Viacheslav Klimov
5 years ago
18 changed files with 621 additions and 277 deletions
@ -0,0 +1,525 @@ |
|||
/** |
|||
* Copyright © 2016-2022 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.controller; |
|||
|
|||
import org.jboss.aerogear.security.otp.Totp; |
|||
import org.jboss.aerogear.security.otp.api.Base32; |
|||
import org.junit.After; |
|||
import org.junit.Before; |
|||
import org.junit.Test; |
|||
import org.mockito.ArgumentCaptor; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.boot.test.mock.mockito.MockBean; |
|||
import org.springframework.boot.test.mock.mockito.SpyBean; |
|||
import org.springframework.cache.CacheManager; |
|||
import org.springframework.web.util.UriComponents; |
|||
import org.springframework.web.util.UriComponentsBuilder; |
|||
import org.thingsboard.rule.engine.api.SmsService; |
|||
import org.thingsboard.server.common.data.CacheConstants; |
|||
import org.thingsboard.server.common.data.exception.ThingsboardException; |
|||
import org.thingsboard.server.common.data.id.TenantId; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.TwoFactorAuthConfigManager; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.TwoFactorAuthSettings; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.account.SmsTwoFactorAuthAccountConfig; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.account.TotpTwoFactorAuthAccountConfig; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.account.TwoFactorAuthAccountConfig; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.provider.SmsTwoFactorAuthProviderConfig; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.provider.TotpTwoFactorAuthProviderConfig; |
|||
import org.thingsboard.server.service.security.auth.mfa.config.provider.TwoFactorAuthProviderConfig; |
|||
import org.thingsboard.server.service.security.auth.mfa.provider.TwoFactorAuthProviderType; |
|||
import org.thingsboard.server.service.security.auth.mfa.provider.impl.OtpBasedTwoFactorAuthProvider; |
|||
import org.thingsboard.server.service.security.auth.mfa.provider.impl.TotpTwoFactorAuthProvider; |
|||
|
|||
import java.util.Arrays; |
|||
import java.util.Collections; |
|||
import java.util.List; |
|||
import java.util.stream.Collectors; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; |
|||
import static org.mockito.ArgumentMatchers.any; |
|||
import static org.mockito.ArgumentMatchers.argThat; |
|||
import static org.mockito.ArgumentMatchers.eq; |
|||
import static org.mockito.Mockito.verify; |
|||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; |
|||
|
|||
public abstract class TwoFactorAuthConfigTest extends AbstractControllerTest { |
|||
|
|||
@SpyBean |
|||
private TotpTwoFactorAuthProvider totpTwoFactorAuthProvider; |
|||
@MockBean |
|||
private SmsService smsService; |
|||
@Autowired |
|||
private CacheManager cacheManager; |
|||
@Autowired |
|||
private TwoFactorAuthConfigManager twoFactorAuthConfigManager; |
|||
|
|||
@Before |
|||
public void beforeEach() throws Exception { |
|||
loginSysAdmin(); |
|||
} |
|||
|
|||
@After |
|||
public void afterEach() { |
|||
twoFactorAuthConfigManager.deleteTwoFaSettings(TenantId.SYS_TENANT_ID); |
|||
twoFactorAuthConfigManager.deleteTwoFaSettings(tenantId); |
|||
} |
|||
|
|||
|
|||
@Test |
|||
public void testSaveTwoFaSettings() throws Exception { |
|||
loginSysAdmin(); |
|||
