Main Koha release repository
https://koha-community.org
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
363 lines
12 KiB
363 lines
12 KiB
#!/usr/bin/perl
|
|
|
|
# This file is part of Koha.
|
|
#
|
|
# Koha is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Koha is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Koha; if not, see <http://www.gnu.org/licenses>.
|
|
|
|
use Modern::Perl;
|
|
|
|
use Test::More tests => 4;
|
|
use Test::MockModule;
|
|
use Test::MockObject;
|
|
use Test::Warn;
|
|
|
|
use C4::Context;
|
|
|
|
my $dbh = C4::Context->dbh;
|
|
# Start transaction
|
|
$dbh->{ AutoCommit } = 0;
|
|
$dbh->{ RaiseError } = 1;
|
|
|
|
# Variables controlling LDAP server config
|
|
my $update = 0;
|
|
my $replicate = 0;
|
|
my $auth_by_bind = 1;
|
|
my $anonymous_bind = 1;
|
|
# Variables controlling LDAP behaviour
|
|
my $desired_authentication_result = 'success';
|
|
my $desired_connection_result = 'error';
|
|
my $desired_bind_result = 'error';
|
|
my $desired_compare_result = 'error';
|
|
my $desired_search_result = 'error';
|
|
my $desired_count_result = 1;
|
|
my $non_anonymous_bind_result = 'error';
|
|
my $ret;
|
|
|
|
# Mock the context module
|
|
my $context = new Test::MockModule( 'C4::Context' );
|
|
$context->mock( 'config', \&mockedC4Config );
|
|
|
|
# Mock the Net::LDAP module
|
|
my $ldap = new Test::MockModule( 'Net::LDAP' );
|
|
|
|
$ldap->mock( 'new', sub {
|
|
if ( $desired_connection_result eq 'error' ) {
|
|
# We were asked to fail the LDAP conexion
|
|
return;
|
|
} else {
|
|
# Return a mocked Net::LDAP object (Test::MockObject)
|
|
return mock_net_ldap();
|
|
}
|
|
});
|
|
|
|
|
|
# C4::Auth_with_ldap needs several stuff set first ^^^
|
|
use_ok( 'C4::Auth_with_ldap' );
|
|
can_ok( 'C4::Auth_with_ldap', qw/
|
|
checkpw_ldap
|
|
search_method );
|
|
|
|
subtest "checkpw_ldap tests" => sub {
|
|
|
|
plan tests => 4;
|
|
|
|
## Connection fail tests
|
|
$desired_connection_result = 'error';
|
|
warning_is { $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' ) }
|
|
"LDAP connexion failed",
|
|
"checkpw_ldap prints correct warning if LDAP conexion fails";
|
|
is( $ret, 0, "checkpw_ldap returns 0 if LDAP conexion fails");
|
|
|
|
## Connection success tests
|
|
$desired_connection_result = 'success';
|
|
|
|
subtest "auth_by_bind = 1 tests" => sub {
|
|
|
|
plan tests => 5;
|
|
|
|
$auth_by_bind = 1;
|
|
|
|
$desired_authentication_result = 'success';
|
|
$anonymous_bind = 1;
|
|
$desired_bind_result = 'error';
|
|
$desired_search_result = 'error';
|
|
reload_ldap_module();
|
|
|
|
|
|
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
|
|
$dbh, 'hola', password => 'hey' ) }
|
|
qr/Anonymous LDAP bind failed: LDAP error #1: error_name/,
|
|
"checkpw_ldap prints correct warning if LDAP anonymous bind fails";
|
|
is( $ret, 0, "checkpw_ldap returns 0 if LDAP anonymous bind fails");
|
|
|
|
$desired_authentication_result = 'success';
|
|
$anonymous_bind = 1;
|
|
$desired_bind_result = 'success';
|
|
$desired_search_result = 'success';
|
|
$desired_count_result = 0; # user auth problem
|
|
$non_anonymous_bind_result = 'success';
|
|
reload_ldap_module();
|
|
is ( C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' ),
|
|
0, "checkpw_ldap returns 0 if user lookup returns 0");
|
|
|
|
$non_anonymous_bind_result = 'error';
|
|
reload_ldap_module();
|
|
|
|
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
|
|
$dbh, 'hola', password => 'hey' ) }
|
|
qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
|
|
"checkpw_ldap prints correct warning if LDAP bind fails";
|
|
is ( $ret, -1, "checkpw_ldap returns -1 LDAP bind fails for user (Bug 8148)");
|
|
};
|
|
|
|
