/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*
*/
package org.apache.directory.api.ldap.aci;
import static org.junit.Assert.fail;
import java.text.ParseException;
import org.apache.directory.api.ldap.aci.ACIItemChecker;
import org.apache.directory.api.ldap.model.schema.SchemaManager;
import org.apache.directory.api.ldap.schemaloader.JarLdifSchemaLoader;
import org.apache.directory.api.ldap.schemamanager.impl.DefaultSchemaManager;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.runner.RunWith;
import com.mycila.junit.concurrent.Concurrency;
import com.mycila.junit.concurrent.ConcurrentJunitRunner;
/**
* Unit tests class for ACIItem checker (wrapper).
*
* @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
*/
@RunWith(ConcurrentJunitRunner.class)
@Concurrency()
public class ACIItemChekerTest
{
/** the ACIItem checker wrapper */
static private ACIItemChecker checker;
/**
* Initialization
*/
@BeforeClass
public static void init() throws Exception
{
JarLdifSchemaLoader loader = new JarLdifSchemaLoader();
SchemaManager schemaManager = new DefaultSchemaManager( loader );
schemaManager.loadAllEnabled();
checker = new ACIItemChecker( schemaManager );
}
/**
* Tests the checker with an ACIItem of ItemFirst main component.
*/
@Test
public void testItemFirst() throws Exception
{
String spec =
" { " +
" identificationTag \"id1\" , " +
" precedence 114 , " +
" authenticationLevel simple , " +
" itemOrUserFirst itemFirst :" +
" { " +
" protectedItems " +
" { " +
" entry , " +
" attributeType { 1.2.3 , ou } ," +
" attributeValue { ou=people , cn=Ersin } , " +
" rangeOfValues (cn=ErsinEr) , " +
" classes and : " +
" { " +
" item: xyz , " +
" or:{item:X,item:Y} " +
" }" +
" } , " +
" itemPermissions " +
" { " +
" { " +
" userClasses " +
" {" +
" allUsers , " +
" userGroup { \"2.5.4.3=y,dc=t\" , \"cn=b,dc=d\" } ," +
" subtree { { base \"ou=people\" } } " +
" } , " +
" grantsAndDenials { denyCompare , grantModify } " +
" }," +
" { " +
" precedence 10, " +
" userClasses " +
" {" +
" allUsers , " +
" userGroup { \"2.5.4.3=y,dc=t\" , \"cn=b,dc=d\" } ," +
" subtree { { base \"ou=people\" } } " +
" } , " +
" grantsAndDenials { denyCompare , grantModify } " +
" } " +
" } " +
" }" +
" }";
checker.parse( spec );
}
/**
* Tests the checker with an ACIItem of UserFirst main component.
*/
@Test
public void testUserFirst() throws Exception
{
String spec = "{ identificationTag \"id2\" , precedence 14, authenticationLevel none , "
+ "itemOrUserFirst userFirst: { userClasses { allUsers , name { \"ou=people,cn=ersin\" }, "
+ "subtree {{ base \"ou=system\" }, { base \"ou=ORGANIZATIONUNIT\","
+ "minimum 1, maximum 2 } } } , "
+ "userPermissions { { protectedItems{ entry , attributeType { cn , ou } , attributeValue {cn=y,sn=n,dc=l} , "
+ "rangeOfValues (cn=ErsinEr) } , grantsAndDenials { grantBrowse } } } } } ";
checker.parse( spec );
}
@Test
public void testAllowAddAllUsers() throws Exception
{
String spec = "{ identificationTag \"addAci\", " + "precedence 14, " + "authenticationLevel none, "
+ "itemOrUserFirst userFirst: { " + "userClasses { allUsers }, "
+ "userPermissions { { protectedItems {entry}, " + "grantsAndDenials { grantAdd } } } } }";
checker.parse( spec );
}
@Test
public void testCombo() throws Exception
{
String spec = "{ identificationTag \"addAci\", " + "precedence 14, " + "authenticationLevel none, "
+ "itemOrUserFirst userFirst: { " + "userClasses { allUsers, name { \"ou=blah\" } }, "
