Source code

001/**
002 * Copyright 2015 DuraSpace, Inc.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 *     http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 */
016package org.fcrepo.integration.auth.webac;
017
018import static javax.ws.rs.core.Response.Status.CREATED;
019
020import static org.junit.Assert.assertEquals;
021import static org.junit.Assert.assertTrue;
022import static org.fcrepo.auth.webac.URIConstants.WEBAC_ACCESS_CONTROL_VALUE;
023import static org.fcrepo.auth.webac.WebACRolesProvider.ROOT_AUTHORIZATION_PROPERTY;
024import static org.fcrepo.kernel.api.RdfLexicon.DC_NAMESPACE;
025import java.io.IOException;
026import java.io.InputStream;
027import java.util.Arrays;
028import java.util.Optional;
029
030import javax.ws.rs.core.Link;
031
032import org.fcrepo.integration.http.api.AbstractResourceIT;
033
034import org.apache.commons.codec.binary.Base64;
035import org.apache.http.HttpResponse;
036import org.apache.http.HttpStatus;
037import org.apache.http.client.methods.CloseableHttpResponse;
038import org.apache.http.client.methods.HttpGet;
039import org.apache.http.client.methods.HttpPatch;
040import org.apache.http.client.methods.HttpPost;
041import org.apache.http.client.methods.HttpPut;
042import org.apache.http.message.AbstractHttpMessage;
043import org.apache.http.Header;
044import org.apache.http.entity.InputStreamEntity;
045import org.apache.http.entity.StringEntity;
046import org.junit.Ignore;
047import org.junit.Test;
048import org.slf4j.Logger;
049import org.slf4j.LoggerFactory;
050
051/**
052 * @author Peter Eichman
053 * @author whikloj
054 * @since September 4, 2015
055 */
056public class WebACRecipesIT extends AbstractResourceIT {
057
058    private static final Logger logger = LoggerFactory.getLogger(WebACRecipesIT.class);
059
060    private static final String DC_TITLE = DC_NAMESPACE + "title";
061
062    /**
063     * Convenience method to create an ACL with 0 or more authorization resources in the respository.
064     */
065    private String ingestAcl(final String username, final String aclResourcePath,
066            final String... authorizationResourcePaths) throws IOException {
067
068        // create the ACL
069        final HttpResponse aclResponse = ingestTurtleResource(username, aclResourcePath, "/rest");
070
071        // get the URI to the newly created resource
072        final String aclURI = aclResponse.getFirstHeader("Location").getValue();
073
074        // add all the authorizations
075        for (final String authorizationResourcePath : authorizationResourcePaths) {
076            ingestTurtleResource(username, authorizationResourcePath, aclURI.replace(serverAddress, ""));
077        }
078
079        return aclURI;
080    }
081
082    /**
083     * Convenience method to POST the contents of a Turtle file to the repository to create a new resource. Returns
084     * the HTTP response from that request. Throws an IOException if the server responds with anything other than a
085     * 201 Created response code.
