summaryrefslogtreecommitdiffstats
path: root/ecomp-sdk/epsdk-fw
diff options
context:
space:
mode:
authorst782s <statta@research.att.com>2017-11-22 11:41:10 -0500
committerSunder Tattavarada <statta@research.att.com>2017-11-28 20:24:36 +0000
commited07ebfbce4031ef4dfbd2f42147f6a7b351aeb8 (patch)
treeee4a6e53f01f15057f32b86f271c9b6d02b25615 /ecomp-sdk/epsdk-fw
parent418d7273d6d8f6fed2698df89c9910be8498a677 (diff)
Harden code
Issue-ID: PORTAL-145,PORTAL-119 Harden code to address SQL injecton, XSS vulnerabilities; Separate docker images for portal, sdk app and DMaaPBC ui Change-Id: I85fad4d3fcee3243207b8f0dfe21beaa41602204 Signed-off-by: st782s <statta@research.att.com>
Diffstat (limited to 'ecomp-sdk/epsdk-fw')
-rw-r--r--ecomp-sdk/epsdk-fw/pom.xml88
-rw-r--r--ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/rest/RestWebServiceClient.java28
-rw-r--r--ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/CipherUtil.java143
-rw-r--r--ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyConstants.java46
-rw-r--r--ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyProperties.java123
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/AbstractModelTest.java75
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/DomainTest.java169
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExceptionTest.java73
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExtendSessionTimeoutTest.java99
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/InMemoryRestServer.java150
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/PortalTimeoutHandlerTest.java100
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/RestClientTest.java112
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/SessionSlotCheckIntervalTest.java103
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/UtilTest.java80
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/resources/ESAPI.properties367
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/resources/key.properties41
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/resources/portal.properties3
-rw-r--r--ecomp-sdk/epsdk-fw/src/test/resources/validation.properties32
18 files changed, 1787 insertions, 45 deletions
diff --git a/ecomp-sdk/epsdk-fw/pom.xml b/ecomp-sdk/epsdk-fw/pom.xml
index de185f48..73283ee8 100644
--- a/ecomp-sdk/epsdk-fw/pom.xml
+++ b/ecomp-sdk/epsdk-fw/pom.xml
@@ -1,5 +1,6 @@
<?xml version="1.0"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
@@ -15,7 +16,9 @@
<name>ONAP Portal SDK Framework</name>
<!-- properties are inherited from parent -->
-
+ <properties>
+ <resteasy.version>3.0.18.Final</resteasy.version>
+ </properties>
<!-- repositories are inherited from parent -->
<!-- profiles are inherited from parent -->
@@ -54,8 +57,6 @@
</build>
<dependencies>
-
- <!-- publicly available -->
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
@@ -81,12 +82,79 @@
<artifactId>jackson-databind</artifactId>
<version>2.6.3</version>
</dependency>
- <dependency>
- <groupId>org.owasp.esapi</groupId>
- <artifactId>esapi</artifactId>
- <version>2.1.0.1</version>
- </dependency>
-
+ <dependency>
+ <groupId>org.owasp.esapi</groupId>
+ <artifactId>esapi</artifactId>
+ <version>2.1.0.1</version>
+ <exclusions>
+ <exclusion>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <version>4.12</version>
+ <scope>test</scope>
+ </dependency>
+ <!-- Test scaffold -->
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>jul-to-slf4j</artifactId>
+ <version>1.7.25</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>jcl-over-slf4j</artifactId>
+ <version>1.7.25</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>ch.qos.logback</groupId>
+ <artifactId>logback-classic</artifactId>
+ <version>1.1.1</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.jboss.resteasy</groupId>
+ <artifactId>resteasy-spring</artifactId>
+ <version>${resteasy.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.jboss.resteasy</groupId>
+ <artifactId>resteasy-client</artifactId>
+ <version>${resteasy.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.jboss.resteasy</groupId>
+ <artifactId>resteasy-jaxb-provider</artifactId>
+ <version>${resteasy.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.jboss.resteasy</groupId>
+ <artifactId>tjws</artifactId>
+ <version>${resteasy.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.jboss.spec.javax.servlet</groupId>
+ <artifactId>jboss-servlet-api_3.1_spec</artifactId>
+ <version>1.0.0.Final</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.mockito</groupId>
+ <artifactId>mockito-core</artifactId>
+ <version>1.10.19</version>
+ <scope>test</scope>
+ </dependency>
+
</dependencies>
</project>
diff --git a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/rest/RestWebServiceClient.java b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/rest/RestWebServiceClient.java
index 91f019be..a752055f 100644
--- a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/rest/RestWebServiceClient.java
+++ b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/rest/RestWebServiceClient.java
@@ -51,7 +51,6 @@ import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
import org.onap.portalsdk.core.onboarding.util.PortalApiProperties;
import org.owasp.esapi.ESAPI;
-
/**
* Simple REST client for GET, POST and DELETE operations against the Portal
* application.
@@ -211,7 +210,9 @@ public class RestWebServiceClient {
// add request header
con.setRequestProperty("uebkey", appUebKey);
- con.setRequestProperty("LoginId", ESAPI.encoder().canonicalize(loginId));
+ if (loginId != null) {
+ con.setRequestProperty("LoginId", ESAPI.encoder().canonicalize(loginId));
+ }
con.setRequestProperty("user-agent", appName);
con.setRequestProperty("X-ECOMP-RequestID", requestId);
con.setRequestProperty("username", appUserName);
@@ -527,31 +528,10 @@ public class RestWebServiceClient {
int bytes;
while ((bytes = in.read(buf)) > 0)
sb.append(new String(buf, 0, bytes));
- }
- catch (Exception ex) {
+ } catch (Exception ex) {
logger.error("readAndCloseStream", ex);
}
return sb.toString();
}
- /**
- * Basic unit test for the client to call Portal app on localhost.
- *
- * @param args
- * Ignored
- * @throws IOException
- * On failure
- */
- public static void main(String[] args) throws IOException {
- RestWebServiceClient client = RestWebServiceClient.getInstance();
- final String getUrl = "http://www.ecomp.openecomp.org:8080/ecompportal/auxapi/analytics";
- String get = client.get(getUrl, "userId", "appName", null, "appUebKey", "appUserName", "appPassword", null);
- System.out.println("Get result:\n" + get);
- final String postUrl = "http://www.ecomp.openecomp.org:8080/ecompportal/auxapi/storeAnalytics";
- final String content = " { " + " \"action\" : \"test1\", " + " \"page\" : \"test2\", "
- + " \"function\" : \"test3\", " + " \"userid\" : \"ab1234\" " + "}";
- String post = client.post(postUrl, "userId", "appName", null, "appUebKey", "appUserName", "appPassword",
- "application/json", content, true);
- System.out.println("Post result:\n" + post);
- }
}
diff --git a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/CipherUtil.java b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/CipherUtil.java
index 92d9ffc3..ba95d870 100644
--- a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/CipherUtil.java
+++ b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/CipherUtil.java
@@ -40,14 +40,17 @@ package org.onap.portalsdk.core.onboarding.util;
import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
+import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.onap.portalsdk.core.onboarding.exception.CipherUtilException;
@@ -59,10 +62,19 @@ public class CipherUtil {
/**
* Default key.
*/
- private final static String key = "AGLDdG4D04BKm2IxIWEr8o==!";
+ private static final String keyString = KeyProperties.getProperty(KeyConstants.CIPHER_ENCRYPTION_KEY);
+
+ private static final String ALGORITHM = "AES";
+ private static final String ALGORYTHM_DETAILS = ALGORITHM + "/CBC/PKCS5PADDING";
+ private static final int BLOCK_SIZE = 128;
+ @SuppressWarnings("unused")
+ private static SecretKeySpec secretKeySpec;
+ private static IvParameterSpec ivspec;
/**
- * Encrypts the text using the specified secret key.
+ * @deprecated Please use {@link #encryptPKC(String)} to encrypt the text.
+ *
+ * Encrypts the text using the specified secret key.
*
* @param plainText
* Text to encrypt
@@ -71,7 +83,9 @@ public class CipherUtil {
* @return encrypted version of plain text.
