QPID-1502: Update the PlainPasswordFilePrincipalDatabase to be manipulatable by the management console and cached in memory like the B64MD5 PD. Add unit tests for the PlainPD

merged from trunk r748641


git-svn-id: https://svn.apache.org/repos/asf/qpid/branches/0.5-fix@764455 13f79535-47bb-0310-9956-ffa450edef68

4 files changed, 870 insertions, 44 deletions

diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabase.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabase.java
index 9da954d74f..5e4678a63b 100644
--- a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabase.java
+++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabase.java
@@ -34,11 +34,13 @@ import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.FileReader;
 import java.io.IOException;
+import java.io.PrintStream;
 import java.security.Principal;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.locks.ReentrantLock;
 import java.util.regex.Pattern;
 
 /**
@@ -50,13 +52,18 @@ import java.util.regex.Pattern;
  */
 public class PlainPasswordFilePrincipalDatabase implements PrincipalDatabase
 {
+    public static final String DEFAULT_ENCODING = "utf-8";
+    
     private static final Logger _logger = Logger.getLogger(PlainPasswordFilePrincipalDatabase.class);
 
-    protected File _passwordFile;
+    private File _passwordFile;
 
-    protected Pattern _regexp = Pattern.compile(":");
+    private Pattern _regexp = Pattern.compile(":");
 
-    protected Map<String, AuthenticationProviderInitialiser> _saslServers;
+    private Map<String, AuthenticationProviderInitialiser> _saslServers;    
+    
+    private Map<String, PlainUser> _users = new HashMap<String, PlainUser>();
+    private ReentrantLock _userUpdate = new ReentrantLock();
 
     public PlainPasswordFilePrincipalDatabase()
     {
@@ -83,7 +90,7 @@ public class PlainPasswordFilePrincipalDatabase implements PrincipalDatabase
         _saslServers.put(cram.getMechanismName(), cram);
     }
 
-    public void setPasswordFile(String passwordFile) throws FileNotFoundException
+    public void setPasswordFile(String passwordFile) throws IOException
     {
         File f = new File(passwordFile);
         _logger.info("PlainPasswordFile using file " + f.getAbsolutePath());
@@ -97,10 +104,20 @@ public class PlainPasswordFilePrincipalDatabase implements PrincipalDatabase
             throw new FileNotFoundException("Cannot read password file " + f +
                                             ". Check permissions.");
         }
+        
+        loadPasswordFile();
     }
 
-    public void setPassword(Principal principal, PasswordCallback callback) throws IOException,
-                                                                                   AccountNotFoundException
+    /**
+     * SASL Callback Mechanism - sets the Password in the PasswordCallback based on the value in the PasswordFile
+     * If you want to change the password for a user, use updatePassword instead.
+     *
+     * @param principal The Principal to set the password for
+     * @param callback  The PasswordCallback to call setPassword on
+     *
+     * @throws AccountNotFoundException If the Principal cannot be found in this Database
+     */
+    public void setPassword(Principal principal, PasswordCallback callback) throws AccountNotFoundException
     {
         if (_passwordFile == null)
         {
@@ -111,6 +128,7 @@ public class PlainPasswordFilePrincipalDatabase implements PrincipalDatabase
             throw new IllegalArgumentException("principal must not be null");
         }
         char[] pwd = lookupPassword(principal.getName());
+        
         if (pwd != null)
         {
             callback.setPassword(pwd);
@@ -121,33 +139,151 @@ public class PlainPasswordFilePrincipalDatabase implements PrincipalDatabase
         }
     }
 
+    /**
+     * Used to verify that the presented Password is correct. Currently only used by Management Console
+     *
+     * @param principal The principal to authenticate
+     * @param password  The plaintext password to check
+     *
+     * @return true if password is correct
+     *
+     * @throws AccountNotFoundException if the principal cannot be found
+     */
     public boolean verifyPassword(String principal, char[] password) throws AccountNotFoundException
     {
-        try
-        {
-            char[] pwd = lookupPassword(principal);
 
