test/org/apache/catalina/authenticator/TestSSOnonLoginAndDigestAuthenticator.java - tomcat80 - Git at Google

 /*
  *  Licensed to the Apache Software Foundation (ASF) under one or more
  *  contributor license agreements.  See the NOTICE file distributed with
  *  this work for additional information regarding copyright ownership.
  *  The ASF licenses this file to You under the Apache License, Version 2.0
  *  (the "License"); you may not use this file except in compliance with
  *  the License.  You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  *  Unless required by applicable law or agreed to in writing, software
  *  distributed under the License is distributed on an "AS IS" BASIS,
  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  */
 package org.apache.catalina.authenticator;

 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;

 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;

 import org.junit.Test;

 import org.apache.catalina.Context;
 import org.apache.catalina.startup.TesterServlet;
 import org.apache.catalina.startup.Tomcat;
 import org.apache.catalina.startup.TomcatBaseTest;
 import org.apache.tomcat.util.buf.ByteChunk;
 import org.apache.tomcat.util.descriptor.web.LoginConfig;
 import org.apache.tomcat.util.descriptor.web.SecurityCollection;
 import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
 import org.apache.tomcat.util.security.ConcurrentMessageDigest;
 import org.apache.tomcat.util.security.MD5Encoder;

 /**
  * Test DigestAuthenticator and NonLoginAuthenticator when a
  * SingleSignOn Valve is active.
  *
  * <p>
  * In the absence of SSO support, a webapp using NonLoginAuthenticator
  * simply cannot access protected resources. These tests exercise the
  * the way successfully authenticating a different webapp under the
  * DigestAuthenticator triggers the additional SSO logic for both webapps.
  *
  * <p>
  * Note: these tests are intended to exercise the SSO logic of the
  * Authenticator, but not to comprehensively test all of its logic paths.
  * That is the responsibility of the non-SSO test suite.
  */
 public class TestSSOnonLoginAndDigestAuthenticator extends TomcatBaseTest {

     private static final String USER = "user";
     private static final String PWD = "pwd";
     private static final String ROLE = "role";

     private static final String HTTP_PREFIX = "http://localhost:";
     private static final String CONTEXT_PATH_NOLOGIN = "/nologin";
     private static final String CONTEXT_PATH_DIGEST = "/digest";
     private static final String URI_PROTECTED = "/protected";
     private static final String URI_PUBLIC = "/anyoneCanAccess";

     private static final int SHORT_TIMEOUT_SECS = 4;
     private static final long SHORT_TIMEOUT_DELAY_MSECS =
                                     ((SHORT_TIMEOUT_SECS + 3) * 1000);
     private static final int LONG_TIMEOUT_SECS = 10;
     private static final long LONG_TIMEOUT_DELAY_MSECS =
                                     ((LONG_TIMEOUT_SECS + 2) * 1000);

     private static final String CLIENT_AUTH_HEADER = "authorization";
     private static final String OPAQUE = "opaque";
     private static final String NONCE = "nonce";
     private static final String REALM = "realm";
     private static final String CNONCE = "cnonce";

     private static String NC1 = "00000001";
     private static String NC2 = "00000002";
     private static String QOP = "auth";

     private static String SERVER_COOKIES = "Set-Cookie";
     private static String BROWSER_COOKIES = "Cookie";

     private List<String> cookies;

     /*
      * Try to access an unprotected resource without an
      * established SSO session.
      * This should be permitted.
      */
     @Test
     public void testAcceptPublicNonLogin() throws Exception {
         doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PUBLIC,
                        true, false, 200);
     }

     /*
      * Try to access a protected resource without an established
      * SSO session.
      * This should be rejected with SC_FORBIDDEN 403 status.
      */
     @Test
     public void testRejectProtectedNonLogin() throws Exception {
         doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
                        false, true, 403);
     }

     /*
      * Logon to access a protected resource using DIGEST authentication,
      * which will establish an SSO session.
      * Wait until the SSO session times-out, then try to re-access
      * the resource.
      * This should be rejected with SC_FORBIDDEN 401 status, which
      * will then be followed by successful re-authentication.
      */
     @Test
     public void testDigestLoginSessionTimeout() throws Exception {
         doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
                      true, 401, true, true, NC1, CNONCE, QOP, true);
         // wait long enough for my session to expire
         Thread.sleep(LONG_TIMEOUT_DELAY_MSECS);
         // must change the client nonce to succeed
         doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
                      true, 401, true, true, NC2, CNONCE, QOP, true);
    }

