You are viewing a plain text version of this content. The canonical link for it is here.
Posted to scm@geronimo.apache.org by va...@apache.org on 2007/11/24 15:43:01 UTC
svn commit: r597853 - in /geronimo/server:
branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/
branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/
trunk/framework/module...
Author: vamsic007
Date: Sat Nov 24 06:42:59 2007
New Revision: 597853
URL: http://svn.apache.org/viewvc?rev=597853&view=rev
Log:
GERONIMO-3628 Review GeronimoPasswordCredentialLoginModule
o logout() should remove credentials from the subject.
o logout() should destroy credentials when the subject is read-only.
o Changes to bring GeronimoPasswordCredentialLoginModule in line with http://java.sun.com/j2se/1.5.0/docs/guide/security/jaas/JAASLMDevGuide.html
**: This commit can use a thorough review.
Added:
geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java (with props)
geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java (with props)
Modified:
geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java
geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java
geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java
geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java
Modified: geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java
URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java?rev=597853&r1=597852&r2=597853&view=diff
==============================================================================
--- geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java (original)
+++ geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java Sat Nov 24 06:42:59 2007
@@ -18,17 +18,23 @@
package org.apache.geronimo.security.realm.providers;
import java.io.Serializable;
+import javax.security.auth.DestroyFailedException;
+import javax.security.auth.Destroyable;
/**
* @version $Rev$ $Date$
*/
-public class GeronimoPasswordCredential implements Serializable {
+public class GeronimoPasswordCredential implements Destroyable, Serializable {
- private final String userName;
- private final char[] password;
+ private String userName;
+ private char[] password;
+ private boolean destroyed;
public GeronimoPasswordCredential(String userName, char[] password) {
+ assert userName != null;
+ assert password != null;
+
this.userName = userName;
this.password = password;
}
@@ -39,5 +45,15 @@
public char[] getPassword() {
return password;
+ }
+
+ public void destroy() throws DestroyFailedException {
+ userName = null;
+ password = null;
+ destroyed = true;
+ }
+
+ public boolean isDestroyed() {
+ return destroyed;
}
}
Modified: geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java
URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java?rev=597853&r1=597852&r2=597853&view=diff
==============================================================================
--- geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java (original)
+++ geronimo/server/branches/2.0/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java Sat Nov 24 06:42:59 2007
@@ -18,6 +18,8 @@
package org.apache.geronimo.security.realm.providers;
import java.util.Map;
+
+import javax.security.auth.DestroyFailedException;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
@@ -62,22 +64,45 @@
} catch (UnsupportedCallbackException e) {
throw (LoginException) new LoginException("Unlikely UnsupportedCallbackException").initCause(e);
}
- geronimoPasswordCredential = new GeronimoPasswordCredential(((NameCallback) callbacks[0]).getName(),
- ((PasswordCallback) callbacks[1]).getPassword());
+ String username = ((NameCallback) callbacks[0]).getName();
+ char[] password = ((PasswordCallback) callbacks[1]).getPassword();
+
+ if (username == null || password == null) return false;
+ geronimoPasswordCredential = new GeronimoPasswordCredential(username, password);
return false;
}
public boolean commit() throws LoginException {
- subject.getPrivateCredentials().add(geronimoPasswordCredential);
+ if(geronimoPasswordCredential != null) {
+ subject.getPrivateCredentials().add(geronimoPasswordCredential);
+ }
return false;
}
public boolean abort() throws LoginException {
- geronimoPasswordCredential = null;
+ if(geronimoPasswordCredential != null) {
+ try {
+ geronimoPasswordCredential.destroy();
+ } catch (DestroyFailedException e) {
+ // do nothing
+ }
+ geronimoPasswordCredential = null;
+ }
return false;
}
public boolean logout() throws LoginException {
+ if(geronimoPasswordCredential == null) {
