File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\test\src\test\java\jenkins\security\ApiTokenPropertyTest.java.html

1 package jenkins.security;
2
3 import com.gargoylesoftware.htmlunit.HttpWebConnection;
4 import com.gargoylesoftware.htmlunit.html.HtmlForm;
5 import com.gargoylesoftware.htmlunit.html.HtmlPage;
6 import hudson.Util;
7 import hudson.model.User;
8 import jenkins.model.Jenkins;
9 import org.apache.commons.httpclient.Credentials;
10 import org.apache.commons.httpclient.HttpClient;
11 import org.apache.commons.httpclient.UsernamePasswordCredentials;
12 import org.apache.commons.httpclient.auth.AuthScheme;
13 import org.apache.commons.httpclient.auth.AuthScope;
14 import org.apache.commons.httpclient.auth.CredentialsNotAvailableException;
15 import org.apache.commons.httpclient.auth.CredentialsProvider;
16 import org.jvnet.hudson.test.HudsonTestCase;
17
18 import java.util.concurrent.Callable;
19
20 /**
21 * @author Kohsuke Kawaguchi
22 */
23 public class ApiTokenPropertyTest extends HudsonTestCase {
24 /**
25 * Tests the UI interaction and authentication.
26 */
27 public void testBasics() throws Exception {
28 jenkins.setSecurityRealm(createDummySecurityRealm());
29 User u = User.get("foo");
30 ApiTokenProperty t = u.getProperty(ApiTokenProperty.class);
31 final String token = t.getApiToken();
32
33 // make sure the UI shows the token
34 HtmlPage config = createWebClient().goTo(u.getUrl() + "/configure");
35 HtmlForm form = config.getFormByName("config");
36 assertEquals(token, form.getInputByName("_.apiToken").getValueAttribute());
37
38 // round-trip shouldn't change the API token
39 submit(form);
40 assertSame(t, u.getProperty(ApiTokenProperty.class));
41
42 WebClient wc = createWebClient();
43 wc.setCredentialsProvider(new CredentialsProvider() {
44 public Credentials getCredentials(AuthScheme scheme, String host, int port, boolean proxy) throws CredentialsNotAvailableException {
45 return new UsernamePasswordCredentials("foo", token);
46 }
47 });
48 wc.setWebConnection(new HttpWebConnection(wc) {
49 @Override
50 protected HttpClient getHttpClient() {
51 HttpClient c = super.getHttpClient();
52 c.getParams().setAuthenticationPreemptive(true);
53 c.getState().setCredentials(new AuthScope("localhost", localPort, AuthScope.ANY_REALM), new UsernamePasswordCredentials("foo", token));
54 return c;
55 }
56 });
57
58 // test the authentication
59 assertEquals(u,wc.executeOnServer(new Callable<User>() {
60 public User call() throws Exception {
61 return User.current();
62 }
63 }));
64 }
65
66 public void testSecurity49Upgrade() throws Exception {
67 jenkins.setSecurityRealm(createDummySecurityRealm());
68 User u = User.get("foo");
69 String historicalInitialValue = Util.getDigestOf(Jenkins.getInstance().getSecretKey() + ":" + u.getId());
70
71 // we won't accept historically used initial value as it may be compromised
72 ApiTokenProperty t = new ApiTokenProperty(historicalInitialValue);
73 u.addProperty(t);
74 String apiToken1 = t.getApiToken();
75 assertFalse(apiToken1.equals(Util.getDigestOf(historicalInitialValue)));
76
77 // the replacement for the compromised value must be consistent and cannot be random
78 ApiTokenProperty t2 = new ApiTokenProperty(historicalInitialValue);
79 u.addProperty(t2);
80 assertEquals(apiToken1,t2.getApiToken());
81
82 // any other value is OK. those are changed values
83 t = new ApiTokenProperty(historicalInitialValue+"somethingElse");
84 u.addProperty(t);
85 assertTrue(t.getApiToken().equals(Util.getDigestOf(historicalInitialValue+"somethingElse")));
86
87 }
88 }
89