cxf-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From cohei...@apache.org
Subject [04/10] cxf-fediz git commit: Refactor of systests
Date Wed, 12 Jul 2017 09:49:34 GMT
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java
----------------------------------------------------------------------
diff --git a/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java
new file mode 100644
index 0000000..6cb8bcf
--- /dev/null
+++ b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/Spring3Test.java
@@ -0,0 +1,163 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.systests.spring;
+
+
+import java.io.File;
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+
+import org.apache.catalina.LifecycleException;
+import org.apache.catalina.LifecycleState;
+import org.apache.catalina.connector.Connector;
+import org.apache.catalina.startup.Tomcat;
+import org.apache.cxf.fediz.systests.common.AbstractTests;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+
+public class Spring3Test extends AbstractTests {
+
+    static String idpHttpsPort;
+    static String rpHttpsPort;
+
+    private static Tomcat idpServer;
+    private static Tomcat rpServer;
+
+    @BeforeClass
+    public static void init() throws Exception {
+        System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog");
+
+        System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true");
+
+        System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "debug");
+
+        System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "debug");
+
+        idpHttpsPort = System.getProperty("idp.https.port");
+        Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort);
+        rpHttpsPort = System.getProperty("rp.https.port");
+        Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort);
+
+        idpServer = startServer(true, idpHttpsPort);
+        rpServer = startServer(false, rpHttpsPort);
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        shutdownServer(idpServer);
+        shutdownServer(rpServer);
+    }
+
+    private static void shutdownServer(Tomcat server) {
+        try {
+            if (server != null && server.getServer() != null
+                && server.getServer().getState() != LifecycleState.DESTROYED) {
+                if (server.getServer().getState() != LifecycleState.STOPPED) {
+                    server.stop();
+                }
+                server.destroy();
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    private static Tomcat startServer(boolean idp, String port)
+        throws ServletException, LifecycleException, IOException {
+        Tomcat server = new Tomcat();
+        server.setPort(0);
+        String currentDir = new File(".").getCanonicalPath();
+        String baseDir = currentDir + File.separator + "target";
+        server.setBaseDir(baseDir);
+
+        if (idp) {
+            server.getHost().setAppBase("tomcat/idp/webapps");
+        } else {
+            server.getHost().setAppBase("tomcat/rp/webapps");
+        }
+        server.getHost().setAutoDeploy(true);
+        server.getHost().setDeployOnStartup(true);
+
+        Connector httpsConnector = new Connector();
+        httpsConnector.setPort(Integer.parseInt(port));
+        httpsConnector.setSecure(true);
+        httpsConnector.setScheme("https");
+        //httpsConnector.setAttribute("keyAlias", keyAlias);
+        httpsConnector.setAttribute("keystorePass", "tompass");
+        httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks");
+        httpsConnector.setAttribute("truststorePass", "tompass");
+        httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks");
+        httpsConnector.setAttribute("clientAuth", "want");
+        // httpsConnector.setAttribute("clientAuth", "false");
+        httpsConnector.setAttribute("sslProtocol", "TLS");
+        httpsConnector.setAttribute("SSLEnabled", true);
+
+        server.getService().addConnector(httpsConnector);
+
+        if (idp) {
+            File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts");
+            server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath());
+
+            File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp");
+            server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath());
+        } else {
+            File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(),
+                                     "fediz-systests-webapps-spring3");
+            server.addWebapp("/fedizhelloworld_spring3", rpWebapp.getAbsolutePath());
+        }
+
+        server.start();
+
+        return server;
+    }
+
+    @Override
+    public String getIdpHttpsPort() {
+        return idpHttpsPort;
+    }
+
+    @Override
+    public String getRpHttpsPort() {
+        return rpHttpsPort;
+    }
+
+    @Override
+    public String getServletContextName() {
+        return "fedizhelloworld_spring3";
+    }
+
+    @Ignore("This tests is currently failing on Spring")
+    @Override
+    public void testConcurrentRequests() throws Exception {
+        // super.testConcurrentRequests();
+    }
+
+    @Override
+    @org.junit.Test
+    public void testCSRFAttack() throws Exception {
+        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
+            + "/j_spring_fediz_security_check";
+        csrfAttackTest(url);
+    }
+
+}

http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java
----------------------------------------------------------------------
diff --git a/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java
new file mode 100644
index 0000000..4d7abba
--- /dev/null
+++ b/systests/spring/src/test/java/org/apache/cxf/fediz/systests/spring/SpringTest.java
@@ -0,0 +1,161 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.systests.spring;
+
+import java.io.File;
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+
+import org.apache.catalina.LifecycleException;
+import org.apache.catalina.LifecycleState;
+import org.apache.catalina.connector.Connector;
+import org.apache.catalina.startup.Tomcat;
+import org.apache.cxf.fediz.systests.common.AbstractTests;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+
+public class SpringTest extends AbstractTests {
+
+    static String idpHttpsPort;
+    static String rpHttpsPort;
+
+    private static Tomcat idpServer;
+    private static Tomcat rpServer;
+
+    @BeforeClass
+    public static void init() throws Exception {
+        System.setProperty("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.SimpleLog");
+
+        System.setProperty("org.apache.commons.logging.simplelog.showdatetime", "true");
+
+        System.setProperty("org.apache.commons.logging.simplelog.log.httpclient.wire", "debug");
+
+        System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.commons.httpclient", "debug");
+
+        idpHttpsPort = System.getProperty("idp.https.port");
+        Assert.assertNotNull("Property 'idp.https.port' null", idpHttpsPort);
