You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by dr...@apache.org on 2015/12/25 22:48:09 UTC
directory-kerby git commit: Renamed some KDC tests
Repository: directory-kerby
Updated Branches:
refs/heads/master 604d3fcc4 -> 11a9e23da
Renamed some KDC tests
Project: http://git-wip-us.apache.org/repos/asf/directory-kerby/repo
Commit: http://git-wip-us.apache.org/repos/asf/directory-kerby/commit/11a9e23d
Tree: http://git-wip-us.apache.org/repos/asf/directory-kerby/tree/11a9e23d
Diff: http://git-wip-us.apache.org/repos/asf/directory-kerby/diff/11a9e23d
Branch: refs/heads/master
Commit: 11a9e23da1f0966220dd9e97df2bc6cb32d64114
Parents: 604d3fc
Author: Kai Zheng <ka...@intel.com>
Authored: Sat Dec 26 05:47:55 2015 +0800
Committer: Kai Zheng <ka...@intel.com>
Committed: Sat Dec 26 05:47:55 2015 +0800
----------------------------------------------------------------------
.../kerby/kerberos/kdc/AccessTokenKdcTest.java | 148 ++++++++++++++++
.../kerberos/kdc/AnonymousPkinitKdcTest.java | 3 +
.../kerberos/kdc/IdentityTokenKdcTest.java | 160 +++++++++++++++++
.../kerby/kerberos/kdc/PkinitKdcTest.java | 115 ++++++++++++
.../kerby/kerberos/kdc/TokenKdcTestBase.java | 176 +++++++++++++++++++
.../kerberos/kdc/WithAccessTokenKdcTest.java | 148 ----------------
.../kerby/kerberos/kdc/WithCertKdcTest.java | 111 ------------
.../kerberos/kdc/WithIdentityTokenKdcTest.java | 160 -----------------
.../kerberos/kdc/WithTokenKdcTestBase.java | 176 -------------------
9 files changed, 602 insertions(+), 595 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AccessTokenKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AccessTokenKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AccessTokenKdcTest.java
new file mode 100644
index 0000000..57b2b1b
--- /dev/null
+++ b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AccessTokenKdcTest.java
@@ -0,0 +1,148 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kdc;
+
+import java.io.InputStream;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.client.KrbTokenClient;
+import org.apache.kerby.kerberos.kerb.common.PrivateKeyReader;
+import org.apache.kerby.kerberos.kerb.common.PublicKeyReader;
+import org.apache.kerby.kerberos.kerb.server.TestKdcServer;
+import org.apache.kerby.kerberos.kerb.type.ticket.SgtTicket;
+import org.junit.Assert;
+import org.junit.Test;
+
+public class AccessTokenKdcTest extends TokenKdcTestBase {
+
+ @Test
+ public void testRequestServiceTicketWithAccessToken() throws Exception {
+ prepareToken(getServerPrincipal());
+ performTest();
+ }
+
+ @Test
+ public void testBadIssuer() throws Exception {
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
+ PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
+ prepareToken(getServerPrincipal(), "oauth1.com", privateKey, null);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad issuer value");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testBadAudienceRestriction() throws Exception {
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
+ PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
+ prepareToken("bad-service" + "/" + getHostname() + "@" + TestKdcServer.KDC_REALM,
+ ISSUER, privateKey, null);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad audience restriction value");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testUnsignedToken() throws Exception {
+ prepareToken(getServerPrincipal(), ISSUER, null, null);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on an unsigned token");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testSignedTokenWithABadKey() throws Exception {
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ KeyPair keyPair = keyGen.generateKeyPair();
+ prepareToken(getServerPrincipal(), ISSUER, keyPair.getPrivate(), null);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad key");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testSignedEncryptedToken() throws Exception {
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
+ PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
+
+ is = TokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
+ PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
+
+ prepareToken(getServerPrincipal(), ISSUER, privateKey, publicKey);
+
+ performTest();
+ }
+
+ @Test
+ public void testSignedEncryptedTokenBadSigningKey() throws Exception {
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ KeyPair keyPair = keyGen.generateKeyPair();
+
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
+ PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
+
+ prepareToken(getServerPrincipal(), ISSUER, keyPair.getPrivate(), publicKey);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad key");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ private void performTest() throws Exception {
+ createCredentialCache(getClientPrincipal(), getClientPassword());
+
+ KrbTokenClient tokenClient = getTokenClient();
+ try {
+ SgtTicket sgtTicket = tokenClient.requestSgt(
+ getKrbToken(), getServerPrincipal(), getcCacheFile().getPath());
+ verifyTicket(sgtTicket);
+ } finally {
+ deleteCcacheFile();
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AnonymousPkinitKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AnonymousPkinitKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AnonymousPkinitKdcTest.java
index bfd8746..215d8b0 100644
--- a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AnonymousPkinitKdcTest.java
+++ b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/AnonymousPkinitKdcTest.java
@@ -33,6 +33,9 @@ import org.junit.Test;
import static org.assertj.core.api.Assertions.assertThat;
+/**
+ * Anonymous PKINIT test.
