Skip to content

Commit 3332e15

Browse files
VlatombeVlatombe
committed
Clean up test references of removed methods
1 parent 56c562a commit 3332e15

8 files changed

Lines changed: 64 additions & 90 deletions

File tree

‎src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -550,18 +550,6 @@ public boolean isSendScopesInTokenRequest() {
550550
return sendScopesInTokenRequest;
551551
}
552552

553-
public boolean isPkceEnabled() {
554-
return pkceEnabled;
555-
}
556-
557-
public boolean isDisableTokenVerification() {
558-
return disableTokenVerification;
559-
}
560-
561-
public boolean isNonceDisabled() {
562-
return nonceDisabled;
563-
}
564-
565553
public boolean isTokenExpirationCheckDisabled() {
566554
return tokenExpirationCheckDisabled;
567555
}

‎src/main/java/org/jenkinsci/plugins/oic/properties/DisableTokenVerification.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
package org.jenkinsci.plugins.oic.properties;
22

3-
import edu.umd.cs.findbugs.annotations.CheckForNull;
43
import edu.umd.cs.findbugs.annotations.NonNull;
54
import hudson.Extension;
65
import java.io.Serial;
@@ -35,7 +34,8 @@ public OidcPropertyExecution newExecution(@NonNull OicServerConfiguration server
3534
@Serial
3635
protected Object readResolve() {
3736
if (FIPS140.useCompliantAlgorithms()) {
38-
throw new IllegalStateException(org.jenkinsci.plugins.oic.Messages.OicSecurityRealm_DisableTokenVerificationFipsMode());
37+
throw new IllegalStateException(
38+
org.jenkinsci.plugins.oic.Messages.OicSecurityRealm_DisableTokenVerificationFipsMode());
3939
}
4040
return this;
4141
}

‎src/main/java/org/jenkinsci/plugins/oic/properties/EscapeHatch.java‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ public class EscapeHatch extends OidcProperty {
5656
public EscapeHatch(@NonNull String username, @CheckForNull String group, @NonNull Secret secret)
5757
throws Descriptor.FormException {
5858
if (FIPS140.useCompliantAlgorithms()) {
59-
throw new IllegalStateException("Cannot use Escape Hatch in FIPS-140 mode");
59+
throw new Descriptor.FormException("Cannot use Escape Hatch in FIPS-140 mode", "escapeHatch");
6060
}
6161
var sanitizedUsername = Util.fixEmptyAndTrim(username);
6262
if (sanitizedUsername == null) {
@@ -106,8 +106,9 @@ private void randomWait() {
106106
public Optional<Authentication> authenticate(@NonNull Authentication authentication) {
107107
if (authentication instanceof UsernamePasswordAuthenticationToken) {
108108
randomWait(); // to slowdown brute forcing
109-
if (authentication.getPrincipal().toString().equals(this.username)
110-
&& BCrypt.checkpw(authentication.getCredentials().toString(), Secret.toString(this.secret))) {
109+
if (check(
110+
authentication.getPrincipal().toString(),
111+
authentication.getCredentials().toString())) {
111112
List<GrantedAuthority> grantedAuthorities = new ArrayList<>();
112113
grantedAuthorities.add(SecurityRealm.AUTHENTICATED_AUTHORITY2);
113114
if (isNotBlank(group)) {
@@ -126,6 +127,13 @@ public Optional<Authentication> authenticate(@NonNull Authentication authenticat
126127
return Optional.empty();
127128
}
128129

130+
/**
131+
* Check a given username and password against the configured ones.
132+
*/
133+
public boolean check(@NonNull String username, @CheckForNull String password) {
134+
return username.equals(this.username) && BCrypt.checkpw(password, Secret.toString(this.secret));
135+
}
136+
129137
public static class DescriptorImpl extends OidcPropertyDescriptor {
130138
@Extension
131139
@CheckForNull

