/*

   Derby - Class 
      org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest

   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

 */

package org.apache.derbyTesting.functionTests.tests.derbynet;

import java.io.PrintWriter;
import java.io.StringWriter;
import java.sql.CallableStatement;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.HashMap;
import javax.sql.ConnectionPoolDataSource;
import javax.sql.DataSource;
import javax.sql.PooledConnection;
import junit.framework.Test;
import org.apache.derbyTesting.junit.BaseJDBCTestCase;
import org.apache.derbyTesting.junit.BaseTestSuite;
import org.apache.derbyTesting.junit.DatabasePropertyTestSetup;
import org.apache.derbyTesting.junit.J2EEDataSource;
import org.apache.derbyTesting.junit.JDBCDataSource;
import org.apache.derbyTesting.junit.NetworkServerTestSetup;
import org.apache.derbyTesting.junit.TestConfiguration;

/**
 * This class tests the security mechanisms supported by Network Server
 * Network server supports SECMEC_EUSRIDPWD, SECMEC_USRIDPWD, SECMEC_USRIDONL
 * and SECMEC_USRSSBPWD.
 * 
 * -----------------------------------------------------------------
 * Security Mechanism | secmec           | User friendly name   
 *                    |  codepoint value |
 * -----------------------------------------------------------------
 * USRIDONL           | 0x04             | USER_ONLY_SECURITY
 * USRIDPWD           | 0x03             | CLEAR_TEXT_PASSWORD_SECURITY
 * EUSRIDPWD          | 0x09             | ENCRYPTED_USER_AND_PASSWORD_SECURITY
 * USRSSBPWD          | 0x08             | STRONG_PASSWORD_SUBSTITUTE_SECURITY
 * -----------------------------------------------------------------
 * 
 * Key points: 
 * #1) Server and client support encrypted userid/password (EUSRIDPWD) via the
 * use of Diffie Helman key-agreement protocol - but current Open Group DRDA
 * specifications imposes small prime and base generator values (256 bits) that
 * prevents other JCE's to be used as java cryptography providers - typical
 * minimum security requirements is usually of 1024 bits (512-bit absolute
 * minimum) when using DH key-agreement protocol to generate a session key.
 * 
 * (Reference: DDM manual, page 281 and 282. Section: Generating the shared
 * private key. DRDA's diffie helman agreed public values for prime are 256
 * bits. The spec gives the public values for the prime, generator and the size
 * of exponent required for DH . These values must be used as is to generate a
 * shared private key.)
 * 
 * Encryption is done using JCE. Hence JCE support of the necessary algorithm
 * is required for a particular security mechanism to work. Thus even though 
 * the server and client have code to support EUSRIDPWD, this security 
 * mechanism will not work in all JVMs.
 * 
 * JVMs where support for DH(32byte prime) is not available and thus EUSRIDPWD
 * won't work are Sun JVM (versions 1.3.1,1.4.1,1.4.2,1.5) and IBM JVM (
 * versions 1.3.1 and some old versions of 1.4.2 (in 2004))
 * 
 * JVMs where support for DH(32bytes prime) is available and thus EUSRIDPWD 
 * will work are IBM JVM [versions 1.4.1, later versions of 1.4.2 (from 2005),
 * 1.5]
 * 
 * #2) Note, if  server restricts the client connections based on security 
 * mechanism by setting derby.drda.securityMechanism, in that case the clients 
 * will see an error similar to this:
 * "Connection authorization failure occurred. Reason: security mechanism not
 *  supported"
 *
 * #3) USRSSBPWD - Strong password substitute is only supported starting from
 *     Apache Derby 10.2.
 *	 NOTE: USRSSBPWD only works with the derby network client driver for now.
 *   ---- 
 */
public class NSSecurityMechanismTest extends BaseJDBCTestCase
{
    // values for derby.drda.securityMechanism property
    private static String[] derby_drda_securityMechanisms = {
        null, // not set 
        "USER_ONLY_SECURITY", "CLEAR_TEXT_PASSWORD_SECURITY",
        // this will give a DRDA_InvalidValue with jvms that do not support it
        "ENCRYPTED_USER_AND_PASSWORD_SECURITY",
        "STRONG_PASSWORD_SUBSTITUTE_SECURITY",
        //these two are always invalid values, again, will give DRDA_InvalidValue
        "INVALID_VALUE", ""};
    
    private static String derby_drda_securityMechanism;

    // possible interesting combinations with respect to security mechanism
    // upgrade logic for user attribute
    private static String[] USER_ATTRIBUTE = {"calvin",null};

    // possible interesting combinations with respect to security mechanism
    // upgrade logic for password attribute
    private static String[] PWD_ATTRIBUTE = {"hobbes",null};

    public NSSecurityMechanismTest(String name)
    {
        super(name);
    }
    
    public static Test suite() 
    {
        BaseTestSuite suite = new BaseTestSuite("NSSecurityMechanismTest");

        BaseTestSuite clientSuite =
            new BaseTestSuite("NSSecurityMechanismTest - client");
        clientSuite.addTest(new NSSecurityMechanismTest(
            "testNetworkServerSecurityMechanism"));
        suite.addTest(TestConfiguration.clientServerDecorator(clientSuite));

        // Test case for embedded mode. Enable builtin authentication.
        suite.addTest(
            DatabasePropertyTestSetup.builtinAuthentication(
                new NSSecurityMechanismTest("testSecurityMechanismOnEmbedded"),
                new String[] { "calvin" }, "pw"));
        return suite;
    }
    
    protected void tearDown() throws Exception {
        removeSystemProperty("derby.drda.securityMechanism");

        super.tearDown();
    }

    // Indicates userid/encrypted password security mechanism.
    static final short SECMEC_EUSRIDPWD = 0x09;

    // Indicates userid only security mechanism.
    static final short SECMEC_USRIDONL = 0x04;

    // Indicates userid/encrypted password security mechanism.
    static final short SECMEC_USRENCPWD = 0x07;

    // Indicates userid/new password security mechanism.
    static final short SECMEC_USRIDNWPWD = 0x05;

    // Indicates userid/password security mechanism.
    static final short SECMEC_USRIDPWD = 0x03;

    // Indicates strong password substitute security mechanism.
    static final short SECMEC_USRSSBPWD = 0x08;

