org.apache.derbyTesting.functionTests.tests.derbynet

Class NSSecurityMechanismTest

java.lang.Object

junit.framework.Assert

junit.framework.TestCase

org.apache.derbyTesting.junit.BaseTestCase

org.apache.derbyTesting.junit.BaseJDBCTestCase

org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest

All Implemented Interfaces:

junit.framework.Test

public class NSSecurityMechanismTest
extends BaseJDBCTestCase

This class tests the security mechanisms supported by Network Server Network server supports SECMEC_EUSRIDPWD, SECMEC_USRIDPWD, SECMEC_USRIDONL and SECMEC_USRSSBPWD. ----------------------------------------------------------------- Security Mechanism | secmec | User friendly name | codepoint value | ----------------------------------------------------------------- USRIDONL | 0x04 | USER_ONLY_SECURITY USRIDPWD | 0x03 | CLEAR_TEXT_PASSWORD_SECURITY EUSRIDPWD | 0x09 | ENCRYPTED_USER_AND_PASSWORD_SECURITY USRSSBPWD | 0x08 | STRONG_PASSWORD_SUBSTITUTE_SECURITY ----------------------------------------------------------------- Key points: #1) Server and client support encrypted userid/password (EUSRIDPWD) via the use of Diffie Helman key-agreement protocol - but current Open Group DRDA specifications imposes small prime and base generator values (256 bits) that prevents other JCE's to be used as java cryptography providers - typical minimum security requirements is usually of 1024 bits (512-bit absolute minimum) when using DH key-agreement protocol to generate a session key. (Reference: DDM manual, page 281 and 282. Section: Generating the shared private key. DRDA's diffie helman agreed public values for prime are 256 bits. The spec gives the public values for the prime, generator and the size of exponent required for DH . These values must be used as is to generate a shared private key.) Encryption is done using JCE. Hence JCE support of the necessary algorithm is required for a particular security mechanism to work. Thus even though the server and client have code to support EUSRIDPWD, this security mechanism will not work in all JVMs. JVMs where support for DH(32byte prime) is not available and thus EUSRIDPWD won't work are Sun JVM (versions 1.3.1,1.4.1,1.4.2,1.5) and IBM JVM ( versions 1.3.1 and some old versions of 1.4.2 (in 2004)) JVMs where support for DH(32bytes prime) is available and thus EUSRIDPWD will work are IBM JVM [versions 1.4.1, later versions of 1.4.2 (from 2005), 1.5] #2) Note, if server restricts the client connections based on security mechanism by setting derby.drda.securityMechanism, in that case the clients will see an error similar to this: "Connection authorization failure occurred. Reason: security mechanism not supported" #3) USRSSBPWD - Strong password substitute is only supported starting from Apache Derby 10.2. NOTE: USRSSBPWD only works with the derby network client driver for now. ----

Field Summary

Fields

Modifier and Type	Field and Description
private static java.lang.String	derby_drda_securityMechanism
private static java.lang.String[]	derby_drda_securityMechanisms
private static java.lang.String[]	PWD_ATTRIBUTE
private static short[]	SECMEC_ATTRIBUTE
(package private) static short	SECMEC_EUSRIDPWD
(package private) static short	SECMEC_USRENCPWD
(package private) static short	SECMEC_USRIDNWPWD
(package private) static short	SECMEC_USRIDONL
(package private) static short	SECMEC_USRIDPWD
(package private) static short	SECMEC_USRSSBPWD
private static java.lang.String[]	USER_ATTRIBUTE

Fields inherited from class org.apache.derbyTesting.junit.BaseTestCase

DEFAULT_DB_DIR, DERBY_LOG, ERRORSTACKTRACEFILE

Constructor Summary

Constructors

Constructor and Description
NSSecurityMechanismTest(java.lang.String name)

