|
Line 0
Link Here
|
| 0 |
- |
1 |
#!/usr/bin/perl |
|
|
2 |
|
| 3 |
# This file is part of Koha. |
| 4 |
# |
| 5 |
# Koha is free software; you can redistribute it and/or modify it |
| 6 |
# under the terms of the GNU General Public License as published by |
| 7 |
# the Free Software Foundation; either version 3 of the License, or |
| 8 |
# (at your option) any later version. |
| 9 |
# |
| 10 |
# Koha is distributed in the hope that it will be useful, but |
| 11 |
# WITHOUT ANY WARRANTY; without even the implied warranty of |
| 12 |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 13 |
# GNU General Public License for more details. |
| 14 |
# |
| 15 |
# You should have received a copy of the GNU General Public License |
| 16 |
# along with Koha; if not, see <http://www.gnu.org/licenses>. |
| 17 |
|
| 18 |
use Modern::Perl; |
| 19 |
|
| 20 |
use Test::More tests => 4; |
| 21 |
use Test::MockModule; |
| 22 |
use Test::MockObject; |
| 23 |
use Test::Warn; |
| 24 |
|
| 25 |
use C4::Context; |
| 26 |
|
| 27 |
my $dbh = C4::Context->dbh; |
| 28 |
# Start transaction |
| 29 |
$dbh->{ AutoCommit } = 0; |
| 30 |
$dbh->{ RaiseError } = 1; |
| 31 |
|
| 32 |
# Variables controlling LDAP server config |
| 33 |
my $update = 0; |
| 34 |
my $replicate = 0; |
| 35 |
my $auth_by_bind = 1; |
| 36 |
my $anonymous_bind = 1; |
| 37 |
# Variables controlling LDAP behaviour |
| 38 |
my $desired_authentication_result = 'success'; |
| 39 |
my $desired_connection_result = 'error'; |
| 40 |
my $desired_bind_result = 'error'; |
| 41 |
my $desired_compare_result = 'error'; |
| 42 |
my $desired_search_result = 'error'; |
| 43 |
my $desired_count_result = 1; |
| 44 |
my $non_anonymous_bind_result = 'error'; |
| 45 |
my $ret; |
| 46 |
|
| 47 |
# Mock the context module |
| 48 |
my $context = new Test::MockModule( 'C4::Context' ); |
| 49 |
$context->mock( 'config', \&mockedC4Config ); |
| 50 |
|
| 51 |
# Mock the Net::LDAP module |
| 52 |
my $ldap = new Test::MockModule( 'Net::LDAP' ); |
| 53 |
|
| 54 |
$ldap->mock( 'new', sub { |
| 55 |
if ( $desired_connection_result eq 'error' ) { |
| 56 |
# We were asked to fail the LDAP conexion |
| 57 |
return; |
| 58 |
} else { |
| 59 |
# Return a mocked Net::LDAP object (Test::MockObject) |
| 60 |
return mock_net_ldap(); |
| 61 |
} |
| 62 |
}); |
| 63 |
|
| 64 |
|
| 65 |
# C4::Auth_with_ldap needs several stuff set first ^^^ |
| 66 |
use_ok( 'C4::Auth_with_ldap' ); |
| 67 |
can_ok( 'C4::Auth_with_ldap', qw/ |
| 68 |
checkpw_ldap |
| 69 |
search_method /); |
| 70 |
|
| 71 |
subtest "checkpw_ldap tests" => sub { |
| 72 |
|
| 73 |
plan tests => 4; |
| 74 |
|
| 75 |
## Connection fail tests |
| 76 |
$desired_connection_result = 'error'; |
| 77 |
warning_is { $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' ) } |
| 78 |
"LDAP connexion failed", |
| 79 |
"checkpw_ldap prints correct warning if LDAP conexion fails"; |
| 80 |
is( $ret, 0, "checkpw_ldap returns 0 if LDAP conexion fails"); |
| 81 |
|
| 82 |
## Connection success tests |
| 83 |
$desired_connection_result = 'success'; |
| 84 |
|
| 85 |
subtest "auth_by_bind = 1 tests" => sub { |
| 86 |
|
| 87 |
plan tests => 5; |
| 88 |
|
| 89 |
$auth_by_bind = 1; |
| 90 |
|
| 91 |
$desired_authentication_result = 'success'; |
| 92 |
$anonymous_bind = 1; |
| 93 |
$desired_bind_result = 'error'; |
| 94 |
$desired_search_result = 'error'; |
| 95 |
reload_ldap_module(); |
| 96 |
|
| 97 |
|
| 98 |
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap( |
| 99 |
$dbh, 'hola', password => 'hey' ) } |
| 100 |
qr/Anonymous LDAP bind failed: LDAP error #1: error_name/, |
| 101 |
"checkpw_ldap prints correct warning if LDAP anonymous bind fails"; |
| 102 |
is( $ret, 0, "checkpw_ldap returns 0 if LDAP anonymous bind fails"); |
| 103 |
|
| 104 |
$desired_authentication_result = 'success'; |
| 105 |
$anonymous_bind = 1; |
| 106 |
$desired_bind_result = 'success'; |
| 107 |
