2015-05-07 17:54:33 +00:00
|
|
|
package ldap
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"testing"
|
2015-10-06 19:48:10 +00:00
|
|
|
"time"
|
2015-05-07 17:54:33 +00:00
|
|
|
|
|
|
|
"github.com/hashicorp/vault/logical"
|
|
|
|
logicaltest "github.com/hashicorp/vault/logical/testing"
|
|
|
|
"github.com/mitchellh/mapstructure"
|
|
|
|
)
|
|
|
|
|
2015-10-06 19:48:10 +00:00
|
|
|
func factory(t *testing.T) logical.Backend {
|
|
|
|
defaultLeaseTTLVal := time.Hour * 24
|
|
|
|
maxLeaseTTLVal := time.Hour * 24 * 30
|
|
|
|
b, err := Factory(&logical.BackendConfig{
|
|
|
|
Logger: nil,
|
|
|
|
System: &logical.StaticSystemView{
|
|
|
|
DefaultLeaseTTLVal: defaultLeaseTTLVal,
|
|
|
|
MaxLeaseTTLVal: maxLeaseTTLVal,
|
|
|
|
},
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Unable to create backend: %s", err)
|
|
|
|
}
|
|
|
|
return b
|
|
|
|
}
|
|
|
|
|
2015-05-07 17:54:33 +00:00
|
|
|
func TestBackend_basic(t *testing.T) {
|
2015-10-06 19:48:10 +00:00
|
|
|
b := factory(t)
|
2015-05-07 17:54:33 +00:00
|
|
|
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
|
|
|
Backend: b,
|
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepConfigUrl(t),
|
|
|
|
testAccStepGroup(t, "scientists", "foo"),
|
2015-07-17 21:40:06 +00:00
|
|
|
testAccStepGroup(t, "engineers", "bar"),
|
|
|
|
testAccStepUser(t, "tesla", "engineers"),
|
2015-05-07 17:54:33 +00:00
|
|
|
testAccStepLogin(t, "tesla", "password"),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestBackend_groupCrud(t *testing.T) {
|
2015-10-06 19:48:10 +00:00
|
|
|
b := factory(t)
|
2015-05-07 17:54:33 +00:00
|
|
|
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
|
|
|
Backend: b,
|
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepGroup(t, "g1", "foo"),
|
|
|
|
testAccStepReadGroup(t, "g1", "foo"),
|
|
|
|
testAccStepDeleteGroup(t, "g1"),
|
|
|
|
testAccStepReadGroup(t, "g1", ""),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepConfigUrl(t *testing.T) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-05-07 17:54:33 +00:00
|
|
|
Path: "config",
|
|
|
|
Data: map[string]interface{}{
|
2015-05-07 17:57:10 +00:00
|
|
|
// Online LDAP test server
|
|
|
|
// http://www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server/
|
2015-05-07 17:54:33 +00:00
|
|
|
"url": "ldap://ldap.forumsys.com",
|
|
|
|
"userattr": "uid",
|
|
|
|
"userdn": "dc=example,dc=com",
|
|
|
|
"groupdn": "dc=example,dc=com",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepGroup(t *testing.T, group string, policies string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-05-07 17:54:33 +00:00
|
|
|
Path: "groups/" + group,
|
|
|
|
Data: map[string]interface{}{
|
|
|
|
"policies": policies,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepReadGroup(t *testing.T, group string, policies string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
|
|
|
Path: "groups/" + group,
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
if resp == nil {
|
|
|
|
if policies == "" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
var d struct {
|
|
|
|
Policies string `mapstructure:"policies"`
|
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.Policies != policies {