    // client and server recognize these secmec values
    private static short[] SECMEC_ATTRIBUTE = {
        SECMEC_USRIDONL,
        SECMEC_USRIDPWD,
        SECMEC_EUSRIDPWD,
        SECMEC_USRSSBPWD
    };

    /**
     *  Test cases for security mechanism
     *  ---------------------------------------------------------------
     *  DriverManager:
     *  T1 - default , no user      PASS (for derbyclient)
     *  T2 - user only              PASS (for derbyclient)
     *  T3 - user,password          PASS (only for derbynet)
     *  T4 - user,password, security mechanism not set  FAIL
     *  T5 - user,password, security mechanism set
     *       to SECMEC_EUSRIDPWD  PASS/FAIL
     *       (Fails with Sun JVM as EUSRIDPWD secmec cannot be used)
     *  T6 - user, security mechanism set to SECMEC_USRIDONL   PASS
     *  T7 - user,password, security mechanism set to SECMEC_USRENCPWD  FAIL
     *  Test with datasource as well as DriverManager
     *  T8 - user,password security mechanism set to SECMEC_USRIDONL   PASS
     *  T9 - user,password security mechanism set to SECMEC_USRSSBPWD  PASS
     *  Test with datasource as well as DriverManager
     * Note, that with DERBY-928, the pass/fail for the connections will depend 
     * on the security mechanism specified at the server by property 
     * derby.drda.securityMechanism.  Please check out the following
     * html file http://issues.apache.org/jira/secure/attachment/12322971/Derby928_Table_SecurityMechanisms..htm
     * for a combination of url/security mechanisms and the expected results 
     */
    public void testNetworkServerSecurityMechanism() throws SQLException, Exception
    {
        String[][] allDriverManagerExpectedValues = {
            {"null",
                "OK","OK","OK","OK","OK","OK","?","OK","OK"},
            {"USER_ONLY_SECURITY",
                "OK","OK","08004","08004","08004","OK","?","OK","08004"},
            {"CLEAR_TEXT_PASSWORD_SECURITY",
                "08004","08004","OK","OK","08004","08004",
                "?","08004","08004"},
            // this should give a DRDA_InvalidValue with jvms that do not
            // support it. For instance, it will fail with jdk14 jvms.
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","08004","08004","OK","08004",
                "?","08004","08004"},
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                    "08004","08004","08004","08004","08004","08004",
                    "?","08004","OK"},
            };
        
        String[][] allDataSourceExpectedValues = {
            {null,"OK","OK","OK","OK"},
            {"USER_ONLY_SECURITY","OK","08004","08004","08004"},
            {"CLEAR_TEXT_PASSWORD_SECURITY","08004","OK","08004","08004"},
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","OK","08004"},
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                "08004","08004","08004","OK"}};
        
        String[] DERBY1080ExpectedValues = {"OK","08004","08004","OK","08004"};
        
        String[][] allUserPwdSecMecExpectedValues = {
            // if secmec is null, all expected to pass.
            {null},
            {"USER_ONLY_SECURITY",
                "08004","OK","08004","08004","08004", 
                "OK","OK","08001.C.8","08001.C.8","08001.C.8",
                "08004","OK","08004","08004","08004",
                "OK","OK","08001.C.8","08001.C.8","08001.C.8"
            },
            {"CLEAR_TEXT_PASSWORD_SECURITY",
                "OK","08004","OK","08004","08004", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "OK","08004","OK","08004","08004",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            },
            {"ENCRYPTED_USER_AND_PASSWORD_SECURITY",
                "08004","08004","08004","OK","08004", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "08004","08004","08004","OK","08004",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            },
            {"STRONG_PASSWORD_SUBSTITUTE_SECURITY",
                "08004","08004","08004","08004","OK", 
                "08004","08004","08001.C.8","08001.C.8","08001.C.8",
                "08004","08004","08004","08004","OK",
                "08004","08004","08001.C.8","08001.C.8","08001.C.8"
            }
        };
        
        String[] testDERBY528ExpectedValues = {
            null,"08006","OK","08004","08006"
        };
        
        // just to see if this will work
        getConnection().getAutoCommit();
        
        for ( int i = 0; i < derby_drda_securityMechanisms.length; i++)
        {   
            derby_drda_securityMechanism = derby_drda_securityMechanisms[i];

            // Using 'null' will give a nullpointer exception...
            // as it's the first in the array, it should use default setting
            if (derby_drda_securityMechanism != null)
            {
                if (derby_drda_securityMechanism.equals(
                        "STRONG_PASSWORD_SUBSTITUTE_SECURITY") &&
                        !hasSufficientEntropy()) {
                    println("skipping USRSSBPWD secmec due to " +
                            "assumed lack of entropy");
                    continue;
                }
                // with "" or "INVALID_VALUE", or with other mechanisms with
                // certain jvms, some settings are not supported. Flag the loop
                // to not try connections
                if (setSecurityMechanism(derby_drda_securityMechanism))
                    continue;
            }
            // Test cases with get connection via drivermanager and via
            // datasource, using different security mechanisms.
            // Network server supports SECMEC_USRIDPWD, SECMEC_USRIDONL,
            // SECMEC_EUSRIDPWD and USRSSBPWD (derby network client only)

            assertConnectionsUsingDriverManager(
                allDriverManagerExpectedValues[i]);
            
            assertConnectionUsingDataSource(allDataSourceExpectedValues[i]);

            // regression test for DERBY-1080
            assertDerby1080Fixed(DERBY1080ExpectedValues[i]);

            // test for DERBY-962
            // test all combinations of user/password with security mechanism
            assertAllCombinationsOfUserPasswordSecMecInputOK(
                allUserPwdSecMecExpectedValues[i]);

