Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Fix 492 #494

Open
wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

WIP: Fix 492 #494

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
49fcf23
improving the tests
shimono Oct 10, 2019
86f5067
fix 492
shimono Oct 10, 2019
016079d
Merge branch 'develop' into feature-492
shimono Nov 18, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/main/java/io/personium/core/auth/AccessContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -737,7 +737,7 @@ private static AccessContext createBearerAuthz(String authzHeaderValue, Cell cel
} else if (PersoniumUnitConfig.getMasterToken().equals(accessToken) && xPersoniumUnitUser != null) {
//Demote from master to unit user token with X-Personium-UnitUser header specification
AccessContext ret = new AccessContext(TYPE_UNIT_USER, cell, baseUri, uriInfo);
ret.subject = xPersoniumUnitUser;
ret.subject = UriUtils.resolveLocalUnit(xPersoniumUnitUser);
return ret;
}
//Since, Cell level.
Expand Down Expand Up @@ -961,7 +961,7 @@ private static AccessContext createAccessContext(Cell cell, String requestURIHos
ret = new AccessContext(TYPE_UNIT_ADMIN, cell, baseUri, uriInfo);
} else {
// If there is an X-Personium-UnitUser header, UnitUser
ret.subject = xPersoniumUnitUser;
ret.subject = UriUtils.resolveLocalUnit(xPersoniumUnitUser);
}
} else if (cellContentsReaderUrl.equals(roleUrl) && unitUserRole == null) {
// If roles are not set, set the CellContentsReader role.
Expand Down
81 changes: 26 additions & 55 deletions src/test/java/io/personium/core/auth/AccessContextTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@
import io.personium.core.model.Box;
import io.personium.core.model.Cell;
import io.personium.core.odata.OEntityWrapper;
import io.personium.core.utils.UriUtils;
import io.personium.core.rs.PersoniumCoreApplication;
import io.personium.test.categories.Unit;
import io.personium.test.utils.UrlUtils;
Expand Down Expand Up @@ -97,61 +98,9 @@ public static void beforeClass() throws Exception {
PersoniumUnitConfig.getX509Certificate(), PersoniumUnitConfig.getX509RootCertificate());
}

/**
* testGetCellのテスト.
*/
@Test
@Ignore
public void testGetCell() {
fail("Not yet implemented");
}

/**
* testGetTypeのテスト.
*/
@Test
@Ignore
public void testGetType() {
fail("Not yet implemented");
}

/**
* testGetSubjectのテスト.
*/
@Test
@Ignore
public void testGetSubject() {
fail("Not yet implemented");
}

/**
* testGetSchemaのテスト.
*/
@Test
@Ignore
public void testGetSchema() {
fail("Not yet implemented");
}

/**
* testAddRoleのテスト.
*/
@Test
@Ignore
public void testAddRole() {
fail("Not yet implemented");
}

/**
* testGetRoleListのテスト.
*/
@Test
@Ignore
public void testGetRoleList() {
fail("Not yet implemented");
}

/**
* testing create method.
*/
@Test
public void create_NoAuthzHeader_ShouldReturn_TypeAnonymous() {
Expand All @@ -161,9 +110,10 @@ public void create_NoAuthzHeader_ShouldReturn_TypeAnonymous() {
// 第1引数は AuthHeader, 第2引数は UriInfo, 第3引数は cookie_peer, 第4引数は cookie内の暗号化されたトークン情報
AccessContext accessContext = AccessContext.create(null, null, null, null,
cell, BASE_URL, UrlUtils.getHost(), OWNER);
assertEquals(accessContext.getType(), AccessContext.TYPE_ANONYMOUS);
assertEquals(AccessContext.TYPE_ANONYMOUS, accessContext.getType());
}


@Test
public void create_Basic_Valid_ShouldReturn_TypeBasic() {
String auth = "Basic "
Expand Down Expand Up @@ -200,7 +150,6 @@ public void create_Basic_INVALID() {
AccessContext accessContext = AccessContext.create(auth,
null, null, null, cell, BASE_URL, UrlUtils.getHost(), OWNER);
assertEquals(accessContext.getType(), AccessContext.TYPE_INVALID);

}

/**
Expand Down Expand Up @@ -400,6 +349,28 @@ public void create_Bearer_VisitorLocalAccessToken_WithSchemaWithConfidentialMark
ac.checkSchemaMatches(box);
}

