<commit_before>/*

   Derby - Class 
      org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest

   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

 */

package org.apache.derbyTesting.functionTests.tests.derbynet;

import java.lang.reflect.*;
import java.net.InetAddress;
import java.util.HashMap;
import java.util.Iterator;

import java.security.AccessController;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.CallableStatement;
import java.sql.Statement;
import java.sql.SQLException;
import java.sql.DriverManager;
import javax.sql.DataSource;
import javax.sql.ConnectionPoolDataSource;
import javax.sql.PooledConnection;

import org.apache.derby.drda.NetworkServerControl;

import org.apache.derbyTesting.junit.BaseJDBCTestCase;
import org.apache.derbyTesting.junit.DatabasePropertyTestSetup;
import org.apache.derbyTesting.junit.J2EEDataSource;
import org.apache.derbyTesting.junit.JDBCDataSource;
import org.apache.derbyTesting.junit.NetworkServerTestSetup;
import org.apache.derbyTesting.junit.TestConfiguration;

import junit.framework.Test;
import junit.framework.TestSuite;

/**
 * This class tests the security mechanisms supported by Network Server
 * Network server supports SECMEC_EUSRIDPWD, SECMEC_USRIDPWD, SECMEC_USRIDONL
 * and SECMEC_USRSSBPWD.
 * 
 * -----------------------------------------------------------------
 * Security Mechanism | secmec           | User friendly name   
 *                    |  codepoint value |
 * -----------------------------------------------------------------
 * USRIDONL           | 0x04             | USER_ONLY_SECURITY
 * USRIDPWD           | 0x03             | CLEAR_TEXT_PASSWORD_SECURITY
 * EUSRIDPWD          | 0x09             | ENCRYPTED_USER_AND_PASSWORD_SECURITY
 * USRSSBPWD          | 0x08             | STRONG_PASSWORD_SUBSTITUTE_SECURITY
 * -----------------------------------------------------------------
 * 
 * Key points: 
 * #1) Server and client support encrypted userid/password (EUS<PASSWORD>PWD) via the
 * use of Diffie Helman key-agreement protocol - but current Open Group DRDA
 * specifications imposes small prime and base generator values (256 bits) that
 * prevents other JCE's to be used as java cryptography providers - typical
 * minimum security requirements is usually of 1024 bits (512-bit absolute
 * minimum) when using DH key-agreement protocol to generate a session key.
 * 
 * (Reference: DDM manual, page 281 and 282. Section: Generating the shared
 * private key. DRDA's diffie helman agreed public values for prime are 256
 * bits. The spec gives the public values for the prime, generator and the size
 * of exponent required for DH . These values must be used as is to generate a
 * shared private key.)
 * 
 * Encryption is done using JCE. Hence JCE support of the necessary algorithm
 * is required for a particular security mechanism to work. Thus even though 
 * the server and client have code to support EUSRIDPWD, this security 
 * mechanism will not work in all JVMs.
 * 
 * JVMs where support for DH(32byte prime) is not available and thus EUSRIDPWD
 * won't work are Sun JVM (versions 1.3.1,1.4.1,1.4.2,1.5) and IBM JVM (
 * versions 1.3.1 and some old versions of 1.4.2 (in 2004))
 * 
 * JVMs where support for DH(32bytes prime) is available and thus EUSRIDPWD 
 * will work are IBM JVM [versions 1.4.1, later versions of 1.4.2 (from 2005),
 * 1.5]
 * 
 * #2) JCC 2.6 client does some automatic upgrade of security mechanism in one
 * case. Logic is  as follows:
 * If client sends USRIDPWD to server and server rejects this
 * and says it accepts only EUSRIDPWD, in that case JCC 2.6 will upgrade the 
 * security mechanism to EUSRIDPWD and retry the request with EUSRIDPWD.
 * This switching will also override the security mechanism specified by user.
 * Thus if JCC client is running with Sun JVM 1.4.2 and even though Sun JCE
 * does not have support for algorithms needed for  EUSRIDPWD, the JCC client
 * will still try to switch to  EUSRIDPWD and throw an exception with 
 * ClassNotFoundException for the IBM JCE.
 *
 * - Default security mechanism is USRIDPWD(0x03)
 * - If securityMechanism is not explicitly specified on connection request 
 *   and if no user specified, an exception is thrown - Null userid not 
 *   supported
 * - If securityMechanism is not explicitly specified on connection request, 
 *   and if no password is specified, an exception is thrown - null password
 *   not supported
 *   If securityMechanism is explicitly specified to be USRIDONL,  then a
 *   password is not required. But in other cases (<PASSWORD>, <PASSWORD>, 
 *   USR<PASSWORD>WD) if password is null, an exception with the message 'a null
 *   password not valid' will be thrown.
 * - On datasource, setting a security mechanism works. It also allows a 
 *   security mechanism of USRIDONL to be set on datasource unlike jcc 2.4.
 * 
 * #3)JCC 2.4 client behavior 
 * Default security mechanism used is USRIDPWD (0x03)
 * If securityMechanism is not explicitly specified on connection request, and
 * if no user is specified, an exception is thrown - Null userid not supported.
 * If securityMechanism is not explicitly specified on connection request, and
 * if no password is specified, an exception is thrown - null password not
 * supported.
 * If security mechanism is specified, jcc client will not override the 
 * security mechanism.
 * If securityMechanism is explicitly specified to be USRIDONL, then a password
 * is not required. But in other cases (EUSRIDPWD,USRIDPWD) if password is null
 * an exception with the message 'a null password not valid' will be thrown.
 * On datasource, setting a security mechanism does not work (bug). It defaults
 * to USRIDPWD.  Setting a value of USRIDONL or EUSRIDPWD does not seem to have
 * an effect.
 * 
 * #4) Note, if  server restricts the client connections based on security 
 * mechanism by setting derby.drda.securityMechanism, in that case the clients 
 * will see an error similar to this:
 * "Connection authorization failure occurred. Reason: security mechanism not
 *  supported"
 *
 * #5) USRSSBPWD - Strong password substitute is only supported starting from
 *     Apache Derby 10.2.
 *	 NOTE: USRSSBPWD only works with the derby network client driver for now.
 *   ---- 
 */
public class NSSecurityMechanismTest extends BaseJDBCTestCase
{
    // values for derby.drda.securityMechanism property
    private static String[] derby_drda_securityMechanisms = {
        null, // not set 
        "USER_ONLY_SECURITY", "CLEAR_TEXT_PASSWORD_SECURITY",
        // this will give a DRDA_InvalidValue with jvms that do not support it
        "ENCRYPTED_USER_AND_PASSWORD_SECURITY",
        "STRONG_PASSWORD_SUBSTITUTE_SECURITY",
        //these two are always invalid values, again, will give DRDA_InvalidValue
        "INVALID_VALUE", ""};
    
    private static String derby_drda_securityMechanism;

