    1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.concurrent;
    17
    18  import junit.framework.TestCase;
    19
    20  import org.acegisecurity.Authentication;
    21  import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
    22  import org.acegisecurity.ui.WebAuthenticationDetails;
    23  import org.springframework.mock.web.MockHttpServletRequest;
    24  import org.springframework.mock.web.MockHttpSession;
    25
    26
    27  /***
    28   * Tests {@link ConcurrentSessionControllerImpl}.
    29   *
    30   * @author Ben Alex
    31   * @version $Id: ConcurrentSessionControllerImplTests.java,v 1.4 2005/11/30 01:23:35 benalex Exp $
    32   */
    33  public class ConcurrentSessionControllerImplTests extends TestCase {
    34      //~ Methods ================================================================
    35
    36      public void testLifecycle() throws Exception {
    37          // Build a test fixture
    38          ConcurrentSessionControllerImpl sc = new ConcurrentSessionControllerImpl();
    39          SessionRegistry registry = new SessionRegistryImpl();
    40          sc.setSessionRegistry(registry);
    41
    42          // Attempt to authenticate - it should be successful
    43          Authentication auth = createAuthentication("bob", "1212");
    44          sc.checkAuthenticationAllowed(auth);
    45          sc.registerSuccessfulAuthentication(auth);
    46
    47          String sessionId1 = ((WebAuthenticationDetails) auth.getDetails())
    48              .getSessionId();
    49          assertFalse(registry.getSessionInformation(sessionId1).isExpired());
    50
    51          // Attempt to authenticate again - it should still be successful
    52          sc.checkAuthenticationAllowed(auth);
    53          sc.registerSuccessfulAuthentication(auth);
    54
    55          // Attempt to authenticate with a different session for same principal - should fail
    56          sc.setExceptionIfMaximumExceeded(true);
    57
    58          Authentication auth2 = createAuthentication("bob", "1212");
    59          assertFalse(registry.getSessionInformation(sessionId1).isExpired());
    60
    61          try {
    62              sc.checkAuthenticationAllowed(auth2);
    63              fail("Should have thrown ConcurrentLoginException");
    64          } catch (ConcurrentLoginException expected) {
    65              assertTrue(true);
    66          }
    67
    68          // Attempt to authenticate with a different session for same principal - should expire first session
    69          sc.setExceptionIfMaximumExceeded(false);
    70
    71          Authentication auth3 = createAuthentication("bob", "1212");
    72          sc.checkAuthenticationAllowed(auth3);
    73          sc.registerSuccessfulAuthentication(auth3);
    74
    75          String sessionId3 = ((WebAuthenticationDetails) auth3.getDetails())
    76              .getSessionId();
    77          assertTrue(registry.getSessionInformation(sessionId1).isExpired());
    78          assertFalse(registry.getSessionInformation(sessionId3).isExpired());
    79      }
    80
    81      public void testStartupDetectsInvalidMaximumSessions()
    82          throws Exception {
    83          ConcurrentSessionControllerImpl sc = new ConcurrentSessionControllerImpl();
    84          sc.setMaximumSessions(0);
    85
    86          try {
    87              sc.afterPropertiesSet();
    88              fail("Should have thrown IAE");
    89          } catch (IllegalArgumentException expected) {
    90              assertTrue(true);
    91          }
    92      }
    93
    94      public void testStartupDetectsInvalidSessionRegistry()
    95          throws Exception {
    96          ConcurrentSessionControllerImpl sc = new ConcurrentSessionControllerImpl();
    97          sc.setSessionRegistry(null);
    98
    99          try {
    100             sc.afterPropertiesSet();
    101             fail("Should have thrown IAE");
    102         } catch (IllegalArgumentException expected) {
    103             assertTrue(true);
    104         }
    105     }
    106
    107     private Authentication createAuthentication(String user, String password) {
    108         UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(user,
    109                 password);
    110         auth.setDetails(createWebDetails(auth));
    111
    112         return auth;
    113     }
    114
    115     private WebAuthenticationDetails createWebDetails(Authentication auth) {
    116         MockHttpSession session = new MockHttpSession();
    117         MockHttpServletRequest request = new MockHttpServletRequest();
    118         request.setSession(session);
    119         request.setUserPrincipal(auth);
    120
    121         return new WebAuthenticationDetails(request);
    122     }
    123 }