WebappAuthenticationValve extends CarbonTomcatValve { @Override public void invoke(Request request, Response response, CompositeValve compositeValve) { if (this.isContextSkipped(request) || this.skipAuthentication(request)) { this.getNext().invoke(request, response, compositeValve); return; } WebappAuthenticator authenticator = WebappAuthenticatorFactory.getAuthenticator(request); if (authenticator == null) { String msg = "Failed to load an appropriate authenticator to authenticate the request"; AuthenticationFrameworkUtil.handleResponse(request, response, HttpServletResponse.SC_UNAUTHORIZED, msg); return; } AuthenticationInfo authenticationInfo = authenticator.authenticate(request, response); if (isManagedAPI(request) && (authenticationInfo.getStatus() == WebappAuthenticator.Status.CONTINUE || authenticationInfo.getStatus() == WebappAuthenticator.Status.SUCCESS)) { WebappAuthenticator.Status status = WebappTenantAuthorizer.authorize(request, authenticationInfo); authenticationInfo.setStatus(status); } if (authenticationInfo.getTenantId() != -1) { try { PrivilegedCarbonContext.startTenantFlow(); PrivilegedCarbonContext privilegedCarbonContext = PrivilegedCarbonContext.getThreadLocalCarbonContext(); privilegedCarbonContext.setTenantId(authenticationInfo.getTenantId()); privilegedCarbonContext.setTenantDomain(authenticationInfo.getTenantDomain()); privilegedCarbonContext.setUsername(authenticationInfo.getUsername()); this.processRequest(request, response, compositeValve, authenticationInfo); } finally { PrivilegedCarbonContext.endTenantFlow(); } } else { this.processRequest(request, response, compositeValve, authenticationInfo); } }  @Override void invoke(Request request, Response response, CompositeValve compositeValve);  }
@Test(description = "This method tests the invoke method of the WebAppAuthenticationValve with the context path " + "starting with carbon") public void testInvokeWithContextSkippedScenario1() { Request request = new Request(); Context context = new StandardContext(); context.setPath("carbon"); CompositeValve compositeValve = Mockito.mock(CompositeValve.class); Mockito.doNothing().when(compositeValve).continueInvocation(Mockito.any(), Mockito.any()); request.setContext(context); webappAuthenticationValve.invoke(request, null, compositeValve); request = new TestRequest("", "test"); context = new StandardContext(); compositeValve = Mockito.mock(CompositeValve.class); Mockito.doNothing().when(compositeValve).continueInvocation(Mockito.any(), Mockito.any()); request.setContext(context); webappAuthenticationValve.invoke(request, null, compositeValve); }
@Test(description = "This method tests the behaviour of the invoke method of WebAuthenticationValve when " + "un-secured endpoints are invoked.") public void testInvokeUnSecuredEndpoints() { Request request = new TestRequest("", "test"); Context context = new StandardContext(); context.setPath("carbon1"); context.addParameter("doAuthentication", String.valueOf(true)); context.addParameter("nonSecuredEndPoints", "test, test1"); CompositeValve compositeValve = Mockito.mock(CompositeValve.class); Mockito.doNothing().when(compositeValve).continueInvocation(Mockito.any(), Mockito.any()); request.setContext(context); webappAuthenticationValve.invoke(request, null, compositeValve); }
@Test(description = "This method tests the behaviour of the invoke method of WebAuthenticationValve when " + "secured endpoints are invoked.") public void testInvokeSecuredEndpoints() throws NoSuchFieldException, IllegalAccessException { String encodedString = new String(Base64.getEncoder().encode((ADMIN_USER + ":" + ADMIN_USER).getBytes())); Request request = createRequest("basic " + encodedString); webappAuthenticationValve.invoke(request, null, compositeValve); encodedString = new String(Base64.getEncoder().encode((ADMIN_USER + ":" + ADMIN_USER + "test").getBytes())); request = createRequest("basic " + encodedString); Response response = new Response(); org.apache.coyote.Response coyoteResponse = new org.apache.coyote.Response(); Connector connector = new Connector(); response.setConnector(connector); response.setCoyoteResponse(coyoteResponse); webappAuthenticationValve.invoke(request, response, compositeValve); Assert.assertEquals(response.getStatus(), HttpServletResponse.SC_UNAUTHORIZED, "Response of un-authorized request is not updated"); }
@Test(description = "This method tests the behaviour of invoke method when the request does not satisfy any " + "authenticator requirements") public void testInvokeWithoutProperAuthenticator() throws NoSuchFieldException, IllegalAccessException { Request request = createRequest("basic"); Response response = new Response(); org.apache.coyote.Response coyoteResponse = new org.apache.coyote.Response(); Connector connector = new Connector(); response.setConnector(connector); response.setCoyoteResponse(coyoteResponse); webappAuthenticationValve.invoke(request, response, compositeValve); Assert.assertEquals(response.getStatus(), HttpServletResponse.SC_UNAUTHORIZED, "Response of un-authorized request is not updated"); }