    // possible interesting combinations with respect to security mechanism
    // upgrade logic for user attribute
    private static String[] USER_ATTRIBUTE = {"calvin",null};

    // possible interesting combinations with respect to security mechanism
    // upgrade logic for password attribute
    private static String[] PWD_ATTRIBUTE = {"<PASSWORD>",null};

    public NSSecurityMechanismTest(String name)
    {
        super(name);
    }
    
    public static Test suite() 
    {
        TestSuite suite = new TestSuite("NSSecurityMechanismTest");

        TestSuite clientSuite =
            new TestSuite("NSSecurityMechanismTest - client");
        clientSuite.addTest(new NSSecurityMechanismTest(
            "testNetworkServerSecurityMechanism"));
        suite.addTest(TestConfiguration.clientServerDecorator(clientSuite));

        // Test case for embedded mode. Enable builtin authentication.
        suite.addTest(
            DatabasePropertyTestSetup.builtinAuthentication(
                new NSSecurityMechanismTest("testSecurityMechanismOnEmbedded"),
                new String[] { "calvin" }, "pw"));

        return suite;
    }
    
    public void tearDown() throws Exception {
        try {
            AccessController.doPrivileged
            (new java.security.PrivilegedAction(){
                public Object run(){
                    return System.getProperties().remove(
                            "derby.drda.securityMechanism");
                }
            });
        } catch (Exception e) {
            fail("warning: could not remove secmec settings");
        }
        super.tearDown();
    }

    // Indicates userid/encrypted password security mechanism.
    static final short SECMEC_EUSRIDPWD = 0x09;

    // Indicates userid only security mechanism.
    static final short SECMEC_USRIDONL = 0x04;

    // Indicates userid/encrypted password security mechanism.
    static final short SECMEC_USRENCPWD = 0x07;

    // Indicates userid/new password security mechanism.
    static final short SECMEC_USRIDNWPWD = 0x05;

    // Indicates userid/password security mechanism.
    static final short SECMEC_USRIDPWD = 0x03;

    // Indicates strong password substitute security mechanism.
    static final short SECMEC_USRSSBPWD = 0x08;

    // client and server recognize these secmec values
    private static short[] SECMEC_ATTRIBUTE = {
        SECMEC_USRIDONL,
        SECMEC_USRIDPWD,
        SECMEC_EUSRIDPWD,
        SECMEC_USRSSBPWD
    };

    /**
     *  Test cases for security mechanism
     *  ---------------------------------------------------------------
     *  DriverManager:
     *  T1 - default , no user      PASS (for derbyclient)
     *  T2 - user only              PASS (for derbyclient)
     *  T3 - user,password          PASS (only for derbynet)
     *  T4 - user,password, security mechanism not set  FAIL
     *  T5 - user,password, security mechanism set
     *       to SECMEC_EUSRIDPWD  PASS/FAIL
     *       (Fails with Sun JVM as EUSRIDPWD secmec cannot be used)
     *  T6 - user, security mechanism set to SECMEC_USRIDONL   PASS
     *  T7 - user,password, security mechanism set to SECMEC_USRENCPWD  FAIL
     *  Test with datasource as well as DriverManager
     *  T8 - user,password security mechanism set to SECMEC_USRIDONL   PASS
     *  T9 - user,password security mechanism set to SECMEC_USRSSBPWD  PASS
     *  Test with datasource as well as DriverManager
     * Note, that with DERBY-928, the pass/fail for the connections will depend 
     * on the security mechanism specified at the server by property 
     * derby.drda.securityMechanism.  Please check out the following
     * html file http://issues.apache.org/jira/secure/attachment/12322971/Derby928_Table_SecurityMechanisms..htm
     * for a combination of url/security mechanisms and the expected results 
     */
    public void testNetworkServerSecurityMechanism() throws SQLException, Exception
    {
        String[][] allDriverManagerExpectedValues = {
            {"null",
                "OK","OK","OK","OK","OK","OK","?","OK","OK"},
            {"USER_ONLY_SECURITY",
                "OK","OK","08004","08004","08004","OK","?","OK","08004"},
            {"CLEAR_TEXT_PASSWORD_SECURITY",
                "08004","08004","OK","OK","08004","08004",
                "?","08004","08004"},
            // this should give a DRDA_InvalidValue with jvms that do not
            // support it. For instance, it will fail with jdk14 jvms.
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","08004","08004","OK","08004",
                "?","08004","08004"},
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                    "08004","08004","08004","08004","08004","08004",
                    "?","08004","OK"},
            };
        
        String[][] allDataSourceExpectedValues = {
            {null,"OK","OK","OK","OK"},
            {"USER_ONLY_SECURITY","OK","08004","08004","08004"},
            {"CLEAR_TEXT_PASSWORD_SECURITY","08004","OK","08004","08004"},
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","OK","08004"},
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                "08004","08004","08004","OK"}};
        
        String[] DERBY1080ExpectedValues = {"OK","08004","08004","OK","08004"};
        
        String[][] allUserPwdSecMecExpectedValues = {
            // if secmec is null, all expected to pass.
            {null},
            {"USER_ONLY_SECURITY",
                "08004","OK","08004","08004","08004", 
                "OK","OK","08001.C.8","08001.C.8","08001.C.8",
                "08004","OK","08004","08004","08004",
                "OK","OK","08001.C.8","08001.C.8","08001.C.8"
            },
            {"CLEAR_TEXT_PASSWORD_SECURITY",
                "OK","08004","OK","08004","08004", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "OK","08004","OK","08004","08004",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            },
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","08004","OK","08004", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "08004","08004","08004","OK","08004",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            },
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                "08004","08004","08004","08004","OK", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "08004","08004","08004","08004","OK",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            }
        };
        
