001 /*
002 * TestSecurity.java
003 *
004 * Copyright (c) 1995-2010, The University of Sheffield. See the file
005 * COPYRIGHT.txt in the software or at http://gate.ac.uk/gate/COPYRIGHT.txt
006 *
007 * This file is part of GATE (see http://gate.ac.uk/), and is free
008 * software, licenced under the GNU Library General Public License,
009 * Version 2, June 1991 (in the distribution as file licence.html,
010 * and also available at http://gate.ac.uk/gate/licence.html).
011 *
012 * Kalina Bontcheva, 01/Oct/01
013 *
014 * $Id: TestSecurity.java 12006 2009-12-01 17:24:28Z thomas_heitz $
015 */
016
017 package gate.security;
018
019 import java.util.List;
020
021 import junit.framework.*;
022
023 import gate.*;
024 import gate.Factory;
025 import gate.Gate;
026 import gate.util.*;
027
028 /** Persistence test class
029 */
030 public class TestSecurity extends TestCase
031 {
032 /** Debug flag */
033 private static final boolean DEBUG = false;
034 private static final int ADMIN_GROUP_ID = 0;
035 private static final int ADMIN_USER_ID = 0;
036
037 private static final int SUAHILI_GROUP_ID = 101;
038 private static final int ENGLISH_GROUP_ID = 101;
039
040
041 /** JDBC URL */
042 private static String JDBC_URL;
043
044 private boolean exceptionThrown = false;
045
046 /** Construction */
047 public TestSecurity(String name) throws GateException { super(name); }
048
049 /** Fixture set up */
050 public void setUp() throws Exception {
051 if (! DataStoreRegister.getConfigData().containsKey("url-test"))
052 throw new GateRuntimeException("DB URL not configured in gate.xml");
053 else
054 JDBC_URL =
055 (String) DataStoreRegister.getConfigData().get("url-test");
056 } // setUp
057
058 /** Put things back as they should be after running tests
059 * (reinitialise the CREOLE register).
060 */
061 public void tearDown() throws Exception {
062 } // tearDown
063
064
065 public void testSecurityTables() throws Exception {
066 // AccessController ac = new AccessControllerImpl(JDBC_URL);
067 AccessController ac = Factory.createAccessController(JDBC_URL);
068 ac.open();
069
070 User myUser = ac.findUser("kalina");
071 Assert.assertNotNull(myUser);
072 Assert.assertEquals(myUser.getName(), "kalina");
073
074 List myGroups = myUser.getGroups();
075
076 Assert.assertNotNull(myGroups);
077 for (int i = 0; i< myGroups.size(); i++) {
078 Group myGroup = //ac.findGroup((Long) myGroups.get(i));
079 (Group)myGroups.get(i);
080 if (i == 0)
081 Assert.assertEquals(myGroup.getName(), "English Language Group");
082 else if (i == 1)
083 Assert.assertEquals(myGroup.getName(), "Suahili Group");
084 //now it is allowed for the test user to be a member of more than these
085 //two groups, as it was creating a problem
086 }//for
087
088 Session mySession = ac.login("kalina", "sesame",
089 ac.findGroup("English Language Group").getID());
090 Assert.assertNotNull(mySession);
091 // Assert.assertTrue(ac.isValidSession(mySession));
092
093 } // testSecurityTables
094
095
096
097 public void testUserGroupManipulation() throws Exception {
098
099 //1. open security factory
100 AccessController ac = Factory.createAccessController(JDBC_URL);
101 ac.open();
102
103 //1.1 list groups and users
104 List groups = ac.listGroups();
105 Assert.assertNotNull(groups);
106
107 if(DEBUG)
108 Err.prln("+++ found ["+groups.size()+"] groups...");
109
110 List users = ac.listUsers();
111 Assert.assertNotNull(users);
112 if(DEBUG)
113 Err.prln("+++ found ["+users.size()+"] users...");
114
115 //2. log into the securoty factory
116 Session adminSession = ac.login("ADMIN", "sesame",new Long(ADMIN_GROUP_ID));
117 //check session
118 Assert.assertNotNull(adminSession);
119 //is session valid?