testSaveTestTwoFaSettings(); |
|||
|
|||
loginTenantAdmin(); |
|||
testSaveTestTwoFaSettings(); |
|||
} |
|||
|
|||
private void testSaveTestTwoFaSettings() throws Exception { |
|||
TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig = new TotpTwoFactorAuthProviderConfig(); |
|||
totpTwoFaProviderConfig.setIssuerName("tb"); |
|||
SmsTwoFactorAuthProviderConfig smsTwoFaProviderConfig = new SmsTwoFactorAuthProviderConfig(); |
|||
smsTwoFaProviderConfig.setSmsVerificationMessageTemplate("${verificationCode}"); |
|||
smsTwoFaProviderConfig.setVerificationCodeLifetime(60); |
|||
|
|||
TwoFactorAuthSettings twoFaSettings = new TwoFactorAuthSettings(); |
|||
twoFaSettings.setProviders(List.of(totpTwoFaProviderConfig, smsTwoFaProviderConfig)); |
|||
twoFaSettings.setVerificationCodeSendRateLimit("1:60"); |
|||
twoFaSettings.setVerificationCodeCheckRateLimit("3:900"); |
|||
twoFaSettings.setMaxVerificationFailuresBeforeUserLockout(10); |
|||
twoFaSettings.setTotalAllowedTimeForVerification(60); |
|||
|
|||
doPost("/api/2fa/settings", twoFaSettings).andExpect(status().isOk()); |
|||
|
|||
TwoFactorAuthSettings savedTwoFaSettings = readResponse(doGet("/api/2fa/settings").andExpect(status().isOk()), TwoFactorAuthSettings.class); |
|||
|
|||
assertThat(savedTwoFaSettings.getProviders()).hasSize(2); |
|||
assertThat(savedTwoFaSettings.getProviders()).contains(totpTwoFaProviderConfig, smsTwoFaProviderConfig); |
|||
} |
|||
|
|||
@Test |
|||
public void testSaveTwoFaSettings_validationError() throws Exception { |
|||
loginTenantAdmin(); |
|||
|
|||
TwoFactorAuthSettings twoFaSettings = new TwoFactorAuthSettings(); |
|||
twoFaSettings.setProviders(Collections.emptyList()); |
|||
twoFaSettings.setVerificationCodeSendRateLimit("ab:aba"); |
|||
twoFaSettings.setVerificationCodeCheckRateLimit("0:12"); |
|||
twoFaSettings.setMaxVerificationFailuresBeforeUserLockout(-1); |
|||
twoFaSettings.setTotalAllowedTimeForVerification(0); |
|||
|
|||
String errorMessage = getErrorMessage(doPost("/api/2fa/settings", twoFaSettings) |
|||
.andExpect(status().isBadRequest())); |
|||
|
|||
assertThat(errorMessage).contains( |
|||
"verification code send rate limit configuration is invalid", |
|||
"verification code check rate limit configuration is invalid", |
|||
"maximum number of verification failure before user lockout must be positive", |
|||
"total amount of time allotted for verification must be greater than 0" |
|||
); |
|||
|
|||
twoFaSettings.setUseSystemTwoFactorAuthSettings(true); |
|||
doPost("/api/2fa/settings", twoFaSettings) |
|||
.andExpect(status().isOk()); |
|||
|
|||
twoFaSettings.setVerificationCodeSendRateLimit(null); |
|||
twoFaSettings.setVerificationCodeCheckRateLimit(null); |
|||
twoFaSettings.setMaxVerificationFailuresBeforeUserLockout(0); |
|||
twoFaSettings.setTotalAllowedTimeForVerification(null); |
|||
|
|||
doPost("/api/2fa/settings", twoFaSettings) |
|||
.andExpect(status().isOk()); |
|||
} |
|||
|
|||
@Test |
|||
public void testGetTwoFaSettings_useSysadminSettingsAsDefault() throws Exception { |
|||
loginSysAdmin(); |
|||
TwoFactorAuthSettings sysadminTwoFaSettings = new TwoFactorAuthSettings(); |
|||
TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig = new TotpTwoFactorAuthProviderConfig(); |
|||
totpTwoFaProviderConfig.setIssuerName("tb"); |
|||