        String[] testDERBY528ExpectedValues = {
            null,"08006","OK","08004","08006"
        };
        
        // just to see if this will work
        getConnection().getAutoCommit();
        
        for ( int i = 0; i < derby_drda_securityMechanisms.length; i++)
        {   
            derby_drda_securityMechanism = derby_drda_securityMechanisms[i];

            // Using 'null' will give a nullpointer exception...
            // as it's the first in the array, it should use default setting
            if (derby_drda_securityMechanism != null)
            {
                // with "" or "INVALID_VALUE", or with other mechanisms with
                // certain jvms, some settings are not supported. Flag the loop
                // to not try connections
                if (setSecurityMechanism(derby_drda_securityMechanism))
                    continue;
            }
            // Test cases with get connection via drivermanager and via
            // datasource, using different security mechanisms.
            // Network server supports SECMEC_USRIDPWD, SECMEC_USRIDONL,
            // SECMEC_EUSRIDPWD and USRSSBPWD (derby network client only)

            assertConnectionsUsingDriverManager(
                allDriverManagerExpectedValues[i]);
            
            assertConnectionUsingDataSource(allDataSourceExpectedValues[i]);

            // regression test for DERBY-1080
            assertDerby1080Fixed(DERBY1080ExpectedValues[i]);

            // test for DERBY-962
            // test all combinations of user/password with security mechanism
            assertAllCombinationsOfUserPasswordSecMecInputOK(
                allUserPwdSecMecExpectedValues[i]);

            // test USRSSBPWD (DERBY-528) with Derby BUILTIN authentication 
            // scheme both with none and USRSSBPWD specified DRDA SecMec upon
            // starting the network server.
            if ((derby_drda_securityMechanism == null) ||
                (derby_drda_securityMechanism.equals(
                "STRONG_PASSWORD_SUBSTITUTE_SECURITY")))
            {
                assertUSRSSBPWD_with_BUILTIN(testDERBY528ExpectedValues);
            }
            else
            {
                // shutdown the database - this will prevent slow startup 
                // when bouncing the server with next security mechanism.
                // for ENCRYPTED_USER_AND_PASSWORD_SECURITY:
                short secmeccode=SECMEC_EUSRIDPWD;
                if (derby_drda_securityMechanism.equals("USER_ONLY_SECURITY"))
                    secmeccode=SECMEC_USRIDONL;
                else if (derby_drda_securityMechanism.equals(
                    "CLEAR_TEXT_PASSWORD_SECURITY"))
                    secmeccode=SECMEC_USRIDPWD;
                assertConnectionUsingDriverManager(getJDBCUrl(
                    "user=APP;password=<PASSWORD>;shutdown=true;securityMechanism=" +
                    secmeccode)," BUILTIN (T5):",
                    "08006");
            }
        }
    }

    /**
     * Test that securityMechanism=8 is ignored by the embedded driver
     * (DERBY-3025).
     */
    public void testSecurityMechanismOnEmbedded() throws SQLException {
        DataSource ds = JDBCDataSource.getDataSource();
        JDBCDataSource.setBeanProperty(
            ds, "connectionAttributes", "securityMechanism=8");

        // DERBY-3025: NullPointerException or AssertFailure was thrown here
        Connection c = ds.getConnection("calvin", "calvinpw");

        c.close();
    }

    // returns a boolean true if the security mechanism is not supported
    // so the loop in which this is called can be continued without
    // causing unnecessary/impossible tests to be run
    private boolean setSecurityMechanism(String derby_security_mechanism) 
    throws Exception {
        try {
        // getting a networkservercontrol to shutdown the currently running 
        // server, before setting the next security mechanism
        NetworkServerControl server = new NetworkServerControl(
            InetAddress.getByName(
                TestConfiguration.getCurrent().getHostName()),
                TestConfiguration.getCurrent().getPort());

        // shut down the server
        server.shutdown();
        } catch (Exception e) {
            if (!(e.getMessage().substring(0,17).equals("DRDA_InvalidValue")))
            {
                fail("unexpected error");
            }
        }

        try {
            AccessController.doPrivileged
            (new java.security.PrivilegedAction(){
                public Object run(){
                    return System.setProperty(
                        "derby.drda.securityMechanism",
                        derby_drda_securityMechanism);
                }
            });
            
            // if the security mechanism isn't supported or invalid, getting a
            // networkservercontrol will fail.
            NetworkServerControl server2 = new NetworkServerControl(
                InetAddress.getByName(
                    TestConfiguration.getCurrent().getHostName()),
                    TestConfiguration.getCurrent().getPort());

            // For debugging, to make output come to console uncomment:
            //server2.start(new PrintWriter(System.out, true));
            // and comment out:
            server2.start(null);
            NetworkServerTestSetup.waitForServerStart(server2);
            
            if (derby_drda_securityMechanism.equals("") ||
                derby_drda_securityMechanism.equals("INVALID_VALUE"))
            {
                fail(
                    "expected server not to start with invalid or empty " +
                     "security mechanism, but passed");
            }
        } catch (Exception e) {
            // "" or "INVALID_VALUE" should always give DRDA_Invalid_Value, 
            // hence the 'fail' above.
            // However, other mechanisms may not be supported with certain
            // jvms, and then also will get the same exception. This is true
            // for ENCRYPTED_USER_AND_PASSWORD_SECURITY.
            // If we're not getting DRDA_Invalid_Value here, something's gone
            // wrong.
            if (derby_drda_securityMechanism.equals("") ||
                derby_drda_securityMechanism.equals("INVALID_VALUE") ||
                derby_drda_securityMechanism.equals(
                    "ENCRYPTED_USER_AND_PASSWORD_SECURITY"))
            {
                // should give invalid value 
                assertEquals("DRDA_InvalidValue",e.getMessage().substring(0,17));
                return true;
            }
            fail ("got unexpected exception setting the mechanism " + 
                derby_security_mechanism + "; message: " + e.getMessage());
        }
        return false;
    }

    private void assertConnectionsUsingDriverManager(String[] expectedValues)
    {
        assertConnectionUsingDriverManager(
            getJDBCUrl(null),"T1:", expectedValues[1]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=max"),"T2:", expectedValues[2]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>"),"T3:", expectedValues[3]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_USRIDPWD),"T4:", expectedValues[4]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_EUSRIDPWD),"T5:", expectedValues[5]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;securityMechanism=" +
            SECMEC_USRIDONL),"T6:", expectedValues[6]);

