Http { public static Principal authenticate(HttpServletRequest request, AuthorityList authorities) { return authenticate(request, authorities, false); }  static Principal authenticate(HttpServletRequest request,
            AuthorityList authorities); static Principal authenticate(HttpServletRequest request,
            AuthorityList authorities, boolean optionalAuth); static String authenticatedUser(HttpServletRequest request,
            AuthorityList authorities); static String authorizedUser(HttpServletRequest request,
            AuthorityList authorities, Authorizer authorizer, String action,
            String resource, String otherDomain); static Principal authorize(Authorizer authorizer, Principal principal,
            String action, String resource, String otherDomain); static final String WWW_AUTHENTICATE; static final String INVALID_CRED_ATTR; static final String AUTH_CHALLENGES; static final String JAVAX_CERT_ATTR; }
@Test public void testAuthenticateInternalServerError() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); try { Http.authenticate(httpServletRequest, null); } catch (ResourceException expected) { assertEquals(expected.getCode(), 500); } }
@Test public void testAuthenticateCertificateFailure() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); Http.AuthorityList authorities = new Http.AuthorityList(); Authority authority = Mockito.mock(Authority.class); Mockito.when(authority.getCredSource()).thenReturn(CredSource.CERTIFICATE); authorities.add(authority); try { Http.authenticate(httpServletRequest, authorities); } catch (ResourceException expected) { assertEquals(expected.getCode(), 401); } }
@Test public void testAuthenticateCertificate() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); Http.AuthorityList authorities = new Http.AuthorityList(); Authority authority = Mockito.mock(Authority.class); Mockito.when(authority.getCredSource()).thenReturn(CredSource.CERTIFICATE); X509Certificate[] certs = new X509Certificate[1]; certs[0] = Mockito.mock(X509Certificate.class); Mockito.when(httpServletRequest.getAttribute(Http.JAVAX_CERT_ATTR)).thenReturn(certs); Principal principal = Mockito.mock(Principal.class); Mockito.when(authority.authenticate(ArgumentMatchers.any(X509Certificate[].class), ArgumentMatchers.any())).thenReturn(principal); authorities.add(authority); assertNotNull(Http.authenticate(httpServletRequest, authorities)); }
@Test public void testAuthenticateRequest() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); Http.AuthorityList authorities = new Http.AuthorityList(); Authority authority = Mockito.mock(Authority.class); Mockito.when(authority.getCredSource()).thenReturn(CredSource.REQUEST); Principal principal = Mockito.mock(Principal.class); Mockito.when(authority.authenticate(ArgumentMatchers.any(HttpServletRequest.class), ArgumentMatchers.any())).thenReturn(principal); authorities.add(authority); assertNotNull(Http.authenticate(httpServletRequest, authorities)); }
@Test public void testAuthenticateHeaderFailure() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); Http.AuthorityList authorities = new Http.AuthorityList(); Authority authority = Mockito.mock(Authority.class); Mockito.when(authority.getCredSource()).thenReturn(CredSource.HEADER); Mockito.when(authority.getHeader()).thenReturn("Cookie.hogehoge"); Mockito.when(authority.getAuthenticateChallenge()).thenReturn("Basic realm=\"athenz\""); authorities.add(authority); try { Http.authenticate(httpServletRequest, authorities); } catch (ResourceException expected) { assertEquals(expected.getCode(), 401); } Set<String> challenges = new HashSet<>(); challenges.add("Basic realm=\"athenz\""); Mockito.verify(httpServletRequest, times(1)) .setAttribute("com.yahoo.athenz.auth.credential.challenges", challenges); }
@Test public void testAuthenticateHeaderErrorMessage() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); Mockito.when(httpServletRequest.getHeader("Athenz-Principal-Auth")).thenReturn("Creds"); Http.AuthorityList authorities = new Http.AuthorityList(); PrincipalAuthority authority1 = new PrincipalAuthority(); authorities.add(authority1); PrincipalAuthority authority2 = new PrincipalAuthority(); authorities.add(authority2); try { Http.authenticate(httpServletRequest, authorities); } catch (ResourceException expected) { assertEquals(expected.getCode(), 401); } Mockito.verify(httpServletRequest, times(1)) .setAttribute(ArgumentMatchers.anyString(), ArgumentMatchers.anyString()); Mockito.verify(httpServletRequest, times(1)) .setAttribute(ArgumentMatchers.anyString(), ArgumentMatchers.anyIterable()); }
@Test public void testAuthenticateHeaderFailureMultipleAuth() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); Http.AuthorityList authorities = new Http.AuthorityList(); Authority authority1 = Mockito.mock(Authority.class); Mockito.when(authority1.getCredSource()).thenReturn(CredSource.HEADER); Mockito.when(authority1.getHeader()).thenReturn("Cookie.hogehoge"); Mockito.when(authority1.getAuthenticateChallenge()).thenReturn("Basic realm=\"athenz\""); authorities.add(authority1); Authority authority2 = Mockito.mock(Authority.class); Mockito.when(authority2.getCredSource()).thenReturn(CredSource.REQUEST); Mockito.when(authority2.getAuthenticateChallenge()).thenReturn("AthenzRequest realm=\"athenz\""); authorities.add(authority2); try { Http.authenticate(httpServletRequest, authorities); } catch (ResourceException expected) { assertEquals(expected.getCode(), 401); } Set<String> challenges = new HashSet<>(); challenges.add("Basic realm=\"athenz\""); challenges.add("AthenzRequest realm=\"athenz\""); Mockito.verify(httpServletRequest, times(1)) .setAttribute("com.yahoo.athenz.auth.credential.challenges", challenges); }
@Test public void testAuthenticateHeaderNull() { HttpServletRequest httpServletRequest = Mockito.mock(HttpServletRequest.class); Http.AuthorityList authorities = new Http.AuthorityList(); Authority authority = Mockito.mock(Authority.class); Mockito.when(authority.getCredSource()).thenReturn(CredSource.HEADER); Mockito.when(authority.getHeader()).thenReturn(null); try { Http.authenticate(httpServletRequest, authorities); } catch (ResourceException expected) { assertEquals(expected.getCode(), 401); } }