/**
* When X-Personium-UnitUser is a URL with personium-localunit scheme, then subject should be normalized to http scheme.
*/
@Test
public void When_XPersoniumUnitUserHeader_localunitScheme_Then_Subject_ShouldBe_NormalizedToHttpSchema() {
Cell cell = (Cell) mock(Cell.class);
when(cell.authenticateAccount((OEntityWrapper) Matchers.any(), Matchers.anyString())).thenReturn(true);
when(cell.getOwnerNormalized()).thenReturn("cellowner");

UriInfo uriInfo = new TestUriInfo();
String masterTokenAuth = "Bearer " + MASTER_TOKEN;
String unitUser = "personium-localunit:supercell:#unituser";
String subjectShouldBe = UriUtils.resolveLocalUnit(unitUser);;

AccessContext accessContext = AccessContext.create(masterTokenAuth, uriInfo, null, null,
cell, BASE_URL, UrlUtils.getHost(), unitUser);
assertEquals(AccessContext.TYPE_UNIT_USER, accessContext.getType());
assertEquals(subjectShouldBe, accessContext.getSubject());
}



/**
* ダミーの UriInfo実装.
*/
Expand Down
5 changes: 3 additions & 2 deletions src/test/java/io/personium/core/rs/unit/UnitCtlResourceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
/**
* personium.io
* Copyright 2017 FUJITSU LIMITED
* Personium
* Copyright 2017-2019 Personium Project
* - FUJITSU LIMITED
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand Down
50 changes: 29 additions & 21 deletions src/test/java/io/personium/test/jersey/unit/PerCellSubdomainMode_UnitUserCellTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,8 @@ public class PerCellSubdomainMode_UnitUserCellTest extends PersoniumTest {
private static String unitUserToken = null;

/**
* Constructor. テスト対象のパッケージをsuperに渡す必要がある
* Constructor.
* Need to pass the target package to super
*/
public PerCellSubdomainMode_UnitUserCellTest() {
super(new PersoniumCoreApplication());
Expand Down Expand Up @@ -171,9 +172,9 @@ private static void deleteUnitAdminRole() {


private static void linkUuAccountAndUnitAdminRole() {
// LinksUtils.createLinks(UNIT_USER_CELL, Account.EDM_TYPE_NAME, UNIT_USER_ACCOUNT, null, Role.EDM_TYPE_NAME,
// unitAdminRole, null, AbstractCase.MASTER_TOKEN_NAME, HttpStatus.SC_NO_CONTENT);
String roleODataUrl = unitUserCellUrl + "__ctl/Role(Name=%27" + unitAdminRole + "%27)";
// LinksUtils.createLinks(UNIT_USER_CELL, Account.EDM_TYPE_NAME, UNIT_USER_ACCOUNT, null, Role.EDM_TYPE_NAME,
// unitAdminRole, null, AbstractCase.MASTER_TOKEN_NAME, HttpStatus.SC_NO_CONTENT);
String roleODataUrl = unitUserCellUrl + "__ctl/Role('" + unitAdminRole + "')";
String accountRoleLinkUrl = unitUserCellUrl + "__ctl/Account(%27" + UNIT_USER_ACCOUNT + "%27)/$links/_Role";
try (CloseableHttpClient client = HttpClientFactory.create(HttpClientFactory.TYPE_ALWAYS_LOCAL)) {
HttpPost post = new HttpPost(accountRoleLinkUrl);
Expand All @@ -183,16 +184,18 @@ private static void linkUuAccountAndUnitAdminRole() {
.build().toString();
HttpEntity entity = new StringEntity(jsonStr);
post.setEntity(entity);
client.execute(post);
try(CloseableHttpResponse res = client.execute(post)){
assertEquals(204, res.getStatusLine().getStatusCode());
};
} catch (Exception e) {
e.printStackTrace();
}
}


private static void createUnitAdminRole() {
// RoleUtils.create(UNIT_USER_CELL, AbstractCase.MASTER_TOKEN_NAME, unitAdminRole,
// null, HttpStatus.SC_CREATED);
// RoleUtils.create(UNIT_USER_CELL, AbstractCase.MASTER_TOKEN_NAME, unitAdminRole,
// null, HttpStatus.SC_CREATED);
String roleODataUrl = unitUserCellUrl + "__ctl/Role";
try (CloseableHttpClient client = HttpClientFactory.create(HttpClientFactory.TYPE_ALWAYS_LOCAL)) {
HttpPost post = new HttpPost(roleODataUrl);
Expand Down Expand Up @@ -303,12 +306,10 @@ public static void afterClass() {
log.info(" OWNER = " + owner);
assertEquals(localunitSubject, owner);


