bug6104: tests can be exempted from strong password requirements

java/com.sap.sailing.selenium.test/src/com/sap/sailing/selenium/api/test/AclRevokeAnonymousTest.java

@@ -24,6 +24,8 @@ import com.sap.sailing.selenium.test.AbstractSeleniumTest;
 
 public class AclRevokeAnonymousTest extends AbstractSeleniumTest {
 
+    private static final String DONALDS_PASSWORD = "daisy0815";
+
     private ApiContext ownerCtx;
 
     private final SecurityApi securityApi = new SecurityApi();
@@ -38,8 +40,8 @@ public class AclRevokeAnonymousTest extends AbstractSeleniumTest {
         clearState(getContextRoot());
         super.setUp();
         final ApiContext adminSecurityCtx = createAdminApiContext(getContextRoot(), SECURITY_CONTEXT);
-        securityApi.createUser(adminSecurityCtx, "donald", "Donald Duck", null, "daisy0815");
-        ownerCtx = createApiContext(getContextRoot(), SERVER_CONTEXT, "donald", "daisy0815");
+        securityApi.createUser(adminSecurityCtx, "donald", "Donald Duck", null, DONALDS_PASSWORD);
+        ownerCtx = createApiContext(getContextRoot(), SERVER_CONTEXT, "donald", DONALDS_PASSWORD);
         adminConsole = goToPage(getWebDriver(), getContextRoot());
         adminConsole.goToLocalServerPanel().setSelfServiceServer(true);
         eventApi.createEvent(ownerCtx, EVENT_NAME, BOAT_CLASS, CompetitorRegistrationType.CLOSED, "Some special place");

java/com.sap.sailing.server.test/src/com/sap/sailing/server/test/LeagueEventHierarchyOwnershipChangeTest.java

@@ -63,7 +63,7 @@ public class LeagueEventHierarchyOwnershipChangeTest {
         securityService = new SecurityBundleTestWrapper().initializeSecurityServiceForTesting();
         Mockito.doReturn(securityService).when(service).getSecurityService();
         securityService.createSimpleUser(USERNAME, "a@b.c", PASSWORD, "The User", "SAP SE",
-                /* validation URL */ Locale.ENGLISH, null, null, /* clientIP */ null);
+                /* validation URL */ Locale.ENGLISH, null, null, /* clientIP */ null, /* enforce strong password */ false);
     }
     
     @Before

java/com.sap.sailing.server.test/src/com/sap/sailing/server/test/TaggingServiceTest.java

@@ -96,7 +96,7 @@ public class TaggingServiceTest {
         securityService = new SecurityBundleTestWrapper().initializeSecurityServiceForTesting();
         // create & login user
         securityService.createSimpleUser(username, email, password, fullName, company, Locale.ENGLISH, null,
-                securityService.getDefaultTenantForCurrentUser(), /* clientIP */ null);
+                securityService.getDefaultTenantForCurrentUser(), /* clientIP */ null, /* enforce strong password */ false);
         ThreadContext.unbindSubject(); // ensure that a new subject is created that knows the current security manager
         subject = SecurityUtils.getSubject(); // this also binds the Subject to the ThreadContext
         subject.login(new UsernamePasswordToken(username, password));

java/com.sap.sse.security.replication.test/src/com/sap/sse/security/replication/test/SecurityReplicationLeadingToEmailReplicationTest.java