+ return false;
+ }
+ if(!subject.isReadOnly()) {
+ subject.getPrivateCredentials().remove(geronimoPasswordCredential);
+ }
+ try {
+ geronimoPasswordCredential.destroy();
+ } catch (DestroyFailedException e) {
+ // do nothing
+ }
geronimoPasswordCredential = null;
return false;
}
Added: geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
URL: http://svn.apache.org/viewvc/geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java?rev=597853&view=auto
==============================================================================
--- geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java (added)
+++ geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java Sat Nov 24 06:42:59 2007
@@ -0,0 +1,129 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.geronimo.security.jaas;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.management.MalformedObjectNameException;
+import javax.security.auth.Subject;
+import javax.security.auth.login.LoginContext;
+
+import org.apache.geronimo.gbean.GBeanData;
+import org.apache.geronimo.security.ContextManager;
+import org.apache.geronimo.security.realm.providers.GeronimoPasswordCredential;
+import org.apache.geronimo.security.realm.providers.GeronimoPasswordCredentialLoginModule;
+
+/**
+ * @version $Rev$ $Date$
+ */
+public class LoginGeronimoPasswordCredentialTest extends AbstractLoginModuleTest {
+ private String username = "john";
+ private String password = "smith";
+
+ protected GBeanData setupTestLoginModule() throws MalformedObjectNameException {
+ GBeanData gbean;
+ gbean = buildGBeanData("name", "GeronimoPasswordCredentialLoginModule", LoginModuleGBean.getGBeanInfo());
+ gbean.setAttribute("loginModuleClass", GeronimoPasswordCredentialLoginModule.class.getName());
+ Map<String, Object> props = new HashMap<String, Object>();
+ gbean.setAttribute("options", props);
+ gbean.setAttribute("loginDomainName", "GeronimoPasswordCredential");
+ gbean.setAttribute("wrapPrincipals", Boolean.FALSE);
+ return gbean;
+ }
+
+ public void testLogin() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(username, password));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+ assertEquals("Principals", 0, subject.getPrincipals().size());
+ assertEquals("Private credentials", 1, subject.getPrivateCredentials().size());
+ assertEquals("GeronimoPasswordCredential private credentials", 1, subject.getPrivateCredentials(GeronimoPasswordCredential.class).size());
+ assertEquals("Public credentials", 0, subject.getPublicCredentials().size());
+ GeronimoPasswordCredential pwdCred = (GeronimoPasswordCredential) subject.getPrivateCredentials().toArray()[0];
+ assertEquals("Username", username, pwdCred.getUserName());
+ assertEquals("Password", password, new String(pwdCred.getPassword()));
+
+ context.logout();
+
+ assertEquals("Private credentials upon logout", 0, subject.getPrivateCredentials().size());
+ assertTrue("id of server subject should be null", ContextManager.getSubjectId(subject) == null);
+ }
+
+ public void testNullUserLogin() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(null, password));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+ assertEquals("Principals", 0, subject.getPrincipals().size());
+ assertEquals("Private credentials", 0, subject.getPrivateCredentials().size());
+ assertEquals("Public credentials", 0, subject.getPublicCredentials().size());
+
+ context.logout();
+ }
+
+ public void testBadUserLogin() throws Exception {
+ //not relevant
+ }
+
+ public void testNullPasswordLogin() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(username, null));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+ assertEquals("Principals", 0, subject.getPrincipals().size());
+ assertEquals("Private credentials", 0, subject.getPrivateCredentials().size());
+ assertEquals("Public credentials", 0, subject.getPublicCredentials().size());
+
+ context.logout();
+ }
+
+ public void testBadPasswordLogin() throws Exception {
+ //not relevant
+ }
+
+ public void testNoPrincipalsAddedOnFailure() throws Exception {
+ //not relevant
+ }
+
+ public void testLogoutWithReadOnlySubject() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(username, password));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+
+ subject.setReadOnly();
+
+ try {
+ context.logout();
+ } catch(Exception e) {
+ fail("logout failed");
+ }
+ GeronimoPasswordCredential pwdCred = (GeronimoPasswordCredential) subject.getPrivateCredentials().toArray()[0];
