869a36e2649ae064c98063cf1e55198488d78d12Allan Foster/**
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster *
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * Copyright (c) 2009 Sun Microsystems Inc. All Rights Reserved
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster *
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * The contents of this file are subject to the terms
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * of the Common Development and Distribution License
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * (the License). You may not use this file except in
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * compliance with the License.
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster *
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * You can obtain a copy of the License at
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * opensso/legal/CDDLv1.0.txt
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * See the License for the specific language governing
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * permission and limitations under the License.
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster *
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * When distributing Covered Code, include this CDDL
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * Header Notice in each file and include the License file
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * at opensso/legal/CDDLv1.0.txt.
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * If applicable, add the following below the CDDL Header,
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * with the fields enclosed by brackets [] replaced by
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * your own identifying information:
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster *
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster * $Id: AndConditionEvalTest.java,v 1.2 2010/01/12 21:29:58 veiming Exp $
d1b57e78cf72f41c7c6a52bd7c2a6d6aa4da6ba4Craig McDonnell *
d1b57e78cf72f41c7c6a52bd7c2a6d6aa4da6ba4Craig McDonnell * Portions Copyrighted 2014 ForgeRock AS
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster */
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste/**
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste * Portions copyright 2014 ForgeRock AS.
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste */
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterpackage com.sun.identity.entitlement;
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport com.iplanet.sso.SSOToken;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport com.sun.identity.entitlement.opensso.SubjectUtils;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport com.sun.identity.security.AdminTokenAction;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport java.security.AccessController;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport java.util.HashMap;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport java.util.HashSet;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport java.util.List;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport java.util.Map;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport java.util.Set;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport javax.security.auth.Subject;
6466ccf2fa7622ea05ba8cd089a224c8fc710f9aCraig McDonnell
6466ccf2fa7622ea05ba8cd089a224c8fc710f9aCraig McDonnellimport org.forgerock.openam.entitlement.conditions.environment.IPv4Condition;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport org.testng.annotations.AfterClass;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport org.testng.annotations.BeforeClass;
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterimport org.testng.annotations.Test;
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
6909255a1970175507277a0f2f105979625f76b2Jaco Joosteimport static org.forgerock.openam.entitlement.conditions.environment.ConditionConstants.REQUEST_IP;
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste
869a36e2649ae064c98063cf1e55198488d78d12Allan Fosterpublic class AndConditionEvalTest {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private static final String PRIVILEGE_NAME = "AndConditionEvalTest";
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private static final String ROOT_RESOURCE_NAME =
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "http://www.AndConditionEvalTest.com";
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private static final String START_IP = "100.100.100.100";
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private static final String END_IP = "200.200.200.200";
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private static final String DNS_MASK = "*.AndConditionEvalTest.com";
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster AdminTokenAction.getInstance());
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private Subject adminSubject = SubjectUtils.createSubject(adminToken);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private boolean migrated = EntitlementConfiguration.getInstance(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster adminSubject, "/").migratedToEntitlementService();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster @BeforeClass
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster public void setup() throws Exception {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if (migrated) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Map<String, Boolean> actions = new HashMap<String, Boolean>();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster actions.put("GET", Boolean.TRUE);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Entitlement ent = new Entitlement(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ApplicationTypeManager.URL_APPLICATION_TYPE_NAME,
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ROOT_RESOURCE_NAME + "/*", actions);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster AndCondition cond = new AndCondition();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Set<EntitlementCondition> conditions = new
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster HashSet<EntitlementCondition>();
6466ccf2fa7622ea05ba8cd089a224c8fc710f9aCraig McDonnell IPv4Condition ipc = new IPv4Condition();
94bba0f00a89bd3995d00513446d4849ecc79858Craig McDonnell ipc.setStartIpAndEndIp(START_IP, END_IP);
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste conditions.add(ipc);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster cond.setEConditions(conditions);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Privilege privilege = Privilege.getNewInstance();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster privilege.setName(PRIVILEGE_NAME);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster privilege.setEntitlement(ent);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster privilege.setSubject(new AnyUserSubject());
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster privilege.setCondition(cond);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster PrivilegeManager pm = PrivilegeManager.getInstance("/",
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster adminSubject);
d1b57e78cf72f41c7c6a52bd7c2a6d6aa4da6ba4Craig McDonnell pm.add(privilege);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Thread.sleep(1000);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster @AfterClass
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster public void clean() throws EntitlementException {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if (migrated) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster PrivilegeManager pm = PrivilegeManager.getInstance("/",
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster adminSubject);
d1b57e78cf72f41c7c6a52bd7c2a6d6aa4da6ba4Craig McDonnell pm.remove(PRIVILEGE_NAME);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster @Test
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster public void positiveTest() throws Exception {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Map<String, Set<String>> environment = getEnvironment(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "100.100.100.200", "www.AndConditionEvalTest.com");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Evaluator evaluator = new Evaluator(adminSubject,
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ApplicationTypeManager.URL_APPLICATION_TYPE_NAME);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster List<Entitlement> entitlements = evaluator.evaluate("/", adminSubject,
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ROOT_RESOURCE_NAME + "/index.html", environment, false);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if ((entitlements == null) || entitlements.isEmpty()) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.positiveTest: no entitlements returned");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Entitlement ent = entitlements.get(0);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Boolean result = ent.getActionValue("GET");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if ((result == null) || !result) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.positiveTest: incorrect decision");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Map<String, Set<String>> advice = ent.getAdvices();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if ((advice != null) && !advice.isEmpty()) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.positiveTest: do not expect advices.");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster @Test
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster public void negativeTest() throws Exception {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Map<String, Set<String>> environment = getEnvironment(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "210.100.100.200", "www.wrong.com");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Evaluator evaluator = new Evaluator(adminSubject,
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ApplicationTypeManager.URL_APPLICATION_TYPE_NAME);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster List<Entitlement> entitlements = evaluator.evaluate("/", adminSubject,
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ROOT_RESOURCE_NAME + "/index.html", environment, false);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if ((entitlements == null) || entitlements.isEmpty()) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.negativeTest: no entitlements returned");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Entitlement ent = entitlements.get(0);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Boolean result = ent.getActionValue("GET");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if ((result != null) && result) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.negativeTest: incorrect decision");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Map<String, Set<String>> advices = ent.getAdvices();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if ((advices == null) || advices.isEmpty()) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.negativeTest: no advices.");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
6466ccf2fa7622ea05ba8cd089a224c8fc710f9aCraig McDonnell Set<String> advice = advices.get(IPv4Condition.class.getName());
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster if ((advice == null) || advice.isEmpty()) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.negativeTest: no advice for IPCondition.");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster String adv = advice.iterator().next();
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste if (!adv.equals(REQUEST_IP + "=" + START_IP + "-" + END_IP)
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster throw new Exception(
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster "AndConditionEvalTest.negativeTest: advice for IP Condition");
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster private Map<String, Set<String>> getEnvironment(String ipAddr, String dns) {
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Map<String, Set<String>> environment =
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster new HashMap<String, Set<String>>();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Set<String> dnsMask = new HashSet<String>();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster dnsMask.add(dns);
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste environment.put("requestDnsName", dnsMask);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster Set<String> ip = new HashSet<String>();
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster ip.add(ipAddr);
6909255a1970175507277a0f2f105979625f76b2Jaco Jooste environment.put(REQUEST_IP, ip);
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster return environment;
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster }
869a36e2649ae064c98063cf1e55198488d78d12Allan Foster}