            // test USRSSBPWD (DERBY-528) with Derby BUILTIN authentication 
            // scheme both with none and USRSSBPWD specified DRDA SecMec upon
            // starting the network server.
            if ((derby_drda_securityMechanism == null) ||
                (derby_drda_securityMechanism.equals(
                "STRONG_PASSWORD_SUBSTITUTE_SECURITY")))
            {
                assertUSRSSBPWD_with_BUILTIN(testDERBY528ExpectedValues);
            }
            else
            {
                // shutdown the database - this will prevent slow startup 
                // when bouncing the server with next security mechanism.
                // for ENCRYPTED_USER_AND_PASSWORD_SECURITY:
                short secmeccode=SECMEC_EUSRIDPWD;
                if (derby_drda_securityMechanism.equals("USER_ONLY_SECURITY"))
                    secmeccode=SECMEC_USRIDONL;
                else if (derby_drda_securityMechanism.equals(
                    "CLEAR_TEXT_PASSWORD_SECURITY"))
                    secmeccode=SECMEC_USRIDPWD;
                assertConnectionUsingDriverManager(getJDBCUrl(
                    "user=APP;password=APP;shutdown=true;securityMechanism=" +
                    secmeccode)," BUILTIN (T5):",
                    "08006");
            }
        }
    }

    /**
     * Test that securityMechanism=8 is ignored by the embedded driver
     * (DERBY-3025).
     */
    public void testSecurityMechanismOnEmbedded() throws SQLException {
        DataSource ds = JDBCDataSource.getDataSource();
        JDBCDataSource.setBeanProperty(
            ds, "connectionAttributes", "securityMechanism=8");

        // DERBY-3025: NullPointerException or AssertFailure was thrown here
        Connection c = ds.getConnection("calvin", "calvinpw");

        c.close();
    }

    // returns a boolean true if the security mechanism is not supported
    // so the loop in which this is called can be continued without
    // causing unnecessary/impossible tests to be run
    private boolean setSecurityMechanism(String derby_security_mechanism) 
    throws Exception {
        try {
            // shut down the currently running
            // server, before setting the next security mechanism
            NetworkServerTestSetup.getNetworkServerControl().shutdown();
        } catch (Exception e) {
            if (!(e.getMessage().substring(0,17).equals("DRDA_InvalidValue")))
            {
                fail("unexpected error");
            }
        }

        // Before attempting to start a new server, wait for the previous
        // server to complete and release the server port.
        NetworkServerTestSetup.waitForAvailablePort();

        setSystemProperty("derby.drda.securityMechanism",
                derby_drda_securityMechanism);
        try {
            
            // if the security mechanism isn't supported or invalid, getting a
            // networkservercontrol will fail.

            // For debugging, to make output come to console call start() with
            // new PrintWriter(System.out, true) instead of null.
            NetworkServerTestSetup.getNetworkServerControl().start(null);
            NetworkServerTestSetup.waitForServerStart(
                    NetworkServerTestSetup.getNetworkServerControl());
            
            if (derby_drda_securityMechanism.equals("") ||
                derby_drda_securityMechanism.equals("INVALID_VALUE"))
            {
                fail(
                    "expected server not to start with invalid or empty " +
                     "security mechanism, but passed");
            }
        } catch (Exception e) {
            // "" or "INVALID_VALUE" should always give DRDA_Invalid_Value, 
            // hence the 'fail' above.
            // However, other mechanisms may not be supported with certain
            // jvms, and then also will get the same exception. This is true
            // for ENCRYPTED_USER_AND_PASSWORD_SECURITY.
            // If we're not getting DRDA_Invalid_Value here, something's gone
            // wrong.
            if (derby_drda_securityMechanism.equals("") ||
                derby_drda_securityMechanism.equals("INVALID_VALUE") ||
                derby_drda_securityMechanism.equals(
                    "ENCRYPTED_USER_AND_PASSWORD_SECURITY"))
            {
                // should give invalid value 
                assertEquals("DRDA_InvalidValue",e.getMessage().substring(0,17));
                return true;
            }
            fail ("got unexpected exception setting the mechanism " + 
                derby_security_mechanism + "; message: " + e.getMessage());
        }
        return false;
    }

    private void assertConnectionsUsingDriverManager(String[] expectedValues)
    {
        assertConnectionUsingDriverManager(
            getJDBCUrl(null),"T1:", expectedValues[1]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=max"),"T2:", expectedValues[2]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=lee"),"T3:", expectedValues[3]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=lee;securityMechanism=" +
            SECMEC_USRIDPWD),"T4:", expectedValues[4]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=lee;securityMechanism=" +
            SECMEC_EUSRIDPWD),"T5:", expectedValues[5]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;securityMechanism=" +
            SECMEC_USRIDONL),"T6:", expectedValues[6]);

        // disable as ibm142 and sun jce doesnt support DH prime of 32 bytes
        //assertConnectionUsingDriverManager(
        //    getJDBCUrl("user=neelima;password=lee;securityMechanism=" +
        //    SECMEC_USRENCPWD),"T7:", expectedValues[7]);
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=lee;securityMechanism=" +
            SECMEC_USRIDONL),"T8:", expectedValues[8]);
        // Test strong password substitute DRDA security mechanism 
        // (only works with DerbyClient driver right now)
        assertConnectionUsingDriverManager(
            getJDBCUrl("user=neelima;password=lee;securityMechanism=" +
            SECMEC_USRSSBPWD),"T9:", expectedValues[9]);
    }
    
    
    /**
     * Get connection from datasource and also set security mechanism
     */
    private void assertConnectionUsingDataSource(String[] expectedValues)
    {
        if (usingDerbyNetClient())
        {
            assertSecurityMechanismOK("sarah",null, SECMEC_USRIDONL,"SECMEC_USRIDONL:", expectedValues[1]);
        }
        assertSecurityMechanismOK("john","sarah", SECMEC_USRIDPWD,"SECMEC_USRIDPWD:", expectedValues[2]);

        if (usingDerbyNetClient())
        {
            // Please note: EUSRIDPWD security mechanism in DRDA uses 
            // Diffie-Helman for generation of shared keys. The spec specifies
            // the prime to use for DH which is 32 bytes and this needs to be
            // used as is.
            // Sun JCE does not support a prime of 32 bytes for Diffie Helman
            // nor do some older versions of IBM JCE (1.4.2).
            // Hence the following call to get connection might not be 
            // successful when client is running in a JVM where the JCE does
            // not support the DH (32 byte prime).
            // The test methods are implemented to work either way.
            assertSecurityMechanismOK("john","sarah",SECMEC_EUSRIDPWD,"SECMEC_EUSRIDPWD:", expectedValues[3]);
            assertSecurityMechanismOK("john","sarah",SECMEC_USRSSBPWD,"SECMEC_USRSSBPWD:", expectedValues[4]);
        }
    }

    private void assertSecurityMechanismOK(String user, String password,
        Short secmec, String msg, String expectedValue)
    {
        // Skip this USRSSBPWD on platforms that are short on entropy.
        if (secmec.shortValue() == SECMEC_USRSSBPWD && !hasSufficientEntropy()){
            return;
        }
        Connection conn;

