Skip to content

Commit 1f6d60d

Browse files
arun-guptaarun-gupta
committed
Merge pull request #171 from arjantijms/master
Added tests for the javax.servlet.http.registerSession feature
2 parents ea983c3 + 14ba58f commit 1f6d60d

File tree

9 files changed

+448
-0
lines changed

9 files changed

+448
-0
lines changed

‎jaspic/pom.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@
2828

2929
<!-- Tests that the main methods of JASPIC artifacts like the SAM are called by the container at the right moment -->
3030
<module>lifecycle</module>
31+
32+
<!-- JASPIC is normally stateless but with a new option introduced in JASPIC 1.1 it can semi-transparently
33+
remember an authenticated identity (semi, because the SAM will still be called and has to explicitly
34+
indidate it wants to continue this remembered session). This tests that remembering a session indeed works.
35+
-->
36+
<module>register-session</module>
3137

3238
<!-- Like Servlet filters, a JASPIC SAM for the Servlet Profile can wrap the request and response. This tests that
3339
this indeed happens. -->

‎jaspic/register-session/pom.xml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
6+
<parent>
7+
<groupId>org.javaee7.jaspic</groupId>
8+
<artifactId>jaspic-samples</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
<relativePath>../pom.xml</relativePath>
11+
</parent>
12+
13+
<groupId>org.javaee7.jaspic</groupId>
14+
<artifactId>register-session</artifactId>
15+
<version>1.0-SNAPSHOT</version>
16+
<packaging>war</packaging>
17+
18+
<dependencies>
19+
<dependency>
20+
<groupId>org.javaee7.jaspic</groupId>
21+
<artifactId>common</artifactId>
22+
<version>1.0-SNAPSHOT</version>
23+
</dependency>
24+
25+
</dependencies>
26+
27+
</project>

‎jaspic/register-session/src/main/java/org/javaee7/jaspic/registersession/sam/SamAutoRegistrationListener.java‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package org.javaee7.jaspic.registersession.sam;
2+
3+
import javax.servlet.ServletContextEvent;
4+
import javax.servlet.annotation.WebListener;
5+
6+
import org.javaee7.jaspic.common.BaseServletContextListener;
7+
import org.javaee7.jaspic.common.JaspicUtils;
8+
9+
/**
10+
*
11+
* @author Arjan Tijms
12+
*
13+
*/
14+
@WebListener
15+
public class SamAutoRegistrationListener extends BaseServletContextListener {
16+
17+
@Override
18+
public void contextInitialized(ServletContextEvent sce) {
19+
JaspicUtils.registerSAM(sce.getServletContext(), new TestServerAuthModule());
20+
}
21+
22+
}

‎jaspic/register-session/src/main/java/org/javaee7/jaspic/registersession/sam/TestServerAuthModule.java‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
package org.javaee7.jaspic.registersession.sam;
2+
3+
import static java.lang.Boolean.TRUE;
4+
import static javax.security.auth.message.AuthStatus.SUCCESS;
5+
6+
import java.io.IOException;
7+
import java.security.Principal;
8+
import java.util.Map;
9+
import java.util.logging.Logger;
10+
11+
import javax.security.auth.Subject;
12+
import javax.security.auth.callback.Callback;
13+
import javax.security.auth.callback.CallbackHandler;
14+
import javax.security.auth.callback.UnsupportedCallbackException;
15+
import javax.security.auth.message.AuthException;
16+
import javax.security.auth.message.AuthStatus;
17+
import javax.security.auth.message.MessageInfo;
18+
import javax.security.auth.message.MessagePolicy;
19+
import javax.security.auth.message.callback.CallerPrincipalCallback;
20+
import javax.security.auth.message.callback.GroupPrincipalCallback;
21+
import javax.security.auth.message.module.ServerAuthModule;
22+
import javax.servlet.http.HttpServletRequest;
23+
import javax.servlet.http.HttpServletResponse;
24+
25+
/**
26+
*
27+
* @author Arjan Tijms
28+
*
29+
*/
30+
public class TestServerAuthModule implements ServerAuthModule {
31+
32+
Logger logger = Logger.getLogger("blalllalala");
33+
34+
private CallbackHandler handler;
35+
private Class<?>[] supportedMessageTypes = new Class[] { HttpServletRequest.class, HttpServletResponse.class };
36+
37+
@Override
38+
public void initialize(MessagePolicy requestPolicy, MessagePolicy responsePolicy, CallbackHandler handler,
39+
@SuppressWarnings("rawtypes") Map options) throws AuthException {
40+
this.handler = handler;
41+
}
42+
43+
@SuppressWarnings("unchecked")
44+
@Override
45+
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
46+
throws AuthException {
47+
48+
HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
49+
Callback[] callbacks;
50+
51+
Principal userPrincipal = request.getUserPrincipal();
52+
if (userPrincipal != null && request.getParameter("continueSession") != null) {
53+
54+
// ### If already authenticated before, continue this session
55+
56+
// Execute protocol to signal container registered authentication session be used.
57+
callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, userPrincipal) };
58+
59+
} else if (request.getParameter("doLogin") != null) {
60+
61+
// ### If not authenticated before, do a new login if so requested
62+
63+
// For the test perform a login by directly "returning" the details of the authenticated user.
64+
// Normally credentials would be checked and the details fetched from some repository
65+
66+
callbacks = new Callback[] {
67+
// The name of the authenticated user
68+
new CallerPrincipalCallback(clientSubject, "test"),
69+
// the roles of the authenticated user
70+
new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) };
71+
72+
// Tell container to register an authentication session.
73+
messageInfo.getMap().put("javax.servlet.http.registerSession", TRUE.toString());
74+
} else {
75+
76+
// ### If no registered session and no login request "do nothing"
77+
78+
// The JASPIC protocol for "do nothing"
79+
callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, (Principal) null) };
80+
}
81+
82+
try {
83+
84+
// Communicate the details of the authenticated user to the container. In many
85+
// cases the handler will just store the details and the container will actually handle
86+
// the login after we return from this method.
87+
handler.handle(callbacks);
88+
89+
} catch (IOException | UnsupportedCallbackException e) {
90+
throw (AuthException) new AuthException().initCause(e);
91+
}
92+
93+
return SUCCESS;
94+
}
95+
96+
@Override
97+
public Class<?>[] getSupportedMessageTypes() {
98+
return supportedMessageTypes;
99+
}
100+
101+
@Override
102+
public AuthStatus secureResponse(MessageInfo messageInfo, Subject serviceSubject) throws AuthException {
103+
return AuthStatus.SEND_SUCCESS;
104+
}
105+
106+
@Override
107+
public void cleanSubject(MessageInfo messageInfo, Subject subject) throws AuthException {
108+
109+
}
110+
}

