oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordHistoryTest.java - jackrabbit-oak - Git at Google

 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
  * contributor license agreements.  See the NOTICE file distributed with
  * this work for additional information regarding copyright ownership.
  * The ASF licenses this file to You under the Apache License, Version 2.0
  * (the "License"); you may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 package org.apache.jackrabbit.oak.security.user;

 import java.lang.reflect.Field;
 import java.util.Collections;
 import java.util.List;
 import javax.jcr.RepositoryException;
 import javax.jcr.nodetype.ConstraintViolationException;

 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
 import org.apache.jackrabbit.api.security.user.User;
 import org.apache.jackrabbit.oak.AbstractSecurityTest;
 import org.apache.jackrabbit.oak.api.Tree;
 import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
 import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration;
 import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
 import org.apache.jackrabbit.oak.spi.security.user.util.PasswordUtil;
 import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
 import org.jetbrains.annotations.NotNull;
 import org.junit.Test;

 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotSame;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;

 /**
  * @see <a href="https://issues.apache.org/jira/browse/OAK-2445">OAK-2445</a>
  */
 public class PasswordHistoryTest extends AbstractSecurityTest implements UserConstants {

     private static final String[] PASSWORDS = {
             "abc", "def", "ghi", "jkl", "mno", "pqr", "stu", "vwx", "yz0", "123", "456", "789"
     };

     private static final ConfigurationParameters CONFIG = ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, 10);

     @Override
     protected ConfigurationParameters getSecurityConfigParameters() {
         return ConfigurationParameters.of(ImmutableMap.of(UserConfiguration.NAME, CONFIG));
     }

     @NotNull
     private List<String> getHistory(@NotNull User user) throws RepositoryException {
         Iterable<String> history = TreeUtil.getStrings(root.getTree(user.getPath()).getChild(REP_PWD), REP_PWD_HISTORY);
         return (history == null) ? Collections.emptyList() : ImmutableList.copyOf(history).reverse();
     }

     /**
      * Use reflection to access the private fields stored in the PasswordHistory
      */
     private static Integer getMaxSize(@NotNull PasswordHistory history) throws Exception {
         Field maxSize = history.getClass().getDeclaredField("maxSize");
         maxSize.setAccessible(true);
         return (Integer) maxSize.get(history);
     }

     /**
      * Use reflection to access the private fields stored in the PasswordHistory
      */
     private static boolean isEnabled(@NotNull PasswordHistory history) throws Exception {
         Field isEnabled = history.getClass().getDeclaredField("isEnabled");
         isEnabled.setAccessible(true);
         return (Boolean) isEnabled.get(history);
     }

     @Test
     public void testNoPwdTreeOnUserCreation() throws Exception {
         User user = getTestUser();
         assertFalse(root.getTree(user.getPath()).hasChild(REP_PWD));
     }

     @Test
     public void testHistoryEmptyOnUserCreationWithPassword() throws Exception {
         User user = getTestUser(); // the user is created with a password set

         // the rep:pwd child must not exist. without the rep:pwd child no password history can exist.
         assertFalse(root.getTree(user.getPath()).hasChild(REP_PWD));
     }

     @Test
     public void testHistoryWithSinglePasswordChange() throws Exception {
         // the user must be able to change the password
         User user = getTestUser();
         String oldPassword = TreeUtil.getString(root.getTree(user.getPath()), REP_PASSWORD);
         user.changePassword("newPwd");
         root.commit();

         // after changing the password, 1 password history entry should be present and the
         // recorded password should be equal to the user's initial password
         // however, the user's current password must not match the old password.
         assertTrue(root.getTree(user.getPath()).hasChild(REP_PWD));

         Tree pwTree = root.getTree(user.getPath()).getChild(REP_PWD);
         assertTrue(pwTree.hasProperty(REP_PWD_HISTORY));

         List<String> history = getHistory(user);
         assertEquals(1, history.size());
         assertEquals(oldPassword, history.iterator().next());

         String currentPw = TreeUtil.getString(root.getTree(user.getPath()), REP_PASSWORD);
         assertNotSame(currentPw, oldPassword);
     }

     @Test
     public void testHistoryMaxSize() throws Exception {
         User user = getTestUser();

         // we're changing the password 12 times, history max is 10
         for (String pw : PASSWORDS) {
             user.changePassword(pw);
             root.commit();
         }

         assertEquals(10, getHistory(user).size());
     }

     @Test
     public void testHistoryOrder() throws Exception {
         User user = getTestUser();