+ */
public class AnonymousPkinitKdcTest extends KdcTestBase {
private String serverPrincipal;
private KrbPkinitClient pkinitClient;
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/IdentityTokenKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/IdentityTokenKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/IdentityTokenKdcTest.java
new file mode 100644
index 0000000..5aa2115
--- /dev/null
+++ b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/IdentityTokenKdcTest.java
@@ -0,0 +1,160 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kdc;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.client.KrbTokenClient;
+import org.apache.kerby.kerberos.kerb.common.PrivateKeyReader;
+import org.apache.kerby.kerberos.kerb.common.PublicKeyReader;
+import org.apache.kerby.kerberos.kerb.server.TestKdcServer;
+import org.apache.kerby.kerberos.kerb.type.ticket.SgtTicket;
+import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.io.InputStream;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+
+public class IdentityTokenKdcTest extends TokenKdcTestBase {
+
+ @Test
+ public void testKdc() throws Exception {
+ prepareToken(getAudience("krbtgt"));
+ performTest();
+ }
+
+ @Test
+ public void testBadIssuer() throws Exception {
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
+ PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
+ prepareToken(getAudience("krbtgt"), "oauth1.com", privateKey, null);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad issuer value");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testBadAudienceRestriction() throws Exception {
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
+ PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
+ prepareToken("krbtgt2@EXAMPLE.COM", ISSUER, privateKey, null);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad audience restriction value");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testUnsignedToken() throws Exception {
+ prepareToken(getAudience("krbtgt2"), ISSUER, null, null);
+ try {
+ performTest();
+ Assert.fail("Failure expected on an unsigned token");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testSignedTokenWithABadKey() throws Exception {
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ KeyPair keyPair = keyGen.generateKeyPair();
+ prepareToken(getAudience("krbtgt"), ISSUER, keyPair.getPrivate(), null);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad key");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ @Test
+ public void testSignedEncryptedToken() throws Exception {
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
+ PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
+
+ is = TokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
+ PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
+
+ prepareToken(getAudience("krbtgt"), ISSUER, privateKey, publicKey);
+
+ performTest();
+ }
+
+ @Test
+ public void testSignedEncryptedTokenBadSigningKey() throws Exception {
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ KeyPair keyPair = keyGen.generateKeyPair();
+
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
+ PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
+
+ prepareToken(getAudience("krbtgt"), ISSUER, keyPair.getPrivate(), publicKey);
+
+ try {
+ performTest();
+ Assert.fail("Failure expected on a bad key");
+ } catch (Exception ex) {
+ // expected
+ Assert.assertTrue(ex instanceof KrbException);
+ }
+ }
+
+ private void performTest() throws Exception {
+
+ createCredentialCache(getClientPrincipal(), getClientPassword());
+
+ TgtTicket tgt;
+ KrbTokenClient tokenClient = getTokenClient();
+ try {
+ tgt = tokenClient.requestTgt(getKrbToken(),
+ getcCacheFile().getPath());
+ } catch (KrbException e) {
+ if (e.getMessage().contains("timeout")) {
+ return;
+ }
+ throw e;
+ }
+ verifyTicket(tgt);
+
+ SgtTicket tkt = getKrbClient().requestSgt(tgt,
+ getServerPrincipal());
+ verifyTicket(tkt);
+ }
+
+ private String getAudience(String name) {
+ return name + "/" + TestKdcServer.KDC_REALM + "@" + TestKdcServer.KDC_REALM;
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/PkinitKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/PkinitKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/PkinitKdcTest.java
new file mode 100644
index 0000000..7a11eff
--- /dev/null
+++ b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/PkinitKdcTest.java
@@ -0,0 +1,115 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kdc;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.client.KrbPkinitClient;
+import org.apache.kerby.kerberos.kerb.server.KdcConfigKey;
+import org.apache.kerby.kerberos.kerb.server.KdcTestBase;
+import org.apache.kerby.kerberos.kerb.type.ticket.SgtTicket;
+import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
+import org.apache.kerby.pki.PkiLoader;
+import org.junit.Before;
+import org.junit.Test;
+
+import java.io.InputStream;
+import java.security.PrivateKey;
+import java.security.cert.Certificate;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * RSA PKINIT test.