Method Summary

Modifier and Type	Method and Description
private java.util.HashMap<java.lang.String,java.lang.Object>	addRequiredAttributes(java.util.HashMap<java.lang.String,java.lang.Object> attrs)
private void	assertAllCombinationsOfUserPasswordSecMecInputOK(java.lang.String[] expectedValues) Test different interesting combinations of user,password, security mechanism for testing security mechanism upgrade logic.
private void	assertConnectionOK(java.sql.Connection conn) Test a connection by executing a sample query
private void	assertConnectionsUsingDriverManager(java.lang.String[] expectedValues)
private void	assertConnectionUsingDataSource(java.lang.String[] expectedValues) Get connection from datasource and also set security mechanism
private void	assertConnectionUsingDriverManager(java.lang.String dbUrl, java.lang.String msg, java.lang.String expectedValue)
private void	assertDerby1080Fixed(java.lang.String expectedValue) This is a regression test for DERBY-1080 - where some variables required only for the EUSRIDPWD security mechanism case were not getting reset on connection re-use and resulting in protocol error.
private void	assertSecMecWithConnPoolingOK(java.lang.String user, java.lang.String password, java.lang.Short secmec) Test a deferred connection reset.
private void	assertSecurityMechanismOK(java.lang.String user, java.lang.String password, java.lang.Short secmec, java.lang.String msg, java.lang.String expectedValue)
private void	assertSQLState08001(java.lang.String expectedValue, java.sql.SQLException sqle)
private void	assertUSRSSBPWD_with_BUILTIN(java.lang.String[] expectedValues) Test SECMEC_USRSSBPWD with derby BUILTIN authentication turned ON.
private static void	dumpSQLException(java.sql.SQLException sqle) Dump SQLState and message for the complete nested chain of SQLException
private javax.sql.ConnectionPoolDataSource	getCPDS(java.lang.String user, java.lang.String password)
private void	getDataSourceConnection(java.lang.String user, java.lang.String password, java.lang.String expectedValue) Helper method to get connection from datasource and to print the exceptions if any when getting a connection.
private java.sql.Connection	getDataSourceConnectionWithSecMec(java.lang.String user, java.lang.String password, java.lang.Short secMec)
private javax.sql.DataSource	getDS(java.lang.String user, java.lang.String password)
private java.lang.String	getExpectedValueFromAll(java.lang.String[] expectedValues, int USER_ATTR, int PWD_ATTR, int SECMEC_ATTR)
private java.lang.String	getJDBCUrl(java.lang.String attrs)
private boolean	hasSufficientEntropy() Tells if the current platform is assumed to have sufficient entropy for the strong password substitution security mechanism to run reasonably fast.
private boolean	setSecurityMechanism(java.lang.String derby_security_mechanism)
static junit.framework.Test	suite()
protected void	tearDown() Tear down this fixture, sub-classes should call super.tearDown().
void	testNetworkServerSecurityMechanism() Test cases for security mechanism --------------------------------------------------------------- DriverManager: T1 - default , no user PASS (for derbyclient) T2 - user only PASS (for derbyclient) T3 - user,password PASS (only for derbynet) T4 - user,password, security mechanism not set FAIL T5 - user,password, security mechanism set to SECMEC_EUSRIDPWD PASS/FAIL (Fails with Sun JVM as EUSRIDPWD secmec cannot be used) T6 - user, security mechanism set to SECMEC_USRIDONL PASS T7 - user,password, security mechanism set to SECMEC_USRENCPWD FAIL Test with datasource as well as DriverManager T8 - user,password security mechanism set to SECMEC_USRIDONL PASS T9 - user,password security mechanism set to SECMEC_USRSSBPWD PASS Test with datasource as well as DriverManager Note, that with DERBY-928, the pass/fail for the connections will depend on the security mechanism specified at the server by property derby.drda.securityMechanism.
void	testSecurityMechanismOnEmbedded() Test that securityMechanism=8 is ignored by the embedded driver (DERBY-3025).

Methods inherited from class org.apache.derbyTesting.junit.BaseJDBCTestCase

assertCallError, assertCheckTable, assertCommitError, assertCompileError, assertEquals, assertEquals, assertEquals, assertEquivalentDataType, assertErrorCode, assertGetIntError, assertNextError, assertPreparedStatementError, assertResults, assertResults, assertSQLExceptionEquals, assertSQLState, assertSQLState, assertStatementError, assertStatementError, assertStatementError, assertStatementError, assertStatementErrorUnordered, assertTableRowCount, assertUpdateCount, assertUpdateCount, assertWarning, chattyPrepare, chattyPrepareCall, checkAllConsistency, checkEstimatedRowCount, closeStatement, commit, createStatement, createStatement, createStatement, dropTable, dropTable, dropView, dropView, dumpRs, dumpRs, emptyStatementCache, executeQuery, expectCompilationError, expectCompilationError, expectExecutionError, getClientTransactionID, getConnection, getDatabaseProperty, getLastSQLException, goodStatement, goodUpdate, initializeConnection, openConnection, openDefaultConnection, openDefaultConnection, openDefaultConnection, openUserConnection, prepareCall, prepareCall, prepareCall, prepareStatement, prepareStatement, prepareStatement, prepareStatement, prepareStatement, prepareStatement, rollback, runBare, runBareOverridable, runScript, runScript, runSQLCommands, setAutoCommit, usingDB2Client, usingDerbyNetClient, usingEmbedded