     /*
      * Logon to access a protected resource using DIGEST authentication,
      * which will establish an SSO session.
      * Immediately try to access a protected resource in the NonLogin
      * webapp, but without sending the SSO session cookie.
      * This should be rejected with SC_FORBIDDEN 403 status.
      */
     @Test
     public void testDigestLoginRejectProtectedWithoutCookies() throws Exception {
         doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
                      true, 401, true, true, NC1, CNONCE, QOP, true);
         doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
                        false, true, 403);
     }

     /*
      * Logon to access a protected resource using DIGEST authentication,
      * which will establish an SSO session.
      * Immediately try to access a protected resource in the NonLogin
      * webapp while sending the SSO session cookie provided by the
      * first webapp.
      * This should be successful with SC_OK 200 status.
      */
     @Test
     public void testDigestLoginAcceptProtectedWithCookies() throws Exception {
         doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
                 true, 401, true, true, NC1, CNONCE, QOP, true);
         doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
                         true, false, 200);
     }

     /*
      * Logon to access a protected resource using DIGEST authentication,
      * which will establish an SSO session.
      * Immediately try to access a protected resource in the NonLogin
      * webapp while sending the SSO session cookie provided by the
      * first webapp.
      * This should be successful with SC_OK 200 status.
      *
      * Then, wait long enough for the DIGEST session to expire. (The SSO
      * session should remain active because the NonLogin session has
      * not yet expired).
      *
      * Try to access the protected resource again, before the SSO session
      * has expired.
      * This should be successful with SC_OK 200 status.
      *
      * Finally, wait for the non-login session to expire and try again..
      * This should be rejected with SC_FORBIDDEN 403 status.
      *
      * (see bugfix https://bz.apache.org/bugzilla/show_bug.cgi?id=52303)
      */
     @Test
     public void testDigestExpiredAcceptProtectedWithCookies() throws Exception {
         doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
                 true, 401, true, true, NC1, CNONCE, QOP, true);
         doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
                         true, false, 200);

         // wait long enough for the BASIC session to expire,
         // but not long enough for NonLogin session expiry
         Thread.sleep(SHORT_TIMEOUT_DELAY_MSECS);
         doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
                         true, false, 200);

         // wait long enough for my NonLogin session to expire
         // and tear down the SSO session at the same time.
         Thread.sleep(LONG_TIMEOUT_DELAY_MSECS);
         doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
                         false, true, 403);
     }


     public void doTestNonLogin(String uri, boolean addCookies,
             boolean expectedReject, int expectedRC)
             throws Exception {

         Map<String,List<String>> reqHeaders = new HashMap<>();
         Map<String,List<String>> respHeaders = new HashMap<>();

         ByteChunk bc = new ByteChunk();
         if (addCookies) {
             addCookies(reqHeaders);
         }
         int rc = getUrl(HTTP_PREFIX + getPort() + uri, bc, reqHeaders,
                 respHeaders);

         if (expectedReject) {
             assertEquals(expectedRC, rc);
             assertTrue(bc.getLength() > 0);
         }
         else {
             assertEquals(200, rc);
             assertEquals("OK", bc.toString());
             saveCookies(respHeaders);
         }
 }

     public void doTestDigest(String user, String pwd, String uri,
             boolean expectedReject1, int expectedRC1,
             boolean useServerNonce, boolean useServerOpaque,
             String nc1, String cnonce,
             String qop, boolean req2expect200)
             throws Exception {

         String digestUri= uri;

         List<String> auth = new ArrayList<>();
         Map<String,List<String>> reqHeaders1 = new HashMap<>();
         Map<String,List<String>> respHeaders1 = new HashMap<>();

         // the first access attempt should be challenged
         auth.add(buildDigestResponse(user, pwd, digestUri, REALM, "null",
                 "null", nc1, cnonce, qop));
         reqHeaders1.put(CLIENT_AUTH_HEADER, auth);