        // disable as ibm142 and sun jce doesnt support DH prime of 32 bytes
        //assertConnectionUsingDriverManager(
        //    getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
        //    SECMEC_USRENCPWD),"T7:", expectedValues[7]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_USRIDONL),"T8:", expectedValues[8]);
        // Test strong password substitute DRDA security mechanism 
        // (only works with DerbyClient driver right now)
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_USRSSBPWD),"T9:", expectedValues[9]);
    }
    
    
    /**
     * Get connection from datasource and also set security mechanism
     */
    private void assertConnectionUsingDataSource(String[] expectedValues)
    {
        // Note: bug in jcc, throws error with null password
        if (usingDerbyNetClient())
        {
            assertSecurityMechanismOK("sarah",null, new Short(
                SECMEC_USRIDONL),"SECMEC_USRIDONL:", expectedValues[1]);
        }
        assertSecurityMechanismOK("john","sarah", new Short(
            SECMEC_USRIDPWD),"SECMEC_USRIDPWD:", expectedValues[2]);

        // Possible bug in JCC, hence disable this test for JCC framework only
        // the security mechanism when set on JCC datasource does not seem to 
        // have an effect. JCC driver is sending a secmec of 3( USRIDPWD) to 
        // the server even though the security mechanism on datasource is set to 
        // EUSRIDPWD (9)
        if (usingDerbyNetClient())
        {
            // Please note: EUSRIDPWD security mechanism in DRDA uses 
            // Diffie-Helman for generation of shared keys. The spec specifies
            // the prime to use for DH which is 32 bytes and this needs to be
            // used as is.
            // Sun JCE does not support a prime of 32 bytes for Diffie Helman
            // nor do some older versions of IBM JCE (1.4.2).
            // Hence the following call to get connection might not be 
            // successful when client is running in a JVM where the JCE does
            // not support the DH (32 byte prime).
            // The test methods are implemented to work either way.
            assertSecurityMechanismOK("john","sarah",new Short(
                SECMEC_EUSRIDPWD),"SECMEC_EUSRIDPWD:", expectedValues[3]);
            // JCC does not support USRSSBPWD security mechanism
            assertSecurityMechanismOK("john","sarah",new Short(
                SECMEC_USRSSBPWD),"SECMEC_USRSSBPWD:", expectedValues[4]);
        }
    }

    private void assertSecurityMechanismOK(String user, String password,
        Short secmec, String msg, String expectedValue)
    {
        Connection conn;
        String securityMechanismProperty = "SecurityMechanism";
        Class[] argType = { Short.TYPE };
        String methodName = getSetterName(securityMechanismProperty);
        Object[] args = new Short[1];
        args[0] = secmec;

        DataSource ds = getDS(user,password);
        try {
            Method sh = ds.getClass().getMethod(methodName, argType);
            sh.invoke(ds, args);
            conn = ds.getConnection(user, password);
            conn.close();
            // EUSRIDPWD is supported with some jvm( version)s, not with others
            if (!(secmec.equals(new Short(SECMEC_EUSRIDPWD))))
            {
                if (!expectedValue.equals("OK"))
                {
                    fail("should have encountered an Exception");
                }
            }
        }
        catch (SQLException sqle)
        {
            if (sqle.getSQLState().equals("08001"))
            {
                // with null user id there's a difference between errors coming
                // from driver manager vs. datasource, because the datasource
                // getconnection call had to be specify user/password or the 
                // junit framework pads it with 'APP'.
                if (user == null)
                    assertSQLState08001("08001.C.7", sqle);
                else
                    assertSQLState08001(expectedValue, sqle);
            }
            // Exceptions expected in certain cases depending on JCE used for 
            // running the test. So, instead of '08004' (connection refused),
            // or "OK", we may see 'not supported' (XJ112).
            else if (secmec.equals(new Short(SECMEC_EUSRIDPWD))) 
            {
                if (!(sqle.getSQLState().equals("XJ112")))
                    assertSQLState(expectedValue, sqle);
            }
            else
                assertSQLState(expectedValue, sqle);
            // for debugging, uncomment:
            //dumpSQLException(sqle.getNextException());
        }
        catch (Exception e)
        {   
            fail(" should not have seen an exception");
        }
    }

    private void assertConnectionUsingDriverManager(
        String dbUrl, String msg, String expectedValue)
    {
        try
        {
            TestConfiguration.getCurrent();
            DriverManager.getConnection(dbUrl);
            // Please note: EUSRIDPWD security mechanism in DRDA uses 
            // Diffie-Helman for generation of shared keys. 
            // The spec specifies the prime to use for DH which is 32 bytes and
            // this needs to be used as is. Sun JCE does not support a prime of
            // 32 bytes for Diffie Helman and some older versions of IBM JCE 
            // ( 1.4.2) also do not support it. Hence the following call to get 
            // connection might not be successful when client is running in JVM
            // where the JCE does not support the DH (32 byte prime)
            
            if (derby_drda_securityMechanism != null && 
                !(derby_drda_securityMechanism.equals(
                "ENCRYPTED_USER_AND_PASSWORD_SECURITY") &&
                ((msg.indexOf("T5")>0) || (dbUrl.indexOf("9")>0))))
            {
                if (!expectedValue.equals("OK"))
                    fail("should have encountered an Exception");
            }
        }
        catch(SQLException sqle)
        {
            // if we're trying T5, and we've got EUSRIDPWD, 08004 is also
            // possible, or XJ112 instead of OK.
            if (derby_drda_securityMechanism != null  &&
                derby_drda_securityMechanism.equals(
                "ENCRYPTED_USER_AND_PASSWORD_SECURITY") &&
                ((msg.indexOf("T5")>0) ))<commit_msg>Close a connection in NSSecurityMechanismTest.<commit_after>/*