+        rpHttpsPort = System.getProperty("rp.https.port");
+        Assert.assertNotNull("Property 'rp.https.port' null", rpHttpsPort);
+
+        idpServer = startServer(true, idpHttpsPort);
+        rpServer = startServer(false, rpHttpsPort);
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        shutdownServer(idpServer);
+        shutdownServer(rpServer);
+    }
+
+    private static void shutdownServer(Tomcat server) {
+        try {
+            if (server != null && server.getServer() != null
+                && server.getServer().getState() != LifecycleState.DESTROYED) {
+                if (server.getServer().getState() != LifecycleState.STOPPED) {
+                    server.stop();
+                }
+                server.destroy();
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    private static Tomcat startServer(boolean idp, String port)
+        throws ServletException, LifecycleException, IOException {
+        Tomcat server = new Tomcat();
+        server.setPort(0);
+        String currentDir = new File(".").getCanonicalPath();
+        String baseDir = currentDir + File.separator + "target";
+        server.setBaseDir(baseDir);
+
+        if (idp) {
+            server.getHost().setAppBase("tomcat/idp/webapps");
+        } else {
+            server.getHost().setAppBase("tomcat/rp/webapps");
+        }
+        server.getHost().setAutoDeploy(true);
+        server.getHost().setDeployOnStartup(true);
+
+        Connector httpsConnector = new Connector();
+        httpsConnector.setPort(Integer.parseInt(port));
+        httpsConnector.setSecure(true);
+        httpsConnector.setScheme("https");
+        //httpsConnector.setAttribute("keyAlias", keyAlias);
+        httpsConnector.setAttribute("keystorePass", "tompass");
+        httpsConnector.setAttribute("keystoreFile", "test-classes/server.jks");
+        httpsConnector.setAttribute("truststorePass", "tompass");
+        httpsConnector.setAttribute("truststoreFile", "test-classes/server.jks");
+        httpsConnector.setAttribute("clientAuth", "want");
+        // httpsConnector.setAttribute("clientAuth", "false");
+        httpsConnector.setAttribute("sslProtocol", "TLS");
+        httpsConnector.setAttribute("SSLEnabled", true);
+
+        server.getService().addConnector(httpsConnector);
+
+        if (idp) {
+            File stsWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp-sts");
+            server.addWebapp("/fediz-idp-sts", stsWebapp.getAbsolutePath());
+
+            File idpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(), "fediz-idp");
+            server.addWebapp("/fediz-idp", idpWebapp.getAbsolutePath());
+        } else {
+            File rpWebapp = new File(baseDir + File.separator + server.getHost().getAppBase(),
+                                     "fediz-systests-webapps-spring");
+            server.addWebapp("/fedizhelloworld", rpWebapp.getAbsolutePath());
+        }
+
+        server.start();
+
+        return server;
+    }
+
+    @Override
+    public String getIdpHttpsPort() {
+        return idpHttpsPort;
+    }
+
+    @Override
+    public String getRpHttpsPort() {
+        return rpHttpsPort;
+    }
+
+    @Override
+    public String getServletContextName() {
+        return "fedizhelloworld";
+    }
+
+    @Ignore("This tests is currently failing on Spring")
+    @Override
+    public void testConcurrentRequests() throws Exception {
+        // super.testConcurrentRequests();
+    }
+
+    @Override
+    @org.junit.Test
+    public void testCSRFAttack() throws Exception {
+        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
+            + "/j_spring_fediz_security_check";
+        csrfAttackTest(url);
+    }
+}

http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java
----------------------------------------------------------------------
diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java
deleted file mode 100644
index 3f2e03a..0000000
--- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractClientCertTests.java
+++ /dev/null
@@ -1,179 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.integrationtests;
-
-import java.net.URL;
-import java.util.ArrayList;
-
-import com.gargoylesoftware.htmlunit.CookieManager;
-import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
-import com.gargoylesoftware.htmlunit.HttpMethod;
-import com.gargoylesoftware.htmlunit.WebClient;
-import com.gargoylesoftware.htmlunit.WebRequest;
-import com.gargoylesoftware.htmlunit.html.DomElement;
-import com.gargoylesoftware.htmlunit.html.DomNodeList;
-import com.gargoylesoftware.htmlunit.html.HtmlForm;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
-import com.gargoylesoftware.htmlunit.util.NameValuePair;
-
-import org.apache.cxf.fediz.core.ClaimTypes;
-import org.apache.wss4j.dom.engine.WSSConfig;
-import org.junit.Assert;
-
-public abstract class AbstractClientCertTests {
-
-    static {
-        WSSConfig.init();
-    }
-
-    public AbstractClientCertTests() {
-        super();
-    }
-
-    public abstract String getServletContextName();
-
-    public abstract String getIdpHttpsPort();
-
-    public abstract String getRpHttpsPort();
-
-    @org.junit.Test
-    public void testClientAuthentication() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
-
-        final WebClient webClient = new WebClient();
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getOptions().setSSLClientCertificate(
-            this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks");
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
-        final HtmlForm form = idpPage.getFormByName("signinresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
-        // Test the Subject Confirmation method here
-        DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
-
-        String wresult = null;
-        for (DomElement result : results) {
-            if ("wresult".equals(result.getAttributeNS(null, "name"))) {
-                wresult = result.getAttributeNS(null, "value");
-                break;
-            }
-        }
-        Assert.assertTrue(wresult != null
-            && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"));
-
-        final HtmlPage rpPage = button.click();
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        final String bodyTextContent = rpPage.getBody().getTextContent();
-        String user = "alice";
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=false"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=false"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=true"));
-
-        String claim = ClaimTypes.FIRSTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'",
-                          bodyTextContent.contains(claim + "=Alice"));
-        claim = ClaimTypes.LASTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'",
-                          bodyTextContent.contains(claim + "=Smith"));