         ByteChunk bc = new ByteChunk();
         int rc = getUrl(HTTP_PREFIX + getPort() + uri, bc, reqHeaders1,
                 respHeaders1);

         if (expectedReject1) {
             assertEquals(expectedRC1, rc);
             assertTrue(bc.getLength() > 0);
         }
         else {
             assertEquals(200, rc);
             assertEquals("OK", bc.toString());
             saveCookies(respHeaders1);
             return;
         }

         // Second request should succeed (if we use the server nonce)
         Map<String,List<String>> reqHeaders2 = new HashMap<>();
         Map<String,List<String>> respHeaders2 = new HashMap<>();

         auth.clear();
         if (useServerNonce) {
             if (useServerOpaque) {
                 auth.add(buildDigestResponse(user, pwd, digestUri,
                         getAuthToken(respHeaders1, REALM),
                         getAuthToken(respHeaders1, NONCE),
                         getAuthToken(respHeaders1, OPAQUE),
                         nc1, cnonce, qop));
             } else {
                 auth.add(buildDigestResponse(user, pwd, digestUri,
                         getAuthToken(respHeaders1, REALM),
                         getAuthToken(respHeaders1, NONCE),
                         "null", nc1, cnonce, qop));
             }
         } else {
             auth.add(buildDigestResponse(user, pwd, digestUri,
                     getAuthToken(respHeaders2, REALM),
                     "null", getAuthToken(respHeaders1, OPAQUE),
                     nc1, cnonce, QOP));
         }
         reqHeaders2.put(CLIENT_AUTH_HEADER, auth);

         bc.recycle();
         rc = getUrl(HTTP_PREFIX + getPort() + uri, bc, reqHeaders2,
                 respHeaders2);

         if (req2expect200) {
             assertEquals(200, rc);
             assertEquals("OK", bc.toString());
             saveCookies(respHeaders2);
         } else {
             assertEquals(401, rc);
             assertTrue((bc.getLength() > 0));
         }
     }


     @Override
     public void setUp() throws Exception {
         super.setUp();

         // create a tomcat server using the default in-memory Realm
         Tomcat tomcat = getTomcatInstance();

         // associate the SingeSignOn Valve before the Contexts
         SingleSignOn sso = new SingleSignOn();
         tomcat.getHost().getPipeline().addValve(sso);

         // add the test user and role to the Realm
         tomcat.addUser(USER, PWD);
         tomcat.addRole(USER, ROLE);

         // setup both NonLogin, Login and digest webapps
         setUpNonLogin(tomcat);
         setUpDigest(tomcat);

         tomcat.start();
     }

     private void setUpNonLogin(Tomcat tomcat) throws Exception {

         // Must have a real docBase for webapps - just use temp
         Context ctxt = tomcat.addContext(CONTEXT_PATH_NOLOGIN,
                 System.getProperty("java.io.tmpdir"));
         ctxt.setSessionTimeout(LONG_TIMEOUT_SECS);

         // Add protected servlet
         Tomcat.addServlet(ctxt, "TesterServlet1", new TesterServlet());
         ctxt.addServletMappingDecoded(URI_PROTECTED, "TesterServlet1");
         SecurityCollection collection1 = new SecurityCollection();
         collection1.addPatternDecoded(URI_PROTECTED);
         SecurityConstraint sc1 = new SecurityConstraint();
         sc1.addAuthRole(ROLE);
         sc1.addCollection(collection1);
         ctxt.addConstraint(sc1);

         // Add unprotected servlet
         Tomcat.addServlet(ctxt, "TesterServlet2", new TesterServlet());
         ctxt.addServletMappingDecoded(URI_PUBLIC, "TesterServlet2");
         SecurityCollection collection2 = new SecurityCollection();
         collection2.addPatternDecoded(URI_PUBLIC);
         SecurityConstraint sc2 = new SecurityConstraint();
         // do not add a role - which signals access permitted without one
         sc2.addCollection(collection2);
         ctxt.addConstraint(sc2);