086     */
087    private HttpResponse ingestTurtleResource(final String username, final String path, final String requestURI)
088            throws IOException {
089        final HttpPost request = postObjMethod(requestURI);
090
091        logger.debug("POST to {} to create {}", requestURI, path);
092
093        setAuth(request, username);
094
095        final InputStream file = this.getClass().getResourceAsStream(path);
096        final InputStreamEntity fileEntity = new InputStreamEntity(file);
097        request.setEntity(fileEntity);
098        request.setHeader("Content-Type", "text/turtle;charset=UTF-8");
099
100        try (final CloseableHttpResponse response = execute(request)) {
101            assertEquals("Didn't get a CREATED response!", CREATED.getStatusCode(), getStatus(response));
102            return response;
103        }
104
105    }
106
107    /**
108     * Convenience method to set up a regular FedoraResource
109     *
110     * @param path Path to put the resource under
111     * @return the Location of the newly created resource
112     * @throws IOException
113     */
114    private String ingestObj(final String path) throws IOException {
115        final HttpPut request = putObjMethod(path.replace(serverAddress, ""));
116        setAuth(request, "fedoraAdmin");
117        try (final CloseableHttpResponse response = execute(request)) {
118            assertEquals(HttpStatus.SC_CREATED, response.getStatusLine().getStatusCode());
119            return response.getFirstHeader("Location").getValue();
120        }
121    }
122
123    private String ingestDatastream(final String path, final String ds) throws IOException {
124        final HttpPut request = putDSMethod(path, ds, "some not so random content");
125        setAuth(request, "fedoraAdmin");
126        try (final CloseableHttpResponse response = execute(request)) {
127            assertEquals(HttpStatus.SC_CREATED, response.getStatusLine().getStatusCode());
128            return response.getFirstHeader("Location").getValue();
129        }
130    }
131
132    /**
133     * Convenience method to link a Resource to a WebACL resource
134     *
135     * @param protectedResource path of the resource to be protected by the
136     * @param aclResource path of the Acl resource
137     */
138    private void linkToAcl(final String protectedResource, final String aclResource)
139            throws IOException {
140        final HttpPatch request = patchObjMethod(protectedResource.replace(serverAddress, ""));
141        setAuth(request, "fedoraAdmin");
142        request.setHeader("Content-type", "application/sparql-update");
143        request.setEntity(new StringEntity(
144                "INSERT { <> <" + WEBAC_ACCESS_CONTROL_VALUE + "> <" + aclResource + "> . } WHERE {}"));
145        assertEquals(HttpStatus.SC_NO_CONTENT, getStatus(request));
146    }
147
148    /**
149     * Convenience method for applying credentials to a request
150     *
151     * @param method the request to add the credentials to
152     * @param username the username to add
153     */
154    private static void setAuth(final AbstractHttpMessage method, final String username) {
155        final String creds = username + ":password";
156        final String encCreds = new String(Base64.encodeBase64(creds.getBytes()));
157        final String basic = "Basic " + encCreds;
158        method.setHeader("Authorization", basic);
159    }
160
161    @Test
162    public void scenario1() throws IOException {
163        final String testObj = ingestObj("/rest/webacl_box1");
164        final String acl1 = ingestAcl("fedoraAdmin", "/acls/01/acl.ttl", "/acls/01/authorization.ttl");
165        linkToAcl(testObj, acl1);
166        final String aclLink = Link.fromUri(acl1).rel("acl").build().toString();
167
168        logger.debug("Anonymous can't read");
169        final HttpGet request = getObjMethod(testObj.replace(serverAddress, ""));
170        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(request));
171
172        logger.debug("Can username 'smith123' read " + testObj);
173        setAuth(request, "smith123");
174        try (final CloseableHttpResponse response = execute(request)) {
175            assertEquals(HttpStatus.SC_OK, getStatus(response));
176
177            final Optional<String> header = Arrays.asList(response.getHeaders("Link")).stream().map(Header::getValue)