-        claim = ClaimTypes.EMAILADDRESS.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'alice@realma.org'",
-                          bodyTextContent.contains(claim + "=alice@realma.org"));
-
-        // webClient.close();
-    }
-
-    @org.junit.Test
-    public void testDifferentClientCertificate() throws Exception {
-        // Get the initial wresult from the IdP
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
-
-        CookieManager cookieManager = new CookieManager();
-        final WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getOptions().setSSLClientCertificate(
-            this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks");
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
-        // Test the Subject Confirmation method here
-        DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
-
-        String wresult = null;
-        String wa = "wsignin1.0";
-        String wctx = null;
-        String wtrealm = null;
-        for (DomElement result : results) {
-            if ("wresult".equals(result.getAttributeNS(null, "name"))) {
-                wresult = result.getAttributeNS(null, "value");
-            } else if ("wctx".equals(result.getAttributeNS(null, "name"))) {
-                wctx = result.getAttributeNS(null, "value");
-            } else if ("wtrealm".equals(result.getAttributeNS(null, "name"))) {
-                wtrealm = result.getAttributeNS(null, "value");
-            }
-        }
-        Assert.assertTrue(wctx != null && wtrealm != null);
-        Assert.assertTrue(wresult != null
-            && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"));
-        // webClient.close();
-
-        // Now invoke on the RP using the saved parameters above, but a different client cert!
-        final WebClient webClient2 = new WebClient();
-        webClient2.setCookieManager(cookieManager);
-        webClient2.getOptions().setUseInsecureSSL(true);
-        webClient2.getOptions().setSSLClientCertificate(
-            this.getClass().getClassLoader().getResource("server.jks"), "tompass", "jks");
-
-        WebRequest request = new WebRequest(new URL(url), HttpMethod.POST);
-
-        request.setRequestParameters(new ArrayList<NameValuePair>());
-        request.getRequestParameters().add(new NameValuePair("wctx", wctx));
-        request.getRequestParameters().add(new NameValuePair("wa", wa));
-        request.getRequestParameters().add(new NameValuePair("wtrealm", wtrealm));
-        request.getRequestParameters().add(new NameValuePair("wresult", wresult));
-
-        try {
-            webClient2.getPage(request);
-            Assert.fail("Exception expected");
-        } catch (FailingHttpStatusCodeException ex) {
-            // expected
-            Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode());
-        }
-
-        // webClient2.close();
-    }
-
-}

http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
----------------------------------------------------------------------
diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
deleted file mode 100644
index 65dead1..0000000
--- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/AbstractTests.java
+++ /dev/null
@@ -1,802 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.integrationtests;
-
-import java.net.URL;
-import java.net.URLEncoder;
-import java.util.ArrayList;
-
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-import org.w3c.dom.Node;
-
-import com.gargoylesoftware.htmlunit.CookieManager;
-import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
-import com.gargoylesoftware.htmlunit.HttpMethod;
-import com.gargoylesoftware.htmlunit.WebClient;
-import com.gargoylesoftware.htmlunit.WebRequest;
-import com.gargoylesoftware.htmlunit.html.DomElement;
-import com.gargoylesoftware.htmlunit.html.DomNodeList;
-import com.gargoylesoftware.htmlunit.html.HtmlForm;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
-import com.gargoylesoftware.htmlunit.util.NameValuePair;
-import com.gargoylesoftware.htmlunit.xml.XmlPage;
-
-import org.apache.commons.io.IOUtils;
-import org.apache.cxf.fediz.core.ClaimTypes;
-import org.apache.cxf.fediz.core.FederationConstants;
-import org.apache.cxf.fediz.core.util.DOMUtils;
-import org.apache.http.auth.AuthScope;
-import org.apache.http.auth.UsernamePasswordCredentials;
-import org.apache.wss4j.dom.engine.WSSConfig;
-import org.apache.xml.security.keys.KeyInfo;
-import org.apache.xml.security.signature.XMLSignature;
-import org.junit.Assert;
-import org.junit.Test;
-
-public abstract class AbstractTests {
-
-    static {
-        WSSConfig.init();
-    }
-
-    public AbstractTests() {
-        super();
-    }
-
-    public abstract String getServletContextName();
-
-    public abstract String getIdpHttpsPort();
-
-    public abstract String getRpHttpsPort();
-
-    @Test
-    public void testAlice() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        final String bodyTextContent =
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=false"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=false"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=true"));
-
-        String claim = ClaimTypes.FIRSTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'",
-                          bodyTextContent.contains(claim + "=Alice"));
-        claim = ClaimTypes.LASTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'",
-                          bodyTextContent.contains(claim + "=Smith"));
-        claim = ClaimTypes.EMAILADDRESS.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'alice@realma.org'",
-                          bodyTextContent.contains(claim + "=alice@realma.org"));
-
-    }
-
-    @Test
-    public void testAliceUser() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/user/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        final String bodyTextContent =
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=false"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=false"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=true"));
-    }
-
-    @Test
-    public void testAliceAdminNoAccess() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/admin/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        try {
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-            Assert.fail("Exception expected");
-        } catch (FailingHttpStatusCodeException ex) {
-            Assert.assertEquals(ex.getStatusCode(), 403);
-        }
-    }
-
-    @Test
-    public void testAliceManagerNoAccess() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/manager/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        try {
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-            Assert.fail("Exception expected");
-        } catch (FailingHttpStatusCodeException ex) {
-            Assert.assertEquals(ex.getStatusCode(), 403);
-        }