120 Assert.assertTrue(true == ac.isValidSession(adminSession));
121 //assert session is privieged
122 Assert.assertTrue(adminSession.isPrivilegedSession());
123
124 //3. create a new user and group
125 User myUser;
126 try {
127 myUser = ac.createUser("myUser", "myPassword",adminSession);
128 } catch (gate.security.SecurityException ex) {
129 //user kalina hasn't got enough priviliges, so login as admin
130 adminSession = ac.login("ADMIN", "sesame", ac.findGroup("ADMINS").getID());
131 //assert session is privieged
132 Assert.assertTrue(adminSession.isPrivilegedSession());
133
134 myUser = ac.createUser("myUser", "myPassword",adminSession);
135 }
136
137 //is the user aded to the security factory?
138 Assert.assertNotNull(ac.findUser("myUser"));
139 //is the user in the security factory equal() to what we put there?
140 Assert.assertEquals(myUser,ac.findUser("myUser"));
141 //is the key correct?
142 Assert.assertEquals(myUser.getName(),ac.findUser("myUser").getName());
143
144
145
146 Group myGroup = ac.createGroup("myGroup",adminSession);
147 //is the group aded to the security factory?
148 Assert.assertNotNull(ac.findGroup("myGroup"));
149 //is the group in the security factory equal() to what we put there?
150 Assert.assertEquals(myGroup,ac.findGroup("myGroup"));
151 //is the key correct?
152 Assert.assertEquals(myGroup.getName(), "myGroup");
153
154
155
156 //4. add user to group
157 myGroup.addUser(myUser, adminSession);
158 //is the user added to the group?
159 Assert.assertTrue(myGroup.getUsers().contains(myUser));
160
161 //4.1 does the user know he's member of the group now?
162 Assert.assertTrue(myUser.getGroups().contains(myGroup));
163
164 //5. change group name
165 String oldName = myGroup.getName();
166 myGroup.setName("my new group", adminSession);
167 //is the name changed?
168 Assert.assertEquals("my new group",myGroup.getName());
169 //test objectModification propagation
170 //[does change of group name reflect change of keys in the collections
171 //of the security factory?]
172 Assert.assertNotNull(ac.findGroup("my new group"));
173 //check that there is nothing hashed
174 //with the old key
175 exceptionThrown = false;
176 try { ac.findGroup(oldName); }
177 catch(SecurityException sex) {exceptionThrown = true;}
178 Assert.assertTrue(exceptionThrown);
179
180 //5.5 change user name
181 oldName = myUser.getName();
182 myUser.setName("my new user", adminSession);
183 //is the name changed?
184 Assert.assertEquals("my new user",myUser.getName());
185 //test objectModification propagation
186 //[does change of user name reflect change of keys in the collections
187 //of the security factory?]
188 Assert.assertNotNull(ac.findUser("my new user"));
189 //check that there is nothing hashed
190 //with the old key
191 exceptionThrown = false;
192 try { ac.findUser(oldName); }
193 catch(SecurityException sex) {exceptionThrown = true;}
194 Assert.assertTrue(exceptionThrown);
195
196 //5.6. restore name
197 myUser.setName(oldName, adminSession);
198
199 //6. get users
200 List myUsers = myGroup.getUsers();
201 Assert.assertNotNull(myUsers);
202 for (int i = 0; i< myUsers.size(); i++) {
203 //verify that there are no junk users
204 //i.e. evry user in the collection is known by the security factory
205 User myUser1 = ac.findUser(((User)myUsers.get(i)).getID());
206 //verify that the user is aware he's nmember of the group
207 Assert.assertTrue(myUser1.getGroups().contains(myGroup));
208
209
210 }//for
211
212 //7. change name again
213 myGroup.setName("my new group again", adminSession);
214 //is the name changed?
215 Assert.assertEquals("my new group again",myGroup.getName());
216
217 //8. try to log the user in
218 Session mySession = ac.login("myUser", "myPassword",
219 ac.findGroup("my new group again").getID());
220 //check session
221 Assert.assertNotNull(mySession);
222 //is valid session?