-            return compareCharArray(pwd, password);
-        }
-        catch (IOException e)
+        char[] pwd = lookupPassword(principal);
+        
+        if (pwd == null)
         {
-            return false;
+            throw new AccountNotFoundException("Unable to lookup the specfied users password");
         }
+
+        return compareCharArray(pwd, password);
+
     }
 
+    /**
+     * Changes the password for the specified user
+     * 
+     * @param principal to change the password for
+     * @param password plaintext password to set the password too
+     */
     public boolean updatePassword(Principal principal, char[] password) throws AccountNotFoundException
     {
-        return false; // updates denied
+        PlainUser user = _users.get(principal.getName());
+
+        if (user == null)
+        {
+            throw new AccountNotFoundException(principal.getName());
+        }
+
+        try
+        {
+            try
+            {
+                _userUpdate.lock();
+                char[] orig = user.getPassword();
+                user.setPassword(password);
+
+                try
+                {
+                    savePasswordFile();
+                }
+                catch (IOException e)
+                {
+                    _logger.error("Unable to save password file, password change for user '" + principal + "' discarded");
+                    //revert the password change
+                    user.setPassword(orig);
+                    return false;
+                }
+                return true;
+            }
+            finally
+            {
+                if (_userUpdate.isHeldByCurrentThread())
+                {
+                    _userUpdate.unlock();
+                }
+            }
+        }
+        catch (Exception e)
+        {
+            return false;
+        }
     }
 
     public boolean createPrincipal(Principal principal, char[] password)
     {
-        return false; // updates denied
+        if (_users.get(principal.getName()) != null)
+        {
+            return false;
+        }
+
+        PlainUser user = new PlainUser(principal.getName(), password);
+
+        try
+        {
+            _userUpdate.lock();
+            _users.put(user.getName(), user);
+
+            try
+            {
+                savePasswordFile();
+                return true;
+            }
+            catch (IOException e)
+            {
+                //remove the use on failure.
+                _users.remove(user.getName());
+                _logger.warn("Unable to create user '" + user.getName());
+                return false;
+            }
+        }
+        finally
+        {
+            if (_userUpdate.isHeldByCurrentThread())
+            {
+                _userUpdate.unlock();
+            }
+        }
     }
 
     public boolean deletePrincipal(Principal principal) throws AccountNotFoundException
     {
-        return false; // updates denied
+        PlainUser user = _users.get(principal.getName());
+
+        if (user == null)
+        {
+            throw new AccountNotFoundException(principal.getName());
+        }
+
+        try
+        {
+            _userUpdate.lock();
+            user.delete();
+
+            try
+            {
+                savePasswordFile();
+            }
+            catch (IOException e)
+            {
+                _logger.error("Unable to remove user '" + user.getName() + "' from password file.");
+                return false;
+            }
+
+            _users.remove(user.getName());
+        }
+        finally
+        {
+            if (_userUpdate.isHeldByCurrentThread())
+            {
+                _userUpdate.unlock();
+            }
+        }
+
+        return true;
     }
 
     public Map<String, AuthenticationProviderInitialiser> getMechanisms()
@@ -157,21 +293,14 @@ public class PlainPasswordFilePrincipalDatabase implements PrincipalDatabase
 
     public List<Principal> getUsers()
     {
-        return new LinkedList<Principal>(); //todo
+        return new LinkedList<Principal>(_users.values());
     }
 
