vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity
This repository has been archived on 2020-03-24. You can view files and clone it, but cannot push or open issues or pull requests.
quay/test/test_ldap.py

152 lines
4.9 KiB
Python
Raw Normal View History

LDAP improvements: - Better logging - Better error messages - Add unit tests - Clean up the setup tool for LDAP
2015-05-12 01:23:18 +00:00
import unittest
from app import app
from initdb import setup_database_for_testing, finished_database_for_testing
from data import model
from data.users import LDAPUsers
from mockldap import MockLdap
class TestLDAP(unittest.TestCase):
def setUp(self):
setup_database_for_testing(self)
self.app = app.test_client()
self.ctx = app.test_request_context()
self.ctx.__enter__()
self.mockldap = MockLdap({
'dc=quay,dc=io': {'dc': ['quay', 'io']},
'ou=employees,dc=quay,dc=io': {
'dc': ['quay', 'io'],
'ou': 'employees'
},
'uid=testy,ou=employees,dc=quay,dc=io': {
'dc': ['quay', 'io'],
'ou': 'employees',
'uid': 'testy',
'userPassword': ['password']
},
'uid=someuser,ou=employees,dc=quay,dc=io': {
'dc': ['quay', 'io'],
'ou': 'employees',
'uid': ['someuser'],
'userPassword': ['somepass'],
'mail': ['foo@bar.com']
},
'uid=nomail,ou=employees,dc=quay,dc=io': {
'dc': ['quay', 'io'],
'ou': 'employees',
'uid': ['nomail'],
'userPassword': ['somepass']
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
},
'uid=cool.user,ou=employees,dc=quay,dc=io': {
'dc': ['quay', 'io'],
'ou': 'employees',
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
'uid': ['cool.user', 'referred'],
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
'userPassword': ['somepass'],
'mail': ['foo@bar.com']
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
},
'uid=referred,ou=employees,dc=quay,dc=io': {
'uid': ['referred'],
'_referral': 'ldap:///uid=cool.user,ou=employees,dc=quay,dc=io'
},
'uid=invalidreferred,ou=employees,dc=quay,dc=io': {
'uid': ['invalidreferred'],
'_referral': 'ldap:///uid=someinvaliduser,ou=employees,dc=quay,dc=io'
},
'uid=multientry,ou=subgroup1,ou=employees,dc=quay,dc=io': {
'uid': ['multientry'],
'mail': ['foo@bar.com'],
'userPassword': ['somepass'],
},
'uid=multientry,ou=subgroup2,ou=employees,dc=quay,dc=io': {
'uid': ['multientry'],
'another': ['key']
},
LDAP improvements: - Better logging - Better error messages - Add unit tests - Clean up the setup tool for LDAP
2015-05-12 01:23:18 +00:00
})
self.mockldap.start()
base_dn = ['dc=quay', 'dc=io']
admin_dn = 'uid=testy,ou=employees,dc=quay,dc=io'
admin_passwd = 'password'
user_rdn = ['ou=employees']
uid_attr = 'uid'
email_attr = 'mail'
ldap = LDAPUsers('ldap://localhost', base_dn, admin_dn, admin_passwd, user_rdn,
uid_attr, email_attr)
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
self.ldap = ldap
def tearDown(self):
self.mockldap.stop()
finished_database_for_testing(self)
self.ctx.__exit__(True, None, None)
Have LDAP return a better error message if it fails to connect Currently, the error results in a 500 being raised when a user tries to login.
2015-06-12 19:39:55 +00:00
def test_invalid_admin_password(self):
base_dn = ['dc=quay', 'dc=io']
admin_dn = 'uid=testy,ou=employees,dc=quay,dc=io'
admin_passwd = 'INVALIDPASSWORD'
user_rdn = ['ou=employees']
uid_attr = 'uid'
email_attr = 'mail'
ldap = LDAPUsers('ldap://localhost', base_dn, admin_dn, admin_passwd, user_rdn,
uid_attr, email_attr)
self.ldap = ldap
# Try to login.
Refactor the users class into their own files, add a common base class for federated users and add a `verify_credentials` method which only does the verification, without the linking. We use this in the superuser verification pass
2015-07-20 15:39:59 +00:00
(response, err_msg) = self.ldap.verify_and_link_user('someuser', 'somepass')
Have LDAP return a better error message if it fails to connect Currently, the error results in a 500 being raised when a user tries to login.
