DelegationIsAllowedSubResourceTest.java revision d1b57e78cf72f41c7c6a52bd7c2a6d6aa4da6ba4
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive/**
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive *
5f5d1b4cc970b7f06ff8ef6526128e9a27303d88nd * Copyright (c) 2009 Sun Microsystems Inc. All Rights Reserved
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive *
acc36ab93565d2880447d535da6ca6e5feac7a70nd * The contents of this file are subject to the terms
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding * of the Common Development and Distribution License
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding * (the License). You may not use this file except in
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding * compliance with the License.
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding *
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding * You can obtain a copy of the License at
db479b48bd4d75423ed4a45e15b75089d1a8ad72fielding * https://opensso.dev.java.net/public/CDDLv1.0.html or
acc36ab93565d2880447d535da6ca6e5feac7a70nd * opensso/legal/CDDLv1.0.txt
acc36ab93565d2880447d535da6ca6e5feac7a70nd * See the License for the specific language governing
acc36ab93565d2880447d535da6ca6e5feac7a70nd * permission and limitations under the License.
acc36ab93565d2880447d535da6ca6e5feac7a70nd *
acc36ab93565d2880447d535da6ca6e5feac7a70nd * When distributing Covered Code, include this CDDL
acc36ab93565d2880447d535da6ca6e5feac7a70nd * Header Notice in each file and include the License file
acc36ab93565d2880447d535da6ca6e5feac7a70nd * at opensso/legal/CDDLv1.0.txt.
acc36ab93565d2880447d535da6ca6e5feac7a70nd * If applicable, add the following below the CDDL Header,
acc36ab93565d2880447d535da6ca6e5feac7a70nd * with the fields enclosed by brackets [] replaced by
acc36ab93565d2880447d535da6ca6e5feac7a70nd * your own identifying information:
7db9f691a00ead175b03335457ca296a33ddf31bnd * "Portions Copyrighted [year] [name of copyright owner]"
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive *
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive * $Id: DelegationIsAllowedSubResourceTest.java,v 1.3 2009/12/22 18:00:24 veiming Exp $
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive *
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive * Portions Copyrighted 2014 ForgeRock AS
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive */
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
860b4efe27e7c1c9a2bf5c872b29c90f76849b51jimpackage com.sun.identity.entitlement;
193ba167383a0599478b84ea51ac9ddec2bc0328rbowen
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8sliveimport com.iplanet.sso.SSOException;
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8sliveimport com.iplanet.sso.SSOToken;
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8sliveimport com.sun.identity.delegation.DelegationEvaluator;
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8sliveimport com.sun.identity.delegation.DelegationPermission;
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8sliveimport com.sun.identity.entitlement.opensso.OpenSSOUserSubject;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.entitlement.opensso.SubjectUtils;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.entitlement.util.AuthUtils;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.entitlement.util.IdRepoUtils;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.idm.AMIdentity;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.idm.IdRepoException;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.security.AdminTokenAction;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.sm.SMSEntry;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport com.sun.identity.sm.SMSException;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport java.security.AccessController;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport java.util.Collections;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport java.util.HashMap;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport java.util.HashSet;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport java.util.Map;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport java.util.Set;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport javax.security.auth.Subject;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport org.testng.annotations.AfterClass;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport org.testng.annotations.BeforeClass;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenimport org.testng.annotations.Test;
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen/**
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen *
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen * @author dennis
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen */
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowenpublic class DelegationIsAllowedSubResourceTest {
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen private static final String APPL_NAME =
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen "DelegationIsAllowedSubResourceTest";
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen private static final String USER1 =
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen "DelegationIsAllowedSubResourceTestUser1";
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen private static final String PRIVILEGE_NAME =
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen "DelegationIsAllowedSubResourceTestPrivilege";
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private static final String PRIVILEGE_NAME1 = PRIVILEGE_NAME + "1";
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
96aee4c18ac74113f91235b99233431769cd1e31jsl private static final String DELEGATE_PRIVILEGE_NAME =
193ba167383a0599478b84ea51ac9ddec2bc0328rbowen "DelegationIsAllowedSubResourceTestDelegationPrivilege";
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private static final String DELEGATED_RESOURCE_BASE =
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive "http://www.www.delegationisallowedsubresourcetest.com.com";
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private static final String DELEGATED_RESOURCE = DELEGATED_RESOURCE_BASE +
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive "/user";
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private SSOToken adminToken = (SSOToken) AccessController.doPrivileged(
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive AdminTokenAction.getInstance());
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private Subject adminSubject = SubjectUtils.createSubject(adminToken);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private boolean migrated = EntitlementConfiguration.getInstance(
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive adminSubject, "/").migratedToEntitlementService();
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private AMIdentity user1;
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive @BeforeClass
96aee4c18ac74113f91235b99233431769cd1e31jsl public void setup()
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive throws Exception {
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
96aee4c18ac74113f91235b99233431769cd1e31jsl if (!migrated) {
