Chris F Ravenscroftandkanywst
cf0eb7f43f
* fix: reject disabled users on all backends in Bind A user with disabled = true could still bind on the config backend, since configHandler.FindUser and LDAPOpsHelper.Bind never checked Disabled while the SQL backends drop such users at lookup. Enforce it in Bind so every backend behaves the same. * fix: use configHandler.Bind rather than helper.Bind in test harness --------- Co-authored-by: kanywst <niwatakuma@icloud.com>
70 lines
1.8 KiB
Go
70 lines
1.8 KiB
Go
package handler
|
|
|
|
import (
|
|
"encoding/hex"
|
|
"net"
|
|
"testing"
|
|
|
|
"github.com/rs/zerolog"
|
|
"go.opentelemetry.io/otel/trace/noop"
|
|
"golang.org/x/crypto/bcrypt"
|
|
|
|
"github.com/glauth/glauth/v2/pkg/config"
|
|
"github.com/glauth/ldap"
|
|
)
|
|
|
|
type disabledBindTestMonitor struct{}
|
|
|
|
func (disabledBindTestMonitor) SetResponseTimeMetric(map[string]string, float64) error {
|
|
return nil
|
|
}
|
|
|
|
func (disabledBindTestMonitor) SetLDAPMetric(map[string]string, float64) error {
|
|
return nil
|
|
}
|
|
|
|
func TestConfigBackendDisabledUserCannotBind(t *testing.T) {
|
|
pw := "correct horse"
|
|
raw, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.MinCost)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
hexHash := hex.EncodeToString(raw)
|
|
|
|
cfg := &config.Config{}
|
|
cfg.Users = []config.User{
|
|
{Name: "activeuser", PrimaryGroup: 5501, PassBcrypt: hexHash, Disabled: false},
|
|
{Name: "disableduser", PrimaryGroup: 5501, PassBcrypt: hexHash, Disabled: true},
|
|
}
|
|
|
|
logger := zerolog.Nop()
|
|
tracer := noop.NewTracerProvider().Tracer("f001")
|
|
helper := NewLDAPOpsHelper(tracer)
|
|
h := configHandler{
|
|
backend: config.Backend{
|
|
BaseDN: "dc=example,dc=com",
|
|
NameFormatAsArray: []string{"cn"},
|
|
GroupFormatAsArray: []string{"ou"},
|
|
},
|
|
log: &logger,
|
|
cfg: cfg,
|
|
ldohelper: helper,
|
|
monitor: disabledBindTestMonitor{},
|
|
tracer: tracer,
|
|
}
|
|
_, server := net.Pipe()
|
|
defer server.Close()
|
|
|
|
bind := func(dn, pass string) ldap.LDAPResultCode {
|
|
code, _ := h.Bind(dn, pass, server)
|
|
return code
|
|
}
|
|
|
|
if code := bind("cn=activeuser,dc=example,dc=com", pw); code != ldap.LDAPResultSuccess {
|
|
t.Fatalf("active user with correct pw should bind, got %d", code)
|
|
}
|
|
if code := bind("cn=disableduser,dc=example,dc=com", pw); code != ldap.LDAPResultInvalidCredentials {
|
|
t.Errorf("disabled user must be rejected; got code %d, want InvalidCredentials(49)", code)
|
|
}
|
|
}
|