     public Principal getUser(String username)
     {
-        try
-        {
-            if (lookupPassword(username) != null)
-            {
-                return new UsernamePrincipal(username);
-            }
-        }
-        catch (IOException e)
+        if (_users.containsKey(username))
         {
-            //fall through to null return
+            return new UsernamePrincipal(username);
         }
         return null;
     }
@@ -197,49 +326,166 @@ public class PlainPasswordFilePrincipalDatabase implements PrincipalDatabase
      * Looks up the password for a specified user in the password file. Note this code is <b>not</b> secure since it
      * creates strings of passwords. It should be modified to create only char arrays which get nulled out.
      *
-     * @param name the name of the principal to lookup
-     *
-     * @return char[] of the password
+     * @param name The principal name to lookup
      *
-     * @throws java.io.IOException whilst accessing the file
+     * @return a char[] for use in SASL.
      */
-    private char[] lookupPassword(String name) throws IOException
+    private char[] lookupPassword(String name)
+    {
+        PlainUser user = _users.get(name);
+        if (user == null)
+        {
+            return null;
+        }
+        else
+        {
+            return user.getPassword();
+        }
+    }
+
+    private void loadPasswordFile() throws IOException
+    {
+        try
+        {
+            _userUpdate.lock();
+            _users.clear();
+
+            BufferedReader reader = null;
+            try
+            {
+                reader = new BufferedReader(new FileReader(_passwordFile));
+                String line;
+
+                while ((line = reader.readLine()) != null)
+                {
+                    String[] result = _regexp.split(line);
+                    if (result == null || result.length < 2 || result[0].startsWith("#"))
+                    {
+                        continue;
+                    }
+
+                    PlainUser user = new PlainUser(result);
+                    _logger.info("Created user:" + user);
+                    _users.put(user.getName(), user);
+                }
+            }
+            finally
+            {
+                if (reader != null)
+                {
+                    reader.close();
+                }
+            }
+        }
+        finally
+        {
+            if (_userUpdate.isHeldByCurrentThread())
+            {
+                _userUpdate.unlock();
+            }
+        }
+    }
+
+    private void savePasswordFile() throws IOException
     {
-        BufferedReader reader = null;
         try
         {
-            reader = new BufferedReader(new FileReader(_passwordFile));
-            String line;
+            _userUpdate.lock();
+
+            BufferedReader reader = null;
+            PrintStream writer = null;
+            File tmp = File.createTempFile(_passwordFile.getName(), ".tmp");
 
-            while ((line = reader.readLine()) != null)
+            try
             {
-                if (!line.startsWith("#"))
+                writer = new PrintStream(tmp);
+                reader = new BufferedReader(new FileReader(_passwordFile));
+                String line;
+
+                while ((line = reader.readLine()) != null)
                 {
                     String[] result = _regexp.split(line);
-                    if (result == null || result.length < 2)
+                    if (result == null || result.length < 2 || result[0].startsWith("#"))
                     {
+                        writer.write(line.getBytes(DEFAULT_ENCODING));
+                        writer.println();
                         continue;
                     }
 
