/*
 * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

/**
 * @test
 * @bug 8005638
 * @summary  Less secure Authentication schemes should work when more secure
 *           schemes are not available
 */

import com.sun.net.httpserver.*;
import java.io.*;
import java.lang.reflect.Field;
import java.net.*;
import java.util.*;
import java.util.Map.Entry;

public class StrongerAuthNotSupported {

    static final boolean NTLM_SUPPORTED = isNTLMSupported();
    static final boolean NEGOTIATE_SUPPORTED = isNegotiateSupported();

    static boolean isNTLMSupported() {
        // ## check JAVA_PROFILE in "release" file, rather than hacky reflection
        try {
            Class<?> cl = (Class<?>)Class.forName(
                "sun.net.www.protocol.http.NTLMAuthenticationProxy", true, null);
            Field f = cl.getDeclaredField("supported");
            f.setAccessible(true);
            return (boolean)f.get(cl);
        } catch (ReflectiveOperationException x) {
            throw new RuntimeException(x);
        }
    }

    static boolean isNegotiateSupported() {
        // ## check JAVA_PROFILE in "release" file, rather than hacky reflection
        try {
            Class.forName(
                "sun.net.www.protocol.http.spnego.NegotiatorImpl", true, null);
            return true;
        } catch (ClassNotFoundException x) {
           return false;
        }
    }

    static final List<String> schemes = new ArrayList<>();

    static {
        if (!NTLM_SUPPORTED)
            schemes.add("NTLM");
        if (!NEGOTIATE_SUPPORTED) {
            schemes.add("Negotiate");
            schemes.add("Kerberos");
        }
    }

    public static void main(String[] args) throws Exception {
        if (schemes.isEmpty()) {
            System.out.format("%nTest not applicable on JRE's that support "
                              + "secure authentication schemes. NTLM_SUPPORTED: "
                              + "%s, NEGOTIATE_SUPPORTED: %s", NTLM_SUPPORTED,
                              NEGOTIATE_SUPPORTED);
            return;
        }

        HttpServer server = HttpServer.create(new InetSocketAddress(0), 0);
        server.createContext("/test", new AuthHandler());
        server.start();

        try {
            for (String scheme : schemes) {
                System.out.format("%nTESTING WITH %s", scheme);
                int resp;
                java.net.Authenticator.setDefault(new FredAuthenticator());
                URL url = new URL("http://localhost:" + server.getAddress().getPort()
                                  + "/test/foo.html");
                HttpURLConnection urlc = (HttpURLConnection)url.openConnection();
                InputStream is = urlc.getInputStream();
                byte[] ba = new byte[1024];
                while (is.read(ba)!= -1);
                resp = urlc.getResponseCode();

                if (resp != 200)
                    throw new RuntimeException(
                            scheme + "Failed. Expected 200, got: " + resp);
            }
        } finally {
            server.stop(2);
        }
    }

    static class AuthHandler implements HttpHandler {
        private int count;

        @Override
        public void handle(HttpExchange t) throws IOException {
            try {
                try (InputStream is = t.getRequestBody()) {
                    byte[] ba = new byte[1024];
                    while (is.read(ba) != -1) ;
                }

                String authValue = t.getRequestHeaders().getFirst("Authorization");
                if (authValue == null) {
                    // no auth info, request some
                    Headers rmap = t.getResponseHeaders();
                    rmap.add("WWW-Authenticate", schemes.get(count++));
                    rmap.add("WWW-Authenticate", "Basic realm=foobar");
                    t.sendResponseHeaders(401, -1);
                } else {
                    // got auth info, ensure it is basic
                    int sp = authValue.indexOf(' ');
                    if (sp == -1 || !authValue.substring(0, sp).equals("Basic")) {
                        error("Unexpected Authorization header", t);
                        return;
                    }
                    byte[] b =  Base64.getDecoder().decode(authValue.substring(sp+1));
                    String decoded = new String(b);
                    int colon = decoded.indexOf(':');
                    String username = decoded.substring(0, colon);
                    String pass = decoded.substring(colon+1);
                    if (!username.equals("fred")) {
                        error("Expected username 'fred', got: " + username, t);
                        return;
                    }
                    if (!pass.equals("x")) {
                        error("Expected pass 'x', got: " + pass, t);
                        return;
                    }
                    t.sendResponseHeaders(200, -1);
                }
            } finally {
                t.close();
            }
        }

        static void error(String message, HttpExchange t) throws IOException {
            System.err.println(message);
            dumpHeaders(t.getRequestHeaders());
            t.sendResponseHeaders(400, -1);
        }

        static void dumpHeaders(Headers h) {
            for (Entry<String,List<String>> entry : h.entrySet()) {
                System.out.format("%n%s: ", entry.getKey());
                for (String value : entry.getValue())
                    System.out.format("%s ", value);
            }
        }
    }

    private static class FredAuthenticator extends java.net.Authenticator {
        @Override
        public PasswordAuthentication getPasswordAuthentication() {
            return new PasswordAuthentication("fred", "x".toCharArray());
        }
    }
}