* @throws CipherUtilException
* if any encryption step fails
+ *
*/
+ @Deprecated
public static String encrypt(String plainText, String secretKey) throws CipherUtilException {
String encryptedString = null;
try {
@@ -90,7 +104,8 @@ public class CipherUtil {
}
/**
- * Encrypts the text using a default secret key.
+ * @deprecated Please use {@link #encryptPKC(String)} to encrypt the text.
+ * Encrypts the text using the secret key in key.properties file.
*
* @param plainText
* Text to encrypt
@@ -98,12 +113,29 @@ public class CipherUtil {
* @throws CipherUtilException
* if any decryption step fails
*/
+ @Deprecated
public static String encrypt(String plainText) throws CipherUtilException {
- return CipherUtil.encrypt(plainText, key);
+ return CipherUtil.encrypt(plainText, keyString);
}
/**
- * Decrypts the text using the specified secret key.
+ * Encrypts the text using a secret key.
+ *
+ * @param plainText
+ * Text to encrypt
+ * @return Encrypted Text
+ * @throws CipherUtilException
+ * if any decryption step fails
+ */
+ public static String encryptPKC(String plainText) throws CipherUtilException {
+ return CipherUtil.encryptPKC(plainText, keyString);
+ }
+
+ /**
+ *
+ * @deprecated Please use {@link #decryptPKC(String)} to Decryption the text.
+ *
+ * Decrypts the text using the specified secret key.
*
* @param encryptedText
* Text to decrypt
@@ -112,7 +144,9 @@ public class CipherUtil {
* @return plain text version of encrypted text
* @throws CipherUtilException
* if any decryption step fails
+ *
*/
+ @Deprecated
public static String decrypt(String encryptedText, String secretKey) throws CipherUtilException {
String encryptedString = null;
try {
@@ -130,8 +164,79 @@ public class CipherUtil {
return encryptedString;
}
+ private static SecretKeySpec getSecretKeySpec() {
+ byte[] key = Base64.decodeBase64(keyString);
+ return new SecretKeySpec(key, ALGORITHM);
+ }
+
+ private static SecretKeySpec getSecretKeySpec(String keyString) {
+ byte[] key = Base64.decodeBase64(keyString);
+ return new SecretKeySpec(key, ALGORITHM);
+ }
+
/**
- * Decrypts the text using a default secret key.
+ * Encrypt the text using the secret key in key.properties file
+ *
+ * @param value
+ * @return The encrypted string
+ * @throws BadPaddingException
+ * @throws CipherUtilException
+ * In case of issue with the encryption
+ */
+ public static String encryptPKC(String value, String skey) throws CipherUtilException {
+ Cipher cipher = null;
+ byte[] iv = null, finalByte = null;
+
+ try {
+ cipher = Cipher.getInstance(ALGORYTHM_DETAILS, "SunJCE");
+
+ SecureRandom r = SecureRandom.getInstance("SHA1PRNG");
+ iv = new byte[BLOCK_SIZE / 8];
+ r.nextBytes(iv);
+ ivspec = new IvParameterSpec(iv);
+ cipher.init(Cipher.ENCRYPT_MODE, getSecretKeySpec(skey), ivspec);
+ finalByte = cipher.doFinal(value.getBytes());
+
+ } catch (Exception ex) {
+ logger.error("encrypt failed", ex);
+ throw new CipherUtilException(ex);
+ }
+ return Base64.encodeBase64String(ArrayUtils.addAll(iv, finalByte));
+ }
+
+ /**
+ * Decrypts the text using the secret key in key.properties file.
+ *
+ * @param message
+ * The encrypted string that must be decrypted using the ecomp
+ * Encryption Key
+ * @return The String decrypted
+ * @throws CipherUtilException
+ * if any decryption step fails
+ */
+ public static String decryptPKC(String message, String skey) throws CipherUtilException {
+ byte[] encryptedMessage = Base64.decodeBase64(message);
+ Cipher cipher;
+ byte[] decrypted = null;
+ try {
+ cipher = Cipher.getInstance(ALGORYTHM_DETAILS, "SunJCE");
+ ivspec = new IvParameterSpec(ArrayUtils.subarray(encryptedMessage, 0, BLOCK_SIZE / 8));
+ byte[] realData = ArrayUtils.subarray(encryptedMessage, BLOCK_SIZE / 8, encryptedMessage.length);
+ cipher.init(Cipher.DECRYPT_MODE, getSecretKeySpec(skey), ivspec);
+ decrypted = cipher.doFinal(realData);
+
+ } catch (Exception ex) {
+ logger.error("decrypt failed", ex);
+ throw new CipherUtilException(ex);
+ }
+
+ return new String(decrypted);
+ }
+
+ /**
+ * @deprecated Please use {@link #decryptPKC(String)} to Decrypt the text.
+ *
+ * Decrypts the text using the secret key in key.properties file.
*
* @param encryptedText
* Text to decrypt
@@ -139,11 +244,26 @@ public class CipherUtil {
* @throws CipherUtilException
* if any decryption step fails
*/
+ @Deprecated
public static String decrypt(String encryptedText) throws CipherUtilException {
- return CipherUtil.decrypt(encryptedText, key);
+ return CipherUtil.decrypt(encryptedText, keyString);
+ }
+
+ /**
+ *
+ * Decrypts the text using the secret key in key.properties file.
+ *
+ * @param encryptedText
+ * Text to decrypt
+ * @return Decrypted text
+ * @throws CipherUtilException
+ * if any decryption step fails
+ */
+ public static String decryptPKC(String encryptedText) throws CipherUtilException {
+ return CipherUtil.decryptPKC(encryptedText, keyString);
}
-/* public static void main(String[] args) throws CipherUtilException {
+ public static void main(String[] args) throws CipherUtilException {
String testValue = "Welcome123";
String encrypted;
@@ -152,9 +272,9 @@ public class CipherUtil {
if (args.length != 2) {
System.out.println("Default password testing... ");
System.out.println("Plain password: " + testValue);
- encrypted = encrypt(testValue);
+ encrypted = encryptPKC(testValue);
System.out.println("Encrypted password: " + encrypted);
- decrypted = decrypt(encrypted);
+ decrypted = decryptPKC(encrypted);
System.out.println("Decrypted password: " + decrypted);
} else {
String whatToDo = args[0];
@@ -170,5 +290,6 @@ public class CipherUtil {
System.out.println("Encrypted Text" + encrypted);
}
}
- }*/
+ }
+
}
diff --git a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyConstants.java b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyConstants.java
new file mode 100644
index 00000000..096b04dc
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyConstants.java
@@ -0,0 +1,46 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+package org.onap.portalsdk.core.onboarding.util;
+
+public interface KeyConstants {
+
+ // Names of keys in the key.properties file
+ public static final String CIPHER_ENCRYPTION_KEY = "cipher.enc.key";
+
+
+}
diff --git a/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyProperties.java b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyProperties.java
new file mode 100644
index 00000000..956d3b81
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/main/java/org/onap/portalsdk/core/onboarding/util/KeyProperties.java
@@ -0,0 +1,123 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+package org.onap.portalsdk.core.onboarding.util;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * Searches the classpath for the file "key.properties".
+ *
+ * To put the file "key.properties" on the classpath, it can be in the same
+ * directory where the first package folder is - 'myClasses' folder in the
+ * following case as an example:
+ *
+ */
+public class KeyProperties {
+
+ private static final Log logger = LogFactory.getLog(KeyProperties.class);
+
+ private static Properties properties;
+ private static String propertyFileName = "key.properties";
+
+ private static final Object lockObject = new Object();
+
+ /**
+ * Constructor is private.
+ */
+ private KeyProperties() {
+ }
+
+ /**
+ * Gets the property value for the specified key. If a value is found, leading
+ * and trailing space is trimmed.
+ *
+ * @param property
+ * Property key
+ * @return Value for the named property; null if the property file was not
+ * loaded or the key was not found.