sysadminTwoFaSettings.setProviders(Collections.singletonList(totpTwoFaProviderConfig)); |
|||
sysadminTwoFaSettings.setMaxVerificationFailuresBeforeUserLockout(25); |
|||
doPost("/api/2fa/settings", sysadminTwoFaSettings).andExpect(status().isOk()); |
|||
|
|||
loginTenantAdmin(); |
|||
TwoFactorAuthSettings tenantTwoFaSettings = new TwoFactorAuthSettings(); |
|||
tenantTwoFaSettings.setUseSystemTwoFactorAuthSettings(true); |
|||
tenantTwoFaSettings.setProviders(Collections.emptyList()); |
|||
doPost("/api/2fa/settings", tenantTwoFaSettings).andExpect(status().isOk()); |
|||
TwoFactorAuthSettings twoFaSettings = readResponse(doGet("/api/2fa/settings").andExpect(status().isOk()), TwoFactorAuthSettings.class); |
|||
assertThat(twoFaSettings).isEqualTo(tenantTwoFaSettings); |
|||
|
|||
doPost("/api/2fa/account/config/generate?providerType=TOTP") |
|||
.andExpect(status().isOk()); |
|||
|
|||
tenantTwoFaSettings.setUseSystemTwoFactorAuthSettings(false); |
|||
tenantTwoFaSettings.setProviders(Collections.emptyList()); |
|||
tenantTwoFaSettings.setMaxVerificationFailuresBeforeUserLockout(10); |
|||
doPost("/api/2fa/settings", tenantTwoFaSettings).andExpect(status().isOk()); |
|||
twoFaSettings = readResponse(doGet("/api/2fa/settings").andExpect(status().isOk()), TwoFactorAuthSettings.class); |
|||
assertThat(twoFaSettings).isEqualTo(tenantTwoFaSettings); |
|||
|
|||
assertThat(getErrorMessage(doPost("/api/2fa/account/config/generate?providerType=TOTP") |
|||
.andExpect(status().isBadRequest()))).containsIgnoringCase("provider is not configured"); |
|||
|
|||
loginSysAdmin(); |
|||
sysadminTwoFaSettings.setProviders(Collections.emptyList()); |
|||
doPost("/api/2fa/settings", sysadminTwoFaSettings).andExpect(status().isOk()); |
|||
loginTenantAdmin(); |
|||
tenantTwoFaSettings.setUseSystemTwoFactorAuthSettings(true); |
|||
tenantTwoFaSettings.setProviders(Collections.singletonList(totpTwoFaProviderConfig)); |
|||
doPost("/api/2fa/settings", tenantTwoFaSettings).andExpect(status().isOk()); |
|||
|
|||
assertThat(getErrorMessage(doPost("/api/2fa/account/config/generate?providerType=TOTP") |
|||
.andExpect(status().isBadRequest()))).containsIgnoringCase("provider is not configured"); |
|||
|
|||
tenantTwoFaSettings.setUseSystemTwoFactorAuthSettings(false); |
|||
doPost("/api/2fa/settings", tenantTwoFaSettings).andExpect(status().isOk()); |
|||
|
|||
doPost("/api/2fa/account/config/generate?providerType=TOTP") |
|||
.andExpect(status().isOk()); |
|||
|
|||
loginSysAdmin(); |
|||
twoFaSettings = readResponse(doGet("/api/2fa/settings").andExpect(status().isOk()), TwoFactorAuthSettings.class); |
|||
assertThat(twoFaSettings).isEqualTo(sysadminTwoFaSettings); |
|||
} |
|||
|
|||
@Test |
|||
public void testSaveTotpTwoFaProviderConfig_validationError() throws Exception { |
|||
TotpTwoFactorAuthProviderConfig invalidTotpTwoFaProviderConfig = new TotpTwoFactorAuthProviderConfig(); |
|||
invalidTotpTwoFaProviderConfig.setIssuerName(" "); |
|||
|
|||
String errorResponse = saveTwoFaSettingsAndGetError(invalidTotpTwoFaProviderConfig); |
|||
assertThat(errorResponse).containsIgnoringCase("issuer name must not be blank"); |
|||
} |
|||
|
|||
@Test |
|||
public void testSaveSmsTwoFaProviderConfig_validationError() throws Exception { |
|||
SmsTwoFactorAuthProviderConfig invalidSmsTwoFaProviderConfig = new SmsTwoFactorAuthProviderConfig(); |