Methods inherited from class org.apache.derbyTesting.junit.BaseTestCase

alarm, assertDirectoryDeleted, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertExecJavaCmdAsExpected, assertLaunchedJUnitTestMethod, assertLaunchedJUnitTestMethod, assertSameNullness, assertSecurityManager, assertThrowableEquals, currentDirectory, execJavaCmd, execJavaCmd, execJavaCmd, fail, getClassVersionMajor, getEmmaJar, getFailureFolder, getFilesWith, getJavaExecutableName, getSystemProperty, getTestConfiguration, getTestResource, hasInterruptibleIO, isCVM, isIBMJVM, isJ9Platform, isJava5, isJava7, isPhoneME, isPlatform, isSunJVM, isWindowsPlatform, newAssertionFailedError, openTestResource, println, printStackTrace, readProcessOutput, removeDirectory, removeDirectory, removeFiles, removeSystemProperty, runsWithEmma, runsWithJaCoCo, setSystemErr, setSystemOut, setSystemProperty, sleep, sleepAtLeastOneTick, traceit, vmAtLeast

Methods inherited from class junit.framework.TestCase

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, countTestCases, createResult, fail, fail, failNotEquals, failNotSame, failSame, format, getName, run, run, runTest, setName, setUp, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

derby_drda_securityMechanisms

private static java.lang.String[] derby_drda_securityMechanisms

derby_drda_securityMechanism

private static java.lang.String derby_drda_securityMechanism

USER_ATTRIBUTE

private static java.lang.String[] USER_ATTRIBUTE

PWD_ATTRIBUTE

private static java.lang.String[] PWD_ATTRIBUTE

SECMEC_EUSRIDPWD

static final short SECMEC_EUSRIDPWD

See Also:

Constant Field Values

SECMEC_USRIDONL

static final short SECMEC_USRIDONL

See Also:

Constant Field Values

SECMEC_USRENCPWD

static final short SECMEC_USRENCPWD

See Also:

Constant Field Values

SECMEC_USRIDNWPWD

static final short SECMEC_USRIDNWPWD

See Also:

Constant Field Values

SECMEC_USRIDPWD

static final short SECMEC_USRIDPWD

See Also:

Constant Field Values

SECMEC_USRSSBPWD

static final short SECMEC_USRSSBPWD

See Also:

Constant Field Values

SECMEC_ATTRIBUTE

private static short[] SECMEC_ATTRIBUTE

Constructor Detail

NSSecurityMechanismTest

public NSSecurityMechanismTest(java.lang.String name)

Method Detail

suite

public static junit.framework.Test suite()

tearDown

protected void tearDown()
                 throws java.lang.Exception

Description copied from class: BaseJDBCTestCase

Tear down this fixture, sub-classes should call super.tearDown(). This cleans up and closes the connection if it is open and any statement objects returned through the utility methods.

Overrides:

tearDown in class BaseJDBCTestCase

Throws:

java.lang.Exception

testNetworkServerSecurityMechanism

public void testNetworkServerSecurityMechanism()
                                        throws java.sql.SQLException,
                                               java.lang.Exception

Test cases for security mechanism --------------------------------------------------------------- DriverManager: T1 - default , no user PASS (for derbyclient) T2 - user only PASS (for derbyclient) T3 - user,password PASS (only for derbynet) T4 - user,password, security mechanism not set FAIL T5 - user,password, security mechanism set to SECMEC_EUSRIDPWD PASS/FAIL (Fails with Sun JVM as EUSRIDPWD secmec cannot be used) T6 - user, security mechanism set to SECMEC_USRIDONL PASS T7 - user,password, security mechanism set to SECMEC_USRENCPWD FAIL Test with datasource as well as DriverManager T8 - user,password security mechanism set to SECMEC_USRIDONL PASS T9 - user,password security mechanism set to SECMEC_USRSSBPWD PASS Test with datasource as well as DriverManager Note, that with DERBY-928, the pass/fail for the connections will depend on the security mechanism specified at the server by property derby.drda.securityMechanism. Please check out the following html file http://issues.apache.org/jira/secure/attachment/12322971/Derby928_Table_SecurityMechanisms..htm for a combination of url/security mechanisms and the expected results

Throws:

java.sql.SQLException

java.lang.Exception

testSecurityMechanismOnEmbedded

public void testSecurityMechanismOnEmbedded()
                                     throws java.sql.SQLException

Test that securityMechanism=8 is ignored by the embedded driver (DERBY-3025).

