You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by sm...@apache.org on 2015/06/02 20:36:37 UTC
[12/51] [partial] directory-fortress-core git commit: FC-109 - rename
rbac package to impl
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/ba64d26a/src/test/java/org/apache/directory/fortress/core/impl/PswdPolicyMgrImplTest.java
----------------------------------------------------------------------
diff --git a/src/test/java/org/apache/directory/fortress/core/impl/PswdPolicyMgrImplTest.java b/src/test/java/org/apache/directory/fortress/core/impl/PswdPolicyMgrImplTest.java
new file mode 100755
index 0000000..1513a36
--- /dev/null
+++ b/src/test/java/org/apache/directory/fortress/core/impl/PswdPolicyMgrImplTest.java
@@ -0,0 +1,1465 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.directory.fortress.core.impl;
+
+
+import java.lang.reflect.Array;
+import java.util.Arrays;
+import java.util.List;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+import org.apache.directory.fortress.core.model.PwPolicy;
+import org.apache.directory.fortress.core.model.Session;
+import org.apache.directory.fortress.core.model.User;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import org.apache.directory.fortress.core.AccessMgr;
+import org.apache.directory.fortress.core.AccessMgrFactory;
+import org.apache.directory.fortress.core.AdminMgr;
+import org.apache.directory.fortress.core.GlobalErrIds;
+import org.apache.directory.fortress.core.PwPolicyMgr;
+import org.apache.directory.fortress.core.PwPolicyMgrFactory;
+import org.apache.directory.fortress.core.SecurityException;
+import org.apache.directory.fortress.core.util.LogUtil;
+
+
+/**
+ * PwPolicyMgrImpl Tester.
+ *
+ * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
+ * @version 1.0
+ */
+public class PswdPolicyMgrImplTest extends TestCase
+{
+ private static final String CLS_NM = PswdPolicyMgrImplTest.class.getName();
+ private static final Logger LOG = LoggerFactory.getLogger( CLS_NM );
+
+
+ public PswdPolicyMgrImplTest( String name )
+ {
+ super( name );
+ }
+
+ static Session adminSess = null;
+
+
+ public void setUp() throws Exception
+ {
+ super.setUp();
+ }
+
+
+ public void tearDown() throws Exception
+ {
+ super.tearDown();
+ }
+
+
+ public static Test suiteX()
+ {
+ TestSuite suite = new TestSuite();
+ suite.addTest( new PswdPolicyMgrImplTest( "testDelete" ) );
+ suite.addTest( new AdminMgrImplTest( "testDeleteUser" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testAdd" ) );
+ suite.addTest( new AdminMgrImplTest( "testAddUser" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testMinAge" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testMaxAge" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testInHistory" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testMinLength" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testExpireWarning" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testGraceLoginLimit" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testMaxFailure" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testLockoutDuration" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testLockout" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testFailureCountInterval" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testMustChange" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testAllowUserChange" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testSafeModify" ) );
+ return suite;
+ }
+
+
+ public static Test suite()
+ {
+ TestSuite suite = new TestSuite();
+ suite.addTest( new PswdPolicyMgrImplTest( "testDelete" ) );
+ suite.addTest( new AdminMgrImplTest( "testDeleteUser" ) );
+ suite.addTest( new PswdPolicyMgrImplTest( "testAdd" ) );
+ suite.addTest( new AdminMgrImplTest( "testAddUser" ) );
+ //suite.addTest(new PswdPolicyMgrImplTest("testMinAge"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testMaxAge"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testInHistory"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testMinLength"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testExpireWarning"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testGraceLoginLimit"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testMaxFailure"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testLockoutDuration"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testLockout"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testFailureCountInterval"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testMustChange"));
+ //suite.addTest(new PswdPolicyMgrImplTest("testAllowUserChange"));
+ suite.addTest( new PswdPolicyMgrImplTest( "testSafeModify" ) );
+ return suite;
+ }
+
+
+ @SafeVarargs
+ public static <T> T[] arrayMerge( T[]... arrays )
+ {
+ // Determine required size of new array
+
+ int count = 0;
+ for ( T[] array : arrays )
+ {
+ count += array.length;
+ }
+
+ // create new array of required class
+
+ T[] mergedArray = ( T[] ) Array.newInstance(
+ arrays[0][0].getClass(), count );
+