+ */
+
+/**
+ openssl genrsa -out cakey.pem 2048
+ openssl req -key cakey.pem -new -x509 -out cacert.pem -days 3650
+ vi extensions.kdc
+ openssl genrsa -out kdckey.pem 2048
+ openssl req -new -out kdc.req -key kdckey.pem
+ env REALM=SH.INTEL.COM openssl x509 -req -in kdc.req -CAkey cakey.pem \
+ -CA cacert.pem -out kdc.pem -days 365 -extfile extensions.kdc -extensions kdc_cert -CAcreateserial
+ */
+public class PkinitKdcTest extends KdcTestBase {
+ private PkiLoader pkiLoader;
+ private String serverPrincipal;
+ private Certificate userCert;
+ private PrivateKey userKey; //NOPMD
+
+ private KrbPkinitClient pkinitClient;
+
+ @Before
+ public void setUp() throws Exception {
+ pkiLoader = new PkiLoader();
+
+ super.setUp();
+
+ pkinitClient = getPkinitClient();
+ }
+
+ @Override
+ protected void configKdcSeverAndClient() {
+ super.configKdcSeverAndClient();
+
+ String pkinitIdentity = getClass().getResource("/kdccerttest.pem").getPath() + ","
+ + getClass().getResource("/kdckey.pem").getPath();
+ String pkinitAnchors = getClass().getResource("/cacert.pem").getPath();
+ getKdcServer().getKdcConfig().setString(KdcConfigKey.PKINIT_IDENTITY, pkinitIdentity);
+ getKdcServer().getKdcConfig().setString(KdcConfigKey.PKINIT_ANCHORS, pkinitAnchors);
+ }
+
+ @Override
+ protected void setUpClient() throws Exception {
+ super.setUpClient();
+
+ loadCredentials();
+ }
+
+ @Test
+ @org.junit.Ignore
+ public void testPkinit() throws Exception {
+ assertThat(userCert).isNotNull();
+
+ TgtTicket tgt;
+ try {
+ String userCertPath = getClass().getResource("/usercert.pem").getPath();
+ String userKeyPath = getClass().getResource("/userkey.pem").getPath();
+
+ tgt = pkinitClient.requestTgt(getClientPrincipal(), userCertPath, userKeyPath);
+ } catch (KrbException te) {
+ assertThat(te.getMessage().contains("timeout")).isTrue();
+ return;
+ }
+ assertThat(tgt).isNotNull();
+
+ serverPrincipal = getServerPrincipal();
+ SgtTicket tkt = getKrbClient().requestSgt(tgt, serverPrincipal);
+ assertThat(tkt).isNotNull();
+ }
+
+ private void loadCredentials() throws Exception {
+ InputStream res = getClass().getResourceAsStream("/usercert.pem");
+ userCert = pkiLoader.loadCerts(res).iterator().next();
+
+ res = getClass().getResourceAsStream("/userkey.pem");
+ userKey = pkiLoader.loadPrivateKey(res, null);
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/TokenKdcTestBase.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/TokenKdcTestBase.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/TokenKdcTestBase.java
new file mode 100644
index 0000000..387ad52
--- /dev/null
+++ b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/TokenKdcTestBase.java
@@ -0,0 +1,176 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.kerby.kerberos.kdc;
+
+import org.apache.kerby.kerberos.kerb.KrbException;
+import org.apache.kerby.kerberos.kerb.KrbRuntime;
+import org.apache.kerby.kerberos.kerb.ccache.Credential;
+import org.apache.kerby.kerberos.kerb.ccache.CredentialCache;
+import org.apache.kerby.kerberos.kerb.common.PrivateKeyReader;
+import org.apache.kerby.kerberos.kerb.provider.TokenEncoder;
+import org.apache.kerby.kerberos.kerb.server.KdcConfigKey;
+import org.apache.kerby.kerberos.kerb.server.KdcTestBase;
+import org.apache.kerby.kerberos.kerb.type.base.AuthToken;
+import org.apache.kerby.kerberos.kerb.type.base.KrbToken;
+import org.apache.kerby.kerberos.kerb.type.base.TokenFormat;
