AdminServerCredentialVerifier { public void authenticate(SecurityContext securityContext, String authHeader) { if (!httpsEnabled) { throw new WebApplicationException(Response.status(FORBIDDEN) .header("Content-Type", "text/plain") .entity("HTTPS not enabled") .build()); } if (securityContext.isUserInRole("server.admin") && !"none".equals(securityContext.getAuthenticationScheme())) { return; } if (username == null || password == null) { throw new WebApplicationException(Response.status(FORBIDDEN) .header("Content-Type", "text/plain") .entity("Administrator password not configured") .build()); } if (authHeader == null || !authHeader.startsWith("Basic ")) { unauthorized(); } String credentials = new String(decoder.decode(authHeader.substring("Basic ".length())), UTF_8); int index = credentials.indexOf(':'); if (index < 0 || !username.equals(credentials.substring(0, index)) || !password.equals(credentials.substring(index + 1))) { unauthorized(); } } @Inject  AdminServerCredentialVerifier(AdminServerConfig adminServerConfig, HttpServerConfig httpServerConfig); void authenticate(SecurityContext securityContext, String authHeader);  }
@Test public void testHttpsDisabled() { try { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, new HttpServerConfig().setHttpsEnabled(false)) .authenticate(SECURITY_CONTEXT_ALLOW, null); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 403); } }
@Test public void testNoPasswordConfigured() { try { new AdminServerCredentialVerifier(new AdminServerConfig(), HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_DENY, null); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 403); } }
@Test public void testNoPasswordConfiguredContextAllows() { new AdminServerCredentialVerifier(new AdminServerConfig(), HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_ALLOW, null); }
@Test public void testNoAuthentication() { try { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_DENY, null); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 401); } }
@Test public void testOptionalAuthenticationContextIgnored() { try { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_OPTIONAL, null); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 401); } }
@Test public void testContextAuthentication() { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_ALLOW, null); }
@Test public void testPasswordAuthentication() { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_DENY, "Basic " + Base64.getEncoder().encodeToString("foo:bar".getBytes(UTF_8))); }
@Test public void testPasswordAuthenticationWithOptionalAuthenticationContext() { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_OPTIONAL, "Basic " + Base64.getEncoder().encodeToString("foo:bar".getBytes(UTF_8))); }
@Test public void testBadUsername() { try { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_DENY, "Basic " + Base64.getEncoder().encodeToString("bad:bar".getBytes(UTF_8))); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 401); } }
@Test public void testBadPassword() { try { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_DENY, "Basic " + Base64.getEncoder().encodeToString("foo:bad".getBytes(UTF_8))); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 401); } }
@Test public void testWrongScheme() { try { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_DENY, "Digest " + Base64.getEncoder().encodeToString("foo:bar".getBytes(UTF_8))); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 401); } }
@Test public void testNoPassword() { try { new AdminServerCredentialVerifier(ADMIN_SERVER_CONFIG, HTTP_SERVER_CONFIG) .authenticate(SECURITY_CONTEXT_DENY, "Digest " + Base64.getEncoder().encodeToString("foo".getBytes(UTF_8))); fail("Expected WebApplicationException"); } catch (WebApplicationException e) { assertEquals(e.getResponse().getStatus(), 401); } }