         // Configure the appropriate authenticator
         LoginConfig lc = new LoginConfig();
         lc.setAuthMethod("NONE");
         ctxt.setLoginConfig(lc);
         ctxt.getPipeline().addValve(new NonLoginAuthenticator());
     }

     private void setUpDigest(Tomcat tomcat) throws Exception {

         // Must have a real docBase for webapps - just use temp
         Context ctxt = tomcat.addContext(CONTEXT_PATH_DIGEST,
                 System.getProperty("java.io.tmpdir"));
         ctxt.setSessionTimeout(SHORT_TIMEOUT_SECS);

         // Add protected servlet
         Tomcat.addServlet(ctxt, "TesterServlet3", new TesterServlet());
         ctxt.addServletMappingDecoded(URI_PROTECTED, "TesterServlet3");
         SecurityCollection collection = new SecurityCollection();
         collection.addPatternDecoded(URI_PROTECTED);
         SecurityConstraint sc = new SecurityConstraint();
         sc.addAuthRole(ROLE);
         sc.addCollection(collection);
         ctxt.addConstraint(sc);

         // Configure the appropriate authenticator
         LoginConfig lc = new LoginConfig();
         lc.setAuthMethod("DIGEST");
         ctxt.setLoginConfig(lc);
         ctxt.getPipeline().addValve(new DigestAuthenticator());
     }

     protected static String getAuthToken(
             Map<String,List<String>> respHeaders, String token) {

         final String AUTH_PREFIX = "=\"";
         final String AUTH_SUFFIX = "\"";
         List<String> authHeaders =
             respHeaders.get(AuthenticatorBase.AUTH_HEADER_NAME);

         // Assume there is only one
         String authHeader = authHeaders.iterator().next();
         String searchFor = token + AUTH_PREFIX;
         int start = authHeader.indexOf(searchFor) + searchFor.length();
         int end = authHeader.indexOf(AUTH_SUFFIX, start);
         return authHeader.substring(start, end);
     }

     /*
      * Notes from RFC2617
      * H(data) = MD5(data)
      * KD(secret, data) = H(concat(secret, ":", data))
      * A1 = unq(username-value) ":" unq(realm-value) ":" passwd
      * A2 = Method ":" digest-uri-value
      * request-digest  = <"> < KD ( H(A1),     unq(nonce-value)
                                     ":" nc-value
                                     ":" unq(cnonce-value)
                                     ":" unq(qop-value)
                                     ":" H(A2)
                                    ) <">
      */
     private static String buildDigestResponse(String user, String pwd,
             String uri, String realm, String nonce, String opaque, String nc,
             String cnonce, String qop) {

         String a1 = user + ":" + realm + ":" + pwd;
         String a2 = "GET:" + uri;

         String md5a1 = digest(a1);
         String md5a2 = digest(a2);

         String response;
         if (qop == null) {
             response = md5a1 + ":" + nonce + ":" + md5a2;
         } else {
             response = md5a1 + ":" + nonce + ":" + nc + ":" + cnonce + ":" +
                     qop + ":" + md5a2;
         }

         String md5response = digest(response);

         StringBuilder auth = new StringBuilder();
         auth.append("Digest username=\"");
         auth.append(user);
         auth.append("\", realm=\"");
         auth.append(realm);
         auth.append("\", nonce=\"");
         auth.append(nonce);
         auth.append("\", uri=\"");
         auth.append(uri);
         auth.append("\", opaque=\"");
         auth.append(opaque);
         auth.append("\", response=\"");
         auth.append(md5response);
         auth.append("\"");
         if (qop != null) {
             auth.append(", qop=");
             auth.append(qop);
         }
         if (nc != null) {
             auth.append(", nc=");
             auth.append(nc);
         }
         if (cnonce != null) {
             auth.append(", cnonce=\"");
             auth.append(cnonce);
             auth.append("\"");
         }

         return auth.toString();
     }

     private static String digest(String input) {
         return MD5Encoder.encode(
                 ConcurrentMessageDigest.digestMD5(input.getBytes()));
     }

     /*
      * extract and save the server cookies from the incoming response
      */
     protected void saveCookies(Map<String,List<String>> respHeaders) {

         // we only save the Cookie values, not header prefix
         cookies = respHeaders.get(SERVER_COOKIES);
     }