-                    if (name.equals(result[0]))
+                    PlainUser user = _users.get(result[0]);
+
+                    if (user == null)
                     {
-                        return result[1].toCharArray();
+                        writer.write(line.getBytes(DEFAULT_ENCODING));
+                        writer.println();
+                    }
+                    else if (!user.isDeleted())
+                    {
+                        if (!user.isModified())
+                        {
+                            writer.write(line.getBytes(DEFAULT_ENCODING));
+                            writer.println();
+                        }
+                        else
+                        {
+                            byte[] password = user.getPasswordBytes();
+
+                            writer.write((user.getName() + ":").getBytes(DEFAULT_ENCODING));
+                            writer.write(password);
+                            writer.println();
+
+                            user.saved();
+                        }
+                    }
+                }
+
+                for (PlainUser user : _users.values())
+                {
+                    if (user.isModified())
+                    {
+                        byte[] password;
+                        password = user.getPasswordBytes();
+                        writer.write((user.getName() + ":").getBytes(DEFAULT_ENCODING));
+                        writer.write(password);
+                        writer.println();
+                        user.saved();
                     }
                 }
             }
-            return null;
+            finally
+            {
+                if (reader != null)
+                {
+                    reader.close();
+                }
+
+                if (writer != null)
+                {
+                    writer.close();
+                }
+
+                // Swap temp file to main password file.
+                File old = new File(_passwordFile.getAbsoluteFile() + ".old");
+                if (old.exists())
+                {
+                    old.delete();
+                }
+                _passwordFile.renameTo(old);
+                tmp.renameTo(_passwordFile);
+                tmp.delete();
+            }
         }
         finally
         {
-            if (reader != null)
+            if (_userUpdate.isHeldByCurrentThread())
             {
-                reader.close();
+                _userUpdate.unlock();
             }
         }
     }
-
+    
     public void reload() throws IOException
     {
-        //This PD is not cached, so do nothing.
+        loadPasswordFile();
     }
 }
diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/auth/database/PlainUser.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/auth/database/PlainUser.java
new file mode 100644
index 0000000000..46a78a55aa
--- /dev/null
+++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/auth/database/PlainUser.java
@@ -0,0 +1,106 @@
+/*
+*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.qpid.server.security.auth.database;
+
+import org.apache.log4j.Logger;
+
+import java.security.Principal;
+
+public class PlainUser implements Principal
+{
+    private String _name;
+    private char[] _password;
+    private boolean _modified = false;
+    private boolean _deleted = false;
+
+    PlainUser(String[] data)
+    {
+        if (data.length != 2)
+        {
+            throw new IllegalArgumentException("User Data should be length 2, username, password");
+        }
+
+        _name = data[0];
+
+        _password = data[1].toCharArray();
+
+    }
+
+    public PlainUser(String name, char[] password)
+    {
+        _name = name;
+        _password = password;
+        _modified = true;
+    }
+
+    public String getName()
+    {
+        return _name;
+    }
+
+    public String toString()
+    {
+        return _name;
+    }
+
+    char[] getPassword()
+    {
+        return _password;
+    }
+    
+    byte[] getPasswordBytes()
+    {
+        byte[] byteArray = new byte[_password.length];
+        int index = 0;
+        for (char c : _password)
+        {
+            byteArray[index++] = (byte) c;
+        }
+        return byteArray;
+    }
+
+    void setPassword(char[] password)
+    {
+        _password = password;
+        _modified = true;
+    }
+
+    public boolean isModified()
+    {
+        return _modified;
+    }
+
