{
try{
log.info("TESTING XML Security");
char[] password = "password".toCharArray();
SecurityClient securityClient = SecurityClientFactory.getSecurityClient();
setSecurity(securityClient,"somebody", password);
//SecurityAssociation.pushSubjectContext(null, new SimplePrincipal("somebody"), password);
log.info("testing unchecked constructor");
SecuredPOJO pojo = new SecuredPOJO(); // unchecked construction
log.info("testing unchecked method");
pojo.unchecked();
log.info("testing unchecked field");
pojo.uncheckedField = 5;
/*SecurityAssociation.popSubjectContext();
SecurityAssociation.pushSubjectContext(null, new SimplePrincipal("authfail"), password);
*/
securityClient.logout();
setSecurity(securityClient,"authfail", password);
boolean securityFailure = true;
try
{
log.info("testing auth failure method");
pojo.someMethod();
}
catch (SecurityException ignored)
{
log.info(ignored.getMessage());
securityFailure = false;
}
if (securityFailure) throw new RuntimeException("auth failure was not caught for method");
securityFailure = true;
try
{
log.info("testing auth failure field");
pojo.someField = 5;
}
catch (SecurityException ignored)
{
log.info(ignored.getMessage());
securityFailure = false;
}
if (securityFailure) throw new RuntimeException("auth failure was not caught for field");
securityFailure = true;
try
{
log.info("testing auth failure constructor");
pojo = new SecuredPOJO(4);
}
catch (SecurityException ignored)
{
log.info(ignored.getMessage());
securityFailure = false;
}
if (securityFailure) throw new RuntimeException("auth failure was not caught for constructor");
securityFailure = true;
securityClient.logout();
setSecurity(securityClient,"rolefail", password);
/*
SecurityAssociation.popSubjectContext();
SecurityAssociation.pushSubjectContext(null, new SimplePrincipal("rolefail"), password);
*/
try
{
log.info("testing role failure method");
pojo.someMethod();
}
catch (SecurityException ignored)
{
log.info(ignored.getMessage());
securityFailure = false;
}
if (securityFailure) throw new RuntimeException("role failure was not caught for method");
securityFailure = true;
try
{
log.info("testing role failure field");
pojo.someField = 5;
}
catch (SecurityException ignored)
{
log.info(ignored.getMessage());
securityFailure = false;
}
if (securityFailure) throw new RuntimeException("role failure was not caught field");
securityFailure = true;
try
{
log.info("testing role failure constructor");
pojo = new SecuredPOJO(4);
}
catch (SecurityException ignored)
{
log.info(ignored.getMessage());
securityFailure = false;
}
if (securityFailure) throw new RuntimeException("role failure was not caught for constructor");
securityClient.logout();
setSecurity(securityClient,"pass", password);
/*
SecurityAssociation.popSubjectContext();
SecurityAssociation.pushSubjectContext(null, new SimplePrincipal("pass"), password);
*/