| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.apache.metron.rest.config; |
| |
| import static junit.framework.TestCase.assertNull; |
| import static junit.framework.TestCase.assertTrue; |
| import static org.junit.jupiter.api.Assertions.assertEquals; |
| import static org.junit.jupiter.api.Assertions.assertFalse; |
| import static org.junit.jupiter.api.Assertions.assertThrows; |
| import static org.mockito.Mockito.any; |
| import static org.mockito.Mockito.doReturn; |
| import static org.mockito.Mockito.doThrow; |
| import static org.mockito.Mockito.mock; |
| import static org.mockito.Mockito.spy; |
| import static org.mockito.Mockito.times; |
| import static org.mockito.Mockito.verify; |
| import static org.mockito.Mockito.verifyNoMoreInteractions; |
| import static org.mockito.Mockito.when; |
| |
| |
| import com.nimbusds.jose.JOSEException; |
| import com.nimbusds.jose.JWSAlgorithm; |
| import com.nimbusds.jose.JWSHeader; |
| import com.nimbusds.jose.JWSObject; |
| import com.nimbusds.jose.crypto.RSASSAVerifier; |
| import com.nimbusds.jose.util.Base64URL; |
| import com.nimbusds.jwt.JWTClaimsSet; |
| import com.nimbusds.jwt.SignedJWT; |
| import java.io.File; |
| import java.nio.charset.StandardCharsets; |
| import java.nio.file.Path; |
| import java.nio.file.Paths; |
| import java.security.interfaces.RSAPublicKey; |
| import java.text.ParseException; |
| import java.util.Arrays; |
| import java.util.Date; |
| import javax.servlet.FilterChain; |
| import javax.servlet.ServletResponse; |
| import javax.servlet.http.Cookie; |
| import javax.servlet.http.HttpServletRequest; |
| import org.apache.commons.io.FileUtils; |
| import org.junit.jupiter.api.Test; |
| import org.springframework.ldap.core.AttributesMapper; |
| import org.springframework.ldap.core.LdapTemplate; |
| import org.springframework.ldap.query.LdapQuery; |
| import org.springframework.security.core.Authentication; |
| import org.springframework.security.core.context.SecurityContext; |
| |
| public class KnoxSSOAuthenticationFilterTest { |
| @Test |
| public void shouldThrowExceptionOnMissingLdapTemplate() { |
| IllegalStateException e = |
| assertThrows( |
| IllegalStateException.class, |
| () -> |
| new KnoxSSOAuthenticationFilter( |
| "userSearchBase", mock(Path.class), "knoxKeyString", "knoxCookie", null)); |
| assertEquals("KnoxSSO requires LDAP. You must add 'ldap' to the active profiles.", e.getMessage()); |
| } |
| |
| @Test |
| public void doFilterShouldProperlySetAuthentication() throws Exception { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| HttpServletRequest request = mock(HttpServletRequest.class); |
| ServletResponse response = mock(ServletResponse.class); |
| FilterChain chain = mock(FilterChain.class); |
| SignedJWT signedJWT = mock(SignedJWT.class); |
| JWTClaimsSet jwtClaimsSet = new JWTClaimsSet.Builder().subject("userName").build(); |
| Authentication authentication = mock(Authentication.class); |
| SecurityContext securityContext = mock(SecurityContext.class); |
| |
| when(request.getHeader("Authorization")).thenReturn(null); |
| doReturn("serializedJWT").when(knoxSSOAuthenticationFilter).getJWTFromCookie(request); |
| doReturn(signedJWT).when(knoxSSOAuthenticationFilter).parseJWT(any()); |
| when(signedJWT.getJWTClaimsSet()).thenReturn(jwtClaimsSet); |
| doReturn(true).when(knoxSSOAuthenticationFilter).isValid(signedJWT, "userName"); |
| doReturn(authentication).when(knoxSSOAuthenticationFilter).getAuthentication("userName", request); |
| doReturn(securityContext).when(knoxSSOAuthenticationFilter).getSecurityContext(); |
| |
| knoxSSOAuthenticationFilter.doFilter(request, response, chain); |
| |
| verify(securityContext).setAuthentication(authentication); |
| verify(chain).doFilter(request, response); |
| verifyNoMoreInteractions(chain, securityContext); |
| } |
| |
| @Test |
| public void doFilterShouldContinueOnBasicAuthenticationHeader() throws Exception { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| HttpServletRequest request = mock(HttpServletRequest.class); |
| ServletResponse response = mock(ServletResponse.class); |
| FilterChain chain = mock(FilterChain.class); |
| |
| when(request.getHeader("Authorization")).thenReturn("Basic "); |