+import org.apache.kerby.kerberos.kerb.type.ticket.KrbTicket;
+import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
+import org.apache.kerby.kerberos.provider.token.JwtTokenEncoder;
+import org.apache.kerby.kerberos.provider.token.JwtTokenProvider;
+import org.junit.Before;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URL;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class TokenKdcTestBase extends KdcTestBase {
+ static final String SUBJECT = "test-sub";
+ static final String ISSUER = "oauth2.com";
+ static final String GROUP = "sales-group";
+ static final String ROLE = "ADMIN";
+ private File cCacheFile;
+ private KrbToken krbToken;
+
+ @Before
+ public void setUp() throws Exception {
+ KrbRuntime.setTokenProvider(new JwtTokenProvider());
+ super.setUp();
+ }
+
+ @Override
+ protected void configKdcSeverAndClient() {
+ super.configKdcSeverAndClient();
+ String verifyKeyPath = this.getClass().getResource("/").getPath();
+ getKdcServer().getKdcConfig().setString(KdcConfigKey.TOKEN_VERIFY_KEYS, verifyKeyPath);
+
+ URL privateKeyPath = TokenKdcTestBase.class.getResource("/private_key.pem");
+ getKdcServer().getKdcConfig().setString(KdcConfigKey.TOKEN_DECRYPTION_KEYS, privateKeyPath.getPath());
+ getKdcServer().getKdcConfig().setString(KdcConfigKey.TOKEN_ISSUERS, ISSUER);
+ }
+
+ protected AuthToken getKrbToken() {
+ return krbToken;
+ }
+
+ protected File getcCacheFile() {
+ return cCacheFile;
+ }
+
+ protected AuthToken prepareToken(String audience) {
+ InputStream is = TokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
+ PrivateKey privateKey = null;
+ try {
+ privateKey = PrivateKeyReader.loadPrivateKey(is);
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+
+ return prepareToken(audience, ISSUER, privateKey, null);
+ }
+
+ protected AuthToken prepareToken(String audience, String issuer,
+ PrivateKey signingKey, PublicKey encryptionKey) {
+ AuthToken authToken = KrbRuntime.getTokenProvider().createTokenFactory().createToken();
+ authToken.setIssuer(issuer);
+ authToken.setSubject(SUBJECT);
+
+ authToken.addAttribute("group", GROUP);
+ authToken.addAttribute("role", ROLE);
+
+ List<String> aud = new ArrayList<String>();
+ aud.add(audience);
+ authToken.setAudiences(aud);
+
+ // Set expiration in 60 minutes
+ final Date now = new Date();
+ Date exp = new Date(now.getTime() + 1000 * 60 * 60);
+ authToken.setExpirationTime(exp);
+
+ Date nbf = now;
+ authToken.setNotBeforeTime(nbf);
+
+ Date iat = now;
+ authToken.setIssueTime(iat);
+
+ TokenEncoder tokenEncoder = KrbRuntime.getTokenProvider().createTokenEncoder();
+
+ if (tokenEncoder instanceof JwtTokenEncoder && signingKey != null) {
+ tokenEncoder.setSignKey(signingKey);
+ }
+ if (tokenEncoder instanceof JwtTokenEncoder && encryptionKey != null) {
+ tokenEncoder.setEncryptionKey(encryptionKey);
+ }
+
+ krbToken = new KrbToken();
+ krbToken.setInnerToken(authToken);
+ krbToken.setTokenType();
+ krbToken.setTokenFormat(TokenFormat.JWT);
+ try {
+ krbToken.setTokenValue(tokenEncoder.encodeAsBytes(authToken));
+ } catch (KrbException e) {
+ throw new RuntimeException("Failed to encode AuthToken", e);
+ }
+
+ return krbToken;
+ }
+
+
+ protected File createCredentialCache(String principal,
+ String password) throws Exception {
+ TgtTicket tgt = getKrbClient().requestTgt(principal, password);
+ writeTgtToCache(tgt, principal);
+ return cCacheFile;
+ }
+
+ /**
+ * Write tgt into credentials cache.
