Merge branch 'bug2589' into bug3493

java/com.sap.sse.security.test/src/com/sap/sse/security/jaxrs/api/SecurityResourceTest.java

@@ -6,7 +6,10 @@ import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
+import javax.ws.rs.core.Response;
+
 import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.UsernamePasswordToken;
 import org.apache.shiro.session.Session;
 import org.apache.shiro.subject.Subject;
 import org.json.simple.JSONObject;
@@ -29,6 +32,7 @@ import com.sap.sse.security.userstore.mongodb.UserStoreImpl;
 public class SecurityResourceTest {
     private SecurityResource servlet;
     private SecurityServiceImpl service;
+    private Subject authenticatedAdmin;
 
     @Before
     public void setUp() throws UserManagementException, MailException {
@@ -36,29 +40,31 @@ public class SecurityResourceTest {
         ClassLoader oldContextClassLoader = Thread.currentThread().getContextClassLoader();
         Thread.currentThread().setContextClassLoader(getClass().getClassLoader());
         try {
-        final UserStoreImpl store = new UserStoreImpl();
-        Activator.setTestUserStore(store);
-        UsernamePasswordRealm.setTestUserStore(store);
-        service = new SecurityServiceImpl(/* mailServiceTracker */ null,
-                store, /* setAsActivatorSecurityService */ true);
-        SecurityUtils.setSecurityManager(service.getSecurityManager());
-        Session session = SecurityUtils.getSubject().getSession();
-        assertNotNull(session);
-        servlet = new SecurityResource() {
-            @Override
-            public SecurityService getService() {
-                return service;
-            }
-        };
-        store.addPermissionForUser("admin", "can do");
-        store.addPermissionForUser("admin", "event:view:*");
-        store.addPermissionForUser("admin", "event:edit:123");
+            final UserStoreImpl store = new UserStoreImpl();
+            Activator.setTestUserStore(store);
+            UsernamePasswordRealm.setTestUserStore(store);
+            service = new SecurityServiceImpl(/* mailServiceTracker */ null,
+                    store, /* setAsActivatorSecurityService */ true);
+            SecurityUtils.setSecurityManager(service.getSecurityManager());
+            authenticatedAdmin = SecurityUtils.getSubject();
+            authenticatedAdmin.login(new UsernamePasswordToken("admin", "admin"));
+            Session session = authenticatedAdmin.getSession();
+            assertNotNull(session);
+            servlet = new SecurityResource() {
+                @Override
+                public SecurityService getService() {
+                    return service;
+                }
+            };
+            store.addPermissionForUser("admin", "can do");
+            store.addPermissionForUser("admin", "event:view:*");
+            store.addPermissionForUser("admin", "event:edit:123");
         } finally {
-        	Thread.currentThread().setContextClassLoader(oldContextClassLoader);
+            Thread.currentThread().setContextClassLoader(oldContextClassLoader);
         }
     }
     
-    private String createAccessToken() throws ParseException {
+    private String getOrCreateAccessToken() throws ParseException {
         String responseJsonString = (String) servlet.respondWithAccessTokenForUser("admin").getEntity();
         JSONObject responseJson = (JSONObject) new JSONParser().parse(responseJsonString);
         assertEquals("admin", responseJson.get("username"));
@@ -67,9 +73,23 @@ public class SecurityResourceTest {
         return accessToken;
     }
 
+    private String createAccessToken() throws ParseException {
+        assertEquals(Response.Status.OK.getStatusCode(), servlet.respondToRemoveAccessTokenForUser("admin").getStatus());
+        String responseJsonString = (String) servlet.respondWithAccessTokenForUser("admin").getEntity();
+        JSONObject responseJson = (JSONObject) new JSONParser().parse(responseJsonString);
+        assertEquals("admin", responseJson.get("username"));
+        String accessToken = (String) responseJson.get("access_token");
+        assertNotNull(accessToken);
+        return accessToken;
+    }
+
+    private void removeAccessToken() {
+        assertEquals(Response.Status.OK.getStatusCode(), servlet.respondToRemoveAccessTokenForUser("admin").getStatus());
+    }
+
     @Test
     public void createAccessTokenAndAuthenticate() throws ParseException {
-        String accessToken = createAccessToken();
+        String accessToken = getOrCreateAccessToken();
         User user = service.getUserByAccessToken(accessToken);
         assertNotNull(user);
         assertEquals("admin", user.getName());
@@ -88,9 +108,17 @@ public class SecurityResourceTest {
 
     @Test
     public void ensureOldBearerTokenIsInvalidatedByObtainingNewOne() throws ParseException {
-        String accessToken = createAccessToken();
+        String accessToken = getOrCreateAccessToken();
         createAccessToken();
         User user = service.getUserByAccessToken(accessToken);
         assertNull(user); // the old access token is expected to have been obsoleted by obtaining a new one
     }
+
+    @Test
+    public void ensureOldBearerTokenIsInvalidatedByRequestingItsRemoval() throws ParseException {
+        String accessToken = getOrCreateAccessToken();
+        removeAccessToken();
+        User user = service.getUserByAccessToken(accessToken);
+        assertNull(user); // the old access token is expected to have been obsoleted by obtaining a new one
+    }
 }

java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/UserStoreImpl.java

@@ -146,8 +146,9 @@ public class UserStoreImpl implements UserStore {
     @Override
     public String getAccessToken(String username) {
         // only the user or an administrator may request a user's access token
+        final Object principal = SecurityUtils.getSubject().getPrincipal();
         if (SecurityUtils.getSubject().hasRole(DefaultRoles.ADMIN.getRolename()) ||
-            SecurityUtils.getSubject().getPrincipal().toString().equals(username)) {
+            (principal != null && principal.toString().equals(username))) {
             return getPreference(username, ACCESS_TOKEN_KEY);
         } else {
             throw new org.apache.shiro.authz.AuthorizationException("Only admin role or owner can retrieve access token");

java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/SecurityResource.java

@@ -78,14 +78,20 @@ public class SecurityResource extends AbstractSecurityResource {
         final Object principal = SecurityUtils.getSubject().getPrincipal();
         if (principal != null) {
             final String username = principal.toString();
-            getService().removeAccessToken(username);
-            result = Response.ok().build();
+            result = respondToRemoveAccessTokenForUser(username);
         } else {
             result = Response.status(Status.UNAUTHORIZED).build();
         }
         return result;
     }
 
+    Response respondToRemoveAccessTokenForUser(final String username) {
+        final Response result;
+        getService().removeAccessToken(username);
+        result = Response.ok().build();
+        return result;
+    }
+
     private Response respondWithAccessTokenForAuthenticatedSubject() {
         final Response result;
         final Object principal = SecurityUtils.getSubject().getPrincipal();