-    }
-
-    @Test
-    public void testAliceWrongPasswordNoAccess() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "alice";
-        String password = "alice";
-
-        try {
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-            Assert.fail("Exception expected");
-        } catch (FailingHttpStatusCodeException ex) {
-            Assert.assertEquals(ex.getStatusCode(), 401);
-        }
-    }
-
-    @Test
-    public void testBob() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "bob";
-        String password = "bob";
-
-        final String bodyTextContent =
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=true"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=true"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=true"));
-
-        String claim = ClaimTypes.FIRSTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Bob'",
-                          bodyTextContent.contains(claim + "=Bob"));
-        claim = ClaimTypes.LASTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Windsor'",
-                          bodyTextContent.contains(claim + "=Windsor"));
-        claim = ClaimTypes.EMAILADDRESS.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'bobwindsor@realma.org'",
-                          bodyTextContent.contains(claim + "=bobwindsor@realma.org"));
-    }
-
-    @Test
-    public void testBobUser() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/user/fedservlet";
-        String user = "bob";
-        String password = "bob";
-
-        final String bodyTextContent =
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=true"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=true"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=true"));
-    }
-
-    @Test
-    public void testBobManager() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/manager/fedservlet";
-        String user = "bob";
-        String password = "bob";
-
-        final String bodyTextContent =
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=true"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=true"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=true"));
-    }
-
-    @Test
-    public void testBobAdmin() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/admin/fedservlet";
-        String user = "bob";
-        String password = "bob";
-
-        final String bodyTextContent =
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=true"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=true"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=true"));
-    }
-
-    @Test
-    public void testTed() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "ted";
-        String password = "det";
-
-        final String bodyTextContent =
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent.contains("userPrincipal=" + user));
-        Assert.assertTrue("User " + user + " does not have role Admin",
-                          bodyTextContent.contains("role:Admin=false"));
-        Assert.assertTrue("User " + user + " does not have role Manager",
-                          bodyTextContent.contains("role:Manager=false"));
-        Assert.assertTrue("User " + user + " must have role User",
-                          bodyTextContent.contains("role:User=false"));
-
-        String claim = ClaimTypes.FIRSTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Ted'",
-                          bodyTextContent.contains(claim + "=Ted"));
-        claim = ClaimTypes.LASTNAME.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Cooper'",
-                          bodyTextContent.contains(claim + "=Cooper"));
-        claim = ClaimTypes.EMAILADDRESS.toString();
-        Assert.assertTrue("User " + user + " claim " + claim + " is not 'tcooper@realma.org'",
-                          bodyTextContent.contains(claim + "=tcooper@realma.org"));
-    }
-
-    @Test
-    public void testTedUserNoAccess() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/user/fedservlet";
-        String user = "ted";
-        String password = "det";
-
-        try {
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-            Assert.fail("Exception expected");
-        } catch (FailingHttpStatusCodeException ex) {
-            Assert.assertEquals(ex.getStatusCode(), 403);
-        }
-    }
-
-    @Test
-    public void testTedAdminNoAccess() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/admin/fedservlet";
-        String user = "ted";
-        String password = "det";
-
-        try {
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-            Assert.fail("Exception expected");
-        } catch (FailingHttpStatusCodeException ex) {
-            Assert.assertEquals(ex.getStatusCode(), 403);
-        }
-    }
-
-    @Test
-    public void testTedManagerNoAccess() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/manager/fedservlet";
-        String user = "ted";
-        String password = "det";
-
-        try {
-            HTTPTestUtils.login(url, user, password, getIdpHttpsPort());
-            Assert.fail("Exception expected");
-        } catch (FailingHttpStatusCodeException ex) {
-            Assert.assertEquals(ex.getStatusCode(), 403);
-        }
-    }
-
-    @Test
-    public void testRPMetadata() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort()
-            + "/" + getServletContextName() + "/FederationMetadata/2007-06/FederationMetadata.xml";
-
-        final WebClient webClient = new WebClient();
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getOptions().setSSLClientCertificate(
-            this.getClass().getClassLoader().getResource("client.jks"), "storepass", "jks");
-
-        final XmlPage rpPage = webClient.getPage(url);
-        final String xmlContent = rpPage.asXml();
-        Assert.assertTrue(xmlContent.startsWith("<md:EntityDescriptor"));
-
-        // Now validate the Signature
-        Document doc = rpPage.getXmlDocument();
-
-        doc.getDocumentElement().setIdAttributeNS(null, "ID", true);
-
-        Node signatureNode =
-            DOMUtils.getChild(doc.getDocumentElement(), "Signature");
-        Assert.assertNotNull(signatureNode);
-
-        XMLSignature signature = new XMLSignature((Element)signatureNode, "");
-        KeyInfo ki = signature.getKeyInfo();
-        Assert.assertNotNull(ki);
-        Assert.assertNotNull(ki.getX509Certificate());
-
-        Assert.assertTrue(signature.checkSignatureValue(ki.getX509Certificate()));
-
-        // webClient.close();
-    }
-
-    @Test
-    public void testRPLogout() throws Exception {
-
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        CookieManager cookieManager = new CookieManager();
-
-        // 1. Login
-        HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager);
-
-        // 2. Now we should have a cookie from the RP and IdP and should be able to do
-        // subsequent requests without authenticate again. Lets test this first.