+ // Merge each array into new array
+
+ int start = 0;
+ for ( T[] array : arrays )
+ {
+ System.arraycopy( array, 0,
+ mergedArray, start, array.length );
+ start += array.length;
+ }
+ return mergedArray;
+ }
+
+
+ /**
+ * @throws SecurityException
+ */
+ public void testMinAge()
+ {
+ minAge(
+ "PWMIN1 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[0],
+ UserTestData.USERS_TU5_UPD[0], PolicyTestData.POLICIES_TP1[0] );
+ minAge(
+ "PWMIN2 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[1],
+ UserTestData.USERS_TU5_UPD[1], PolicyTestData.POLICIES_TP1[1] );
+ //minAge("PWMIN3 " + TestUtils.getDataLabel(PolicyTestData.class, "POLICIES_TP1") + " " + TestUtils.getDataLabel(UserTestData.class, "USERS_TU5"), UserTestData.USERS_TU5[2], UserTestData.USERS_TU5_UPD[2], PolicyTestData.POLICIES_TP1[2]);
+ //minAge("PWMIN4 " + TestUtils.getDataLabel(PolicyTestData.class, "POLICIES_TP1") + " " + TestUtils.getDataLabel(UserTestData.class, "USERS_TU5"), UserTestData.USERS_TU5[3], UserTestData.USERS_TU5_UPD[3], PolicyTestData.POLICIES_TP1[3]);
+ }
+
+
+ /**
+ * PT1
+ * <p/>
+ * 5.2.2 pwdMinAge
+ * <p/>
+ * This attribute holds the number of seconds that must elapse between
+ * modifications to the password. If this attribute is not present, 0
+ * seconds is assumed. "chg"
+ *
+ * @param msg
+ * @param newusr
+ * @param oldusr *
+ * @param plcy
+ */
+ public void minAge( String msg, String[] oldusr, String[] newusr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ User oldUser = UserTestData.getUser( oldusr );
+ oldUser.setPwPolicy( PolicyTestData.getName( plcy ) );
+ adminMgr.updateUser( oldUser );
+ TestUtils.sleep( PolicyTestData.getMinAge( plcy ) );
+ adminMgr.changePassword( UserTestData.getUser( oldusr ), UserTestData.getPassword( newusr ) );
+ User newUser = UserTestData.getUser( newusr );
+ try
+ {
+ newUser.setPassword( "changed".toCharArray() );
+ adminMgr.changePassword( UserTestData.getUser( newusr ), newUser.getPassword() );
+ fail( CLS_NM + ".minAge name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( oldusr ) + "] failed min age test" );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".minAge invalid error message userId [" + UserTestData.getUserId( oldusr ) + "]",
+ ex.getErrorId() == GlobalErrIds.PSWD_CONST_VIOLATION );
+ // still good
+ TestUtils.sleep( PolicyTestData.getMinAge( plcy ) );
+ adminMgr.changePassword( UserTestData.getUser( newusr ), newUser.getPassword() );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "minAge caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testMaxAge()
+ {
+ maxAge(
+ "PWMAX3 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[2],
+ UserTestData.USERS_TU5_UPD[2], PolicyTestData.POLICIES_TP1[2] );
+ maxAge(
+ "PWMAX4 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[3],
+ UserTestData.USERS_TU5_UPD[3], PolicyTestData.POLICIES_TP1[3] );
+ }
+
+
+ /**
+ * PT2
+ * 5.2.3 pwdMaxAge
+ * <p/>
+ * This attribute holds the number of seconds after which a modified
+ * password will expire.
+ * <p/>
+ * If this attribute is not present, or if the value is 0 the password
+ * does not expire. If not 0, the value must be greater than or equal
+ * to the value of the pwdMinAge.*
+ *
+ * @param msg
+ * @param oldusr
+ * @param newusr
+ * @param plcy
+ */
+ public void maxAge( String msg, String[] oldusr, String[] newusr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User oldUser = UserTestData.getUser( oldusr );
+ User newUser = UserTestData.getUser( newusr );
+ oldUser.setPwPolicy( PolicyTestData.getName( plcy ) );
+ adminMgr.updateUser( oldUser );
+ char[] newPassword = newUser.getPassword();
+ adminMgr.changePassword( oldUser, newPassword );
+ oldUser.setPassword( newPassword );
+ for ( int i = 0; i < 3; i++ )
+ {
+ TestUtils.sleep( PolicyTestData.getMaxAge( plcy ) );
+ TestUtils.sleep( 1 );
+ try
+ {
+ accessMgr.createSession( oldUser, false );
+ fail( CLS_NM + ".maxAge name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( oldusr ) + "] failed age test" );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".maxAge invalid error message userId [" + UserTestData.getUserId( oldusr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_EXPIRED );
+ // still good
+ }
+ newPassword = "changedabc".toCharArray();
+ oldUser = new User( oldUser.getUserId() );
+ oldUser.setPassword( newPassword );
+ // since this password is now expired we have to call update rather than changePassword:
+ adminMgr.updateUser( oldUser );
+ accessMgr.createSession( oldUser, false );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "maxAge caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testInHistory()
+ {
+ inHistory(
+ "PWHIST5 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[4],
+ PolicyTestData.POLICIES_TP1[4] );
+ inHistory(
+ "PWHIST6 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[5],
+ PolicyTestData.POLICIES_TP1[5] );
+ }
+
+
+ /**
+ * PT3
+ * 5.2.4 pwdInHistory
+ * <p/>
+ * This attribute specifies the maximum number of used passwords stored
+ * in the pwdHistory attribute.