@@ -120,7 +120,7 @@ public class SecurityReplicationLeadingToEmailReplicationTest extends AbstractSe
         final String password = "BertMyFriend";
         final String validationBaseURL = null; //so that validation email is not sent        
         masterSecurityService.createSimpleUser(username, email, password, 
-                /* fullName */ null, /* company */ null, Locale.ENGLISH, validationBaseURL, null, /* clientIP */ null);
+                /* fullName */ null, /* company */ null, Locale.ENGLISH, validationBaseURL, null, /* clientIP */ null, /* enforce strong password */ false);
         masterSecurityService.sendMail(username, "subject", "body");
         securitySetUp.getReplicaReplicator().waitUntilQueueIsEmpty();
         mailSetUp.getReplicaReplicator().waitUntilQueueIsEmpty();
@@ -146,7 +146,7 @@ public class SecurityReplicationLeadingToEmailReplicationTest extends AbstractSe
         final String password = "BertMyFriend";
         final String validationBaseURL = null; //so that validation email is not sent        
         replicaSecurityService.createSimpleUser(username, email, password,
-                /* fullName */ null, /* company */ null, Locale.ENGLISH, validationBaseURL, null, /* clientIP */ null);
+                /* fullName */ null, /* company */ null, Locale.ENGLISH, validationBaseURL, null, /* clientIP */ null, /* enforce strong password */ false);
         replicaSecurityService.sendMail(username, "subject", "body");
         securitySetUp.getReplicaReplicator().waitUntilQueueIsEmpty();
         mailSetUp.getReplicaReplicator().waitUntilQueueIsEmpty();

java/com.sap.sse.security.replication.test/src/com/sap/sse/security/replication/test/SecurityServiceInitialLoadTest.java

@@ -44,7 +44,8 @@ public class SecurityServiceInitialLoadTest extends AbstractServerWithSingleServ
                 final SecurityServiceImpl newMaster = new SecurityServiceImpl(null, /* corsFilterConfigurationTracker */ null, userStore,
                         accessControlStore, SecuredSecurityTypes::getAllInstances, SSESubscriptionPlan::getAllInstances);
                 newMaster.createSimpleUser(username, email, password, fullName, company,
-                        /* validationBaseURL */ Locale.ENGLISH, null, null, /* clientIP */ null);
+                        /* validationBaseURL */ Locale.ENGLISH, null, null, /* clientIP */ null,
+                        /* enforce strong password */ false);
                 accessToken = newMaster.createAccessToken(username);
                 return newMaster;
             }

java/com.sap.sse.security.replication.test/src/com/sap/sse/security/replication/test/SimpleSecurityReplicationTest.java

