Securing a web application

 1<?xml version="1.0" encoding="UTF-8"?>
 2<!-- tag::copyright[] -->
 3<!--
 4    Copyright (c) 2018, 2019 IBM Corp.
 5
 6    Licensed under the Apache License, Version 2.0 (the "License");
 7    you may not use this file except in compliance with the License.
 8    You may obtain a copy of the License at
 9
10        http://www.apache.org/licenses/LICENSE-2.0
11
12    Unless required by applicable law or agreed to in writing, software
13    distributed under the License is distributed on an "AS IS" BASIS,
14    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15    See the License for the specific language governing permissions and
16    limitations under the License.
17-->
18<!-- end::copyright[]-->
19<!-- tag::webxml[] -->
20<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" 
21    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
22    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
23    version="3.1">
24    <display-name>Liberty Project</display-name>
25
26    <!-- WebAppJSF: Faces Servlet -->
27    <servlet>
28      <servlet-name>Faces Servlet</servlet-name>
29      <servlet-class>jakarta.faces.webapp.FacesServlet</servlet-class>
30      <load-on-startup>1</load-on-startup>
31    </servlet>
32
33    <!-- WebAppJSF: Faces Servlet Mapping -->
34    <servlet-mapping>
35      <servlet-name>Faces Servlet</servlet-name>
36      <url-pattern>*.jsf</url-pattern>
37    </servlet-mapping>
38
39    <welcome-file-list>
40      <welcome-file>/index.html</welcome-file>
41    </welcome-file-list>
42
43    <!-- tag::webxmlsecurity[] -->
44    <!-- SECURITY ROLES -->
45    <!-- tag::security-role[] -->
46    <security-role>
47      <!-- tag::role-name-admin[] -->
48      <role-name>admin</role-name>
49      <!-- end::role-name-admin[] -->
50    </security-role>
51
52    <security-role>
53      <!-- tag::role-name-user[] -->
54      <role-name>user</role-name>
55      <!-- end::role-name-user[] -->
56    </security-role>
57    <!-- end::security-role[] -->
58
59    <!-- SECURITY CONSTRAINTS -->
60    <!-- tag::security-constraint[] -->
61    <security-constraint>
62      <web-resource-collection>
63        <web-resource-name>AdminViewProperties</web-resource-name>
64        <!-- tag::url-pattern-admin[] -->
65        <url-pattern>/admin.jsf</url-pattern>
66        <!-- end::url-pattern-admin[] -->
67        <http-method>GET</http-method>
68      </web-resource-collection>
69      <auth-constraint>
70        <role-name>admin</role-name>
71      </auth-constraint>
72    </security-constraint>
73
74    <security-constraint>
75      <web-resource-collection>
76        <web-resource-name>UserViewProperties</web-resource-name>
77        <!-- tag::url-pattern-user[] -->
78        <url-pattern>/user.jsf</url-pattern>
79        <!-- end::url-pattern-user[] -->
80        <http-method>GET</http-method>
81      </web-resource-collection>
82      <auth-constraint>
83        <role-name>user</role-name>
84      </auth-constraint>
85    </security-constraint>
86    <deny-uncovered-http-methods/>
87    <!-- end::security-constraint[] -->
88    <!-- end::webxmlsecurity[] -->
89
90    <!-- Handle 403 Error -->
91    <error-page>
92      <error-code>403</error-code>
93      <location>/error403.html</location>
94    </error-page>
95</web-app>
96<!-- end::webxml[] -->

  1// tag::copyright[]
  2/*******************************************************************************
  3 * Copyright (c) 2018, 2022 IBM Corporation and others.
