LoginAbstractAzkabanServlet extends AbstractAzkabanServlet { @Override protected void doPost(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException { Session session = getSessionFromRequest(req); getWebMetrics().markWebPostCall(); logRequest(req, session); if (isIllegalPostRequest(req)) { writeResponse(resp, "Login error. Must pass username and password in request body"); return; } if (ServletFileUpload.isMultipartContent(req)) { final Map<String, Object> params = this.multipartParser.parseMultipart(req); if (session == null) { if (params.containsKey("session.id")) { final String sessionId = (String) params.get("session.id"); session = getSessionFromSessionId(sessionId); if (session != null) { handleMultiformPost(req, resp, params, session); return; } } if (!params.containsKey("username") || !params.containsKey("password")) { writeResponse(resp, "Login error. Need username and password"); return; } final String username = (String) params.get("username"); final String password = (String) params.get("password"); final String ip = WebUtils.getRealClientIpAddr(req); try { session = createSession(username, password, ip, true); } catch (final UserManagerException e) { writeResponse(resp, "Login error: " + e.getMessage()); return; } } handleMultiformPost(req, resp, params, session); } else if (API_LOGIN.equals(req.getParameter("action"))) { final HashMap<String, Object> obj = new HashMap<>(); handleAjaxLoginAction(req, resp, obj); this.writeJSON(resp, obj); } else if ("oauth_callback".equals(req.getParameter("action"))) { handleOauthCallback(req, resp); } else if (session == null) { if (hasParam(req, "username") && hasParam(req, "password")) { try { session = createSession(req); } catch (final UserManagerException e) { writeResponse(resp, "Login error: " + e.getMessage()); } handlePost(req, resp, session); } else { if (isAjaxCall(req)) { final String response = AbstractAzkabanServlet .createJsonResponse("error", "Invalid Session. Need to re-login", API_LOGIN, null); writeResponse(resp, response); } else { handleLogin(req, resp, "Enter username and password"); } } } else { handlePost(req, resp, session); } } LoginAbstractAzkabanServlet(final List<AzkabanAPI> apiEndpoints); @Override void init(final ServletConfig config); static AzkabanAPI getLoginAPI(); void setResourceDirectory(final File file); boolean isUserAuthenticated(final HttpServletRequest req);  }
@Test public void testWhenPostRequestSessionIsValid() throws Exception { final String clientIp = "127.0.0.1:10000"; final String sessionId = "111"; final HttpServletRequest req = MockLoginAzkabanServlet .getRequestWithNoUpstream(clientIp, sessionId, "POST"); final StringWriter writer = new StringWriter(); final HttpServletResponse resp = getResponse(writer); final MockLoginAzkabanServlet servlet = MockLoginAzkabanServlet.getServletWithSession(sessionId, "user", "127.0.0.1"); servlet.doPost(req, resp); assertEquals("SUCCESS_MOCK_LOGIN_SERVLET", writer.toString()); }
@Test public void testWhenPostRequestChangedClientIpSessionIsInvalid() throws Exception { final String clientIp = "127.0.0.2:10000"; final String sessionId = "111"; final HttpServletRequest req = MockLoginAzkabanServlet .getRequestWithNoUpstream(clientIp, sessionId, "POST"); final StringWriter writer = new StringWriter(); final HttpServletResponse resp = getResponse(writer); final MockLoginAzkabanServlet servlet = MockLoginAzkabanServlet.getServletWithSession(sessionId, "user", "127.0.0.1"); servlet.doPost(req, resp); assertNotSame("SUCCESS_MOCK_LOGIN_SERVLET", writer.toString()); }
@Test public void testWhenPostRequestChangedClientPortSessionIsValid() throws Exception { final String clientIp = "127.0.0.1:10000"; final String sessionId = "111"; final HttpServletRequest req = MockLoginAzkabanServlet .getRequestWithNoUpstream(clientIp, sessionId, "POST"); final StringWriter writer = new StringWriter(); final HttpServletResponse resp = getResponse(writer); final MockLoginAzkabanServlet servlet = MockLoginAzkabanServlet.getServletWithSession(sessionId, "user", "127.0.0.1"); servlet.doPost(req, resp); assertEquals("SUCCESS_MOCK_LOGIN_SERVLET", writer.toString()); }
@Test public void testWhenPostRequestWithUpstreamSessionIsValid() throws Exception { final String clientIp = "127.0.0.1:10000"; final String upstreamIp = "192.168.1.1:11111"; final String sessionId = "111"; final HttpServletRequest req = MockLoginAzkabanServlet .getRequestWithUpstream(clientIp, upstreamIp, sessionId, "POST"); final StringWriter writer = new StringWriter(); final HttpServletResponse resp = getResponse(writer); final MockLoginAzkabanServlet servlet = MockLoginAzkabanServlet.getServletWithSession(sessionId, "user", "192.168.1.1"); servlet.doPost(req, resp); assertEquals("SUCCESS_MOCK_LOGIN_SERVLET", writer.toString()); }
@Test public void testWhenPostRequestWithMultipleUpstreamsSessionIsValid() throws Exception { final String clientIp = "127.0.0.1:10000"; final String upstreamIp = "192.168.1.1:11111,888.8.8.8:2222,5.5.5.5:5555"; final String sessionId = "111"; final HttpServletRequest req = MockLoginAzkabanServlet .getRequestWithUpstream(clientIp, upstreamIp, sessionId, "POST"); final StringWriter writer = new StringWriter(); final HttpServletResponse resp = getResponse(writer); final MockLoginAzkabanServlet servlet = MockLoginAzkabanServlet.getServletWithSession(sessionId, "user", "192.168.1.1"); servlet.doPost(req, resp); assertEquals("SUCCESS_MOCK_LOGIN_SERVLET", writer.toString()); }
@Test public void testLoginRevealingCredentialsShouldThrowFailure() throws Exception { final String clientIp = "127.0.0.1:10000"; final String sessionId = "111"; final String queryString = "action=login&username=azkaban&password=azkaban"; final String[] mockCredentials = {"azkaban"}; final HashMap<String, String[]> mockParameterMap = new HashMap<String, String[]>() { { put("username", mockCredentials); put("password", mockCredentials); } }; final HttpServletRequest req = MockLoginAzkabanServlet .getRequestWithNoUpstream(clientIp, sessionId, "POST"); when(req.getParameterMap()).thenReturn(mockParameterMap); when(req.getQueryString()).thenReturn(queryString); final StringWriter writer = new StringWriter(); final HttpServletResponse resp = getResponse(writer); final MockLoginAzkabanServlet servlet = MockLoginAzkabanServlet.getServletWithSession(sessionId, "user", "127.0.0.1"); servlet.doPost(req, resp); assertEquals("Login error. Must pass username and password in request body", writer.toString()); }