|||
invalidSmsTwoFaProviderConfig.setSmsVerificationMessageTemplate("does not contain verification code"); |
|||
invalidSmsTwoFaProviderConfig.setVerificationCodeLifetime(60); |
|||
|
|||
String errorResponse = saveTwoFaSettingsAndGetError(invalidSmsTwoFaProviderConfig); |
|||
assertThat(errorResponse).containsIgnoringCase("must contain verification code"); |
|||
|
|||
invalidSmsTwoFaProviderConfig.setSmsVerificationMessageTemplate(null); |
|||
invalidSmsTwoFaProviderConfig.setVerificationCodeLifetime(0); |
|||
errorResponse = saveTwoFaSettingsAndGetError(invalidSmsTwoFaProviderConfig); |
|||
assertThat(errorResponse).containsIgnoringCase("verification message template is required"); |
|||
assertThat(errorResponse).containsIgnoringCase("verification code lifetime is required"); |
|||
} |
|||
|
|||
private String saveTwoFaSettingsAndGetError(TwoFactorAuthProviderConfig invalidTwoFaProviderConfig) throws Exception { |
|||
TwoFactorAuthSettings twoFaSettings = new TwoFactorAuthSettings(); |
|||
twoFaSettings.setProviders(Collections.singletonList(invalidTwoFaProviderConfig)); |
|||
|
|||
return getErrorMessage(doPost("/api/2fa/settings", twoFaSettings) |
|||
.andExpect(status().isBadRequest())); |
|||
} |
|||
|
|||
@Test |
|||
public void testSaveTwoFaAccountConfig_providerNotConfigured() throws Exception { |
|||
configureSmsTwoFaProvider("${verificationCode}"); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
TwoFactorAuthProviderType notConfiguredProviderType = TwoFactorAuthProviderType.TOTP; |
|||
String errorMessage = getErrorMessage(doPost("/api/2fa/account/config/generate?providerType=" + notConfiguredProviderType) |
|||
.andExpect(status().isBadRequest())); |
|||
assertThat(errorMessage).containsIgnoringCase("provider is not configured"); |
|||
|
|||
TotpTwoFactorAuthAccountConfig notConfiguredProviderAccountConfig = new TotpTwoFactorAuthAccountConfig(); |
|||
notConfiguredProviderAccountConfig.setAuthUrl("otpauth://totp/aba:aba?issuer=aba&secret=ABA"); |
|||
errorMessage = getErrorMessage(doPost("/api/2fa/account/config/submit", notConfiguredProviderAccountConfig)); |
|||
assertThat(errorMessage).containsIgnoringCase("provider is not configured"); |
|||
} |
|||
|
|||
@Test |
|||
public void testGenerateTotpTwoFaAccountConfig() throws Exception { |
|||
TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig = configureTotpTwoFaProvider(); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
assertThat(readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), String.class)).isNullOrEmpty(); |
|||
generateTotpTwoFaAccountConfig(totpTwoFaProviderConfig); |
|||
} |
|||
|
|||
@Test |
|||
public void testSubmitTotpTwoFaAccountConfig() throws Exception { |
|||
TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig = configureTotpTwoFaProvider(); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
TotpTwoFactorAuthAccountConfig generatedTotpTwoFaAccountConfig = generateTotpTwoFaAccountConfig(totpTwoFaProviderConfig); |
|||
doPost("/api/2fa/account/config/submit", generatedTotpTwoFaAccountConfig).andExpect(status().isOk()); |
|||
verify(totpTwoFactorAuthProvider).prepareVerificationCode(argThat(user -> user.getEmail().equals(TENANT_ADMIN_EMAIL)), |
|||
eq(totpTwoFaProviderConfig), eq(generatedTotpTwoFaAccountConfig)); |
|||
} |
|||
|
|||
@Test |
|||
