Fix authentication security hole with external providers

James Moger

2014-03-18 b4a63aad7f56486c164a15ae2477bcd251b0bb1b

 src/test/java/com/gitblit/tests/RedmineAuthenticationTest.java

@@ -8,6 +8,7 @@

import com.gitblit.IStoredSettings;
import com.gitblit.auth.RedmineAuthProvider;
import com.gitblit.manager.AuthenticationManager;
import com.gitblit.manager.RuntimeManager;
import com.gitblit.manager.UserManager;
import com.gitblit.models.UserModel;
@@ -18,10 +19,6 @@
    private static final String JSON = "{\"user\":{\"created_on\":\"2011-03-28T00:41:29Z\",\"lastname\":\"foo\","
        + "\"last_login_on\":\"2012-09-06T23:59:26Z\",\"firstname\":\"baz\","
        + "\"id\":4,\"login\":\"RedmineUserId\",\"mail\":\"baz@example.com\"}}";

    private static final String NOT_ADMIN_JSON = "{\"user\":{\"lastname\":\"foo\","
        + "\"last_login_on\":\"2012-09-08T13:59:01Z\",\"created_on\":\"2009-03-17T14:25:50Z\","
        + "\"mail\":\"baz@example.com\",\"id\":5,\"firstname\":\"baz\"}}";

    MemorySettings getSettings() {
       return new MemorySettings(new HashMap<String, Object>());
@@ -38,6 +35,17 @@
    RedmineAuthProvider newRedmineAuthentication() {
       return newRedmineAuthentication(getSettings());
    }
    
    AuthenticationManager newAuthenticationManager() {
       RuntimeManager runtime = new RuntimeManager(getSettings(), GitBlitSuite.BASEFOLDER).start();
       UserManager users = new UserManager(runtime).start();
       RedmineAuthProvider redmine = new RedmineAuthProvider();
       redmine.setup(runtime, users);
        redmine.setTestingCurrentUserAsJson(JSON);
       AuthenticationManager auth = new AuthenticationManager(runtime, users);
       auth.addAuthenticationProvider(redmine);
       return auth;
    }

    @Test
    public void testAuthenticate() throws Exception {
@@ -48,18 +56,15 @@
        assertThat(userModel.getDisplayName(), is("baz foo"));
        assertThat(userModel.emailAddress, is("baz@example.com"));
        assertNotNull(userModel.cookie);
        assertThat(userModel.canAdmin, is(true));
    }

    @Test
    public void testAuthenticateNotAdminUser() throws Exception {
       RedmineAuthProvider redmine = newRedmineAuthentication();
        redmine.setTestingCurrentUserAsJson(NOT_ADMIN_JSON);
        UserModel userModel = redmine.authenticate("RedmineUserId", "RedmineAPIKey".toCharArray());
        assertThat(userModel.getName(), is("redmineuserid"));
    public void testAuthenticationManager() throws Exception {
       AuthenticationManager auth = newAuthenticationManager();
        UserModel userModel = auth.authenticate("RedmineAdminId", "RedmineAPIKey".toCharArray());
        assertThat(userModel.getName(), is("redmineadminid"));
        assertThat(userModel.getDisplayName(), is("baz foo"));
        assertThat(userModel.emailAddress, is("baz@example.com"));
        assertNotNull(userModel.cookie);
        assertThat(userModel.canAdmin, is(false));
    }
}