   Derby - Class 
      org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest

   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

 */

package org.apache.derbyTesting.functionTests.tests.derbynet;

import java.lang.reflect.*;
import java.net.InetAddress;
import java.util.HashMap;
import java.util.Iterator;

import java.security.AccessController;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.CallableStatement;
import java.sql.Statement;
import java.sql.SQLException;
import java.sql.DriverManager;
import javax.sql.DataSource;
import javax.sql.ConnectionPoolDataSource;
import javax.sql.PooledConnection;

import org.apache.derby.drda.NetworkServerControl;

import org.apache.derbyTesting.junit.BaseJDBCTestCase;
import org.apache.derbyTesting.junit.DatabasePropertyTestSetup;
import org.apache.derbyTesting.junit.J2EEDataSource;
import org.apache.derbyTesting.junit.JDBCDataSource;
import org.apache.derbyTesting.junit.NetworkServerTestSetup;
import org.apache.derbyTesting.junit.TestConfiguration;

import junit.framework.Test;
import junit.framework.TestSuite;

/**
 * This class tests the security mechanisms supported by Network Server
 * Network server supports SECMEC_EUSRIDPWD, SECMEC_USRIDPWD, SECMEC_USRIDONL
 * and SECMEC_USRSSBPWD.
 * 
 * -----------------------------------------------------------------
 * Security Mechanism | secmec           | User friendly name   
 *                    |  codepoint value |
 * -----------------------------------------------------------------
 * USRIDONL           | 0x04             | USER_ONLY_SECURITY
 * USRIDPWD           | 0x03             | CLEAR_TEXT_PASSWORD_SECURITY
 * EUSRIDPWD          | 0x09             | ENCRYPTED_USER_AND_PASSWORD_SECURITY
 * USRSSBPWD          | 0x08             | STRONG_PASSWORD_SUBSTITUTE_SECURITY
 * -----------------------------------------------------------------
 * 
 * Key points: 
 * #1) Server and client support encrypted userid/password (EUSRIDPWD) via the
 * use of Diffie Helman key-agreement protocol - but current Open Group DRDA
 * specifications imposes small prime and base generator values (256 bits) that
 * prevents other JCE's to be used as java cryptography providers - typical
 * minimum security requirements is usually of 1024 bits (512-bit absolute
 * minimum) when using DH key-agreement protocol to generate a session key.
 * 
 * (Reference: DDM manual, page 281 and 282. Section: Generating the shared
 * private key. DRDA's diffie helman agreed public values for prime are 256
 * bits. The spec gives the public values for the prime, generator and the size
 * of exponent required for DH . These values must be used as is to generate a
 * shared private key.)
 * 
 * Encryption is done using JCE. Hence JCE support of the necessary algorithm
 * is required for a particular security mechanism to work. Thus even though 
 * the server and client have code to support EUSRIDPWD, this security 
 * mechanism will not work in all JVMs.
 * 
 * JVMs where support for DH(32byte prime) is not available and thus EUSRIDPWD
 * won't work are Sun JVM (versions 1.3.1,1.4.1,1.4.2,1.5) and IBM JVM (
 * versions 1.3.1 and some old versions of 1.4.2 (in 2004))
 * 
 * JVMs where support for DH(32bytes prime) is available and thus EUSRIDPWD 
 * will work are IBM JVM [versions 1.4.1, later versions of 1.4.2 (from 2005),
 * 1.5]
 * 
 * #2) JCC 2.6 client does some automatic upgrade of security mechanism in one
 * case. Logic is  as follows:
 * If client sends USRIDPWD to server and server rejects this
 * and says it accepts only EUSRIDPWD, in that case JCC 2.6 will upgrade the 
 * security mechanism to EUSRIDPWD and retry the request with EUSRIDPWD.
 * This switching will also override the security mechanism specified by user.
 * Thus if JCC client is running with Sun JVM 1.4.2 and even though Sun JCE
 * does not have support for algorithms needed for  EUSRIDPWD, the JCC client
 * will still try to switch to  EUSRIDPWD and throw an exception with 
 * ClassNotFoundException for the IBM JCE.
 *
 * - Default security mechanism is USRIDPWD(0x03)
 * - If securityMechanism is not explicitly specified on connection request 
 *   and if no user specified, an exception is thrown - Null userid not 
 *   supported
 * - If securityMechanism is not explicitly specified on connection request, 
 *   and if no password is specified, an exception is thrown - null password
 *   not supported
 *   If securityMechanism is explicitly specified to be USRIDONL,  then a
 *   password is not required. But in other cases (EUSRIDPWD, USRIDPWD, 
 *   USRSSBPWD) if password is null, an exception with the message 'a null
 *   password not valid' will be thrown.
 * - On datasource, setting a security mechanism works. It also allows a 
 *   security mechanism of USRIDONL to be set on datasource unlike jcc 2.4.
 * 
 * #3)JCC 2.4 client behavior 
 * Default security mechanism used is USRIDPWD (0x03)
 * If securityMechanism is not explicitly specified on connection request, and
 * if no user is specified, an exception is thrown - Null userid not supported.
 * If securityMechanism is not explicitly specified on connection request, and
 * if no password is specified, an exception is thrown - null password not
 * supported.
 * If security mechanism is specified, jcc client will not override the 
 * security mechanism.
 * If securityMechanism is explicitly specified to be USRIDONL, then a password
 * is not required. But in other cases (EUSRIDPWD,USRIDPWD) if password is null
 * an exception with the message 'a null password not valid' will be thrown.
 * On datasource, setting a security mechanism does not work (bug). It defaults
 * to USRIDPWD.  Setting a value of USRIDONL or EUSRIDPWD does not seem to have
 * an effect.
 * 
 * #4) Note, if  server restricts the client connections based on security 
 * mechanism by setting derby.drda.securityMechanism, in that case the clients 
 * will see an error similar to this:
 * "Connection authorization failure occurred. Reason: security mechanism not
 *  supported"
 *
 * #5) USRSSBPWD - Strong password substitute is only supported starting from
 *     Apache Derby 10.2.
 *	 NOTE: USRSSBPWD only works with the derby network client driver for now.
 *   ---- 
 */
public class NSSecurityMechanismTest extends BaseJDBCTestCase
{
    // values for derby.drda.securityMechanism property
    private static String[] derby_drda_securityMechanisms = {
        null, // not set 
        "USER_ONLY_SECURITY", "CLEAR_TEXT_PASSWORD_SECURITY",
        // this will give a DRDA_InvalidValue with jvms that do not support it
        "ENCRYPTED_USER_AND_PASSWORD_SECURITY",
        "STRONG_PASSWORD_SUBSTITUTE_SECURITY",
        //these two are always invalid values, again, will give DRDA_InvalidValue
        "INVALID_VALUE", ""};
    
    private static String derby_drda_securityMechanism;