@@ -40,7 +40,7 @@ public class SimpleSecurityReplicationTest extends AbstractSecurityReplicationTe
     public void testSimpleReplicationOfUserCreation() throws InterruptedException, UserManagementException, MailException, IllegalAccessException, UserGroupManagementException {
         assertNull(master.getUserByName(ERNIE));
         User user = master.createSimpleUser(ERNIE, ERNIE_SESAME_STREET_COM, BERT_MY_FRIEND, ERNIE_S_FULL_NAME, ERNIE_S_COMPANY, Locale.ENGLISH,
-                HTTP_ME_TO_BACK_COM, null, /* clientIP */ null);
+                HTTP_ME_TO_BACK_COM, null, /* clientIP */ null, /* enforce strong password */ false);
         assertNotNull(user);
         assertSame(user, master.getUserByName(ERNIE));
         assertTrue(master.checkPassword(ERNIE, BERT_MY_FRIEND));
@@ -65,7 +65,7 @@ public class SimpleSecurityReplicationTest extends AbstractSecurityReplicationTe
     @Test
     public void testSimpleReplicationOfUserEmailChange() throws InterruptedException, UserManagementException, MailException, IllegalAccessException, UserGroupManagementException {
         User user = master.createSimpleUser(ERNIE, ERNIE_SESAME_STREET_COM, BERT_MY_FRIEND, ERNIE_S_FULL_NAME, ERNIE_S_COMPANY, Locale.ENGLISH,
-                HTTP_ME_TO_BACK_COM, master.getDefaultTenantForCurrentUser(), /* clientIP */ null);
+                HTTP_ME_TO_BACK_COM, master.getDefaultTenantForCurrentUser(), /* clientIP */ null, /* enforce strong password */ false);
         user.setFullName(ERNIE_S_FULL_NAME);
         user.setCompany(ERNIE_S_COMPANY);
         final String emailValidationSecretAfterCreation = user.getValidationSecret();
@@ -89,7 +89,7 @@ public class SimpleSecurityReplicationTest extends AbstractSecurityReplicationTe
         final String newPassword = "ErnieAndBert";
         master.createSimpleUser(ERNIE, ERNIE_SESAME_STREET_COM, BERT_MY_FRIEND,
                 /* fullName */ null, /* company */ null, Locale.ENGLISH, HTTP_ME_TO_BACK_COM,
-                null, /* clientIP */ null);
+                null, /* clientIP */ null, /* enforce strong password */ false);
         master.updateSimpleUserPassword(ERNIE, newPassword);
         assertTrue(master.checkPassword(ERNIE, newPassword));
         replicaReplicator.waitUntilQueueIsEmpty();
@@ -110,7 +110,7 @@ public class SimpleSecurityReplicationTest extends AbstractSecurityReplicationTe
         final String passwordResetBaseURL = "http://me.to.back.com/passwordreset";
         User user = master.createSimpleUser(ERNIE, ERNIE_SESAME_STREET_COM, BERT_MY_FRIEND,
                 /* fullName */ null, /* company */ null, Locale.ENGLISH, validationBaseURL,
-                null, /* clientIP */ null);
+                null, /* clientIP */ null, /* enforce strong password */ false);
         master.validateEmail(ERNIE, user.getValidationSecret());
         assertTrue(user.isEmailValidated());
         master.resetPassword(ERNIE, passwordResetBaseURL);
@@ -131,7 +131,7 @@ public class SimpleSecurityReplicationTest extends AbstractSecurityReplicationTe
         final Set<WildcardPermission> permissions = Collections.singleton(permission);
         master.createSimpleUser(ERNIE, ERNIE_SESAME_STREET_COM, BERT_MY_FRIEND,
                 /* fullName */ null, /* company */ null, Locale.ENGLISH, null,
-                null, /* clientIP */ null);
+                null, /* clientIP */ null, /* enforce strong password */ false);
         final RoleDefinition roleDefinition = master.createRoleDefinition(roleDefinitionUUID, roleDefinitionName);
         roleDefinition.setPermissions(permissions);
         master.updateRoleDefinition(roleDefinition);
@@ -151,7 +151,7 @@ public class SimpleSecurityReplicationTest extends AbstractSecurityReplicationTe
         final Set<WildcardPermission> permissions = Collections.singleton(permission);
         master.createSimpleUser(ERNIE, ERNIE_SESAME_STREET_COM, BERT_MY_FRIEND,
                 /* fullName */ null, /* company */ null, Locale.ENGLISH, null,
-                null, /* clientIP */ null);
+                null, /* clientIP */ null, /* enforce strong password */ false);
         final RoleDefinition roleDefinition = master.createRoleDefinition(roleDefinitionUUID, roleDefinitionName);
         roleDefinition.setPermissions(permissions);
         master.updateRoleDefinition(roleDefinition);

java/com.sap.sse.security.test/src/com/sap/sse/security/jaxrs/api/SecurityResourceTest.java

@@ -73,7 +73,7 @@ public class SecurityResourceTest {
             Activator.setSecurityService(service);
             SecurityUtils.setSecurityManager(service.getSecurityManager());
             service.createSimpleUser(USERNAME, "a@b.c", PASSWORD, "The User", "SAP SE",
-                    /* validation URL */ Locale.ENGLISH, null, null, /* clientIP */ null);
+                    /* validation URL */ Locale.ENGLISH, null, null, /* clientIP */ null, /* enforce strong password */ false);
             authenticatedAdmin = SecurityUtils.getSubject();
             authenticatedAdmin.login(new UsernamePasswordToken(USERNAME, PASSWORD));
             Session session = authenticatedAdmin.getSession();