         // we're changing the password 12 times, history max is 10
         for (String pw : PASSWORDS) {
             user.changePassword(pw);
         }

         // we skip the first entry in the password list as it was shifted out
         // due to max history size = 10.
         int i = 1;
         for (String pwHash : getHistory(user)) {
             assertTrue(PasswordUtil.isSame(pwHash, PASSWORDS[i++]));
         }
     }

     @Test
     public void testRepeatedPwAfterHistorySizeReached() throws Exception {
         User user = getTestUser();
         for (String pw : PASSWORDS) {
             user.changePassword(pw);
         }

         // changing pw back to the original value (as used for creation) must succeed
         user.changePassword(user.getID());
         // now, using all old passwords must also succeed as they get shifted out
         for (String pw : PASSWORDS) {
             user.changePassword(pw);
         }
     }

     @Test(expected = ConstraintViolationException.class)
     public void testHistoryViolationAtFirstChange() throws Exception {
         User user = getTestUser();
         user.changePassword(user.getID());
     }

     @Test(expected = ConstraintViolationException.class)
     public void testHistoryViolation() throws Exception {
         User user = getTestUser();
         user.changePassword("abc");
         user.changePassword("def");
         user.changePassword("abc");
     }

     @Test
     public void testNoHistoryUpdateOnViolation() throws Exception {
         User user = getTestUser();
         try {
             user.changePassword("abc");
             user.changePassword("def");
             user.changePassword("abc");
             fail("history violation not detected");
         } catch (ConstraintViolationException e) {
             String[] expected = new String[] {user.getID(), "abc"};
             int i = 0;
             for (String pwHash : getHistory(user)) {
                 assertTrue(PasswordUtil.isSame(pwHash, expected[i++]));
             }
         }
     }

     @Test
     public void testEnabledPasswordHistory() throws Exception {
         PasswordHistory history = new PasswordHistory(CONFIG);
         assertTrue(isEnabled(history));
         assertEquals(10, getMaxSize(history).longValue());
     }

     @Test
     public void testHistoryUpperLimit() throws Exception {
         PasswordHistory history = new PasswordHistory(ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, Integer.MAX_VALUE));

         assertTrue(isEnabled(history));
         assertEquals(1000, getMaxSize(history).longValue());
     }

     @Test
     public void testDisabledPasswordHistory() throws Exception {
         User user = getTestUser();
         Tree userTree = root.getTree(user.getPath());

         List<ConfigurationParameters> configs = ImmutableList.of(
                 ConfigurationParameters.EMPTY,
                 ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, PASSWORD_HISTORY_DISABLED_SIZE),
                 ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, -1),
                 ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, Integer.MIN_VALUE)
         );

         for (ConfigurationParameters config : configs) {
             PasswordHistory disabledHistory = new PasswordHistory(config);

             assertFalse(isEnabled(disabledHistory));
             assertFalse(disabledHistory.updatePasswordHistory(userTree, user.getID()));
         }
     }

     @Test(expected = ConstraintViolationException.class)
     public void testCheckPasswordHistory() throws Exception {
         Tree userTree = root.getTree(getTestUser().getPath());

         PasswordHistory history = new PasswordHistory(CONFIG);
         assertTrue(isEnabled(history));
         assertEquals(10, getMaxSize(history).longValue());

         history.updatePasswordHistory(userTree, getTestUser().getID());
     }

     @Test
     public void testConfigurationChange() throws Exception {
         User user = getTestUser();
         Tree userTree = root.getTree(user.getPath());

         PasswordHistory history = new PasswordHistory(CONFIG);
         for (String pw : PASSWORDS) {
             assertTrue(history.updatePasswordHistory(userTree, pw));
         }
         assertEquals(10, getHistory(user).size());

         // change configuration to a smaller size
         history = new PasswordHistory(ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, 5));
         List<String> oldPwds = getHistory(user);
         assertEquals(10, oldPwds.size());

         // only the configured max-size number of entries in the history must be
         // checked. additional entries in the history must be ignored
         Iterables.skip(oldPwds, 6);
         history.updatePasswordHistory(userTree, oldPwds.iterator().next());

         // after chaning the pwd again however the rep:pwdHistory property must
         // only contain the max-size number of passwords
         assertEquals(5, getHistory(user).size());

         history = new PasswordHistory(CONFIG);
         history.updatePasswordHistory(userTree, "newPwd");
         assertEquals(6, getHistory(user).size());
     }