public void testSubmitTotpTwoFaAccountConfig_validationError() throws Exception { |
|||
configureTotpTwoFaProvider(); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
TotpTwoFactorAuthAccountConfig totpTwoFaAccountConfig = new TotpTwoFactorAuthAccountConfig(); |
|||
totpTwoFaAccountConfig.setAuthUrl(null); |
|||
|
|||
String errorMessage = getErrorMessage(doPost("/api/2fa/account/config/submit", totpTwoFaAccountConfig) |
|||
.andExpect(status().isBadRequest())); |
|||
assertThat(errorMessage).containsIgnoringCase("otp auth url cannot be blank"); |
|||
|
|||
totpTwoFaAccountConfig.setAuthUrl("otpauth://totp/T B: aba"); |
|||
errorMessage = getErrorMessage(doPost("/api/2fa/account/config/submit", totpTwoFaAccountConfig) |
|||
.andExpect(status().isBadRequest())); |
|||
assertThat(errorMessage).containsIgnoringCase("otp auth url is invalid"); |
|||
|
|||
totpTwoFaAccountConfig.setAuthUrl("otpauth://totp/ThingsBoard%20(Tenant):tenant@thingsboard.org?issuer=ThingsBoard+%28Tenant%29&secret=FUNBIM3CXFNNGQR6ZIPVWHP65PPFWDII"); |
|||
doPost("/api/2fa/account/config/submit", totpTwoFaAccountConfig) |
|||
.andExpect(status().isOk()); |
|||
} |
|||
|
|||
@Test |
|||
public void testVerifyAndSaveTotpTwoFaAccountConfig() throws Exception { |
|||
TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig = configureTotpTwoFaProvider(); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
TotpTwoFactorAuthAccountConfig generatedTotpTwoFaAccountConfig = generateTotpTwoFaAccountConfig(totpTwoFaProviderConfig); |
|||
|
|||
String secret = UriComponentsBuilder.fromUriString(generatedTotpTwoFaAccountConfig.getAuthUrl()).build() |
|||
.getQueryParams().getFirst("secret"); |
|||
String correctVerificationCode = new Totp(secret).now(); |
|||
|
|||
doPost("/api/2fa/account/config?verificationCode=" + correctVerificationCode, generatedTotpTwoFaAccountConfig) |
|||
.andExpect(status().isOk()); |
|||
|
|||
TwoFactorAuthAccountConfig twoFaAccountConfig = readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), TwoFactorAuthAccountConfig.class); |
|||
assertThat(twoFaAccountConfig).isEqualTo(generatedTotpTwoFaAccountConfig); |
|||
} |
|||
|
|||
@Test |
|||
public void testVerifyAndSaveTotpTwoFaAccountConfig_incorrectVerificationCode() throws Exception { |
|||
TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig = configureTotpTwoFaProvider(); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
TotpTwoFactorAuthAccountConfig generatedTotpTwoFaAccountConfig = generateTotpTwoFaAccountConfig(totpTwoFaProviderConfig); |
|||
|
|||
String incorrectVerificationCode = "100000"; |
|||
String errorMessage = getErrorMessage(doPost("/api/2fa/account/config?verificationCode=" + incorrectVerificationCode, generatedTotpTwoFaAccountConfig) |
|||
.andExpect(status().isBadRequest())); |
|||
|
|||
assertThat(errorMessage).containsIgnoringCase("verification code is incorrect"); |
|||
} |
|||
|
|||
private TotpTwoFactorAuthAccountConfig generateTotpTwoFaAccountConfig(TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig) throws Exception { |
|||
TwoFactorAuthAccountConfig generatedTwoFaAccountConfig = readResponse(doPost("/api/2fa/account/config/generate?providerType=TOTP") |
|||
.andExpect(status().isOk()), TwoFactorAuthAccountConfig.class); |
|||
assertThat(generatedTwoFaAccountConfig).isInstanceOf(TotpTwoFactorAuthAccountConfig.class); |