+ */
+ private void writeTgtToCache(
+ TgtTicket tgt, String principal) throws IOException {
+ Credential credential = new Credential(tgt);
+ CredentialCache cCache = new CredentialCache();
+ cCache.addCredential(credential);
+ cCache.setPrimaryPrincipal(tgt.getClientPrincipal());
+
+ String fileName = "krb5_" + principal + ".cc";
+ cCacheFile = new File(getTestDir().getPath(), fileName);
+ cCache.store(cCacheFile);
+ }
+
+ protected void deleteCcacheFile() {
+ cCacheFile.delete();
+ }
+
+ protected void verifyTicket(KrbTicket ticket) {
+ assertThat(ticket).isNotNull();
+ assertThat(ticket.getRealm()).isEqualTo(getKdcServer().getKdcSetting().getKdcRealm());
+ assertThat(ticket.getTicket()).isNotNull();
+ assertThat(ticket.getSessionKey()).isNotNull();
+ assertThat(ticket.getEncKdcRepPart()).isNotNull();
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithAccessTokenKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithAccessTokenKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithAccessTokenKdcTest.java
deleted file mode 100644
index e829625..0000000
--- a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithAccessTokenKdcTest.java
+++ /dev/null
@@ -1,148 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kdc;
-
-import java.io.InputStream;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.client.KrbTokenClient;
-import org.apache.kerby.kerberos.kerb.common.PrivateKeyReader;
-import org.apache.kerby.kerberos.kerb.common.PublicKeyReader;
-import org.apache.kerby.kerberos.kerb.server.TestKdcServer;
-import org.apache.kerby.kerberos.kerb.type.ticket.SgtTicket;
-import org.junit.Assert;
-import org.junit.Test;
-
-public class WithAccessTokenKdcTest extends WithTokenKdcTestBase {
-
- @Test
- public void testRequestServiceTicketWithAccessToken() throws Exception {
- prepareToken(getServerPrincipal());
- performTest();
- }
-
- @Test
- public void testBadIssuer() throws Exception {
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
- PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
- prepareToken(getServerPrincipal(), "oauth1.com", privateKey, null);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad issuer value");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testBadAudienceRestriction() throws Exception {
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
- PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
- prepareToken("bad-service" + "/" + getHostname() + "@" + TestKdcServer.KDC_REALM,
- ISSUER, privateKey, null);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad audience restriction value");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testUnsignedToken() throws Exception {
- prepareToken(getServerPrincipal(), ISSUER, null, null);
-
- try {
- performTest();
- Assert.fail("Failure expected on an unsigned token");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testSignedTokenWithABadKey() throws Exception {
- KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
- KeyPair keyPair = keyGen.generateKeyPair();
- prepareToken(getServerPrincipal(), ISSUER, keyPair.getPrivate(), null);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad key");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testSignedEncryptedToken() throws Exception {
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
- PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
-
- is = WithTokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
- PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
-
- prepareToken(getServerPrincipal(), ISSUER, privateKey, publicKey);
-
- performTest();
- }
-
- @Test
- public void testSignedEncryptedTokenBadSigningKey() throws Exception {
- KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
- KeyPair keyPair = keyGen.generateKeyPair();
-
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
- PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
-
- prepareToken(getServerPrincipal(), ISSUER, keyPair.getPrivate(), publicKey);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad key");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- private void performTest() throws Exception {
- createCredentialCache(getClientPrincipal(), getClientPassword());
-
- KrbTokenClient tokenClient = getTokenClient();
- try {
- SgtTicket sgtTicket = tokenClient.requestSgt(
- getKrbToken(), getServerPrincipal(), getcCacheFile().getPath());
