HttpDigestAuthFilterTest.java

/*
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 *
 * Copyright (c) 2010-2017 Oracle and/or its affiliates. All rights reserved.
 *
 * The contents of this file are subject to the terms of either the GNU
 * General Public License Version 2 only ("GPL") or the Common Development
 * and Distribution License("CDDL") (collectively, the "License").  You
 * may not use this file except in compliance with the License.  You can
 * obtain a copy of the License at
 * http://glassfish.java.net/public/CDDL+GPL_1_1.html
 * or packager/legal/LICENSE.txt.  See the License for the specific
 * language governing permissions and limitations under the License.
 *
 * When distributing the software, include this License Header Notice in each
 * file and include the License file at packager/legal/LICENSE.txt.
 *
 * GPL Classpath Exception:
 * Oracle designates this particular file as subject to the "Classpath"
 * exception as provided by Oracle in the GPL Version 2 section of the License
 * file that accompanied this code.
 *
 * Modifications:
 * If applicable, add the following below the License Header, with the fields
 * enclosed by brackets [] replaced by your own identifying information:
 * "Portions Copyright [year] [name of copyright owner]"
 *
 * Contributor(s):
 * If you wish your version of this file to be governed by only the CDDL or
 * only the GPL Version 2, indicate your decision by adding "[Contributor]
 * elects to include this software in this distribution under the [CDDL or GPL
 * Version 2] license."  If you don't indicate a single choice of license, a
 * recipient has the option to distribute your version of this file under
 * either the CDDL, the GPL Version 2 or to extend the choice of license to
 * its licensees as provided above.  However, if you add GPL Version 2 code
 * and therefore, elected the GPL Version 2 license, then the option applies
 * only if the new code is made subject to such option by the copyright
 * holder.
 */
package org.glassfish.jersey.tests.e2e.client;

import java.nio.charset.Charset;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.List;

import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.ProcessingException;
import javax.ws.rs.client.WebTarget;
import javax.ws.rs.core.Application;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.Response.ResponseBuilder;
import javax.ws.rs.core.UriInfo;

import org.glassfish.jersey.client.authentication.HttpAuthenticationFeature;
import org.glassfish.jersey.server.ResourceConfig;
import org.glassfish.jersey.test.JerseyTest;
import org.glassfish.jersey.test.TestProperties;
import org.glassfish.jersey.uri.UriComponent;

import org.junit.Assert;
import org.junit.Test;

/**
 *
 * @author Pavel Bucek (pavel.bucek at oracle.com)
 * @author Stefan Katerkamp <stefan at katerkamp.de>
 */
public class HttpDigestAuthFilterTest extends JerseyTest {

    private static final String DIGEST_TEST_LOGIN = "user";
    private static final String DIGEST_TEST_PASS = "password";
    private static final String DIGEST_TEST_INVALIDPASS = "nopass";
    // Digest string expected for OK auth:
    // Digest realm="test", nonce="eDePFNeJBAA=a874814ec55647862b66a747632603e5825acd39",
    //   algorithm=MD5, domain="/auth-digest/", qop="auth"
    private static final String DIGEST_TEST_NONCE = "eDePFNeJBAA=a874814ec55647862b66a747632603e5825acd39";
    private static final String DIGEST_TEST_REALM = "test";
    private static final String DIGEST_TEST_DOMAIN = "/auth-digest/";
    private static int ncExpected = 1;

    @Override
    protected Application configure() {
        enable(TestProperties.LOG_TRAFFIC);
        enable(TestProperties.DUMP_ENTITY);
        return new ResourceConfig(Resource.class);
    }

    @Path("/auth-digest")
    public static class Resource {

        @Context
        private HttpHeaders httpHeaders;
        @Context
        private UriInfo uriInfo;

        @GET
        public Response get1() {
            return verify();
        }


        @GET
        @Path("ěščřžýáíé")
        public Response getEncoding() {
            return verify();
        }

        private Response verify() {
            if (httpHeaders.getRequestHeader(HttpHeaders.AUTHORIZATION) == null) {
                // the first request has no authorization header, tell filter its 401
                // and send filter back seed for the new to be built header
                ResponseBuilder responseBuilder = Response.status(Response.Status.UNAUTHORIZED);
                responseBuilder = responseBuilder.header(HttpHeaders.WWW_AUTHENTICATE,
                        "Digest realm=\"" + DIGEST_TEST_REALM + "\", "
                                + "nonce=\"" + DIGEST_TEST_NONCE + "\", "
                                + "algorithm=MD5, "
                                + "domain=\"" + DIGEST_TEST_DOMAIN + "\", qop=\"auth\"");
                return responseBuilder.build();
            } else {
                // the filter takes the seed and adds the header
                final List<String> authList = httpHeaders.getRequestHeader(HttpHeaders.AUTHORIZATION);
                if (authList.size() != 1) {
                    return Response.status(Response.Status.INTERNAL_SERVER_ERROR).build();
                }
                final String authHeader = authList.get(0);

                final String ha1 = md5(DIGEST_TEST_LOGIN, DIGEST_TEST_REALM, DIGEST_TEST_PASS);
                final String requestUri = UriComponent.fullRelativeUri(uriInfo.getRequestUri());
                final String ha2 = md5("GET", requestUri.startsWith("/") ? requestUri : "/" + requestUri);
                final String response = md5(
                        ha1,
                        DIGEST_TEST_NONCE,
                        getDigestAuthHeaderValue(authHeader, "nc="),
                        getDigestAuthHeaderValue(authHeader, "cnonce="),
                        getDigestAuthHeaderValue(authHeader, "qop="),
                        ha2);