-        WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        final HtmlPage rpPage = webClient.getPage(url);
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        // 3. now we logout from RP
-        String rpLogoutUrl = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/logout";
-
-        HTTPTestUtils.logout(rpLogoutUrl, cookieManager);
-
-        // 4. now we try to access the RP and idp without authentication but with the existing cookies
-        // to see if we are really logged out
-
-        // webClient.close();
-        webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getOptions().setThrowExceptionOnFailingStatusCode(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-
-        Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode());
-
-        // webClient.close();
-    }
-
-    @Test
-    public void testRPLogoutViaAction() throws Exception {
-
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        CookieManager cookieManager = new CookieManager();
-
-        // 1. Login
-        HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager);
-
-        // 2. Now we should have a cookie from the RP and IdP and should be able to do
-        // subsequent requests without authenticate again. Lets test this first.
-        WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        final HtmlPage rpPage = webClient.getPage(url);
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        // 3. now we logout from RP
-        String rpLogoutUrl = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet?wa=" + FederationConstants.ACTION_SIGNOUT;
-
-        HTTPTestUtils.logout(rpLogoutUrl, cookieManager);
-
-        // 4. now we try to access the RP and idp without authentication but with the existing cookies
-        // to see if we are really logged out
-
-        // webClient.close();
-        webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getOptions().setThrowExceptionOnFailingStatusCode(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-
-        Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode());
-
-        // webClient.close();
-    }
-
-    @Test
-    public void testIdPLogout() throws Exception {
-
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        CookieManager cookieManager = new CookieManager();
-
-        // 1. Login
-        HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager);
-
-        // 2. Now we should have a cookie from the RP and IdP and should be able to do
-        // subsequent requests without authenticate again. Lets test this first.
-        WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        final HtmlPage rpPage = webClient.getPage(url);
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        // 3. now we logout from IdP
-        String idpLogoutUrl = "https://localhost:" + getIdpHttpsPort() + "/fediz-idp/federation?wa="
-            + FederationConstants.ACTION_SIGNOUT; //todo logout url on idp?!?
-
-        HTTPTestUtils.logout(idpLogoutUrl, cookieManager);
-
-        // 4. now we try to access the RP and idp without authentication but with the existing cookies
-        // to see if we are really logged out
-
-        // webClient.close();
-        webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getOptions().setThrowExceptionOnFailingStatusCode(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-
-        Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode());
-
-        // webClient.close();
-    }
-
-    @Test
-    public void testIdPLogoutCleanup() throws Exception {
-
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        CookieManager cookieManager = new CookieManager();
-
-        // 1. Login
-        HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager);
-
-        // 2. Now we should have a cookie from the RP and IdP and should be able to do
-        // subsequent requests without authenticate again. Lets test this first.
-        WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        final HtmlPage rpPage = webClient.getPage(url);
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        // 3. now we logout from IdP
-        String idpLogoutUrl = "https://localhost:" + getIdpHttpsPort() + "/fediz-idp/federation?wa="
-            + FederationConstants.ACTION_SIGNOUT_CLEANUP;
-
-        HTTPTestUtils.logoutCleanup(idpLogoutUrl, cookieManager);
-
-        // 4. now we try to access the RP and idp without authentication but with the existing cookies
-        // to see if we are really logged out
-
-        // webClient.close();
-        webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getOptions().setThrowExceptionOnFailingStatusCode(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-
-        Assert.assertEquals(401, idpPage.getWebResponse().getStatusCode());
-
-        // webClient.close();
-    }
-
-    @Test
-    public void testAliceModifiedSignature() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName()
-            + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        // Get the initial token
-        CookieManager cookieManager = new CookieManager();
-        final WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
-        // Parse the form to get the token (wresult)
-        DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
-
-        for (DomElement result : results) {
-            if ("wresult".equals(result.getAttributeNS(null, "name"))) {
-                // Now modify the Signature
-                String value = result.getAttributeNS(null, "value");
-                value = value.replace("alice", "bob");
-                result.setAttributeNS(null, "value", value);
-            }
-        }
-
-        // Invoke back on the RP
-
-        final HtmlForm form = idpPage.getFormByName("signinresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
-        try {
-            button.click();
-            Assert.fail("Failure expected on a modified signature");
-        } catch (FailingHttpStatusCodeException ex) {
-            // expected
-            Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode());
-        }
-
-        // webClient.close();
-    }
-
-    @Test
-    public void testConcurrentRequests() throws Exception {
-
-        String url1 = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
-        String url2 = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/test.html";
-        String user = "bob";
-        String password = "bob";
-
-        // Get the initial token
-        CookieManager cookieManager = new CookieManager();
-        final WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage1 = webClient.getPage(url1);
-        final HtmlPage idpPage2 = webClient.getPage(url2);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage1.getTitleText());
-        Assert.assertEquals("IDP SignIn Response Form", idpPage2.getTitleText());
-
-        // Invoke back on the page1 RP
-        final HtmlForm form = idpPage1.getFormByName("signinresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-        final HtmlPage rpPage1 = button.click();
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage1.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage1.getTitleText()));
-
-        String bodyTextContent1 = rpPage1.getBody().getTextContent();
-
-        Assert.assertTrue("Principal not " + user,
-                          bodyTextContent1.contains("userPrincipal=" + user));
-
-        // Invoke back on the page2 RP
-        final HtmlForm form2 = idpPage2.getFormByName("signinresponseform");
-        final HtmlSubmitInput button2 = form2.getInputByName("_eventId_submit");
-        final HtmlPage rpPage2 = button2.click();
-        String bodyTextContent2 = rpPage2.getBody().getTextContent();
-
-        Assert.assertTrue("Unexpected content of RP page", bodyTextContent2.contains("Secure Test"));
-
-        // webClient.close();
-    }
-
-    @org.junit.Test
-    public void testMaliciousRedirect() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        CookieManager cookieManager = new CookieManager();
-
-        // 1. Login
-        HTTPTestUtils.loginWithCookieManager(url, user, password, getIdpHttpsPort(), cookieManager);
-
-        // 2. Now we should have a cookie from the RP and IdP and should be able to do
-        // subsequent requests without authenticate again. Lets test this first.
