[cpp-sp] branch main updated: More tests, fix a throw instruction.
Scott Cantor
cantor.2 at osu.edu
Thu Dec 19 16:00:11 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=6ba656149523ab3523075c52d2aa383035da0ed3
The following commit(s) were added to refs/heads/main by this push:
new 6ba65614 More tests, fix a throw instruction.
6ba65614 is described below
commit 6ba656149523ab3523075c52d2aa383035da0ed3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 19 11:00:06 2024 -0500
More tests, fix a throw instruction.
---
shibsp/impl/XMLAccessControl.cpp | 2 +-
tests/data/impl/and-acl.xml | 6 +++
tests/data/impl/external-and-acl.xml | 1 +
tests/data/impl/external-not-acl.xml | 1 +
tests/data/impl/inline-not-multiple-acl.xml | 8 ++++
tests/data/impl/not-acl.xml | 5 ++
tests/impl/XMLAccessControlTests.cpp | 72 +++++++++++++++++++++++++++++
7 files changed, 94 insertions(+), 1 deletion(-)
diff --git a/shibsp/impl/XMLAccessControl.cpp b/shibsp/impl/XMLAccessControl.cpp
index b168466a..a0ab5dc9 100644
--- a/shibsp/impl/XMLAccessControl.cpp
+++ b/shibsp/impl/XMLAccessControl.cpp
@@ -323,7 +323,7 @@ Operator::Operator(const string& name, const ptree& pt)
}
if (m_op == OP_NOT && m_operands.size() != 1) {
- throw new ConfigurationException("NOT operator contained more than one child");
+ throw ConfigurationException("NOT operator contained more than one child");
}
}
diff --git a/tests/data/impl/and-acl.xml b/tests/data/impl/and-acl.xml
new file mode 100644
index 00000000..d12fb8e7
--- /dev/null
+++ b/tests/data/impl/and-acl.xml
@@ -0,0 +1,6 @@
+<AccessControl>
+ <AND>
+ <Rule require="user">jdoe</Rule>
+ <Rule require="affiliation">student</Rule>
+ </AND>
+</AccessControl>
diff --git a/tests/data/impl/external-and-acl.xml b/tests/data/impl/external-and-acl.xml
new file mode 100644
index 00000000..93433b49
--- /dev/null
+++ b/tests/data/impl/external-and-acl.xml
@@ -0,0 +1 @@
+<AccessControlProvider type="XML" path="./data/impl/and-acl.xml" reloadChanges="1" />
diff --git a/tests/data/impl/external-not-acl.xml b/tests/data/impl/external-not-acl.xml
new file mode 100644
index 00000000..94726a21
--- /dev/null
+++ b/tests/data/impl/external-not-acl.xml
@@ -0,0 +1 @@
+<AccessControlProvider type="XML" path="./data/impl/not-acl.xml" reloadChanges="1" />
diff --git a/tests/data/impl/inline-not-multiple-acl.xml b/tests/data/impl/inline-not-multiple-acl.xml
new file mode 100644
index 00000000..29e04464
--- /dev/null
+++ b/tests/data/impl/inline-not-multiple-acl.xml
@@ -0,0 +1,8 @@
+<AccessControlProvider type="XML">
+ <AccessControl>
+ <NOT>
+ <Rule require="authnContextClassRef">urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</Rule>
+ <Rule require="valid-user" />
+ </NOT>
+ </AccessControl>
+</AccessControlProvider>
diff --git a/tests/data/impl/not-acl.xml b/tests/data/impl/not-acl.xml
new file mode 100644
index 00000000..caf3416e
--- /dev/null
+++ b/tests/data/impl/not-acl.xml
@@ -0,0 +1,5 @@
+<AccessControl>
+ <NOT>
+ <Rule require="affiliation">student</Rule>
+ </NOT>
+</AccessControl>
diff --git a/tests/impl/XMLAccessControlTests.cpp b/tests/impl/XMLAccessControlTests.cpp
index 83d00902..c3bf6a69 100644
--- a/tests/impl/XMLAccessControlTests.cpp
+++ b/tests/impl/XMLAccessControlTests.cpp
@@ -196,6 +196,21 @@ BOOST_FIXTURE_TEST_CASE(XMLAccessControl_inline_invalid_internal, XMLAccessContr
ConfigurationException, checker.check_message);
}
+/////////////
+// Inline ACL test for NOT operator with 2 rules.
