identity/entitlement/DelegationIsAllowedSubResourceTest.java

	DelegationIsAllowedSubResourceTest.java revision 74dca04245920444925c2544c591c3da5dad607e
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Copyright (c) 2009 Sun Microsystems Inc. All Rights Reserved
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * The contents of this file are subject to the terms
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * of the Common Development and Distribution License
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * (the License). You may not use this file except in
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * compliance with the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * You can obtain a copy of the License at
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * opensso/legal/CDDLv1.0.txt
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * See the License for the specific language governing
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * permission and limitations under the License.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * When distributing Covered Code, include this CDDL
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Header Notice in each file and include the License file
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * at opensso/legal/CDDLv1.0.txt.
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * If applicable, add the following below the CDDL Header,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * with the fields enclosed by brackets [] replaced by
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * your own identifying information:
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * $Id: DelegationIsAllowedSubResourceTest.java,v 1.3 2009/12/22 18:00:24 veiming Exp $
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * Portions Copyrighted 2014-2015 ForgeRock AS
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpackage com.sun.identity.entitlement;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.sso.SSOException;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.iplanet.sso.SSOToken;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.delegation.DelegationEvaluator;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.delegation.DelegationEvaluatorImpl;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.delegation.DelegationPermission;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.entitlement.opensso.OpenSSOUserSubject;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.entitlement.opensso.SubjectUtils;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.entitlement.util.AuthUtils;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.entitlement.util.IdRepoUtils;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.idm.AMIdentity;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.idm.IdRepoException;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.security.AdminTokenAction;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.sm.SMSEntry;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport com.sun.identity.sm.SMSException;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.security.AccessController;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.Collections;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.HashMap;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.HashSet;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.Map;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport java.util.Set;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport javax.security.auth.Subject;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport org.testng.annotations.AfterClass;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport org.testng.annotations.BeforeClass;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterimport org.testng.annotations.Test;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster/**
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster *
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster * @author dennis
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster */
8af80418ba1ec431c8027fa9668e5678658d3611Allan Fosterpublic class DelegationIsAllowedSubResourceTest {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String APPL_NAME =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        "DelegationIsAllowedSubResourceTest";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String USER1 =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        "DelegationIsAllowedSubResourceTestUser1";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String PRIVILEGE_NAME =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        "DelegationIsAllowedSubResourceTestPrivilege";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String PRIVILEGE_NAME1 = PRIVILEGE_NAME + "1";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String DELEGATE_PRIVILEGE_NAME =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        "DelegationIsAllowedSubResourceTestDelegationPrivilege";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String DELEGATED_RESOURCE_BASE =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        "http://www.www.delegationisallowedsubresourcetest.com.com";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private static final String DELEGATED_RESOURCE = DELEGATED_RESOURCE_BASE +
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        "/user";
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            AdminTokenAction.getInstance());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private Subject adminSubject = SubjectUtils.createSubject(adminToken);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private boolean migrated = EntitlementConfiguration.getInstance(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        adminSubject, "/").migratedToEntitlementService();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private AMIdentity user1;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    @BeforeClass
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public void setup()
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        throws Exception {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (!migrated) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Application appl = new Application("/", APPL_NAME,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ApplicationTypeManager.getAppplicationType(adminSubject,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ApplicationTypeManager.URL_APPLICATION_TYPE_NAME));
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        // Test disabled, unable to fix model change
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        // Set<String> appResources = new HashSet<String>();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        // appResources.add(DELEGATED_RESOURCE_BASE);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        // appl.addResources(appResources);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        appl.setEntitlementCombiner(DenyOverride.class);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ApplicationManager.saveApplication(adminSubject, "/", appl);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        user1 = IdRepoUtils.createUser("/", USER1);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        createDelegationPrivilege();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        createPrivilege();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    @AfterClass
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public void cleanup() throws Exception {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (!migrated) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            return;
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        PrivilegeManager pm = PrivilegeManager.getInstance("/", adminSubject);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        pm.remove(PRIVILEGE_NAME1);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ApplicationPrivilegeManager apm =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ApplicationPrivilegeManager.getInstance("/", adminSubject);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        apm.removePrivilege(DELEGATE_PRIVILEGE_NAME);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        IdRepoUtils.deleteIdentity("/", user1);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ApplicationManager.deleteApplication(adminSubject, "/",
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            APPL_NAME);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private void createPrivilege() throws EntitlementException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        PrivilegeManager pm = PrivilegeManager.getInstance("/", adminSubject);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Map<String, Boolean> actionValues = new HashMap<String, Boolean>();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        actionValues.put("GET", Boolean.TRUE);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Entitlement entitlement = new Entitlement(APPL_NAME,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            DELEGATED_RESOURCE_BASE, actionValues);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        OpenSSOUserSubject subject = new OpenSSOUserSubject(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            "id=isallowedtestdummy,ou=user," + SMSEntry.getRootSuffix());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Privilege privilege1 = Privilege.getNewInstance();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        privilege1.setName(PRIVILEGE_NAME1);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        privilege1.setEntitlement(entitlement);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        privilege1.setSubject(subject);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        pm.add(privilege1);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    private void createDelegationPrivilege()
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        throws SMSException, EntitlementException, SSOException,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        IdRepoException,
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        InterruptedException {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ApplicationPrivilege ap = new ApplicationPrivilege(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            DELEGATE_PRIVILEGE_NAME);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        OpenSSOUserSubject sbj = new OpenSSOUserSubject();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        sbj.setID(user1.getUniversalId());
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Set<SubjectImplementation> subjects = new HashSet<SubjectImplementation>();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        subjects.add(sbj);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ap.setSubject(subjects);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Map<String, Set<String>> appRes = new HashMap<String, Set<String>>();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Set<String> res = new HashSet<String>();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        appRes.put(APPL_NAME, res);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        res.add(DELEGATED_RESOURCE);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ap.setApplicationResources(appRes);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ap.setActionValues(ApplicationPrivilege.PossibleAction.READ);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        ApplicationPrivilegeManager apm =
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            ApplicationPrivilegeManager.getInstance("/", adminSubject);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        apm.addPrivilege(ap);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    @Test
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    public void test() throws Exception {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        Set<String> actions = new HashSet<String>();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        actions.add("READ");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        SSOToken token = AuthUtils.authenticate("/", USER1, USER1);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        DelegationPermission dp = new DelegationPermission("/",
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            "sunEntitlementService", "1.0", "application",
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            "default/application/*",
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            actions, null);
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        DelegationEvaluator de = new DelegationEvaluatorImpl();
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        if (!de.isAllowed(token, dp, Collections.EMPTY_MAP, true)) {
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster            throw new Exception(
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster                "DelegationIsAllowedSubResourceTest.test: failed");
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster        }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster    }
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster}
8af80418ba1ec431c8027fa9668e5678658d3611Allan Foster