HttpHeaderAuthenticationFilter extends GenericFilterBean { @Override @SuppressFBWarnings(value = "BC_UNCONFIRMED_CAST", justification = "The ServletRequest is cast to an HttpServletRequest which is always the case since all requests use the HTTP protocol.") public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { doHttpFilter((HttpServletRequest) servletRequest, (HttpServletResponse) servletResponse, filterChain); } HttpHeaderAuthenticationFilter(AuthenticationManager authenticationManager, ApplicationUserBuilder applicationUserBuilder); @Override @SuppressFBWarnings(value = "BC_UNCONFIRMED_CAST", justification = "The ServletRequest is cast to an HttpServletRequest which is always the case since all requests use the HTTP protocol.") void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain); void doHttpFilter(HttpServletRequest servletRequest, HttpServletResponse servletResponse, FilterChain filterChain);  }
@Test public void testHttpHeaderAuthenticationFilterRegularUser() throws Exception { namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE); userNamespaceAuthorizationDaoTestHelper .createUserNamespaceAuthorizationEntity(USER_ID, namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE_2), SUPPORTED_NAMESPACE_PERMISSIONS); userNamespaceAuthorizationDaoTestHelper .createUserNamespaceAuthorizationEntity(USER_ID, namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE_3), SUPPORTED_NAMESPACE_PERMISSIONS); Set<NamespaceAuthorization> expectedNamespaceAuthorizations = new HashSet<>(); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE_2, SUPPORTED_NAMESPACE_PERMISSIONS)); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE_3, SUPPORTED_NAMESPACE_PERMISSIONS)); setupTestFunctions("testRole"); modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", TEST_FUNCTIONS, expectedNamespaceAuthorizations); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", TEST_FUNCTIONS, expectedNamespaceAuthorizations); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterAdminUser() throws Exception { userDaoTestHelper.createUserEntity(USER_ID, true); namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE); namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE_2); Set<NamespaceAuthorization> expectedNamespaceAuthorizations = new HashSet<>(); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE, SUPPORTED_NAMESPACE_PERMISSIONS)); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE_2, SUPPORTED_NAMESPACE_PERMISSIONS)); setupTestFunctions("testRole"); modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", TEST_FUNCTIONS, expectedNamespaceAuthorizations); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", TEST_FUNCTIONS, expectedNamespaceAuthorizations); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterUserAuthorizationDisabled() throws Exception { userDaoTestHelper.createUserEntity(USER_ID, true); namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE); namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE_2); Set<NamespaceAuthorization> expectedNamespaceAuthorizations = new HashSet<>(); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE, SUPPORTED_NAMESPACE_PERMISSIONS)); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE_2, SUPPORTED_NAMESPACE_PERMISSIONS)); setupTestFunctions("testRole"); Map<String, Object> overrideMap = getDefaultSecurityEnvironmentVariables(); overrideMap.put(ConfigurationValue.USER_NAMESPACE_AUTHORIZATION_ENABLED.getKey(), "false"); modifyPropertySourceInEnvironment(overrideMap); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", TEST_FUNCTIONS, expectedNamespaceAuthorizations); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", TEST_FUNCTIONS, expectedNamespaceAuthorizations); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterUserAuthorizationInvalidConfigurationValue() throws Exception { userDaoTestHelper.createUserEntity(USER_ID, true); namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE); namespaceDaoTestHelper.createNamespaceEntity(NAMESPACE_2); Set<NamespaceAuthorization> expectedNamespaceAuthorizations = new HashSet<>(); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE, SUPPORTED_NAMESPACE_PERMISSIONS)); expectedNamespaceAuthorizations.add(new NamespaceAuthorization(NAMESPACE_2, SUPPORTED_NAMESPACE_PERMISSIONS)); setupTestFunctions("testRole"); Map<String, Object> overrideMap = getDefaultSecurityEnvironmentVariables(); overrideMap.put(ConfigurationValue.USER_NAMESPACE_AUTHORIZATION_ENABLED.getKey(), "NOT_A_BOOLEAN"); modifyPropertySourceInEnvironment(overrideMap); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); assertNull(SecurityContextHolder.getContext().getAuthentication()); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterNoHeaders() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { invalidateApplicationUser(null); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(new MockHttpServletRequest(), new MockHttpServletResponse(), new MockFilterChain()); Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); assertNull(authentication); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterUserChangedInHeaders() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", null, null); request = getRequestWithHeaders(USER_ID_2, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID_2, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", null, null); request = getRequestWithHeaders(USER_ID_2, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 11:24:09"); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID_2, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 11:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterNoRoles() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", null, "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", (String) null, "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterNoSessionInitTime() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", null, null); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", (String) null, null, null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterInvalidateSessionOnWrongHeader() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", null, null); httpHeaderAuthenticationFilter.doFilter(new MockHttpServletRequest(), new MockHttpServletResponse(), new MockFilterChain()); Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); assertNull(authentication); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterMultipleRoles() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole1,testRole2", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); Set<String> expectedRoles = new HashSet<>(); expectedRoles.add("testRole1"); expectedRoles.add("testRole2"); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", expectedRoles, "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterEmptyRoleRegex() throws Exception { Map<String, Object> overrideMap = getDefaultSecurityEnvironmentVariables(); overrideMap.put(ConfigurationValue.SECURITY_HTTP_HEADER_ROLE_REGEX.getKey(), " "); modifyPropertySourceInEnvironment(overrideMap); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole1,testRole2", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); Set<String> expectedRoles = new HashSet<>(); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", expectedRoles, "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterNoRegexGroup() throws Exception { Map<String, Object> overrideMap = getDefaultSecurityEnvironmentVariables(); overrideMap.put(ConfigurationValue.SECURITY_HTTP_HEADER_ROLE_REGEX_GROUP.getKey(), " "); modifyPropertySourceInEnvironment(overrideMap); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole1,testRole2", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); Set<String> expectedRoles = new HashSet<>(); expectedRoles.add("testRole1,"); expectedRoles.add("testRole2"); validateHttpHeaderApplicationUser(USER_ID, "testFirstName", "testLastName", "testEmail", expectedRoles, "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterUserIdWithDomainName() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); try { MockHttpServletRequest request = getRequestWithHeaders("testUser@company.com", "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser("testUser@company.com", "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterUserWithMultiRoleHeaderNameRegexNoRole() throws Exception { modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariablesWithMultiHeaderRoles()); try { MockHttpServletRequest request = getRequestWithHeaders("testUserId", "testFirstName", "testLastName", "testEmail", "", "Wed, 11 Mar 2015 10:24:09"); request.addHeader("useridSuffix", "suffix"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser("testUserId" + "@suffix", "testFirstName", "testLastName", "testEmail", (String) null, "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterUserWithMultiRoleHeaderNameRegexNoUseridSuffix() throws Exception { Map<String, Object> overrideMap = getDefaultSecurityEnvironmentVariables(); overrideMap.put(ConfigurationValue.SECURITY_HTTP_HEADER_NAMES.getKey(), "useridHeader=userId|firstNameHeader=firstName" + "|lastNameHeader=lastName|emailHeader=email|sessionInitTimeHeader=sessionInitTime"); modifyPropertySourceInEnvironment(overrideMap); try { MockHttpServletRequest request = getRequestWithHeaders("testUserId", "testFirstName", "testLastName", "testEmail", "", "Wed, 11 Mar 2015 10:24:09"); request.addHeader("useridSuffix", "suffix"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser("testUserId", "testFirstName", "testLastName", "testEmail", (String) null, "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterUserWithMultiRoleHeaderNameRegexMultiRoles() throws Exception { String testUserId = "testUser"; String userIdSuffix = "suffix"; String userIdWithSuffix = testUserId + "@" + userIdSuffix; modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariablesWithMultiHeaderRoles()); try { MockHttpServletRequest request = getRequestWithHeaders(testUserId, "testFirstName", "testLastName", "testEmail", "", "Wed, 11 Mar 2015 10:24:09"); request.addHeader("privtestrole1", "valid"); request.addHeader("privtestrole2", "valid"); request.addHeader("useridSuffix", userIdSuffix); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); Set<String> expectedRoles = new HashSet<>(); expectedRoles.add("testrole1"); expectedRoles.add("testrole2"); validateHttpHeaderApplicationUser(userIdWithSuffix, "testFirstName", "testLastName", "testEmail", expectedRoles, "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test(expected = IllegalArgumentException.class) public void testHttpHeaderAuthenticationFilterUserWithMultipleRoleHeaderNameRegexAndSingleRoleHeaderTogether() throws Exception { Map<String, Object> overrideMap = getDefaultSecurityEnvironmentVariables(); overrideMap.put(ConfigurationValue.SECURITY_HTTP_HEADER_NAMES.getKey(), "useridHeader=userId|firstNameHeader=firstName" + "|lastNameHeader=lastName|emailHeader=email|rolesHeader=roles|sessionInitTimeHeader=sessionInitTime"); overrideMap.put(ConfigurationValue.SECURITY_HTTP_HEADER_NAME_ROLE_REGEX.getKey(), "priv(.+)"); overrideMap.put(ConfigurationValue.SECURITY_HTTP_HEADER_ROLE_VALUE.getKey(), "valid"); modifyPropertySourceInEnvironment(overrideMap); try { MockHttpServletRequest request = getRequestWithHeaders("testUserId", "testFirstName", "testLastName", "testEmail", "noRoleMemberOf", "Wed, 11 Mar 2015 10:24:09"); request.addHeader("privtestrole2", "valid"); invalidateApplicationUser(request); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); httpHeaderAuthenticationFilter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain()); validateHttpHeaderApplicationUser("testUserId", "testFirstName", "testLastName", "testEmail", "testrole1", "Wed, 11 Mar 2015 10:24:09", null, null); } finally { restorePropertySourceInEnvironment(); } }
@Test public void testHttpHeaderAuthenticationFilterWithDatabaseConnectionError() throws Exception { setupTestFunctions("testRole"); modifyPropertySourceInEnvironment(getDefaultSecurityEnvironmentVariables()); ApplicationUserBuilder applicationUserBuilder = (ApplicationUserBuilder) ReflectionTestUtils.getField(httpHeaderAuthenticationFilter, "applicationUserBuilder"); try { MockHttpServletRequest request = getRequestWithHeaders(USER_ID, "testFirstName", "testLastName", "testEmail", "testRole", "Wed, 11 Mar 2015 10:24:09"); ApplicationUserBuilder mockApplicationUserBuilder = Mockito.mock(ApplicationUserBuilder.class); Mockito.when(mockApplicationUserBuilder.buildNoRoles(any(HttpServletRequest.class))).thenThrow(PersistenceException.class); invalidateApplicationUser(request); ReflectionTestUtils.setField(httpHeaderAuthenticationFilter, "applicationUserBuilder", mockApplicationUserBuilder); httpHeaderAuthenticationFilter.init(new MockFilterConfig()); MockHttpServletResponse mockHttpServletResponse = new MockHttpServletResponse(); httpHeaderAuthenticationFilter.doFilter(request, mockHttpServletResponse, new MockFilterChain()); assertEquals(500, mockHttpServletResponse.getStatus()); ErrorInformation errorInformation = new ErrorInformation(); errorInformation.setStatusCode(500); errorInformation.setStatusDescription("Internal Server Error"); errorInformation.setMessage("javax.persistence.PersistenceException"); errorInformation.setMessageDetails(new ArrayList<>()); assertEquals(xmlHelper.objectToXml(errorInformation), mockHttpServletResponse.getContentAsString()); } finally { restorePropertySourceInEnvironment(); } ReflectionTestUtils.setField(httpHeaderAuthenticationFilter, "applicationUserBuilder", applicationUserBuilder); }