Throws:

java.sql.SQLException

setSecurityMechanism

private boolean setSecurityMechanism(java.lang.String derby_security_mechanism)
                              throws java.lang.Exception

Throws:

java.lang.Exception

assertConnectionsUsingDriverManager

private void assertConnectionsUsingDriverManager(java.lang.String[] expectedValues)

assertConnectionUsingDataSource

private void assertConnectionUsingDataSource(java.lang.String[] expectedValues)

Get connection from datasource and also set security mechanism

assertSecurityMechanismOK

private void assertSecurityMechanismOK(java.lang.String user,
                                       java.lang.String password,
                                       java.lang.Short secmec,
                                       java.lang.String msg,
                                       java.lang.String expectedValue)

assertConnectionUsingDriverManager

private void assertConnectionUsingDriverManager(java.lang.String dbUrl,
                                                java.lang.String msg,
                                                java.lang.String expectedValue)

assertAllCombinationsOfUserPasswordSecMecInputOK

private void assertAllCombinationsOfUserPasswordSecMecInputOK(java.lang.String[] expectedValues)

Test different interesting combinations of user,password, security mechanism for testing security mechanism upgrade logic. This test has been added as part of DERBY-962. Two things have been fixed in DERBY-962, affects only client behavior. 1)Upgrade logic should not override security mechanism if it has been explicitly set in connection request (either via DriverManager or using DataSource) 2)Upgrade security mechanism to a more secure one , ie preferably to encrypted userid and password if the JVM in which the client is running has support for it. Details are: If security mechanism is not specified as part of the connection request, then client will do an automatic switching (upgrade) of security mechanism to use. The logic is as follows : if password is available, and if the JVM in which the client is running supports EUSRIDPWD mechanism, in that case also, USRIDPWD security mechanism is used. if password is available, and if the JVM in which the client is running does not support EUSRIDPWD mechanism, in that case the client will then default to USRIDPWD. Also see DERBY-962 http://issues.apache.org/jira/browse/DERBY-962
To understand which JVMs support EUSRIDPWD or not, please see class level comments (#1)
The expected output from this test will depend on the following -- the client behavior. For the derby client, the table below represents what security mechanism the client will send to server. -- Note: in case of derby client, if no user is specified, user defaults to APP. -- Will depend on if the server has been started with property derby.drda.securityMechanism and to the value it is set to. See method (fixture) testNetworkServerSecurityMechanism() to check if server is using the derby.drda.securityMechanism to restrict client connections based on security mechanism. TABLE with all different combinations of userid, password, security mechanism of derby client that is covered by this testcase if test is run against IBM15 and JDK15. IBM15 supports eusridpwd, whereas SunJDK15 doesnt support EUSRIDPWD Security Mechanisms supported by derby server and client ==================================================================== |SecMec |codepoint value| User friendly name | ==================================================================== |USRIDONL | 0x04 | USER_ONLY_SECURITY | |USRIDPWD | 0x03 | CLEAR_TEXT_PASSWORD_SECURITY | |EUSRIDPWD | 0x09 | ENCRYPTED_USER_AND_PASSWORD_SECURITY| |USRSSBPWD | 0x08 | STRONG_PASSWORD_SUBSTITUTE_SECURITY | ===================================================================== Explanation of columns in table. a) Connection request specifies a user or not. Note: if no user is specified, client defaults to APP b) Connection request specifies a password or not c) Connection request specifies securityMechanism or not. the valid values are 4(USRIDONL), 3(USRIDPWD), 9(EUSRIDPWD) and 8(USRSSBPWD). d) support eusridpwd means whether this client jvm supports encrypted userid/password security mechanism or not. A value of Y means it supports and N means no. The next three columns specify what the client sends to the server e) Does client send user information f) Does client send password information g) What security mechanism value (secmec value) is sent to server. SecMec refers to securityMechanism. Y means yes, N means No, - or blank means not specified. Err stands for error. Err(1) stands for null password not supported Err(2) stands for case when the JCE does not support encrypted userid and password security mechanism. ---------------------------------------------------------------- | url connection | support | Client sends to Server | |User |Pwd |secmec |eusridpwd |User Pwd SecMec | |#a |#b |#c |#d |#e #f #g | |---------------------------------------------------------------| ================================================================= |SecMec not specified on connection request ================================================================= |Y |Y |- |Y |Y Y 3 | |---------------------------------------------------------------- | |Y |- |Y |Y Y 3 | ----------------------------------------------------------------- |Y | |- |Y |Y N 4 | ----------------------------------------------------------------- | | |- |Y |Y N 4 | ================================================================= |Y |Y |- |N |Y Y 3 | |---------------------------------------------------------------- | |Y |- |N |Y Y 3 | ----------------------------------------------------------------- |Y | |- |N |Y N 4 | ----------------------------------------------------------------- | | |- |N |Y N 4 | ================================================================= SecMec specified to 3 (clear text userid and password) ================================================================= |Y |Y |3 |Y |Y Y 3 | |---------------------------------------------------------------- | |Y |3 |Y |Y Y 3 | ----------------------------------------------------------------- |Y | |3 |Y |- - Err1 | ----------------------------------------------------------------- | | |3 |Y |- - Err1 | ================================================================= |Y |Y |3 |N |Y Y 3 | |---------------------------------------------------------------- | |Y |3 |N |Y Y 3 | ----------------------------------------------------------------- |Y | |3 |N |- - Err1 | ----------------------------------------------------------------- | | |3 |N |- - Err1 | ================================================================= SecMec specified to 9 (encrypted userid/password) ================================================================= |Y |Y |9 |Y |Y Y 9 | |---------------------------------------------------------------- | |Y |9 |Y |Y Y 9 | ----------------------------------------------------------------- |Y | |9 |Y | - - Err1 | ----------------------------------------------------------------- | | |9 |Y | - - Err1 | ================================================================= |Y |Y |9 |N | - - Err2 | |---------------------------------------------------------------- | |Y |9 |N | - - Err2 | ----------------------------------------------------------------- |Y | |9 |N | - - Err1 | ----------------------------------------------------------------- | | |9 |N | - - Err1 | ================================================================= SecMec specified to 4 (userid only security) ================================================================= |Y |Y |4 |Y |Y N 4 | |---------------------------------------------------------------- | |Y |4 |Y |Y N 4 | ----------------------------------------------------------------- |Y | |4 |Y |Y N 4 | ----------------------------------------------------------------- | | |4 |Y |Y N 4 | ================================================================= |Y |Y |4 |N |Y N 4 | |---------------------------------------------------------------- | |Y |4 |N |Y N 4 | ----------------------------------------------------------------- |Y | |4 |N |Y N 4 | ----------------------------------------------------------------- | | |4 |N |Y N 4 | ================================================================= SecMec specified to 8 (strong password substitute) ================================================================= |Y |Y |8 |Y |Y Y 8 | |---------------------------------------------------------------- | |Y |8 |Y |Y Y 8 | ----------------------------------------------------------------- |Y | |8 |Y | - - Err1 | ----------------------------------------------------------------- | | |8 |Y | - - Err1 | ================================================================= |Y |Y |8 |N | - Y 8 | |---------------------------------------------------------------- | |Y |8 |N | - Y 8 | ----------------------------------------------------------------- |Y | |8 |N | - - Err1 | ----------------------------------------------------------------- | | |8 |N | - - Err1 | =================================================================

getExpectedValueFromAll

private java.lang.String getExpectedValueFromAll(java.lang.String[] expectedValues,
                                                 int USER_ATTR,
                                                 int PWD_ATTR,
                                                 int SECMEC_ATTR)

getDataSourceConnection

private void getDataSourceConnection(java.lang.String user,
                                     java.lang.String password,
                                     java.lang.String expectedValue)

Helper method to get connection from datasource and to print the exceptions if any when getting a connection. This method is used in assertAllCombinationsOfUserPasswordSecMecInputOK. For explanation of exceptions that might arise in this method, please check assertAllCombinationsOfUserPasswordSecMecInputOK javadoc comment. get connection from datasource

Parameters:

user - username

password - password

expectedValue - expected sql state

dumpSQLException

private static void dumpSQLException(java.sql.SQLException sqle)

Dump SQLState and message for the complete nested chain of SQLException

Parameters:

sqle - SQLException whose complete chain of exceptions is traversed and sqlstate and message is printed out

assertSecMecWithConnPoolingOK

private void assertSecMecWithConnPoolingOK(java.lang.String user,
                                           java.lang.String password,
                                           java.lang.Short secmec)
                                    throws java.lang.Exception

Test a deferred connection reset. When connection pooling is done and connection is reset, the client sends EXCSAT,ACCSEC and followed by SECCHK and ACCRDB. Test if the security mechanism related information is correctly reset or not. This method was added to help simulate regression test for DERBY-1080. It is called from testDerby1080.