178                    .filter(aclLink::equals).findFirst();
179            assertTrue("Missing Link header", header.isPresent());
180        }
181
182    }
183
184    @Test
185    public void scenario2() throws IOException {
186        final String id = "/rest/box/bag/collection";
187        final String testObj = ingestObj(id);
188        final String acl2 = ingestAcl("fedoraAdmin", "/acls/02/acl.ttl", "/acls/02/authorization.ttl");
189        linkToAcl(testObj, acl2);
190
191        logger.debug("Anonymous can not read " + testObj);
192        final HttpGet requestGet = getObjMethod(id);
193        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet));
194
195        logger.debug("GroupId 'Editors' can read " + testObj);
196        final HttpGet requestGet2 = getObjMethod(id);
197        setAuth(requestGet2, "jones");
198        requestGet2.setHeader("some-header", "Editors");
199        assertEquals(HttpStatus.SC_OK, getStatus(requestGet2));
200
201        logger.debug("Anonymous cannot write " + testObj);
202        final HttpPatch requestPatch = patchObjMethod(id);
203        requestPatch.setEntity(new StringEntity("INSERT { <> <" + DC_TITLE + "> \"Test title\" . } WHERE {}"));
204        requestPatch.setHeader("Content-type", "application/sparql-update");
205        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestPatch));
206
207        logger.debug("Editors can write " + testObj);
208        final HttpPatch requestPatch2 = patchObjMethod(id);
209        setAuth(requestPatch2, "jones");
210        requestPatch2.setHeader("some-header", "Editors");
211        requestPatch2.setEntity(new StringEntity("INSERT { <> <" + DC_TITLE + "> \"Different title\" . } WHERE {}"));
212        requestPatch2.setHeader("Content-type", "application/sparql-update");
213        assertEquals(HttpStatus.SC_NO_CONTENT, getStatus(requestPatch2));
214    }
215
216    @Test
217    public void scenario3() throws IOException {
218        final String idDark = "/rest/dark/archive";
219        final String idLight = "/rest/dark/archive/sunshine";
220        final String testObj = ingestObj(idDark);
221        final String testObj2 = ingestObj(idLight);
222        final String acl3 =
223                ingestAcl("fedoraAdmin", "/acls/03/acl.ttl", "/acls/03/auth_open.ttl", "/acls/03/auth_restricted.ttl");
224        linkToAcl(testObj, acl3);
225
226        logger.debug("Anonymous can't read " + testObj);
227        final HttpGet requestGet = getObjMethod(idDark);
228        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet));
229
230        logger.debug("Restricted can read " + testObj);
231        final HttpGet requestGet2 = getObjMethod(idDark);
232        setAuth(requestGet2, "jones");
233        requestGet2.setHeader("some-header", "Restricted");
234        assertEquals(HttpStatus.SC_OK, getStatus(requestGet2));
235
236        logger.debug("Anonymous can read " + testObj2);
237        final HttpGet requestGet3 = getObjMethod(idLight);
238        assertEquals(HttpStatus.SC_OK, getStatus(requestGet3));
239
240        logger.debug("Restricted can read " + testObj2);
241        final HttpGet requestGet4 = getObjMethod(idLight);
242        setAuth(requestGet4, "jones");
243        requestGet4.setHeader("some-header", "Restricted");
244        assertEquals(HttpStatus.SC_OK, getStatus(requestGet4));
245    }
246
247    @Test
248    public void scenario4() throws IOException {
249        final String id = "/rest/public_collection";
250        final String testObj = ingestObj(id);
251        final String acl4 = ingestAcl("fedoraAdmin", "/acls/04/acl.ttl", "/acls/04/auth1.ttl", "/acls/04/auth2.ttl");
252        linkToAcl(testObj, acl4);
253
254        logger.debug("Anonymous can read " + testObj);
255        final HttpGet requestGet = getObjMethod(id);
256        assertEquals(HttpStatus.SC_OK, getStatus(requestGet));
257
258        logger.debug("Editors can read " + testObj);
259        final HttpGet requestGet2 = getObjMethod(id);
260        setAuth(requestGet2, "jones");
261        requestGet2.setHeader("some-header", "Editors");
262        assertEquals(HttpStatus.SC_OK, getStatus(requestGet2));
263
264        logger.debug("Smith can access " + testObj);
265        final HttpGet requestGet3 = getObjMethod(id);
266        setAuth(requestGet3, "smith");
267        assertEquals(HttpStatus.SC_OK, getStatus(requestGet3));
268
269        logger.debug("Anonymous can't write " + testObj);