| |
| knoxSSOAuthenticationFilter.doFilter(request, response, chain); |
| |
| verify(knoxSSOAuthenticationFilter, times(0)).getJWTFromCookie(request); |
| verify(chain).doFilter(request, response); |
| verifyNoMoreInteractions(chain); |
| } |
| |
| @Test |
| public void doFilterShouldContinueOnParseException() throws Exception { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| HttpServletRequest request = mock(HttpServletRequest.class); |
| ServletResponse response = mock(ServletResponse.class); |
| FilterChain chain = mock(FilterChain.class); |
| |
| when(request.getHeader("Authorization")).thenReturn(null); |
| doReturn("serializedJWT").when(knoxSSOAuthenticationFilter).getJWTFromCookie(request); |
| doThrow(new ParseException("parse exception", 0)).when(knoxSSOAuthenticationFilter).parseJWT(any()); |
| |
| knoxSSOAuthenticationFilter.doFilter(request, response, chain); |
| |
| verify(knoxSSOAuthenticationFilter, times(0)).getAuthentication("userName", request); |
| verify(chain).doFilter(request, response); |
| verifyNoMoreInteractions(chain); |
| } |
| |
| @Test |
| public void doFilterShouldContinueOnInvalidToken() throws Exception { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| HttpServletRequest request = mock(HttpServletRequest.class); |
| ServletResponse response = mock(ServletResponse.class); |
| FilterChain chain = mock(FilterChain.class); |
| SignedJWT signedJWT = mock(SignedJWT.class); |
| JWTClaimsSet jwtClaimsSet = new JWTClaimsSet.Builder().subject("userName").build(); |
| |
| when(request.getHeader("Authorization")).thenReturn(null); |
| doReturn("serializedJWT").when(knoxSSOAuthenticationFilter).getJWTFromCookie(request); |
| doReturn(signedJWT).when(knoxSSOAuthenticationFilter).parseJWT(any()); |
| when(signedJWT.getJWTClaimsSet()).thenReturn(jwtClaimsSet); |
| doReturn(false).when(knoxSSOAuthenticationFilter).isValid(signedJWT, "userName"); |
| |
| knoxSSOAuthenticationFilter.doFilter(request, response, chain); |
| |
| verify(knoxSSOAuthenticationFilter, times(0)).getAuthentication("userName", request); |
| verify(chain).doFilter(request, response); |
| verifyNoMoreInteractions(chain); |
| } |
| |
| @Test |
| public void isValidShouldProperlyValidateToken() throws Exception { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| |
| SignedJWT jwtToken = mock(SignedJWT.class); |
| |
| { |
| // Should be invalid on emtpy user name |
| assertFalse(knoxSSOAuthenticationFilter.isValid(jwtToken, null)); |
| } |
| |
| { |
| // Should be invalid on expired token |
| Date expiredDate = new Date(System.currentTimeMillis() - 10000); |
| JWTClaimsSet jwtClaimsSet = new JWTClaimsSet.Builder().expirationTime(expiredDate).build(); |
| when(jwtToken.getJWTClaimsSet()).thenReturn(jwtClaimsSet); |
| |
| assertFalse(knoxSSOAuthenticationFilter.isValid(jwtToken, "userName")); |
| } |
| |
| { |
| // Should be invalid when date is before notBeforeTime |
| Date notBeforeDate = new Date(System.currentTimeMillis() + 10000); |
| JWTClaimsSet jwtClaimsSet = new JWTClaimsSet.Builder().notBeforeTime(notBeforeDate).build(); |
| when(jwtToken.getJWTClaimsSet()).thenReturn(jwtClaimsSet); |
| |
| assertFalse(knoxSSOAuthenticationFilter.isValid(jwtToken, "userName")); |
| } |
| |
| { |
| // Should be valid if user name is present and token is within time constraints |
| Date expiredDate = new Date(System.currentTimeMillis() + 10000); |
| Date notBeforeDate = new Date(System.currentTimeMillis() - 10000); |
| JWTClaimsSet jwtClaimsSet = new JWTClaimsSet.Builder().expirationTime(expiredDate).notBeforeTime(notBeforeDate).build(); |
| when(jwtToken.getJWTClaimsSet()).thenReturn(jwtClaimsSet); |
| doReturn(true).when(knoxSSOAuthenticationFilter).validateSignature(jwtToken); |
| |
| assertTrue(knoxSSOAuthenticationFilter.isValid(jwtToken, "userName")); |
| } |
| |
| } |
| |
| @Test |
| public void validateSignatureShouldProperlyValidateToken() throws Exception { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| |
| SignedJWT jwtToken = mock(SignedJWT.class); |
| |
| { |
| // Should be invalid if algorithm is not ES256 |
| JWSHeader jwsHeader = new JWSHeader(JWSAlgorithm.ES384); |