+ "userPermissions { { protectedItems {entry}, " + "grantsAndDenials { grantAdd } } } } }";
checker.parse( spec );
}
@Test
public void testOrderOfProtectedItemsDoesNotMatter() throws Exception
{
String spec = " { identificationTag \"id1\" , precedence 114 , authenticationLevel simple , "
+ "itemOrUserFirst itemFirst :{ protectedItems { attributeType { 1.2.3 , ou }, entry , "
+ " rangeOfValues (cn=ErsinEr) , attributeValue { ou=people , cn=Ersin },"
+ "classes and : { item: xyz , or:{item:X,item:Y} }} , "
+ "itemPermissions { { userClasses {allUsers , userGroup { \"2.5.4.3=y,dc=t\" , \"cn=b,dc=d\" } "
+ " , subtree { { base \"ou=people\" } } } , grantsAndDenials { denyCompare , grantModify } },"
+ "{ precedence 10, userClasses {allUsers , userGroup { \"2.5.4.3=y,dc=t\" , \"cn=b,dc=d\" } "
+ " , subtree { { base \"ou=people\" } } } , grantsAndDenials { denyCompare , grantModify } } } }}";
checker.parse( spec );
}
@Test
public void testOrderOfUserClassesDoesNotMatter() throws Exception
{
String spec = "{ identificationTag \"id2\" , precedence 14, authenticationLevel none , "
+ "itemOrUserFirst userFirst: { userClasses { name { \"ou=people,cn=ersin\" }, allUsers, "
+ "subtree {{ base \"ou=system\" }, { base \"ou=ORGANIZATIONUNIT\","
+ "minimum 1, maximum 2 } } } , "
+ "userPermissions { { protectedItems{ entry , attributeType { cn , ou } , attributeValue {dc=y,sn=n,dc=l} , "
+ "rangeOfValues (cn=ErsinEr) } , grantsAndDenials { grantBrowse } } } } } ";
checker.parse( spec );
}
@Test
public void testItemPermissionComponentsOrderDoesNotMatter() throws Exception
{
String spec = " { identificationTag \"id1\" , precedence 114 , authenticationLevel simple , "
+ "itemOrUserFirst itemFirst :{ protectedItems { attributeType { 1.2.3 , ou }, entry , "
+ " rangeOfValues (cn=ErsinEr) , attributeValue { ou=people , cn=Ersin },"
+ "classes and : { item: xyz , or:{item:X,item:Y} }} , "
+ "itemPermissions { { grantsAndDenials { denyCompare , grantModify }, userClasses {allUsers , userGroup { \"2.5.4.3=y,dc=t\" , \"cn=b,dc=d\" } "
+ " , subtree { { base \"ou=people\" } } } },"
+ "{ precedence 10, userClasses {allUsers , userGroup { \"2.5.4.3=y,dc=t\" , \"cn=b,dc=d\" } "
+ " , subtree { { base \"ou=people\" } } } , grantsAndDenials { denyCompare , grantModify } } } }}";
checker.parse( spec );
}
@Test
public void testUserPermissionComponentsOrderDoesNotMatter() throws Exception
{
String spec = "{ identificationTag \"id2\" , precedence 14, authenticationLevel none , "
+ "itemOrUserFirst userFirst: { userClasses { allUsers , name { \"ou=people,cn=ersin\" }, "
+ "subtree {{ base \"ou=system\" }, { base \"ou=ORGANIZATIONUNIT\","
+ "minimum 1, maximum 2 } } } , "
+ "userPermissions { { grantsAndDenials { grantBrowse }, protectedItems{ entry , attributeType { cn , ou } , attributeValue {cn=y,sn=n,dc=l} , "
+ "rangeOfValues (cn=ErsinEr) } } } } } ";
checker.parse( spec );
}
@Test
public void testOrderOfMainACIComponentsDoesNotMatter() throws Exception
{
String spec = "{ itemOrUserFirst userFirst: { userClasses { allUsers , name { \"ou=people,cn=ersin\" }, "
+ "subtree {{ base \"ou=system\" }, { base \"ou=ORGANIZATIONUNIT\","
+ "minimum 1, maximum 2 } } } , "
+ "userPermissions { { protectedItems{ entry , attributeType { cn , ou } , attributeValue {cn=y,sn=n,dc=l} , "
+ "rangeOfValues (cn=ErsinEr) } , grantsAndDenials { grantBrowse } } } }, "
+ " identificationTag \"id2\" , authenticationLevel none, precedence 14 } ";
checker.parse( spec );
}