+/////////////
+
+BOOST_FIXTURE_TEST_CASE(XMLAccessControl_inline_NOT_multiple, XMLAccessControlFixture)
+{
+ parse("inline-not-multiple-acl.xml");
+ BOOST_CHECK_EQUAL(tree.size(), 1);
+
+ exceptionCheck checker("Initial AccessControl configuration was invalid.");
+ BOOST_CHECK_EXCEPTION(AgentConfig::getConfig().AccessControlManager.newPlugin(
+ tree.front().second.get<string>("<xmlattr>.type").c_str(), tree.front().second, true),
+ ConfigurationException, checker.check_message);
+}
+
/////////////
// Inline ACL test for valid-user rule.
/////////////
@@ -334,4 +349,61 @@ BOOST_FIXTURE_TEST_CASE(XMLAccessControl_external_OR, XMLAccessControlFixture)
BOOST_CHECK_EQUAL(acl->authorized(request, &session), AccessControl::shib_acl_true);
}
+/////////////
+// External ACL test for AND operator
+/////////////
+
+BOOST_FIXTURE_TEST_CASE(XMLAccessControl_external_AND, XMLAccessControlFixture)
+{
+ parse("external-and-acl.xml");
+ BOOST_CHECK_EQUAL(tree.size(), 1);
+
+ unique_ptr<AccessControl> acl(AgentConfig::getConfig().AccessControlManager.newPlugin(
+ tree.front().second.get<string>("<xmlattr>.type").c_str(), tree.front().second, true));
+
+#ifdef HAVE_CXX14
+ shared_lock locker(*acl);
+#endif
+
+ DummyRequest request;
+ DummySession session;
+
+ session.m_attributes.push_back(unique_ptr<Attribute>(new SimpleAttribute({"affiliation"})));
+ SimpleAttribute& attr = dynamic_cast<SimpleAttribute&>(*(session.m_attributes.back()));
+
+ request.m_user = "jdoe";
+ BOOST_CHECK_EQUAL(acl->authorized(request, &session), AccessControl::shib_acl_false);
+
+ attr.getValues().push_back("student");
+ BOOST_CHECK_EQUAL(acl->authorized(request, &session), AccessControl::shib_acl_true);
+}
+
+/////////////
+// External ACL test for NOT operator
+/////////////
+
+BOOST_FIXTURE_TEST_CASE(XMLAccessControl_external_NOT, XMLAccessControlFixture)
+{
+ parse("external-not-acl.xml");
+ BOOST_CHECK_EQUAL(tree.size(), 1);
+
+ unique_ptr<AccessControl> acl(AgentConfig::getConfig().AccessControlManager.newPlugin(
+ tree.front().second.get<string>("<xmlattr>.type").c_str(), tree.front().second, true));
+
+#ifdef HAVE_CXX14
+ shared_lock locker(*acl);
+#endif
+
+ DummyRequest request;
+ DummySession session;
+
+ session.m_attributes.push_back(unique_ptr<Attribute>(new SimpleAttribute({"affiliation"})));
+ SimpleAttribute& attr = dynamic_cast<SimpleAttribute&>(*(session.m_attributes.back()));
+
+ BOOST_CHECK_EQUAL(acl->authorized(request, &session), AccessControl::shib_acl_true);
+
+ attr.getValues().push_back("student");
+ BOOST_CHECK_EQUAL(acl->authorized(request, &session), AccessControl::shib_acl_false);
+}
+
};
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list