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepDeleteGroup(t *testing.T, group string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.DeleteOperation,
|
|
|
|
Path: "groups/" + group,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-07-14 22:46:15 +00:00
|
|
|
func TestBackend_userCrud(t *testing.T) {
|
|
|
|
b := Backend()
|
|
|
|
|
|
|
|
logicaltest.Test(t, logicaltest.TestCase{
|
|
|
|
Backend: b,
|
|
|
|
Steps: []logicaltest.TestStep{
|
|
|
|
testAccStepUser(t, "g1", "bar"),
|
|
|
|
testAccStepReadUser(t, "g1", "bar"),
|
|
|
|
testAccStepDeleteUser(t, "g1"),
|
|
|
|
testAccStepReadUser(t, "g1", ""),
|
|
|
|
},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2015-07-17 21:40:06 +00:00
|
|
|
func testAccStepUser(t *testing.T, user string, groups string) logicaltest.TestStep {
|
2015-07-14 22:46:15 +00:00
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-07-14 22:46:15 +00:00
|
|
|
Path: "users/" + user,
|
|
|
|
Data: map[string]interface{}{
|
2015-07-17 21:40:06 +00:00
|
|
|
"groups": groups,
|
2015-07-14 22:46:15 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-07-17 21:40:06 +00:00
|
|
|
func testAccStepReadUser(t *testing.T, user string, groups string) logicaltest.TestStep {
|
2015-07-14 22:46:15 +00:00
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.ReadOperation,
|
|
|
|
Path: "users/" + user,
|
|
|
|
Check: func(resp *logical.Response) error {
|
|
|
|
if resp == nil {
|
2015-07-17 21:40:06 +00:00
|
|
|
if groups == "" {
|
2015-07-14 22:46:15 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
var d struct {
|
2015-07-17 21:40:06 +00:00
|
|
|
Groups string `mapstructure:"groups"`
|
2015-07-14 22:46:15 +00:00
|
|
|
}
|
|
|
|
if err := mapstructure.Decode(resp.Data, &d); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2015-07-17 21:40:06 +00:00
|
|
|
if d.Groups != groups {
|
2015-07-14 22:46:15 +00:00
|
|
|
return fmt.Errorf("bad: %#v", resp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func testAccStepDeleteUser(t *testing.T, user string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
|
|
|
Operation: logical.DeleteOperation,
|
|
|
|
Path: "users/" + user,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-05-07 17:54:33 +00:00
|
|
|
func testAccStepLogin(t *testing.T, user string, pass string) logicaltest.TestStep {
|
|
|
|
return logicaltest.TestStep{
|
2016-01-07 15:30:47 +00:00
|
|
|
Operation: logical.UpdateOperation,
|
2015-05-09 19:07:52 +00:00
|
|
|
Path: "login/" + user,
|
2015-05-07 17:54:33 +00:00
|
|
|
Data: map[string]interface{}{
|
|
|
|
"password": pass,
|
|
|
|
},
|
|
|
|
Unauthenticated: true,
|
|
|
|
|
2015-07-14 22:46:15 +00:00
|
|
|
Check: logicaltest.TestCheckAuth([]string{"foo", "bar"}),
|
2015-05-07 17:54:33 +00:00
|
|
|
}
|
|
|
|
}
|
2015-06-29 21:50:55 +00:00
|
|
|
|
|
|
|
func TestLDAPEscape(t *testing.T) {
|
2015-10-06 19:48:10 +00:00
|
|
|
testcases := map[string]string{
|
|
|
|
"#test": "\\#test",
|
|
|
|
"test,hello": "test\\,hello",
|
|
|
|
"test,hel+lo": "test\\,hel\\+lo",
|
|
|
|
"test\\hello": "test\\\\hello",
|
|
|
|
" test ": "\\ test \\ ",
|
|
|
|
}
|
|
|
|
|
|
|
|
for test, answer := range testcases {
|
|
|
|
res := EscapeLDAPValue(test)
|
|
|
|
if res != answer {
|
|
|
|
t.Errorf("Failed to escape %s: %s != %s\n", test, res, answer)
|
|
|
|
}
|
|
|
|
}
|
2015-06-29 21:50:55 +00:00
|
|
|
}
|