                // this generates INTERNAL_SERVER_ERROR if not matching
                Assert.assertEquals(ncExpected, Integer.parseInt(getDigestAuthHeaderValue(authHeader, "nc=")));

                if (response.equals(getDigestAuthHeaderValue(authHeader, "response="))) {
                    return Response.ok().build();
                } else {
                    return Response.status(Response.Status.UNAUTHORIZED).build();
                }
            }
        }

        private static final Charset CHARACTER_SET = Charset.forName("iso-8859-1");

        /**
         * Colon separated value MD5 hash. Call md5 method of the filter.
         *
         * @param tokens one or more strings
         * @return M5 hash string
         */
        static String md5(final String... tokens) {
            final StringBuilder sb = new StringBuilder(100);
            for (final String token : tokens) {
                if (sb.length() > 0) {
                    sb.append(':');
                }
                sb.append(token);
            }

            final MessageDigest md;
            try {
                md = MessageDigest.getInstance("MD5");
            } catch (final NoSuchAlgorithmException ex) {
                throw new ProcessingException(ex.getMessage());
            }
            md.update(sb.toString().getBytes(CHARACTER_SET), 0, sb.length());
            final byte[] md5hash = md.digest();
            return bytesToHex(md5hash);
        }

        /**
         * Convert bytes array to hex string.
         *
         * @param bytes array of bytes
         * @return hex string
         */
        private static String bytesToHex(final byte[] bytes) {
            final char[] hexChars = new char[bytes.length * 2];
            int v;
            for (int j = 0; j < bytes.length; j++) {
                v = bytes[j] & 0xFF;
                hexChars[j * 2] = HEX_ARRAY[v >>> 4];
                hexChars[j * 2 + 1] = HEX_ARRAY[v & 0x0F];
            }
            return new String(hexChars);
        }

        private static final char[] HEX_ARRAY = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};


        /**
         * Get a value of the Digest Auth Header.
         *
         * @param authHeader digest auth header string
         * @param keyName key of the value to retrieve
         * @return value string
         */
        static String getDigestAuthHeaderValue(final String authHeader, final String keyName) {
            final int i1 = authHeader.indexOf(keyName);

            if (i1 == -1) {
                return null;
            }

            String value = authHeader.substring(
                    authHeader.indexOf('=', i1) + 1,
                    (authHeader.indexOf(',', i1) != -1
                            ? authHeader.indexOf(',', i1) : authHeader.length()));

            value = value.trim();
            if (value.charAt(0) == '"' && value.charAt(value.length() - 1) == '"') {
                value = value.substring(1, value.length() - 1);
            }

            return value;
        }
    }

    @Test
    public void testHttpDigestAuthFilter() {
        testRequest("auth-digest");
    }

    @Test
    public void testHttpDigestAuthFilterWithEncodedUri() {
        testRequest("auth-digest/ěščřžýáíé");
    }

    @Test
    public void testHttpDigestAuthFilterWithParams() {
        testRequest("auth-digest", true);
    }

    @Test
    public void testHttpDigestAuthFilterWithEncodedUriAndParams() {
        testRequest("auth-digest/ěščřžýáíé", true);
    }

    private void testRequest(final String path) {
        testRequest(path, false);
    }

    private void testRequest(final String path, final boolean addParams) {
        WebTarget resource = target()
                .register(HttpAuthenticationFeature.digest(DIGEST_TEST_LOGIN, DIGEST_TEST_PASS))
                .path(path);

        if (addParams) {
            resource = resource.matrixParam("bar", "foo").queryParam("foo", "bar");
        }

        ncExpected = 1;
        final Response r1 = resource.request().get();
        Assert.assertEquals(Response.Status.fromStatusCode(r1.getStatus()), Response.Status.OK);
    }


    @Test
    public void testPreemptive() {
        final WebTarget resource = target()
                .register(HttpAuthenticationFeature.digest(DIGEST_TEST_LOGIN, DIGEST_TEST_PASS))
                .path("auth-digest");

        ncExpected = 1;
        final Response r1 = resource.request().get();
        Assert.assertEquals(Response.Status.fromStatusCode(r1.getStatus()), Response.Status.OK);

        ncExpected = 2;
        final Response r2 = resource.request().get();
        Assert.assertEquals(Response.Status.fromStatusCode(r2.getStatus()), Response.Status.OK);

        ncExpected = 3;
        final Response r3 = resource.request().get();
        Assert.assertEquals(Response.Status.fromStatusCode(r3.getStatus()), Response.Status.OK);

    }

    @Test
    public void testAuthentication() {
        final WebTarget resource = target()
                .register(HttpAuthenticationFeature.digest(DIGEST_TEST_LOGIN, DIGEST_TEST_INVALIDPASS))
                .path("auth-digest");

        ncExpected = 1;
        final Response r1 = resource.request().get();
        Assert.assertEquals(Response.Status.fromStatusCode(r1.getStatus()), Response.Status.UNAUTHORIZED);
    }
}