        DataSource ds = getDS(user,password);
        try {
            JDBCDataSource.setBeanProperty(ds,
                    "SecurityMechanism", secmec);
            conn = ds.getConnection(user, password);
            conn.close();
            // EUSRIDPWD is supported with some jvm( version)s, not with others
            if (!(secmec.equals(SECMEC_EUSRIDPWD)))
            {
                if (!expectedValue.equals("OK"))
                {
                    fail("should have encountered an Exception");
                }
            }
        }
        catch (SQLException sqle)
        {
            if (sqle.getSQLState().equals("08001"))
            {
                // with null user id there's a difference between errors coming
                // from driver manager vs. datasource, because the datasource
                // getconnection call had to be specify user/password or the 
                // junit framework pads it with 'APP'.
                if (user == null)
                    assertSQLState08001("08001.C.7", sqle);
                else
                    assertSQLState08001(expectedValue, sqle);
            }
            // Exceptions expected in certain cases depending on JCE used for 
            // running the test. So, instead of '08004' (connection refused),
            // or "OK", we may see 'not supported' (XJ112).
            else if (secmec.equals(SECMEC_EUSRIDPWD)) 
            {
                if (!(sqle.getSQLState().equals("XJ112")))
                    assertSQLState(expectedValue, sqle);
            }
            else
                assertSQLState(expectedValue, sqle);
            // for debugging, uncomment:
            //dumpSQLException(sqle.getNextException());
        }
        catch (Exception e)
        {   
            fail(" should not have seen an exception");
        }
    }

    private void assertConnectionUsingDriverManager(
        String dbUrl, String msg, String expectedValue)
    {
        if (!hasSufficientEntropy() &&
                dbUrl.indexOf("securityMechanism=8") != -1) {
            return;
        }
        try
        {
            TestConfiguration.getCurrent();
            DriverManager.getConnection(dbUrl).close();
            // Please note: EUSRIDPWD security mechanism in DRDA uses 
            // Diffie-Helman for generation of shared keys. 
            // The spec specifies the prime to use for DH which is 32 bytes and
            // this needs to be used as is. Sun JCE does not support a prime of
            // 32 bytes for Diffie Helman and some older versions of IBM JCE 
            // ( 1.4.2) also do not support it. Hence the following call to get 
            // connection might not be successful when client is running in JVM
            // where the JCE does not support the DH (32 byte prime)
            
            if (derby_drda_securityMechanism != null && 
                !(derby_drda_securityMechanism.equals(
                "ENCRYPTED_USER_AND_PASSWORD_SECURITY") &&
                ((msg.indexOf("T5")>0) || (dbUrl.indexOf("9")>0))))
            {
                if (!expectedValue.equals("OK"))
                    fail("should have encountered an Exception");
            }
        }
        catch(SQLException sqle)
        {
            // if we're trying T5, and we've got EUSRIDPWD, 08004 is also
            // possible, or XJ112 instead of OK.
            if (derby_drda_securityMechanism != null  &&
                derby_drda_securityMechanism.equals(
                "ENCRYPTED_USER_AND_PASSWORD_SECURITY") &&
                ((msg.indexOf("T5")>0) ))
            {
                if (!(sqle.getSQLState().equals("XJ112")))
                    assertSQLState(expectedValue, sqle);
            }
            else if (sqle.getSQLState().equals("08001"))
                assertSQLState08001(expectedValue, sqle);
            else if (dbUrl.indexOf("9")>0)
            {
                if (!(sqle.getSQLState().equals("XJ112")))
                    assertSQLState(expectedValue, sqle);
            }
            else if (sqle.getSQLState().equals("XJ001"))
            {
                // we might have hit DERBY-6702. We know the stack trace
                // of that situation, so skip if we see it, except to repeat
                // the passed in values.
                StringWriter sw = new StringWriter();
                sqle.printStackTrace(new PrintWriter(sw));
                if (!sw.toString().contains(
                    "java.lang.InternalError: Unexpected CryptoAPI failure"))
                    assertSQLState(expectedValue, sqle);
                else
                    alarm("hit DERBY-6702; for values:" +
                    "\n\t dbURL: " + dbUrl +
                    "\n\t msg: " + msg + 
                    "\n\t expectedValue: " + expectedValue + "\n");
            }
            else 
            {
                if (expectedValue.length() < 5) {
                    StringWriter sw = new StringWriter();
                    sqle.printStackTrace(new PrintWriter(sw));
                    String emsgtxt = "unexpected failure..." +
                        "\n\t dbURL: " + dbUrl +
                        "\n\t msg: " + msg + 
                        "\n\t expectedValue: " + expectedValue ; 
                    fail (emsgtxt, sqle);
                }
                else
                    assertSQLState(expectedValue, sqle);
            }
            //for debugging sqles, uncomment: 
            // dumpSQLException(sqle.getNextException());
        }
    }