+ * <p/>
+ * If this attribute is not present, or if the value is 0, used
+ * passwords are not stored in the pwdHistory attribute and thus may be
+ * reused.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void inHistory( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+
+ User user = UserTestData.getUser( usr );
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ int numHistory = PolicyTestData.getInHistory( plcy );
+ for ( int i = 0; i < numHistory + 1; i++ )
+ {
+ String newPassword = Arrays.toString( UserTestData.getPassword( usr ) ) + Integer.toString( i );
+ LOG.debug( "inHistory change pw=" + Arrays.toString( user.getPassword() ) );
+ adminMgr.changePassword( user, newPassword.toCharArray() );
+ user.setPassword( newPassword.toCharArray() );
+ try
+ {
+ LOG.debug( "inHistory change pw2=" + Arrays.toString( user.getPassword() ) );
+ adminMgr.changePassword( user, newPassword.toCharArray() );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".inHistory invalid error message userId [" + user.getUserId() + "]",
+ ex.getErrorId() == GlobalErrIds.PSWD_CONST_VIOLATION );
+ // still good
+ }
+ }
+ try
+ {
+ // now try to change back to original password, this should pass
+ adminMgr.changePassword( user, UserTestData.getPassword( usr ) );
+ }
+ catch ( SecurityException ex )
+ {
+ String error = "inHistory caught SecurityException rc=" + ex.getErrorId() + ", msg="
+ + ex.getMessage();
+ LOG.error( error );
+ fail( error );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "inHistory caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testMinLength()
+ {
+ minLength(
+ "PWLEN7 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[6],
+ PolicyTestData.POLICIES_TP1[6] );
+ minLength(
+ "PWLEN8 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[7],
+ PolicyTestData.POLICIES_TP1[7] );
+ }
+
+
+ /**
+ * PT4
+ * 5.2.6 pwdMinLength
+ * <p/>
+ * When quality checking is enabled, this attribute holds the minimum
+ * number of characters that must be used in a password. If this
+ * attribute is not present, no minimum password length will be
+ * enforced. If the server is unable to check the length (due to a
+ * hashed password or otherwise), the server will, depending on the
+ * value of the pwdCheckQuality attribute, either accept the password
+ * without checking it ('0' or '1') or refuse it ('2').
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void minLength( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+
+ User user = UserTestData.getUser( usr );
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ try
+ {
+ int min = PolicyTestData.getMinLength( plcy );
+ LOG.debug( "testMinLength min=" + min + " len pw=" + user.getPassword().length );
+ String newPassword = new String( user.getPassword() ).substring( 0, min - 1 );
+ adminMgr.changePassword( user, newPassword.toCharArray() );
+ fail( CLS_NM + ".minLength name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed length test" );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".minLength invalid error message userId [" + UserTestData.getUserId( usr ) + "]",
+ ex.getErrorId() == GlobalErrIds.PSWD_CONST_VIOLATION );
+ // still good
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "minLength caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testExpireWarning()
+ {
+ expireWarning(
+ "PWEXP7 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[8],
+ PolicyTestData.POLICIES_TP1[8] );
+ expireWarning(
+ "PWEXP8 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[9],
+ PolicyTestData.POLICIES_TP1[9] );
+ }
+
+
+ /**
+ * PT5
+ * 5.2.7 pwdExpireWarning
+ * <p/>
+ * This attribute specifies the maximum number of seconds before a
+ * password is due to expire that expiration warning messages will be
+ * returned to an authenticating user.