‎jaspic/register-session/src/main/java/org/javaee7/jaspic/registersession/servlet/ProtectedServlet.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package org.javaee7.jaspic.registersession.servlet;
2+
3+
import java.io.IOException;
4+
5+
import javax.servlet.ServletException;
6+
import javax.servlet.annotation.WebServlet;
7+
import javax.servlet.http.HttpServlet;
8+
import javax.servlet.http.HttpServletRequest;
9+
import javax.servlet.http.HttpServletResponse;
10+
11+
/**
12+
*
13+
* @author Arjan Tijms
14+
*
15+
*/
16+
@WebServlet(urlPatterns = "/protected/servlet")
17+
public class ProtectedServlet extends HttpServlet {
18+
19+
private static final long serialVersionUID = 1L;
20+
21+
@Override
22+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
23+
24+
response.getWriter().write("This is a protected servlet \n");
25+
26+
String webName = null;
27+
if (request.getUserPrincipal() != null) {
28+
webName = request.getUserPrincipal().getName();
29+
}
30+
31+
response.getWriter().write("web username: " + webName + "\n");
32+
33+
boolean webHasRole = request.isUserInRole("architect");
34+
35+
response.getWriter().write("web user has role \"architect\": " + webHasRole + "\n");
36+
37+
}
38+
39+
}

‎jaspic/register-session/src/main/java/org/javaee7/jaspic/registersession/servlet/PublicServlet.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package org.javaee7.jaspic.registersession.servlet;
2+
3+
import java.io.IOException;
4+
5+
import javax.servlet.ServletException;
6+
import javax.servlet.annotation.WebServlet;
7+
import javax.servlet.http.HttpServlet;
8+
import javax.servlet.http.HttpServletRequest;
9+
import javax.servlet.http.HttpServletResponse;
10+
11+
/**
12+
*
13+
* @author Arjan Tijms
14+
*
15+
*/
16+
@WebServlet(urlPatterns = "/public/servlet")
17+
public class PublicServlet extends HttpServlet {
18+
19+
private static final long serialVersionUID = 1L;
20+
21+
@Override
22+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
23+
24+
response.getWriter().write("This is a public servlet \n");
25+
26+
String webName = null;
27+
if (request.getUserPrincipal() != null) {
28+
webName = request.getUserPrincipal().getName();
29+
}
30+
31+
response.getWriter().write("web username: " + webName + "\n");
32+
33+
boolean webHasRole = request.isUserInRole("architect");
34+
35+
response.getWriter().write("web user has role \"architect\": " + webHasRole + "\n");
36+
37+
}
38+
39+
}

‎jaspic/register-session/src/main/webapp/WEB-INF/glassfish-web.xml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
3+
<glassfish-web-app>
4+
5+
<security-role-mapping>
6+
<role-name>architect</role-name>
7+
<group-name>architect</group-name>
8+
</security-role-mapping>
9+
10+
<parameter-encoding default-charset="UTF-8" />
11+
12+
</glassfish-web-app>

‎jaspic/register-session/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
4+
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
5+
version="3.0">
6+
7+
<security-constraint>
8+
<web-resource-collection>
9+
<web-resource-name>Test</web-resource-name>
10+
<url-pattern>/protected/*</url-pattern>
11+
</web-resource-collection>
12+
<auth-constraint>
13+
<role-name>architect</role-name>
14+
</auth-constraint>
15+
</security-constraint>
16+
17+
<security-role>
18+
<role-name>architect</role-name>
19+
</security-role>
20+
21+
</web-app>

0 commit comments

Comments
 (0)