} finally {
// Delete Unit User Account
deleteUnitUserAccount();


// 本テスト用セルの削除
CellUtils.delete(AbstractCase.MASTER_TOKEN_NAME, CREATE_CELL, -1);
// Delete Unit User Cell for the tests
Expand Down Expand Up @@ -377,10 +378,10 @@ public static void afterClass() {
* ユニットアドミンロールをもつユニットユーザートークンでセル作成を行いオーナーが設定されないことを確認.
*/
@Test
public void ユニットアドミンロールをもつユニットユーザートークンでセル作成を行いオーナーが設定されないことを確認() {

public void ユニットアドミンロールをもつユニットユーザートークンでセル作成を行いオーナーが設定されないことを確認()
throws Exception {
try {
// 本テスト用セルの作成
// 本テスト用 Unit User Cell の作成
CellUtils.create(UNIT_USER_CELL, AbstractCase.MASTER_TOKEN_NAME, HttpStatus.SC_CREATED);

// アカウント追加
Expand All @@ -392,24 +393,31 @@ public static void afterClass() {
// linkUnit AdminRole with account
linkUuAccountAndUnitAdminRole();


// 認証（ユニットユーザートークン取得）
unitUserToken = getUnitUserToken();
TransCellAccessToken uu1 = TransCellAccessToken.parse(unitUserToken);
log.info("UUT1 with subject: " + uu1.getSubject());
log.info("Roles: " + uu1.getRoleList().size());

// ユニットユーザートークンを使ってセル作成をするとオーナーがユニットユーザー（ここだとuserNameアカウントのURL）になるはず。
// Unit User Token トークンを使ってセル作成をするとオーナーが
// Unit User Token （ここだとuserNameアカウントのURL）になるはず。
log.info("Creating Cell with UUT1: " + CREATE_CELL);
CellUtils.create(CREATE_CELL, unitUserToken, HttpStatus.SC_CREATED);

// UnitUserTokenを自作
TransCellAccessToken tcat = new TransCellAccessToken(UrlUtils.cellRoot(UNIT_USER_CELL),
UrlUtils.subjectUrl(UNIT_USER_CELL, UNIT_USER_ACCOUNT),
// Unit User Token を自作
String subj = UrlUtils.subjectUrl(UNIT_USER_CELL, UNIT_USER_ACCOUNT);
log.info("UUT2 with subject: " + subj);
TransCellAccessToken uut2 = new TransCellAccessToken(UrlUtils.cellRoot(UNIT_USER_CELL), subj,
UrlUtils.getBaseUrl() + "/", new ArrayList<Role>(), null, null);

// ユニットユーザトークンでは取得できないことを確認
CellUtils.get(CREATE_CELL, tcat.toTokenString(), HttpStatus.SC_FORBIDDEN);
// Unit User Token では取得できないことを確認
log.info("Getting the cell with UUT2 should fail");
CellUtils.get(CREATE_CELL, uut2.toTokenString(), HttpStatus.SC_FORBIDDEN);

// セルのオーナーが見指定のため、マスタートークンのオーナーヘッダ指定を使うと取得不可なことを確認
// セルのオーナーが未指定のため、マスタートークンのオーナーヘッダ指定を使うと取得不可なことを確認
log.info("Getting the cell with UMT with subj fail. Subj= " + subj);
CellUtils.get(CREATE_CELL, AbstractCase.MASTER_TOKEN_NAME,
UrlUtils.subjectUrl(UNIT_USER_CELL, UNIT_USER_ACCOUNT), HttpStatus.SC_FORBIDDEN);
subj, HttpStatus.SC_FORBIDDEN);