+ * <p/>
+ * If this attribute is not present, or if the value is 0 no warnings
+ * will be returned. If not 0, the value must be smaller than the value
+ * of the pwdMaxAge attribute.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void expireWarning( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User user = UserTestData.getUser( usr );
+ long expireSecs = PolicyTestData.getExpireWarning( plcy );
+ long maxSecs = PolicyTestData.getMaxAge( plcy );
+ long elapsedWait = maxSecs - expireSecs;
+ String newPassword = Arrays.toString( UserTestData.getPassword( usr ) ) + "a";
+ user.setPassword( newPassword.toCharArray() );
+ user.setPwPolicy( PolicyTestData.getName( plcy ) );
+ // because the password max age is so short, need to set new password, otherwise it will have already expired:
+ adminMgr.updateUser( user );
+ // now do the password change to start the clock ticking:
+ newPassword = Arrays.toString( UserTestData.getPassword( usr ) ) + "b";
+ adminMgr.changePassword( user, newPassword.toCharArray() );
+ user.setPassword( newPassword.toCharArray() );
+ Session s1 = accessMgr.createSession( user, false );
+ assertTrue( CLS_NM + ".expireWarning invalid error message userId [" + UserTestData.getUserId( usr ) + "]",
+ s1.getExpirationSeconds() == 0 );
+ TestUtils.sleep( elapsedWait );
+ // add one second for good measure:
+ TestUtils.sleep( 1 );
+ s1 = accessMgr.createSession( user, false );
+ assertTrue( CLS_NM + ".expireWarning invalid error message 2 userId [" + UserTestData.getUserId( usr )
+ + "]", ( 0 < s1.getExpirationSeconds() ) && ( s1.getExpirationSeconds() < maxSecs ) );
+ TestUtils.sleep( elapsedWait );
+ try
+ {
+ accessMgr.createSession( user, false );
+ fail( CLS_NM + ".expireWarning name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed expired pw test" );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".expireWarning invalid error message 3 userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_EXPIRED );
+ // still good
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "expireWarning caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testGraceLoginLimit()
+ {
+ graceLoginLimit(
+ "PWGRACE9 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[10],
+ PolicyTestData.POLICIES_TP1[10] );
+ graceLoginLimit( "PWGRACE10 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[11],
+ PolicyTestData.POLICIES_TP1[11] );
+ }
+
+
+ /**
+ * PT6
+ * 5.2.8 pwdGraceAuthNLimit
+ * <p/>
+ * This attribute specifies the number of times an expired password can
+ * be used to authenticate. If this attribute is not present or if the
+ * value is 0, authentication will fail.
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void graceLoginLimit( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User user = UserTestData.getUser( usr );
+ user.setPwPolicy( PolicyTestData.getName( plcy ) );
+ adminMgr.updateUser( user );
+ String newPassword = Arrays.toString( user.getPassword() ) + "a";
+ adminMgr.changePassword( user, newPassword.toCharArray() );
+ user.setPassword( newPassword.toCharArray() );
+ TestUtils.sleep( PolicyTestData.getMaxAge( plcy ) );
+ TestUtils.sleep( 1 );
+ int numGrace = PolicyTestData.getGraceLoginLimit( plcy );
+ for ( int i = 0; i < numGrace; i++ )
+ {
+ try
+ {
+ accessMgr.createSession( user, false );
+ TestUtils.sleep( 1 );
+ }
+ catch ( SecurityException ex )
+ {
+ fail( CLS_NM + ".graceLoginLimit name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed grace allowed=" + numGrace + " iteration=" + i );
+ assertTrue(
+ CLS_NM + ".graceLoginLimit invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_EXPIRED );
+ // still good
+ }
+ }
+ try
+ {
+ accessMgr.createSession( user, false );
+ fail( CLS_NM + ".graceLoginLimit name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed grace test 2" );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".graceLoginLimit invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_EXPIRED );
+ // still good
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "graceLoginLimit caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testMaxFailure()
+ {
+ maxFailure(
+ "PWMAXFAILK11 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[12],
+ PolicyTestData.POLICIES_TP1[12] );
+ maxFailure(
+ "PWMAXFAIL12 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[13],
+ PolicyTestData.POLICIES_TP1[13] );
+ }
+
+
+ /**
+ * PT7
+ * 5.2.11 pwdMaxFailure
+ * <p/>
+ * This attribute specifies the number of consecutive failed bind
+ * attempts after which the password may not be used to authenticate.
+ * If this attribute is not present, or if the value is 0, this policy
+ * is not checked, and the value of pwdLockout will be ignored.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void maxFailure( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User user = UserTestData.getUser( usr );
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ int maxFailures = PolicyTestData.getMaxFailure( plcy );
+ for ( int i = 0; i < maxFailures; i++ )
+ {
+ try
+ {
+ User badUser = new User( user.getUserId(), "wrongpw".toCharArray() );
+ accessMgr.createSession( badUser, false );
+ fail( CLS_NM + ".maxFailure name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed max failure test=" + maxFailures + " iteration="
+ + i );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".maxFailure invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_INVLD );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ }
+ try
+ {
+ // now try with valid password - better be locked out...
