cdmlib-services/src/test/java/eu/etaxonomy/cdm/api/service/UserServiceImplTest.java

   1 /**
   2 * Copyright (C) 2009 EDIT
   3 * European Distributed Institute of Taxonomy
   4 * http://www.e-taxonomy.eu
   5 *
   6 * The contents of this file are subject to the Mozilla Public License Version 1.1
   7 * See LICENSE.TXT at the top of this package for the full license terms.
   8 */
   9
  10 package eu.etaxonomy.cdm.api.service;
  11
  12
  13 import java.util.ArrayList;
  14 import java.util.HashSet;
  15 import java.util.List;
  16 import java.util.Set;
  17 import java.util.UUID;
  18
  19 import org.apache.log4j.Logger;
  20 import org.joda.time.DateTime;
  21 import org.junit.Assert;
  22 import org.junit.Before;
  23 import org.junit.Ignore;
  24 import org.junit.Test;
  25 import org.springframework.security.authentication.AuthenticationManager;
  26 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  27 import org.springframework.security.core.Authentication;
  28 import org.springframework.security.core.GrantedAuthority;
  29 import org.springframework.security.core.context.SecurityContext;
  30 import org.springframework.security.core.context.SecurityContextHolder;
  31 import org.unitils.dbunit.annotation.DataSet;
  32 import org.unitils.spring.annotation.SpringApplicationContext;
  33 import org.unitils.spring.annotation.SpringBeanByType;
  34
  35 import eu.etaxonomy.cdm.model.common.GrantedAuthorityImpl;
  36 import eu.etaxonomy.cdm.model.common.User;
  37 import eu.etaxonomy.cdm.persistence.hibernate.permission.CdmPermissionEvaluator;
  38 import eu.etaxonomy.cdm.persistence.query.MatchMode;
  39 import eu.etaxonomy.cdm.test.integration.CdmIntegrationTest;
  40
  41 @Ignore //FIXME tests are failing
  42 @SpringApplicationContext("file:./target/test-classes/eu/etaxonomy/cdm/applicationContext-securityTest.xml")
  43 public class UserServiceImplTest extends CdmIntegrationTest {
  44
  45     protected static final Logger logger = Logger.getLogger(UserServiceImplTest.class);
  46
  47     @SpringBeanByType
  48     private AuthenticationManager authenticationManager;
  49
  50     @SpringBeanByType
  51     private IUserService userService;
  52
  53     @SpringBeanByType
  54     private IGroupService groupService;
  55
  56     @SpringBeanByType
  57     private ITaxonService taxonService;
  58
  59     @SpringBeanByType
  60     private CdmPermissionEvaluator permissionEvaluator;
  61
  62
  63 //      @SpringBeanByType
  64 //    public void setDataSource(@Qualifier("dataSource") DataSource dataSource) {
  65 //        this.dataSource=dataSource;
  66 //    }
  67
  68
  69 //
  70 //      @TestDataSource
  71 //      protected DataSource dataSource;
  72
  73     private Set<GrantedAuthority> expectedRoles;
  74     private UsernamePasswordAuthenticationToken token;
  75
  76     private Authentication authentication;
  77
  78     UUID uuid;
  79
  80     @Before
  81     public void setUp() {
  82         expectedRoles = new HashSet<GrantedAuthority>();
  83
  84         GrantedAuthorityImpl update = GrantedAuthorityImpl.NewInstance();
  85         update.setAuthority("USER.Update");
  86         update.setUuid(UUID.fromString("14788361-1a7e-4eed-b22f-fd90a0b424ac"));
  87         update.setCreated(new DateTime(2009,2,3,17,52,26,0));
  88         GrantedAuthorityImpl annotate = GrantedAuthorityImpl.NewInstance();
  89         annotate.setAuthority("USER.Create");
  90         annotate.setUuid(UUID.fromString("fa56073c-0ffd-4384-b459-b2f07e35b689"));
  91         annotate.setCreated(new DateTime(2009,2,3,17,52,26,0));
  92         GrantedAuthorityImpl checkAnnotation = GrantedAuthorityImpl.NewInstance();
  93         checkAnnotation.setAuthority("USER.Delete");
  94         checkAnnotation.setUuid(UUID.fromString("e5354c0e-657b-4b4d-bb2f-791612199711"));
  95         checkAnnotation.setCreated(new DateTime(2009,2,3,17,52,26,0));
  96         GrantedAuthorityImpl userAdmin = GrantedAuthorityImpl.NewInstance();
  97         userAdmin.setAuthority("USER.Admin");
  98
  99         expectedRoles.add(update);
 100         expectedRoles.add(annotate);
 101         expectedRoles.add(checkAnnotation);
 102         expectedRoles.add(userAdmin);
 103         String username = "useradmin";
 104         String password = "password";
 105         User user = User.NewInstance(username, password);
 106         user.setAccountNonExpired(true);
 107         user.setGrantedAuthorities(expectedRoles);
 108         uuid = userService.save(user);
 109
 110         User standardUser =  User.NewInstance("standardUser", "pw");
 111         uuid = userService.save(standardUser);
 112
 113         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
 114         authentication = authenticationManager.authenticate(token);
 115         SecurityContext context = SecurityContextHolder.getContext();
 116         context.setAuthentication(authentication);
 117     }
 118
 119
 120     @Test
 121     @DataSet
 122     public void testCreateUser() {
 123         String username = "user2";
 124         String password = "password";
 125         User user = User.NewInstance(username, password);
 126
 127         userService.createUser(user);
 128
 129         List<User> userList = userService.listByUsername("user2", MatchMode.EXACT, null, null, null, null, null);