@Test
public void testRestrictedValueComponentsOrderDoesNotMatter() throws Exception
{
String spec = "{ identificationTag \"id2\" , precedence 14, authenticationLevel none , "
+ "itemOrUserFirst userFirst: { userClasses { allUsers , name { \"ou=people,cn=ersin\" }, "
+ "subtree {{ base \"ou=system\"}, { base \"ou=ORGANIZATIONUNIT\"," + "minimum 1, maximum 2 } } } , "
+ "userPermissions { { protectedItems{ entry , "
+ "maxValueCount { { type 10.11.12, maxCount 10 }, { maxCount 20, type 11.12.13 } } "
+ " } , grantsAndDenials { grantBrowse } } } } } ";
checker.parse( spec );
}
@Test
public void testMaxValueCountComponentsOrderDoesNotMatter() throws Exception
{
String spec = "{ identificationTag \"id2\" , precedence 14, authenticationLevel none , "
+ "itemOrUserFirst userFirst: { userClasses { allUsers , name { \"ou=people,cn=ersin\" }, "
+ "subtree {{ base \"ou=system\" }, { base \"ou=ORGANIZATIONUNIT\"," + "minimum 1, maximum 2 } } } , "
+ "userPermissions { { protectedItems{ entry , "
+ "restrictedBy { { type 10.11.12, valuesIn ou }, { valuesIn cn, type 11.12.13 } } "
+ " } , grantsAndDenials { grantBrowse } } } } } ";
checker.parse( spec );
}
/**
* Test case for DIRSERVER-891
*/
@Test
public void testInvalidAttributeValue()
{
String spec;
// no name-value-pair
spec = "{ identificationTag \"id2\" , precedence 14, authenticationLevel none , "
+ "itemOrUserFirst userFirst: { userPermissions { { protectedItems{ entry , attributeType { cn , ou } , attributeValue { must_be_a_name_value_pair } , "
+ "rangeOfValues (cn=ErsinEr) } , grantsAndDenials { grantBrowse } } }, userClasses { allUsers , name { \"ou=people,cn=ersin\" }, "
+ "subtree {{ minimum 7, maximum 9, base \"ou=system\" }, { base \"ou=ORGANIZATIONUNIT\","
+ " maximum 2, minimum 1 } } } } } ";
try
{
checker.parse( spec );
fail( "Expected ParseException, invalid protected item 'attributeValue { must_be_a_name_value_pair }'" );
}
catch ( ParseException e )
{
// Expected
}
// no name-value-pair
spec = "{ identificationTag \"id2\" , precedence 14, authenticationLevel none , "
+ "itemOrUserFirst userFirst: { userPermissions { { protectedItems{ entry , attributeType { cn , ou } , attributeValue { x=y,m=n,k=l,x } , "
+ "rangeOfValues (cn=ErsinEr) } , grantsAndDenials { grantBrowse } } }, userClasses { allUsers , name { \"ou=people,cn=ersin\" }, "
+ "subtree {{ minimum 7, maximum 9, base \"ou=system\" }, { base \"ou=ORGANIZATIONUNIT\","
+ " maximum 2, minimum 1 } } } } } ";
try
{
checker.parse( spec );
fail( "Expected ParseException, invalid protected item 'attributeValue { must_be_a_name_value_pair }'" );
}
catch ( ParseException e )
{
// Expected
}
}
/**
* Test case for DIRSERVER-891
*/
@Test
public void testIncomplete()
{
String spec;
spec = "{ }";
try
{
checker.parse( spec );
fail( "Expected ParseException, ACIItem is incomplete'" );
}
catch ( ParseException e )
{
// Expected
}
spec = "{ identificationTag \"id2\" }";
try
{
checker.parse( spec );
fail( "Expected ParseException, ACIItem is incomplete'" );
}
catch ( ParseException e )
{
// Expected
}
spec = "{ identificationTag \"id2\", precedence 14 } ";
try
{
checker.parse( spec );
fail( "Expected ParseException, ACIItem is incomplete'" );
}
catch ( ParseException e )
{
// Expected
}
spec = "{ identificationTag \"id2\", precedence 14, authenticationLevel none } ";
try
{
checker.parse( spec );
fail( "Expected ParseException, ACIItem is incomplete'" );
}
catch ( ParseException e )
{
// Expected
}
}
}