+ accessMgr.createSession( user, false );
+ fail( CLS_NM + ".maxFailure name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed max failure test 2" );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue(
+ CLS_NM + ".maxFailure invalid error message userId [" + UserTestData.getUserId( usr ) + "]",
+ ex.getErrorId() == GlobalErrIds.USER_PW_LOCKED );
+ // still good
+ }
+ adminMgr.unlockUserAccount( user );
+ // now try with valid password - better work this time...
+ accessMgr.createSession( user, false );
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "maxFailure caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testLockoutDuration() throws SecurityException
+ {
+ lockoutDuration( "PWDURATION13 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[14],
+ PolicyTestData.POLICIES_TP1[14] );
+ lockoutDuration( "PWDURATION14 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[15],
+ PolicyTestData.POLICIES_TP1[15] );
+ }
+
+
+ /**
+ * PT8
+ * 5.2.10 pwdLockoutDuration
+ * <p/>
+ * This attribute holds the number of seconds that the password cannot
+ * be used to authenticate due to too many failed bind attempts. If
+ * this attribute is not present, or if the value is 0 the password
+ * cannot be used to authenticate until reset by a password
+ * administrator.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void lockoutDuration( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User user = UserTestData.getUser( usr );
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ int maxFailures = PolicyTestData.getMaxFailure( plcy );
+ int lockoutDuration = PolicyTestData.getLockoutDuration( plcy );
+ for ( int i = 0; i < maxFailures; i++ )
+ {
+ try
+ {
+ User badUser = new User( user.getUserId(), "wrongpw".toCharArray() );
+ accessMgr.createSession( badUser, false );
+ fail( CLS_NM + ".lockoutDuration name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed lockout duration test=" + maxFailures
+ + " iteration=" + i );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue(
+ CLS_NM + ".lockoutDuration invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_INVLD );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ }
+ try
+ {
+ // now try with valid password - better be locked out...
+ accessMgr.createSession( user, false );
+ fail( CLS_NM + ".lockoutDuration name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed lockout duration test 2" );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".lockoutDuration invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_LOCKED );
+ // still good
+ }
+
+ // now sleep for lockout duration - password should unlock automatically:
+ TestUtils.sleep( lockoutDuration );
+ // sleep one more second for good measure.
+ TestUtils.sleep( 1 );
+ // now try with valid password - better work this time...
+ accessMgr.createSession( user, false );
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "lockoutDuration caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testLockout()
+ {
+ lockout(
+ "PWLOCK15 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[16],
+ PolicyTestData.POLICIES_TP1[16] );
+ lockout(
+ "PWLOCK16 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[17],
+ PolicyTestData.POLICIES_TP1[17] );
+ }
+
+
+ /**
+ * PT9
+ * 5.2.9 pwdLockout
+ * <p/>
+ * This attribute indicates, when its value is "TRUE", that the password
+ * may not be used to authenticate after a specified number of
+ * consecutive failed bind attempts. The maximum number of consecutive
+ * failed bind attempts is specified in pwdMaxFailure.
+ * <p/>
+ * If this attribute is not present, or if the value is "FALSE", the
+ * password may be used to authenticate when the number of failed bind
+ * attempts has been reached.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void lockout( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User user = UserTestData.getUser( usr );
+
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ for ( int i = 0; i < 3; i++ )
+ {
+ // first lock it:
+ adminMgr.lockUserAccount( user );
+ try
+ {
+ // because account is locked, this better fail:
+ accessMgr.createSession( user, false );
+ fail( CLS_NM + ".lockout name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed lockout test iteration=" + i );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".lockout invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_LOCKED );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ // now unlock it:
+ adminMgr.unlockUserAccount( user );
+ // this better work:
+ accessMgr.createSession( user, false );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "lockout caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testFailureCountInterval()
+ {
+ failureCountInterval( "PWINTERVAL17 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[18],
+ PolicyTestData.POLICIES_TP1[18] );
+ failureCountInterval( "PWINTERVAL18 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[19],
+ PolicyTestData.POLICIES_TP1[19] );
+ }
+
+
+ /**
+ * PT10
+ * <p/>
+ * This attribute holds the number of seconds after which the password
+ * failures are purged from the failure counter, even though no
+ * successful authentication occurred.
