AwsSecurityContextFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { requestContext.setSecurityContext(createSecurityContext()); } AwsSecurityContextFilter();  AwsSecurityContextFilter(Collection<String> allowedAuthenticationSchemes); @Override void filter(ContainerRequestContext requestContext);  }
@Test public void filter_ValidIamGivenAndAllowed_ShouldSetScWithIamPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareIamRequest(true) .build(); SecurityContext sc = filter(request); assertIamPrincipal(sc.getUserPrincipal()); }
@Test public void filter_InvalidIamGivenAndAllowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareIamRequest(false) .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }
@Test public void filter_ValidIamGivenAndDisallowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareIamRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_IAM); SecurityContext sc = filter(request, allowedAuthSchemes); assertNull(sc.getUserPrincipal()); }
@Test public void filter_ValidCogIdentityGivenAndAllowed_ShouldSetScWithCogIdentityPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoIdentityRequest(true) .build(); SecurityContext sc = filter(request); assertCognitoIdentityPrincipal(sc.getUserPrincipal()); }
@Test public void filter_InvalidCogIdentityGivenAndAllowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoIdentityRequest(false) .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }
@Test public void filter_ValidCogIdentityGivenAndDisallowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoIdentityRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_COGNITO_IDENTITY); SecurityContext sc = filter(request, allowedAuthSchemes); assertNull(sc.getUserPrincipal()); }
@Test public void filter_ValidCustomAuthGivenAndAllowed_ShouldSetScWithCustomAuthPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCustomAuthorizerRequest(true) .build(); SecurityContext sc = filter(request); assertCustomAuthorizerPrincipal(sc.getUserPrincipal()); }
@Test public void filter_InvalidCustomAuthGivenAndAllowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCustomAuthorizerRequest(false) .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }
@Test public void filter_ValidCustomAuthGivenAndDisallowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCustomAuthorizerRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_CUSTOM_AUTHORIZER); SecurityContext sc = filter(request, allowedAuthSchemes); assertNull(sc.getUserPrincipal()); }
@Test public void filter_ValidCogUserPoolGivenAndAllowed_ShouldSetScWithCogUserPoolPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoUserPoolRequest(true) .build(); SecurityContext sc = filter(request); assertCognitoUserPoolPrincipal(sc.getUserPrincipal()); }
@Test public void filter_InvalidCogUserPoolGivenAndAllowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoUserPoolRequest(false) .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }
@Test public void filter_ValidCogUserPoolGivenAndDisallowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoUserPoolRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_COGNITO_USER_POOL); SecurityContext sc = filter(request, allowedAuthSchemes); assertNull(sc.getUserPrincipal()); }
@Test public void filter_AllAuthsPossibleAndAllAllowed_ShouldSetScWithCogIdentityPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoIdentityRequest(true) .prepareCustomAuthorizerRequest(true) .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); SecurityContext sc = filter(request); assertCognitoIdentityPrincipal(sc.getUserPrincipal()); }
@Test public void filter_AllAuthsPossibleButCogIdentityInvalidAndAllAllowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoIdentityRequest(false) .prepareCustomAuthorizerRequest(true) .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }
@Test public void filter_AllAuthsPossibleAndAllAllowedButCognitoIdentity_ShouldSetScWithCustomAuthPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoIdentityRequest(true) .prepareCustomAuthorizerRequest(true) .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_COGNITO_IDENTITY); SecurityContext sc = filter(request, allowedAuthSchemes); assertCustomAuthorizerPrincipal(sc.getUserPrincipal()); }
@Test public void filter_AllAuthsButCogIdentityPossibleAndAllAllowed_ShouldSetScWithCustomAuthPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCustomAuthorizerRequest(true) .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); SecurityContext sc = filter(request); assertCustomAuthorizerPrincipal(sc.getUserPrincipal()); }
@Test public void filter_AllAuthsButCogIdentityPossibleAndCustomAuthInvalidAndAllAllowed_ShouldSetScNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCustomAuthorizerRequest(false) .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }
@Test public void filter_AllAuthsButCogIdentityPossibleAndAllAllowedButCustomAuth_ShouldSetScWithCogUserPoolPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCustomAuthorizerRequest(true) .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_CUSTOM_AUTHORIZER); SecurityContext sc = filter(request, allowedAuthSchemes); assertCognitoUserPoolPrincipal(sc.getUserPrincipal()); }
@Test public void filter_CogUserPoolAndIamPossibleAndAllAllowed_ShouldSetScWithCogUserPoolPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); SecurityContext sc = filter(request); assertCognitoUserPoolPrincipal(sc.getUserPrincipal()); }
@Test public void filter_CogUserPoolAndIamPossibleAndCogUserPoolInvalidAndAllAllowed_ShouldSetScWithNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoUserPoolRequest(false) .prepareIamRequest(true) .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }
@Test public void filter_CogUserPoolAndIamPossibleAndAllAllowedButCogUserPool_ShouldSetScWithIamPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoUserPoolRequest(true) .prepareIamRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_COGNITO_USER_POOL); SecurityContext sc = filter(request, allowedAuthSchemes); assertIamPrincipal(sc.getUserPrincipal()); }
@Test public void filter_CogUserPoolAndIamPossibleAndCogUserPoolInvalidAndAllAllowedButCogUserPool_ShouldSetScWithIamPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .prepareCognitoUserPoolRequest(false) .prepareIamRequest(true) .build(); List<String> allowedAuthSchemes = new ArrayList<>(AwsAuthenticationSchemes.ALL_AWS_AUTHENTICATION_SCHEMES); allowedAuthSchemes.remove(AwsAuthenticationSchemes.AWS_COGNITO_USER_POOL); SecurityContext sc = filter(request, allowedAuthSchemes); assertIamPrincipal(sc.getUserPrincipal()); }
@Test public void filter_NonePossibleAndAllAllowed_ShouldSetScNoPrincipal() { GatewayRequest request = new GatewayRequestBuilder() .build(); SecurityContext sc = filter(request); assertNull(sc.getUserPrincipal()); }