| when(jwtToken.getHeader()).thenReturn(jwsHeader); |
| |
| assertFalse(knoxSSOAuthenticationFilter.validateSignature(jwtToken)); |
| } |
| { |
| // Should be invalid if state is not SIGNED |
| JWSHeader jwsHeader = new JWSHeader(JWSAlgorithm.RS256); |
| when(jwtToken.getHeader()).thenReturn(jwsHeader); |
| when(jwtToken.getState()).thenReturn(JWSObject.State.UNSIGNED); |
| |
| assertFalse(knoxSSOAuthenticationFilter.validateSignature(jwtToken)); |
| } |
| { |
| // Should be invalid if signature is null |
| JWSHeader jwsHeader = new JWSHeader(JWSAlgorithm.RS256); |
| when(jwtToken.getHeader()).thenReturn(jwsHeader); |
| when(jwtToken.getState()).thenReturn(JWSObject.State.SIGNED); |
| |
| assertFalse(knoxSSOAuthenticationFilter.validateSignature(jwtToken)); |
| } |
| { |
| Base64URL signature = mock(Base64URL.class); |
| when(jwtToken.getSignature()).thenReturn(signature); |
| RSAPublicKey rsaPublicKey = mock(RSAPublicKey.class); |
| RSASSAVerifier rsaSSAVerifier = mock(RSASSAVerifier.class); |
| doReturn(rsaSSAVerifier).when(knoxSSOAuthenticationFilter).getRSASSAVerifier(); |
| { |
| // Should be invalid if token verify throws an exception |
| when(jwtToken.verify(rsaSSAVerifier)).thenThrow(new JOSEException("verify exception")); |
| |
| assertFalse(knoxSSOAuthenticationFilter.validateSignature(jwtToken)); |
| } |
| { |
| // Should be invalid if RSA verification fails |
| doReturn(false).when(jwtToken).verify(rsaSSAVerifier); |
| |
| assertFalse(knoxSSOAuthenticationFilter.validateSignature(jwtToken)); |
| } |
| { |
| // Should be valid if RSA verification succeeds |
| doReturn(true).when(jwtToken).verify(rsaSSAVerifier); |
| |
| assertTrue(knoxSSOAuthenticationFilter.validateSignature(jwtToken)); |
| } |
| } |
| } |
| |
| @Test |
| public void getJWTFromCookieShouldProperlyReturnToken() { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| |
| HttpServletRequest request = mock(HttpServletRequest.class); |
| |
| { |
| // Should be null if cookies are empty |
| assertNull(knoxSSOAuthenticationFilter.getJWTFromCookie(request)); |
| } |
| { |
| // Should be null if Knox cookie is missing |
| Cookie cookie = new Cookie("someCookie", "someValue"); |
| when(request.getCookies()).thenReturn(new Cookie[]{cookie}); |
| |
| assertNull(knoxSSOAuthenticationFilter.getJWTFromCookie(request)); |
| } |
| { |
| // Should return token from knoxCookie |
| Cookie cookie = new Cookie("knoxCookie", "token"); |
| when(request.getCookies()).thenReturn(new Cookie[]{cookie}); |
| |
| assertEquals("token", knoxSSOAuthenticationFilter.getJWTFromCookie(request)); |
| } |
| |
| } |
| |
| @Test |
| public void getKnoxKeyShouldProperlyReturnKnoxKey() throws Exception { |
| { |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| |
| assertEquals("knoxKeyString", knoxSSOAuthenticationFilter.getKnoxKey()); |
| } |
| { |
| |
| FileUtils.writeStringToFile(new File("./target/knoxKeyFile"), "knoxKeyFileKeyString", StandardCharsets.UTF_8); |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("userSearchBase", |
| Paths.get("./target/knoxKeyFile"), |
| null, |
| "knoxCookie", |
| mock(LdapTemplate.class) |
| )); |
| |
| assertEquals("knoxKeyFileKeyString", knoxSSOAuthenticationFilter.getKnoxKey()); |
| } |
| } |
| |
| @SuppressWarnings("unchecked") |
| @Test |
| public void getAuthenticationShouldProperlyPopulateAuthentication() { |
| LdapTemplate ldapTemplate = mock(LdapTemplate.class); |
| KnoxSSOAuthenticationFilter knoxSSOAuthenticationFilter = spy(new KnoxSSOAuthenticationFilter("ou=people,dc=hadoop,dc=apache,dc=org", |
| mock(Path.class), |
| "knoxKeyString", |
| "knoxCookie", |
| ldapTemplate |
| )); |
| |
| HttpServletRequest request = mock(HttpServletRequest.class); |
| |
| when(ldapTemplate.search(any(LdapQuery.class), any(AttributesMapper.class))).thenReturn(Arrays.asList("USER", "ADMIN")); |
| |
| Authentication authentication = knoxSSOAuthenticationFilter.getAuthentication("userName", request); |
| Object[] grantedAuthorities = authentication.getAuthorities().toArray(); |
| assertEquals("ROLE_USER", grantedAuthorities[0].toString()); |
| assertEquals("ROLE_ADMIN", grantedAuthorities[1].toString()); |
| assertEquals("userName", authentication.getName()); |
| } |
| |
| } |