+ */
+ public static String getProperty(String property) {
+ if (properties == null) {
+ synchronized (lockObject) {
+ try {
+ if (!initialize()) {
+ logger.error("Failed to read property file " + propertyFileName);
+ return null;
+ }
+ } catch (IOException e) {
+ logger.error("Failed to read property file " + propertyFileName, e);
+ return null;
+ }
+ }
+ }
+ String value = properties.getProperty(property);
+ if (value != null)
+ value = value.trim();
+ return value;
+ }
+
+ /**
+ * Reads properties from a portal.properties file on the classpath.
+ *
+ * Clients do NOT need to call this method. Clients MAY call this method to test
+ * whether the properties file can be loaded successfully.
+ *
+ * @return True if properties were successfully loaded, else false.
+ * @throws IOException
+ * On failure
+ */
+ private static boolean initialize() throws IOException {
+ if (properties != null)
+ return true;
+ InputStream in = KeyProperties.class.getClassLoader().getResourceAsStream(propertyFileName);
+ if (in == null)
+ return false;
+ properties = new Properties();
+ try {
+ properties.load(in);
+ } finally {
+ in.close();
+ }
+ return true;
+ }
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/AbstractModelTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/AbstractModelTest.java
new file mode 100644
index 00000000..ca35446b
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/AbstractModelTest.java
@@ -0,0 +1,75 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import java.util.Date;
+
+public abstract class AbstractModelTest {
+
+ // Values for properties
+ final long time = new Date().getTime();
+ final boolean b1 = true;
+ final boolean b2 = false;
+ final Byte[] by1 = { 0, 1, 2, 3 };
+ final Date d1 = new Date(time + 1 * 24 * 60 * 60 * 1000);
+ final Date d2 = new Date(time + 2 * 24 * 60 * 60 * 1000);
+ final Date d3 = new Date(time + 3 * 24 * 60 * 60 * 1000);
+ final Date d4 = new Date(time + 4 * 24 * 60 * 60 * 1000);
+ final Date d5 = new Date(time + 5 * 24 * 60 * 60 * 1000);
+ final Integer i1 = 1;
+ final Integer i2 = 2;
+ final Integer i3 = 3;
+ final Integer i4 = 4;
+ final Integer i5 = 5;
+ final Long l1 = 1L;
+ final Long l2 = 2L;
+ final Long l3 = 3L;
+ final Long l4 = 4L;
+ final String s1 = "string1";
+ final String s2 = "string2";
+ final String s3 = "string3";
+ final String s4 = "string4";
+ final String s5 = "string5";
+ final String s6 = "string6";
+ final String s7 = "string7";
+ final String s8 = "string8";
+ final String s9 = "string9";
+ final String s10 = "string10";
+
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/DomainTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/DomainTest.java
new file mode 100644
index 00000000..700c8b3e
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/DomainTest.java
@@ -0,0 +1,169 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import java.util.HashSet;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.Assert;
+import org.junit.Test;
+import org.onap.portalsdk.core.onboarding.crossapi.PortalAPIResponse;
+import org.onap.portalsdk.core.restful.domain.EcompRole;
+import org.onap.portalsdk.core.restful.domain.EcompUser;
+import org.onap.portalsdk.core.restful.domain.PortalTimeoutVO;
+import org.onap.portalsdk.core.restful.domain.SharedContext;
+
+public class DomainTest extends AbstractModelTest {
+
+ private final Log logger = LogFactory.getLog(DomainTest.class);
+
+ @Test
+ public void testPortalAPIResponse() {
+ PortalAPIResponse m = new PortalAPIResponse(true, s1);
+ Assert.assertEquals("ok", m.getStatus());
+ Assert.assertEquals(s1, m.getMessage());
+ logger.info(m.toString());
+ }
+
+ @Test
+ public void testEcompRole() {
+ EcompRole m = new EcompRole();
+ m.setId(l1);
+ m.setName(s1);
+ Assert.assertEquals(l1, m.getId());
+ Assert.assertEquals(s1, m.getName());
+ Assert.assertTrue(m.equals(m));
+ Assert.assertFalse(m.equals(new EcompRole()));
+ Assert.assertNotNull(m.hashCode());
+ logger.info(m.toString());
+ }
+
+ @Test
+ public void testEcompUser() {
+ EcompUser m = new EcompUser();
+ m.setActive(false);
+ m.setEmail(s1);
+ m.setFirstName(s2);
+ m.setHrid(s3);
+ m.setJobTitle(s4);
+ m.setLastName(s5);
+ m.setLoginId(s6);
+ m.setManagerId(s7);
+ m.setMiddleInitial(s8);
+ m.setOrgCode(s9);
+ m.setOrgId(l1);
+ m.setOrgManagerUserId(s10);
+ // Start over at 1, but double
+ m.setOrgUserId(s1 + s1);
+ m.setPhone(s2 + s2);
+ EcompRole r = new EcompRole();
+ HashSet<EcompRole> roles = new HashSet<>();
+ roles.add(r);
+ m.setRoles(roles);
+ Assert.assertEquals(false, m.isActive());
+ Assert.assertEquals(s1, m.getEmail());
+ Assert.assertEquals(s2, m.getFirstName());
+ Assert.assertEquals(s3, m.getHrid());
+ Assert.assertEquals(s4, m.getJobTitle());
+ Assert.assertEquals(s5, m.getLastName());
+ Assert.assertEquals(s6, m.getLoginId());
+ Assert.assertEquals(s7, m.getManagerId());
+ Assert.assertEquals(s8, m.getMiddleInitial());
+ Assert.assertEquals(s9, m.getOrgCode());
+ Assert.assertEquals(l1, m.getOrgId());
+ Assert.assertEquals(s10, m.getOrgManagerUserId());
+ Assert.assertEquals(s1 + s1, m.getOrgUserId());
+ Assert.assertEquals(s2 + s2, m.getPhone());
+ // this is weak
+ Assert.assertEquals(roles, m.getRoles());
+ Assert.assertTrue(m.equals(m));
+ Assert.assertFalse(m.equals(null));
+ Assert.assertFalse(m.equals(new EcompUser()));
+ Assert.assertNotNull(m.hashCode());
+ logger.info(m.toString());
+ }
+
+ @Test
+ public void testPortalTimeoutVO() {
+ PortalTimeoutVO m = new PortalTimeoutVO();
+ m.setjSessionId(s1);
+ m.setSessionTimOutMilliSec(l1);
+ Assert.assertEquals(s1, m.getjSessionId());
+ Assert.assertEquals(l1, m.getSessionTimOutMilliSec());
+ Assert.assertTrue(m.equals(m));
+ Assert.assertFalse(m.equals(null));
+ Assert.assertFalse(m.equals(new PortalTimeoutVO()));
+ }
+
+ @Test
+ public void testSharedContext() {
+ SharedContext m = new SharedContext();
+ m.setAuditTrail(s1);
+ m.setAuditUserId(s2);
+ m.setCkey(s3);
+ m.setContext_id(s4);
+ m.setCreate_time(l1);
+ m.setCreated(s5);
+ m.setCreatedId(s6);
+ m.setCvalue(s7);
+ m.setId(l2);
+ m.setModified(s8);
+ m.setModifiedId(s9);
+ m.setResponse(s10);
+ m.setRowNum(s1 + s1);
+ Assert.assertEquals(s1, m.getAuditTrail());
+ Assert.assertEquals(s2, m.getAuditUserId());
+ Assert.assertEquals(s3, m.getCkey());
+ Assert.assertEquals(s4, m.getContext_id());
+ Assert.assertEquals(l1, m.getCreate_time());
+ Assert.assertEquals(s5, m.getCreated());
+ Assert.assertEquals(s6, m.getCreatedId());
+ Assert.assertEquals(s7, m.getCvalue());
+ Assert.assertEquals(l2, m.getId());
+ Assert.assertEquals(s8, m.getModified());
+ Assert.assertEquals(s9, m.getModifiedId());
+ Assert.assertEquals(s10, m.getResponse());
+ Assert.assertEquals(s1 + s1, m.getRowNum());
+ Assert.assertTrue(m.equals(m));
+ Assert.assertFalse(m.equals(null));
+ Assert.assertFalse(m.equals(new SharedContext()));
+ }
+
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExceptionTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExceptionTest.java
new file mode 100644
index 00000000..76f8f072
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExceptionTest.java
@@ -0,0 +1,73 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.Assert;
+import org.junit.Test;