- verifyTicket(sgtTicket);
- } finally {
- deleteCcacheFile();
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithCertKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithCertKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithCertKdcTest.java
deleted file mode 100644
index 05183ea..0000000
--- a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithCertKdcTest.java
+++ /dev/null
@@ -1,111 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kdc;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.client.KrbPkinitClient;
-import org.apache.kerby.kerberos.kerb.server.KdcConfigKey;
-import org.apache.kerby.kerberos.kerb.server.KdcTestBase;
-import org.apache.kerby.kerberos.kerb.type.ticket.SgtTicket;
-import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
-import org.apache.kerby.pki.PkiLoader;
-import org.junit.Before;
-import org.junit.Test;
-
-import java.io.InputStream;
-import java.security.PrivateKey;
-import java.security.cert.Certificate;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- openssl genrsa -out cakey.pem 2048
- openssl req -key cakey.pem -new -x509 -out cacert.pem -days 3650
- vi extensions.kdc
- openssl genrsa -out kdckey.pem 2048
- openssl req -new -out kdc.req -key kdckey.pem
- env REALM=SH.INTEL.COM openssl x509 -req -in kdc.req -CAkey cakey.pem \
- -CA cacert.pem -out kdc.pem -days 365 -extfile extensions.kdc -extensions kdc_cert -CAcreateserial
- */
-public class WithCertKdcTest extends KdcTestBase {
- private PkiLoader pkiLoader;
- private String serverPrincipal;
- private Certificate userCert;
- private PrivateKey userKey; //NOPMD
-
- private KrbPkinitClient pkinitClient;
-
- @Before
- public void setUp() throws Exception {
- pkiLoader = new PkiLoader();
-
- super.setUp();
-
- pkinitClient = getPkinitClient();
- }
-
- @Override
- protected void configKdcSeverAndClient() {
- super.configKdcSeverAndClient();
-
- String pkinitIdentity = getClass().getResource("/kdccerttest.pem").getPath() + ","
- + getClass().getResource("/kdckey.pem").getPath();
- String pkinitAnchors = getClass().getResource("/cacert.pem").getPath();
- getKdcServer().getKdcConfig().setString(KdcConfigKey.PKINIT_IDENTITY, pkinitIdentity);
- getKdcServer().getKdcConfig().setString(KdcConfigKey.PKINIT_ANCHORS, pkinitAnchors);
- }
-
- @Override
- protected void setUpClient() throws Exception {
- super.setUpClient();
-
- loadCredentials();
- }
-
- @Test
- @org.junit.Ignore
- public void testPkinit() throws Exception {
- assertThat(userCert).isNotNull();
-
- TgtTicket tgt;
- try {
- String userCertPath = getClass().getResource("/usercert.pem").getPath();
- String userKeyPath = getClass().getResource("/userkey.pem").getPath();
-
- tgt = pkinitClient.requestTgt(getClientPrincipal(), userCertPath, userKeyPath);
- } catch (KrbException te) {
- assertThat(te.getMessage().contains("timeout")).isTrue();
- return;
- }
- assertThat(tgt).isNotNull();
-
- serverPrincipal = getServerPrincipal();
- SgtTicket tkt = getKrbClient().requestSgt(tgt, serverPrincipal);
- assertThat(tkt).isNotNull();
- }
-
- private void loadCredentials() throws Exception {
- InputStream res = getClass().getResourceAsStream("/usercert.pem");
- userCert = pkiLoader.loadCerts(res).iterator().next();
-
- res = getClass().getResourceAsStream("/userkey.pem");
- userKey = pkiLoader.loadPrivateKey(res, null);
- }
-}
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithIdentityTokenKdcTest.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithIdentityTokenKdcTest.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithIdentityTokenKdcTest.java
deleted file mode 100644
index acac0a0..0000000
--- a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithIdentityTokenKdcTest.java
+++ /dev/null
@@ -1,160 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kdc;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.client.KrbTokenClient;
-import org.apache.kerby.kerberos.kerb.common.PrivateKeyReader;
-import org.apache.kerby.kerberos.kerb.common.PublicKeyReader;
-import org.apache.kerby.kerberos.kerb.server.TestKdcServer;
-import org.apache.kerby.kerberos.kerb.type.ticket.SgtTicket;
-import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
-import org.junit.Assert;
-import org.junit.Test;
-
-import java.io.InputStream;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-
