ClientCertAuthenticator extends Authenticator { @Override public Result authenticate(HttpExchange httpExchange) { if( !(httpExchange instanceof HttpsExchange) ) { return new Failure(500); } try { HttpsExchange httpsExchange = (HttpsExchange) httpExchange; X509Certificate certificate = getClientCert(httpsExchange); if (certificate == null) { return new Failure(401); } checkCertForClientUsage(certificate); checkCertForAllowedPrincipals(httpsExchange); String name=""; try { name = httpsExchange.getSSLSession().getPeerPrincipal().getName(); } catch (SSLPeerUnverifiedException ignore) { } return new Success(new HttpPrincipal(name, "ssl")); } catch (SecurityException e) { return new Failure(403); } } ClientCertAuthenticator(JolokiaServerConfig pConfig); @Override Result authenticate(HttpExchange httpExchange);  }
@Test public void positive() throws Exception { ClientCertAuthenticator auth = new ClientCertAuthenticator(getConfig("clientPrincipal","cn=roland", "extendedClientCheck","true")); Authenticator.Result result = auth.authenticate(createHttpsExchange(new Headers(),"uid=blub,cn=roland,o=redhat,c=de", true, true)); assertTrue(result instanceof Authenticator.Success); }
@Test public void positiveWithoutExtendedClientCheck() throws Exception { ClientCertAuthenticator auth = new ClientCertAuthenticator(getConfig("clientPrincipal","cn=roland", "extendedClientCheck","false")); Authenticator.Result result = auth.authenticate(createHttpsExchange(new Headers(),"uid=blub,cn=roland,o=redhat,c=de", true, false)); assertTrue(result instanceof Authenticator.Success); }
@Test public void negativeWithExtendedClientCheck() throws Exception { ClientCertAuthenticator auth = new ClientCertAuthenticator(getConfig("clientPrincipal","cn=roland", "extendedClientCheck","true")); Authenticator.Result result = auth.authenticate(createHttpsExchange(new Headers(),"uid=blub,cn=roland,o=redhat,c=de", true, false)); assertTrue(result instanceof Authenticator.Failure); }
@Test public void negativeWithWrongClientPrincipal() throws Exception { ClientCertAuthenticator auth = new ClientCertAuthenticator(getConfig("clientPrincipal","cn=roland", "extendedClientCheck","true")); Authenticator.Result result = auth.authenticate(createHttpsExchange(new Headers(),"uid=blub,cn=manuel,o=redhat,c=de", true, true)); assertTrue(result instanceof Authenticator.Failure); }
@Test public void negativeWithNoCert() throws Exception { ClientCertAuthenticator auth = new ClientCertAuthenticator(getConfig("clientPrincipal","cn=roland", "extendedClientCheck","false")); Authenticator.Result result = auth.authenticate(createHttpsExchange(new Headers(),"uid=blub,cn=roland,o=redhat,c=de", false , false)); assertTrue(result instanceof Authenticator.Failure); }
@Test public void wrongExchange() throws Exception { ClientCertAuthenticator auth = new ClientCertAuthenticator(getConfig()); Authenticator.Result result = auth.authenticate(createHttpExchange(new Headers())); assertTrue(result instanceof Authenticator.Failure); }