Changeset 6060

Timestamp:

27/11/09 09:32:13 (11 years ago)

Author:

pjkersha

Message:

Refactor into separate unit test classes for SAMLAuthorizationMiddleware and NDGAuthorizationMiddleware

Location:

TI12-security/trunk/python/ndg_security_test/ndg/security/test/unit/wsgi/authz

Files:

• test.ini (modified) (1 diff)
• test_authz.py (modified) (6 diffs)

TI12-security/trunk/python/ndg_security_test/ndg/security/test/unit/wsgi/authz/test.ini

@@ -19 +19 @@
 
 [filter:AuthZFilter]
-paste.filter_app_factory=ndg.security.server.wsgi.authz:AuthorizationMiddleware.filter_app_factory
+paste.filter_app_factory=ndg.security.server.wsgi.authz:SAMLAuthorizationMiddleware.filter_app_factory
 prefix = authz.
 policy.filePath = %(here)s/policy.xml

TI12-security/trunk/python/ndg_security_test/ndg/security/test/unit/wsgi/authz/test_authz.py

@@ -25 +25 @@
 from paste.deploy import loadapp
 from ndg.security.server.wsgi import NDGSecurityMiddlewareBase
-from ndg.security.server.wsgi.authz import (SamlPIPMiddlewareConfigError, 
+from ndg.security.server.wsgi.authz import (NdgPIPMiddlewareConfigError,
+                                            SamlPIPMiddlewareConfigError, 
                                             PEPResultHandlerMiddleware)
 from ndg.security.common.authz.msi import Response
+
 
 class RedirectFollowingAccessDenied(PEPResultHandlerMiddleware):
@@ -48 +50 @@
                                                             environ,
                                                             start_response)
+
         
 class TestAuthZMiddleware(object):
@@ -83 +86 @@
         return [TestAuthZMiddleware.response]
 
+
 class BeakerSessionStub(dict):
     """Emulate beaker.session session object for purposes of the unit tests
@@ -88 +92 @@
     def save(self):
         pass
-    
-class WSGIAuthZTestCase(unittest.TestCase):
+ 
+    
+class NdgWSGIAuthZTestCase(unittest.TestCase):
 
     def __init__(self, *args, **kwargs):
@@ -105 +110 @@
         try:
             response = self.app.get('/test_200')
-        except SamlPIPMiddlewareConfigError, e:
+        except NdgPIPMiddlewareConfigError, e:
             print("PASS - expected: %s exception: %s" % (e.__class__, e))
        
