1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17 package org.springframework.ws.soap.security.wss4j;
18
19 import java.util.Properties;
20
21 import org.springframework.security.authentication.AuthenticationManager;
22 import org.springframework.security.core.context.SecurityContextHolder;
23 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
24 import org.springframework.ws.context.DefaultMessageContext;
25 import org.springframework.ws.context.MessageContext;
26 import org.springframework.ws.server.EndpointInterceptor;
27 import org.springframework.ws.soap.SoapMessage;
28 import org.springframework.ws.soap.security.wss4j.callback.SpringSecurityPasswordValidationCallbackHandler;
29
30 import org.apache.ws.security.WSConstants;
31 import org.junit.After;
32 import org.junit.Test;
33
34 import static org.easymock.EasyMock.*;
35 import static org.junit.Assert.assertNotNull;
36 import static org.junit.Assert.assertNull;
37
38 public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase extends Wss4jTestCase {
39
40 private Properties users = new Properties();
41
42 private AuthenticationManager authenticationManager;
43
44 @Override
45 protected void onSetup() throws Exception {
46 authenticationManager = createMock(AuthenticationManager.class);
47 users.setProperty("Bert", "Ernie,ROLE_TEST");
48 }
49
50 @After
51 public void tearDown() throws Exception {
52 verify(authenticationManager);
53 SecurityContextHolder.clearContext();
54 }
55
56 @Test
57 public void testValidateUsernameTokenPlainText() throws Exception {
58 EndpointInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
59 SoapMessage message = loadSoap11Message("usernameTokenPlainText-soap.xml");
60 MessageContext messageContext = new DefaultMessageContext(message, getSoap11MessageFactory());
61 interceptor.handleRequest(messageContext, null);
62 assertValidateUsernameToken(message);
63
64
65 messageContext.getResponse();
66 interceptor.handleResponse(messageContext, null);
67 interceptor.afterCompletion(messageContext, null, null);
68 assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
69 }
70
71 @Test
72 public void testValidateUsernameTokenDigest() throws Exception {
73 EndpointInterceptor interceptor = prepareInterceptor("UsernameToken", true, true);
74 SoapMessage message = loadSoap11Message("usernameTokenDigest-soap.xml");
75 MessageContext messageContext = new DefaultMessageContext(message, getSoap11MessageFactory());
76 interceptor.handleRequest(messageContext, null);
77 assertValidateUsernameToken(message);
78
79
80 messageContext.getResponse();
81 interceptor.handleResponse(messageContext, null);
82 interceptor.afterCompletion(messageContext, null, null);
83 assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
84 }
85
86 protected void assertValidateUsernameToken(SoapMessage message) throws Exception {
87 Object result = getMessage(message);
88 assertNotNull("No result returned", result);
89 assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
90 getDocument(message));
91 assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication());
92 }
93
94 protected EndpointInterceptor prepareInterceptor(String actions, boolean validating, boolean digest)
95 throws Exception {
96 Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
97 if (validating) {
98 interceptor.setValidationActions(actions);
99 }
100 else {
101 interceptor.setSecurementActions(actions);
102 }
103 SpringSecurityPasswordValidationCallbackHandler callbackHandler =
104 new SpringSecurityPasswordValidationCallbackHandler();
105 InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager(users);
106 callbackHandler.setUserDetailsService(userDetailsManager);
107 if (digest) {
108 interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
109 }
110 else {
111 interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
112 }
113 interceptor.setValidationCallbackHandler(callbackHandler);
114 interceptor.afterPropertiesSet();
115 replay(authenticationManager);
116 return interceptor;
117 }
118 }