-        WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        HtmlPage rpPage = webClient.getPage(url);
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        // 3. Now a malicious user sends the client a URL with a bad "wreply" address to the IdP
-        String maliciousURL = "https://www.apache.org/attack";
-        String idpUrl
-         = "https://localhost:" + getIdpHttpsPort() + "/fediz-idp/federation";
-        idpUrl += "?wa=wsignin1.0&wreply=" + URLEncoder.encode(maliciousURL, "UTF-8");
-        idpUrl += "&wtrealm=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Afedizhelloworld";
-        idpUrl += "&whr=urn%3Aorg%3Aapache%3Acxf%3Afediz%3Aidp%3Arealm-A";
-        // webClient.close();
-
-        final WebClient webClient2 = new WebClient();
-        webClient2.setCookieManager(cookieManager);
-        webClient2.getOptions().setUseInsecureSSL(true);
-        webClient2.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient2.getOptions().setJavaScriptEnabled(false);
-        try {
-            webClient2.getPage(idpUrl);
-            Assert.fail("Failure expected on a bad wreply address");
-        } catch (FailingHttpStatusCodeException ex) {
-            Assert.assertEquals(ex.getStatusCode(), 400);
-        }
-        // webClient2.close();
-    }
-
-    @Test
-    public void testEntityExpansionAttack() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        // Get the initial token
-        CookieManager cookieManager = new CookieManager();
-        final WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
-        // Parse the form to get the token (wresult)
-        DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
-
-        String entity = IOUtils.toString(this.getClass().getClassLoader().getResource("entity.xml").openStream());
-        String reference = "&m;";
-
-        for (DomElement result : results) {
-            if ("wresult".equals(result.getAttributeNS(null, "name"))) {
-                // Now modify the Signature
-                String value = result.getAttributeNS(null, "value");
-                value = entity + value;
-                value = value.replace("alice", reference);
-                result.setAttributeNS(null, "value", value);
-            }
-        }
-
-        // Invoke back on the RP
-
-        final HtmlForm form = idpPage.getFormByName("signinresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
-        try {
-            button.click();
-            Assert.fail("Failure expected on an entity expansion attack");
-        } catch (FailingHttpStatusCodeException ex) {
-            // expected
-            Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode());
-        }
-
-        // webClient.close();
-    }
-
-    @org.junit.Test
-    public void testCSRFAttack() throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
-        csrfAttackTest(url);
-    }
-
-    protected void csrfAttackTest(String rpURL) throws Exception {
-        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
-        String user = "alice";
-        String password = "ecila";
-
-        // 1. Log in as "alice"
-        WebClient webClient = new WebClient();
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
-        final HtmlForm form = idpPage.getFormByName("signinresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
-        final HtmlPage rpPage = button.click();
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                            || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-
-        // 2. Log in as "bob" using another WebClient
-        WebClient webClient2 = new WebClient();
-        webClient2.getOptions().setUseInsecureSSL(true);
-        webClient2.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
-            new UsernamePasswordCredentials("bob", "bob"));
-
-        webClient2.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage2 = webClient2.getPage(url);
-        webClient2.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage2.getTitleText());
-
-        // 3. Now instead of clicking on the form, send the form via alice's WebClient instead
-
-        // Send with context...