2015-06-12 19:39:55 +00:00
self.assertIsNone(response)
self.assertEquals('LDAP Admin dn or password is invalid', err_msg)
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
def test_login(self):
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
# Verify we can login.
Refactor the users class into their own files, add a common base class for federated users and add a `verify_credentials` method which only does the verification, without the linking. We use this in the superuser verification pass
2015-07-20 15:39:59 +00:00
(response, _) = self.ldap.verify_and_link_user('someuser', 'somepass')
LDAP improvements: - Better logging - Better error messages - Add unit tests - Clean up the setup tool for LDAP
2015-05-12 01:23:18 +00:00
self.assertEquals(response.username, 'someuser')
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
# Verify we can confirm the user.
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
(response, _) = self.ldap.confirm_existing_user('someuser', 'somepass')
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
self.assertEquals(response.username, 'someuser')
LDAP improvements: - Better logging - Better error messages - Add unit tests - Clean up the setup tool for LDAP
2015-05-12 01:23:18 +00:00
def test_missing_mail(self):
Refactor the users class into their own files, add a common base class for federated users and add a `verify_credentials` method which only does the verification, without the linking. We use this in the superuser verification pass
2015-07-20 15:39:59 +00:00
(response, err_msg) = self.ldap.verify_and_link_user('nomail', 'somepass')
LDAP improvements: - Better logging - Better error messages - Add unit tests - Clean up the setup tool for LDAP
2015-05-12 01:23:18 +00:00
self.assertIsNone(response)
self.assertEquals('Missing mail field "mail" in user record', err_msg)
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
def test_confirm_different_username(self):
# Verify that the user is logged in and their username was adjusted.
Refactor the users class into their own files, add a common base class for federated users and add a `verify_credentials` method which only does the verification, without the linking. We use this in the superuser verification pass
2015-07-20 15:39:59 +00:00
(response, _) = self.ldap.verify_and_link_user('cool.user', 'somepass')
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
self.assertEquals(response.username, 'cool_user')
# Verify we can confirm the user's quay username.
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
(response, _) = self.ldap.confirm_existing_user('cool_user', 'somepass')
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
self.assertEquals(response.username, 'cool_user')
# Verify that we *cannot* confirm the LDAP username.
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
(response, _) = self.ldap.confirm_existing_user('cool.user', 'somepass')
self.assertIsNone(response)
def test_referral(self):
Refactor the users class into their own files, add a common base class for federated users and add a `verify_credentials` method which only does the verification, without the linking. We use this in the superuser verification pass
2015-07-20 15:39:59 +00:00
(response, _) = self.ldap.verify_and_link_user('referred', 'somepass')
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
self.assertEquals(response.username, 'cool_user')
# Verify we can confirm the user's quay username.
(response, _) = self.ldap.confirm_existing_user('cool_user', 'somepass')
self.assertEquals(response.username, 'cool_user')
def test_invalid_referral(self):
Refactor the users class into their own files, add a common base class for federated users and add a `verify_credentials` method which only does the verification, without the linking. We use this in the superuser verification pass
2015-07-20 15:39:59 +00:00
(response, _) = self.ldap.verify_and_link_user('invalidreferred', 'somepass')
Fix encrypted password generator to use the LDAP username, not the Quay username. Currently, we use the Quay username via `verify_user` when we go to create the encrypted password. This is only correct if Quay has not generated its own different username for the LDAP user, and fails if it has. We therefore add a new method `confirm_existing_user`, which looks up the federated login for the LDAP user and then runs the auth flow using that username.
2015-05-20 20:37:09 +00:00
self.assertIsNone(response)
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
def test_multientry(self):
Refactor the users class into their own files, add a common base class for federated users and add a `verify_credentials` method which only does the verification, without the linking. We use this in the superuser verification pass
2015-07-20 15:39:59 +00:00
(response, _) = self.ldap.verify_and_link_user('multientry', 'somepass')
Fix LDAP referral and multiple pair handling Fixes two issues found with our LDAP handling code. First, we now follow referrals in both LDAP calls, as some LDAP systems will return a referral instead of the original record. Second, we now make sure to handle multiple search result pairs properly by further filtering based on the presence of the 'mail' attribute when we have multiple valid pairs. This CL also adds tests for all of the above cases.
2015-05-26 19:46:35 +00:00
self.assertEquals(response.username, 'multientry')
LDAP improvements: - Better logging - Better error messages - Add unit tests - Clean up the setup tool for LDAP
2015-05-12 01:23:18 +00:00
if __name__ == '__main__':
unittest.main()
Reference in a new issue Copy permalink