//login before the user is disabled, so login should work
List<NameValuePair> params = new ArrayList<NameValuePair>();
params.add(new NameValuePair("j_username", testUserId));
params.add(new NameValuePair("j_password", "testPwd"));
params.add(new NameValuePair("j_validate", "true"));
HttpMethod post = H.assertPostStatus(HttpTest.HTTP_BASE_URL + "/j_security_check", HttpServletResponse.SC_OK, params, null);
assertNull(post.getResponseHeader("X-Reason"));
H.getHttpClient().getState().clearCredentials();
H.getHttpClient().getState().clearCookies();
//update the user to disable it
String postUrl = HttpTest.HTTP_BASE_URL + "/system/userManager/user/" + testUserId + ".update.html";
List<NameValuePair> postParams = new ArrayList<NameValuePair>();
postParams.add(new NameValuePair(":disabled", "true"));
postParams.add(new NameValuePair(":disabledReason", "Just Testing"));
H.assertAuthenticatedAdminPostStatus(postUrl, HttpServletResponse.SC_OK, postParams, null);
//the user is now disabled, so login should fail
post = H.assertPostStatus(HttpTest.HTTP_BASE_URL + "/j_security_check", HttpServletResponse.SC_FORBIDDEN, params, null);
assertNotNull(post.getResponseHeader("X-Reason"));
H.getHttpClient().getState().clearCredentials();
H.getHttpClient().getState().clearCookies();
//enable the user again
postParams = new ArrayList<NameValuePair>();
postParams.add(new NameValuePair(":disabled", "false"));
H.assertAuthenticatedAdminPostStatus(postUrl, HttpServletResponse.SC_OK, postParams, null);
//login after the user is enabled, so login should work
post = H.assertPostStatus(HttpTest.HTTP_BASE_URL + "/j_security_check", HttpServletResponse.SC_OK, params, null);
assertNull(post.getResponseHeader("X-Reason"));
H.getHttpClient().getState().clearCredentials();
H.getHttpClient().getState().clearCookies();
}