270        final HttpPatch requestPatch = patchObjMethod(id);
271        requestPatch.setHeader("Content-type", "application/sparql-update");
272        requestPatch.setEntity(new StringEntity("INSERT { <> <" + DC_TITLE + "> \"Change title\" . } WHERE {}"));
273        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestPatch));
274
275        logger.debug("Editors can write " + testObj);
276        final HttpPatch requestPatch2 = patchObjMethod(id);
277        requestPatch2.setHeader("Content-type", "application/sparql-update");
278        requestPatch2.setEntity(new StringEntity("INSERT { <> <" + DC_TITLE + "> \"New title\" . } WHERE {}"));
279        setAuth(requestPatch2, "jones");
280        requestPatch2.setHeader("some-header", "Editors");
281        assertEquals(HttpStatus.SC_NO_CONTENT, getStatus(requestPatch2));
282
283        logger.debug("Editors can create (PUT) child objects of " + testObj);
284        final HttpPut requestPut1 = putObjMethod(id + "/child1");
285        setAuth(requestPut1, "jones");
286        requestPut1.setHeader("some-header", "Editors");
287        assertEquals(HttpStatus.SC_CREATED, getStatus(requestPut1));
288
289        final HttpGet requestGet4 = getObjMethod(id + "/child1");
290        setAuth(requestGet4, "jones");
291        requestGet4.setHeader("some-header", "Editors");
292        assertEquals(HttpStatus.SC_OK, getStatus(requestGet4));
293
294        logger.debug("Editors can create (POST) child objects of " + testObj);
295        final HttpPost requestPost1 = postObjMethod(id);
296        requestPost1.addHeader("Slug", "child2");
297        setAuth(requestPost1, "jones");
298        requestPost1.setHeader("some-header", "Editors");
299        assertEquals(HttpStatus.SC_CREATED, getStatus(requestPost1));
300
301        final HttpGet requestGet5 = getObjMethod(id + "/child2");
302        setAuth(requestGet5, "jones");
303        requestGet5.setHeader("some-header", "Editors");
304        assertEquals(HttpStatus.SC_OK, getStatus(requestGet5));
305
306        logger.debug("Editors can create nested child objects of " + testObj);
307        final HttpPut requestPut2 = putObjMethod(id + "/a/b/c/child");
308        setAuth(requestPut2, "jones");
309        requestPut2.setHeader("some-header", "Editors");
310        assertEquals(HttpStatus.SC_CREATED, getStatus(requestPut2));
311
312        final HttpGet requestGet6 = getObjMethod(id + "/a/b/c/child");
313        setAuth(requestGet6, "jones");
314        requestGet6.setHeader("some-header", "Editors");
315        assertEquals(HttpStatus.SC_OK, getStatus(requestGet6));
316
317        logger.debug("Smith can't write " + testObj);
318        final HttpPatch requestPatch3 = patchObjMethod(id);
319        requestPatch3.setHeader("Content-type", "application/sparql-update");
320        requestPatch3.setEntity(new StringEntity("INSERT { <> <" + DC_TITLE + "> \"Different title\" . } WHERE {}"));
321        setAuth(requestPatch3, "smith");
322        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestPatch3));
323    }
324
325    @Test
326    public void scenario5() throws IOException {
327        final String idPublic = "/rest/mixedCollection/publicObj";
328        final String idPrivate = "/rest/mixedCollection/privateObj";
329        final String testObj = ingestObj("/rest/mixedCollection");
330        final String publicObj = ingestObj(idPublic);
331        final HttpPatch patch = patchObjMethod(idPublic);
332        final String acl5 =
333                ingestAcl("fedoraAdmin", "/acls/05/acl.ttl", "/acls/05/auth_open.ttl", "/acls/05/auth_restricted.ttl");
334        linkToAcl(testObj, acl5);
335
336        setAuth(patch, "fedoraAdmin");
337        patch.setHeader("Content-type", "application/sparql-update");
338        patch.setEntity(new StringEntity("INSERT { <> a <http://example.com/terms#publicImage> . } WHERE {}"));
339        assertEquals(HttpStatus.SC_NO_CONTENT, getStatus(patch));
340
341        final String privateObj = ingestObj(idPrivate);
342
343        logger.debug("Anonymous can see eg:publicImage " + publicObj);
344        final HttpGet requestGet = getObjMethod(idPublic);
345        assertEquals(HttpStatus.SC_OK, getStatus(requestGet));
346
347        logger.debug("Anonymous can't see other resource " + privateObj);
348        final HttpGet requestGet2 = getObjMethod(idPrivate);
