136 lines
4.8 KiB
Perl
136 lines
4.8 KiB
Perl
use strict;
|
|
use warnings;
|
|
use Setup;
|
|
use LDAPContext;
|
|
use Test2::V0;
|
|
use Catalyst::Test ();
|
|
use HTTP::Request::Common;
|
|
use JSON::MaybeXS;
|
|
|
|
my $ldap = LDAPContext->new();
|
|
my $users = {
|
|
unrelated => $ldap->add_user("unrelated_user"),
|
|
admin => $ldap->add_user("admin_user"),
|
|
not_admin => $ldap->add_user("not_admin_user"),
|
|
many_roles => $ldap->add_user("many_roles"),
|
|
many_roles_one_group => $ldap->add_user("many_roles_one_group"),
|
|
};
|
|
|
|
$ldap->add_group("hydra_admin", $users->{"admin"}->{"username"});
|
|
$ldap->add_group("hydra-admin", $users->{"not_admin"}->{"username"});
|
|
$ldap->add_group("hydra_one_group_many_roles", $users->{"many_roles_one_group"}->{"username"});
|
|
|
|
$ldap->add_group("hydra_create-projects", $users->{"many_roles"}->{"username"});
|
|
$ldap->add_group("hydra_restart-jobs", $users->{"many_roles"}->{"username"});
|
|
$ldap->add_group("hydra_bump-to-front", $users->{"many_roles"}->{"username"});
|
|
$ldap->add_group("hydra_cancel-build", $users->{"many_roles"}->{"username"});
|
|
$ldap->add_group("hydra_eval-jobset", $users->{"many_roles"}->{"username"});
|
|
|
|
|
|
my $ctx = test_context(
|
|
before_init => sub {
|
|
my ($ctx) = @_;
|
|
write_file($ctx->{"tmpdir"} . "/password.conf", "bindpw = ${\$ldap->{'root_password'}}");
|
|
},
|
|
hydra_config => <<CFG
|
|
<ldap>
|
|
<config>
|
|
<credential>
|
|
class = Password
|
|
password_field = password
|
|
password_type = self_check
|
|
</credential>
|
|
<store>
|
|
class = LDAP
|
|
ldap_server = ${\$ldap->server_url()}
|
|
<ldap_server_options>
|
|
timeout = 30
|
|
debug = 0
|
|
</ldap_server_options>
|
|
binddn = "cn=root,dc=example"
|
|
include password.conf
|
|
start_tls = 0
|
|
<start_tls_options>
|
|
verify = none
|
|
</start_tls_options>
|
|
user_basedn = "ou=users,dc=example"
|
|
user_filter = "(&(objectClass=inetOrgPerson)(cn=%s))"
|
|
user_scope = one
|
|
user_field = cn
|
|
<user_search_options>
|
|
deref = always
|
|
</user_search_options>
|
|
use_roles = 1
|
|
role_basedn = "ou=groups,dc=example"
|
|
role_filter = "(&(objectClass=groupOfNames)(member=%s))"
|
|
role_scope = one
|
|
role_field = cn
|
|
role_value = dn
|
|
<role_search_options>
|
|
deref = always
|
|
</role_search_options>
|
|
</store>
|
|
</config>
|
|
<role_mapping>
|
|
hydra_admin = admin
|
|
hydra_create-projects = create-projects
|
|
hydra_cancel-build = cancel-build
|
|
hydra_bump-to-front = bump-to-front
|
|
hydra_restart-jobs = restart-jobs
|
|
hydra_eval-jobset = eval-jobset
|
|
|
|
hydra_one_group_many_roles = create-projects
|
|
hydra_one_group_many_roles = cancel-build
|
|
hydra_one_group_many_roles = bump-to-front
|
|
hydra_one_group_many-roles = eval-jobset
|
|
</role_mapping>
|
|
</ldap>
|
|
CFG
|
|
);
|
|
|
|
Catalyst::Test->import('Hydra');
|
|
|
|
subtest "Valid login attempts" => sub {
|
|
my %users_to_roles = (
|
|
unrelated => [],
|
|
admin => ["admin"],
|
|
not_admin => [],
|
|
many_roles => [ "create-projects", "restart-jobs", "bump-to-front", "cancel-build", "eval-jobset" ],
|
|
many_roles_one_group => [ "create-projects", "bump-to-front", "cancel-build" ],
|
|
);
|
|
for my $username (keys %users_to_roles) {
|
|
my $user = $users->{$username};
|
|
my $roles = $users_to_roles{$username};
|
|
|
|
subtest "Verifying $username" => sub {
|
|
my $req = request(POST '/login',
|
|
Referer => 'http://localhost/',
|
|
Accept => 'application/json',
|
|
Content => {
|
|
username => $user->{"username"},
|
|
password => $user->{"password"}
|
|
}
|
|
);
|
|
|
|
is($req->code, 302, "The login redirects");
|
|
my $data = decode_json($req->content());
|
|
is($data->{"username"}, $user->{"username"}, "Username matches");
|
|
is($data->{"emailaddress"}, $user->{"email"}, "Email matches");
|
|
is([sort @{$data->{"userroles"}}], [sort @$roles], "Roles match");
|
|
};
|
|
}
|
|
};
|
|
|
|
# Logging in with an invalid user is rejected
|
|
is(request(POST '/login',
|
|
Referer => 'http://localhost/',
|
|
Content => {
|
|
username => 'alice',
|
|
password => 'foobar'
|
|
}
|
|
)->code, 403, "Logging in with invalid credentials does not work");
|
|
|
|
|
|
|
|
done_testing;
|