+    public boolean isDeleted()
+    {
+        return _deleted;
+    }
+
+    public void delete()
+    {
+        _deleted = true;
+    }
+
+    public void saved()
+    {
+        _modified = false;
+    }
+
+}
diff --git a/qpid/java/broker/src/test/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabaseTest.java b/qpid/java/broker/src/test/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabaseTest.java
new file mode 100644
index 0000000000..20b8d0a7b4
--- /dev/null
+++ b/qpid/java/broker/src/test/java/org/apache/qpid/server/security/auth/database/PlainPasswordFilePrincipalDatabaseTest.java
@@ -0,0 +1,396 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.qpid.server.security.auth.database;
+
+import junit.framework.TestCase;
+
+import javax.security.auth.login.AccountNotFoundException;
+
+import org.apache.qpid.server.security.auth.sasl.UsernamePrincipal;
+
+import java.io.BufferedReader;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileReader;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.security.Principal;
+import java.util.List;
+import java.util.regex.Pattern;
+
+public class PlainPasswordFilePrincipalDatabaseTest extends TestCase
+{
+
+    private static final String TEST_COMMENT = "# Test Comment";
+    private static final String TEST_PASSWORD = "testPassword";
+    private static final char[] TEST_PASSWORD_CHARS = TEST_PASSWORD.toCharArray();
+    private static final String TEST_USERNAME = "testUser";
+    
+    private Principal _principal = new UsernamePrincipal(TEST_USERNAME);
+    private PlainPasswordFilePrincipalDatabase _database;
+
+    public void setUp() throws Exception
+    {
+        _database = new PlainPasswordFilePrincipalDatabase();
+    }
+
+    // ******* Test Methods ********** //
+
+    public void testCreatePrincipal()
+    {
+        File testFile = createPasswordFile(1, 0);
+
+        loadPasswordFile(testFile);
+
+        final String CREATED_PASSWORD = "guest";
+        final String CREATED_USERNAME = "createdUser";
+
+        Principal principal = new Principal()
+        {
+            public String getName()
+            {
+                return CREATED_USERNAME;
+            }
+        };
+
+        assertTrue("New user not created.", _database.createPrincipal(principal, CREATED_PASSWORD.toCharArray()));
+
+        loadPasswordFile(testFile);
+
+        assertNotNull("Created User was not saved", _database.getUser(CREATED_USERNAME));
+
+        assertFalse("Duplicate user created.", _database.createPrincipal(principal, CREATED_PASSWORD.toCharArray()));
+
+        testFile.delete();
+    }
+
+    public void testCreatePrincipalIsSavedToFile()
+    {
+
+        File testFile = createPasswordFile(1, 0);
+
+        loadPasswordFile(testFile);
+
+        Principal principal = new Principal()
+        {
+            public String getName()
+            {
+                return TEST_USERNAME;
+            }
+        };
+
+        _database.createPrincipal(principal, TEST_PASSWORD_CHARS);
+
+        try
+        {
+            BufferedReader reader = new BufferedReader(new FileReader(testFile));
+
+            assertTrue("File has no content", reader.ready());
+
+            assertEquals("Comment line has been corrupted.", TEST_COMMENT, reader.readLine());
+
+            assertTrue("File is missing user data.", reader.ready());
+
+            String userLine = reader.readLine();
+
+            String[] result = Pattern.compile(":").split(userLine);
+
+            assertEquals("User line not complete '" + userLine + "'", 2, result.length);
+
+            assertEquals("Username not correct,", TEST_USERNAME, result[0]);
+            assertEquals("Password not correct,", TEST_PASSWORD, result[1]);
+
+            assertFalse("File has more content", reader.ready());
+
+        }
+        catch (IOException e)
+        {
+            fail("Unable to valdate file contents due to:" + e.getMessage());
+        }
+        testFile.delete();
+    }
+    
+    public void testDeletePrincipal()
+    {
+        File testFile = createPasswordFile(1, 1);
+
+        loadPasswordFile(testFile);
+
+        Principal user = _database.getUser(TEST_USERNAME + "0");
+        assertNotNull("Generated user not present.", user);
+
+        try
+        {
+            _database.deletePrincipal(user);
+        }
+        catch (AccountNotFoundException e)
+        {
+            fail("User should be present" + e.getMessage());
+        }
+
+        try
+        {