+ assertTrue("credential should have been destroyed", pwdCred.isDestroyed());
+ }
+}
Propchange: geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
------------------------------------------------------------------------------
svn:keywords = Date Revision
Propchange: geronimo/server/branches/2.0/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
------------------------------------------------------------------------------
svn:mime-type = text/plain
Modified: geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java
URL: http://svn.apache.org/viewvc/geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java?rev=597853&r1=597852&r2=597853&view=diff
==============================================================================
--- geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java (original)
+++ geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredential.java Sat Nov 24 06:42:59 2007
@@ -18,17 +18,23 @@
package org.apache.geronimo.security.realm.providers;
import java.io.Serializable;
+import javax.security.auth.DestroyFailedException;
+import javax.security.auth.Destroyable;
/**
* @version $Rev$ $Date$
*/
-public class GeronimoPasswordCredential implements Serializable {
+public class GeronimoPasswordCredential implements Destroyable, Serializable {
- private final String userName;
- private final char[] password;
+ private String userName;
+ private char[] password;
+ private boolean destroyed;
public GeronimoPasswordCredential(String userName, char[] password) {
+ assert userName != null;
+ assert password != null;
+
this.userName = userName;
this.password = password;
}
@@ -39,5 +45,15 @@
public char[] getPassword() {
return password;
+ }
+
+ public void destroy() throws DestroyFailedException {
+ userName = null;
+ password = null;
+ destroyed = true;
+ }
+
+ public boolean isDestroyed() {
+ return destroyed;
}
}
Modified: geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java
URL: http://svn.apache.org/viewvc/geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java?rev=597853&r1=597852&r2=597853&view=diff
==============================================================================
--- geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java (original)
+++ geronimo/server/trunk/framework/modules/geronimo-security/src/main/java/org/apache/geronimo/security/realm/providers/GeronimoPasswordCredentialLoginModule.java Sat Nov 24 06:42:59 2007
@@ -18,6 +18,8 @@
package org.apache.geronimo.security.realm.providers;
import java.util.Map;
+
+import javax.security.auth.DestroyFailedException;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
@@ -62,22 +64,45 @@
} catch (UnsupportedCallbackException e) {
throw (LoginException) new LoginException("Unlikely UnsupportedCallbackException").initCause(e);
}
- geronimoPasswordCredential = new GeronimoPasswordCredential(((NameCallback) callbacks[0]).getName(),
- ((PasswordCallback) callbacks[1]).getPassword());
+ String username = ((NameCallback) callbacks[0]).getName();
+ char[] password = ((PasswordCallback) callbacks[1]).getPassword();
+
+ if (username == null || password == null) return false;
+ geronimoPasswordCredential = new GeronimoPasswordCredential(username, password);
return false;
}
public boolean commit() throws LoginException {
- subject.getPrivateCredentials().add(geronimoPasswordCredential);
+ if(geronimoPasswordCredential != null) {
+ subject.getPrivateCredentials().add(geronimoPasswordCredential);
+ }
return false;
}
public boolean abort() throws LoginException {
- geronimoPasswordCredential = null;
+ if(geronimoPasswordCredential != null) {
+ try {
+ geronimoPasswordCredential.destroy();
+ } catch (DestroyFailedException e) {
+ // do nothing
+ }
+ geronimoPasswordCredential = null;
+ }
return false;
}
public boolean logout() throws LoginException {
+ if(geronimoPasswordCredential == null) {
+ return false;
+ }
+ if(!subject.isReadOnly()) {
+ subject.getPrivateCredentials().remove(geronimoPasswordCredential);
+ }
+ try {
+ geronimoPasswordCredential.destroy();
+ } catch (DestroyFailedException e) {
+ // do nothing
+ }
geronimoPasswordCredential = null;
return false;
}
Added: geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
URL: http://svn.apache.org/viewvc/geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java?rev=597853&view=auto
==============================================================================
--- geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java (added)