$desired_search_result = 'success'; |
| 108 |
$desired_count_result = 0; # user auth problem |
| 109 |
$non_anonymous_bind_result = 'success'; |
| 110 |
reload_ldap_module(); |
| 111 |
is ( C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola', password => 'hey' ), |
| 112 |
0, "checkpw_ldap returns 0 if user lookup returns 0"); |
| 113 |
|
| 114 |
$non_anonymous_bind_result = 'error'; |
| 115 |
reload_ldap_module(); |
| 116 |
|
| 117 |
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap( |
| 118 |
$dbh, 'hola', password => 'hey' ) } |
| 119 |
qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/, |
| 120 |
"checkpw_ldap prints correct warning if LDAP bind fails"; |
| 121 |
is ( $ret, -1, "checkpw_ldap returns -1 LDAP bind fails for user (Bug 8148)"); |
| 122 |
}; |
| 123 |
|
| 124 |
subtest "auth_by_bind = 0 tests" => sub { |
| 125 |
|
| 126 |
plan tests => 8; |
| 127 |
|
| 128 |
$auth_by_bind = 0; |
| 129 |
|
| 130 |
# Anonymous bind |
| 131 |
$anonymous_bind = 1; |
| 132 |
$desired_bind_result = 'error'; |
| 133 |
$non_anonymous_bind_result = 'error'; |
| 134 |
reload_ldap_module(); |
| 135 |
|
| 136 |
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap( |
| 137 |
$dbh, 'hola', password => 'hey' ) } |
| 138 |
qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/, |
| 139 |
"checkpw_ldap prints correct warning if LDAP bind fails"; |
| 140 |
is ( $ret, 0, "checkpw_ldap returns 0 if bind fails"); |
| 141 |
|
| 142 |
$anonymous_bind = 1; |
| 143 |
$desired_bind_result = 'success'; |
| 144 |
$non_anonymous_bind_result = 'success'; |
| 145 |
$desired_compare_result = 'error'; |
| 146 |
reload_ldap_module(); |
| 147 |
|
| 148 |
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap( |
| 149 |
$dbh, 'hola', password => 'hey' ) } |
| 150 |
qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/, |
| 151 |
"checkpw_ldap prints correct warning if LDAP bind fails"; |
| 152 |
is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)"); |
| 153 |
|
| 154 |
# Non-anonymous bind |
| 155 |
$anonymous_bind = 0; |
| 156 |
$desired_bind_result = 'success'; |
| 157 |
$non_anonymous_bind_result = 'error'; |
| 158 |
$desired_compare_result = 'dont care'; |
| 159 |
reload_ldap_module(); |
| 160 |
|
| 161 |
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap( |
| 162 |
$dbh, 'hola', password => 'hey' ) } |
| 163 |
qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: error_name/, |
| 164 |
"checkpw_ldap prints correct warning if LDAP bind fails"; |
| 165 |
is ( $ret, 0, "checkpw_ldap returns 0 if bind fails"); |
| 166 |
|
| 167 |
$anonymous_bind = 0; |
| 168 |
$desired_bind_result = 'success'; |
| 169 |
$non_anonymous_bind_result = 'success'; |
| 170 |
$desired_compare_result = 'error'; |
| 171 |
reload_ldap_module(); |
| 172 |
|
| 173 |
warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap( |
| 174 |
$dbh, 'hola', password => 'hey' ) } |
| 175 |
qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/, |
| 176 |
"checkpw_ldap prints correct warning if LDAP bind fails"; |
| 177 |
is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)"); |
| 178 |
|
| 179 |
}; |
| 180 |
}; |
| 181 |
|
| 182 |
subtest "search_method tests" => sub { |
| 183 |
|
| 184 |
plan tests => 5; |
| 185 |
|
| 186 |
my $ldap = mock_net_ldap(); |
| 187 |
|
| 188 |
# Null params tests |
| 189 |
is( C4::Auth_with_ldap::search_method( $ldap, undef), undef, |
| 190 |
"search_method returns undef on undefined userid"); |
| 191 |
is( C4::Auth_with_ldap::search_method( undef, "undef"), undef, |
| 192 |
"search_method returns undef on undefined ldap object"); |
| 193 |
|
| 194 |
# search ->code and !->code |
| 195 |
$desired_search_result = 'error'; |
| 196 |
reload_ldap_module(); |
| 197 |
eval { $ret = C4::Auth_with_ldap::search_method( $ldap, "undef"); }; |
| 198 |
like( $@, qr/LDAP search failed to return object : 1/, |
| 199 |
