@Test
public void testInvalidImpersonation() throws Exception {
UserManager userManager = getUserManager(root);
ContentSession cs = null;
User user = null;
try {
user = userManager.createUser("test", "pw");
root.commit();
SimpleCredentials sc = new SimpleCredentials("test", "pw".toCharArray());
cs = login(sc);
AuthInfo authInfo = cs.getAuthInfo();
assertEquals("test", authInfo.getUserID());
cs.close();
cs = null;
ConfigurationParameters config = securityProvider.getConfiguration(UserConfiguration.class).getParameters();
String adminId = UserUtil.getAdminId(config);
sc = new SimpleCredentials(adminId, new char[0]);
ImpersonationCredentials ic = new ImpersonationCredentials(sc, authInfo);
try {
cs = login(ic);
fail("User 'test' should not be allowed to impersonate " + adminId);
} catch (LoginException e) {
// success
}
} finally {
if (user != null) {
user.remove();
root.commit();
}
if (cs != null) {
cs.close();
}