     @Test
     public void testEnableDisable() throws Exception {
         User user = getTestUser();
         Tree userTree = root.getTree(user.getPath());

         PasswordHistory history = new PasswordHistory(CONFIG);
         for (String pw : PASSWORDS) {
             assertTrue(history.updatePasswordHistory(userTree, pw));
         }
         assertEquals(10, getHistory(user).size());

         // disable the password history : changing the pw now must not
         // modify the rep:pwdHistory property.
         history = new PasswordHistory(ConfigurationParameters.EMPTY);
         history.updatePasswordHistory(userTree, PASSWORDS[8]);

         assertEquals(10, getHistory(user).size());
     }

     @Test
     public void testSingleTypeHistoryProperty() throws Exception {
         Tree userTree = root.getTree(getTestUser().getPath());
         Tree pwdNode = TreeUtil.getOrAddChild(userTree, REP_PWD, NT_REP_PASSWORD);

         pwdNode.setProperty(REP_PWD_HISTORY, "singleValuedProperty");
         assertFalse(pwdNode.getProperty(REP_PWD_HISTORY).isArray());
         assertFalse(pwdNode.getProperty(REP_PWD_HISTORY).getType().isArray());

         PasswordHistory history = new PasswordHistory(CONFIG);
         assertTrue(history.updatePasswordHistory(userTree, "anyOtherPassword"));

         assertTrue(pwdNode.getProperty(REP_PWD_HISTORY).isArray());
         assertTrue(pwdNode.getProperty(REP_PWD_HISTORY).getType().isArray());
     }

     @Test
     public void testUpdateMissingPwHash() throws Exception {
         User u = getUserManager(root).createUser("uid", null);
         PasswordHistory ph = new PasswordHistory(ConfigurationParameters.of(UserConstants.PARAM_PASSWORD_HISTORY_SIZE, UserConstants.PASSWORD_HISTORY_DISABLED_SIZE+1));
         assertFalse(ph.updatePasswordHistory(root.getTree(u.getPath()), "pw"));
     }
 }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one or more
	* contributor license agreements. See the NOTICE file distributed with
	* this work for additional information regarding copyright ownership.
	* The ASF licenses this file to You under the Apache License, Version 2.0
	* (the "License"); you may not use this file except in compliance with
	* the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/
	package org.apache.jackrabbit.oak.security.user;

	import java.lang.reflect.Field;
	import java.util.Collections;
	import java.util.List;
	import javax.jcr.RepositoryException;
	import javax.jcr.nodetype.ConstraintViolationException;

	import com.google.common.collect.ImmutableList;
	import com.google.common.collect.ImmutableMap;
	import com.google.common.collect.Iterables;
	import org.apache.jackrabbit.api.security.user.User;
	import org.apache.jackrabbit.oak.AbstractSecurityTest;
	import org.apache.jackrabbit.oak.api.Tree;
	import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
	import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration;
	import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
	import org.apache.jackrabbit.oak.spi.security.user.util.PasswordUtil;
	import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
	import org.jetbrains.annotations.NotNull;
	import org.junit.Test;

	import static org.junit.Assert.assertEquals;
	import static org.junit.Assert.assertFalse;
	import static org.junit.Assert.assertNotSame;
	import static org.junit.Assert.assertTrue;
	import static org.junit.Assert.fail;

	/**
	* @see <a href="https://issues.apache.org/jira/browse/OAK-2445">OAK-2445</a>
	*/
	public class PasswordHistoryTest extends AbstractSecurityTest implements UserConstants {

	private static final String[] PASSWORDS = {
	"abc", "def", "ghi", "jkl", "mno", "pqr", "stu", "vwx", "yz0", "123", "456", "789"
	};

	private static final ConfigurationParameters CONFIG = ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, 10);

	@Override
	protected ConfigurationParameters getSecurityConfigParameters() {
	return ConfigurationParameters.of(ImmutableMap.of(UserConfiguration.NAME, CONFIG));
	}

	@NotNull
	private List<String> getHistory(@NotNull User user) throws RepositoryException {
	Iterable<String> history = TreeUtil.getStrings(root.getTree(user.getPath()).getChild(REP_PWD), REP_PWD_HISTORY);
	return (history == null) ? Collections.emptyList() : ImmutableList.copyOf(history).reverse();
	}