    // possible interesting combinations with respect to security mechanism
    // upgrade logic for user attribute
    private static String[] USER_ATTRIBUTE = {"calvin",null};

    // possible interesting combinations with respect to security mechanism
    // upgrade logic for password attribute
    private static String[] PWD_ATTRIBUTE = {"hobbes",null};

    public NSSecurityMechanismTest(String name)
    {
        super(name);
    }
    
    public static Test suite() 
    {
        TestSuite suite = new TestSuite("NSSecurityMechanismTest");

        TestSuite clientSuite =
            new TestSuite("NSSecurityMechanismTest - client");
        clientSuite.addTest(new NSSecurityMechanismTest(
            "testNetworkServerSecurityMechanism"));
        suite.addTest(TestConfiguration.clientServerDecorator(clientSuite));

        // Test case for embedded mode. Enable builtin authentication.
        suite.addTest(
            DatabasePropertyTestSetup.builtinAuthentication(
                new NSSecurityMechanismTest("testSecurityMechanismOnEmbedded"),
                new String[] { "calvin" }, "pw"));

        return suite;
    }
    
    public void tearDown() throws Exception {
        try {
            AccessController.doPrivileged
            (new java.security.PrivilegedAction(){
                public Object run(){
                    return System.getProperties().remove(
                            "derby.drda.securityMechanism");
                }
            });
        } catch (Exception e) {
            fail("warning: could not remove secmec settings");
        }
        super.tearDown();
    }

    // Indicates userid/encrypted password security mechanism.
    static final short SECMEC_EUSRIDPWD = 0x09;

    // Indicates userid only security mechanism.
    static final short SECMEC_USRIDONL = 0x04;

    // Indicates userid/encrypted password security mechanism.
    static final short SECMEC_USRENCPWD = 0x07;

    // Indicates userid/new password security mechanism.
    static final short SECMEC_USRIDNWPWD = 0x05;

    // Indicates userid/password security mechanism.
    static final short SECMEC_USRIDPWD = 0x03;

    // Indicates strong password substitute security mechanism.
    static final short SECMEC_USRSSBPWD = 0x08;

    // client and server recognize these secmec values
    private static short[] SECMEC_ATTRIBUTE = {
        SECMEC_USRIDONL,
        SECMEC_USRIDPWD,
        SECMEC_EUSRIDPWD,
        SECMEC_USRSSBPWD
    };

    /**
     *  Test cases for security mechanism
     *  ---------------------------------------------------------------
     *  DriverManager:
     *  T1 - default , no user      PASS (for derbyclient)
     *  T2 - user only              PASS (for derbyclient)
     *  T3 - user,password          PASS (only for derbynet)
     *  T4 - user,password, security mechanism not set  FAIL
     *  T5 - user,password, security mechanism set
     *       to SECMEC_EUSRIDPWD  PASS/FAIL
     *       (Fails with Sun JVM as EUSRIDPWD secmec cannot be used)
     *  T6 - user, security mechanism set to SECMEC_USRIDONL   PASS
     *  T7 - user,password, security mechanism set to SECMEC_USRENCPWD  FAIL
     *  Test with datasource as well as DriverManager
     *  T8 - user,password security mechanism set to SECMEC_USRIDONL   PASS
     *  T9 - user,password security mechanism set to SECMEC_USRSSBPWD  PASS
     *  Test with datasource as well as DriverManager
     * Note, that with DERBY-928, the pass/fail for the connections will depend 
     * on the security mechanism specified at the server by property 
     * derby.drda.securityMechanism.  Please check out the following
     * html file http://issues.apache.org/jira/secure/attachment/12322971/Derby928_Table_SecurityMechanisms..htm
     * for a combination of url/security mechanisms and the expected results 
     */
    public void testNetworkServerSecurityMechanism() throws SQLException, Exception
    {
        String[][] allDriverManagerExpectedValues = {
            {"null",
                "OK","OK","OK","OK","OK","OK","?","OK","OK"},
            {"USER_ONLY_SECURITY",
                "OK","OK","08004","08004","08004","OK","?","OK","08004"},
            {"CLEAR_TEXT_PASSWORD_SECURITY",
                "08004","08004","OK","OK","08004","08004",
                "?","08004","08004"},
            // this should give a DRDA_InvalidValue with jvms that do not
            // support it. For instance, it will fail with jdk14 jvms.
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","08004","08004","OK","08004",
                "?","08004","08004"},
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                    "08004","08004","08004","08004","08004","08004",
                    "?","08004","OK"},
            };
        
        String[][] allDataSourceExpectedValues = {
            {null,"OK","OK","OK","OK"},
            {"USER_ONLY_SECURITY","OK","08004","08004","08004"},
            {"CLEAR_TEXT_PASSWORD_SECURITY","08004","OK","08004","08004"},
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","OK","08004"},
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                "08004","08004","08004","OK"}};
        
        String[] DERBY1080ExpectedValues = {"OK","08004","08004","OK","08004"};
        
        String[][] allUserPwdSecMecExpectedValues = {
            // if secmec is null, all expected to pass.
            {null},
            {"USER_ONLY_SECURITY",
                "08004","OK","08004","08004","08004", 
                "OK","OK","08001.C.8","08001.C.8","08001.C.8",
                "08004","OK","08004","08004","08004",
                "OK","OK","08001.C.8","08001.C.8","08001.C.8"
            },
            {"CLEAR_TEXT_PASSWORD_SECURITY",
                "OK","08004","OK","08004","08004", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "OK","08004","OK","08004","08004",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            },
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","08004","OK","08004", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "08004","08004","08004","OK","08004",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            },
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                "08004","08004","08004","08004","OK", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "08004","08004","08004","08004","OK",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            }
        };
        
        String[] testDERBY528ExpectedValues = {
            null,"08006","OK","08004","08006"
        };
        
