Skip to content

Commit 098e9f7

Browse files
willyborankinwillyborankin
committed
Moved test AccountApiTest into AccountRestApiIntegrationTest Signed-off-by: Andrey Pleskach <ples@aiven.io>
1 parent 7b862be commit 098e9f7

File tree

3 files changed

+186
-250
lines changed

3 files changed

+186
-250
lines changed

‎src/integrationTest/java/org/opensearch/security/api/AccountRestApiIntegrationTest.java‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
/*
2+
* Copyright OpenSearch Contributors
3+
* SPDX-License-Identifier: Apache-2.0
4+
*
5+
* The OpenSearch Contributors require contributions made to
6+
* this file be licensed under the Apache-2.0 license or a
7+
* compatible open source license.
8+
*
9+
*/
10+
package org.opensearch.security.api;
11+
12+
import com.fasterxml.jackson.databind.node.ObjectNode;
13+
import org.apache.http.HttpStatus;
14+
import org.junit.Test;
15+
16+
import org.opensearch.test.framework.TestSecurityConfig;
17+
import org.opensearch.test.framework.cluster.TestRestClient;
18+
19+
import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic;
20+
import static org.opensearch.security.DefaultObjectMapper.objectMapper;
21+
import static org.opensearch.security.dlic.rest.support.Utils.hash;
22+
import static org.junit.Assert.assertEquals;
23+
import static org.junit.Assert.assertFalse;
24+
import static org.junit.Assert.assertTrue;
25+
26+
public class AccountRestApiIntegrationTest extends AbstractApiIntegrationTest {
27+
28+
private final static String TEST_USER = "test-user";
29+
30+
private final static String RESERVED_USER = "reserved-user";
31+
32+
private final static String HIDDEN_USERS = "hidden-user";
33+
34+
public final static String TEST_USER_PASSWORD = randomAlphabetic(10);
35+
36+
public final static String TEST_USER_NEW_PASSWORD = randomAlphabetic(10);
37+
38+
static {
39+
testSecurityConfig.user(new TestSecurityConfig.User(TEST_USER).password(TEST_USER_PASSWORD))
40+
.user(new TestSecurityConfig.User(RESERVED_USER).reserved(true))
41+
.user(new TestSecurityConfig.User(HIDDEN_USERS).hidden(true));
42+
}
43+
44+
private String accountPath() {
45+
return super.apiPath("account");
46+
}
47+
48+
@Test
49+
public void accountInfo() throws Exception {
50+
withUser(NEW_USER, client -> {
51+
var response = client.get(accountPath());
52+
assertEquals(response.getBody(), HttpStatus.SC_OK, response.getStatusCode());
53+
54+
final var account = response.bodyAsJsonNode();
55+
assertEquals(response.getBody(), NEW_USER, account.get("user_name").asText());
56+
assertFalse(response.getBody(), account.get("is_reserved").asBoolean());
57+
assertFalse(response.getBody(), account.get("is_hidden").asBoolean());
58+
assertTrue(response.getBody(), account.get("is_internal_user").asBoolean());
59+
assertTrue(response.getBody(), account.get("user_requested_tenant").isNull());
60+
assertTrue(response.getBody(), account.get("backend_roles").isArray());
61+
assertTrue(response.getBody(), account.get("custom_attribute_names").isArray());
62+
assertTrue(response.getBody(), account.get("tenants").isObject());
63+
assertTrue(response.getBody(), account.get("roles").isArray());
64+
});
65+
withUser(NEW_USER, "a", client -> {
66+
final var response = client.get(accountPath());
67+
assertEquals(response.getBody(), HttpStatus.SC_UNAUTHORIZED, response.getStatusCode());
68+
});
69+
withUser("a", "b", client -> {
70+
final var response = client.get(accountPath());
71+
assertEquals(response.getBody(), HttpStatus.SC_UNAUTHORIZED, response.getStatusCode());
72+
});
73+
}
74+
75+
@Test
76+
public void changeAccountPassword() throws Exception {
77+
withUser(TEST_USER, TEST_USER_PASSWORD, this::verifyWrongPayload);
78+
verifyPasswordCanBeChanged();
79+
80+
withUser(RESERVED_USER, client -> {
81+
var response = client.get(accountPath());
82+
assertTrue(response.getBody(), response.getBooleanFromJsonBody("/is_reserved"));
83+
84+
response = client.putJson(accountPath(), changePasswordPayload(DEFAULT_PASSWORD, randomAlphabetic(10)).toString());
85+
assertEquals(response.getBody(), HttpStatus.SC_FORBIDDEN, response.getStatusCode());
86+
});
87+
withUser(HIDDEN_USERS, client -> {
88+
var response = client.get(accountPath());
89+
assertTrue(response.getBody(), response.getBooleanFromJsonBody("/is_hidden"));
90+
91+
response = client.putJson(accountPath(), changePasswordPayload(DEFAULT_PASSWORD, randomAlphabetic(10)).toString());
92+
assertEquals(response.getBody(), HttpStatus.SC_NOT_FOUND, response.getStatusCode());
93+
});
94+
withUser(ADMIN_USER_NAME, localCluster.getAdminCertificate(), client -> {
95+
var response = client.get(accountPath());
96+
assertEquals(response.getBody(), HttpStatus.SC_OK, response.getStatusCode());
97+
98+