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive return;
38bbf5ea004d668e9a47ac1af2273c659a2747f5nd }
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen
9b4686eb1b0da187469acf6032db0ab3967ed8ddrbowen Application appl = new Application("/", APPL_NAME,
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive ApplicationTypeManager.getAppplicationType(adminSubject,
27b42eee5c7ea26114f3cc43da7940de7f5731aferikabele ApplicationTypeManager.URL_APPLICATION_TYPE_NAME));
e302f38fd646764ce1a1e1c578d794aef514a9e5sf Set<String> appResources = new HashSet<String>();
27b42eee5c7ea26114f3cc43da7940de7f5731aferikabele appResources.add(DELEGATED_RESOURCE_BASE);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive appl.addResources(appResources);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive appl.setEntitlementCombiner(DenyOverride.class);
96aee4c18ac74113f91235b99233431769cd1e31jsl ApplicationManager.saveApplication(adminSubject, "/", appl);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive user1 = IdRepoUtils.createUser("/", USER1);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive createDelegationPrivilege();
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive createPrivilege();
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive }
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive @AfterClass
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive public void cleanup() throws Exception {
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive if (!migrated) {
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive return;
b6e82ec3e4e7edb7cb3680da11b2cc390fc0deb8jsl }
4a13940dc2990df0a798718d3a3f9cf1566c2217bjh
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive PrivilegeManager pm = PrivilegeManager.getInstance("/", adminSubject);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive pm.remove(PRIVILEGE_NAME1);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
96aee4c18ac74113f91235b99233431769cd1e31jsl ApplicationPrivilegeManager apm =
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen ApplicationPrivilegeManager.getInstance("/", adminSubject);
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen apm.removePrivilege(DELEGATE_PRIVILEGE_NAME);
860b4efe27e7c1c9a2bf5c872b29c90f76849b51jim
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen IdRepoUtils.deleteIdentity("/", user1);
96aee4c18ac74113f91235b99233431769cd1e31jsl ApplicationManager.deleteApplication(adminSubject, "/",
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive APPL_NAME);
860b4efe27e7c1c9a2bf5c872b29c90f76849b51jim }
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private void createPrivilege() throws EntitlementException {
96aee4c18ac74113f91235b99233431769cd1e31jsl PrivilegeManager pm = PrivilegeManager.getInstance("/", adminSubject);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive Map<String, Boolean> actionValues = new HashMap<String, Boolean>();
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen actionValues.put("GET", Boolean.TRUE);
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen Entitlement entitlement = new Entitlement(APPL_NAME,
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen DELEGATED_RESOURCE_BASE, actionValues);
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen OpenSSOUserSubject subject = new OpenSSOUserSubject(
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen "id=isallowedtestdummy,ou=user," + SMSEntry.getRootSuffix());
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen Privilege privilege1 = Privilege.getNewInstance();
53bf1cfe583762b91a0022a3f072a7897d825df1rbowen privilege1.setName(PRIVILEGE_NAME1);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive privilege1.setEntitlement(entitlement);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive privilege1.setSubject(subject);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive pm.add(privilege1);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive }
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive private void createDelegationPrivilege()
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive throws SMSException, EntitlementException, SSOException,
d7750613d638753810c10ba58a57806def872c8dsf IdRepoException,
d7750613d638753810c10ba58a57806def872c8dsf InterruptedException {
d7750613d638753810c10ba58a57806def872c8dsf
d7750613d638753810c10ba58a57806def872c8dsf ApplicationPrivilege ap = new ApplicationPrivilege(
d7750613d638753810c10ba58a57806def872c8dsf DELEGATE_PRIVILEGE_NAME);
96aee4c18ac74113f91235b99233431769cd1e31jsl OpenSSOUserSubject sbj = new OpenSSOUserSubject();
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive sbj.setID(user1.getUniversalId());
b6e82ec3e4e7edb7cb3680da11b2cc390fc0deb8jsl Set<SubjectImplementation> subjects = new HashSet<SubjectImplementation>();
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive subjects.add(sbj);
96aee4c18ac74113f91235b99233431769cd1e31jsl ap.setSubject(subjects);
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive Map<String, Set<String>> appRes = new HashMap<String, Set<String>>();
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive Set<String> res = new HashSet<String>();
35702d372b14ed702a8ea6bf3ba7fb0f6838cea8slive appRes.put(APPL_NAME, res);
96aee4c18ac74113f91235b99233431769cd1e31jsl res.add(DELEGATED_RESOURCE);
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen ap.setApplicationResources(appRes);
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen ap.setActionValues(ApplicationPrivilege.PossibleAction.READ);
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen ApplicationPrivilegeManager apm =
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen ApplicationPrivilegeManager.getInstance("/", adminSubject);
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen apm.addPrivilege(ap);
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen }
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen @Test
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen public void test() throws Exception {
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen Set<String> actions = new HashSet<String>();
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen actions.add("READ");
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen SSOToken token = AuthUtils.authenticate("/", USER1, USER1);
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen DelegationPermission dp = new DelegationPermission("/",
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen "sunEntitlementService", "1.0", "application",
b47bddbe88fb1489893591d69d4ccab9b873af68humbedooh "default/application/*",
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen actions, null);
b47bddbe88fb1489893591d69d4ccab9b873af68humbedooh DelegationEvaluator de = new DelegationEvaluator();
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen if (!de.isAllowed(token, dp, Collections.EMPTY_MAP, true)) {
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen throw new Exception(
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen "DelegationIsAllowedSubResourceTest.test: failed");
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen }
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen }
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen}
0335f6ccd1c6e42c576a393335a365d67df6d3cerbowen