Imported Upstream version 3.6.0

Former-commit-id: da6be194a6b1221998fc28233f2503bd61dd9d14

external/aspnetwebstack/test/System.Web.Http.Integration.Test/Authentication/BasicOverHttpTest.cs

@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. See License.txt in the project root for license information.
+
+using System.Net;
+using System.Net.Http;
+using System.Web.Http.SelfHost;
+using Xunit;
+
+namespace System.Web.Http
+{
+    public class BasicOverHttpTest
+    {
+        private static readonly string BaseAddress = "http://localhost:8080";
+
+        [Fact]
+        public void AuthenticateWithUsernameTokenSucceed()
+        {
+            RunBasicAuthTest("Sample", "", new NetworkCredential("username", "password"),
+                (response) => Assert.Equal(HttpStatusCode.OK, response.StatusCode)
+                );
+        }
+
+        [Fact]
+        public void AuthenticateWithWrongPasswordFail()
+        {
+            RunBasicAuthTest("Sample", "", new NetworkCredential("username", "wrong password"),
+                (response) => Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode)
+                );
+        }
+
+        [Fact]
+        public void AuthenticateWithNoCredentialFail()
+        {
+            RunBasicAuthTest("Sample", "", null,
+                (response) => Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode)
+                );
+        }
+
+        private static void RunBasicAuthTest(string controllerName, string routeSuffix, NetworkCredential credential, Action<HttpResponseMessage> assert)
+        {
+            // Arrange
+            HttpSelfHostConfiguration config = new HttpSelfHostConfiguration(BaseAddress);
+            config.Routes.MapHttpRoute("Default", "{controller}" + routeSuffix, new { controller = controllerName });
+            config.UserNamePasswordValidator = new CustomUsernamePasswordValidator();
+            config.MessageHandlers.Add(new CustomMessageHandler());
+            HttpSelfHostServer server = new HttpSelfHostServer(config);
+
+            server.OpenAsync().Wait();
+
+            // Create a GET request with correct username and password
+            HttpClientHandler handler = new HttpClientHandler();
+            handler.Credentials = credential;
+            HttpClient client = new HttpClient(handler);
+
+            HttpResponseMessage response = null;
+            try
+            {
+                // Act
+                response = client.GetAsync(BaseAddress).Result;
+
+                // Assert
+                assert(response);
+            }
+            finally
+            {
+                if (response != null)
+                {
+                    response.Dispose();
+                }
+                client.Dispose();
+            }
+
+            server.CloseAsync().Wait();
+        }
+
+    }
+}

external/aspnetwebstack/test/System.Web.Http.Integration.Test/Authentication/CustomMessageHandler.cs

@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. See License.txt in the project root for license information.
+
+using System.Net.Http;
+using System.Security.Principal;
+using System.ServiceModel;
+using System.ServiceModel.Security;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Web.Http.SelfHost;
+
+namespace System.Web.Http
+{
+    public class CustomMessageHandler : DelegatingHandler
+    {
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            IPrincipal originalPrincipal = Thread.CurrentPrincipal;
+
+            // here you can see the requestor's identity via the request message
+            // convert the Generic Identity to some IPrincipal object, and set it in the request's property
+            // later the authorization filter will use the role information to authorize request.
+            SecurityMessageProperty property = request.GetSecurityMessageProperty();
+            if (property != null)
+            {
+                ServiceSecurityContext context = property.ServiceSecurityContext;
+
+                if (context.PrimaryIdentity.Name == "username")
+                {
+                    Thread.CurrentPrincipal = new GenericPrincipal(context.PrimaryIdentity, new string[] { "Administrators" });
+                }
+            }
+
+            return base.SendAsync(request, cancellationToken)
+                       .Finally(() => Thread.CurrentPrincipal = originalPrincipal);
+        }
+    }
+}

external/aspnetwebstack/test/System.Web.Http.Integration.Test/Authentication/CustomUsernamePasswordValidator.cs

@@ -0,0 +1,21 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. See License.txt in the project root for license information.
+
+using System.IdentityModel.Selectors;
+
+namespace System.Web.Http
+{
+    public class CustomUsernamePasswordValidator : UserNamePasswordValidator
+    {
+        public override void Validate(string userName, string password)
+        {
+            if (userName == "username" && password == "password")
+            {
+                return;
+            }
+            else
+            {
+                throw new InvalidOperationException();
+            }
+        }
+    }
+}

external/aspnetwebstack/test/System.Web.Http.Integration.Test/Authentication/RequireAdminAttribute.cs

@@ -0,0 +1,24 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. See License.txt in the project root for license information.
+
+using System.Net;
+using System.Net.Http;
+using System.Security.Principal;
+using System.Threading;
+using System.Web.Http.Controllers;
+using System.Web.Http.Filters;
+
+namespace System.Web.Http
+{
+    public class RequireAdminAttribute : AuthorizationFilterAttribute
+    {
+        public override void OnAuthorization(HttpActionContext context)
+        {
+            // do authorization based on the principle.
+            IPrincipal principal = Thread.CurrentPrincipal;
+            if (principal == null || !principal.IsInRole("Administrators"))
+            {
+                context.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
+            }
+        }
+    }
+}

external/aspnetwebstack/test/System.Web.Http.Integration.Test/Authentication/SampleController.cs

@@ -0,0 +1,16 @@
+// Copyright (c) Microsoft Corporation. All rights reserved. See License.txt in the project root for license information.
+
+namespace System.Web.Http
+{
+    /// <summary>
+    /// Sample ApiControler
+    /// </summary>
+    public class SampleController : ApiController
+    {
+        [RequireAdmin]
+        public string Get()
+        {
+            return "hello";
+        }
+    }
+}