        // just to see if this will work
        getConnection().getAutoCommit();
        
        for ( int i = 0; i < derby_drda_securityMechanisms.length; i++)
        {   
            derby_drda_securityMechanism = derby_drda_securityMechanisms[i];

            // Using 'null' will give a nullpointer exception...
            // as it's the first in the array, it should use default setting
            if (derby_drda_securityMechanism != null)
            {
                // with "" or "INVALID_VALUE", or with other mechanisms with
                // certain jvms, some settings are not supported. Flag the loop
                // to not try connections
                if (setSecurityMechanism(derby_drda_securityMechanism))
                    continue;
            }
            // Test cases with get connection via drivermanager and via
            // datasource, using different security mechanisms.
            // Network server supports SECMEC_USRIDPWD, SECMEC_USRIDONL,
            // SECMEC_EUSRIDPWD and USRSSBPWD (derby network client only)

            assertConnectionsUsingDriverManager(
                allDriverManagerExpectedValues[i]);
            
            assertConnectionUsingDataSource(allDataSourceExpectedValues[i]);

            // regression test for DERBY-1080
            assertDerby1080Fixed(DERBY1080ExpectedValues[i]);

            // test for DERBY-962
            // test all combinations of user/password with security mechanism
            assertAllCombinationsOfUserPasswordSecMecInputOK(
                allUserPwdSecMecExpectedValues[i]);

            // test USRSSBPWD (DERBY-528) with Derby BUILTIN authentication 
            // scheme both with none and USRSSBPWD specified DRDA SecMec upon
            // starting the network server.
            if ((derby_drda_securityMechanism == null) ||
                (derby_drda_securityMechanism.equals(
                "STRONG_PASSWORD_SUBSTITUTE_SECURITY")))
            {
                assertUSRSSBPWD_with_BUILTIN(testDERBY528ExpectedValues);
            }
            else
            {
                // shutdown the database - this will prevent slow startup 
                // when bouncing the server with next security mechanism.
                // for ENCRYPTED_USER_AND_PASSWORD_SECURITY:
                short secmeccode=SECMEC_EUSRIDPWD;
                if (derby_drda_securityMechanism.equals("USER_ONLY_SECURITY"))
                    secmeccode=SECMEC_USRIDONL;
                else if (derby_drda_securityMechanism.equals(
                    "CLEAR_TEXT_PASSWORD_SECURITY"))
                    secmeccode=SECMEC_USRIDPWD;
                assertConnectionUsingDriverManager(getJDBCUrl(
                    "user=APP;password=<PASSWORD>;shutdown=true;securityMechanism=" +
                    secmeccode)," BUILTIN (T5):",
                    "08006");
            }
        }
    }

    /**
     * Test that securityMechanism=8 is ignored by the embedded driver
     * (DERBY-3025).
     */
    public void testSecurityMechanismOnEmbedded() throws SQLException {
        DataSource ds = JDBCDataSource.getDataSource();
        JDBCDataSource.setBeanProperty(
            ds, "connectionAttributes", "securityMechanism=8");

        // DERBY-3025: NullPointerException or AssertFailure was thrown here
        Connection c = ds.getConnection("calvin", "calvinpw");

        c.close();
    }

    // returns a boolean true if the security mechanism is not supported
    // so the loop in which this is called can be continued without
    // causing unnecessary/impossible tests to be run
    private boolean setSecurityMechanism(String derby_security_mechanism) 
    throws Exception {
        try {
        // getting a networkservercontrol to shutdown the currently running 
        // server, before setting the next security mechanism
        NetworkServerControl server = new NetworkServerControl(
            InetAddress.getByName(
                TestConfiguration.getCurrent().getHostName()),
                TestConfiguration.getCurrent().getPort());

        // shut down the server
        server.shutdown();
        } catch (Exception e) {
            if (!(e.getMessage().substring(0,17).equals("DRDA_InvalidValue")))
            {
                fail("unexpected error");
            }
        }

        try {
            AccessController.doPrivileged
            (new java.security.PrivilegedAction(){
                public Object run(){
                    return System.setProperty(
                        "derby.drda.securityMechanism",
                        derby_drda_securityMechanism);
                }
            });
            
            // if the security mechanism isn't supported or invalid, getting a
            // networkservercontrol will fail.
            NetworkServerControl server2 = new NetworkServerControl(
                InetAddress.getByName(
                    TestConfiguration.getCurrent().getHostName()),
                    TestConfiguration.getCurrent().getPort());

            // For debugging, to make output come to console uncomment:
            //server2.start(new PrintWriter(System.out, true));
            // and comment out:
            server2.start(null);
            NetworkServerTestSetup.waitForServerStart(server2);
            
            if (derby_drda_securityMechanism.equals("") ||
                derby_drda_securityMechanism.equals("INVALID_VALUE"))
            {
                fail(
                    "expected server not to start with invalid or empty " +
                     "security mechanism, but passed");
            }
        } catch (Exception e) {
            // "" or "INVALID_VALUE" should always give DRDA_Invalid_Value, 
            // hence the 'fail' above.
            // However, other mechanisms may not be supported with certain
            // jvms, and then also will get the same exception. This is true
            // for ENCRYPTED_USER_AND_PASSWORD_SECURITY.
            // If we're not getting DRDA_Invalid_Value here, something's gone
            // wrong.
            if (derby_drda_securityMechanism.equals("") ||
                derby_drda_securityMechanism.equals("INVALID_VALUE") ||
                derby_drda_securityMechanism.equals(
                    "ENCRYPTED_USER_AND_PASSWORD_SECURITY"))
            {
                // should give invalid value 
                assertEquals("DRDA_InvalidValue",e.getMessage().substring(0,17));
                return true;
            }
            fail ("got unexpected exception setting the mechanism " + 
                derby_security_mechanism + "; message: " + e.getMessage());
        }
        return false;
    }

    private void assertConnectionsUsingDriverManager(String[] expectedValues)
    {
        assertConnectionUsingDriverManager(
            getJDBCUrl(null),"T1:", expectedValues[1]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=max"),"T2:", expectedValues[2]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>"),"T3:", expectedValues[3]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_USRIDPWD),"T4:", expectedValues[4]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_EUSRIDPWD),"T5:", expectedValues[5]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;securityMechanism=" +
            SECMEC_USRIDONL),"T6:", expectedValues[6]);

