AccessControlInterceptor extends AbstractPhaseInterceptor<Message> { @Override public void handleMessage( final Message message ) { try { if ( InterceptorState.SERVER_IN.isActive( message ) ) { HttpServletRequest req = ( HttpServletRequest ) message.get( AbstractHTTPDestination.HTTP_REQUEST ); Session userSession = getSession( message, req ); if ( userSession != null ) { Subject.doAs( userSession.getSubject(), new PrivilegedAction<Void>() { @Override public Void run() { try { message.getInterceptorChain().doIntercept( message ); } catch ( Exception ex ) { Throwable t = ExceptionUtils.getRootCause( ex ); MessageContentUtil.abortChain( message, t ); } return null; } } ); } else { MessageContentUtil.abortChain( message, 401, "User is not authorized" ); } } } catch ( Exception e ) { throw new Fault( e ); } } AccessControlInterceptor( IdentityManager identityManager ); @Override void handleMessage( final Message message );  }
@Test public void testHandleMessage() throws Exception { Message message = InterceptorStateHelper.getMessage( InterceptorState.SERVER_IN ); doReturn( request ).when( message ).get( AbstractHTTPDestination.HTTP_REQUEST ); doReturn( exchange ).when( message ).getExchange(); doReturn( interceptorChain ).when( message ).getInterceptorChain(); doReturn( message ).when( exchange ).getInMessage(); doReturn( Common.DEFAULT_PUBLIC_SECURE_PORT ).when( request ).getLocalPort(); doReturn( response ).when( message ).get( AbstractHTTPDestination.HTTP_RESPONSE ); ServletOutputStream outputStream = mock( ServletOutputStream.class ); doReturn( outputStream ).when( response ).getOutputStream(); accessControlInterceptor.handleMessage( message ); verify( accessControlInterceptor ).authenticateAccess( null, null ); verify( interceptorChain ).abort(); doReturn( "/rest/v1/identity/auth").when( request ).getRequestURI(); doReturn( -1 ).when( request ).getLocalPort(); accessControlInterceptor.handleMessage( message ); verify( accessControlInterceptor, times( 2 ) ).authenticateAccess( null, null ); doReturn( Common.DEFAULT_PUBLIC_PORT ).when( request ).getLocalPort(); doReturn( "/blabla" ).when( request ).getRequestURI(); accessControlInterceptor.handleMessage( message ); verify( accessControlInterceptor ).authenticateAccess( message, request ); }