     /*
      * add all saved cookies to the outgoing request
      */
     protected void addCookies(Map<String,List<String>> reqHeaders) {

         if ((cookies != null) && (cookies.size() > 0)) {
             reqHeaders.put(BROWSER_COOKIES, cookies);
         }
     }
 }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one or more
	* contributor license agreements. See the NOTICE file distributed with
	* this work for additional information regarding copyright ownership.
	* The ASF licenses this file to You under the Apache License, Version 2.0
	* (the "License"); you may not use this file except in compliance with
	* the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/
	package org.apache.catalina.authenticator;

	import java.util.ArrayList;
	import java.util.HashMap;
	import java.util.List;
	import java.util.Map;

	import static org.junit.Assert.assertEquals;
	import static org.junit.Assert.assertTrue;

	import org.junit.Test;

	import org.apache.catalina.Context;
	import org.apache.catalina.startup.TesterServlet;
	import org.apache.catalina.startup.Tomcat;
	import org.apache.catalina.startup.TomcatBaseTest;
	import org.apache.tomcat.util.buf.ByteChunk;
	import org.apache.tomcat.util.descriptor.web.LoginConfig;
	import org.apache.tomcat.util.descriptor.web.SecurityCollection;
	import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
	import org.apache.tomcat.util.security.ConcurrentMessageDigest;
	import org.apache.tomcat.util.security.MD5Encoder;

	/**
	* Test DigestAuthenticator and NonLoginAuthenticator when a
	* SingleSignOn Valve is active.
	*
	* <p>
	* In the absence of SSO support, a webapp using NonLoginAuthenticator
	* simply cannot access protected resources. These tests exercise the
	* the way successfully authenticating a different webapp under the
	* DigestAuthenticator triggers the additional SSO logic for both webapps.
	*
	* <p>
	* Note: these tests are intended to exercise the SSO logic of the
	* Authenticator, but not to comprehensively test all of its logic paths.
	* That is the responsibility of the non-SSO test suite.
	*/
	public class TestSSOnonLoginAndDigestAuthenticator extends TomcatBaseTest {

	private static final String USER = "user";
	private static final String PWD = "pwd";
	private static final String ROLE = "role";

	private static final String HTTP_PREFIX = "http://localhost:";
	private static final String CONTEXT_PATH_NOLOGIN = "/nologin";
	private static final String CONTEXT_PATH_DIGEST = "/digest";
	private static final String URI_PROTECTED = "/protected";
	private static final String URI_PUBLIC = "/anyoneCanAccess";

	private static final int SHORT_TIMEOUT_SECS = 4;
	private static final long SHORT_TIMEOUT_DELAY_MSECS =
	((SHORT_TIMEOUT_SECS + 3) * 1000);
	private static final int LONG_TIMEOUT_SECS = 10;
	private static final long LONG_TIMEOUT_DELAY_MSECS =
	((LONG_TIMEOUT_SECS + 2) * 1000);

	private static final String CLIENT_AUTH_HEADER = "authorization";
	private static final String OPAQUE = "opaque";
	private static final String NONCE = "nonce";
	private static final String REALM = "realm";
	private static final String CNONCE = "cnonce";

	private static String NC1 = "00000001";
	private static String NC2 = "00000002";
	private static String QOP = "auth";

	private static String SERVER_COOKIES = "Set-Cookie";
	private static String BROWSER_COOKIES = "Cookie";

	private List<String> cookies;

	/*
	* Try to access an unprotected resource without an
	* established SSO session.
	* This should be permitted.
	*/
	@Test
	public void testAcceptPublicNonLogin() throws Exception {
	doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PUBLIC,
	true, false, 200);
	}

	/*
	* Try to access a protected resource without an established
	* SSO session.
	* This should be rejected with SC_FORBIDDEN 403 status.
	*/
	@Test
	public void testRejectProtectedNonLogin() throws Exception {
	doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
	false, true, 403);
	}

	/*
	* Logon to access a protected resource using DIGEST authentication,
	* which will establish an SSO session.
	* Wait until the SSO session times-out, then try to re-access
	* the resource.
	* This should be rejected with SC_FORBIDDEN 401 status, which
	* will then be followed by successful re-authentication.
	*/
	@Test
	public void testDigestLoginSessionTimeout() throws Exception {
	doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
	true, 401, true, true, NC1, CNONCE, QOP, true);
	// wait long enough for my session to expire
	Thread.sleep(LONG_TIMEOUT_DELAY_MSECS);
	// must change the client nonce to succeed
	doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
	true, 401, true, true, NC2, CNONCE, QOP, true);
	}