Parameters:

user - username

password - password for connection

secmec - security mechanism for datasource

Throws:

java.lang.Exception

assertConnectionOK

private void assertConnectionOK(java.sql.Connection conn)
                         throws java.sql.SQLException

Test a connection by executing a sample query

Parameters:

conn - database connection

Throws:

java.lang.Exception - if there is any error

java.sql.SQLException

assertDerby1080Fixed

private void assertDerby1080Fixed(java.lang.String expectedValue)
                           throws java.lang.Exception

This is a regression test for DERBY-1080 - where some variables required only for the EUSRIDPWD security mechanism case were not getting reset on connection re-use and resulting in protocol error. This also applies to USRSSBPWD security mechanism. Read class level comments (#1) to understand what is specified by drda spec for EUSRIDPWD.
Encryption is done using JCE. Hence JCE support of the necessary algorithm is required for EUSRIDPWD security mechanism to work. Thus even though the server and client have code to support EUSRIDPWD, this security mechanism will not work in all JVMs. JVMs where support for DH(32byte prime) is not available and thus EUSRIDPWD wont work are Sun JVM (versions 1.3.1, 1.4.1, 1.4.2, 1.5) and IBM JVM (versions 1.3.1 and some old versions of 1.4.2 (in 2004) ) Expected behavior for this test: If no regression has occurred, this test should work OK, given the expected exception in following cases: 1) When EUSRIDPWD is not supported in JVM the test is running, a CNFE with initializing EncryptionManager will happen. This will happen for Sun JVM (versions 1.3.1, 1.4.1, 1.4.2, 1.5) and IBM JVM (versions 1.3.1 and some old versions of 1.4.2 (in 2004) ) For derby client, the error message is "Security exception encountered, see next exception for details." 2)If server does not accept EUSRIDPWD security mechanism from clients,then error message will be "Connection authorization failure occurred. Reason: security mechanism not supported" Note: #2 can happen if server is started with derby.drda.securityMechanism and thus restricts what security mechanisms the client can connect with. This will happen for the test run when derby.drda.securityMechanism is set, to a valid value other than ENCRYPTED_USER_AND_PASSWORD_SECURITY.
See testNetworkServerSecurityMechanism where this method is called to test for regression for DERBY-1080, and to check if server is using the derby.drda.securityMechanism to restrict client connections based on the security mechanism.

Throws:

java.lang.Exception

assertUSRSSBPWD_with_BUILTIN

private void assertUSRSSBPWD_with_BUILTIN(java.lang.String[] expectedValues)
                                   throws java.lang.Exception

Test SECMEC_USRSSBPWD with derby BUILTIN authentication turned ON. We want to test a combination of USRSSBPWD with BUILTIN as password substitute is only supported with NONE or BUILTIN Derby authentication scheme right now (DERBY-528). Also, it doesn't work if passwords are hashed with the configurable hash authentication scheme (DERBY-4483) before they are stored in the database, so we'll need to disable that.

Throws:

java.lang.Exception - if there an unexpected error

getDataSourceConnectionWithSecMec

private java.sql.Connection getDataSourceConnectionWithSecMec(java.lang.String user,
                                                              java.lang.String password,
                                                              java.lang.Short secMec)
                                                       throws java.lang.Exception

Throws:

java.lang.Exception

getJDBCUrl

private java.lang.String getJDBCUrl(java.lang.String attrs)

getDS

private javax.sql.DataSource getDS(java.lang.String user,
                                   java.lang.String password)

addRequiredAttributes

private java.util.HashMap<java.lang.String,java.lang.Object> addRequiredAttributes(java.util.HashMap<java.lang.String,java.lang.Object> attrs)

getCPDS

private javax.sql.ConnectionPoolDataSource getCPDS(java.lang.String user,
                                                   java.lang.String password)

assertSQLState08001

private void assertSQLState08001(java.lang.String expectedValue,
                                 java.sql.SQLException sqle)

hasSufficientEntropy

private boolean hasSufficientEntropy()

Tells if the current platform is assumed to have sufficient entropy for the strong password substitution security mechanism to run reasonably fast.