subtest "auth_by_bind = 0 tests" => sub {
|
|
|
|
plan tests => 8;
|
|
|
|
$auth_by_bind = 0;
|
|
|
|
# Anonymous bind
|
|
$anonymous_bind = 1;
|
|
$desired_bind_result = 'error';
|
|
$non_anonymous_bind_result = 'error';
|
|
reload_ldap_module();
|
|
|
|
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
|
|
$dbh, 'hola', password => 'hey' ) }
|
|
qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/,
|
|
"checkpw_ldap prints correct warning if LDAP bind fails";
|
|
is ( $ret, 0, "checkpw_ldap returns 0 if bind fails");
|
|
|
|
$anonymous_bind = 1;
|
|
$desired_bind_result = 'success';
|
|
$non_anonymous_bind_result = 'success';
|
|
$desired_compare_result = 'error';
|
|
reload_ldap_module();
|
|
|
|
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
|
|
$dbh, 'hola', password => 'hey' ) }
|
|
qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/,
|
|
"checkpw_ldap prints correct warning if LDAP bind fails";
|
|
is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)");
|
|
|
|
# Non-anonymous bind
|
|
$anonymous_bind = 0;
|
|
$desired_bind_result = 'success';
|
|
$non_anonymous_bind_result = 'error';
|
|
$desired_compare_result = 'dont care';
|
|
reload_ldap_module();
|
|
|
|
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
|
|
$dbh, 'hola', password => 'hey' ) }
|
|
qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/,
|
|
"checkpw_ldap prints correct warning if LDAP bind fails";
|
|
is ( $ret, 0, "checkpw_ldap returns 0 if bind fails");
|
|
|
|
$anonymous_bind = 0;
|
|
$desired_bind_result = 'success';
|
|
$non_anonymous_bind_result = 'success';
|
|
$desired_compare_result = 'error';
|
|
reload_ldap_module();
|
|
|
|
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
|
|
$dbh, 'hola', password => 'hey' ) }
|
|
qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/,
|
|
"checkpw_ldap prints correct warning if LDAP bind fails";
|
|
is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)");
|
|
|
|
};
|
|
};
|
|
|
|
subtest "search_method tests" => sub {
|
|
|
|
plan tests => 5;
|
|
|
|
my $ldap = mock_net_ldap();
|
|
|
|
# Null params tests
|
|
is( C4::Auth_with_ldap::search_method( $ldap, undef), undef,
|
|
"search_method returns undef on undefined userid");
|
|
is( C4::Auth_with_ldap::search_method( undef, "undef"), undef,
|
|
"search_method returns undef on undefined ldap object");
|
|
|
|
# search ->code and !->code
|
|
$desired_search_result = 'error';
|
|
reload_ldap_module();
|
|
eval { $ret = C4::Auth_with_ldap::search_method( $ldap, "undef"); };
|
|
like( $@, qr/LDAP search failed to return object : 1/,
|
|
"search_method prints correct warning when db->search returns error code");
|
|
|
|
$desired_search_result = 'success';
|
|
$desired_count_result = 2;
|
|
reload_ldap_module();
|
|
warning_like { $ret = C4::Auth_with_ldap::search_method( $ldap, '123') }
|
|
qr/^LDAP Auth rejected \: \(uid\=123\) gets 2 hits/,
|
|
"search_method prints correct warning when hits count is not 1";
|
|
is( $ret, 0, "search_method returns 0 when hits count is not 1" );
|
|
|
|
};
|
|
|
|
# Function that mocks the call to C4::Context->config(param)
|
|
sub mockedC4Config {
|
|
|
|
my $param = shift;
|
|
|
|
my %ldap_mapping = (
|
|
firstname => { is => 'givenname' },
|
|
surname => { is => 'sn' },
|
|
address => { is => 'postaladdress' },
|
|
city => { is => 'l' },
|
|
zipcode => { is => 'postalcode' },
|
|
branchcode => { is => 'branch' },
|
|
userid => { is => 'uid' },
|
|
password => { is => 'userpassword' },
|
|
email => { is => 'mail' },
|
|
categorycode => { is => 'employeetype' },
|
|
phone => { is => 'telephonenumber' }
|
|
);
|
|
|
|
my %ldap_config = (
|
|
anonymous_bind => $anonymous_bind,
|
|
auth_by_bind => $auth_by_bind,