    /**
     * Test different interesting combinations of user,password, security 
     * mechanism for testing security mechanism upgrade logic. This test
     * has been added as part of DERBY-962. Two things have been fixed in
     * DERBY-962, affects only client behavior.
     *
     * 1)Upgrade logic should not override security mechanism if it has been 
     * explicitly set in connection request (either via DriverManager or 
     * using DataSource)
     *
     * 2)Upgrade security mechanism to a more secure one , ie preferably 
     * to encrypted userid and password if the JVM in which the client is 
     * running has support for it.
     * 
     * Details are:  
     * If security mechanism is not specified as part of the connection 
     * request, then client will do an automatic switching (upgrade) of 
     * security mechanism to use. The logic is as follows :
     * if password is available, and if the JVM in which the client is running 
     * supports EUSRIDPWD mechanism, in that case also, USRIDPWD security 
     * mechanism is used. 
     * if password is available, and if the JVM in which the client is running 
     * does not support EUSRIDPWD mechanism, in that case the client will then
     * default to USRIDPWD.
     * Also see DERBY-962 http://issues.apache.org/jira/browse/DERBY-962
     * <BR>
     * To understand which JVMs support EUSRIDPWD or not, please see class
     * level comments (#1)
     * <BR>
     * The expected output from this test will depend on the following
     * -- the client behavior. For the derby client, the table below 
     * represents what security mechanism the client will send to server. 
     * -- Note: in case of derby client, if no user  is specified, user 
     * defaults to APP.
     * -- Will depend on if the server has been started with property 
     * derby.drda.securityMechanism and to the value it is set to.  See method
     * (fixture) testNetworkServerSecurityMechanism() to check if server is 
     * using the derby.drda.securityMechanism to restrict client connections
     * based on security mechanism. 
     * 
     TABLE with all different combinations of userid, password, security
     mechanism of derby client that is covered by this testcase if test
     is run against IBM15 and JDK15. 

     IBM15 supports eusridpwd, whereas SunJDK15 doesnt support EUSRIDPWD

     Security Mechanisms supported by derby server and client
     ====================================================================
     |SecMec     |codepoint value|   User friendly name                  |
     ====================================================================
     |USRIDONL   |   0x04        |   USER_ONLY_SECURITY                  |
     |USRIDPWD   |   0x03        |   CLEAR_TEXT_PASSWORD_SECURITY        |
     |EUSRIDPWD  |   0x09        |   ENCRYPTED_USER_AND_PASSWORD_SECURITY|
     |USRSSBPWD  |   0x08        |   STRONG_PASSWORD_SUBSTITUTE_SECURITY |
     =====================================================================
	 Explanation of columns in table. 

	 a) Connection request specifies a user or not.
	 Note: if no user is specified, client defaults to APP
	 b) Connection request specifies a password or not
	 c) Connection request specifies securityMechanism or not. the valid
	 values are 4(USRIDONL), 3(USRIDPWD), 9(EUSRIDPWD) and 8(USRSSBPWD).
	 d) support eusridpwd means whether this client jvm supports encrypted 
     userid/password security mechanism or not.  A value of Y means it 
     supports and N means no.
	 The next three columns specify what the client sends to the server
	 e) Does client send user information 
	 f) Does client send password information
	 g) What security mechanism value (secmec value) is sent to server.

	 SecMec refers to securityMechanism.
	 Y means yes, N means No,  - or blank means not specified.
	 Err stands for error.
	 Err(1) stands for null password not supported
	 Err(2) stands for case when the JCE does not support encrypted userid and
	 password security mechanism. 
	 ----------------------------------------------------------------
	 | url connection      | support   | Client sends to Server      |
	 |User |Pwd    |secmec |eusridpwd  |User   Pwd    SecMec         |
	 |#a   |#b     |#c     |#d         |#e     #f      #g            |
	 |---------------------------------------------------------------|
	 =================================================================
     |SecMec not specified on connection request                    
	 =================================================================
	 |Y    |Y     |-       |Y         |Y        Y       3            |
	 |----------------------------------------------------------------
	 |     |Y     |-       |Y         |Y        Y       3            |
	 -----------------------------------------------------------------
	 |Y    |      |-       |Y         |Y        N       4            |
	 -----------------------------------------------------------------
	 |     |      |-       |Y         |Y        N       4            |
	 =================================================================
     |Y    |Y     |-       |N         |Y        Y       3            |
     |----------------------------------------------------------------
     |     |Y     |-       |N         |Y        Y       3            |
     -----------------------------------------------------------------
     |Y    |      |-       |N         |Y        N       4            |
     -----------------------------------------------------------------
     |     |      |-       |N         |Y        N       4            |
     =================================================================
	 SecMec specified to 3 (clear text userid and password)
	 =================================================================
     |Y    |Y     |3       |Y         |Y        Y       3            |
     |----------------------------------------------------------------
     |     |Y     |3       |Y         |Y        Y       3            |
     -----------------------------------------------------------------
     |Y    |      |3       |Y         |-        -       Err1         |
     -----------------------------------------------------------------
     |     |      |3       |Y         |-        -       Err1         |
     =================================================================
     |Y    |Y     |3       |N         |Y        Y       3            |
     |----------------------------------------------------------------
     |     |Y     |3       |N         |Y        Y       3            |
     -----------------------------------------------------------------
     |Y    |      |3       |N         |-        -       Err1         |
     -----------------------------------------------------------------
     |     |      |3       |N         |-        -       Err1         |
     =================================================================
	 SecMec specified to 9 (encrypted userid/password)
     =================================================================
     |Y    |Y     |9       |Y         |Y        Y       9            |
     |----------------------------------------------------------------
     |     |Y     |9       |Y         |Y        Y       9            |
     -----------------------------------------------------------------
     |Y    |      |9       |Y         | -       -       Err1         |
     -----------------------------------------------------------------
     |     |      |9       |Y         | -       -       Err1         |
     =================================================================
     |Y    |Y     |9       |N         | -       -       Err2         |
     |----------------------------------------------------------------
     |     |Y     |9       |N         | -       -       Err2         |
     -----------------------------------------------------------------
     |Y    |      |9       |N         | -       -       Err1         |
     -----------------------------------------------------------------
     |     |      |9       |N         | -       -       Err1         |
     =================================================================
	 SecMec specified to 4 (userid only security)
     =================================================================
     |Y    |Y     |4       |Y         |Y        N       4            |
     |----------------------------------------------------------------
     |     |Y     |4       |Y         |Y        N       4            |
     -----------------------------------------------------------------
     |Y    |      |4       |Y         |Y        N       4            |
     -----------------------------------------------------------------
     |     |      |4       |Y         |Y        N       4            |
     =================================================================
     |Y    |Y     |4       |N         |Y        N       4            |
     |----------------------------------------------------------------
     |     |Y     |4       |N         |Y        N       4            |
     -----------------------------------------------------------------
     |Y    |      |4       |N         |Y        N       4            |
     -----------------------------------------------------------------
     |     |      |4       |N         |Y        N       4            |
     =================================================================
	 SecMec specified to 8 (strong password substitute)
     =================================================================
     |Y    |Y     |8       |Y         |Y        Y       8            |
     |----------------------------------------------------------------
     |     |Y     |8       |Y         |Y        Y       8            |
     -----------------------------------------------------------------
     |Y    |      |8       |Y         | -       -       Err1         |
     -----------------------------------------------------------------
     |     |      |8       |Y         | -       -       Err1         |
     =================================================================
     |Y    |Y     |8       |N         | -       Y       8            |
     |----------------------------------------------------------------
     |     |Y     |8       |N         | -       Y       8            |
     -----------------------------------------------------------------
     |Y    |      |8       |N         | -       -       Err1         |
     -----------------------------------------------------------------
     |     |      |8       |N         | -       -       Err1         |
     ================================================================= 
     */
    private void assertAllCombinationsOfUserPasswordSecMecInputOK(
        String[] expectedValues) {
        // Try following combinations:
        // user { null, user attribute given}
        // password {null, pwd specified}
        // securityMechanism attribute specified and not specified.
        // try with different security mechanism values - 
        // {encrypted useridpassword, userid only, clear text userid &password}
        // try with drivermanager, try with datasource
        