	/*
	* Logon to access a protected resource using DIGEST authentication,
	* which will establish an SSO session.
	* Immediately try to access a protected resource in the NonLogin
	* webapp, but without sending the SSO session cookie.
	* This should be rejected with SC_FORBIDDEN 403 status.
	*/
	@Test
	public void testDigestLoginRejectProtectedWithoutCookies() throws Exception {
	doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
	true, 401, true, true, NC1, CNONCE, QOP, true);
	doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
	false, true, 403);
	}

	/*
	* Logon to access a protected resource using DIGEST authentication,
	* which will establish an SSO session.
	* Immediately try to access a protected resource in the NonLogin
	* webapp while sending the SSO session cookie provided by the
	* first webapp.
	* This should be successful with SC_OK 200 status.
	*/
	@Test
	public void testDigestLoginAcceptProtectedWithCookies() throws Exception {
	doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
	true, 401, true, true, NC1, CNONCE, QOP, true);
	doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
	true, false, 200);
	}

	/*
	* Logon to access a protected resource using DIGEST authentication,
	* which will establish an SSO session.
	* Immediately try to access a protected resource in the NonLogin
	* webapp while sending the SSO session cookie provided by the
	* first webapp.
	* This should be successful with SC_OK 200 status.
	*
	* Then, wait long enough for the DIGEST session to expire. (The SSO
	* session should remain active because the NonLogin session has
	* not yet expired).
	*
	* Try to access the protected resource again, before the SSO session
	* has expired.
	* This should be successful with SC_OK 200 status.
	*
	* Finally, wait for the non-login session to expire and try again..
	* This should be rejected with SC_FORBIDDEN 403 status.
	*
	* (see bugfix https://bz.apache.org/bugzilla/show_bug.cgi?id=52303)
	*/
	@Test
	public void testDigestExpiredAcceptProtectedWithCookies() throws Exception {
	doTestDigest(USER, PWD, CONTEXT_PATH_DIGEST + URI_PROTECTED,
	true, 401, true, true, NC1, CNONCE, QOP, true);
	doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
	true, false, 200);

	// wait long enough for the BASIC session to expire,
	// but not long enough for NonLogin session expiry
	Thread.sleep(SHORT_TIMEOUT_DELAY_MSECS);
	doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
	true, false, 200);

	// wait long enough for my NonLogin session to expire
	// and tear down the SSO session at the same time.
	Thread.sleep(LONG_TIMEOUT_DELAY_MSECS);
	doTestNonLogin(CONTEXT_PATH_NOLOGIN + URI_PROTECTED,
	false, true, 403);
	}


	public void doTestNonLogin(String uri, boolean addCookies,
	boolean expectedReject, int expectedRC)
	throws Exception {

	Map<String,List<String>> reqHeaders = new HashMap<>();
	Map<String,List<String>> respHeaders = new HashMap<>();

	ByteChunk bc = new ByteChunk();
	if (addCookies) {
	addCookies(reqHeaders);
	}
	int rc = getUrl(HTTP_PREFIX + getPort() + uri, bc, reqHeaders,
	respHeaders);

	if (expectedReject) {
	assertEquals(expectedRC, rc);
	assertTrue(bc.getLength() > 0);
	}
	else {
	assertEquals(200, rc);
	assertEquals("OK", bc.toString());
	saveCookies(respHeaders);
	}
	}

	public void doTestDigest(String user, String pwd, String uri,
	boolean expectedReject1, int expectedRC1,
	boolean useServerNonce, boolean useServerOpaque,
	String nc1, String cnonce,
	String qop, boolean req2expect200)
	throws Exception {

	String digestUri= uri;

	List<String> auth = new ArrayList<>();
	Map<String,List<String>> reqHeaders1 = new HashMap<>();
	Map<String,List<String>> respHeaders1 = new HashMap<>();

	// the first access attempt should be challenged
	auth.add(buildDigestResponse(user, pwd, digestUri, REALM, "null",
	"null", nc1, cnonce, qop));
	reqHeaders1.put(CLIENT_AUTH_HEADER, auth);