|
|
base => 'dc=metavore,dc=com',
|
|
hostname => 'localhost',
|
|
mapping => \%ldap_mapping,
|
|
pass => 'metavore',
|
|
principal_name => '%s@my_domain.com',
|
|
replicate => $replicate,
|
|
update => $update,
|
|
user => 'cn=Manager,dc=metavore,dc=com'
|
|
);
|
|
|
|
return \%ldap_config;
|
|
};
|
|
|
|
# Function that mocks the call to Net::LDAP
|
|
sub mock_net_ldap {
|
|
|
|
my $mocked_ldap = Test::MockObject->new();
|
|
|
|
$mocked_ldap->mock( 'bind', sub {
|
|
|
|
my @args = @_;
|
|
my $mocked_message;
|
|
|
|
if ( $#args > 1 ) {
|
|
# Args passed => non-anonymous bind
|
|
if ( $non_anonymous_bind_result eq 'error' ) {
|
|
return mock_net_ldap_message(1,1,'error_name','error_text');
|
|
} else {
|
|
return mock_net_ldap_message(0,0,'','');
|
|
}
|
|
} else {
|
|
$mocked_message = mock_net_ldap_message(
|
|
($desired_bind_result eq 'error' ) ? 1 : 0, # code
|
|
($desired_bind_result eq 'error' ) ? 1 : 0, # error
|
|
($desired_bind_result eq 'error' ) ? 'error_name' : 0, # error_name
|
|
($desired_bind_result eq 'error' ) ? 'error_text' : 0 # error_text
|
|
);
|
|
}
|
|
|
|
return $mocked_message;
|
|
});
|
|
|
|
$mocked_ldap->mock( 'compare', sub {
|
|
|
|
my $mocked_message;
|
|
|
|
if ( $desired_compare_result eq 'error' ) {
|
|
$mocked_message = mock_net_ldap_message(1,1,'error_name','error_text');
|
|
} else {
|
|
# we expect return code 6 for success
|
|
$mocked_message = mock_net_ldap_message(6,0,'','');
|
|
}
|
|
|
|
return $mocked_message;
|
|
});
|
|
|
|
$mocked_ldap->mock( 'search', sub {
|
|
|
|
return mock_net_ldap_search(
|
|
( $desired_count_result ) # count
|
|
? $desired_count_result
|
|
: 1, # default to 1
|
|
( $desired_search_result eq 'error' ) # code
|
|
? 1
|
|
: 0, # 0 == success
|
|
( $desired_search_result eq 'error' ) # error
|
|
? 1
|
|
: 0,
|
|
( $desired_search_result eq 'error' ) # error_text
|
|
? 'error_text'
|
|
: undef,
|
|
( $desired_search_result eq 'error' ) # error_name
|
|
? 'error_name'
|
|
: undef,
|
|
mock_net_ldap_entry( 'sampledn', 1 ) # shift_entry
|
|
);
|
|
|
|
});
|
|
|
|
return $mocked_ldap;
|
|
}
|
|
|
|
sub mock_net_ldap_search {
|
|
my ( $count, $code, $error, $error_text,
|
|
$error_name, $shift_entry ) = @_;
|
|
|
|
my $mocked_search = Test::MockObject->new();
|
|
$mocked_search->mock( 'count', sub { return $count; } );
|
|
$mocked_search->mock( 'code', sub { return $code; } );
|
|
$mocked_search->mock( 'error', sub { return $error; } );
|
|
$mocked_search->mock( 'error_name', sub { return $error_name; } );
|
|
$mocked_search->mock( 'error_text', sub { return $error_text; } );
|
|
$mocked_search->mock( 'shift_entry', sub { return $shift_entry; } );
|
|
|
|
return $mocked_search;
|
|
}
|
|
|
|
sub mock_net_ldap_message {
|
|
my ( $code, $error, $error_name, $error_text ) = @_;
|
|
|
|
my $mocked_message = Test::MockObject->new();
|
|
$mocked_message->mock( 'code', sub { $code } );
|
|
$mocked_message->mock( 'error', sub { $error } );
|
|
$mocked_message->mock( 'error_name', sub { $error_name } );
|
|
$mocked_message->mock( 'error_text', sub { $error_text } );
|
|
|
|
return $mocked_message;
|
|
}
|
|
|
|
sub mock_net_ldap_entry {
|
|
my ( $dn, $exists ) = @_;
|
|
|
|
my $mocked_entry = Test::MockObject->new();
|
|
$mocked_entry->mock( 'dn', sub { return $dn; } );
|
|
$mocked_entry->mock( 'exists', sub { return $exists } );
|
|
|
|
return $mocked_entry;
|
|
}
|
|
|
|
# TODO: Once we remove the global variables in C4::Auth_with_ldap
|
|
# we shouldn't need this...
|
|
# ... Horrible hack
|
|
sub reload_ldap_module {
|
|
delete $INC{'C4/Auth_with_ldap.pm'};
|
|
require C4::Auth_with_ldap;
|
|
C4::Auth_with_ldap->import;
|
|
}
|
|
|
|
$dbh->rollback;
|
|
|
|
1;
|
|
|