+            _database.deletePrincipal(user);
+            fail("User should not be present");
+        }
+        catch (AccountNotFoundException e)
+        {
+            //pass
+        }
+
+        loadPasswordFile(testFile);
+
+        try
+        {
+            _database.deletePrincipal(user);
+            fail("User should not be present");
+        }
+        catch (AccountNotFoundException e)
+        {
+            //pass
+        }
+
+        assertNull("Deleted user still present.", _database.getUser(TEST_USERNAME + "0"));
+
+        testFile.delete();
+    }
+
+    public void testGetUsers()
+    {
+        int USER_COUNT = 10;
+        File testFile = createPasswordFile(1, USER_COUNT);
+
+        loadPasswordFile(testFile);
+
+        Principal user = _database.getUser("MISSING_USERNAME");
+        assertNull("Missing user present.", user);
+
+        List<Principal> users = _database.getUsers();
+
+        assertNotNull("Users list is null.", users);
+
+        assertEquals(USER_COUNT, users.size());
+
+        boolean[] verify = new boolean[USER_COUNT];
+        for (int i = 0; i < USER_COUNT; i++)
+        {
+            Principal principal = users.get(i);
+
+            assertNotNull("Generated user not present.", principal);
+
+            String name = principal.getName();
+
+            int id = Integer.parseInt(name.substring(TEST_USERNAME.length()));
+
+            assertFalse("Duplicated username retrieve", verify[id]);
+            verify[id] = true;
+        }
+
+        for (int i = 0; i < USER_COUNT; i++)
+        {
+            assertTrue("User " + i + " missing", verify[i]);
+        }
+
+        testFile.delete();
+    }
+
+    public void testUpdatePasswordIsSavedToFile()
+    {
+
+        File testFile = createPasswordFile(1, 1);
+
+        loadPasswordFile(testFile);
+
+        Principal testUser = _database.getUser(TEST_USERNAME + "0");
+
+        assertNotNull(testUser);
+
+        String NEW_PASSWORD = "NewPassword";
+        try
+        {
+            _database.updatePassword(testUser, NEW_PASSWORD.toCharArray());
+        }
+        catch (AccountNotFoundException e)
+        {
+            fail(e.toString());
+        }
+
+        try
+        {
+            BufferedReader reader = new BufferedReader(new FileReader(testFile));
+
+            assertTrue("File has no content", reader.ready());
+
+            assertEquals("Comment line has been corrupted.", TEST_COMMENT, reader.readLine());
+
+            assertTrue("File is missing user data.", reader.ready());
+
+            String userLine = reader.readLine();
+
+            String[] result = Pattern.compile(":").split(userLine);
+
+            assertEquals("User line not complete '" + userLine + "'", 2, result.length);
+
+            assertEquals("Username not correct,", TEST_USERNAME + "0", result[0]);
+            assertEquals("New Password not correct,", NEW_PASSWORD, result[1]);
+
+            assertFalse("File has more content", reader.ready());
+
+        }
+        catch (IOException e)
+        {
+            fail("Unable to valdate file contents due to:" + e.getMessage());
+        }
+        testFile.delete();
+    }
+
+    public void testSetPasswordFileWithMissingFile()
+    {
+        try
+        {
+            _database.setPasswordFile("DoesntExist");
+        }
+        catch (FileNotFoundException fnfe)
+        {
+            assertTrue(fnfe.getMessage(), fnfe.getMessage().startsWith("Cannot find password file"));
+        }
+        catch (IOException e)
+        {
+            fail("Password File was not created." + e.getMessage());
+        }
+
+    }
+
+    public void testSetPasswordFileWithReadOnlyFile()
+    {
+
+        File testFile = createPasswordFile(0, 0);
+
+        testFile.setReadOnly();
+
+        try
+        {
+            _database.setPasswordFile(testFile.toString());
+        }
+        catch (FileNotFoundException fnfe)
+        {
+            assertTrue(fnfe.getMessage().startsWith("Cannot read password file "));
+        }
+        catch (IOException e)
+        {
+            fail("Password File was not created." + e.getMessage());
+        }
+
+        testFile.delete();
+    }
+    
+    private void createUserPrincipal() throws IOException
+    {
+        File testFile = createPasswordFile(0, 0);
+        loadPasswordFile(testFile);
+        
+        _database.createPrincipal(_principal, TEST_PASSWORD_CHARS);
+        Principal newPrincipal = _database.getUser(TEST_USERNAME);
