1   /*
2    * Copyright 2005-2012 the original author or authors.
3    *
4    * Licensed under the Apache License, Version 2.0 (the "License");
5    * you may not use this file except in compliance with the License.
6    * You may obtain a copy of the License at
7    *
8    *     http://www.apache.org/licenses/LICENSE-2.0
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   */
16  
17  package org.springframework.ws.soap.security.wss4j;
18  
19  import java.util.Properties;
20  
21  import org.springframework.security.authentication.AuthenticationManager;
22  import org.springframework.security.core.context.SecurityContextHolder;
23  import org.springframework.security.provisioning.InMemoryUserDetailsManager;
24  import org.springframework.ws.context.DefaultMessageContext;
25  import org.springframework.ws.context.MessageContext;
26  import org.springframework.ws.server.EndpointInterceptor;
27  import org.springframework.ws.soap.SoapMessage;
28  import org.springframework.ws.soap.security.wss4j.callback.SpringSecurityPasswordValidationCallbackHandler;
29  
30  import org.apache.ws.security.WSConstants;
31  import org.junit.After;
32  import org.junit.Test;
33  
34  import static org.easymock.EasyMock.*;
35  import static org.junit.Assert.assertNotNull;
36  import static org.junit.Assert.assertNull;
37  
38  public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase extends Wss4jTestCase {
39  
40      private Properties users = new Properties();
41  
42      private AuthenticationManager authenticationManager;
43  
44      @Override
45      protected void onSetup() throws Exception {
46          authenticationManager = createMock(AuthenticationManager.class);
47          users.setProperty("Bert", "Ernie,ROLE_TEST");
48      }
49  
50      @After
51      public void tearDown() throws Exception {
52          verify(authenticationManager);
53          SecurityContextHolder.clearContext();
54      }
55  
56      @Test
57      public void testValidateUsernameTokenPlainText() throws Exception {
58          EndpointInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
59          SoapMessage message = loadSoap11Message("usernameTokenPlainText-soap.xml");
60          MessageContext messageContext = new DefaultMessageContext(message, getSoap11MessageFactory());
61          interceptor.handleRequest(messageContext, null);
62          assertValidateUsernameToken(message);
63  
64          // test clean up
65          messageContext.getResponse();
66          interceptor.handleResponse(messageContext, null);
67          interceptor.afterCompletion(messageContext, null, null);
68          assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
69      }
70  
71      @Test
72      public void testValidateUsernameTokenDigest() throws Exception {
73          EndpointInterceptor interceptor = prepareInterceptor("UsernameToken", true, true);
74          SoapMessage message = loadSoap11Message("usernameTokenDigest-soap.xml");
75          MessageContext messageContext = new DefaultMessageContext(message, getSoap11MessageFactory());
76          interceptor.handleRequest(messageContext, null);
77          assertValidateUsernameToken(message);
78  
79          // test clean up
80          messageContext.getResponse();
81          interceptor.handleResponse(messageContext, null);
82          interceptor.afterCompletion(messageContext, null, null);
83          assertNull("Authentication created", SecurityContextHolder.getContext().getAuthentication());
84      }
85  
86      protected void assertValidateUsernameToken(SoapMessage message) throws Exception {
87          Object result = getMessage(message);
88          assertNotNull("No result returned", result);
89          assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security",
90                  getDocument(message));
91          assertNotNull("No Authentication created", SecurityContextHolder.getContext().getAuthentication());
92      }
93  
94      protected EndpointInterceptor prepareInterceptor(String actions, boolean validating, boolean digest)
95              throws Exception {
96          Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
97          if (validating) {
98              interceptor.setValidationActions(actions);
99          }
100         else {
101             interceptor.setSecurementActions(actions);
102         }
103         SpringSecurityPasswordValidationCallbackHandler callbackHandler =
104                 new SpringSecurityPasswordValidationCallbackHandler();
105         InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager(users);
106         callbackHandler.setUserDetailsService(userDetailsManager);
107         if (digest) {
108             interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
109         }
110         else {
111             interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
112         }
113         interceptor.setValidationCallbackHandler(callbackHandler);
114         interceptor.afterPropertiesSet();
115         replay(authenticationManager);
116         return interceptor;
117     }
118 }