+import org.onap.portalsdk.core.onboarding.exception.CipherUtilException;
+import org.onap.portalsdk.core.onboarding.exception.PortalAPIException;
+
+public class ExceptionTest extends AbstractModelTest {
+
+ private final Log logger = LogFactory.getLog(ExceptionTest.class);
+
+ @Test
+ public void coverCipherUtilException() {
+ Exception e = new CipherUtilException();
+ e = new CipherUtilException("message", new Exception(), false, false);
+ e = new CipherUtilException("message", new Exception());
+ e = new CipherUtilException("message");
+ e = new CipherUtilException(new Exception());
+ Assert.assertNotNull(e);
+ logger.info(e);
+ }
+
+ @Test
+ public void coverPortalAPIException() {
+ Exception e = new PortalAPIException();
+ e = new PortalAPIException("message", new Exception(), false, false);
+ e = new PortalAPIException("message", new Exception());
+ e = new PortalAPIException("message");
+ e = new PortalAPIException(new Exception());
+ Assert.assertNotNull(e);
+ logger.info(e);
+ }
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExtendSessionTimeoutTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExtendSessionTimeoutTest.java
new file mode 100644
index 00000000..a87639d8
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/ExtendSessionTimeoutTest.java
@@ -0,0 +1,99 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import java.io.IOException;
+import java.net.URL;
+
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.onap.portalsdk.core.onboarding.crossapi.SessionCommunicationService;
+import org.onap.portalsdk.core.onboarding.listener.PortalTimeoutHandler;
+import org.onap.portalsdk.core.onboarding.listener.PortalTimeoutHandler.SessionCommInf;
+import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
+import org.onap.portalsdk.core.onboarding.util.PortalApiProperties;
+
+public class ExtendSessionTimeoutTest {
+
+ private final Log logger = LogFactory.getLog(ExtendSessionTimeoutTest.class);
+ private InMemoryRestServer server;
+
+ @Path("extendSessionTimeOuts")
+ public static class RestResource {
+ @POST
+ @Produces(MediaType.APPLICATION_JSON)
+ public String get( @HeaderParam("username") String username,
+ @HeaderParam("password") String password, @HeaderParam("uebkey") String uebkey) {
+ return "{ 'post-session' : '" + username + "' }";
+ }
+ }
+
+ @Before
+ public void before() throws Exception {
+ URL url = new URL(PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REST_URL));
+ server = InMemoryRestServer.create(url.getPort(), new RestResource());
+ }
+
+ @After
+ public void after() throws Exception {
+ server.close();
+ }
+
+ @Test
+ public void testRequestSessionTimeoutExtension() throws IOException {
+ String url = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REST_URL);
+ String get = SessionCommunicationService.requestPortalSessionTimeoutExtension(url, "userName", "word", "uebKey", "map");
+ Assert.assertNotNull(get);
+ logger.info("extend session test yields: " + get);
+ // Similar test via a different path
+ SessionCommInf sc = new PortalTimeoutHandler.SessionComm();
+ sc.extendSessionTimeOuts(url, "userName", "word", "uebKey", "map");
+ }
+
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/InMemoryRestServer.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/InMemoryRestServer.java
new file mode 100644
index 00000000..2c37e214
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/InMemoryRestServer.java
@@ -0,0 +1,150 @@
+/**
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * https://github.com/mp911de/rest-api-test
+ *
+ * Embedded InMemory REST server for RESTEasy. Usage:
+ * <ul>
+ * <li>InMemoryRestServer srv = InMemoryRestServer.create(...) passing your resources and provider classes</li>
+ * <li>srv.baseUri() for BaseUrl</li>
+ * <li>srv.newRequest("/relative/resource/path") to issue requests</li>
+ * <li>srv.close() to stop</li>
+ * </ul>
+ *
+ */
+package org.onap.portalsdk.fw.test;
+
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.util.HashSet;
+import java.util.Set;
+
+import javax.ws.rs.core.Application;
+
+import org.jboss.resteasy.client.jaxrs.ResteasyClient;
+import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
+import org.jboss.resteasy.plugins.server.embedded.SecurityDomain;
+import org.jboss.resteasy.plugins.server.tjws.TJWSEmbeddedJaxrsServer;
+
+
+public class InMemoryRestServer implements AutoCloseable {
+
+ private int port;
+
+ private Set<Object> objects = new HashSet<Object>();
+ @SuppressWarnings("rawtypes")
+ private Set<Class> classes = new HashSet<Class>();
+
+ private TJWSEmbeddedJaxrsServer server;
+ private SecurityDomain securityDomain;
+ private ResteasyClient resteasyClient;
+ private String bindAddress = "localhost";
+
+ private InMemoryRestServer(Object... objects) {
+ append(objects);
+ }
+
+ /**
+ * Create instance and pass given instances/classes as singletons/providers.
+ *
+ * @param port
+ * Port number to bind
+ * @param objects
+ * Resource providers
+ * @return running instance of {@link InMemoryRestServer}
+ * @throws IOException
+ * In case of error
+ */
+ public static InMemoryRestServer create(int port, Object... objects) throws IOException {
+ InMemoryRestServer inMemoryRestServer = new InMemoryRestServer(objects);
+ inMemoryRestServer.start(port);
+ return inMemoryRestServer;
+ }
+
+ @SuppressWarnings("rawtypes")
+ private void append(Object... objects) {
+ for (Object object : objects) {
+ if (object instanceof Class) {
+ classes.add((Class) object);
+ } else {
+ this.objects.add(object);
+ }
+ }
+ }
+
+ private void start(int requestPort) throws IOException {
+ if (requestPort <= 0)
+ port = findFreePort();
+ else
+ port = requestPort;
+ server = new TJWSEmbeddedJaxrsServer();
+ server.setPort(port);
+ server.setBindAddress(bindAddress);
+ server.setSecurityDomain(securityDomain);
+
+ for (Object object : objects) {
+ if (object instanceof Application) {
+ server.getDeployment().setApplication((Application) object);
+ } else {
+ server.getDeployment().getResources().add(object);
+ }
+ }
+
+ for (@SuppressWarnings("rawtypes") Class resourceOrProvider : classes) {
+ if (Application.class.isAssignableFrom(resourceOrProvider)) {
+ server.getDeployment().setApplicationClass(resourceOrProvider.getName());
+ } else {
+ server.getDeployment().getProviderClasses().add(resourceOrProvider.getName());
+ }
+ }
+
+ server.start();
+ }
+
+ /**
+ * @return baseURI (http://localhost:PORT) to the REST server.
+ */
+ public String baseUri() {
+ return "http://" + bindAddress + ":" + port;
+ }
+
+ /**
+ * Begin a new {@link ResteasyWebTarget} with additional, relative path with leading /.
+ *
+ * @param uriTemplate
+ * URI template
+ * @return ResteasyWebTarget
+ */
+ public ResteasyWebTarget newRequest(String uriTemplate) {
+ return resteasyClient.target(baseUri() + uriTemplate);
+ }
+
+ /**
+ * Find a free server port.
+ *
+ * @return port number.
+ * @throws IOException
+ * On failure to create server socket
+ */
+ private static int findFreePort() throws IOException {
+ ServerSocket server = new ServerSocket(0);
+ int port = server.getLocalPort();
+ server.close();
+ return port;
+ }
+
+ /**
+ * Close the server and free resources.