java/com.sap.sse.security.test/src/com/sap/sse/security/test/LoginTest.java

@@ -92,7 +92,7 @@ public class LoginTest {
         final String username = "TheNewUser";
         final String specialUserGroupName1 = "TheSpecialUserGroup1";
         final String specialUserGroupName2 = "TheSpecialUserGroup2";
-        final User user = securityService.createSimpleUser(username, "u@a.b", "Humba", "The New User", /* company */ null, /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null);
+        final User user = securityService.createSimpleUser(username, "u@a.b", "Humba", "The New User", /* company */ null, /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null, /* enforce strong password */ false);
         final TypeRelativeObjectIdentifier myServerTypeRelativeObjectIdentifier = new TypeRelativeObjectIdentifier("myserver");
         final WildcardPermission createObjectPermissionOnMyserver = SecuredSecurityTypes.SERVER.getPermissionForTypeRelativeIdentifier(ServerActions.CREATE_OBJECT,
                 myServerTypeRelativeObjectIdentifier);
@@ -123,7 +123,7 @@ public class LoginTest {
         final String username = "TheNewUser";
         final String specialUserGroupName1 = "TheSpecialUserGroup1";
         final String specialUserGroupName2 = "TheSpecialUserGroup2";
-        final User user = securityService.createSimpleUser(username, "u@a.b", "Humba", "The New User", /* company */ null, /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null);
+        final User user = securityService.createSimpleUser(username, "u@a.b", "Humba", "The New User", /* company */ null, /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null, /* enforce strong password */ false);
         final UserGroup defaultUserGroup = securityService.getUserGroupByName(username+SecurityService.TENANT_SUFFIX);
         final UserGroup specialUserGroup1 = securityService.createUserGroup(UUID.randomUUID(), specialUserGroupName1);
         final UserGroup specialUserGroup2 = securityService.createUserGroup(UUID.randomUUID(), specialUserGroupName2);
@@ -141,7 +141,7 @@ public class LoginTest {
     public void testAclAnonUserGroup() throws UserManagementException, MailException, UserGroupManagementException {
         final String username = "TheNewUser";
         securityService.createSimpleUser(username, "u@a.b", "Humba", username, /* company */ null,
-                /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null);
+                /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null, /* enforce strong password */ false);
         final UserGroup defaultUserGroup = securityService.getUserGroupByName(username + SecurityService.TENANT_SUFFIX);
         Map<UserGroup, Set<String>> permissionMap = new HashMap<>();
         permissionMap.put(defaultUserGroup, new HashSet<>(Arrays.asList(new String[] { "!READ", "UPDATE" })));
@@ -180,7 +180,7 @@ public class LoginTest {
         final RoleDefinition adminRoleDefinition = securityService.getOrCreateRoleDefinitionFromPrototype(AdminRole.getInstance(), /* makeReadableForAll */ true);
         final UserGroup adminTenant = securityService.getUserGroupByName(admin.getName()+SecurityService.TENANT_SUFFIX);
         securityService.createSimpleUser(username, "u@a.b", password, username, /* company */ null,
-                /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null);
+                /* locale */ null, /* validationBaseURL */ null, /* owning group */ null, /* clientIP */ null, /* enforce strong password */ false);
         final UserGroup defaultUserGroup = securityService.getUserGroupByName(username + SecurityService.TENANT_SUFFIX);
         final QualifiedObjectIdentifier myId = my.getIdentifier();
         // grant admin role to user unqualified, implying READ on all objects including the "my" SERVER

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementWriteServiceImpl.java

@@ -279,7 +279,8 @@ public class UserManagementWriteServiceImpl extends UserManagementServiceImpl im
                         try {
                             User newUser = getSecurityService().createSimpleUser(username, email, password, fullName,
                                     company, getLocaleFromLocaleName(localeName), validationBaseURL,
-                                    getSecurityService().getDefaultTenantForCurrentUser(), clientIP);
+                                    getSecurityService().getDefaultTenantForCurrentUser(), clientIP,
+                                    /* enforce strong password */ true);
                             return newUser;
                         } catch (UserManagementException e) {
                             logger.severe("Error creating user " + username+": "+e.getMessage());

java/com.sap.sse.security/src/com/sap/sse/security/SecurityService.java

@@ -205,14 +205,14 @@ public interface SecurityService extends ReplicableWithObjectInputStream<Replica
 
