Skip to content

Commit 48fed43

Browse files
arun-guptaarun-gupta
committed
Adding a new sample/test for JAX-RS basic authentication security
1 parent a1605b5 commit 48fed43

File tree

6 files changed

+269
-0
lines changed

6 files changed

+269
-0
lines changed

‎jaxrs/jaxrs-security-declarative/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<parent>
5+
<groupId>org.javaee7.jaxrs</groupId>
6+
<artifactId>jaxrs-samples</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
<relativePath>../pom.xml</relativePath>
9+
</parent>
10+
11+
<artifactId>jaxrs-security-declarative</artifactId>
12+
<packaging>war</packaging>
13+
</project>

‎jaxrs/jaxrs-security-declarative/src/main/java/org/javaee7/jaxrs/security/declarative/MyApplication.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
12+
* or packager/legal/LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at packager/legal/LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
package org.javaee7.jaxrs.security.declarative;
41+
42+
import java.util.Set;
43+
import javax.ws.rs.ApplicationPath;
44+
import javax.ws.rs.core.Application;
45+
46+
/**
47+
* @author Arun Gupta
48+
*/
49+
@ApplicationPath("webresources")
50+
public class MyApplication extends Application {
51+
52+
@Override
53+
public Set<Class<?>> getClasses() {
54+
Set<Class<?>> resources = new java.util.HashSet<>();
55+
resources.add(MyResource.class);
56+
return resources;
57+
}
58+
59+
}

‎jaxrs/jaxrs-security-declarative/src/main/java/org/javaee7/jaxrs/security/declarative/MyResource.java‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
package org.javaee7.jaxrs.security.declarative;
2+
3+
import javax.ejb.EJB;
4+
import javax.enterprise.context.RequestScoped;
5+
import javax.ws.rs.Consumes;
6+
import javax.ws.rs.DELETE;
7+
import javax.ws.rs.FormParam;
8+
import javax.ws.rs.GET;
9+
import javax.ws.rs.POST;
10+
import javax.ws.rs.PUT;
11+
import javax.ws.rs.Path;
12+
import javax.ws.rs.PathParam;
13+
import javax.ws.rs.Produces;
14+
import javax.ws.rs.core.MediaType;
15+
16+
/**
17+
* @author Arun Gupta
18+
*/
19+
@Path("myresource")
20+
@RequestScoped
21+
public class MyResource {
22+
@GET
23+
public String get() {
24+
return "get";
25+
}
26+
27+
@GET
28+
@Path("{id}")
29+
public String getPerson(@PathParam("id")int id) {
30+
return "get" + id;
31+
}
32+
33+
@POST
34+
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
35+
public String addToList(@FormParam("name") String name) {
36+
return "post " + name;
37+
}
38+
39+
@PUT
40+
public void putToList() {
41+
System.out.println("put invoked");
42+
}
43+
44+
@DELETE
45+
public void delete() {
46+
System.out.println("delete invoked");
47+
}
48+
}

‎jaxrs/jaxrs-security-declarative/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
6+
version="3.1">
7+
<deny-uncovered-http-methods/>
8+
<security-constraint>
9+
<web-resource-collection>
10+
<web-resource-name>SecureResource</web-resource-name>
11+
<url-pattern>/webresources/*</url-pattern>
12+
<http-method>GET</http-method>
13+
</web-resource-collection>
14+
<auth-constraint>
15+
<role-name>g1</role-name>
16+
</auth-constraint>
17+
</security-constraint>
18+
19+
<login-config>
20+
<auth-method>BASIC</auth-method>
21+
<realm-name>file</realm-name>
22+
</login-config>
23+
24+
<security-role>
25+
<role-name>g1</role-name>
26+
</security-role>
27+
</web-app>