+ */
+ @Override
+ public void close() {
+ if (server != null) {
+ server.stop();
+ server = null;
+ }
+ }
+} \ No newline at end of file
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/PortalTimeoutHandlerTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/PortalTimeoutHandlerTest.java
new file mode 100644
index 00000000..8826237d
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/PortalTimeoutHandlerTest.java
@@ -0,0 +1,100 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.servlet.http.HttpSession;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.runners.MockitoJUnitRunner;
+import org.mockito.stubbing.Answer;
+import org.onap.portalsdk.core.onboarding.listener.PortalTimeoutHandler;
+
+@RunWith(MockitoJUnitRunner.class)
+public class PortalTimeoutHandlerTest extends AbstractModelTest {
+
+ private final Log logger = LogFactory.getLog(PortalTimeoutHandlerTest.class);
+
+ @Mock
+ private HttpSession mockHttpSession;
+ private Map<String, Object> attributes = new HashMap<String, Object>();
+
+ @Before
+ public void before() {
+ Mockito.doAnswer(new Answer<Object>() {
+ @Override
+ public Object answer(InvocationOnMock invocation) throws Throwable {
+ String key = (String) invocation.getArguments()[0];
+ logger.debug("get for key " + key);
+ return attributes.get(key);
+ }
+ }).when(mockHttpSession).getAttribute(Mockito.anyString());
+
+ Mockito.doAnswer(new Answer<Object>() {
+ @Override
+ public Object answer(InvocationOnMock invocation) throws Throwable {
+ String key = (String) invocation.getArguments()[0];
+ logger.debug("set for key " + key);
+ Object value = invocation.getArguments()[1];
+ attributes.put(key, value);
+ return null;
+ }
+ }).when(mockHttpSession).setAttribute(Mockito.anyString(), Mockito.any());
+ }
+
+ @Test
+ public void testPortalTimeoutHandler() {
+ Assert.assertNotNull(PortalTimeoutHandler.getInstance());
+ Assert.assertNotNull(PortalTimeoutHandler.getSessionMap());
+ PortalTimeoutHandler.sessionCreated("portalJSessionId", "jSessionId", mockHttpSession);
+ PortalTimeoutHandler.invalidateSession("portalJSessionId");
+ PortalTimeoutHandler.sessionDestroyed(mockHttpSession);
+ PortalTimeoutHandler.gatherSessionExtensions();
+ }
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/RestClientTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/RestClientTest.java
new file mode 100644
index 00000000..d36ee79d
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/RestClientTest.java
@@ -0,0 +1,112 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import java.io.IOException;
+import java.net.URL;
+
+import javax.ws.rs.DELETE;
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.onap.portalsdk.core.onboarding.rest.RestWebServiceClient;
+import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
+import org.onap.portalsdk.core.onboarding.util.PortalApiProperties;
+
+public class RestClientTest {
+
+ private final Log logger = LogFactory.getLog(RestClientTest.class);
+ private InMemoryRestServer server;
+
+ @Path("portal")
+ public static class RestResource {
+ @GET
+ @Produces(MediaType.APPLICATION_JSON)
+ public String get(@HeaderParam("LoginId") String loginId, @HeaderParam("username") String username,
+ @HeaderParam("password") String password) {
+ return "{ 'get' : '" + loginId + "' }";
+ }
+ @POST
+ public String post(@HeaderParam("LoginId") String loginId, @HeaderParam("username") String username,
+ @HeaderParam("password") String password) {
+ return "{ 'post' : '" + loginId + "' }";
+ }
+ @DELETE
+ public String delete(@HeaderParam("LoginId") String loginId, @HeaderParam("username") String username,
+ @HeaderParam("password") String password) {
+ return "{ 'delete' : '" + loginId + "' }";
+ }
+ }
+
+ @Before
+ public void before() throws Exception {
+ URL url = new URL(PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REST_URL));
+ server = InMemoryRestServer.create(url.getPort(), new RestResource());
+ }
+
+ @After
+ public void after() throws Exception {
+ server.close();
+ }
+
+ @Test
+ public void testRestClient() throws IOException {
+ RestWebServiceClient client = RestWebServiceClient.getInstance();
+ String get = client.getPortalContent("/portal", "userid", "appName", "requestId", "appUserName", "appPassword", true);
+ Assert.assertNotNull(get);
+ logger.info("Get test yields: " + get);
+ String post = client.postPortalContent("/portal", "userid", "appName", "requestId", "appUserName", "appPassword", MediaType.APPLICATION_JSON, "content", true);
+ Assert.assertNotNull(post);
+ logger.info("Post test yields: " + post);
+ String delete = client.deletePortalContent("/portal", "userid", "appName", "requestId", "appUserName", "appPassword", MediaType.APPLICATION_JSON, "content", true);
+ Assert.assertNotNull(delete);
+ logger.info("Delete test yields: " + delete);
+ }
+
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/SessionSlotCheckIntervalTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/SessionSlotCheckIntervalTest.java
new file mode 100644
index 00000000..79e87532
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/SessionSlotCheckIntervalTest.java
@@ -0,0 +1,103 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import java.io.IOException;
+import java.net.URL;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.HeaderParam;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.onap.portalsdk.core.onboarding.crossapi.SessionCommunicationService;
+import org.onap.portalsdk.core.onboarding.listener.PortalTimeoutHandler;
+import org.onap.portalsdk.core.onboarding.listener.PortalTimeoutHandler.SessionCommInf;
+import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
+import org.onap.portalsdk.core.onboarding.util.PortalApiProperties;
+
+public class SessionSlotCheckIntervalTest {
+
+ private final Log logger = LogFactory.getLog(SessionSlotCheckIntervalTest.class);
+ private static final String timeoutValue = "1";
+ private InMemoryRestServer server;
+
+ @Path("getSessionSlotCheckInterval")
+ public static class RestResource {
+ @GET
+ @Produces(MediaType.APPLICATION_JSON)
+ public String get( @HeaderParam("username") String username,
+ @HeaderParam("password") String password, @HeaderParam("uebkey") String uebkey) {
+ // Expects only an integer, not even a POJO/JSON model.
+ return timeoutValue;
+ }
+ }
+
+ @Before
+ public void before() throws Exception {
+ URL url = new URL(PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REST_URL));
+ server = InMemoryRestServer.create(url.getPort(), new RestResource());
+ }
+
+ @After
+ public void after() throws Exception {
+ server.close();
+ }
+
+ @Test
+ public void testSessionSlot() throws IOException {
+ String url = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REST_URL);
+ String get = SessionCommunicationService.getSessionSlotCheckInterval(url, "userName", "word", "uebKey");
+ Assert.assertTrue(get.equals(timeoutValue));
+ logger.info("Get test yields: " + get);
+ // Similar test via a different path
+ SessionCommInf sc = new PortalTimeoutHandler.SessionComm();
+ Integer i = sc.fetchSessionSlotCheckInterval(url, "userName", "word", "uebKey");
+ Assert.assertTrue(i.toString().equals(timeoutValue));
+ logger.info("Fetched slot-check interval: " + i);
+ }
+
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/UtilTest.java b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/UtilTest.java
new file mode 100644
index 00000000..66a81a04
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/java/org/onap/portalsdk/fw/test/UtilTest.java
@@ -0,0 +1,80 @@
+/*
+ * ============LICENSE_START==========================================
+ * ONAP Portal SDK
+ * ===================================================================
+ * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+ * ===================================================================
+ *
+ * Unless otherwise specified, all software contained herein is licensed
+ * under the Apache License, Version 2.0 (the "License");
+ * you may not use this software except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Unless otherwise specified, all documentation contained herein is licensed
+ * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
+ * you may not use this documentation except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://creativecommons.org/licenses/by/4.0/
+ *
+ * Unless required by applicable law or agreed to in writing, documentation
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END============================================
+ *
+ * ECOMP is a trademark and service mark of AT&T Intellectual Property.