 130         Assert.assertNotNull(userList);
 131
 132         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("standardUser", "pw");
 133         authentication = authenticationManager.authenticate(token);
 134         SecurityContext context = SecurityContextHolder.getContext();
 135         context.setAuthentication(authentication);
 136         try{
 137             userService.createUser(user);
 138             Assert.fail();
 139         }catch(Exception e){
 140             Assert.assertEquals("Access is denied", e.getMessage());
 141         }
 142     }
 143
 144
 145
 146     @Test
 147     @DataSet
 148     public void testUpdateUser(){
 149         User user= userService.find(uuid);
 150         user.setEmailAddress("test@bgbm.org");
 151         try{
 152         userService.updateUser(user);
 153         }catch (Exception e){
 154             Assert.fail();
 155         }
 156
 157         try{
 158             userService.update(user);
 159             }catch (Exception e){
 160                 Assert.fail();
 161             }
 162         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("standardUser", "pw");
 163         authentication = authenticationManager.authenticate(token);
 164         SecurityContext context = SecurityContextHolder.getContext();
 165         context.setAuthentication(authentication);
 166         user.setEmailAddress("user@bgbm.org");
 167         try{
 168         userService.updateUser(user);
 169         Assert.fail();
 170         }catch (Exception e){
 171             Assert.assertEquals("Access is denied", e.getMessage());
 172         }
 173
 174         try{
 175             userService.saveOrUpdate(user);
 176             Assert.fail();
 177         }catch (Exception e){
 178             Assert.assertEquals("Access is denied", e.getMessage());
 179         }
 180         try{
 181             userService.update(user);
 182             Assert.fail();
 183         }catch (Exception e){
 184             Assert.assertEquals("Access is denied", e.getMessage());
 185         }
 186     }
 187
 188     @Test
 189     @DataSet
 190     public void testIfAnyGranted() {
 191         Object p = authentication.getPrincipal();
 192         Assert.assertTrue(p instanceof User);
 193         User principal = (User)p;
 194
 195         Assert.assertEquals(principal.getUsername(),"useradmin");
 196
 197         Assert.assertNotNull(expectedRoles);
 198         Assert.assertEquals(expectedRoles.size(), authentication.getAuthorities().size());
 199     }
 200
 201
 202     @Test
 203     @DataSet
 204     public void testCreateGroup(){
 205
 206         GrantedAuthorityImpl userAdminUpdate = GrantedAuthorityImpl.NewInstance();
 207         userAdminUpdate.setAuthority("USER.update");
 208         GrantedAuthorityImpl userAdminCreate = GrantedAuthorityImpl.NewInstance();
 209         userAdminCreate.setAuthority("USER.create");
 210         GrantedAuthorityImpl userAdminDelete = GrantedAuthorityImpl.NewInstance();
 211         userAdminDelete.setAuthority("USER.delete");
 212         List<GrantedAuthority> list = new ArrayList<GrantedAuthority>();
 213         list.add(userAdminUpdate);
 214         list.add(userAdminDelete);
 215         list.add(userAdminCreate);
 216
 217
 218         userService.createGroup("UserAdmins", list);
 219         String username = "user3";
 220         String password = "password";
 221         User user = User.NewInstance(username, password);
 222         userService.createUser(user);
 223         List<String> groups = userService.findAllGroups();
 224         Assert.assertEquals("UserAdmins", groups.get(0));
 225
 226
 227         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
 228         authentication = authenticationManager.authenticate(token);
 229         SecurityContext context = SecurityContextHolder.getContext();
 230         context.setAuthentication(authentication);
 231
 232         username = "user4";
 233         password = "password";
 234         user = User.NewInstance(username, password);
 235         try{
 236             userService.createUser(user);
 237             Assert.fail();
 238         }catch(Exception e){
 239             Assert.assertEquals("Access is denied", e.getMessage());
 240         }
 241         groupService.addUserToGroup("user3", "UserAdmins");
 242
 243     //  System.err.println(context.getAuthentication().getName());
 244         try{
 245             userService.createUser(user);
 246         }catch(Exception e){
 247             System.err.println(e.getMessage());
 248             Assert.fail();
 249         }
 250
 251     }
 252
 253
 254     @Test
 255     @DataSet
 256     public void testChangePassword(){
 257         String username = "useradmin";
 258         String newPassword = "password2";
 259         userService.changePasswordForUser(username, newPassword);
 260         username = "user4";
 261         String password = "password";
 262         User user = User.NewInstance(username, password);
 263         userService.createUser(user);
 264         try{
 265             userService.changePasswordForUser(username, "newPassword");
 266         }catch (Exception e){
 267             System.err.println(e.getMessage());
 268             Assert.fail();
 269         }
 270     }
 271
 272 }