	/**
	* Use reflection to access the private fields stored in the PasswordHistory
	*/
	private static Integer getMaxSize(@NotNull PasswordHistory history) throws Exception {
	Field maxSize = history.getClass().getDeclaredField("maxSize");
	maxSize.setAccessible(true);
	return (Integer) maxSize.get(history);
	}

	/**
	* Use reflection to access the private fields stored in the PasswordHistory
	*/
	private static boolean isEnabled(@NotNull PasswordHistory history) throws Exception {
	Field isEnabled = history.getClass().getDeclaredField("isEnabled");
	isEnabled.setAccessible(true);
	return (Boolean) isEnabled.get(history);
	}

	@Test
	public void testNoPwdTreeOnUserCreation() throws Exception {
	User user = getTestUser();
	assertFalse(root.getTree(user.getPath()).hasChild(REP_PWD));
	}

	@Test
	public void testHistoryEmptyOnUserCreationWithPassword() throws Exception {
	User user = getTestUser(); // the user is created with a password set

	// the rep:pwd child must not exist. without the rep:pwd child no password history can exist.
	assertFalse(root.getTree(user.getPath()).hasChild(REP_PWD));
	}

	@Test
	public void testHistoryWithSinglePasswordChange() throws Exception {
	// the user must be able to change the password
	User user = getTestUser();
	String oldPassword = TreeUtil.getString(root.getTree(user.getPath()), REP_PASSWORD);
	user.changePassword("newPwd");
	root.commit();

	// after changing the password, 1 password history entry should be present and the
	// recorded password should be equal to the user's initial password
	// however, the user's current password must not match the old password.
	assertTrue(root.getTree(user.getPath()).hasChild(REP_PWD));

	Tree pwTree = root.getTree(user.getPath()).getChild(REP_PWD);
	assertTrue(pwTree.hasProperty(REP_PWD_HISTORY));

	List<String> history = getHistory(user);
	assertEquals(1, history.size());
	assertEquals(oldPassword, history.iterator().next());

	String currentPw = TreeUtil.getString(root.getTree(user.getPath()), REP_PASSWORD);
	assertNotSame(currentPw, oldPassword);
	}

	@Test
	public void testHistoryMaxSize() throws Exception {
	User user = getTestUser();

	// we're changing the password 12 times, history max is 10
	for (String pw : PASSWORDS) {
	user.changePassword(pw);
	root.commit();
	}

	assertEquals(10, getHistory(user).size());
	}

	@Test
	public void testHistoryOrder() throws Exception {
	User user = getTestUser();

	// we're changing the password 12 times, history max is 10
	for (String pw : PASSWORDS) {
	user.changePassword(pw);
	}

	// we skip the first entry in the password list as it was shifted out
	// due to max history size = 10.
	int i = 1;
	for (String pwHash : getHistory(user)) {
	assertTrue(PasswordUtil.isSame(pwHash, PASSWORDS[i++]));
	}
	}

	@Test
	public void testRepeatedPwAfterHistorySizeReached() throws Exception {
	User user = getTestUser();
	for (String pw : PASSWORDS) {
	user.changePassword(pw);
	}

	// changing pw back to the original value (as used for creation) must succeed
	user.changePassword(user.getID());
	// now, using all old passwords must also succeed as they get shifted out
	for (String pw : PASSWORDS) {
	user.changePassword(pw);
	}
	}

	@Test(expected = ConstraintViolationException.class)
	public void testHistoryViolationAtFirstChange() throws Exception {
	User user = getTestUser();
	user.changePassword(user.getID());
	}

	@Test(expected = ConstraintViolationException.class)
	public void testHistoryViolation() throws Exception {
	User user = getTestUser();
	user.changePassword("abc");
	user.changePassword("def");
	user.changePassword("abc");
	}

	@Test
	public void testNoHistoryUpdateOnViolation() throws Exception {
	User user = getTestUser();
	try {
	user.changePassword("abc");
	user.changePassword("def");
	user.changePassword("abc");
	fail("history violation not detected");
	} catch (ConstraintViolationException e) {
	String[] expected = new String[] {user.getID(), "abc"};
	int i = 0;
	for (String pwHash : getHistory(user)) {
	assertTrue(PasswordUtil.isSame(pwHash, expected[i++]));
	}
	}
	}

	@Test
	public void testEnabledPasswordHistory() throws Exception {
	PasswordHistory history = new PasswordHistory(CONFIG);
	assertTrue(isEnabled(history));
	assertEquals(10, getMaxSize(history).longValue());
	}