349        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet2));
350
351        logger.debug("Admins can see eg:publicImage " + publicObj);
352        final HttpGet requestGet3 = getObjMethod(idPublic);
353        setAuth(requestGet3, "jones");
354        requestGet3.setHeader("some-header", "Admins");
355        assertEquals(HttpStatus.SC_OK, getStatus(requestGet3));
356
357        logger.debug("Admins can see others" + privateObj);
358        final HttpGet requestGet4 = getObjMethod(idPrivate);
359        setAuth(requestGet4, "jones");
360        requestGet4.setHeader("some-header", "Admins");
361        assertEquals(HttpStatus.SC_OK, getStatus(requestGet4));
362    }
363
364    @Test
365    public void scenario9() throws IOException {
366        final String idPublic = "/rest/anotherCollection/publicObj";
367        final String groups = "/rest/group";
368        final String fooGroup = groups + "/foo";
369        final String testObj = ingestObj("/rest/anotherCollection");
370        final String publicObj = ingestObj(idPublic);
371
372        final HttpPut request = putObjMethod(fooGroup);
373        setAuth(request, "fedoraAdmin");
374
375        final InputStream file = this.getClass().getResourceAsStream("/acls/09/group.ttl");
376        final InputStreamEntity fileEntity = new InputStreamEntity(file);
377        request.setEntity(fileEntity);
378        request.setHeader("Content-Type", "text/turtle;charset=UTF-8");
379
380        assertEquals("Didn't get a CREATED response!", CREATED.getStatusCode(), getStatus(request));
381
382        final String acl9 = ingestAcl("fedoraAdmin", "/acls/09/acl.ttl", "/acls/09/authorization.ttl");
383        linkToAcl(testObj, acl9);
384
385        logger.debug("Person1 can see object " + publicObj);
386        final HttpGet requestGet1 = getObjMethod(idPublic);
387        setAuth(requestGet1, "person1");
388        assertEquals(HttpStatus.SC_OK, getStatus(requestGet1));
389
390        logger.debug("Person2 can see object " + publicObj);
391        final HttpGet requestGet2 = getObjMethod(idPublic);
392        setAuth(requestGet2, "person2");
393        assertEquals(HttpStatus.SC_OK, getStatus(requestGet2));
394
395        logger.debug("Person3 user cannot see object " + publicObj);
396        final HttpGet requestGet3 = getObjMethod(idPublic);
397        setAuth(requestGet3, "person3");
398        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet3));
399    }
400
401    @Test
402    public void testAccessToRoot() throws IOException {
403        final String id = "/rest/" + getRandomUniqueId();
404        final String testObj = ingestObj(id);
405        final String acl = ingestAcl("fedoraAdmin", "/acls/06/acl.ttl", "/acls/06/authorization.ttl");
406
407        logger.debug("Anonymous can't read (no ACL): {}", id);
408        final HttpGet requestGet1 = getObjMethod(id);
409        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet1));
410
411        logger.debug("Can username 'smith123' read {} (no ACL)", id);
412        final HttpGet requestGet2 = getObjMethod(id);
413        setAuth(requestGet2, "smith123");
414        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet2));
415
416        System.setProperty(ROOT_AUTHORIZATION_PROPERTY, "./target/test-classes/test-root-authorization2.ttl");
417        logger.debug("Can username 'smith123' read {} (overridden system ACL)", id);
418        final HttpGet requestGet3 = getObjMethod(id);
419        setAuth(requestGet3, "smith123");
420        assertEquals(HttpStatus.SC_OK, getStatus(requestGet3));
421        System.clearProperty(ROOT_AUTHORIZATION_PROPERTY);
422
423        // Add ACL to root
424        linkToAcl("/rest/", acl);
425
426        logger.debug("Anonymous still can't read (ACL present)");
427        final HttpGet requestGet4 = getObjMethod(id);
428        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet4));
429
430        logger.debug("Can username 'smith123' read {} (ACL present)", testObj);
431        final HttpGet requestGet5 = getObjMethod(id);
432        setAuth(requestGet5, "smith123");
433        assertEquals(HttpStatus.SC_OK, getStatus(requestGet5));
434    }
435
436    @Test
437    public void testAccessToBinary() throws IOException {
438        // Block access to "book"
439        final String idBook = "/rest/book";
440        ingestObj(idBook);
441
442        // Open access datastream, "file"
443        final String id = idBook + "/file";