‎jaxrs/jaxrs-security-declarative/src/test/java/org/javaee7/jaxrs/security/declarative/MyResourceTest.java‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
package org.javaee7.jaxrs.security.declarative;
2+
3+
import com.meterware.httpunit.AuthorizationRequiredException;
4+
import com.meterware.httpunit.GetMethodWebRequest;
5+
import com.meterware.httpunit.HttpException;
6+
import com.meterware.httpunit.PostMethodWebRequest;
7+
import com.meterware.httpunit.PutMethodWebRequest;
8+
import com.meterware.httpunit.WebConversation;
9+
import com.meterware.httpunit.WebResponse;
10+
import java.io.ByteArrayInputStream;
11+
import java.io.File;
12+
import java.io.IOException;
13+
import java.net.URL;
14+
import static org.junit.Assert.assertEquals;
15+
16+
import org.jboss.arquillian.container.test.api.Deployment;
17+
import org.jboss.arquillian.junit.Arquillian;
18+
import org.jboss.arquillian.test.api.ArquillianResource;
19+
import org.jboss.shrinkwrap.api.ShrinkWrap;
20+
import org.jboss.shrinkwrap.api.spec.WebArchive;
21+
import static org.junit.Assert.assertNotNull;
22+
import static org.junit.Assert.assertTrue;
23+
import static org.junit.Assert.fail;
24+
import org.junit.Test;
25+
import org.junit.runner.RunWith;
26+
import org.xml.sax.SAXException;
27+
28+
/**
29+
* @author Arun Gupta
30+
*/
31+
@RunWith(Arquillian.class)
32+
public class MyResourceTest {
33+
34+
@ArquillianResource
35+
private URL base;
36+
37+
private static final String WEBAPP_SRC = "src/main/webapp";
38+
39+
@Deployment(testable = false)
40+
public static WebArchive createDeployment() {
41+
return ShrinkWrap.create(WebArchive.class)
42+
.addAsWebInfResource((new File(WEBAPP_SRC + "/WEB-INF", "web.xml")))
43+
.addClasses(MyApplication.class, MyResource.class);
44+
}
45+
46+
@Test
47+
public void testGetWithCorrectCredentials() throws IOException, SAXException {
48+
WebConversation conv = new WebConversation();
49+
conv.setAuthentication("file", "u1", "p1");
50+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/webresources/myresource");
51+
WebResponse response = null;
52+
try {
53+
response = conv.getResponse(getRequest);
54+
} catch (AuthorizationRequiredException e) {
55+
fail(e.getMessage());
56+
}
57+
assertNotNull(response);
58+
assertTrue(response.getText().contains("get"));
59+
}
60+
61+
@Test
62+
public void testGetSubResourceWithCorrectCredentials() throws IOException, SAXException {
63+
WebConversation conv = new WebConversation();
64+
conv.setAuthentication("file", "u1", "p1");
65+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/webresources/myresource/1");
66+
WebResponse response = null;
67+
try {
68+
response = conv.getResponse(getRequest);
69+
} catch (AuthorizationRequiredException e) {
70+
fail(e.getMessage());
71+
}
72+
assertNotNull(response);
73+
assertTrue(response.getText().contains("get1"));
74+
}
75+
76+
@Test
77+
public void testGetWithIncorrectCredentials() throws IOException, SAXException {
78+
WebConversation conv = new WebConversation();
79+
conv.setAuthentication("file", "random", "random");
80+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/webresources/myresource");
81+
try {
82+
WebResponse response = conv.getResponse(getRequest);
83+
} catch (AuthorizationRequiredException e) {
84+
assertNotNull(e);
85+
return;
86+
}
87+
fail("GET can be called with incorrect credentials");
88+
}
89+
90+
@Test
91+
public void testPost() throws IOException, SAXException {
92+
WebConversation conv = new WebConversation();
93+
conv.setAuthentication("file", "u1", "p1");
94+
PostMethodWebRequest postRequest = new PostMethodWebRequest(base + "/webresources/myresource");
95+
try {
96+
WebResponse response = conv.getResponse(postRequest);
97+
} catch (HttpException e) {
98+
assertNotNull(e);
99+
assertEquals(403, e.getResponseCode());
100+
return;
101+
}
102+
fail("POST is not authorized and can still be called");
103+
}
104+
105+
@Test
106+
public void testPut() throws IOException, SAXException {
107+
WebConversation conv = new WebConversation();
108+
conv.setAuthentication("file", "u1", "p1");
109+
byte[] bytes = new byte[8];
110+
ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
111+
PutMethodWebRequest putRequest = new PutMethodWebRequest(base + "/webresources/myresource", bais, "text/plain");
112+
try {
113+
WebResponse response = conv.getResponse(putRequest);
114+
} catch (HttpException e) {
115+
assertNotNull(e);
116+
assertEquals(403, e.getResponseCode());
117+
return;
118+
}
119+
fail("PUT is not authorized and can still be called");
120+
}
121+
}

‎jaxrs/pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,5 +40,6 @@
4040
<!--<module>server-sent-event</module>-->
4141
<module>singleton</module>
4242
<module>readerwriter-injection</module>
43+
<module>jaxrs-security-declarative</module>
4344
</modules>
4445
</project>

0 commit comments

Comments
 (0)