	ByteChunk bc = new ByteChunk();
	int rc = getUrl(HTTP_PREFIX + getPort() + uri, bc, reqHeaders1,
	respHeaders1);

	if (expectedReject1) {
	assertEquals(expectedRC1, rc);
	assertTrue(bc.getLength() > 0);
	}
	else {
	assertEquals(200, rc);
	assertEquals("OK", bc.toString());
	saveCookies(respHeaders1);
	return;
	}

	// Second request should succeed (if we use the server nonce)
	Map<String,List<String>> reqHeaders2 = new HashMap<>();
	Map<String,List<String>> respHeaders2 = new HashMap<>();

	auth.clear();
	if (useServerNonce) {
	if (useServerOpaque) {
	auth.add(buildDigestResponse(user, pwd, digestUri,
	getAuthToken(respHeaders1, REALM),
	getAuthToken(respHeaders1, NONCE),
	getAuthToken(respHeaders1, OPAQUE),
	nc1, cnonce, qop));
	} else {
	auth.add(buildDigestResponse(user, pwd, digestUri,
	getAuthToken(respHeaders1, REALM),
	getAuthToken(respHeaders1, NONCE),
	"null", nc1, cnonce, qop));
	}
	} else {
	auth.add(buildDigestResponse(user, pwd, digestUri,
	getAuthToken(respHeaders2, REALM),
	"null", getAuthToken(respHeaders1, OPAQUE),
	nc1, cnonce, QOP));
	}
	reqHeaders2.put(CLIENT_AUTH_HEADER, auth);

	bc.recycle();
	rc = getUrl(HTTP_PREFIX + getPort() + uri, bc, reqHeaders2,
	respHeaders2);

	if (req2expect200) {
	assertEquals(200, rc);
	assertEquals("OK", bc.toString());
	saveCookies(respHeaders2);
	} else {
	assertEquals(401, rc);
	assertTrue((bc.getLength() > 0));
	}
	}


	@Override
	public void setUp() throws Exception {
	super.setUp();

	// create a tomcat server using the default in-memory Realm
	Tomcat tomcat = getTomcatInstance();

	// associate the SingeSignOn Valve before the Contexts
	SingleSignOn sso = new SingleSignOn();
	tomcat.getHost().getPipeline().addValve(sso);

	// add the test user and role to the Realm
	tomcat.addUser(USER, PWD);
	tomcat.addRole(USER, ROLE);

	// setup both NonLogin, Login and digest webapps
	setUpNonLogin(tomcat);
	setUpDigest(tomcat);

	tomcat.start();
	}

	private void setUpNonLogin(Tomcat tomcat) throws Exception {

	// Must have a real docBase for webapps - just use temp
	Context ctxt = tomcat.addContext(CONTEXT_PATH_NOLOGIN,
	System.getProperty("java.io.tmpdir"));
	ctxt.setSessionTimeout(LONG_TIMEOUT_SECS);

	// Add protected servlet
	Tomcat.addServlet(ctxt, "TesterServlet1", new TesterServlet());
	ctxt.addServletMappingDecoded(URI_PROTECTED, "TesterServlet1");
	SecurityCollection collection1 = new SecurityCollection();
	collection1.addPatternDecoded(URI_PROTECTED);
	SecurityConstraint sc1 = new SecurityConstraint();
	sc1.addAuthRole(ROLE);
	sc1.addCollection(collection1);
	ctxt.addConstraint(sc1);

	// Add unprotected servlet
	Tomcat.addServlet(ctxt, "TesterServlet2", new TesterServlet());
	ctxt.addServletMappingDecoded(URI_PUBLIC, "TesterServlet2");
	SecurityCollection collection2 = new SecurityCollection();
	collection2.addPatternDecoded(URI_PUBLIC);
	SecurityConstraint sc2 = new SecurityConstraint();
	// do not add a role - which signals access permitted without one
	sc2.addCollection(collection2);
	ctxt.addConstraint(sc2);

	// Configure the appropriate authenticator
	LoginConfig lc = new LoginConfig();
	lc.setAuthMethod("NONE");
	ctxt.setLoginConfig(lc);
	ctxt.getPipeline().addValve(new NonLoginAuthenticator());
	}

	private void setUpDigest(Tomcat tomcat) throws Exception {

	// Must have a real docBase for webapps - just use temp
	Context ctxt = tomcat.addContext(CONTEXT_PATH_DIGEST,
	System.getProperty("java.io.tmpdir"));
	ctxt.setSessionTimeout(SHORT_TIMEOUT_SECS);