-        WebRequest request = new WebRequest(new URL(rpURL), HttpMethod.POST);
-        request.setRequestParameters(new ArrayList<NameValuePair>());
-
-        DomNodeList<DomElement> results = idpPage2.getElementsByTagName("input");
-
-        for (DomElement result : results) {
-            if ("wresult".equals(result.getAttributeNS(null, "name"))
-                || "wa".equals(result.getAttributeNS(null, "name"))
-                || "wctx".equals(result.getAttributeNS(null, "name"))) {
-                String value = result.getAttributeNS(null, "value");
-                request.getRequestParameters().add(new NameValuePair(result.getAttributeNS(null, "name"), value));
-            }
-        }
-
-        try {
-            webClient.getPage(request);
-            Assert.fail("Failure expected on a CSRF attack");
-        } catch (FailingHttpStatusCodeException ex) {
-            // expected
-        }
-
-        // webClient.close();
-
-    }
-
-}

http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java
----------------------------------------------------------------------
diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java b/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java
deleted file mode 100644
index f5a530d..0000000
--- a/systests/tests/src/test/java/org/apache/cxf/fediz/integrationtests/HTTPTestUtils.java
+++ /dev/null
@@ -1,155 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.integrationtests;
-
-import java.io.IOException;
-
-import com.gargoylesoftware.htmlunit.CookieManager;
-import com.gargoylesoftware.htmlunit.WebClient;
-import com.gargoylesoftware.htmlunit.html.DomElement;
-import com.gargoylesoftware.htmlunit.html.DomNodeList;
-import com.gargoylesoftware.htmlunit.html.HtmlForm;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
-
-import org.apache.http.auth.AuthScope;
-import org.apache.http.auth.UsernamePasswordCredentials;
-import org.junit.Assert;
-
-/**
- * Some basic HTTP-based functionality for use in the tests
- */
-public final class HTTPTestUtils {
-
-    private HTTPTestUtils() {
-        // complete
-    }
-
-    public static String login(String url, String user, String password, String idpPort) throws IOException {
-        final WebClient webClient = new WebClient();
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(idpPort)),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
-        final HtmlForm form = idpPage.getFormByName("signinresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
-        final HtmlPage rpPage = button.click();
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                            || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        // webClient.close();
-        return rpPage.getBody().getTextContent();
-    }
-
-    public static String loginForSAMLSSO(String url, String user, String password, String idpPort) throws IOException {
-        final WebClient webClient = new WebClient();
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(idpPort)),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage rpPage = webClient.getPage(url);
-
-        // webClient.close();
-        return rpPage.getBody().getTextContent();
-    }
-
-    public static String loginWithCookieManager(String url, String user, String password,
-                                                String idpPort, CookieManager cookieManager) throws IOException {
-        final WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        webClient.getCredentialsProvider().setCredentials(
-            new AuthScope("localhost", Integer.parseInt(idpPort)),
-            new UsernamePasswordCredentials(user, password));
-
-        webClient.getOptions().setJavaScriptEnabled(false);
-        final HtmlPage idpPage = webClient.getPage(url);
-        webClient.getOptions().setJavaScriptEnabled(true);
-        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
-
-        final HtmlForm form = idpPage.getFormByName("signinresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-
-        final HtmlPage rpPage = button.click();
-        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
-                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
-
-        // webClient.close();
-        return rpPage.getBody().getTextContent();
-    }
-
-    public static void logout(String url, CookieManager cookieManager) throws IOException {
-        final WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        final HtmlPage idpPage = webClient.getPage(url);
-
-        Assert.assertEquals("IDP SignOut Confirmation Response Page", idpPage.getTitleText());
-
-        final HtmlForm form = idpPage.getFormByName("signoutconfirmationresponseform");
-        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
-        final HtmlPage idpLogoutPage = button.click();
-
-        DomNodeList<DomElement> images = idpLogoutPage.getElementsByTagName("img");
-        Assert.assertEquals(1, images.getLength());
-        for (int i = 0; i < images.size(); i++) {
-            DomElement domElement = images.get(i);
-            String imgSrc = domElement.getAttribute("src");
-
-            //we should get a fault if the image isn't available.
-            webClient.getPage(imgSrc);
-        }
-
-        // webClient.close();
-    }
-
-    public static void logoutCleanup(String url, CookieManager cookieManager) throws IOException {
-        final WebClient webClient = new WebClient();
-        webClient.setCookieManager(cookieManager);
-        webClient.getOptions().setUseInsecureSSL(true);
-        final HtmlPage idpPage = webClient.getPage(url);
-
-        Assert.assertEquals("IDP SignOut Response Page", idpPage.getTitleText());
-
-        Assert.assertTrue(idpPage.asText().contains("CXF Fediz IDP successful logout"));
-
-        DomNodeList<DomElement> images = idpPage.getElementsByTagName("img");
-        Assert.assertEquals(1, images.getLength());
-        for (int i = 0; i < images.size(); i++) {
-            DomElement domElement = images.get(i);
-            String imgSrc = domElement.getAttribute("src");
-
-            //we should get a fault if the image isn't available.