|||
|
|||
assertThat(((TotpTwoFactorAuthAccountConfig) generatedTwoFaAccountConfig)).satisfies(accountConfig -> { |
|||
UriComponents otpAuthUrl = UriComponentsBuilder.fromUriString(accountConfig.getAuthUrl()).build(); |
|||
assertThat(otpAuthUrl.getScheme()).isEqualTo("otpauth"); |
|||
assertThat(otpAuthUrl.getHost()).isEqualTo("totp"); |
|||
assertThat(otpAuthUrl.getQueryParams().getFirst("issuer")).isEqualTo(totpTwoFaProviderConfig.getIssuerName()); |
|||
assertThat(otpAuthUrl.getPath()).isEqualTo("/%s:%s", totpTwoFaProviderConfig.getIssuerName(), TENANT_ADMIN_EMAIL); |
|||
assertThat(otpAuthUrl.getQueryParams().getFirst("secret")).satisfies(secretKey -> { |
|||
assertDoesNotThrow(() -> Base32.decode(secretKey)); |
|||
}); |
|||
}); |
|||
return (TotpTwoFactorAuthAccountConfig) generatedTwoFaAccountConfig; |
|||
} |
|||
|
|||
@Test |
|||
public void testGetTwoFaAccountConfig_whenProviderNotConfigured() throws Exception { |
|||
testVerifyAndSaveTotpTwoFaAccountConfig(); |
|||
assertThat(readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), |
|||
TotpTwoFactorAuthAccountConfig.class)).isNotNull(); |
|||
|
|||
loginSysAdmin(); |
|||
|
|||
saveProvidersConfigs(); |
|||
|
|||
assertThat(readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), String.class)) |
|||
.isNullOrEmpty(); |
|||
} |
|||
|
|||
@Test |
|||
public void testGenerateSmsTwoFaAccountConfig() throws Exception { |
|||
configureSmsTwoFaProvider("${verificationCode}"); |
|||
doPost("/api/2fa/account/config/generate?providerType=SMS") |
|||
.andExpect(status().isOk()); |
|||
} |
|||
|
|||
@Test |
|||
public void testSubmitSmsTwoFaAccountConfig() throws Exception { |
|||
String verificationMessageTemplate = "Here is your verification code: ${verificationCode}"; |
|||
configureSmsTwoFaProvider(verificationMessageTemplate); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
SmsTwoFactorAuthAccountConfig smsTwoFaAccountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
smsTwoFaAccountConfig.setPhoneNumber("+38054159785"); |
|||
|
|||
doPost("/api/2fa/account/config/submit", smsTwoFaAccountConfig).andExpect(status().isOk()); |
|||
|
|||
String verificationCode = cacheManager.getCache(CacheConstants.TWO_FA_VERIFICATION_CODES_CACHE) |
|||
.get(tenantAdminUserId, OtpBasedTwoFactorAuthProvider.Otp.class).getValue(); |
|||
|
|||
verify(smsService).sendSms(eq(tenantId), any(), argThat(phoneNumbers -> { |
|||
return phoneNumbers[0].equals(smsTwoFaAccountConfig.getPhoneNumber()); |
|||
}), eq("Here is your verification code: " + verificationCode)); |
|||
} |
|||
|
|||
@Test |
|||
public void testSubmitSmsTwoFaAccountConfig_validationError() throws Exception { |
|||
configureSmsTwoFaProvider("${verificationCode}"); |
|||
|
|||
SmsTwoFactorAuthAccountConfig smsTwoFaAccountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
String blankPhoneNumber = ""; |
|||
smsTwoFaAccountConfig.setPhoneNumber(blankPhoneNumber); |
|||
|
|||
String errorMessage = getErrorMessage(doPost("/api/2fa/account/config/submit", smsTwoFaAccountConfig) |
|||
.andExpect(status().isBadRequest())); |
|||
assertThat(errorMessage).containsIgnoringCase("phone number cannot be blank"); |
|||
|
|||
String nonE164PhoneNumber = "8754868"; |
|||
smsTwoFaAccountConfig.setPhoneNumber(nonE164PhoneNumber); |
|||
|
|||