‎src/test/java/org/jenkinsci/plugins/oic/ConfigurationAsCodeTest.java‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import static io.jenkins.plugins.casc.misc.Util.toStringFromYamlFile;
99
import static io.jenkins.plugins.casc.misc.Util.toYamlString;
1010
import static org.hamcrest.MatcherAssert.assertThat;
11+
import static org.hamcrest.Matchers.empty;
1112
import static org.hamcrest.Matchers.instanceOf;
1213
import static org.hamcrest.Matchers.is;
1314
import static org.hamcrest.Matchers.notNullValue;
@@ -87,7 +88,6 @@ void testConfig(JenkinsConfiguredWithCodeRule j) {
8788
assertEquals("userNameField", oicSecurityRealm.getUserNameField());
8889
assertTrue(oicSecurityRealm.isRootURLFromRequest());
8990
assertEquals("http://localhost/jwks", serverConf.getJwksServerUrl());
90-
assertFalse(oicSecurityRealm.isDisableTokenVerification());
9191
var loginQueryParameters = oicSecurityRealm.getProperties().get(LoginQueryParameters.class);
9292
assertThat(loginQueryParameters, notNullValue());
9393
assertEquals(
@@ -145,7 +145,6 @@ void testMinimal(JenkinsConfiguredWithCodeRule j) {
145145
assertEquals("clientSecret", Secret.toString(oicSecurityRealm.getClientSecret()));
146146
assertFalse(oicSecurityRealm.isDisableSslVerification());
147147
assertNull(oicSecurityRealm.getEmailFieldName());
148-
assertFalse(oicSecurityRealm.isEscapeHatchEnabled());
149148
assertNull(oicSecurityRealm.getFullNameFieldName());
150149
assertNull(oicSecurityRealm.getGroupsFieldName());
151150
assertEquals("openid email", serverConf.getScopes());
@@ -155,9 +154,7 @@ void testMinimal(JenkinsConfiguredWithCodeRule j) {
155154
assertTrue(oicSecurityRealm.isLogoutFromOpenidProvider());
156155
assertFalse(oicSecurityRealm.isRootURLFromRequest());
157156
assertNull(serverConf.getJwksServerUrl());
158-
assertFalse(oicSecurityRealm.isDisableTokenVerification());
159-
assertNull(oicSecurityRealm.getLoginQueryParameters());
160-
assertNull(oicSecurityRealm.getLogoutQueryParameters());
157+
assertThat(oicSecurityRealm.getProperties(), empty());
161158
}
162159

163160
@Test
@@ -175,7 +172,6 @@ void testMinimalWellKnown(JenkinsConfiguredWithCodeRule j) {
175172

176173
assertFalse(oicSecurityRealm.isDisableSslVerification());
177174
assertNull(oicSecurityRealm.getEmailFieldName());
178-
assertFalse(oicSecurityRealm.isEscapeHatchEnabled());
179175
assertNull(oicSecurityRealm.getFullNameFieldName());
180176
assertNull(oicSecurityRealm.getGroupsFieldName());
181177

@@ -184,12 +180,9 @@ void testMinimalWellKnown(JenkinsConfiguredWithCodeRule j) {
184180

185181
assertEquals("sub", oicSecurityRealm.getUserNameField());
186182
assertTrue(oicSecurityRealm.isLogoutFromOpenidProvider());
187-
assertFalse(oicSecurityRealm.isDisableTokenVerification());
188183

189184
assertEquals(urlBase + "/well.known", serverConf.getWellKnownOpenIDConfigurationUrl());
190-
191-
assertNull(oicSecurityRealm.getLoginQueryParameters());
192-
assertNull(oicSecurityRealm.getLogoutQueryParameters());
185+
assertThat(oicSecurityRealm.getProperties(), empty());
193186
}
194187

195188
/** Class to setup WellKnownMockExtension for well known with stub and setting port in env variable

‎src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmTest.java‎

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,8 @@
77
import static org.hamcrest.Matchers.startsWith;
88
import static org.junit.jupiter.api.Assertions.assertEquals;
99
import static org.junit.jupiter.api.Assertions.assertFalse;
10-
import static org.junit.jupiter.api.Assertions.assertNotEquals;
1110
import static org.junit.jupiter.api.Assertions.assertNotNull;
1211
import static org.junit.jupiter.api.Assertions.assertThrows;
13-
import static org.junit.jupiter.api.Assertions.assertTrue;
1412

