small changes to creds/gid

[sfa.git] / tests / testCred.py

diff --git a/tests/testCred.py b/tests/testCred.py
index b148bb2..32fac4a 100755 (executable)
--- a/tests/testCred.py
+++ b/tests/testCred.py
@@ -52,6 +52,7 @@ class TestCred(unittest.TestCase):
       self.assertEqual(cred2.get_privileges().save_to_string(), rights)
 
 
+
    def createSignedGID(self, subject, urn, issuer_pkey = None, issuer_gid = None):
       gid = GID(subject=subject, uuid=1, urn=urn)
       keys = Keypair(create=True)
@@ -64,16 +65,19 @@ class TestCred(unittest.TestCase):
       gid.encode()
       gid.sign()
       return gid, keys
+
+   
    
-   def testDelegation(self):
+
+   def testDelegationAndVerification(self):
       gidAuthority, keys = self.createSignedGID("site", "urn:publicid:IDN+plc+authority+site")
-      gidCaller, ckeys = self.createSignedGID("foo", "urn:publicid:IDN+plc:site+user+foo",
+      gidCaller, ckeys = self.createSignedGID("site.foo", "urn:publicid:IDN+plc:site+user+foo",
                                           keys, gidAuthority)
-      gidObject, _ = self.createSignedGID("bar_slice", "urn:publicid:IDN+plc:site+slice+bar_slice",
+      gidObject, _ = self.createSignedGID("site.slice", "urn:publicid:IDN+plc:site+slice+bar_slice",
                                           keys, gidAuthority)
-      gidDelegatee, _ = self.createSignedGID("delegatee", "urn:publicid:IDN+plc:site+user+delegatee",
+      gidDelegatee, _ = self.createSignedGID("site.delegatee", "urn:publicid:IDN+plc:site+user+delegatee",
                                              keys, gidAuthority)
-      
+
       cred = Credential()
       cred.set_gid_caller(gidCaller)
       cred.set_gid_object(gidObject)
@@ -86,12 +90,14 @@ class TestCred(unittest.TestCase):
       cred.set_issuer_keys("/tmp/auth_key", "/tmp/auth_gid")
       cred.sign()
 
+
       cred.verify(['/tmp/auth_gid'])
 
       # Test copying
       cred2 = Credential(string=cred.save_to_string())
       cred2.verify(['/tmp/auth_gid'])
 
+
       # Test delegation
       delegated = Credential()
       delegated.set_gid_caller(gidDelegatee)
@@ -105,21 +111,63 @@ class TestCred(unittest.TestCase):
       delegated.set_issuer_keys("/tmp/caller_pkey", "/tmp/caller_gid")
 
       delegated.encode()
+
       delegated.sign()
       
       # This should verify
       delegated.verify(['/tmp/auth_gid'])
-      delegated.save_to_file("/tmp/dcred")
 
+      backup = Credential(string=delegated.get_xml())
 
       # Test that verify catches an incorrect lifetime      
       delegated.set_lifetime(6000)
+      delegated.encode()
+      delegated.sign()
+      try:
+         delegated.verify(['/tmp/auth_gid'])
+         assert(1==0)
+      except CredentialNotVerifiable:
+         pass
+
+      # Test that verify catches an incorrect signer
+      delegated = Credential(string=backup.get_xml())
+      delegated.set_issuer_keys("/tmp/auth_key", "/tmp/auth_gid")
+      delegated.encode()
+      delegated.sign()
+
+      try:
+         delegated.verify(['/tmp/auth_gid'])
+         assert(1==0)
+      except CredentialNotVerifiable:
+         pass
+
 
-      WHY IS THIS CRASHING??  
+      # Test that verify catches a changed gid
+      delegated = Credential(string=backup.get_xml())
+      delegated.set_gid_object(delegated.get_gid_caller())
       delegated.encode()
       delegated.sign()
-      delegated.verify(['/tmp/auth_gid'])
+
+      try:
+         delegated.verify(['/tmp/auth_gid'])
+         assert(1==0)
+      except CredentialNotVerifiable:
+         pass
+
+
+      # Test that verify catches a credential with the wrong authority for the object
+      test = Credential(string=cred.get_xml())
+      test.set_issuer_keys("/tmp/caller_pkey", "/tmp/caller_gid")
+      test.encode()
+      test.sign()
+
+      try:
+         test.verify(['/tmp/auth_gid'])
+         assert(1==0)
+      except CredentialNotVerifiable:
+         pass      
       
+      # Test that * gets translated properly
 
 if __name__ == "__main__":
     unittest.main()