// オーナーが設定されていないのでマスタートークンのみアクセス可能
CellUtils.get(CREATE_CELL, AbstractCase.MASTER_TOKEN_NAME, HttpStatus.SC_OK);
Expand Down
40 changes: 25 additions & 15 deletions src/test/java/io/personium/test/jersey/unit/UnitUserCellTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,8 @@ public class UnitUserCellTest extends PersoniumTest {
private static String urlModeBackup = "";

/**
* Constructor. テスト対象のパッケージをsuperに渡す必要がある
* Constructor.
* Need to pass the target package to super
*/
public UnitUserCellTest() {
super(new PersoniumCoreApplication());
Expand Down Expand Up @@ -279,15 +280,15 @@ public static void afterClass() {


/**
* ユニットアドミンロールをもつユニットユーザートークンでセル作成を行いオーナーが設定されないことを確認.
* UnitAdmin Role をもつUnit User Tokenでセル作成を行いOwnerが設定されないことを確認.
* @throws Exception
*/
@Test
public void ユニットアドミンロールをもつユニットユーザートークンでセル作成を行いオーナーが設定されないことを確認() {

public void ユニットアドミンロールをもつユニットユーザートークンでセル作成を行いオーナーが設定されないことを確認()
throws Exception {
try {
// 本テスト用セルの作成
// 本テスト用 Unit User Cell の作成
CellUtils.create(UNIT_USER_CELL, AbstractCase.MASTER_TOKEN_NAME, HttpStatus.SC_CREATED);

// アカウント追加
AccountUtils.create(AbstractCase.MASTER_TOKEN_NAME, UNIT_USER_CELL,
UNIT_USER_ACCOUNT, UNIT_USER_ACCOUNT_PASS, HttpStatus.SC_CREATED);
Expand All @@ -311,19 +312,28 @@ public static void afterClass() {

JSONObject json = res.bodyAsJson();
String unitUserToken = (String) json.get(OAuth2Helper.Key.ACCESS_TOKEN);

// ユニットユーザートークンを使ってセル作成をするとオーナーがユニットユーザー（ここだとuserNameアカウントのURL）になるはず。
TransCellAccessToken uut1 = TransCellAccessToken.parse(unitUserToken);
log.info("UUT1 with subject: " + uut1.getSubject());
log.info("Roles: " + uut1.getRoleList().size());
log.info("UUT1 with subject: " + uut1.getSubject());

// Unit User Token を使ってセル作成をするとオーナーが
// Unit User Token （ここだとuserNameアカウントのURL）になるはず。
log.info("Creating Cell with UUT1: " + CREATE_CELL);
CellUtils.create(CREATE_CELL, unitUserToken, HttpStatus.SC_CREATED);

// UnitUserTokenを自作
TransCellAccessToken tcat = new TransCellAccessToken(UrlUtils.cellRoot(UNIT_USER_CELL),
UrlUtils.subjectUrl(UNIT_USER_CELL, UNIT_USER_ACCOUNT),
UrlUtils.getBaseUrl() + "/", new ArrayList<Role>(), null, null);
// Unit User Token を自作
String subj = UrlUtils.subjectUrl(UNIT_USER_CELL, UNIT_USER_ACCOUNT);
log.info("UUT2 with subject: " + subj);
TransCellAccessToken uut2 = new TransCellAccessToken(UrlUtils.cellRoot(UNIT_USER_CELL),
subj, UrlUtils.getBaseUrl() + "/", new ArrayList<Role>(), null, null);

// ユニットユーザトークンでは取得できないことを確認
CellUtils.get(CREATE_CELL, tcat.toTokenString(), HttpStatus.SC_FORBIDDEN);
// Unit User Token では取得できないことを確認
log.info("Getting the cell with UUT2 should fail");
CellUtils.get(CREATE_CELL, uut2.toTokenString(), HttpStatus.SC_FORBIDDEN);

// セルのオーナーが見指定のため、マスタートークンのオーナーヘッダ指定を使うと取得不可なことを確認
// セルのオーナーが未指定のため、マスタートークンのオーナーヘッダ指定を使うと取得不可なことを確認
log.info("Getting the cell with UMT with subj fail. Subj= " + subj);
CellUtils.get(CREATE_CELL, AbstractCase.MASTER_TOKEN_NAME,
UrlUtils.subjectUrl(UNIT_USER_CELL, UNIT_USER_ACCOUNT), HttpStatus.SC_FORBIDDEN);

Expand Down