+ * <p/>
+ * If this attribute is not present, or if its value is 0, the failure
+ * counter is only reset by a successful authentication.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void failureCountInterval( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User user = UserTestData.getUser( usr );
+
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ int maxFailures = PolicyTestData.getMaxFailure( plcy );
+ int failureInterval = PolicyTestData.getFailureCountInterval( plcy );
+ for ( int i = 0; i < maxFailures - 1; i++ )
+ {
+ try
+ {
+ User badUser = new User( user.getUserId(), "wrongpw".toCharArray() );
+ accessMgr.createSession( badUser, false );
+ fail( CLS_NM + ".failureCountInterval name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed failure count interval test, maxfailures="
+ + maxFailures + " iteration=" + i );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue(
+ CLS_NM + ".failureCountInterval invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_INVLD );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ }
+ // now sleep for failure count interval - password failure count should reset automatically:
+ TestUtils.sleep( failureInterval );
+ // sleep one more second for good measure.
+ TestUtils.sleep( 1 );
+ // now loop thru another set of bad pw tries:
+ for ( int i = 0; i < maxFailures - 1; i++ )
+ {
+ try
+ {
+ User badUser = new User( user.getUserId(), "wrongpw".toCharArray() );
+ accessMgr.createSession( badUser, false );
+ fail( CLS_NM + ".failureCountInterval name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed failure count interval test 2, maxfailures="
+ + maxFailures + " iteration=" + i );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue(
+ CLS_NM + ".failureCountInterval invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_INVLD );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ }
+ // now sleep for failure count interval - password failure count should reset automatically:
+ TestUtils.sleep( failureInterval );
+ // sleep one more second for good measure.
+ TestUtils.sleep( 1 );
+
+ // now try with valid password - it should work...
+ accessMgr.createSession( user, false );
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "failureCountInterval caught SecurityException rc=" + ex.getErrorId() + ", msg="
+ + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testMustChange()
+ {
+ mustChange(
+ "PWMUST19 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[20],
+ PolicyTestData.POLICIES_TP1[20] );
+ mustChange(
+ "PWMUST20 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[21],
+ PolicyTestData.POLICIES_TP1[21] );
+ }
+
+
+ /**
+ * PT11
+ * This attribute specifies with a value of "TRUE" that users must
+ * change their passwords when they first bind to the directory after a
+ * password is set or reset by a password administrator. If this
+ * attribute is not present, or if the value is "FALSE", users are not
+ * required to change their password upon binding after the password
+ * administrator sets or resets the password. This attribute is not set
+ * due to any actions specified by this document, it is typically set by
+ * a password administrator after resetting a user's password.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void mustChange( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ User user = UserTestData.getUser( usr );
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ boolean mustChange = PolicyTestData.getMustChange( plcy );
+ adminMgr.resetPassword( user, "newpassword".toCharArray() );
+ if ( mustChange )
+ {
+ try
+ {
+ // because mustchange flag is set, this better fail:
+ User badUser = new User( user.getUserId(), "newpassword".toCharArray() );
+ accessMgr.createSession( badUser, false );
+ fail( CLS_NM + ".mustChange name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed must change test flag=" + mustChange );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".mustChange invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_RESET );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ }
+ else
+ {
+ // this better work:
+ User goodUser = new User( user.getUserId(), "newpassword".toCharArray() );
+ accessMgr.createSession( goodUser, false );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( CLS_NM + ".mustChange policy [" + PolicyTestData.getName( plcy )
+ + "] caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testAllowUserChange()
+ {
+ allowUserChange( "PWALLOW21 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[22],
+ PolicyTestData.POLICIES_TP1[22] );
+ allowUserChange( "PWALLOW22 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[23],
+ PolicyTestData.POLICIES_TP1[23] );
+ }
+
+
+ /**
+ * PT12
+ * This attribute indicates whether users can change their own
+ * passwords, although the change operation is still subject to access
+ * control. If this attribute is not present, a value of "TRUE" is
+ * assumed. This attribute is intended to be used in the absense of an
+ * access control mechanism.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void allowUserChange( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ User user = UserTestData.getUser( usr );
+
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ boolean allowChange = PolicyTestData.getAllowUserChange( plcy );
+ if ( !allowChange )
+ {
+ try
+ {
+ // because allowchange flag is false, this better fail:
+ adminMgr.changePassword( user, "newPassword".toCharArray() );
+ fail( CLS_NM + ".allowUserChange name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed allow change test flag=" + allowChange );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue(
+ CLS_NM + ".allowUserChange invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_MOD_NOT_ALLOWED );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ }
+ else
+ {
+ // this better work:
+ adminMgr.changePassword( user, "newPassword".toCharArray() );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "allowUserChange policy [" + PolicyTestData.getName( plcy )
+ + "] caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testSafeModify()
+ {
+ safeModify(
+ "PWSAFEW23 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[24],
+ PolicyTestData.POLICIES_TP1[24] );
+ safeModify(
+ "PWSAFE24 " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ) + " "
+ + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ), UserTestData.USERS_TU5[25],
+ PolicyTestData.POLICIES_TP1[25] );
+ }
+
+
+ /**
+ * PT13
+ * 5.2.15 pwdSafeModify
+ * <p/>
+ * This attribute specifies whether or not the existing password must be
+ * sent along with the new password when being changed. If this
+ * attribute is not present, a "FALSE" value is assumed.