errorMessage = getErrorMessage(doPost("/api/2fa/account/config/submit", smsTwoFaAccountConfig) |
|||
.andExpect(status().isBadRequest())); |
|||
assertThat(errorMessage).containsIgnoringCase("phone number is not of E.164 format"); |
|||
} |
|||
|
|||
@Test |
|||
public void testVerifyAndSaveSmsTwoFaAccountConfig() throws Exception { |
|||
configureSmsTwoFaProvider("${verificationCode}"); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
SmsTwoFactorAuthAccountConfig smsTwoFaAccountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
smsTwoFaAccountConfig.setPhoneNumber("+38051889445"); |
|||
|
|||
ArgumentCaptor<String> verificationCodeCaptor = ArgumentCaptor.forClass(String.class); |
|||
doPost("/api/2fa/account/config/submit", smsTwoFaAccountConfig).andExpect(status().isOk()); |
|||
|
|||
verify(smsService).sendSms(eq(tenantId), any(), argThat(phoneNumbers -> { |
|||
return phoneNumbers[0].equals(smsTwoFaAccountConfig.getPhoneNumber()); |
|||
}), verificationCodeCaptor.capture()); |
|||
|
|||
String correctVerificationCode = verificationCodeCaptor.getValue(); |
|||
doPost("/api/2fa/account/config?verificationCode=" + correctVerificationCode, smsTwoFaAccountConfig) |
|||
.andExpect(status().isOk()); |
|||
|
|||
TwoFactorAuthAccountConfig accountConfig = readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), TwoFactorAuthAccountConfig.class); |
|||
assertThat(accountConfig).isEqualTo(smsTwoFaAccountConfig); |
|||
} |
|||
|
|||
@Test |
|||
public void testVerifyAndSaveSmsTwoFaAccountConfig_incorrectVerificationCode() throws Exception { |
|||
configureSmsTwoFaProvider("${verificationCode}"); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
SmsTwoFactorAuthAccountConfig smsTwoFaAccountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
smsTwoFaAccountConfig.setPhoneNumber("+38051889445"); |
|||
|
|||
String errorMessage = getErrorMessage(doPost("/api/2fa/account/config?verificationCode=100000", smsTwoFaAccountConfig) |
|||
.andExpect(status().isBadRequest())); |
|||
assertThat(errorMessage).containsIgnoringCase("verification code is incorrect"); |
|||
} |
|||
|
|||
@Test |
|||
public void testVerifyAndSaveSmsTwoFaAccountConfig_differentAccountConfigs() throws Exception { |
|||
configureSmsTwoFaProvider("${verificationCode}"); |
|||
loginTenantAdmin(); |
|||
|
|||
SmsTwoFactorAuthAccountConfig initialSmsTwoFaAccountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
initialSmsTwoFaAccountConfig.setPhoneNumber("+38051889445"); |
|||
|
|||
ArgumentCaptor<String> verificationCodeCaptor = ArgumentCaptor.forClass(String.class); |
|||
doPost("/api/2fa/account/config/submit", initialSmsTwoFaAccountConfig).andExpect(status().isOk()); |
|||
|
|||
verify(smsService).sendSms(eq(tenantId), any(), argThat(phoneNumbers -> { |
|||
return phoneNumbers[0].equals(initialSmsTwoFaAccountConfig.getPhoneNumber()); |
|||
}), verificationCodeCaptor.capture()); |
|||
|
|||
String correctVerificationCode = verificationCodeCaptor.getValue(); |
|||
|
|||
SmsTwoFactorAuthAccountConfig anotherSmsTwoFaAccountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
anotherSmsTwoFaAccountConfig.setPhoneNumber("+38111111111"); |
|||
String errorMessage = getErrorMessage(doPost("/api/2fa/account/config?verificationCode=" + correctVerificationCode, anotherSmsTwoFaAccountConfig) |
|||
.andExpect(status().isBadRequest())); |
|||
