-
Notifications
You must be signed in to change notification settings - Fork 149
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add Security to StateChanging REST methods
* POST, PUT, DELETE now require authentication * Change to use Twitter Sign In, instead of app authentication * Workaround AGOVA-53 When the Security Module is included in the deployment all REST services are locked down. This means any state changing methods will require authentication. The Security Module test-jar comes with a Arquillian Extension that will setup do a full authentication in AfterDeploy and setup RestAssured with a valid Http Session. This allow the conference, user, attachment REST Stories used as final functional tests in the Application to work with our without the Security Module included. The REST tests have no knowledge of the Security Module. Issue: #52
- Loading branch information
1 parent
19d380b
commit c9ed918
Showing
12 changed files
with
304 additions
and
39 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
27 changes: 27 additions & 0 deletions
27
...rity/src/main/java/org/cedj/geekseek/service/security/oauth/SuccessfulAuthentication.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| package org.cedj.geekseek.service.security.oauth; | ||
|
|
||
| import java.io.Serializable; | ||
|
|
||
| import org.agorava.core.api.UserProfile; | ||
| import org.agorava.core.api.oauth.OAuthToken; | ||
|
|
||
| public class SuccessfulAuthentication implements Serializable { | ||
|
|
||
| private static final long serialVersionUID = 1L; | ||
|
|
||
| private UserProfile profile; | ||
| private OAuthToken token; | ||
|
|
||
| public SuccessfulAuthentication(UserProfile profile, OAuthToken token) { | ||
| this.profile = profile; | ||
| this.token = token; | ||
| } | ||
|
|
||
| public UserProfile getProfile() { | ||
| return profile; | ||
| } | ||
|
|
||
| public OAuthToken getToken() { | ||
| return token; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1 change: 1 addition & 0 deletions
1
code/application/service/security/src/main/resources/Twitter.properties
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| apiClass=org.scribe.builder.api.TwitterApi$Authenticate |
92 changes: 92 additions & 0 deletions
92
...t/java/org/cedj/geekseek/service/security/test/arquillian/AuthorizedSessionExtension.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| package org.cedj.geekseek.service.security.test.arquillian; | ||
|
|
||
| import java.net.URI; | ||
| import java.util.Collection; | ||
|
|
||
| import org.jboss.arquillian.config.descriptor.api.ArquillianDescriptor; | ||
| import org.jboss.arquillian.config.descriptor.api.ExtensionDef; | ||
| import org.jboss.arquillian.container.spi.client.protocol.metadata.HTTPContext; | ||
| import org.jboss.arquillian.container.spi.client.protocol.metadata.ProtocolMetaData; | ||
| import org.jboss.arquillian.container.spi.event.container.AfterDeploy; | ||
| import org.jboss.arquillian.core.api.Instance; | ||
| import org.jboss.arquillian.core.api.annotation.Inject; | ||
| import org.jboss.arquillian.core.api.annotation.Observes; | ||
| import org.jboss.arquillian.core.spi.LoadableExtension; | ||
|
|
||
| import com.jayway.restassured.RestAssured; | ||
| import com.jayway.restassured.config.RestAssuredConfig; | ||
| import com.jayway.restassured.config.SessionConfig; | ||
|
|
||
| /** | ||
| * Arquillian Extension that will do a authorization request | ||
| * after deployment to create a active session and set the session | ||
| * id as 'current session' for the RestAssured client lib. | ||
| * | ||
| * Since security is only active if the Security module is deployed, | ||
| * rest clients in the test suite shouldn't have to tie them selves | ||
| * into how security is done, if at all active. | ||
| * | ||
| * This Extension enables/activates security in the Test suite | ||
| * if the security module is included. | ||
| * | ||
| * This behavior can be disabled by configuring the authsession | ||
| * extension in arquillian.xml, using the disabled=true property. | ||
| * | ||
| * @author <a href="mailto:aslak@redhat.com">Aslak Knutsen</a> | ||
| */ | ||
| public class AuthorizedSessionExtension implements LoadableExtension { | ||
|
|
||
| private static final String EXT_NAME = "authsession"; | ||
| private static final String EXT_DISABLE = "disabled"; | ||
|
|
||
| @Override | ||
| public void register(ExtensionBuilder builder) { | ||
| builder.observer(CreateAuthorizedSession.class); | ||
| } | ||
|
|
||
| public static class CreateAuthorizedSession { | ||
|
|
||
| @Inject | ||
| private Instance<ArquillianDescriptor> desc; | ||
|
|
||
| public void performLogin(@Observes AfterDeploy event, ProtocolMetaData data) { | ||
|
|
||
| if(isDisabled()) { | ||
| return; | ||
| } | ||
|
|
||
| URI authUri = locateAuthURI(data); | ||
| String sessionId = authenticate(authUri); | ||
|
|
||
| RestAssured.config = RestAssuredConfig.config().sessionConfig( | ||
| SessionConfig.sessionConfig().sessionIdValue(sessionId)); | ||
| } | ||
|
|
||
| private String authenticate(URI authUri) { | ||
| return new TwitterLogin().login(authUri.toASCIIString()); | ||
| } | ||
|
|
||
| private URI locateAuthURI(ProtocolMetaData data) { | ||
| Collection<HTTPContext> contexts = data.getContexts(HTTPContext.class); | ||
| if(contexts == null || contexts.size() == 0 || contexts.size() > 1) { | ||
| throw new RuntimeException("Could not determine auth URL: " + contexts); | ||
| } | ||
|
|
||
| HTTPContext context = contexts.iterator().next(); | ||
| return URI.create(context.getServlets().get(0).getBaseURI()+ "auth"); | ||
| } | ||
|
|
||
| private boolean isDisabled() { | ||
| for(ExtensionDef def : desc.get().getExtensions()) { | ||
| if(EXT_NAME.equals(def.getExtensionName())) { | ||
| if(def.getExtensionProperties().containsKey(EXT_DISABLE)) { | ||
| if(def.getExtensionProperties().get(EXT_DISABLE).equals("true")) { | ||
| return true; | ||
| } | ||
| } | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.