	@Test
	public void testHistoryUpperLimit() throws Exception {
	PasswordHistory history = new PasswordHistory(ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, Integer.MAX_VALUE));

	assertTrue(isEnabled(history));
	assertEquals(1000, getMaxSize(history).longValue());
	}

	@Test
	public void testDisabledPasswordHistory() throws Exception {
	User user = getTestUser();
	Tree userTree = root.getTree(user.getPath());

	List<ConfigurationParameters> configs = ImmutableList.of(
	ConfigurationParameters.EMPTY,
	ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, PASSWORD_HISTORY_DISABLED_SIZE),
	ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, -1),
	ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, Integer.MIN_VALUE)
	);

	for (ConfigurationParameters config : configs) {
	PasswordHistory disabledHistory = new PasswordHistory(config);

	assertFalse(isEnabled(disabledHistory));
	assertFalse(disabledHistory.updatePasswordHistory(userTree, user.getID()));
	}
	}

	@Test(expected = ConstraintViolationException.class)
	public void testCheckPasswordHistory() throws Exception {
	Tree userTree = root.getTree(getTestUser().getPath());

	PasswordHistory history = new PasswordHistory(CONFIG);
	assertTrue(isEnabled(history));
	assertEquals(10, getMaxSize(history).longValue());

	history.updatePasswordHistory(userTree, getTestUser().getID());
	}

	@Test
	public void testConfigurationChange() throws Exception {
	User user = getTestUser();
	Tree userTree = root.getTree(user.getPath());

	PasswordHistory history = new PasswordHistory(CONFIG);
	for (String pw : PASSWORDS) {
	assertTrue(history.updatePasswordHistory(userTree, pw));
	}
	assertEquals(10, getHistory(user).size());

	// change configuration to a smaller size
	history = new PasswordHistory(ConfigurationParameters.of(PARAM_PASSWORD_HISTORY_SIZE, 5));
	List<String> oldPwds = getHistory(user);
	assertEquals(10, oldPwds.size());

	// only the configured max-size number of entries in the history must be
	// checked. additional entries in the history must be ignored
	Iterables.skip(oldPwds, 6);
	history.updatePasswordHistory(userTree, oldPwds.iterator().next());

	// after chaning the pwd again however the rep:pwdHistory property must
	// only contain the max-size number of passwords
	assertEquals(5, getHistory(user).size());

	history = new PasswordHistory(CONFIG);
	history.updatePasswordHistory(userTree, "newPwd");
	assertEquals(6, getHistory(user).size());
	}

	@Test
	public void testEnableDisable() throws Exception {
	User user = getTestUser();
	Tree userTree = root.getTree(user.getPath());

	PasswordHistory history = new PasswordHistory(CONFIG);
	for (String pw : PASSWORDS) {
	assertTrue(history.updatePasswordHistory(userTree, pw));
	}
	assertEquals(10, getHistory(user).size());

	// disable the password history : changing the pw now must not
	// modify the rep:pwdHistory property.
	history = new PasswordHistory(ConfigurationParameters.EMPTY);
	history.updatePasswordHistory(userTree, PASSWORDS[8]);

	assertEquals(10, getHistory(user).size());
	}

	@Test
	public void testSingleTypeHistoryProperty() throws Exception {
	Tree userTree = root.getTree(getTestUser().getPath());
	Tree pwdNode = TreeUtil.getOrAddChild(userTree, REP_PWD, NT_REP_PASSWORD);

	pwdNode.setProperty(REP_PWD_HISTORY, "singleValuedProperty");
	assertFalse(pwdNode.getProperty(REP_PWD_HISTORY).isArray());
	assertFalse(pwdNode.getProperty(REP_PWD_HISTORY).getType().isArray());

	PasswordHistory history = new PasswordHistory(CONFIG);
	assertTrue(history.updatePasswordHistory(userTree, "anyOtherPassword"));

	assertTrue(pwdNode.getProperty(REP_PWD_HISTORY).isArray());
	assertTrue(pwdNode.getProperty(REP_PWD_HISTORY).getType().isArray());
	}

	@Test
	public void testUpdateMissingPwHash() throws Exception {
	User u = getUserManager(root).createUser("uid", null);
	PasswordHistory ph = new PasswordHistory(ConfigurationParameters.of(UserConstants.PARAM_PASSWORD_HISTORY_SIZE, UserConstants.PASSWORD_HISTORY_DISABLED_SIZE+1));
	assertFalse(ph.updatePasswordHistory(root.getTree(u.getPath()), "pw"));
	}
	}