timmy
1549d440b7
Update ldap client implementation to github.com/go-ldap/ldap/v3 Add contexts to all relevant functions eg NewHandler Provide backwards compatibility for sql handlers
71 lines
1.8 KiB
Go
71 lines
1.8 KiB
Go
package handler
|
|
|
|
import (
|
|
"encoding/hex"
|
|
"net"
|
|
"testing"
|
|
|
|
"github.com/glauth/ldaps"
|
|
"github.com/rs/zerolog"
|
|
"go.opentelemetry.io/otel/trace/noop"
|
|
"golang.org/x/crypto/bcrypt"
|
|
|
|
"github.com/glauth/glauth/v2/pkg/config"
|
|
"github.com/go-ldap/ldap/v3"
|
|
)
|
|
|
|
type disabledBindTestMonitor struct{}
|
|
|
|
func (disabledBindTestMonitor) SetResponseTimeMetric(map[string]string, float64) error {
|
|
return nil
|
|
}
|
|
|
|
func (disabledBindTestMonitor) SetLDAPMetric(map[string]string, float64) error {
|
|
return nil
|
|
}
|
|
|
|
func TestConfigBackendDisabledUserCannotBind(t *testing.T) {
|
|
pw := "correct horse"
|
|
raw, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.MinCost)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
hexHash := hex.EncodeToString(raw)
|
|
|
|
cfg := &config.Config{}
|
|
cfg.Users = []config.User{
|
|
{Name: "activeuser", PrimaryGroup: 5501, PassBcrypt: hexHash, Disabled: false},
|
|
{Name: "disableduser", PrimaryGroup: 5501, PassBcrypt: hexHash, Disabled: true},
|
|
}
|
|
|
|
logger := zerolog.Nop()
|
|
tracer := noop.NewTracerProvider().Tracer("f001")
|
|
helper := NewLDAPOpsHelper(tracer)
|
|
h := configHandler{
|
|
backend: config.Backend{
|
|
BaseDN: "dc=example,dc=com",
|
|
NameFormatAsArray: []string{"cn"},
|
|
GroupFormatAsArray: []string{"ou"},
|
|
},
|
|
log: &logger,
|
|
cfg: cfg,
|
|
ldohelper: helper,
|
|
monitor: disabledBindTestMonitor{},
|
|
tracer: tracer,
|
|
}
|
|
_, server := net.Pipe()
|
|
defer server.Close()
|
|
|
|
bind := func(dn, pass string) uint16 {
|
|
_, err := h.Bind(t.Context(), dn, pass, server)
|
|
return ldaps.StatusCode(err)
|
|
}
|
|
|
|
if code := bind("cn=activeuser,dc=example,dc=com", pw); code != ldap.LDAPResultSuccess {
|
|
t.Fatalf("active user with correct pw should bind, got %d", code)
|
|
}
|
|
if code := bind("cn=disableduser,dc=example,dc=com", pw); code != ldap.LDAPResultInvalidCredentials {
|
|
t.Errorf("disabled user must be rejected; got code %d, want InvalidCredentials(49)", code)
|
|
}
|
|
}
|