletRequest, AUTH_DISABLED)), same(servletResponse));
}