MAGETWO-50608: [Github][Security] Able to brute force API token access

- fixed integration tests

Author: Oleksii Korshenko

dev/tests/api-functional/testsuite/Magento/Integration/Model/AdminTokenServiceTest.php

@@ -58,7 +58,7 @@ public function setUp()
     }
 
     /**
-     * @magentoApiDataFixture Magento/User/_files/user_with_role.php
+     * @magentoApiDataFixture Magento/Webapi/_files/webapi_user.php
      */
     public function testCreateAdminAccessToken()
     {
@@ -139,7 +139,7 @@ public function validationDataProvider()
     }
 
     /**
-     * @magentoApiDataFixture Magento/User/_files/user_with_role.php
+     * @magentoApiDataFixture Magento/Webapi/_files/webapi_user.php
      */
     public function testThrottlingMaxAttempts()
     {

dev/tests/integration/testsuite/Magento/Integration/Model/CustomerTokenServiceTest.php

@@ -70,8 +70,8 @@ public function testCreateCustomerAccessTokenEmptyOrNullCredentials($username, $
     }
 
     /**
-     * @expectedException \Magento\Framework\Exception\InvalidEmailOrPasswordException
-     * @expectedExceptionMessage Invalid login or password.
+     * @expectedException \Magento\Framework\Exception\AuthenticationException
+     * @expectedExceptionMessage You did not sign in correctly or your account is temporarily disabled.
      */
     public function testCreateCustomerAccessTokenInvalidCustomer()
     {

dev/tests/integration/testsuite/Magento/Webapi/_files/webapi_user.php

@@ -0,0 +1,24 @@
+<?php
+/**
+ * Copyright © 2016 Magento. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+/**
+ * Create an admin user with an assigned role
+ */
+
+/** @var $model \Magento\User\Model\User */
+$model = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create('Magento\User\Model\User');
+$model->setFirstname("Web")
+    ->setLastname("Api")
+    ->setUsername('webapi_user')
+    ->setPassword(\Magento\TestFramework\Bootstrap::ADMIN_PASSWORD)
+    ->setEmail('webapi_user@example.com')
+    ->setRoleType('G')
+    ->setResourceId('Magento_Backend::all')
+    ->setPrivileges("")
+    ->setAssertId(0)
+    ->setRoleId(1)
+    ->setPermission('allow');
+$model->save();

dev/tests/integration/testsuite/Magento/User/_files/user_with_role_rollback.php renamed to dev/tests/integration/testsuite/Magento/Webapi/_files/webapi_user_rollback.php

@@ -8,7 +8,7 @@
 
 /** @var $model \Magento\User\Model\User */
 $model = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create('Magento\User\Model\User');
-$userName = 'adminUser';
+$userName = 'webapi_user';
 $model->load($userName, 'username');
 $model->delete();