+ */
+
+package org.onap.portalsdk.fw.test;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.junit.Assert;
+import org.junit.Test;
+import org.onap.portalsdk.core.onboarding.exception.CipherUtilException;
+import org.onap.portalsdk.core.onboarding.util.CipherUtil;
+import org.onap.portalsdk.core.onboarding.util.PortalApiConstants;
+import org.onap.portalsdk.core.onboarding.util.PortalApiProperties;
+
+public class UtilTest extends AbstractModelTest {
+
+ private final Log logger = LogFactory.getLog(UtilTest.class);
+
+
+ @Test
+ public void testCipherUtil() throws CipherUtilException {
+ String cipher;
+
+ cipher = CipherUtil.encryptPKC(s1);
+ Assert.assertNotNull(cipher);
+ Assert.assertNotEquals(cipher, s1);
+ Assert.assertEquals(s1, CipherUtil.decryptPKC(cipher));
+
+ cipher = CipherUtil.encryptPKC(s2);
+ Assert.assertNotNull(cipher);
+ Assert.assertNotEquals(cipher, s2);
+ Assert.assertEquals(s2, CipherUtil.decryptPKC(cipher));
+
+ logger.info("CipherUtils tested");
+ }
+
+ @Test
+ public void testProperties() {
+ // Relies on portal.properties file in src/test/resources
+ String val = PortalApiProperties.getProperty(PortalApiConstants.ECOMP_REST_URL);
+ Assert.assertNotNull(val);
+ logger.info("PortalApiProperties tested");
+ }
+
+}
diff --git a/ecomp-sdk/epsdk-fw/src/test/resources/ESAPI.properties b/ecomp-sdk/epsdk-fw/src/test/resources/ESAPI.properties
new file mode 100644
index 00000000..52c39161
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/resources/ESAPI.properties
@@ -0,0 +1,367 @@
+#===========================================================================
+# ESAPI Configuration
+#
+# If true, then print all the ESAPI properties set here when they are loaded.
+# If false, they are not printed. Useful to reduce output when running JUnit tests.
+# If you need to troubleshoot a properties related problem, turning this on may help.
+# This is 'false' in the src/test/resources/.esapi version. It is 'true' by
+# default for reasons of backward compatibility with earlier ESAPI versions.
+ESAPI.printProperties=true
+
+# ESAPI is designed to be easily extensible. You can use the reference implementation
+# or implement your own providers to take advantage of your enterprise's security
+# infrastructure. The functions in ESAPI are referenced using the ESAPI locator, like:
+#
+# String ciphertext =
+# ESAPI.encryptor().encrypt("Secret message"); // Deprecated in 2.0
+# CipherText cipherText =
+# ESAPI.encryptor().encrypt(new PlainText("Secret message")); // Preferred
+#
+# Below you can specify the classname for the provider that you wish to use in your
+# application. The only requirement is that it implement the appropriate ESAPI interface.
+# This allows you to switch security implementations in the future without rewriting the
+# entire application.
+#
+# ExperimentalAccessController requires ESAPI-AccessControlPolicy.xml in .esapi directory
+ESAPI.AccessControl=org.owasp.esapi.reference.DefaultAccessController
+# FileBasedAuthenticator requires users.txt file in .esapi directory
+ESAPI.Authenticator=org.owasp.esapi.reference.FileBasedAuthenticator
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+ESAPI.Encryptor=org.owasp.esapi.reference.crypto.JavaEncryptor
+
+ESAPI.Executor=org.owasp.esapi.reference.DefaultExecutor
+ESAPI.HTTPUtilities=org.owasp.esapi.reference.DefaultHTTPUtilities
+ESAPI.IntrusionDetector=org.owasp.esapi.reference.DefaultIntrusionDetector
+ESAPI.Logger=org.owasp.esapi.reference.JavaLogFactory
+ESAPI.Randomizer=org.owasp.esapi.reference.DefaultRandomizer
+ESAPI.Validator=org.owasp.esapi.reference.DefaultValidator
+
+#===========================================================================
+# ESAPI Authenticator
+#
+Authenticator.AllowedLoginAttempts=3
+Authenticator.MaxOldPasswordHashes=13
+Authenticator.UsernameParameterName=username
+Authenticator.PasswordParameterName=password
+# RememberTokenDuration (in days)
+Authenticator.RememberTokenDuration=14
+# Session Timeouts (in minutes)
+Authenticator.IdleTimeoutDuration=20
+Authenticator.AbsoluteTimeoutDuration=120
+
+#===========================================================================
+# ESAPI Encoder
+#
+# ESAPI canonicalizes input before validation to prevent bypassing filters with encoded attacks.
+# Failure to canonicalize input is a very common mistake when implementing validation schemes.
+# Canonicalization is automatic when using the ESAPI Validator, but you can also use the
+# following code to canonicalize data.
+#
+# ESAPI.Encoder().canonicalize( "%22hello world&#x22;" );
+#
+# Multiple encoding is when a single encoding format is applied multiple times. Allowing
+# multiple encoding is strongly discouraged.
+Encoder.AllowMultipleEncoding=false
+
+# Mixed encoding is when multiple different encoding formats are applied, or when
+# multiple formats are nested. Allowing multiple encoding is strongly discouraged.
+Encoder.AllowMixedEncoding=false
+
+# The default list of codecs to apply when canonicalizing untrusted data. The list should include the codecs
+# for all downstream interpreters or decoders. For example, if the data is likely to end up in a URL, HTML, or
+# inside JavaScript, then the list of codecs below is appropriate. The order of the list is not terribly important.
+Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec
+
+
+#===========================================================================
+# ESAPI Encryption
+#
+# The ESAPI Encryptor provides basic cryptographic functions with a simplified API.
+# To get started, generate a new key using java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
+# There is not currently any support for key rotation, so be careful when changing your key and salt as it
+# will invalidate all signed, encrypted, and hashed data.
+#
+# WARNING: Not all combinations of algorithms and key lengths are supported.
+# If you choose to use a key length greater than 128, you MUST download the
+# unlimited strength policy files and install in the lib directory of your JRE/JDK.
+# See http://java.sun.com/javase/downloads/index.jsp for more information.
+#
+# Backward compatibility with ESAPI Java 1.4 is supported by the two deprecated API
+# methods, Encryptor.encrypt(String) and Encryptor.decrypt(String). However, whenever
+# possible, these methods should be avoided as they use ECB cipher mode, which in almost
+# all circumstances a poor choice because of it's weakness. CBC cipher mode is the default
+# for the new Encryptor encrypt / decrypt methods for ESAPI Java 2.0. In general, you
+# should only use this compatibility setting if you have persistent data encrypted with
+# version 1.4 and even then, you should ONLY set this compatibility mode UNTIL
+# you have decrypted all of your old encrypted data and then re-encrypted it with
+# ESAPI 2.0 using CBC mode. If you have some reason to mix the deprecated 1.4 mode
+# with the new 2.0 methods, make sure that you use the same cipher algorithm for both
+# (256-bit AES was the default for 1.4; 128-bit is the default for 2.0; see below for
+# more details.) Otherwise, you will have to use the new 2.0 encrypt / decrypt methods
+# where you can specify a SecretKey. (Note that if you are using the 256-bit AES,
+# that requires downloading the special jurisdiction policy files mentioned above.)
+#
+# ***** IMPORTANT: Do NOT forget to replace these with your own values! *****
+# To calculate these values, you can run:
+# java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
+#
+Encryptor.MasterKey=tzfztf56ftv
+Encryptor.MasterSalt=123456ztrewq
+
+# Provides the default JCE provider that ESAPI will "prefer" for its symmetric
+# encryption and hashing. (That is it will look to this provider first, but it
+# will defer to other providers if the requested algorithm is not implemented
+# by this provider.) If left unset, ESAPI will just use your Java VM's current
+# preferred JCE provider, which is generally set in the file
+# "$JAVA_HOME/jre/lib/security/java.security".
+#
+# The main intent of this is to allow ESAPI symmetric encryption to be
+# used with a FIPS 140-2 compliant crypto-module. For details, see the section
+# "Using ESAPI Symmetric Encryption with FIPS 140-2 Cryptographic Modules" in
+# the ESAPI 2.0 Symmetric Encryption User Guide, at:
+# http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/esapi4java-core-2.0-symmetric-crypto-user-guide.html
+# However, this property also allows you to easily use an alternate JCE provider
+# such as "Bouncy Castle" without having to make changes to "java.security".
+# See Javadoc for SecurityProviderLoader for further details. If you wish to use
+# a provider that is not known to SecurityProviderLoader, you may specify the
+# fully-qualified class name of the JCE provider class that implements
+# java.security.Provider. If the name contains a '.', this is interpreted as
+# a fully-qualified class name that implements java.security.Provider.