assertThat(errorMessage).containsIgnoringCase("verification code is incorrect"); |
|||
|
|||
doPost("/api/2fa/account/config?verificationCode=" + correctVerificationCode, initialSmsTwoFaAccountConfig) |
|||
.andExpect(status().isOk()); |
|||
TwoFactorAuthAccountConfig accountConfig = readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), TwoFactorAuthAccountConfig.class); |
|||
assertThat(accountConfig).isEqualTo(initialSmsTwoFaAccountConfig); |
|||
} |
|||
|
|||
private TotpTwoFactorAuthProviderConfig configureTotpTwoFaProvider() throws Exception { |
|||
TotpTwoFactorAuthProviderConfig totpTwoFaProviderConfig = new TotpTwoFactorAuthProviderConfig(); |
|||
totpTwoFaProviderConfig.setIssuerName("tb"); |
|||
|
|||
saveProvidersConfigs(totpTwoFaProviderConfig); |
|||
return totpTwoFaProviderConfig; |
|||
} |
|||
|
|||
private SmsTwoFactorAuthProviderConfig configureSmsTwoFaProvider(String verificationMessageTemplate) throws Exception { |
|||
SmsTwoFactorAuthProviderConfig smsTwoFaProviderConfig = new SmsTwoFactorAuthProviderConfig(); |
|||
smsTwoFaProviderConfig.setSmsVerificationMessageTemplate(verificationMessageTemplate); |
|||
smsTwoFaProviderConfig.setVerificationCodeLifetime(60); |
|||
|
|||
saveProvidersConfigs(smsTwoFaProviderConfig); |
|||
return smsTwoFaProviderConfig; |
|||
} |
|||
|
|||
private void saveProvidersConfigs(TwoFactorAuthProviderConfig... providerConfigs) throws Exception { |
|||
TwoFactorAuthSettings twoFaSettings = new TwoFactorAuthSettings(); |
|||
|
|||
twoFaSettings.setProviders(Arrays.stream(providerConfigs).collect(Collectors.toList())); |
|||
doPost("/api/2fa/settings", twoFaSettings).andExpect(status().isOk()); |
|||
} |
|||
|
|||
@Test |
|||
public void testIsTwoFaEnabled() throws ThingsboardException { |
|||
SmsTwoFactorAuthAccountConfig accountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
accountConfig.setPhoneNumber("+380505050"); |
|||
twoFactorAuthConfigManager.saveTwoFaAccountConfig(tenantId, tenantAdminUserId, accountConfig); |
|||
|
|||
assertThat(twoFactorAuthConfigManager.isTwoFaEnabled(tenantId, tenantAdminUserId)).isTrue(); |
|||
} |
|||
|
|||
@Test |
|||
public void testDeleteTwoFaAccountConfig() throws Exception { |
|||
SmsTwoFactorAuthAccountConfig accountConfig = new SmsTwoFactorAuthAccountConfig(); |
|||
accountConfig.setPhoneNumber("+380505050"); |
|||
twoFactorAuthConfigManager.saveTwoFaAccountConfig(tenantId, tenantAdminUserId, accountConfig); |
|||
|
|||
loginTenantAdmin(); |
|||
|
|||
TwoFactorAuthAccountConfig savedAccountConfig = readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), TwoFactorAuthAccountConfig.class); |
|||
assertThat(savedAccountConfig).isEqualTo(accountConfig); |
|||
|
|||
doDelete("/api/2fa/account/config").andExpect(status().isOk()); |
|||
|
|||
assertThat(readResponse(doGet("/api/2fa/account/config").andExpect(status().isOk()), String.class)) |
|||
.isNullOrEmpty(); |
|||
} |
|||
|
|||
} |
|||
@ -0,0 +1,23 @@ |
|||
/** |
|||
* Copyright © 2016-2022 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.controller.sql; |
|||
|
|||
import org.thingsboard.server.dao.service.DaoSqlTest; |
|||
import org.thingsboard.server.controller.TwoFactorAuthConfigTest; |
|||
|
|||
@DaoSqlTest |
|||
public class TwoFactorAuthConfigSqlTest extends TwoFactorAuthConfigTest { |
|||
} |
|||
Loading…
Reference in new issue