-public class WithIdentityTokenKdcTest extends WithTokenKdcTestBase {
-
- @Test
- public void testKdc() throws Exception {
- prepareToken(getAudience("krbtgt"));
- performTest();
- }
-
- @Test
- public void testBadIssuer() throws Exception {
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
- PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
- prepareToken(getAudience("krbtgt"), "oauth1.com", privateKey, null);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad issuer value");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testBadAudienceRestriction() throws Exception {
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
- PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
- prepareToken("krbtgt2@EXAMPLE.COM", ISSUER, privateKey, null);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad audience restriction value");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testUnsignedToken() throws Exception {
- prepareToken(getAudience("krbtgt2"), ISSUER, null, null);
- try {
- performTest();
- Assert.fail("Failure expected on an unsigned token");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testSignedTokenWithABadKey() throws Exception {
- KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
- KeyPair keyPair = keyGen.generateKeyPair();
- prepareToken(getAudience("krbtgt"), ISSUER, keyPair.getPrivate(), null);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad key");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- @Test
- public void testSignedEncryptedToken() throws Exception {
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
- PrivateKey privateKey = PrivateKeyReader.loadPrivateKey(is);
-
- is = WithTokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
- PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
-
- prepareToken(getAudience("krbtgt"), ISSUER, privateKey, publicKey);
-
- performTest();
- }
-
- @Test
- public void testSignedEncryptedTokenBadSigningKey() throws Exception {
- KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
- KeyPair keyPair = keyGen.generateKeyPair();
-
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/oauth2.com_public_key.pem");
- PublicKey publicKey = PublicKeyReader.loadPublicKey(is);
-
- prepareToken(getAudience("krbtgt"), ISSUER, keyPair.getPrivate(), publicKey);
-
- try {
- performTest();
- Assert.fail("Failure expected on a bad key");
- } catch (Exception ex) {
- // expected
- Assert.assertTrue(ex instanceof KrbException);
- }
- }
-
- private void performTest() throws Exception {
-
- createCredentialCache(getClientPrincipal(), getClientPassword());
-
- TgtTicket tgt;
- KrbTokenClient tokenClient = getTokenClient();
- try {
- tgt = tokenClient.requestTgt(getKrbToken(),
- getcCacheFile().getPath());
- } catch (KrbException e) {
- if (e.getMessage().contains("timeout")) {
- return;
- }
- throw e;
- }
- verifyTicket(tgt);
-
- SgtTicket tkt = getKrbClient().requestSgt(tgt,
- getServerPrincipal());
- verifyTicket(tkt);
- }
-
- private String getAudience(String name) {
- return name + "/" + TestKdcServer.KDC_REALM + "@" + TestKdcServer.KDC_REALM;
- }
-}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/directory-kerby/blob/11a9e23d/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithTokenKdcTestBase.java
----------------------------------------------------------------------
diff --git a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithTokenKdcTestBase.java b/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithTokenKdcTestBase.java
deleted file mode 100644
index bed9e7d..0000000
--- a/kerby-kdc-test/src/test/java/org/apache/kerby/kerberos/kdc/WithTokenKdcTestBase.java
+++ /dev/null
@@ -1,176 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- *
- */
-package org.apache.kerby.kerberos.kdc;
-
-import org.apache.kerby.kerberos.kerb.KrbException;
-import org.apache.kerby.kerberos.kerb.KrbRuntime;
-import org.apache.kerby.kerberos.kerb.ccache.Credential;
-import org.apache.kerby.kerberos.kerb.ccache.CredentialCache;
-import org.apache.kerby.kerberos.kerb.common.PrivateKeyReader;
-import org.apache.kerby.kerberos.kerb.provider.TokenEncoder;
-import org.apache.kerby.kerberos.kerb.server.KdcConfigKey;
-import org.apache.kerby.kerberos.kerb.server.KdcTestBase;
-import org.apache.kerby.kerberos.kerb.type.base.AuthToken;
-import org.apache.kerby.kerberos.kerb.type.base.KrbToken;