+#
+# NOTE: Setting this property has the side-effect of changing it in your application
+# as well, so if you are using JCE in your application directly rather than
+# through ESAPI (you wouldn't do that, would you? ;-), it will change the
+# preferred JCE provider there as well.
+#
+# Default: Keeps the JCE provider set to whatever JVM sets it to.
+Encryptor.PreferredJCEProvider=
+
+# AES is the most widely used and strongest encryption algorithm. This
+# should agree with your Encryptor.CipherTransformation property.
+# By default, ESAPI Java 1.4 uses "PBEWithMD5AndDES" and which is
+# very weak. It is essentially a password-based encryption key, hashed
+# with MD5 around 1K times and then encrypted with the weak DES algorithm
+# (56-bits) using ECB mode and an unspecified padding (it is
+# JCE provider specific, but most likely "NoPadding"). However, 2.0 uses
+# "AES/CBC/PKCSPadding". If you want to change these, change them here.
+# Warning: This property does not control the default reference implementation for
+# ESAPI 2.0 using JavaEncryptor. Also, this property will be dropped
+# in the future.
+# @deprecated
+Encryptor.EncryptionAlgorithm=AES
+# For ESAPI Java 2.0 - New encrypt / decrypt methods use this.
+Encryptor.CipherTransformation=AES/CBC/PKCS5Padding
+
+# Applies to ESAPI 2.0 and later only!
+# Comma-separated list of cipher modes that provide *BOTH*
+# confidentiality *AND* message authenticity. (NIST refers to such cipher
+# modes as "combined modes" so that's what we shall call them.) If any of these
+# cipher modes are used then no MAC is calculated and stored
+# in the CipherText upon encryption. Likewise, if one of these
+# cipher modes is used with decryption, no attempt will be made
+# to validate the MAC contained in the CipherText object regardless
+# of whether it contains one or not. Since the expectation is that
+# these cipher modes support support message authenticity already,
+# injecting a MAC in the CipherText object would be at best redundant.
+#
+# Note that as of JDK 1.5, the SunJCE provider does not support *any*
+# of these cipher modes. Of these listed, only GCM and CCM are currently
+# NIST approved. YMMV for other JCE providers. E.g., Bouncy Castle supports
+# GCM and CCM with "NoPadding" mode, but not with "PKCS5Padding" or other
+# padding modes.
+Encryptor.cipher_modes.combined_modes=GCM,CCM,IAPM,EAX,OCB,CWC
+
+# Applies to ESAPI 2.0 and later only!
+# Additional cipher modes allowed for ESAPI 2.0 encryption. These
+# cipher modes are in _addition_ to those specified by the property
+# 'Encryptor.cipher_modes.combined_modes'.
+# Note: We will add support for streaming modes like CFB & OFB once
+# we add support for 'specified' to the property 'Encryptor.ChooseIVMethod'
+# (probably in ESAPI 2.1).
+# DISCUSS: Better name?
+Encryptor.cipher_modes.additional_allowed=CBC
+
+# 128-bit is almost always sufficient and appears to be more resistant to
+# related key attacks than is 256-bit AES. Use '_' to use default key size
+# for cipher algorithms (where it makes sense because the algorithm supports
+# a variable key size). Key length must agree to what's provided as the
+# cipher transformation, otherwise this will be ignored after logging a
+# warning.
+#
+# NOTE: This is what applies BOTH ESAPI 1.4 and 2.0. See warning above about mixing!
+Encryptor.EncryptionKeyLength=128
+
+# Because 2.0 uses CBC mode by default, it requires an initialization vector (IV).
+# (All cipher modes except ECB require an IV.) There are two choices: we can either
+# use a fixed IV known to both parties or allow ESAPI to choose a random IV. While
+# the IV does not need to be hidden from adversaries, it is important that the
+# adversary not be allowed to choose it. Also, random IVs are generally much more
+# secure than fixed IVs. (In fact, it is essential that feed-back cipher modes
+# such as CFB and OFB use a different IV for each encryption with a given key so
+# in such cases, random IVs are much preferred. By default, ESAPI 2.0 uses random
+# IVs. If you wish to use 'fixed' IVs, set 'Encryptor.ChooseIVMethod=fixed' and
+# uncomment the Encryptor.fixedIV.
+#
+# Valid values: random|fixed|specified 'specified' not yet implemented; planned for 2.1
+Encryptor.ChooseIVMethod=random
+# If you choose to use a fixed IV, then you must place a fixed IV here that
+# is known to all others who are sharing your secret key. The format should
+# be a hex string that is the same length as the cipher block size for the
+# cipher algorithm that you are using. The following is an *example* for AES
+# from an AES test vector for AES-128/CBC as described in:
+# NIST Special Publication 800-38A (2001 Edition)
+# "Recommendation for Block Cipher Modes of Operation".
+# (Note that the block size for AES is 16 bytes == 128 bits.)
+#
+Encryptor.fixedIV=0x000102030405060708090a0b0c0d0e0f
+
+# Whether or not CipherText should use a message authentication code (MAC) with it.
+# This prevents an adversary from altering the IV as well as allowing a more
+# fool-proof way of determining the decryption failed because of an incorrect
+# key being supplied. This refers to the "separate" MAC calculated and stored
+# in CipherText, not part of any MAC that is calculated as a result of a
+# "combined mode" cipher mode.
+#
+# If you are using ESAPI with a FIPS 140-2 cryptographic module, you *must* also
+# set this property to false.
+Encryptor.CipherText.useMAC=true
+
+# Whether or not the PlainText object may be overwritten and then marked
+# eligible for garbage collection. If not set, this is still treated as 'true'.
+Encryptor.PlainText.overwrite=true
+
+# Do not use DES except in a legacy situations. 56-bit is way too small key size.
+#Encryptor.EncryptionKeyLength=56
+#Encryptor.EncryptionAlgorithm=DES
+
+# TripleDES is considered strong enough for most purposes.
+# Note: There is also a 112-bit version of DESede. Using the 168-bit version
+# requires downloading the special jurisdiction policy from Sun.
+#Encryptor.EncryptionKeyLength=168
+#Encryptor.EncryptionAlgorithm=DESede
+
+Encryptor.HashAlgorithm=SHA-512
+Encryptor.HashIterations=1024
+Encryptor.DigitalSignatureAlgorithm=SHA1withDSA
+Encryptor.DigitalSignatureKeyLength=1024
+Encryptor.RandomAlgorithm=SHA1PRNG
+Encryptor.CharacterEncoding=UTF-8
+
+# This is the Pseudo Random Function (PRF) that ESAPI's Key Derivation Function
+# (KDF) normally uses. Note this is *only* the PRF used for ESAPI's KDF and
+# *not* what is used for ESAPI's MAC. (Currently, HmacSHA1 is always used for
+# the MAC, mostly to keep the overall size at a minimum.)
+#
+# Currently supported choices for JDK 1.5 and 1.6 are:
+# HmacSHA1 (160 bits), HmacSHA256 (256 bits), HmacSHA384 (384 bits), and
+# HmacSHA512 (512 bits).
+# Note that HmacMD5 is *not* supported for the PRF used by the KDF even though
+# the JDKs support it. See the ESAPI 2.0 Symmetric Encryption User Guide
+# further details.
+Encryptor.KDF.PRF=HmacSHA256
+#===========================================================================
+# ESAPI Logging
+# Set the application name if these logs are combined with other applications
+Logger.ApplicationName=Ecompportal_application
+# If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true
+Logger.LogEncodingRequired=false
+# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.
+Logger.LogApplicationName=true
+# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
+Logger.LogServerIP=true
+# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you
+# want to place it in a specific directory.