        // disable as ibm142 and sun jce doesnt support DH prime of 32 bytes
        //assertConnectionUsingDriverManager(
        //    getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
        //    SECMEC_USRENCPWD),"T7:", expectedValues[7]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_USRIDONL),"T8:", expectedValues[8]);
        // Test strong password substitute DRDA security mechanism 
        // (only works with DerbyClient driver right now)
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=<PASSWORD>;securityMechanism=" +
            SECMEC_USRSSBPWD),"T9:", expectedValues[9]);
    }
    
    
    /**
     * Get connection from datasource and also set security mechanism
     */
    private void assertConnectionUsingDataSource(String[] expectedValues)
    {
        // Note: bug in jcc, throws error with null password
        if (usingDerbyNetClient())
        {
            assertSecurityMechanismOK("sarah",null, new Short(
                SECMEC_USRIDONL),"SECMEC_USRIDONL:", expectedValues[1]);
        }
        assertSecurityMechanismOK("john","sarah", new Short(
            SECMEC_USRIDPWD),"SECMEC_USRIDPWD:", expectedValues[2]);

        // Possible bug in JCC, hence disable this test for JCC framework only
        // the security mechanism when set on JCC datasource does not seem to 
        // have an effect. JCC driver is sending a secmec of 3( USRIDPWD) to 
        // the server even though the security mechanism on datasource is set to 
        // EUSRIDPWD (9)
        if (usingDerbyNetClient())
        {
            // Please note: EUSRIDPWD security mechanism in DRDA uses 
            // Diffie-Helman for generation of shared keys. The spec specifies
            // the prime to use for DH which is 32 bytes and this needs to be
            // used as is.
            // Sun JCE does not support a prime of 32 bytes for Diffie Helman
            // nor do some older versions of IBM JCE (1.4.2).
            // Hence the following call to get connection might not be 
            // successful when client is running in a JVM where the JCE does
            // not support the DH (32 byte prime).
            // The test methods are implemented to work either way.
            assertSecurityMechanismOK("john","sarah",new Short(
                SECMEC_EUSRIDPWD),"SECMEC_EUSRIDPWD:", expectedValues[3]);
            // JCC does not support USRSSBPWD security mechanism
            assertSecurityMechanismOK("john","sarah",new Short(
                SECMEC_USRSSBPWD),"SECMEC_USRSSBPWD:", expectedValues[4]);
        }
    }

    private void assertSecurityMechanismOK(String user, String password,
        Short secmec, String msg, String expectedValue)
    {
        Connection conn;
        String securityMechanismProperty = "SecurityMechanism";
        Class[] argType = { Short.TYPE };
        String methodName = getSetterName(securityMechanismProperty);
        Object[] args = new Short[1];
        args[0] = secmec;

        DataSource ds = getDS(user,password);
        try {
            Method sh = ds.getClass().getMethod(methodName, argType);
            sh.invoke(ds, args);
            conn = ds.getConnection(user, password);
            conn.close();
            // EUSRIDPWD is supported with some jvm( version)s, not with others
            if (!(secmec.equals(new Short(SECMEC_EUSRIDPWD))))
            {
                if (!expectedValue.equals("OK"))
                {
                    fail("should have encountered an Exception");
                }
            }
        }
        catch (SQLException sqle)
        {
            if (sqle.getSQLState().equals("08001"))
            {
                // with null user id there's a difference between errors coming
                // from driver manager vs. datasource, because the datasource
                // getconnection call had to be specify user/password or the 
                // junit framework pads it with 'APP'.
                if (user == null)
                    assertSQLState08001("08001.C.7", sqle);
                else
                    assertSQLState08001(expectedValue, sqle);
            }
            // Exceptions expected in certain cases depending on JCE used for 
            // running the test. So, instead of '08004' (connection refused),
            // or "OK", we may see 'not supported' (XJ112).
            else if (secmec.equals(new Short(SECMEC_EUSRIDPWD))) 
            {
                if (!(sqle.getSQLState().equals("XJ112")))
                    assertSQLState(expectedValue, sqle);
            }
            else
                assertSQLState(expectedValue, sqle);
            // for debugging, uncomment:
            //dumpSQLException(sqle.getNextException());
        }
        catch (Exception e)
        {   
            fail(" should not have seen an exception");
        }
    }

    private void assertConnectionUsingDriverManager(
        String dbUrl, String msg, String expectedValue)
    {
        try
        {
            TestConfiguration.getCurrent();
            DriverManager.getConnection(dbUrl).close();
            // Please note: EUSRIDPWD security mechanism in DRDA uses 
            // Diffie-Helman for generation of shared keys. 
            // The spec specifies the prime to use for DH which is 32 bytes and
            // this needs to be used as is. Sun JCE does not support a prime of
            // 32 bytes for Diffie Helman and some older versions of IBM JCE 
            // ( 1.4.2) also do not support it. Hence the following call to get 
            // connection might not be successful when client is running in JVM
            // where the JCE does not support the DH (32 byte prime)
            
            if (derby_drda_securityMechanism != null && 
                !(derby_drda_securityMechanism.equals(
                "ENCRYPTED_USER_AND_PASSWORD_SECURITY") &&
                ((msg.indexOf("T5")>0) || (dbUrl.indexOf("9")>0))))
            {
                if (!expectedValue.equals("OK"))
                    fail("should have encountered an Exception");
            }
        }
        catch(SQLException sqle)
        {
            // if we're trying T5, and we've got EUSRIDPWD, 08004 is also
            // possible, or XJ112 instead of OK.
            if (derby_drda_securityMechanism != null  &&
                derby_drda_securityMechanism.equals(
                "ENCRYPTED_USER_AND_PASSWORD_SECURITY") &&
                ((msg.indexOf("T5")>0) ))
{'fraction_non_alphanumeric': 0.09680948990048109, 'fraction_numerical': 0.029734095211629643, 'mean_word_length': 2.242552232922228, 'pattern_counts': {'":': 0, '<': 24, '<?xml version=': 0, '>': 28, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1469305', 'n_tokens_mistral': 16981, 'n_tokens_neox': 15453, 'n_words': 4512}