1513
import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
1614
import hudson.util.Secret;
@@ -32,7 +30,6 @@
3230
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
3331
import org.springframework.security.core.GrantedAuthority;
3432
import org.springframework.security.core.authority.SimpleGrantedAuthority;
35-
import org.springframework.security.crypto.bcrypt.BCrypt;
3633

3734
@WithJenkins
3835
class OicSecurityRealmTest {
@@ -118,41 +115,6 @@ void testShouldReturnRootUrlWhenRedirectUrlIsInvalid(JenkinsRule jenkinsRule) th
118115
assertEquals(rootUrl, realm.getValidRedirectUrl("http://localhost/jenkins/../bar/"));
119116
}
120117

121-
@Test
122-
void testShouldCheckEscapeHatchWithPlainPassword(JenkinsRule jenkinsRule) throws Exception {
123-
final String escapeHatchUsername = "aUsername";
124-
final String escapeHatchPassword = "aSecretPassword";
125-
126-
TestRealm realm = new TestRealm.Builder(wireMock)
127-
.WithMinimalDefaults()
128-
.WithEscapeHatch(true, escapeHatchUsername, escapeHatchPassword, "Group")
129-
.build();
130-
131-
assertEquals(escapeHatchUsername, realm.getEscapeHatchUsername());
132-
assertNotEquals(escapeHatchPassword, Secret.toString(realm.getEscapeHatchSecret()));
133-
assertTrue(realm.doCheckEscapeHatch(escapeHatchUsername, escapeHatchPassword));
134-
assertFalse(realm.doCheckEscapeHatch("otherUsername", escapeHatchPassword));
135-
assertFalse(realm.doCheckEscapeHatch(escapeHatchUsername, "wrongPassword"));
136-
}
137-
138-
@Test
139-
void testShouldCheckEscapeHatchWithHashedPassword(JenkinsRule jenkinsRule) throws Exception {
140-
final String escapeHatchUsername = "aUsername";
141-
final String escapeHatchPassword = "aSecretPassword";
142-
final String escapeHatchCryptedPassword = BCrypt.hashpw(escapeHatchPassword, BCrypt.gensalt());
143-
144-
TestRealm realm = new TestRealm.Builder(wireMock)
145-
.WithMinimalDefaults()
146-
.WithEscapeHatch(true, escapeHatchUsername, escapeHatchCryptedPassword, "Group")
147-
.build();
148-
149-
assertEquals(escapeHatchUsername, realm.getEscapeHatchUsername());
150-
assertEquals(escapeHatchCryptedPassword, Secret.toString(realm.getEscapeHatchSecret()));
151-
assertTrue(realm.doCheckEscapeHatch(escapeHatchUsername, escapeHatchPassword));
152-
assertFalse(realm.doCheckEscapeHatch("otherUsername", escapeHatchPassword));
153-
assertFalse(realm.doCheckEscapeHatch(escapeHatchUsername, "wrongPassword"));
154-
}
155-
156118
@Test
157119
@WithoutJenkins
158120
public void testMaybeOpenIdLogoutEndpoint() throws Exception {

‎src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
package org.jenkinsci.plugins.oic;
22

33
import static org.hamcrest.MatcherAssert.assertThat;
4-
import static org.hamcrest.Matchers.is;
4+
import static org.hamcrest.Matchers.nullValue;
55
import static org.junit.jupiter.api.Assertions.assertThrows;
66

77
import hudson.model.Descriptor;
8+
import hudson.util.Secret;
89
import jenkins.security.FIPS140;
10+
import org.jenkinsci.plugins.oic.properties.EscapeHatch;
911
import org.junit.jupiter.api.AfterAll;
1012
import org.junit.jupiter.api.BeforeAll;
1113
import org.junit.jupiter.api.Test;
@@ -31,22 +33,22 @@ static void tearDown() {
3133
@Test
3234
void escapeHatchThrowsException() {
3335
assertThrows(
34-
Descriptor.FormException.class,
35-
() -> new OicSecurityRealm("clientId", null, null, null, null, null).setEscapeHatchEnabled(true));
36+
Descriptor.FormException.class, () -> new OicSecurityRealm("clientId", null, null, null, null, null)
37+
.getProperties()
38+
.add(new EscapeHatch("admin", null, Secret.fromString("very-secret"))));
3639
}
3740