444        final String testObj = ingestDatastream(idBook, "file");
445        final String acl = ingestAcl("fedoraAdmin",
446                "/acls/07/acl.ttl",
447                "/acls/07/authorization.ttl",
448                "/acls/07/authorization-book.ttl");
449
450        linkToAcl(id + "/fcr:metadata", acl);
451
452        logger.debug("Anonymous can't read");
453        final HttpGet requestGet1 = getObjMethod(id);
454        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet1));
455
456        logger.debug("Can username 'smith123' read {}", testObj);
457        final HttpGet requestGet2 = getObjMethod(id);
458
459        setAuth(requestGet2, "smith123");
460        assertEquals(HttpStatus.SC_OK, getStatus(requestGet2));
461    }
462
463    @Test
464    @Ignore("FAILING")
465    public void testAccessToHashResource() throws IOException {
466        final String id = "/rest/some/parent#hash-resource";
467        final String testObj = ingestObj(id);
468        final String acl = ingestAcl("fedoraAdmin", "/acls/08/acl.ttl", "/acls/08/authorization.ttl");
469        linkToAcl(testObj, acl);
470
471        logger.debug("Anonymous can't read");
472        final HttpGet requestGet1 = getObjMethod(id);
473        assertEquals(HttpStatus.SC_FORBIDDEN, getStatus(requestGet1));
474
475        logger.debug("Can username 'smith123' read {}", testObj);
476        final HttpGet requestGet2 = getObjMethod(id);
477        setAuth(requestGet2, "smith123");
478        assertEquals(HttpStatus.SC_OK, getStatus(requestGet2));
479    }
480
481    @Test
482    public void testAccessToVersionedResources() throws IOException {
483        final String idVersion = "/rest/versionResource";
484        ingestObj(idVersion);
485
486        final HttpPatch requestPatch1 = patchObjMethod(idVersion);
487        setAuth(requestPatch1, "fedoraAdmin");
488        requestPatch1.addHeader("Content-type", "application/sparql-update");
489        requestPatch1.setEntity(
490                new StringEntity("PREFIX pcdm: <http://pcdm.org/models#> INSERT { <> a pcdm:Object } WHERE {}"));
491        assertEquals(HttpStatus.SC_NO_CONTENT, getStatus(requestPatch1));
492
493        final String acl = ingestAcl("fedoraAdmin",
494                "/acls/10/acl.ttl",
495                "/acls/10/authorization.ttl");
496
497        linkToAcl(idVersion, acl);
498
499        final HttpGet requestGet1 = getObjMethod(idVersion);
500        setAuth(requestGet1, "testuser");
501        assertEquals("testuser can't read object", HttpStatus.SC_OK, getStatus(requestGet1));
502
503        final HttpPost requestPost1 = postObjMethod(idVersion + "/fcr:versions");
504        requestPost1.addHeader("Slug", "v0");
505        setAuth(requestPost1, "fedoraAdmin");
506        assertEquals("Unable to create a new version", HttpStatus.SC_CREATED, getStatus(requestPost1));
507
508        final HttpGet requestGet2 = getObjMethod(idVersion);
509        setAuth(requestGet2, "testuser");
510        assertEquals("testuser can't read versioned object", HttpStatus.SC_OK, getStatus(requestGet2));
511    }
512
513    @Test
514    public void testDelegatedUserAccess() throws IOException {
515        logger.debug("testing delegated authentication");
516        final String targetPath = "/rest/foo";
517        final String targetResource = ingestObj(targetPath);
518
519        final String acl = ingestAcl("fedoraAdmin", "/acls/11/acl.ttl", "/acls/11/authorization.ttl");
520        linkToAcl(targetResource, acl);
521
522        final HttpGet adminGet = getObjMethod(targetPath);
523        setAuth(adminGet, "fedoraAdmin");
524        assertEquals("admin can read object", HttpStatus.SC_OK, getStatus(adminGet));
525
526        final HttpGet adminDelegatedGet = getObjMethod(targetPath);
527        setAuth(adminDelegatedGet, "fedoraAdmin");
528        adminDelegatedGet.addHeader("On-Behalf-Of", "user1");
529        assertEquals("delegated user can read object", HttpStatus.SC_OK, getStatus(adminDelegatedGet));
530
531        final HttpGet adminUnauthorizedDelegatedGet = getObjMethod(targetPath);
532        setAuth(adminUnauthorizedDelegatedGet, "fedoraAdmin");
533        adminUnauthorizedDelegatedGet.addHeader("On-Behalf-Of", "fakeuser");
534        assertEquals("delegated fakeuser cannot read object", HttpStatus.SC_FORBIDDEN,
535                getStatus(adminUnauthorizedDelegatedGet));
536    }
537
538}