  4 * All rights reserved. This program and the accompanying materials
  5 * are made available under the terms of the Eclipse Public License 2.0
  6 * which accompanies this distribution, and is available at
  7 * http://www.eclipse.org/legal/epl-2.0/
  8 *
  9 * SPDX-License-Identifier: EPL-2.0
 10 *******************************************************************************/
 11// end::copyright[]
 12package it.io.openliberty.guides.security;
 13
 14import static org.junit.jupiter.api.Assertions.assertEquals;
 15import static org.junit.jupiter.api.Assertions.assertTrue;
 16
 17import java.net.URI;
 18import java.util.ArrayList;
 19import java.util.List;
 20
 21import javax.net.ssl.SSLContext;
 22import jakarta.servlet.http.HttpServletResponse;
 23
 24import org.apache.http.HttpResponse;
 25import org.apache.http.NameValuePair;
 26import org.apache.http.client.HttpClient;
 27import org.apache.http.client.config.CookieSpecs;
 28import org.apache.http.client.config.RequestConfig;
 29import org.apache.http.client.entity.UrlEncodedFormEntity;
 30import org.apache.http.client.methods.HttpGet;
 31import org.apache.http.client.methods.HttpPost;
 32import org.apache.http.impl.client.HttpClientBuilder;
 33import org.apache.http.message.BasicNameValuePair;
 34import org.apache.http.util.EntityUtils;
 35import org.junit.jupiter.api.BeforeEach;
 36import org.junit.jupiter.api.Test;
 37
 38public class SecurityIT {
 39
 40    private static String urlHttp;
 41    private static String urlHttps;
 42
 43    @BeforeEach
 44    public void setup() throws Exception {
 45        urlHttp = "http://localhost:" + System.getProperty("http.port");
 46        urlHttps = "https://localhost:" + System.getProperty("https.port");
 47        ITUtils.trustAll();
 48    }
 49
 50    @Test
 51    // tag::testAuthenticationFail[]
 52    public void testAuthenticationFail() throws Exception {
 53        executeURL("/", "bob", "wrongpassword", true, -1, "Don't care");
 54    }
 55    // end::testAuthenticationFail[]
 56
 57    @Test
 58    // tag::testAuthorizationForAdmin[]
 59    public void testAuthorizationForAdmin() throws Exception {
 60        executeURL("/", "bob", "bobpwd", false,
 61            HttpServletResponse.SC_OK, "admin, user");
 62    }
 63    // end::testAuthorizationForAdmin[]
 64
 65    @Test
 66    // tag::testAuthorizationForUser[]
 67    public void testAuthorizationForUser() throws Exception {
 68        executeURL("/", "alice", "alicepwd", false,
 69            HttpServletResponse.SC_OK, "<title>User</title>");
 70    }
 71    // end::testAuthorizationForUser[]
 72
 73    @Test
 74    // tag::testAuthorizationFail[]
 75    public void testAuthorizationFail() throws Exception {
 76        executeURL("/", "dave", "davepwd", false,
 77            HttpServletResponse.SC_FORBIDDEN, "Error 403: Authorization failed");
 78    }
 79    // end::testAuthorizationFail[]
 80
 81    private void executeURL(
 82        String testUrl, String userid, String password,
 83        boolean expectLoginFail, int expectedCode, String expectedContent)
 84        throws Exception {
 85
 86        // Use HttpClient to execute the testUrl by HTTP
 87        URI url = new URI(urlHttp + testUrl);
 88        HttpGet getMethod = new HttpGet(url);
 89        HttpClientBuilder clientBuilder = HttpClientBuilder.create();
 90        SSLContext sslContext = SSLContext.getDefault();
 91        clientBuilder.setSSLContext(sslContext);
 92        clientBuilder.setDefaultRequestConfig(
 93            RequestConfig.custom().setCookieSpec(CookieSpecs.STANDARD).build());
 94        HttpClient client = clientBuilder.build();
 95        HttpResponse response = client.execute(getMethod);
 96
 97        // Response should be login.html
 98        String loginBody = EntityUtils.toString(response.getEntity(), "UTF-8");
 99        assertTrue(loginBody.contains("window.location.assign"),
100            "Not redirected to home.html");
101        String[] redirect = loginBody.split("'");
102
103        // Use j_security_check to login
104        HttpPost postMethod = new HttpPost(urlHttps + "/j_security_check");
105        List<NameValuePair> nvps = new ArrayList<NameValuePair>();
106        nvps.add(new BasicNameValuePair("j_username", userid));
107        nvps.add(new BasicNameValuePair("j_password", password));
108        postMethod.setEntity(new UrlEncodedFormEntity(nvps, "UTF-8"));
109        response = client.execute(postMethod);
110        assertEquals(HttpServletResponse.SC_FOUND,
111            response.getStatusLine().getStatusCode(),
112            "Expected " + HttpServletResponse.SC_FOUND + " status code for login");
113
114        // Return if login fails
115        if (expectLoginFail) {
116            String location = response.getFirstHeader("Location").getValue();
117            assertTrue(location.contains("error.html"),
118                "Error.html was not returned");
119            return;
120        }
121
122        // Use HttpClient to execute the redirected url
123        url = new URI(urlHttps + redirect[1]);
124        getMethod = new HttpGet(url);
125        response = client.execute(getMethod);
126        assertEquals(expectedCode, response.getStatusLine().getStatusCode(),
127            "Expected " + expectedCode + " status code for login");
128
129        // Return if not SC_OK
130        if (expectedCode != HttpServletResponse.SC_OK) {
131            return;
132        }
133
134        // Check the content of the response returned
135        String actual = EntityUtils.toString(response.getEntity(), "UTF-8");
136        assertTrue(actual.contains(userid),
137            "The actual content did not contain the userid \"" + userid
138            + "\". It was:\n" + actual);
139        assertTrue(actual.contains(expectedContent),
140            "The url " + testUrl + " did not return the expected content \""
141            + expectedContent + "\"" + "The actual content was:\n" + actual);
142    }
143
144}