3841
@Test
3942
void escapeHatchToFalse() throws Exception {
4043
OicSecurityRealm oicSecurityRealm = new OicSecurityRealm("clientId", null, null, null, null, null);
41-
oicSecurityRealm.setEscapeHatchEnabled(false);
42-
assertThat(oicSecurityRealm.isEscapeHatchEnabled(), is(false));
44+
assertThat(oicSecurityRealm.getProperties().get(EscapeHatch.class), nullValue());
4345
}
4446

4547
@Test
4648
void readResolve() throws Exception {
4749
OicSecurityRealm oicSecurityRealm = new OicSecurityRealm("clientId", null, null, null, null, null);
48-
oicSecurityRealm.setEscapeHatchEnabled(false);
49-
assertThat(oicSecurityRealm.isEscapeHatchEnabled(), is(false));
50+
assertThat(oicSecurityRealm.getProperties().get(EscapeHatch.class), nullValue());
5051
oicSecurityRealm.readResolve();
52+
assertThat(oicSecurityRealm.getProperties().get(EscapeHatch.class), nullValue());
5153
}
5254
}

‎src/test/java/org/jenkinsci/plugins/oic/TestRealm.java‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,9 @@
1212
import java.util.ArrayList;
1313
import java.util.List;
1414
import jenkins.model.IdStrategy;
15+
import org.jenkinsci.plugins.oic.properties.DisableNonce;
1516
import org.jenkinsci.plugins.oic.properties.DisableTokenVerification;
17+
import org.jenkinsci.plugins.oic.properties.EscapeHatch;
1618
import org.jenkinsci.plugins.oic.properties.LoginQueryParameters;
1719
import org.jenkinsci.plugins.oic.properties.LogoutQueryParameters;
1820
import org.kohsuke.stapler.StaplerRequest2;
@@ -54,10 +56,6 @@ public static class Builder {
5456
public Boolean logoutFromOpenidProvider = false;
5557
public String endSessionEndpoint = null;
5658
public String postLogoutRedirectUrl = null;
57-
public boolean escapeHatchEnabled = false;
58-
public String escapeHatchUsername = null;
59-
public Secret escapeHatchSecret = null;
60-
public String escapeHatchGroup = null;
6159
public boolean automanualconfigure = false;
6260
public IdStrategy userIdStrategy;
6361
public IdStrategy groupIdStrategy;
@@ -151,11 +149,14 @@ public Builder WithEscapeHatch(
151149
boolean escapeHatchEnabled,
152150
String escapeHatchUsername,
153151
String escapeHatchSecret,
154-
String escapeHatchGroup) {
155-
this.escapeHatchEnabled = escapeHatchEnabled;
156-
this.escapeHatchUsername = escapeHatchUsername;
157-
this.escapeHatchSecret = escapeHatchSecret == null ? null : Secret.fromString(escapeHatchSecret);
158-
this.escapeHatchGroup = escapeHatchGroup;
152+
String escapeHatchGroup)
153+
throws Descriptor.FormException {
154+
if (escapeHatchEnabled) {
155+
this.properties.add(
156+
new EscapeHatch(escapeHatchUsername, escapeHatchGroup, Secret.fromString(escapeHatchSecret)));
157+
} else {
158+
this.properties.removeIf(EscapeHatch.class::isInstance);
159+
}
159160
return this;
160161
}
161162