     /**
      * This version should only be used for tests, normally the defaultTenand handling should be used
-     * 
      * @param validationBaseURL
      *            if <code>null</code>, no validation will be attempted
      * @param requestClientIP
      *            used for throttling user creation requests coming from the same IP address
+     * @param enforceStrongPassword TODO
      */
     User createSimpleUser(String username, String email, String password, String fullName, String company,
-            Locale locale, String validationBaseURL, UserGroup userOwner, String requestClientIP)
+            Locale locale, String validationBaseURL, UserGroup userOwner, String requestClientIP, boolean enforceStrongPassword)
             throws UserManagementException, MailException, UserGroupManagementException;
 
     void updateSimpleUserPassword(String name, String newPassword) throws UserManagementException;

java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java

@@ -275,7 +275,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
     /**
      * Contains locking objects keyed by client IP addresses ({@code null} not allowed) that describe which client IPs
      * are locked for {@link User} creation, e.g., through the
-     * {@link #createSimpleUser(String, String, String, String, String, Locale, String, UserGroup, String)
+     * {@link #createSimpleUser(String, String, String, String, String, Locale, String, UserGroup, String, boolean)
      * createSimpleUser} method.<p>
      * 
      * When entering values into this map, the method entering it is responsible for also scheduling a background
@@ -455,7 +455,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
                 final User adminUser = createSimpleUser(UserStore.ADMIN_USERNAME, "nobody@sapsailing.com",
                         ADMIN_DEFAULT_PASSWORD,
                         /* fullName */ null, /* company */ null, Locale.ENGLISH, /* validationBaseURL */ null,
-                        null, /* clientIP */ null);
+                        null, /* clientIP */ null, /* enforce strong password */ false);
                 setOwnership(adminUser.getIdentifier(), adminUser, null);
                 Role adminRole = new Role(adminRoleDefinition, /* transitive */ true);
                 addRoleForUserAndSetUserAsOwner(adminUser, adminRole);
@@ -1070,7 +1070,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
     @Override
     public User createSimpleUser(final String username, final String email, String password, String fullName,
             String company, Locale locale, final String validationBaseURL, UserGroup groupOwningUser,
-            String requestClientIP) throws UserManagementException, MailException, UserGroupManagementException {
+            String requestClientIP, boolean enforceStrongPassword) throws UserManagementException, MailException, UserGroupManagementException {
         if (requestClientIP != null) {
             checkAndRecordUserCreationFromClientIP(requestClientIP);
         }
@@ -1081,7 +1081,7 @@ implements ReplicableSecurityService, ClearStateTestSupport {
         }
         if (username == null || username.length() < 3) {
             throw new UserManagementException(UserManagementException.USERNAME_DOES_NOT_MEET_REQUIREMENTS);
-        } else if (!isPasswordGoodEnough(password)) {
+        } else if (enforceStrongPassword && !isPasswordGoodEnough(password)) {
             throw new UserManagementException(UserManagementException.PASSWORD_DOES_NOT_MEET_REQUIREMENTS);
         }
         RandomNumberGenerator rng = new SecureRandomNumberGenerator();

java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java

@@ -202,7 +202,7 @@ public class SecurityResource extends AbstractSecurityResource {
                             final String fullNameToUse = preferFirstIfNotNullOrElseSecond(formFullName, queryFullName);
                             final String companyToUse = preferFirstIfNotNullOrElseSecond(formCompany, queryCompany);
                             User newUser = getSecurityService().createSimpleUser(usernameToUse, emailToUse, passwordToUse, fullNameToUse, companyToUse,
-                                    Locale.ENGLISH, validationBaseURL, getSecurityService().getDefaultTenantForCurrentUser(), clientIP);
+                                    Locale.ENGLISH, validationBaseURL, getSecurityService().getDefaultTenantForCurrentUser(), clientIP, /* enforce strong password */ true);
                             SecurityUtils.getSubject().login(new UsernamePasswordToken(usernameToUse, passwordToUse));
                             return newUser;
                         }