response = client.putJson(accountPath(), changePasswordPayload(DEFAULT_PASSWORD, randomAlphabetic(10)).toString());
99+
assertEquals(response.getBody(), HttpStatus.SC_NOT_FOUND, response.getStatusCode());
100+
});
101+
}
102+
103+
private void verifyWrongPayload(final TestRestClient client) {
104+
var response = client.putJson(accountPath(), EMPTY_BODY);
105+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
106+
107+
response = client.putJson(accountPath(), changePasswordPayload(null, "new_password").toString());
108+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
109+
110+
// test - bad request as current password is incorrect
111+
response = client.putJson(accountPath(), changePasswordPayload("wrong-password", "some_new_pwd").toString());
112+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
113+
114+
response = client.putJson(accountPath(), changePasswordPayload(TEST_USER_PASSWORD, null).toString());
115+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
116+
117+
response = client.putJson(accountPath(), changePasswordPayload(TEST_USER_PASSWORD, "").toString());
118+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
119+
120+
response = client.putJson(accountPath(), changePasswordPayload(TEST_USER_PASSWORD, null).put("hash", "").toString());
121+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
122+
123+
response = client.putJson(accountPath(), changePasswordPayload(TEST_USER_PASSWORD, "").put("hash", "").toString());
124+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
125+
126+
// test - bad request as invalid parameters are present
127+
response = client.putJson(
128+
accountPath(),
129+
changePasswordPayload(TEST_USER_PASSWORD, "new_password").set("backend_roles", objectMapper.createArrayNode()).toString()
130+
);
131+
assertEquals(HttpStatus.SC_BAD_REQUEST, response.getStatusCode());
132+
}
133+
134+
private void verifyPasswordCanBeChanged() throws Exception {
135+
final var newPassword = randomAlphabetic(10);
136+
withUser(TEST_USER, TEST_USER_PASSWORD, client -> {
137+
final var response = client.putJson(
138+
accountPath(),
139+
changePasswordPayload(TEST_USER_PASSWORD, null).put("hash", hash(newPassword.toCharArray())).toString()
140+
);
141+
assertEquals(response.getBody(), HttpStatus.SC_OK, response.getStatusCode());
142+
});
143+
withUser(TEST_USER, newPassword, client -> {
144+
final var response = client.putJson(accountPath(), changePasswordPayload(newPassword, TEST_USER_NEW_PASSWORD).toString());
145+
assertEquals(response.getBody(), HttpStatus.SC_OK, response.getStatusCode());
146+
});
147+
}
148+
149+
@Test
150+
public void testPutAccountRetainsAccountInformation() throws Exception {
151+
final var username = "test";
152+
final String password = randomAlphabetic(10);
153+
final String newPassword = randomAlphabetic(10);
154+
withUser(ADMIN_USER_NAME, client -> {
155+
final var userPayload = objectMapper.createObjectNode()
156+
.put("password", password)
157+
.<ObjectNode>set("backend_roles", objectMapper.createArrayNode().add("test-backend-role-1"))
158+
.<ObjectNode>set("opendistro_security_roles", objectMapper.createArrayNode().add("user_limited-user__limited-role"))
159+
.set("attributes", objectMapper.createObjectNode().put("attribute1", "value1"));
160+
final var response = client.putJson(apiPath("internalusers", username), userPayload.toString());
161+
assertEquals(response.getBody(), HttpStatus.SC_CREATED, response.getStatusCode());
162+
});
163+
withUser(username, password, client -> {
164+
final var response = client.putJson(accountPath(), changePasswordPayload(password, newPassword).toString());
165+
assertEquals(response.getBody(), HttpStatus.SC_OK, response.getStatusCode());
166+
});
167+
withUser(ADMIN_USER_NAME, client -> {
168+
final var response = client.get(apiPath("internalusers", username));
169+
assertEquals(HttpStatus.SC_OK, response.getStatusCode());
170+
171+
final var user = response.bodyAsJsonNode().get(username);
172+
assertEquals(user.toString(), "test-backend-role-1", user.get("backend_roles").get(0).asText());
173+
assertEquals(user.toString(), "user_limited-user__limited-role", user.get("opendistro_security_roles").get(0).asText());
174+
assertEquals(user.toString(), "value1", user.get("attributes").get("attribute1").asText());
175+
176+
});
177+
}
178+
179+
private ObjectNode changePasswordPayload(final String currentPassword, final String newPassword) {
180+
final var changePwdJson = objectMapper.createObjectNode();
181+
if (currentPassword != null) changePwdJson.put("current_password", currentPassword);
182+
if (newPassword != null) changePwdJson.put("password", newPassword);
183+
return changePwdJson;
184+
}
185+
186+
}

0 commit comments

Comments
 (0)