        String urlAttributes = null;

        for (int k = 0; k < USER_ATTRIBUTE.length; k++) {
            for (int j = 0; j < PWD_ATTRIBUTE.length; j++) {
                urlAttributes = "";
                if (USER_ATTRIBUTE[k] != null)
                    urlAttributes += "user=" + USER_ATTRIBUTE[k] +";";
                if (PWD_ATTRIBUTE[j] != null)
                    urlAttributes += "password=" + PWD_ATTRIBUTE[j] +";";
                
                // removing the last semicolon that we added here
                if (urlAttributes.length() >= 1)
                    urlAttributes = urlAttributes.substring(
                        0,urlAttributes.length()-1);

                // case - do not specify securityMechanism explicitly in the 
                // url get connection via driver manager and datasource.
                assertConnectionUsingDriverManager(
                    getJDBCUrl(urlAttributes), "Test:", 
                    getExpectedValueFromAll(expectedValues, k, j, 4));
                getDataSourceConnection(USER_ATTRIBUTE[k],PWD_ATTRIBUTE[j],
                    getExpectedValueFromAll(expectedValues, k, j, 4));

                for (int i = 0; i < SECMEC_ATTRIBUTE.length; i++) {
                    // case - specify securityMechanism attribute in url
                    // get connection using DriverManager
                    assertConnectionUsingDriverManager(
                        getJDBCUrl(urlAttributes + ";securityMechanism=" + 
                            SECMEC_ATTRIBUTE[i]), "#", 
                            getExpectedValueFromAll(expectedValues, k, j, i));
                    // case - specify security mechanism on datasource
                    assertSecurityMechanismOK(
                        USER_ATTRIBUTE[k],PWD_ATTRIBUTE[j], SECMEC_ATTRIBUTE[i], "TEST_DS (" + urlAttributes
                            + ",securityMechanism="+SECMEC_ATTRIBUTE[i]+")", 
                            getExpectedValueFromAll(expectedValues, k, j, i));
                }
            }
        }
    }
    
    private String getExpectedValueFromAll(String[] expectedValues,
        int USER_ATTR, int PWD_ATTR, int SECMEC_ATTR)
    {
        String expectedValue;
        // There are 2 values each for USER_ATTR and PWD_ATTR.
        if (derby_drda_securityMechanism == null)
            return "OK";
        // elses
        // value 0 is just the name of the sec mechanism
        // sec mec '4' means no security mechanism specified
        // datasource and drivermanager calls should have same result
        // values 1-6 are for user 1, pwd 1
        if (USER_ATTR == 0 && PWD_ATTR == 0)
        {
            if (SECMEC_ATTR == 4)
                expectedValue = expectedValues[1];
            else
                expectedValue = expectedValues[2+SECMEC_ATTR];
        }
        else if (USER_ATTR == 0 && PWD_ATTR == 1)
        {
            if (SECMEC_ATTR == 4)
                expectedValue = expectedValues[6];
            else
                expectedValue = expectedValues[7+SECMEC_ATTR];
        }
        else if (USER_ATTR == 1 && PWD_ATTR == 0)
        {
            if (SECMEC_ATTR == 4)
                expectedValue = expectedValues[11];
            else
                expectedValue = expectedValues[12+SECMEC_ATTR];
        }
        else
        {
            if (SECMEC_ATTR == 4)
                expectedValue = expectedValues[16];
            else
                expectedValue = expectedValues[17+SECMEC_ATTR];
        }
        return expectedValue;
    }

    /**
     * Helper method to get connection from datasource and to print
     * the exceptions if any when getting a connection. This method 
     * is used in assertAllCombinationsOfUserPasswordSecMecInputOK.
     * For explanation of exceptions that might arise in this method,
     * please check assertAllCombinationsOfUserPasswordSecMecInputOK
     * javadoc comment.
     * get connection from datasource
     * @param user username
     * @param password password
     * @param expectedValue expected sql state
     */
    private void getDataSourceConnection(
        String user, String password, String expectedValue)
    {
        Connection conn;
        DataSource ds = getDS(user, password);
        try {
            // get connection via datasource without setting securityMechanism
            // cannot use ds.getConnection, because junit framework will
            // substitute 'null' with 'APP'.
            conn = ds.getConnection(user, password);
            conn.close();
        }
        catch (SQLException sqle)
        {
            // Exceptions expected in certain case hence printing message
            // instead of stack traces here. 
            // - For case if server doesnt accept connection with this 
            //   security mechanism
            // - For case when client driver does support USRSSBPWD security
            //   mechanism
            if ((user == null) && (sqle.getSQLState().equals("08001")))
                assertSQLState08001("08001.C.7", sqle);
            else
                assertSQLState(expectedValue, sqle);
            // for debugging, uncomment:
            //dumpSQLException(sqle.getNextException());
        }
        catch (Exception e)
        {
            fail ("should not have gotten an exception");
        }
    }