	// Add protected servlet
	Tomcat.addServlet(ctxt, "TesterServlet3", new TesterServlet());
	ctxt.addServletMappingDecoded(URI_PROTECTED, "TesterServlet3");
	SecurityCollection collection = new SecurityCollection();
	collection.addPatternDecoded(URI_PROTECTED);
	SecurityConstraint sc = new SecurityConstraint();
	sc.addAuthRole(ROLE);
	sc.addCollection(collection);
	ctxt.addConstraint(sc);

	// Configure the appropriate authenticator
	LoginConfig lc = new LoginConfig();
	lc.setAuthMethod("DIGEST");
	ctxt.setLoginConfig(lc);
	ctxt.getPipeline().addValve(new DigestAuthenticator());
	}

	protected static String getAuthToken(
	Map<String,List<String>> respHeaders, String token) {

	final String AUTH_PREFIX = "=\"";
	final String AUTH_SUFFIX = "\"";
	List<String> authHeaders =
	respHeaders.get(AuthenticatorBase.AUTH_HEADER_NAME);

	// Assume there is only one
	String authHeader = authHeaders.iterator().next();
	String searchFor = token + AUTH_PREFIX;
	int start = authHeader.indexOf(searchFor) + searchFor.length();
	int end = authHeader.indexOf(AUTH_SUFFIX, start);
	return authHeader.substring(start, end);
	}

	/*
	* Notes from RFC2617
	* H(data) = MD5(data)
	* KD(secret, data) = H(concat(secret, ":", data))
	* A1 = unq(username-value) ":" unq(realm-value) ":" passwd
	* A2 = Method ":" digest-uri-value
	* request-digest = <"> < KD ( H(A1), unq(nonce-value)
	":" nc-value
	":" unq(cnonce-value)
	":" unq(qop-value)
	":" H(A2)
	) <">
	*/
	private static String buildDigestResponse(String user, String pwd,
	String uri, String realm, String nonce, String opaque, String nc,
	String cnonce, String qop) {

	String a1 = user + ":" + realm + ":" + pwd;
	String a2 = "GET:" + uri;

	String md5a1 = digest(a1);
	String md5a2 = digest(a2);

	String response;
	if (qop == null) {
	response = md5a1 + ":" + nonce + ":" + md5a2;
	} else {
	response = md5a1 + ":" + nonce + ":" + nc + ":" + cnonce + ":" +
	qop + ":" + md5a2;
	}

	String md5response = digest(response);

	StringBuilder auth = new StringBuilder();
	auth.append("Digest username=\"");
	auth.append(user);
	auth.append("\", realm=\"");
	auth.append(realm);
	auth.append("\", nonce=\"");
	auth.append(nonce);
	auth.append("\", uri=\"");
	auth.append(uri);
	auth.append("\", opaque=\"");
	auth.append(opaque);
	auth.append("\", response=\"");
	auth.append(md5response);
	auth.append("\"");
	if (qop != null) {
	auth.append(", qop=");
	auth.append(qop);
	}
	if (nc != null) {
	auth.append(", nc=");
	auth.append(nc);
	}
	if (cnonce != null) {
	auth.append(", cnonce=\"");
	auth.append(cnonce);
	auth.append("\"");
	}

	return auth.toString();
	}

	private static String digest(String input) {
	return MD5Encoder.encode(
	ConcurrentMessageDigest.digestMD5(input.getBytes()));
	}

	/*
	* extract and save the server cookies from the incoming response
	*/
	protected void saveCookies(Map<String,List<String>> respHeaders) {

	// we only save the Cookie values, not header prefix
	cookies = respHeaders.get(SERVER_COOKIES);
	}

	/*
	* add all saved cookies to the outgoing request
	*/
	protected void addCookies(Map<String,List<String>> reqHeaders) {

	if ((cookies != null) && (cookies.size() > 0)) {
	reqHeaders.put(BROWSER_COOKIES, cookies);
	}
	}
	}