@@ -205 +210 @@
         print response
 
+
+
+        
+class TestAuthZMiddleware(object):
+    '''Test Application for the Authentication handler to protect'''
+    response = "Test Authorization application"
+       
+    def __init__(self, app_conf, **local_conf):
+        pass
+    
+    def __call__(self, environ, start_response):
+        
+        if environ['PATH_INFO'] == '/test_401':
+            status = "401 Unauthorized"
+            
+        elif environ['PATH_INFO'] == '/test_403':
+            status = "403 Forbidden"
+            
+        elif environ['PATH_INFO'] == '/test_200':
+            status = "200 OK"
+            
+        elif environ['PATH_INFO'] == '/test_accessDeniedToSecuredURI':
+            # Nb. AuthZ middleware should intercept the request and bypass this
+            # response
+            status = "200 OK"
+            
+        elif environ['PATH_INFO'] == '/test_accessGrantedToSecuredURI':
+            status = "200 OK"
+        else:
+            status = "404 Not found"
+                
+        start_response(status,
+                       [('Content-length', 
+                         str(len(TestAuthZMiddleware.response))),
+                        ('Content-type', 'text/plain')])
+        return [TestAuthZMiddleware.response]
+
+
+class BeakerSessionStub(dict):
+    """Emulate beaker.session session object for purposes of the unit tests
+    """
+    def save(self):
+        pass
+ 
+    
+class SamlWSGIAuthZTestCase(unittest.TestCase):
+
+    def __init__(self, *args, **kwargs):
+        here_dir = os.path.dirname(os.path.abspath(__file__))
+        wsgiapp = loadapp('config:saml-test.ini', relative_to=here_dir)
+        self.app = paste.fixture.TestApp(wsgiapp)
+         
+        unittest.TestCase.__init__(self, *args, **kwargs)
+        
+
+    def test01CatchNoBeakerSessionFound(self):
+        
+        # PEPFilterConfigError is raised if no beaker.session is set in 
+        # environ
+        try:
+            response = self.app.get('/test_200')
+        except SamlPIPMiddlewareConfigError, e:
+            print("PASS - expected: %s exception: %s" % (e.__class__, e))
+       
+    def test02Ensure200WithNotLoggedInAndUnsecuredURI(self):
+        
+        # Check the authZ middleware leaves the response alone if the URI 
+        # is not matched in the policy
+        
+        # Simulate a beaker.session in the environ
+        extra_environ={'beaker.session.ndg.security':BeakerSessionStub()}
+        response = self.app.get('/test_200',
+                                extra_environ=extra_environ)
+
+    def test03Catch401WithLoggedIn(self):
+        
+        # Check that the application being secured can raise a HTTP 401
+        # response and that this respected by the Authorization middleware
+        # even though a user is set in the session
+        
+        extra_environ={'beaker.session.ndg.security':
+                       BeakerSessionStub(username='testuser')}
+        response = self.app.get('/test_401', 
+                                extra_environ=extra_environ,
+                                status=401)
+
+    def test04Catch403WithLoggedIn(self):
+        
+        # Check that the application being secured can raise a HTTP 403
+        # response and that this respected by the Authorization middleware
+        # even though a user is set in the session
+        
+        extra_environ={'beaker.session.ndg.security':
+                       BeakerSessionStub(username='testuser')}
+        response = self.app.get('/test_403', 
+                                extra_environ=extra_environ,
+                                status=403)
+
+    def test05Catch401WithNotLoggedInAndSecuredURI(self):
+        
+        # AuthZ middleware grants access because the URI requested is not 
+        # targeted in the policy
+        
+        # AuthZ middleware checks for username key in session set by AuthN
+        # handler
+        extra_environ={'beaker.session.ndg.security':BeakerSessionStub()}        
+        response = self.app.get('/test_accessDeniedToSecuredURI',
+                                extra_environ=extra_environ,
+                                status=401)
+        
+    def test06AccessDeniedForSecuredURI(self):
+        
+        # User is logged in but doesn't have the required credentials for 
+        # access
+        extra_environ={'beaker.session.ndg.security':
+                       BeakerSessionStub(username='testuser')}
+        
+        response = self.app.get('/test_accessDeniedToSecuredURI',
+                                extra_environ=extra_environ,
+                                status=403)
+        self.assert_("Insufficient privileges to access the "
+                     "resource" in response)
+        print response
+
+    def test07AccessGrantedForSecuredURI(self):
+        
+        # User is logged in and has credentials for access to a URI secured
+        # by the policy file
+        extra_environ={'beaker.session.ndg.security':
+                       BeakerSessionStub(username='testuser')}
+        
+        response = self.app.get('/test_accessGrantedToSecuredURI',
+                                extra_environ=extra_environ,
+                                status=200)
+        self.assert_(TestAuthZMiddleware.response in response)
+        print response
+
+    def test08AccessDeniedForAdminQueryArg(self):
+        
+        # User is logged in but doesn't have the required credentials for 
+        # access
+        extra_environ={'beaker.session.ndg.security':
+                       BeakerSessionStub(username='testuser')}
+        
+        # Try this URI with the query arg admin=1.  This will be picked up
+        # by the policy as a request requiring admin rights.  The request is
+        # denied as the user doesn't have these rights but this then calls
+        # into play the PEP result handler defined in this module,
+        # RedirectFollowingAccessDenied.  This class reinvokes the request
+        # but without the admin query argument.  Access is then granted for
+        # the redirected request
+        response = self.app.get('/test_accessGrantedToSecuredURI',
+                                params={'admin': 1},
+                                extra_environ=extra_environ,
+                                status=302)
+        try:
+            redirectResponse = response.follow(extra_environ=extra_environ)
+        except paste.fixture.AppError, e:
+            self.failIf(TestAuthZMiddleware.response not in response)
+        print response
+
+
 if __name__ == "__main__":
     unittest.main()