+ *
+ * @param msg
+ * @param usr
+ * @param plcy
+ */
+ public void safeModify( String msg, String[] usr, String[] plcy )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ AdminMgr adminMgr = AdminMgrImplTest.getManagedAdminMgr();
+ User user = UserTestData.getUser( usr );
+ policyMgr.updateUserPolicy( user.getUserId(), PolicyTestData.getName( plcy ) );
+ boolean safeModify = PolicyTestData.getSafeModify( plcy );
+ if ( safeModify )
+ {
+ try
+ {
+ // because safe modify flag is true, this better fail:
+ adminMgr.changePassword( user, "newPassword".toCharArray() );
+ fail( CLS_NM + ".safeModify name [" + PolicyTestData.getName( plcy ) + "] user ["
+ + UserTestData.getUserId( usr ) + "] failed safe modify test flag=" + safeModify );
+ }
+ catch ( SecurityException ex )
+ {
+ assertTrue( CLS_NM + ".safeModify invalid error message userId [" + UserTestData.getUserId( usr )
+ + "]", ex.getErrorId() == GlobalErrIds.USER_PW_MOD_NOT_ALLOWED );
+ // still good
+ TestUtils.sleep( 1 );
+ }
+ }
+ else
+ {
+ // this better work:
+ adminMgr.changePassword( user, "newPassword".toCharArray() );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "safeModify policy [" + PolicyTestData.getName( plcy )
+ + "] caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ /**
+ * PT14
+ * 5.2.5 pwdCheckQuality
+ * <p/>
+ * This attribute indicates how the password quality will be verified
+ * while being modified or added. If this attribute is not present, or
+ * if the value is '0', quality checking will not be enforced. A value
+ * of '1' indicates that the server will check the quality, and if the
+ * server is unable to check it (due to a hashed password or other
+ * reasons) it will be accepted. A value of '2' indicates that the
+ * server will check the quality, and if the server is unable to verify
+ * it, it will return an error refusing the password.
+ *
+ * @param msg
+ * @param pArray
+ */
+ public void checkQuality( String msg, String[][] pArray )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ for ( String[] plcy : pArray )
+ {
+ PwPolicy policy = PolicyTestData.getPolicy( plcy );
+ policyMgr.add( policy );
+ LOG.debug( "checkQuality name [" + policy.getName() + "] successful" );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "checkQuality caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testAdd()
+ {
+ // todo: use annotations to pass names of input tables for logging:
+ // public void add(PwPolicy policy)
+ //add("POLICIES_TP1", PolicyTestData.POLICIES_TP1);
+ add( "ADD " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ), PolicyTestData.POLICIES_TP1, false );
+ add( "ADD " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP2" ), PolicyTestData.POLICIES_TP2, false );
+ }
+
+
+ /**
+ * @param msg
+ * @param pArray
+ */
+ public static void add( String msg, String[][] pArray, boolean nofail )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ for ( String[] plcy : pArray )
+ {
+ PwPolicy policy = PolicyTestData.getPolicy( plcy );
+ policyMgr.add( policy );
+ LOG.debug( "add name [" + policy.getName() + "] successful" );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ if(!nofail)
+ {
+ LOG.error( "add caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+ }
+
+
+ public void testUpdate()
+ {
+ // todo: use annotations to pass names of input tables for logging:
+ // public void update(PwPolicy policy)
+ update( "UPD " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ), PolicyTestData.POLICIES_TP1 );
+ }
+
+
+ /**
+ * @param msg
+ * @param pArray
+ */
+ public void update( String msg, String[][] pArray )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ for ( String[] plcy : pArray )
+ {
+ PwPolicy policy = PolicyTestData.getPolicy( plcy );
+ policyMgr.update( policy );
+ LOG.debug( "update name [" + policy.getName() + "] successful" );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "update caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testDelete()
+ {
+ // todo: use annotations to pass names of input tables for logging:
+ // public void deleteRecursive(String name)
+ delete( "DEL " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ), PolicyTestData.POLICIES_TP1 );
+ delete( "DEL " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP2" ), PolicyTestData.POLICIES_TP2 );
+ }
+
+
+ /**
+ * @param msg
+ * @param pArray
+ */
+ public void delete( String msg, String[][] pArray )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ for ( String[] plcy : pArray )