-import org.apache.kerby.kerberos.kerb.type.base.TokenFormat;
-import org.apache.kerby.kerberos.kerb.type.ticket.KrbTicket;
-import org.apache.kerby.kerberos.kerb.type.ticket.TgtTicket;
-import org.apache.kerby.kerberos.provider.token.JwtTokenEncoder;
-import org.apache.kerby.kerberos.provider.token.JwtTokenProvider;
-import org.junit.Before;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.URL;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-public class WithTokenKdcTestBase extends KdcTestBase {
- static final String SUBJECT = "test-sub";
- static final String ISSUER = "oauth2.com";
- static final String GROUP = "sales-group";
- static final String ROLE = "ADMIN";
- private File cCacheFile;
- private KrbToken krbToken;
-
- @Before
- public void setUp() throws Exception {
- KrbRuntime.setTokenProvider(new JwtTokenProvider());
- super.setUp();
- }
-
- @Override
- protected void configKdcSeverAndClient() {
- super.configKdcSeverAndClient();
- String verifyKeyPath = this.getClass().getResource("/").getPath();
- getKdcServer().getKdcConfig().setString(KdcConfigKey.TOKEN_VERIFY_KEYS, verifyKeyPath);
-
- URL privateKeyPath = WithTokenKdcTestBase.class.getResource("/private_key.pem");
- getKdcServer().getKdcConfig().setString(KdcConfigKey.TOKEN_DECRYPTION_KEYS, privateKeyPath.getPath());
- getKdcServer().getKdcConfig().setString(KdcConfigKey.TOKEN_ISSUERS, ISSUER);
- }
-
- protected AuthToken getKrbToken() {
- return krbToken;
- }
-
- protected File getcCacheFile() {
- return cCacheFile;
- }
-
- protected AuthToken prepareToken(String audience) {
- InputStream is = WithTokenKdcTestBase.class.getResourceAsStream("/private_key.pem");
- PrivateKey privateKey = null;
- try {
- privateKey = PrivateKeyReader.loadPrivateKey(is);
- } catch (Exception e) {
- e.printStackTrace();
- }
-
- return prepareToken(audience, ISSUER, privateKey, null);
- }
-
- protected AuthToken prepareToken(String audience, String issuer,
- PrivateKey signingKey, PublicKey encryptionKey) {
- AuthToken authToken = KrbRuntime.getTokenProvider().createTokenFactory().createToken();
- authToken.setIssuer(issuer);
- authToken.setSubject(SUBJECT);
-
- authToken.addAttribute("group", GROUP);
- authToken.addAttribute("role", ROLE);
-
- List<String> aud = new ArrayList<String>();
- aud.add(audience);
- authToken.setAudiences(aud);
-
- // Set expiration in 60 minutes
- final Date now = new Date();
- Date exp = new Date(now.getTime() + 1000 * 60 * 60);
- authToken.setExpirationTime(exp);
-
- Date nbf = now;
- authToken.setNotBeforeTime(nbf);
-
- Date iat = now;
- authToken.setIssueTime(iat);
-
- TokenEncoder tokenEncoder = KrbRuntime.getTokenProvider().createTokenEncoder();
-
- if (tokenEncoder instanceof JwtTokenEncoder && signingKey != null) {
- tokenEncoder.setSignKey(signingKey);
- }
- if (tokenEncoder instanceof JwtTokenEncoder && encryptionKey != null) {
- tokenEncoder.setEncryptionKey(encryptionKey);
- }
-
- krbToken = new KrbToken();
- krbToken.setInnerToken(authToken);
- krbToken.setTokenType();
- krbToken.setTokenFormat(TokenFormat.JWT);
- try {
- krbToken.setTokenValue(tokenEncoder.encodeAsBytes(authToken));
- } catch (KrbException e) {
- throw new RuntimeException("Failed to encode AuthToken", e);
- }
-
- return krbToken;
- }
-
-
- protected File createCredentialCache(String principal,
- String password) throws Exception {
- TgtTicket tgt = getKrbClient().requestTgt(principal, password);
- writeTgtToCache(tgt, principal);
- return cCacheFile;
- }
-
- /**
- * Write tgt into credentials cache.
- */
- private void writeTgtToCache(
- TgtTicket tgt, String principal) throws IOException {
- Credential credential = new Credential(tgt);
- CredentialCache cCache = new CredentialCache();
- cCache.addCredential(credential);
- cCache.setPrimaryPrincipal(tgt.getClientPrincipal());
-
- String fileName = "krb5_" + principal + ".cc";
- cCacheFile = new File(getTestDir().getPath(), fileName);
- cCache.store(cCacheFile);
- }
-
- protected void deleteCcacheFile() {
- cCacheFile.delete();
- }
-
- protected void verifyTicket(KrbTicket ticket) {
- assertThat(ticket).isNotNull();
- assertThat(ticket.getRealm()).isEqualTo(getKdcServer().getKdcSetting().getKdcRealm());
- assertThat(ticket.getTicket()).isNotNull();
- assertThat(ticket.getSessionKey()).isNotNull();
- assertThat(ticket.getEncKdcRepPart()).isNotNull();
- }
-}