+        assertNotNull(newPrincipal);
+        assertEquals(_principal.getName(), newPrincipal.getName());
+    }
+    
+    public void testVerifyPassword() throws IOException, AccountNotFoundException
+    {
+        createUserPrincipal();
+        assertFalse(_database.verifyPassword(TEST_USERNAME, new char[]{}));
+        assertFalse(_database.verifyPassword(TEST_USERNAME, "massword".toCharArray()));
+        assertTrue(_database.verifyPassword(TEST_USERNAME, TEST_PASSWORD_CHARS));
+        
+        try
+        {
+            _database.verifyPassword("made.up.username", TEST_PASSWORD_CHARS);
+            fail("Should not have been able to verify this non-existant users password.");
+        }
+        catch (AccountNotFoundException e)
+        {
+            // pass
+        }
+    }
+    
+    public void testUpdatePassword() throws IOException, AccountNotFoundException 
+    {
+        createUserPrincipal();
+        char[] newPwd = "newpassword".toCharArray();
+        _database.updatePassword(_principal, newPwd);
+        assertFalse(_database.verifyPassword(TEST_USERNAME, TEST_PASSWORD_CHARS));
+        assertTrue(_database.verifyPassword(TEST_USERNAME, newPwd));
+    }
+ 
+    
+    
+    // *********** Utility Methods ******** //
+    
+    private File createPasswordFile(int commentLines, int users)
+    {
+        try
+        {
+            File testFile = File.createTempFile(this.getClass().getName(),"tmp");
+            testFile.deleteOnExit();
+
+            BufferedWriter writer = new BufferedWriter(new FileWriter(testFile));
+
+            for (int i = 0; i < commentLines; i++)
+            {
+                writer.write(TEST_COMMENT);
+                writer.newLine();
+            }
+
+            for (int i = 0; i < users; i++)
+            {
+                writer.write(TEST_USERNAME + i + ":" + TEST_PASSWORD);
+                writer.newLine();
+            }
+
+            writer.flush();
+            writer.close();
+
+            return testFile;
+
+        }
+        catch (IOException e)
+        {
+            fail("Unable to create test password file." + e.getMessage());
+        }
+
+        return null;
+    }
+
+    private void loadPasswordFile(File file)
+    {
+        try
+        {
+            _database.setPasswordFile(file.toString());
+        }
+        catch (IOException e)
+        {
+            fail("Password File was not created." + e.getMessage());
+        }
+    }
+    
+    
+}
diff --git a/qpid/java/broker/src/test/java/org/apache/qpid/server/security/auth/database/PlainUserTest.java b/qpid/java/broker/src/test/java/org/apache/qpid/server/security/auth/database/PlainUserTest.java
new file mode 100644
index 0000000000..7f0843d46e
--- /dev/null
+++ b/qpid/java/broker/src/test/java/org/apache/qpid/server/security/auth/database/PlainUserTest.java
@@ -0,0 +1,78 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.qpid.server.security.auth.database;
+
+import junit.framework.TestCase;
+
+/*
+    Note PlainUser is mainly tested by PlainPFPDTest, this is just to catch the extra methods
+ */
+public class PlainUserTest extends TestCase
+{
+
+    String USERNAME = "username";
+    String PASSWORD = "password";
+
+    public void testTooLongArrayConstructor()
+    {
+        try
+        {
+            PlainUser user = new PlainUser(new String[]{USERNAME, PASSWORD, USERNAME});
+            fail("Error expected");
+        }
+        catch (IllegalArgumentException e)
+        {
+            assertEquals("User Data should be length 2, username, password", e.getMessage());
+        }
+    }
+
+    public void testStringArrayConstructor()
+    {
+        PlainUser user = new PlainUser(new String[]{USERNAME, PASSWORD});
+        assertEquals("Username incorrect", USERNAME, user.getName());
+        int index = 0;
+
+        char[] password = PASSWORD.toCharArray();
+
+        try            
+        {
+            for (byte c : user.getPasswordBytes())
+            {
+                assertEquals("Password incorrect", password[index], (char) c);
+                index++;
+            }
+        }
+        catch (Exception e)
+        {
+            fail(e.getMessage());
+        }
+
+        password = PASSWORD.toCharArray();
+
+        index=0;
+        for (char c : user.getPassword())
+        {
+            assertEquals("Password incorrect", password[index], c);
+            index++;
+        }
+    }
+}
+