223 Assert.assertTrue(true == ac.isValidSession(mySession));
224
225 //9. logout
226 ac.logout(mySession);
227 //is session invalidated?
228 Assert.assertTrue(false == ac.isValidSession(mySession));
229
230 //10. try to perform an operation with invalid session
231 exceptionThrown = false;
232 try {
233 myGroup.removeUser(myUser,mySession);
234 }
235 catch(SecurityException ex) {
236 exceptionThrown = true;
237 if(DEBUG)
238 Err.prln("++++ OK, got exception ["+ex.getMessage()+"]");
239 }
240 Assert.assertTrue(true == exceptionThrown);
241
242 //10.1 login again
243 mySession = ac.login("myUser", "myPassword",
244 ac.findGroup("my new group again").getID());
245 //check session
246 Assert.assertNotNull(mySession);
247 //is valid session?
248 Assert.assertTrue(true == ac.isValidSession(mySession));
249
250 //11. try to delete group
251 ac.deleteGroup(myGroup, adminSession);
252 //is the group deleted?
253 exceptionThrown = false;
254 try {
255 ac.findGroup(myGroup.getName());
256 }
257 catch(SecurityException se) {
258 if(DEBUG)
259 Err.prln("++ OK, got exception");
260
261 exceptionThrown = true;
262 }
263 Assert.assertTrue(exceptionThrown);
264
265 //11.1 does the user know that he's no longer member of the group?
266 Assert.assertTrue(false == myUser.getGroups().contains(myGroup));
267
268 //11.2 is the user's sesion invalidated?
269 Assert.assertTrue(false == ac.isValidSession(mySession));
270
271 //11.3 add the user to new group
272 Group suahiliGrp = ac.findGroup(new Long(TestSecurity.SUAHILI_GROUP_ID));
273 Assert.assertNotNull(suahiliGrp);
274 suahiliGrp.addUser(myUser,adminSession);
275 //11.4 check if the group knows the user is now mmeber
276 Assert.assertTrue(suahiliGrp.getUsers().contains(myUser));
277 //11.5 check if the user know he's member of the group
278 Assert.assertTrue(myUser.getGroups().contains(suahiliGrp));
279 //11.6 login again [with the new group]
280 Session newSession = ac.login("myUser","myPassword",suahiliGrp.getID());
281 //11.7 check session
282 Assert.assertTrue(ac.isValidSession(newSession));
283
284
285 //12. check that the sessions are invalidated if the
286 //group/user in the session is deleted
287
288 //12.1 delete user
289 ac.deleteUser(myUser, adminSession);
290 //12.2 assert he's deleted from the Security Controller
291 exceptionThrown = false;
292 try {
293 ac.findUser(myUser.getName());
294 }
295 catch(SecurityException se) {
296
297 if(DEBUG)
298 Err.prln("++ OK, got exception");
299
300 exceptionThrown = true;
301 }
302 Assert.assertTrue(exceptionThrown);
303 //12.3 assert the group has deleted the user as member
304 Assert.assertTrue(false == suahiliGrp.getUsers().contains(myUser));
305 //12.4 assert the session is invalidated
306 Assert.assertTrue(false == ac.isValidSession(newSession));
307
308 //13. check objectModification events
309
310 //14.
311
312 } // testUserGroupManipulation
313
314
315
316 /** Test suite routine for the test runner */
317 public static Test suite() {
318 return new TestSuite(TestSecurity.class);
319 } // suite
320
321 public static void main(String[] args){
322 try{
323 Gate.setLocalWebServer(false);
324 Gate.setNetConnected(false);
325 Gate.init();
326 TestSecurity test = new TestSecurity("");
327
328 test.setUp();
329 test.testSecurityTables();
330 test.tearDown();
331
332 test.setUp();
333 test.testUserGroupManipulation();
334 test.tearDown();
335
336 }catch(Exception e){
337 e.printStackTrace();
338 }
339 }
340 } // class TestPersist
|