    /**
     * Dump SQLState and message for the complete nested chain of SQLException 
     * @param sqle SQLException whose complete chain of exceptions is
     * traversed and sqlstate and message is printed out
     */
    private static void dumpSQLException(SQLException sqle)
    {
        while ( sqle != null)
        {
            println("SQLSTATE("+sqle.getSQLState()+"): " + 
                sqle.getMessage());
            sqle = sqle.getNextException();
        }
    }

    /**
     * Test a deferred connection reset. When connection pooling is done
     * and connection is reset, the client sends EXCSAT,ACCSEC and followed
     * by SECCHK and ACCRDB. Test if the security mechanism related information
     * is correctly reset or not. This method was added to help simulate 
     * regression test for DERBY-1080. It is called from testDerby1080.   
     * @param user username 
     * @param password password for connection
     * @param secmec security mechanism for datasource
     * @throws Exception
     */
    private void assertSecMecWithConnPoolingOK(
        String user, String password, Short secmec) throws Exception
    {     
        ConnectionPoolDataSource cpds = getCPDS(user,password);
        
        // call setSecurityMechanism with secmec.
        JDBCDataSource.setBeanProperty(cpds,
                "SecurityMechanism", secmec);
               
        // simulate case when connection will be re-used by getting 
        // a connection, closing it and then the next call to
        // getConnection will re-use the previous connection.  
        PooledConnection pc = cpds.getPooledConnection();
        Connection conn = pc.getConnection();
        conn.close();
        conn = pc.getConnection();
        assertConnectionOK(conn);
        pc.close();
        conn.close();
    }

    /**
     * Test a connection by executing a sample query
     * @param   conn    database connection
     * @throws Exception if there is any error
     */
    private void assertConnectionOK(Connection conn)
    throws SQLException
    {
        Statement stmt = conn.createStatement();
        ResultSet rs = null;
        // To test our connection, we will try to do a select from the 
        // system catalog tables
        rs = stmt.executeQuery("select count(*) from sys.systables");
        int updatecount=0;
        while(rs.next())
        {
            rs.getInt(1); // assume ok if no exception, ignore result
            updatecount++;
        }
        assertEquals(1,updatecount);
        
        if(rs != null)
            rs.close();
        if(stmt != null)
            stmt.close();
    }
    
    /**
     * This is a regression test for DERBY-1080 - where some variables required
     * only for the EUSRIDPWD security mechanism case were not getting reset on
     * connection re-use and resulting in protocol error. This also applies to
     * USRSSBPWD security mechanism. 
     * 
     * Read class level comments (#1) to understand what is specified by drda
     * spec for EUSRIDPWD.  
     * <br>
     * Encryption is done using JCE. Hence JCE support of the necessary
     * algorithm is required for EUSRIDPWD security mechanism to work. Thus
     * even though the server and client have code to support EUSRIDPWD, this
     * security mechanism will not work in all JVMs. 
     * 
     * JVMs where support for DH(32byte prime) is not available and thus EUSRIDPWD 
     * wont work are Sun JVM (versions 1.3.1, 1.4.1, 1.4.2, 1.5) and 
     * IBM JVM (versions 1.3.1 and some old versions of 1.4.2 (in 2004) )
     * 
     * Expected behavior for this test:
     * If no regression has occurred, this test should work OK, given the 
     * expected exception in following cases:
     * 1) When EUSRIDPWD is not supported in JVM the test is running, a CNFE
     * with initializing EncryptionManager will happen. This will happen for 
     * Sun JVM (versions 1.3.1, 1.4.1, 1.4.2, 1.5) and 
     * IBM JVM (versions 1.3.1 and some old versions of 1.4.2 (in 2004) )
     * For derby client, the error message is 
     * "Security exception encountered, see next exception for details."
     * 2)If server does not accept EUSRIDPWD security mechanism from clients,then
     * error message will be "Connection authorization failure
     * occurred. Reason: security mechanism not supported"
     * Note: #2 can happen if server is started with derby.drda.securityMechanism
     * and thus restricts what security mechanisms the client can connect with.
     * This will happen for the test run when derby.drda.securityMechanism is
     * set, to a valid value other than ENCRYPTED_USER_AND_PASSWORD_SECURITY.
     * <br>
     * See testNetworkServerSecurityMechanism where this method is called to 
     * test for regression for DERBY-1080, and to check if server is using the
     * derby.drda.securityMechanism to restrict client connections based on
     * the security mechanism.
     */
    private void assertDerby1080Fixed(String expectedValue)
            throws Exception {
        try
        {
            // simulate connection re-set using connection pooling on a pooled
            // datasource set security mechanism to use encrypted userid and
            // password.
            assertSecMecWithConnPoolingOK(
                "peter","neelima",SECMEC_EUSRIDPWD);
            if (!expectedValue.equals("OK"))
                fail("expected SQLException if DERBY-1080 did not regress");
        }
        catch (SQLException sqle)
        {
            // Exceptions expected in certain case hence accepting different
            // SQLStates.
            // - For cases where the jvm does not support EUSRIDPWD.
            // - For case if server doesnt accept connection with this security
            // mechanism
            // Please see javadoc comments for this test method for more 
            // details of expected exceptions.
            if(!(sqle.getSQLState().equals("XJ112")))
                assertSQLState(expectedValue, sqle);
            // for debugging, uncomment:
            // dumpSQLException(sqle.getNextException());
        }
    }

    /**
     * Test SECMEC_USRSSBPWD with derby BUILTIN authentication turned ON.
     *
     * We want to test a combination of USRSSBPWD with BUILTIN as password
     * substitute is only supported with NONE or BUILTIN Derby authentication
     * scheme right now (DERBY-528). Also, it doesn't work if passwords are
     * hashed with the configurable hash authentication scheme (DERBY-4483)
     * before they are stored in the database, so we'll need to disable that.
     * 
     * @throws Exception if there an unexpected error
     */
    private void assertUSRSSBPWD_with_BUILTIN(String[] expectedValues)
            throws Exception {
        // Skip this security mechanism on platforms that are short on entropy,
        // otherwise this test will take a very long time to complete.
        if (!hasSufficientEntropy()) {
            return;
        }
        // Turn on Derby BUILTIN authentication and attempt connecting with
        // USRSSBPWD security mechanism.
        println("Turning ON Derby BUILTIN authentication");
        Connection conn = getDataSourceConnectionWithSecMec(
            "neelima", "lee", SECMEC_USRSSBPWD);

