started with access token / REST security; test case read

java/com.sap.sse.security.test/META-INF/MANIFEST.MF

@@ -10,3 +10,4 @@ Require-Bundle: org.junit4;bundle-version="4.8.2",
  com.sap.sse.security.userstore.mongodb,
  org.mongodb.mongo-java-driver;bundle-version="2.13.0",
  com.sap.sse.mongodb
+Import-Package: org.apache.shiro.session.mgt

java/com.sap.sse.security.test/src/com/sap/sse/security/test/SecurityResourceTest.java

@@ -0,0 +1,52 @@
+package com.sap.sse.security.test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+
+import java.util.Properties;
+
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.session.Session;
+import org.json.simple.JSONObject;
+import org.json.simple.parser.JSONParser;
+import org.json.simple.parser.ParseException;
+import org.junit.Before;
+import org.junit.Test;
+
+import com.sap.sse.security.SecurityService;
+import com.sap.sse.security.UsernamePasswordRealm;
+import com.sap.sse.security.impl.SecurityServiceImpl;
+import com.sap.sse.security.jaxrs.api.SecurityResource;
+import com.sap.sse.security.shared.MailException;
+import com.sap.sse.security.shared.UserManagementException;
+import com.sap.sse.security.userstore.mongodb.UserStoreImpl;
+
+public class SecurityResourceTest {
+    private SecurityResource servlet;
+    private SecurityServiceImpl service;
+
+    @Before
+    public void setUp() throws UserManagementException, MailException {
+        final UserStoreImpl store = new UserStoreImpl();
+        UsernamePasswordRealm.setTestUserStore(store);
+        service = new SecurityServiceImpl(store, /* mailProperties */ new Properties());
+        SecurityUtils.setSecurityManager(service.getSecurityManager());
+        Session session = SecurityUtils.getSubject().getSession();
+        assertNotNull(session);
+        servlet = new SecurityResource() {
+            @Override
+            public SecurityService getService() {
+                return service;
+            }
+        };
+    }
+    
+    @Test
+    public void createAccessTokenAndAuthenticate() throws ParseException {
+        String responseJsonString = (String) servlet.accessToken("admin", "admin").getEntity();
+        JSONObject responseJson = (JSONObject) new JSONParser().parse(responseJsonString);
+        assertEquals("admin", responseJson.get("username"));
+        String accessToken = (String) responseJson.get("access_token");
+        assertNotNull(accessToken);
+    }
+}

java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/UserStoreImpl.java

@@ -123,6 +123,15 @@ public class UserStoreImpl implements UserStore {
         return result;
     }
 
+    @Override
+    public void removeAccessToken(String username, String accessToken) {
+        User user = usersByAccessToken.remove(accessToken);
+        if (user != null) {
+            // the access token actually existed; now we need to update the preferences
+            unsetPreference(username, ACCESS_TOKEN_KEY);
+        }
+    }
+
     private void addToUsersByEmail(User u) {
         if (u.getEmail() != null && !u.getEmail().isEmpty()) {
             Set<User> set = usersByEmail.get(u.getEmail());

java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java

@@ -141,7 +141,8 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
 
     /**
      * Issues a new access token and remembers it so that later the user identified by <code>username</code> can be
-     * authenticated using the token.
+     * authenticated using the token. Any access token previously created for same user will be invalidated by this
+     * call.
      * 
      * @return a new access token if <code>username</code> identifies a known user, <code>null</code> otherwise
      */
@@ -154,4 +155,6 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
      */
     User getUserByAccessToken(String accessToken);
 
+    void removeAccessToken(String username, String accessToken);
+
 }

java/com.sap.sse.security/src/com/sap/sse/security/UserStore.java

@@ -97,4 +97,6 @@ public interface UserStore extends Named {
      */
     boolean setAccessToken(String username, String accessToken);
 
+    void removeAccessToken(String username, String accessToken);
+
 }

java/com.sap.sse.security/src/com/sap/sse/security/impl/ReplicableSecurityService.java

@@ -22,6 +22,8 @@ public interface ReplicableSecurityService extends SecurityService {
     
     Void internalSetAccessToken(String username, String accessToken);
 
+    Void internalRemoveAccessToken(String username, String accessToken);
+
     Boolean internalSetSetting(String key, Object setting);
 
     Void internalAddSetting(String key, Class<?> clazz);

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java

@@ -901,6 +901,12 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica
         return null;
     }
 
+    @Override
+    public Void internalRemoveAccessToken(String username, String accessToken) {
+        store.removeAccessToken(username, accessToken);
+        return null;
+    }
+
     @Override
     public String getPreference(String username, String key) {
         Subject subject = SecurityUtils.getSubject();
@@ -926,6 +932,11 @@ public class SecurityServiceImpl extends RemoteServiceServlet implements Replica
         }
         return token;
     }
+    
+    @Override
+    public void removeAccessToken(String username, String accessToken) {
+        apply(s -> s.internalRemoveAccessToken(username, accessToken));
+    }
 
     // ----------------- Replication -------------
     @Override

java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java

@@ -13,6 +13,7 @@ import javax.ws.rs.core.Response.Status;
 
 import org.json.simple.JSONObject;
 
+import com.sap.sse.security.User;
 import com.sap.sse.security.jaxrs.AbstractSecurityResource;
 import com.sap.sse.security.shared.UserManagementException;
 
@@ -55,11 +56,29 @@ public class SecurityResource extends AbstractSecurityResource {
             JSONObject response = new JSONObject();
             response.put("username", username);
             response.put("access_token", getService().createAccessToken(username));
+            return Response.ok(response.toJSONString(), MediaType.APPLICATION_JSON).build();
         } catch (UserManagementException e) {
             logger.info("Logging in " + username + " with password failed: "+e.getMessage());
             return getSecurityErrorResponse(e.getMessage());
         }
-        return Response.ok("Logged in!", MediaType.TEXT_PLAIN).build();
+    }
+
+    @POST
+    @Path("/authenticate")
+    @Produces("application/json;charset=UTF-8")
+    public Response authenticate(@FormParam("access_token") String accessToken) {
+        User user = getService().getUserByAccessToken(accessToken);
+        if (user == null) {
+            logger.info("Invalid access token " + accessToken);
+            return Response.status(Status.UNAUTHORIZED).entity("Access token " + accessToken + " not recognized")
+                    .build();
+        } else {
+            logger.info("Authenticated " + user.getName() + " with access token");
+        }
+        JSONObject response = new JSONObject();
+        response.put("username", user.getName());
+        response.put("email", user.getEmail());
+        return Response.ok(response.toJSONString(), MediaType.APPLICATION_JSON).build();
     }
     
     @GET