Continuous Integration: Testing security by changing authentication credentials. Is it impossible?

[Javier Ruiz Jiménez]

Hi

We are developing an application to administer Subversion repositories, for subversion access we are using svnclientadapter with javahl (because we need to do exports without externals).

In order to provide the credentials to access the repository we use an implementation of ISVNPromptUserPassword as PasswordCallback.

Our ISVNPromptUserPassword implementation returns false in userAllowedSave so the user/password is not cached.

Everything works perfectly for production except that we would like to run some tests during CI to check user authorization against different paths (We launch a svnserv during tests and create some repositories and paths).

The user/password is not cached between different executions of the application, I have checked %APPDATA%/Subversion/auth/svn.simple for cached credentials and credentials are not cached.

Problem:

The user/password is cached in memory during the execution of the test and can't be changed.

We need to be able to change credentials to test with different users.

Something like:

test(){
setUser(admin);
commitToFolder(AdminOnlyFolder)
setUser(reader);
commitToFolder(AdminOnlyFolder) -> expect failure.

}

Is it possible to change the user/password during execution?

Thanks!

------------------------------------------------------
http://subclipse.tigris.org/ds/viewMessage.do?dsForumId=1043&dsMessageId=2768432

To unsubscribe from this discussion, e-mail: [dev-***@subclipse.tigris.org].

[Mark Phippard]

Post by Javier Ruiz Jiménez
The user/password is cached in memory during the execution of the test and can't be changed.
We need to be able to change credentials to test with different users.
test(){
 setUser(admin);
 commitToFolder(AdminOnlyFolder)
 setUser(reader);
 commitToFolder(AdminOnlyFolder) -> expect failure.
}
Is it possible to change the user/password during execution?

The credentials are not cached by svnClientAdapter. I do not think
the Subversion API layer does either, but there might be cases where
it already has a connection open or something.

Couldn't you just change your code so that you are constructing a new
ISVNClientAdapter? That would give you a different JNI object for
each instance. If Subversion does have any kind of in memory cache,
that would deal with it as it would be per object.
--
Thanks

Mark Phippard
http://markphip.blogspot.com/

------------------------------------------------------
http://subclipse.tigris.org/ds/viewMessage.do?dsForumId=1043&dsMessageId=2768450

To unsubscribe from this discussion, e-mail: [dev-***@subclipse.tigris.org].

[Javier Ruiz Jiménez]

Thanks Mark

Your suggestion works as expected. I see that is the same approach used on svnClientAdapter SVNTest class.

Regards,
Javier

------------------------------------------------------
http://subclipse.tigris.org/ds/viewMessage.do?dsForumId=1043&dsMessageId=2768486

To unsubscribe from this discussion, e-mail: [dev-***@subclipse.tigris.org].