+ {
+ PwPolicy policy = PolicyTestData.getPolicy( plcy );
+ policyMgr.delete( policy );
+ LOG.debug( "deleteRecursive name [" + PolicyTestData.getName( plcy ) + "] successful" );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "deleteRecursive caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(),
+ ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testRead()
+ {
+ // todo: use annotations to pass names of input tables for logging:
+ // public PwPolicy read(String name)
+ read( "READ " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ), PolicyTestData.POLICIES_TP1 );
+ }
+
+
+ /**
+ * @param msg
+ * @param pArray
+ */
+ public void read( String msg, String[][] pArray )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = PwPolicyMgrFactory.createInstance( TestUtils.getContext() );
+ for ( String[] plcy : pArray )
+ {
+ PwPolicy entity = policyMgr.read( PolicyTestData.getName( plcy ) );
+ PolicyTestData.assertEquals( entity, plcy );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "read caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testSearch()
+ {
+ // todo: use annotations to pass names of input tables for logging:
+ //public List<PwPolicy> search(String searchVal)
+ search( "SRCH " + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ),
+ TestUtils.getSrchValue( PolicyTestData.getName( PolicyTestData.POLICIES_TP1[0] ) ),
+ PolicyTestData.POLICIES_TP1 );
+ }
+
+
+ /**
+ * @param msg
+ * @param pArray
+ */
+ public void search( String msg, String srchValue, String[][] pArray )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = PwPolicyMgrFactory.createInstance( TestUtils.getContext() );
+ List<PwPolicy> policies = policyMgr.search( srchValue );
+ assertNotNull( policies );
+ assertTrue( CLS_NM + "search list size check", pArray.length == policies.size() );
+ for ( String[] plcy : pArray )
+ {
+ int indx = policies.indexOf( new PwPolicy( PolicyTestData.getName( plcy ) ) );
+ if ( indx != -1 )
+ {
+ PwPolicy entity = policies.get( indx );
+ assertNotNull( entity );
+ PolicyTestData.assertEquals( entity, plcy );
+ }
+ else
+ {
+ msg = "search srchValue [" + srchValue + "] failed list search";
+ LogUtil.logIt( msg );
+ fail( msg );
+ }
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error( "search srchValue [" + srchValue + "] caught SecurityException rc=" + ex.getErrorId()
+ + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testUpdatePasswordPolicy()
+ {
+ //public void updateUserPolicy(String userId, String policyName)
+ updatePasswordPolicy(
+ "UPD " + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ) + " "
+ + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ), UserTestData.USERS_TU5,
+ PolicyTestData.POLICIES_TP1 );
+ }
+
+
+ /**
+ * @param msg
+ * @param uArray
+ * @param pArray
+ */
+ public void updatePasswordPolicy( String msg, String[][] uArray, String[][] pArray )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ int i = 0;
+ for ( String[] plcy : pArray )
+ {
+ policyMgr.updateUserPolicy( UserTestData.getUserId( uArray[i++] ), PolicyTestData.getName( plcy ) );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "updateUserPolicy caught SecurityException rc=" + ex.getErrorId() + ", msg="
+ + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ public void testDeletePasswordPolicy()
+ {
+ //public void deletePasswordPolicy(String userId)
+ deletePasswordPolicy(
+ "DEL " + TestUtils.getDataLabel( UserTestData.class, "USERS_TU5" ) + " "
+ + TestUtils.getDataLabel( PolicyTestData.class, "POLICIES_TP1" ), UserTestData.USERS_TU5 );
+ }
+
+
+ /**
+ * @param msg
+ * @param uArray
+ */
+ public void deletePasswordPolicy( String msg, String[][] uArray )
+ {
+ LogUtil.logIt( msg );
+ try
+ {
+ PwPolicyMgr policyMgr = getManagedPswdMgr();
+ for ( String[] usr : uArray )
+ {
+ policyMgr.deletePasswordPolicy( UserTestData.getUserId( usr ) );
+ }
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "deletePasswordPolicy caught SecurityException rc=" + ex.getErrorId() + ", msg="
+ + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+
+ /**
+ *
+ * @return
+ * @throws SecurityException
+ */
+ public static PwPolicyMgr getManagedPswdMgr() throws SecurityException
+ {
+ if ( FortressJUnitTest.isAdminEnabled() && adminSess == null )
+ {
+ adminSess = DelegatedMgrImplTest.createAdminSession();
+ }
+ return PwPolicyMgrFactory.createInstance( TestUtils.getContext(), adminSess );
+ }
+}