@@ -234,10 +235,6 @@ public TestRealm(Builder builder) throws Exception {
234235
this.setGroupsFieldName(builder.groupsFieldName);
235236
this.setLogoutFromOpenidProvider(builder.logoutFromOpenidProvider);
236237
this.setPostLogoutRedirectUrl(builder.postLogoutRedirectUrl);
237-
this.setEscapeHatchEnabled(builder.escapeHatchEnabled);
238-
this.setEscapeHatchUsername(builder.escapeHatchUsername);
239-
this.setEscapeHatchSecret(builder.escapeHatchSecret);
240-
this.setEscapeHatchGroup(builder.escapeHatchGroup);
241238
this.setProperties(builder.properties);
242239
// need to call the following method annotated with @PostConstruct and called
243240
// from readResolve and as such
@@ -307,7 +304,8 @@ public void doFinishLogin(StaplerRequest2 request, StaplerResponse2 response) th
307304
/*
308305
* PluginTest uses a hardCoded nonce "nonce"
309306
*/
310-
if (!isNonceDisabled()) {
307+
308+
if (getProperties().get(DisableNonce.class) == null) {
311309
// only hack the nonce if the nonce is enabled
312310
FrameworkParameters parameters = new JEEFrameworkParameters(request, response);
313311
WebContext webContext = JEEContextFactory.INSTANCE.newContext(parameters);
@@ -331,8 +329,4 @@ public String getStringFieldFromJMESPath(Object object, String jmespathField) {
331329
public Object readResolve() throws ObjectStreamException {
332330
return super.readResolve();
333331
}
334-
335-
public boolean doCheckEscapeHatch(String username, String password) {
336-
return super.checkEscapeHatch(username, password);
337-
}
338332
}

‎src/test/java/org/jenkinsci/plugins/oic/properties/EscapeHatchTest.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
package org.jenkinsci.plugins.oic.properties;
22

3+
import static org.junit.jupiter.api.Assertions.assertEquals;
34
import static org.junit.jupiter.api.Assertions.assertFalse;
5+
import static org.junit.jupiter.api.Assertions.assertNotEquals;
46
import static org.junit.jupiter.api.Assertions.assertTrue;
57

8+
import hudson.util.Secret;
69
import jakarta.servlet.FilterChain;
710
import jakarta.servlet.ServletException;
811
import jakarta.servlet.http.HttpServletResponse;
912
import java.io.IOException;
1013
import org.jenkinsci.plugins.oic.MockHttpServletRequest;
1114
import org.junit.jupiter.api.Test;
15+
import org.springframework.security.crypto.bcrypt.BCrypt;
1216

1317
class EscapeHatchTest {
1418
private EscapeHatch.CrumbExclusionImpl crumb = new EscapeHatch.CrumbExclusionImpl();
@@ -47,4 +51,27 @@ void process_WithGoodPath() throws IOException, ServletException {
4751
MockHttpServletRequest request = newRequestWithPath("/securityRealm/escapeHatch");
4852
assertTrue(crumb.process(request, response, chain));
4953
}
54+
55+
@Test
56+
void testShouldCheckEscapeHatchWithPlainPassword() throws Exception {
57+
final String escapeHatchUsername = "aUsername";
58+
final String escapeHatchPassword = "aSecretPassword";
59+
var escapeHatch = new EscapeHatch(escapeHatchUsername, null, Secret.fromString(escapeHatchPassword));
60+
assertEquals(escapeHatchUsername, escapeHatch.getUsername());
61+
assertNotEquals(escapeHatchPassword, Secret.toString(escapeHatch.getSecret()));
62+
assertTrue(escapeHatch.check(escapeHatchUsername, escapeHatchPassword));
63+
assertFalse(escapeHatch.check("otherUsername", escapeHatchPassword));
64+
assertFalse(escapeHatch.check(escapeHatchUsername, "wrongPassword"));
65+
}
66+
67+
@Test
68+
void testShouldCheckEscapeHatchWithHashedPassword() throws Exception {
69+
final String escapeHatchUsername = "aUsername";
70+
final String escapeHatchPassword = "aSecretPassword";
71+
final String escapeHatchCryptedPassword = BCrypt.hashpw(escapeHatchPassword, BCrypt.gensalt());
72+
73+
var escapeHatch = new EscapeHatch(escapeHatchUsername, null, Secret.fromString(escapeHatchCryptedPassword));
74+
assertEquals(escapeHatchUsername, escapeHatch.getUsername());
75+
assertEquals(escapeHatchCryptedPassword, Secret.toString(escapeHatch.getSecret()));
76+
}
5077
}

0 commit comments

Comments
 (0)