+++ geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java Sat Nov 24 06:42:59 2007
@@ -0,0 +1,129 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.geronimo.security.jaas;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.management.MalformedObjectNameException;
+import javax.security.auth.Subject;
+import javax.security.auth.login.LoginContext;
+
+import org.apache.geronimo.gbean.GBeanData;
+import org.apache.geronimo.security.ContextManager;
+import org.apache.geronimo.security.realm.providers.GeronimoPasswordCredential;
+import org.apache.geronimo.security.realm.providers.GeronimoPasswordCredentialLoginModule;
+
+/**
+ * @version $Rev$ $Date$
+ */
+public class LoginGeronimoPasswordCredentialTest extends AbstractLoginModuleTest {
+ private String username = "john";
+ private String password = "smith";
+
+ protected GBeanData setupTestLoginModule() throws MalformedObjectNameException {
+ GBeanData gbean;
+ gbean = buildGBeanData("name", "GeronimoPasswordCredentialLoginModule", LoginModuleGBean.getGBeanInfo());
+ gbean.setAttribute("loginModuleClass", GeronimoPasswordCredentialLoginModule.class.getName());
+ Map<String, Object> props = new HashMap<String, Object>();
+ gbean.setAttribute("options", props);
+ gbean.setAttribute("loginDomainName", "GeronimoPasswordCredential");
+ gbean.setAttribute("wrapPrincipals", Boolean.FALSE);
+ return gbean;
+ }
+
+ public void testLogin() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(username, password));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+ assertEquals("Principals", 0, subject.getPrincipals().size());
+ assertEquals("Private credentials", 1, subject.getPrivateCredentials().size());
+ assertEquals("GeronimoPasswordCredential private credentials", 1, subject.getPrivateCredentials(GeronimoPasswordCredential.class).size());
+ assertEquals("Public credentials", 0, subject.getPublicCredentials().size());
+ GeronimoPasswordCredential pwdCred = (GeronimoPasswordCredential) subject.getPrivateCredentials().toArray()[0];
+ assertEquals("Username", username, pwdCred.getUserName());
+ assertEquals("Password", password, new String(pwdCred.getPassword()));
+
+ context.logout();
+
+ assertEquals("Private credentials upon logout", 0, subject.getPrivateCredentials().size());
+ assertTrue("id of server subject should be null", ContextManager.getSubjectId(subject) == null);
+ }
+
+ public void testNullUserLogin() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(null, password));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+ assertEquals("Principals", 0, subject.getPrincipals().size());
+ assertEquals("Private credentials", 0, subject.getPrivateCredentials().size());
+ assertEquals("Public credentials", 0, subject.getPublicCredentials().size());
+
+ context.logout();
+ }
+
+ public void testBadUserLogin() throws Exception {
+ //not relevant
+ }
+
+ public void testNullPasswordLogin() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(username, null));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+ assertEquals("Principals", 0, subject.getPrincipals().size());
+ assertEquals("Private credentials", 0, subject.getPrivateCredentials().size());
+ assertEquals("Public credentials", 0, subject.getPublicCredentials().size());
+
+ context.logout();
+ }
+
+ public void testBadPasswordLogin() throws Exception {
+ //not relevant
+ }
+
+ public void testNoPrincipalsAddedOnFailure() throws Exception {
+ //not relevant
+ }
+
+ public void testLogoutWithReadOnlySubject() throws Exception {
+ LoginContext context = new LoginContext(COMPLEX_REALM, new UsernamePasswordCallback(username, password));
+
+ context.login();
+ Subject subject = context.getSubject();
+
+ assertTrue("expected non-null subject", subject != null);
+
+ subject.setReadOnly();
+
+ try {
+ context.logout();
+ } catch(Exception e) {
+ fail("logout failed");
+ }
+ GeronimoPasswordCredential pwdCred = (GeronimoPasswordCredential) subject.getPrivateCredentials().toArray()[0];
+ assertTrue("credential should have been destroyed", pwdCred.isDestroyed());
+ }
+}
Propchange: geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
------------------------------------------------------------------------------
svn:keywords = Date Revision
Propchange: geronimo/server/trunk/framework/modules/geronimo-security/src/test/java/org/apache/geronimo/security/jaas/LoginGeronimoPasswordCredentialTest.java
------------------------------------------------------------------------------
svn:mime-type = text/plain