CommonLoginPolicy implements LoginPolicy { @Override public Result isAllowed(String principalId) { int failureCount = 0; if (enabled) { LockoutPolicy lockoutPolicy = lockoutPolicyRetriever.getLockoutPolicy(); long eventsAfter = timeService.getCurrentTimeMillis() - lockoutPolicy.getCountFailuresWithin() * 1000; List<AuditEvent> events = auditService.find(principalId, eventsAfter, IdentityZoneHolder.get().getId()); failureCount = sequentialFailureCount(events); if (failureCount >= lockoutPolicy.getLockoutAfterFailures()) { AuditEvent lastFailure = mostRecentFailure(events); if (lastFailure != null && lastFailure.getTime() > timeService.getCurrentTimeMillis() - lockoutPolicy.getLockoutPeriodSeconds() * 1000) { return new Result(false, failureCount); } } } return new Result(true, failureCount); } CommonLoginPolicy(UaaAuditService auditService,
                             LockoutPolicyRetriever lockoutPolicyRetriever,
                             AuditEventType successEventType,
                             AuditEventType failureEventType,
                             TimeService timeService,
                             boolean enabled); @Override Result isAllowed(String principalId); LockoutPolicyRetriever getLockoutPolicyRetriever();  }
@Test public void test_is_disabled() { commonLoginPolicy = spy(new CommonLoginPolicy(auditService, lockoutPolicyRetriever, successEventType, failureEventType, timeService, false)); LoginPolicy.Result result = commonLoginPolicy.isAllowed("principal"); assertTrue(result.isAllowed()); assertEquals(0, result.getFailureCount()); verifyZeroInteractions(lockoutPolicyRetriever); verifyZeroInteractions(timeService); verifyZeroInteractions(auditService); }
@Test public void isAllowed_whenLockoutAfterFailuresIsNegative_returnsTrue() { when(lockoutPolicyRetriever.getLockoutPolicy()).thenReturn(new LockoutPolicy(-1, -1, 300)); LoginPolicy.Result result = commonLoginPolicy.isAllowed("principal"); assertTrue(result.isAllowed()); assertEquals(0, result.getFailureCount()); }
@Test public void isAllowed_whenLockoutAfterFailuresIsPositive_returnsFalseIfTooManyUnsuccessfulRecentAttempts() { when(lockoutPolicyRetriever.getLockoutPolicy()).thenReturn(new LockoutPolicy(2, 1, 300)); AuditEvent auditEvent = new AuditEvent(failureEventType, null, null, null, 1L, null, null, null); List<AuditEvent> list = Collections.singletonList(auditEvent); String zoneId = IdentityZoneHolder.get().getId(); when(auditService.find(eq("principal"), anyLong(), eq(zoneId))).thenReturn(list); LoginPolicy.Result result = commonLoginPolicy.isAllowed("principal"); assertFalse(result.isAllowed()); assertEquals(1, result.getFailureCount()); }
@Test public void isAllowed_whenLockoutAfterFailuresIsPositive_returnsTrueIfNotTooManyUnsuccessfulRecentAttempts() { when(lockoutPolicyRetriever.getLockoutPolicy()).thenReturn(new LockoutPolicy(2, 2, 300)); AuditEvent auditEvent = new AuditEvent(failureEventType, null, null, null, 1L, null, null, null); List<AuditEvent> list = Collections.singletonList(auditEvent); String zoneId = IdentityZoneHolder.get().getId(); when(auditService.find(eq("principal"), anyLong(), eq(zoneId))).thenReturn(list); LoginPolicy.Result result = commonLoginPolicy.isAllowed("principal"); assertTrue(result.isAllowed()); assertEquals(1, result.getFailureCount()); }