[jboss-cvs] Picketbox SVN: r463 - in trunk/security-jboss-sx/jbosssx/src: test/java/org/jboss/test/authorization and 1 other directories.

[jboss-cvs-commits at lists.jboss.org]

Author: sguilhen at redhat.com
Date: 2013-10-22 09:23:23 -0400 (Tue, 22 Oct 2013)
New Revision: 463

Added:
   trunk/security-jboss-sx/jbosssx/src/test/java/org/jboss/test/authorization/jacc/
   trunk/security-jboss-sx/jbosssx/src/test/java/org/jboss/test/authorization/jacc/JACCAuthorizationUnitTestCase.java
Modified:
   trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/jacc/ContextPolicy.java
Log:
Add support for the JACC '**' role (any authenticated user).

Modified: trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/jacc/ContextPolicy.java
===================================================================
--- trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/jacc/ContextPolicy.java	2013-10-21 20:15:46 UTC (rev 462)
+++ trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/jacc/ContextPolicy.java	2013-10-22 13:23:23 UTC (rev 463)
@@ -53,6 +53,8 @@
    /** HashMap<String, Permissions> role name to permissions mapping */
    private HashMap<String, Permissions> rolePermissions = new HashMap<String, Permissions>();
 
+   private static final String ANY_AUTHENTICATED_USER_ROLE = "**";
+
    ContextPolicy(String contextID)
    {
       this.contextID = contextID;
@@ -122,24 +124,21 @@
             principalNames.add(name);
          }
       }
-      if( principalNames.size() > 0 )
+      if (principalNames.size() == 0)
+         PicketBoxLogger.LOGGER.traceNoPrincipalsInProtectionDomain(domain);
+
+      principalNames.add(ANY_AUTHENTICATED_USER_ROLE);
+      PicketBoxLogger.LOGGER.traceProtectionDomainPrincipals(principalNames);
+      for(int n = 0; implied == false && n < principalNames.size(); n ++)
       {
-         PicketBoxLogger.LOGGER.traceProtectionDomainPrincipals(principalNames);
-         for(int n = 0; implied == false && n < principalNames.size(); n ++)
-         {
-            String name = principalNames.get(n);
-            Permissions perms = rolePermissions.get(name);
-            PicketBoxLogger.LOGGER.debugImpliesParameters(name, perms);
-            if( perms == null )
-               continue;
-            implied = perms.implies(permission);
-            PicketBoxLogger.LOGGER.debugImpliesResult(implied);
-         }
+         String name = principalNames.get(n);
+         Permissions perms = rolePermissions.get(name);
+         PicketBoxLogger.LOGGER.debugImpliesParameters(name, perms);
+         if( perms == null )
+            continue;
+         implied = perms.implies(permission);
+         PicketBoxLogger.LOGGER.debugImpliesResult(implied);
       }
-      else
-      {
-         PicketBoxLogger.LOGGER.traceNoPrincipalsInProtectionDomain(domain);
-      }
 
       return implied;
    }

Added: trunk/security-jboss-sx/jbosssx/src/test/java/org/jboss/test/authorization/jacc/JACCAuthorizationUnitTestCase.java
===================================================================
--- trunk/security-jboss-sx/jbosssx/src/test/java/org/jboss/test/authorization/jacc/JACCAuthorizationUnitTestCase.java	                        (rev 0)
+++ trunk/security-jboss-sx/jbosssx/src/test/java/org/jboss/test/authorization/jacc/JACCAuthorizationUnitTestCase.java	2013-10-22 13:23:23 UTC (rev 463)
@@ -0,0 +1,69 @@
+package org.jboss.test.authorization.jacc;
+
+import junit.framework.Assert;
+import junit.framework.TestCase;
+import org.jboss.security.SimplePrincipal;
+import org.jboss.security.jacc.DelegatingPolicy;
+import org.jboss.security.jacc.JBossPolicyConfigurationFactory;
+import org.junit.Test;
+
+import javax.security.jacc.PolicyConfiguration;
+import javax.security.jacc.PolicyContext;
+import javax.security.jacc.WebResourcePermission;
+import java.security.Permission;
+import java.security.Policy;
+import java.security.Principal;
+import java.security.ProtectionDomain;
+
+/**
+ * This class tests the behavior of the PicketBox JACC policy implementation in scenarios that involve the usage of the
+ * "any authenticated user" role, "**".
+ */
+public class JACCAuthorizationUnitTestCase extends TestCase {
+
+    private static final String ANY_AUTHENTICATED_USER_ROLE = "**";
+
+    /**
+     * This test installs the PicketBox policy and registers a WebResourcePermission with the role "**" (any authenticated
+     * user). It then performs a series of implies methods, checking the results. Any authenticated user should be able
+     * to access the resource identified by the same pattern and HTTP methods as the registered WebResourcePermission
+     * irrespective of the security roles associated with that user.
+     *
+     * @throws Exception if an error occurs while running the test.
+     */
+    @Test
+    public void testAnyAuthenticatedUserRole() throws Exception {
+
+        Policy policy = new DelegatingPolicy();
+        Policy.setPolicy(policy);
+        PolicyContext.setContextID("testcontext");
+
+        PolicyConfiguration configuration =
+            new JBossPolicyConfigurationFactory().getPolicyConfiguration("testcontext", true);
+        // create a permission for a web resource using the role '**' (any authenticated user).
+        Permission permission = new WebResourcePermission("/test", "GET,POST");
+        configuration.addToRole(ANY_AUTHENTICATED_USER_ROLE, permission);
+        configuration.commit();
+
+        Principal[] roles = new Principal[]{new SimplePrincipal("Manager"), new SimplePrincipal("Administrator")};
+        // should match - same pattern, same methods. Authenticated user has a couple of roles.
+        boolean implies = policy.implies(new ProtectionDomain(null, null, null, roles),
+                new WebResourcePermission("/test", "POST,GET"));
+        Assert.assertTrue(implies);
+
+        // should match - same pattern, same methods. User contains has no roles.
+        implies = policy.implies(new ProtectionDomain(null, null, null, new Principal[]{}),
+                new WebResourcePermission("/test", "POST,GET"));
+        Assert.assertTrue(implies);
+
+        // should not match - supplied permission has a different pattern.
+        implies = policy.implies(new ProtectionDomain(null, null, null, roles),
+                new WebResourcePermission("/test/*", "GET,POST"));
+        Assert.assertFalse(implies);
+
+        // should not match - supplied permission has a different list of methods.
+        implies = policy.implies(new ProtectionDomain(null, null, null, roles),
+                new WebResourcePermission("/test/*", "GET,DELETE,PUT"));
+        Assert.assertFalse(implies);
+    }
+}