        // Turn on BUILTIN authentication
        CallableStatement cs = conn.prepareCall(
            "CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY(?, ?)");

        // First, disable the configurable hash authentication scheme so that
        // passwords are stored using the old hash algorithm.
        cs.setString(1, "derby.authentication.builtin.algorithm");
        cs.setString(2, null);
        cs.execute();

        cs.setString(1, "derby.user.neelima");
        cs.setString(2, "lee");
        cs.execute();

        cs.setString(1, "derby.user.APP");
        cs.setString(2, "APP");
        cs.execute();

        cs.setString(1, "derby.database.fullAccessUsers");
        cs.setString(2, "neelima,APP");
        cs.execute();

        cs.setString(1, "derby.connection.requireAuthentication");
        cs.setString(2, "true");
        cs.execute();

        cs.close();
        cs = null;

        conn.close();

        // Shutdown database for BUILTIN
        // authentication to take effect the next time it is
        // booted - derby.connection.requireAuthentication is a
        // static property.
        assertConnectionUsingDriverManager(getJDBCUrl(
            "user=APP;password=APP;shutdown=true;securityMechanism=" +
            SECMEC_USRSSBPWD),"USRSSBPWD (T0):", expectedValues[1]);

        // Now test some connection(s) with SECMEC_USRSSBPWD
        // via DriverManager and Datasource
        assertConnectionUsingDriverManager(getJDBCUrl(
            "user=neelima;password=lee;securityMechanism=" +
            SECMEC_USRSSBPWD),"USRSSBPWD + BUILTIN (T1):", expectedValues[2]);
        assertSecurityMechanismOK(
            "neelima","lee",SECMEC_USRSSBPWD,
            "TEST_DS - USRSSBPWD + BUILTIN (T2):", expectedValues[2]);
        // Attempting to connect with some invalid user
        assertConnectionUsingDriverManager(getJDBCUrl(
            "user=invalid;password=user;securityMechanism=" +
            SECMEC_USRSSBPWD),"USRSSBPWD + BUILTIN (T3):",expectedValues[3]);
        assertSecurityMechanismOK(
            "invalid","user",SECMEC_USRSSBPWD,
            "TEST_DS - USRSSBPWD + BUILTIN (T4):", expectedValues[3]);

        // Prepare to turn OFF Derby BUILTIN authentication
        conn = getDataSourceConnectionWithSecMec("neelima", "lee",
            SECMEC_USRSSBPWD);

        // Turn off BUILTIN authentication
        cs = conn.prepareCall(
        "CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY(?, ?)");

        cs.setString(1, "derby.connection.requireAuthentication");
        cs.setString(2, "false");
        cs.execute();

        cs.close();
        cs = null;
        conn.close();

        // Shutdown 'wombat' database for BUILTIN authentication
        // to take effect the next time it is booted
        assertConnectionUsingDriverManager(getJDBCUrl(
            "user=APP;password=APP;shutdown=true;securityMechanism=" +
            SECMEC_USRSSBPWD),"USRSSBPWD + BUILTIN (T5):", expectedValues[4]);
    }
    
    private Connection getDataSourceConnectionWithSecMec(
        String user, String password, Short secMec)
            throws Exception {

        DataSource ds = getDS(user, password);
        JDBCDataSource.setBeanProperty(ds,
                "SecurityMechanism", secMec);
        return ds.getConnection();
    }

    private String getJDBCUrl(String attrs) {
        String dbName = 
            TestConfiguration.getCurrent().getDefaultDatabaseName();
        // s is protocol, subprotocol, + dbName
        String s = TestConfiguration.getCurrent().getJDBCUrl(dbName);

        if (attrs != null)
            if (usingDerbyNetClient())
                s = s + ";" + attrs;
            else
                s = s + ":" + attrs + ";";
        return s;
    }

    private javax.sql.DataSource getDS(String user, String password)
    {
        HashMap<String, Object> attrs = new HashMap<String, Object>();
        if (user != null)
            attrs.put("user", user);
        if (password != null)
            attrs.put("password", password);
        attrs = addRequiredAttributes(attrs);

        DataSource ds = JDBCDataSource.getDataSource();
        for (String property : attrs.keySet()) {
            Object value = attrs.get(property);
            JDBCDataSource.setBeanProperty(ds, property, value);
        }
        return ds;
    }

    private HashMap<String, Object> addRequiredAttributes(
            HashMap<String, Object> attrs)
    {
        String hostName = TestConfiguration.getCurrent().getHostName();
        int port = TestConfiguration.getCurrent().getPort();
        /** 
         * serverName defaults to localhost (see DERBY-410), 
         * but for a remote host it's needed 
         */
        if (!hostName.equals("localhost"))
        {
            attrs.put("serverName", hostName);
            attrs.put("portNumber", port);
        }
        else
        {
            attrs.put("portNumber", port);
        }
        return attrs;
    }

    private javax.sql.ConnectionPoolDataSource getCPDS(
        String user, String password)
    {
        HashMap<String, Object> attrs = new HashMap<String, Object>();
        if (user != null)
            attrs.put("user", user);
        if (password != null)
            attrs.put("password", password);

        attrs = addRequiredAttributes(attrs);
        ConnectionPoolDataSource cpds = 
            J2EEDataSource.getConnectionPoolDataSource();
        for (String property : attrs.keySet()) {
            Object value = attrs.get(property);
            JDBCDataSource.setBeanProperty(cpds, property, value);
        }
        return cpds;
    }
    
    private void assertSQLState08001(String expectedValue, SQLException sqle)
    {
        if (expectedValue.equals("08001.C.7"))
            assertEquals("User id can not be null.", sqle.getMessage());
        if (expectedValue.equals("08001.C.8"))
            assertEquals("Password can not be null.", sqle.getMessage());
    }

    /**
     * Tells if the current platform is assumed to have sufficient entropy for
     * the strong password substitution security mechanism to run reasonably
     * fast.
     */
    private boolean hasSufficientEntropy() {
        // The ARM platform is known to suffer from too little entropy
        // (unless there is significant disk activity).
        return !getSystemProperty("os.arch").equalsIgnoreCase("arm");
    }
}