+Logger.LogFileName=Ecompportal_ESAPI_logging_file
+# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
+Logger.MaxLogFileSize=10000000
+
+
+#===========================================================================
+# ESAPI Intrusion Detection
+#
+# Each event has a base to which .count, .interval, and .action are added
+# The IntrusionException will fire if we receive "count" events within "interval" seconds
+# The IntrusionDetector is configurable to take the following actions: log, logout, and disable
+# (multiple actions separated by commas are allowed e.g. event.test.actions=log,disable
+#
+# Custom Events
+# Names must start with "event." as the base
+# Use IntrusionDetector.addEvent( "test" ) in your code to trigger "event.test" here
+# You can also disable intrusion detection completely by changing
+# the following parameter to true
+#
+IntrusionDetector.Disable=false
+#
+IntrusionDetector.event.test.count=2
+IntrusionDetector.event.test.interval=10
+IntrusionDetector.event.test.actions=disable,log
+
+# Exception Events
+# All EnterpriseSecurityExceptions are registered automatically
+# Call IntrusionDetector.getInstance().addException(e) for Exceptions that do not extend EnterpriseSecurityException
+# Use the fully qualified classname of the exception as the base
+
+# any intrusion is an attack
+IntrusionDetector.org.owasp.esapi.errors.IntrusionException.count=1
+IntrusionDetector.org.owasp.esapi.errors.IntrusionException.interval=1
+IntrusionDetector.org.owasp.esapi.errors.IntrusionException.actions=log,disable,logout
+
+# for test purposes
+# CHECKME: Shouldn't there be something in the property name itself that designates
+# that these are for testing???
+IntrusionDetector.org.owasp.esapi.errors.IntegrityException.count=10
+IntrusionDetector.org.owasp.esapi.errors.IntegrityException.interval=5
+IntrusionDetector.org.owasp.esapi.errors.IntegrityException.actions=log,disable,logout
+
+# rapid validation errors indicate scans or attacks in progress
+# org.owasp.esapi.errors.ValidationException.count=10
+# org.owasp.esapi.errors.ValidationException.interval=10
+# org.owasp.esapi.errors.ValidationException.actions=log,logout
+
+# sessions jumping between hosts indicates session hijacking
+IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.count=2
+IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.interval=10
+IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.actions=log,logout
+
+
+#===========================================================================
+# ESAPI Validation
+#
+# The ESAPI Validator works on regular expressions with defined names. You can define names
+# either here, or you may define application specific patterns in a separate file defined below.
+# This allows enterprises to specify both organizational standards as well as application specific
+# validation rules.
+#
+Validator.ConfigurationFile=validation.properties
+Validator.ConfigurationFile.MultiValued=false
+
+# Validators used by ESAPI
+Validator.AccountName=^[a-zA-Z0-9]{3,20}$
+Validator.SystemCommand=^[a-zA-Z\\-\\/]{1,64}$
+Validator.RoleName=^[a-z]{1,20}$
+
+#the word TEST below should be changed to your application
+#name - only relative URL's are supported
+Validator.Redirect=^\\/test.*$
+
+# Global HTTP Validation Rules
+# Values with Base64 encoded data (e.g. encrypted state) will need at least [a-zA-Z0-9\/+=]
+Validator.HTTPScheme=^(http|https)$
+Validator.HTTPServerName=^[a-zA-Z0-9_.\\-]*$
+Validator.HTTPParameterName=^[a-zA-Z0-9_]{1,32}$
+Validator.HTTPParameterValue=^[a-zA-Z0-9.\\-\\/+=@_ ]*$
+Validator.HTTPCookieName=^[a-zA-Z0-9\\-_]{1,32}$
+Validator.HTTPCookieValue=^[a-zA-Z0-9\\-\\/+=_ ]*$
+Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,32}$
+Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
+Validator.HTTPContextPath=^\\/?[a-zA-Z0-9.\\-\\/_]*$
+Validator.HTTPServletPath=^[a-zA-Z0-9.\\-\\/_]*$
+Validator.HTTPPath=^[a-zA-Z0-9.\\-_]*$
+Validator.HTTPQueryString=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ %]*$
+Validator.HTTPURI=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
+Validator.HTTPURL=^.*$
+Validator.HTTPJSESSIONID=^[A-Z0-9]{10,30}$
+
+# Validation of file related input
+Validator.FileName=^[a-zA-Z0-9!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
+Validator.DirectoryName=^[a-zA-Z0-9:/\\\\!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
diff --git a/ecomp-sdk/epsdk-fw/src/test/resources/key.properties b/ecomp-sdk/epsdk-fw/src/test/resources/key.properties
new file mode 100644
index 00000000..aa3355d1
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/resources/key.properties
@@ -0,0 +1,41 @@
+###
+# ============LICENSE_START==========================================
+# ONAP Portal SDK
+# ===================================================================
+# Copyright © 2017 AT&T Intellectual Property. All rights reserved.
+# ===================================================================
+#
+# Unless otherwise specified, all software contained herein is licensed
+# under the Apache License, Version 2.0 (the “License”);
+# you may not use this software except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Unless otherwise specified, all documentation contained herein is licensed
+# under the Creative Commons License, Attribution 4.0 Intl. (the “License”);
+# you may not use this documentation except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://creativecommons.org/licenses/by/4.0/
+#
+# Unless required by applicable law or agreed to in writing, documentation
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# ============LICENSE_END============================================
+#
+# ECOMP is a trademark and service mark of AT&T Intellectual Property.
+###
+
+# Properties read by the ECOMP Framework library (epsdk-fw)
+
+cipher.enc.key = AGLDdG4D04BKm2IxIWEr8o== \ No newline at end of file
diff --git a/ecomp-sdk/epsdk-fw/src/test/resources/portal.properties b/ecomp-sdk/epsdk-fw/src/test/resources/portal.properties
new file mode 100644
index 00000000..15bedc9a
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/resources/portal.properties
@@ -0,0 +1,3 @@
+# for testing only
+ecomp_rest_url = http://localhost:55155
+ueb_app_key = 123abc
diff --git a/ecomp-sdk/epsdk-fw/src/test/resources/validation.properties b/ecomp-sdk/epsdk-fw/src/test/resources/validation.properties
new file mode 100644
index 00000000..b275093f
--- /dev/null
+++ b/ecomp-sdk/epsdk-fw/src/test/resources/validation.properties
@@ -0,0 +1,32 @@
+# The ESAPI validator does many security checks on input, such as canonicalization
+# and whitelist validation. Note that all of these validation rules are applied *after*
+# canonicalization. Double-encoded characters (even with different encodings involved,
+# are never allowed.
+#
+# To use:
+#
+# First set up a pattern below. You can choose any name you want, prefixed by the word
+# "Validation." For example:
+# Validation.Email=^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$
+#
+# Then you can validate in your code against the pattern like this:
+# ESAPI.validator().isValidInput("User Email", input, "Email", maxLength, allowNull);
+# Where maxLength and allowNull are set for you needs, respectively.
+#
+# But note, when you use boolean variants of validation functions, you lose critical
+# canonicalization. It is preferable to use the "get" methods (which throw exceptions) and
+# and use the returned user input which is in canonical form. Consider the following:
+#
+# try {
+# someObject.setEmail(ESAPI.validator().getValidInput("User Email", input, "Email", maxLength, allowNull));
+#
+Validator.SafeString=^[.\\p{Alnum}\\p{Space}]{0,1024}$
+#Given the discussion: https://github.com/ESAPI/esapi-java-legacy/issues/374, a better upper-bound for domain name
+#was selected as 62. This is slightly under the length in RFC-1035
+Validator.Email=^[A-Za-z0-9._%'-]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,62}$
+Validator.Gmail=^[A-Za-z0-9._%'-+]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,62}$
+Validator.IPAddress=^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+#Validator.URL=^(?:ht|f)tp(s?+)\\:\\/\\/[0-9a-zA-Z](?:[-.\\w]*[0-9a-zA-Z])*(?::(?:0-9)*)*(?:\\/?+)(?:[a-zA-Z0-9\\-\\.\\?\\,\\:\\'\\/\\\\\\+=&amp;%\\$#_]*)?+$
+Validator.URL=^(?:ht|f)tp(?:s?)(?:[:A-Za-z0-9%/#?&.=-]*)$
+Validator.CreditCard=^(\\d{4}[- ]?){3}\\d{4}$
+Validator.SSN=^(?!000)([0-6]\\d{2}|7([0-6]\\d|7[012]))([ -]?)(?!00)\\d\\d\\3(?!0000)\\d{4}$ \ No newline at end of file