Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-05-22 21:33:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated integration tests to detect case reported as SPR-7563.

Browse Source
This commit is contained in:
Luke Taylor
2010-09-19 18:09:59 +01:00
parent 265cdaf2a6
commit 8d867e8b67
8 changed files with 108 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
itest/web/src/main/webapp/WEB-INF/http-security-concurrency.xml
+32
View File
@@ -0,0 +1,32 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<debug />
<!--
Http App Context to test form login, remember-me and concurrent session control.
Needs to be supplemented with authentication provider(s)
-->
<http pattern="/login.jsp" security="none" />
<http use-expressions="true">
<intercept-url pattern="/secure/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
<intercept-url pattern="/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=true"/>
<http-basic/>
<!-- Default logout configuration -->
<logout logout-url="/logout"/>
<session-management>
<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
</session-management>
</http>
</beans:beans>
itest/web/src/main/webapp/WEB-INF/http-security-custom-concurrency.xml
+1
View File
@@ -12,6 +12,7 @@
<intercept-url pattern="/**" access="ROLE_DEVELOPER,ROLE_USER" />
<session-management session-authentication-strategy-ref="sas"/>
<logout />
<custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
<custom-filter position="FORM_LOGIN_FILTER" ref="myAuthFilter" />
itest/web/src/main/webapp/login.jsp
+3 -7
View File
@@ -1,5 +1,3 @@
<!-- %@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" % -->
<!-- Not used unless you declare a <form-login login-page="/login.jsp"/> element -->
<html>
@@ -11,13 +9,11 @@
<h1>Custom Spring Security Login</h1>
<%
if (request.getParameter("login_error") != null) {
if (request.getParameter("login_error") != null) {
%>
<font color="red">
Your login attempt was not successful, try again.<br/><br/>
</font>
Your login attempt was not successful, try again. ${SPRING_SECURITY_LAST_EXCEPTION.message}<br/><br/>
<%
}
}
%>
<form action="j_spring_security_check" method="POST">
itest/web/src/test/java/org/springframework/security/integration/AbstractWebServerIntegrationTests.java
+1 -1
View File
@@ -108,7 +108,7 @@ public abstract class AbstractWebServerIntegrationTests {
return getAppContext().getBean(beanName);
}
private WebApplicationContext getAppContext() {
protected final WebApplicationContext getAppContext() {
ServletContext servletCtx = ((WebAppContext)server.getHandler()).getServletContext();
WebApplicationContext appCtx =
WebApplicationContextUtils.getRequiredWebApplicationContext(servletCtx);
itest/web/src/test/java/org/springframework/security/integration/ConcurrentSessionManagementTests.java
+44
View File
@@ -0,0 +1,44 @@
package org.springframework.security.integration;
import net.sourceforge.jwebunit.junit.WebTester;
import org.testng.annotations.Test;
/**
* @author Luke Taylor
*/
public class ConcurrentSessionManagementTests extends AbstractWebServerIntegrationTests {
protected String getContextConfigLocations() {
return "/WEB-INF/http-security-concurrency.xml /WEB-INF/in-memory-provider.xml";
}
@Test
public void maxConcurrentLoginsValueIsRespected() throws Exception {
System.out.println("Client: ******* First login ******* ");
beginAt("secure/index.html");
login("jimi", "jimispassword");
// Login again
System.out.println("Client: ******* Second login ******* ");
WebTester tester2 = new WebTester();
tester2.getTestContext().setBaseUrl(getBaseUrl());
tester2.beginAt("secure/index.html");
// seems to be a bug in checking for form here (it fails)
//tester2.assertFormPresent();
tester2.setTextField("j_username", "jimi");
tester2.setTextField("j_password", "jimispassword");
// tester2.submit() also fails to detect the form
tester2.getTestingEngine().submit();
tester2.assertTextPresent("Maximum sessions of 1 for this principal exceeded");
// Now logout to kill first session
tester.gotoPage("/logout");
// Try second session again
tester2.setTextField("j_username", "jimi");
tester2.setTextField("j_password", "jimispassword");
// tester2.submit() also fails to detect the form
tester2.getTestingEngine().submit();
tester2.assertTextPresent("A Secure Page");
}
}
itest/web/src/test/java/org/springframework/security/integration/CustomConcurrentSessionManagementTests.java
+20
View File
@@ -3,6 +3,7 @@ package org.springframework.security.integration;
import net.sourceforge.jwebunit.junit.WebTester;
import org.junit.Assert;
import org.springframework.security.core.session.SessionRegistry;
import org.testng.annotations.Test;
/**
@@ -30,4 +31,23 @@ public class CustomConcurrentSessionManagementTests extends AbstractWebServerInt
Assert.assertTrue(tester2.getServerResponse().contains("Maximum sessions of 1 for this principal exceeded"));
}
@Test
public void logoutClearsSessionRegistryAndAllowsSecondLogin() throws Exception {
beginAt("secure/index.html");
login("bessie", "bessiespassword");
SessionRegistry reg = getAppContext().getBean(SessionRegistry.class);
tester.gotoPage("/j_spring_security_logout");
// Login again
System.out.println("Client: ******* Second login ******* ");
WebTester tester2 = new WebTester();
tester2.getTestContext().setBaseUrl(getBaseUrl());
tester2.beginAt("secure/index.html");
tester2.setTextField("j_username", "bessie");
tester2.setTextField("j_password", "bessiespassword");
tester2.setIgnoreFailingStatusCodes(true);
tester2.submit();
Assert.assertTrue(tester2.getServerResponse().contains("A secure page"));
}
}
itest/web/src/test/java/org/springframework/security/integration/InMemoryProviderWebAppTests.java
-22
View File
@@ -72,26 +72,4 @@ public class InMemoryProviderWebAppTests extends AbstractWebServerIntegrationTes
beginAt("secure/index.html");
assertTextPresent("A Secure Page");
}
@Test
public void maxConcurrentLoginsValueIsRespected() throws Exception {
System.out.println("Client: ******* First login ******* ");
beginAt("secure/index.html");
login("jimi", "jimispassword");
// Login again
System.out.println("Client: ******* Second login ******* ");
WebTester tester2 = new WebTester();
tester2.getTestContext().setBaseUrl(getBaseUrl());
tester2.beginAt("secure/index.html");
// seems to be a bug in checking for form here (it fails)
//tester2.assertFormPresent();
tester2.setTextField("j_username", "jimi");
tester2.setTextField("j_password", "jimispassword");
// tester2.submit() also fails to detect the form
tester2.getTestingEngine().submit();
// Try an use the original
System.out.println("Client: ******* Retry Original Session ******* ");
tester.gotoPage("secure/index.html");
tester.assertTextPresent("This session has been expired");
}
}