HttpBasicExecutor implements IAuthExecutor { @Override public AuthReport checkAllowed(Exchange exchange, Api api) { AuthReport authReport = new AuthReport(); String authHeader = (String) exchange.getIn().getHeader("Authorization"); if(authHeader != null){ String[] chunks = authHeader.split(" "); if(chunks.length == 2){ String scheme = chunks[0]; if("Basic".equalsIgnoreCase(scheme)){ String base64 = chunks[1]; String decoded = new String(Base64.decodeBase64(base64.getBytes())); chunks = decoded.split(":"); if(chunks.length >= 2){ String user = chunks[0]; String pass = chunks[1]; authReport = dataAccess.checkAllowed(api, user, pass); } else{ if(logger.isDebugEnabled()) { logger.debug("Unable to decode user/pass"); } authReport.setBadRequest(true); } } else{ if(logger.isDebugEnabled()) { logger.debug("Auth scheme not Basic ("+scheme+"). Cannot authenticate request"); } authReport.setBadRequest(true); } } else{ if(logger.isDebugEnabled()) { logger.debug("Improperly formed authorization header:"+authHeader); } authReport.setBadRequest(true); } } else{ if(logger.isDebugEnabled()) { logger.debug("Http Basic Authentication Header is missing"); } authReport.setBadRequest(true); } return authReport; } HttpBasicExecutor(IAuthDataAccess dataAcccess); @Override AuthReport checkAllowed(Exchange exchange, Api api); @Override AuthType getType(); @Override GatewayExceptionCode getErrorCode();  }
@Test public void testWin() { Exchange exchange = new DefaultExchange(context); Api api = new Api(); api.setId("123"); exchange.getIn().setHeader(AuthHttpHeaders.Authorization.toString(), "Basic "+new String(Base64.encodeBase64("win:blarg".getBytes()))); HttpBasicExecutor executor = new HttpBasicExecutor(new MockAuthDataAccess(null, "win:blarg", null)); AuthReport authReport = executor.checkAllowed(exchange, api); assertNotNull("This authentication should have succeeded", authReport.getAuthIdentity()); }
@Test public void testFailNoEncoding(){ Exchange exchange = new DefaultExchange(context); Api api = new Api(); api.setId("123"); exchange.getIn().setHeader(AuthHttpHeaders.Authorization.toString(), "Basic "+"win:blarg"); HttpBasicExecutor executor = new HttpBasicExecutor(new MockAuthDataAccess(null, "win:blarg", null)); AuthReport authReport = executor.checkAllowed(exchange, api); assertNull("This authentication should have failed", authReport.getAuthIdentity()); }
@Test public void testFailNoHeader(){ Exchange exchange = new DefaultExchange(context); Api api = new Api(); api.setId("123"); HttpBasicExecutor executor = new HttpBasicExecutor(new MockAuthDataAccess(null, "win:blarg", null)); AuthReport authReport = executor.checkAllowed(exchange, api); assertNull("This authentication should have failed", authReport.getAuthIdentity()); }
@Test public void testFailBadFormat(){ Exchange exchange = new DefaultExchange(context); Api api = new Api(); api.setId("123"); exchange.getIn().setHeader(AuthHttpHeaders.Authorization.toString(), "Vlasic "+new String(Base64.encodeBase64("win:blarg".getBytes()))); HttpBasicExecutor executor = new HttpBasicExecutor(new MockAuthDataAccess(null, "win:blarg", null)); AuthReport authReport = executor.checkAllowed(exchange, api); assertNull("This authentication should have failed", authReport.getAuthIdentity()); }
@Test public void testFailBadFormat2(){ Exchange exchange = new DefaultExchange(context); Api api = new Api(); api.setId("123"); exchange.getIn().setHeader(AuthHttpHeaders.Authorization.toString(), "Basic"+new String(Base64.encodeBase64("win:blarg".getBytes()))); HttpBasicExecutor executor = new HttpBasicExecutor(new MockAuthDataAccess(null, "win:blarg", null)); AuthReport authReport = executor.checkAllowed(exchange, api); assertNull("This authentication should have failed", authReport.getAuthIdentity()); }
@Test public void testFailNotAllowed(){ Exchange exchange = new DefaultExchange(context); Api api = new Api(); api.setId("123"); exchange.getIn().setHeader(AuthHttpHeaders.Authorization.toString(), "Basic "+new String(Base64.encodeBase64("win:blarg".getBytes()))); HttpBasicExecutor executor = new HttpBasicExecutor(new MockAuthDataAccess(null, null, null)); AuthReport authReport = executor.checkAllowed(exchange, api); assertNull("This authentication should have failed", authReport.getAuthIdentity()); }