-            webClient.getPage(imgSrc);
-        }
-
-        // webClient.close();
-    }
-
-}

http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/cc76fc31/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java
----------------------------------------------------------------------
diff --git a/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java
new file mode 100644
index 0000000..0599559
--- /dev/null
+++ b/systests/tests/src/test/java/org/apache/cxf/fediz/systests/common/AbstractClientCertTests.java
@@ -0,0 +1,179 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.systests.common;
+
+import java.net.URL;
+import java.util.ArrayList;
+
+import com.gargoylesoftware.htmlunit.CookieManager;
+import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
+import com.gargoylesoftware.htmlunit.HttpMethod;
+import com.gargoylesoftware.htmlunit.WebClient;
+import com.gargoylesoftware.htmlunit.WebRequest;
+import com.gargoylesoftware.htmlunit.html.DomElement;
+import com.gargoylesoftware.htmlunit.html.DomNodeList;
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+import com.gargoylesoftware.htmlunit.util.NameValuePair;
+
+import org.apache.cxf.fediz.core.ClaimTypes;
+import org.apache.wss4j.dom.engine.WSSConfig;
+import org.junit.Assert;
+
+public abstract class AbstractClientCertTests {
+
+    static {
+        WSSConfig.init();
+    }
+
+    public AbstractClientCertTests() {
+        super();
+    }
+
+    public abstract String getServletContextName();
+
+    public abstract String getIdpHttpsPort();
+
+    public abstract String getRpHttpsPort();
+
+    @org.junit.Test
+    public void testClientAuthentication() throws Exception {
+        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
+
+        final WebClient webClient = new WebClient();
+        webClient.getOptions().setUseInsecureSSL(true);
+        webClient.getOptions().setSSLClientCertificate(
+            this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks");
+
+        webClient.getOptions().setJavaScriptEnabled(false);
+        final HtmlPage idpPage = webClient.getPage(url);
+        webClient.getOptions().setJavaScriptEnabled(true);
+        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
+
+        final HtmlForm form = idpPage.getFormByName("signinresponseform");
+        final HtmlSubmitInput button = form.getInputByName("_eventId_submit");
+
+        // Test the Subject Confirmation method here
+        DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
+
+        String wresult = null;
+        for (DomElement result : results) {
+            if ("wresult".equals(result.getAttributeNS(null, "name"))) {
+                wresult = result.getAttributeNS(null, "value");
+                break;
+            }
+        }
+        Assert.assertTrue(wresult != null
+            && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"));
+
+        final HtmlPage rpPage = button.click();
+        Assert.assertTrue("WS Federation Systests Examples".equals(rpPage.getTitleText())
+                          || "WS Federation Systests Spring Examples".equals(rpPage.getTitleText()));
+
+        final String bodyTextContent = rpPage.getBody().getTextContent();
+        String user = "alice";
+        Assert.assertTrue("Principal not " + user,
+                          bodyTextContent.contains("userPrincipal=" + user));
+        Assert.assertTrue("User " + user + " does not have role Admin",
+                          bodyTextContent.contains("role:Admin=false"));
+        Assert.assertTrue("User " + user + " does not have role Manager",
+                          bodyTextContent.contains("role:Manager=false"));
+        Assert.assertTrue("User " + user + " must have role User",
+                          bodyTextContent.contains("role:User=true"));
+
+        String claim = ClaimTypes.FIRSTNAME.toString();
+        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Alice'",
+                          bodyTextContent.contains(claim + "=Alice"));
+        claim = ClaimTypes.LASTNAME.toString();
+        Assert.assertTrue("User " + user + " claim " + claim + " is not 'Smith'",
+                          bodyTextContent.contains(claim + "=Smith"));
+        claim = ClaimTypes.EMAILADDRESS.toString();
+        Assert.assertTrue("User " + user + " claim " + claim + " is not 'alice@realma.org'",
+                          bodyTextContent.contains(claim + "=alice@realma.org"));
+
+        // webClient.close();
+    }
+
+    @org.junit.Test
+    public void testDifferentClientCertificate() throws Exception {
+        // Get the initial wresult from the IdP
+        String url = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
+
+        CookieManager cookieManager = new CookieManager();
+        final WebClient webClient = new WebClient();
+        webClient.setCookieManager(cookieManager);
+        webClient.getOptions().setUseInsecureSSL(true);
+        webClient.getOptions().setSSLClientCertificate(
+            this.getClass().getClassLoader().getResource("alice_client.jks"), "storepass", "jks");
+
+        webClient.getOptions().setJavaScriptEnabled(false);
+        final HtmlPage idpPage = webClient.getPage(url);
+        webClient.getOptions().setJavaScriptEnabled(true);
+        Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText());
+
+        // Test the Subject Confirmation method here
+        DomNodeList<DomElement> results = idpPage.getElementsByTagName("input");
+
+        String wresult = null;
+        String wa = "wsignin1.0";
+        String wctx = null;
+        String wtrealm = null;
+        for (DomElement result : results) {
+            if ("wresult".equals(result.getAttributeNS(null, "name"))) {
+                wresult = result.getAttributeNS(null, "value");
+            } else if ("wctx".equals(result.getAttributeNS(null, "name"))) {
+                wctx = result.getAttributeNS(null, "value");
+            } else if ("wtrealm".equals(result.getAttributeNS(null, "name"))) {
+                wtrealm = result.getAttributeNS(null, "value");
+            }
+        }
+        Assert.assertTrue(wctx != null && wtrealm != null);
+        Assert.assertTrue(wresult != null
+            && wresult.contains("urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"));
+        // webClient.close();
+
+        // Now invoke on the RP using the saved parameters above, but a different client cert!
+        final WebClient webClient2 = new WebClient();
+        webClient2.setCookieManager(cookieManager);
+        webClient2.getOptions().setUseInsecureSSL(true);
+        webClient2.getOptions().setSSLClientCertificate(
+            this.getClass().getClassLoader().getResource("server.jks"), "tompass", "jks");
+
+        WebRequest request = new WebRequest(new URL(url), HttpMethod.POST);
+
+        request.setRequestParameters(new ArrayList<NameValuePair>());
+        request.getRequestParameters().add(new NameValuePair("wctx", wctx));
+        request.getRequestParameters().add(new NameValuePair("wa", wa));
+        request.getRequestParameters().add(new NameValuePair("wtrealm", wtrealm));
+        request.getRequestParameters().add(new NameValuePair("wresult", wresult));
+
+        try {
+            webClient2.getPage(request);
+            Assert.fail("Exception expected");
+        } catch (FailingHttpStatusCodeException ex) {
+            // expected
+            Assert.assertTrue(401 == ex.getStatusCode() || 403 == ex.getStatusCode());
+        }
+
+        // webClient2.close();
+    }
+
+}


Mime
View raw message