"search_method prints correct warning when db->search returns error code"); |
| 200 |
|
| 201 |
$desired_search_result = 'success'; |
| 202 |
$desired_count_result = 2; |
| 203 |
reload_ldap_module(); |
| 204 |
warning_like { $ret = C4::Auth_with_ldap::search_method( $ldap, '123') } |
| 205 |
qr/^LDAP Auth rejected \: \(uid\=123\) gets 2 hits/, |
| 206 |
"search_method prints correct warning when hits count is not 1"; |
| 207 |
is( $ret, 0, "search_method returns 0 when hits count is not 1" ); |
| 208 |
|
| 209 |
}; |
| 210 |
|
| 211 |
# Function that mocks the call to C4::Context->config(param) |
| 212 |
sub mockedC4Config { |
| 213 |
|
| 214 |
my $param = shift; |
| 215 |
|
| 216 |
my %ldap_mapping = ( |
| 217 |
firstname => { is => 'givenname' }, |
| 218 |
surname => { is => 'sn' }, |
| 219 |
address => { is => 'postaladdress' }, |
| 220 |
city => { is => 'l' }, |
| 221 |
zipcode => { is => 'postalcode' }, |
| 222 |
branchcode => { is => 'branch' }, |
| 223 |
userid => { is => 'uid' }, |
| 224 |
password => { is => 'userpassword' }, |
| 225 |
email => { is => 'mail' }, |
| 226 |
categorycode => { is => 'employeetype' }, |
| 227 |
phone => { is => 'telephonenumber' } |
| 228 |
); |
| 229 |
|
| 230 |
my %ldap_config = ( |
| 231 |
anonymous_bind => $anonymous_bind, |
| 232 |
auth_by_bind => $auth_by_bind, |
| 233 |
base => 'dc=metavore,dc=com', |
| 234 |
hostname => 'localhost', |
| 235 |
mapping => \%ldap_mapping, |
| 236 |
pass => 'metavore', |
| 237 |
principal_name => '%s@my_domain.com', |
| 238 |
replicate => $replicate, |
| 239 |
update => $update, |
| 240 |
user => 'cn=Manager,dc=metavore,dc=com' |
| 241 |
); |
| 242 |
|
| 243 |
return \%ldap_config; |
| 244 |
}; |
| 245 |
|
| 246 |
# Function that mocks the call to Net::LDAP |
| 247 |
sub mock_net_ldap { |
| 248 |
|
| 249 |
my $mocked_ldap = Test::MockObject->new(); |
| 250 |
|
| 251 |
$mocked_ldap->mock( 'bind', sub { |
| 252 |
|
| 253 |
my @args = @_; |
| 254 |
my $mocked_message; |
| 255 |
|
| 256 |
if ( $#args > 1 ) { |
| 257 |
# Args passed => non-anonymous bind |
| 258 |
if ( $non_anonymous_bind_result eq 'error' ) { |
| 259 |
return mock_net_ldap_message(1,1,'error_name','error_text'); |
| 260 |
} else { |
| 261 |
return mock_net_ldap_message(0,0,'',''); |
| 262 |
} |
| 263 |
} else { |
| 264 |
$mocked_message = mock_net_ldap_message( |
| 265 |
($desired_bind_result eq 'error' ) ? 1 : 0, # code |
| 266 |
($desired_bind_result eq 'error' ) ? 1 : 0, # error |
| 267 |
($desired_bind_result eq 'error' ) ? 'error_name' : 0, # error_name |
| 268 |
($desired_bind_result eq 'error' ) ? 'error_text' : 0 # error_text |
| 269 |
); |
| 270 |
} |
| 271 |
|
| 272 |
return $mocked_message; |
| 273 |
}); |
| 274 |
|
| 275 |
$mocked_ldap->mock( 'compare', sub { |
| 276 |
|
| 277 |
my $mocked_message; |
| 278 |
|
| 279 |
if ( $desired_compare_result eq 'error' ) { |
| 280 |
$mocked_message = mock_net_ldap_message(1,1,'error_name','error_text'); |
| 281 |
} else { |
| 282 |
# we expect return code 6 for success |
| 283 |
$mocked_message = mock_net_ldap_message(6,0,'',''); |
| 284 |
} |
| 285 |
|
| 286 |
return $mocked_message; |
| 287 |
}); |
| 288 |
|
| 289 |
$mocked_ldap->mock( 'search', sub { |
| 290 |
|
| 291 |
return mock_net_ldap_search( |
| 292 |
( $desired_count_result ) # count |
| 293 |
? $desired_count_result |
| 294 |
: 1, # default to 1 |
| 295 |
( $desired_search_result eq 'error' ) # code |
| 296 |
? 1 |
| 297 |
: 0, # 0 == success |
| 298 |
( $desired_search_result eq 'error' ) # error |
| 299 |
? 1 |
| 300 |
: 0, |
| 301 |
( $desired_search_result eq 'error' ) # error_text |
| 302 |
? 'error_text' |
| 303 |
: undef, |
| 304 |
( $desired_search_result eq 'error' ) # error_name |
| 305 |
? 'error_name' |
| 306 |
: undef, |
| 307 |
mock_net_ldap_entry( 'sampledn', 1 ) # shift_entry |
| 308 |
); |
| 309 |
|
| 310 |
}); |
| 311 |
|
| 312 |
return $mocked_ldap; |
| 313 |
} |
| 314 |
|
| 315 |
sub mock_net_ldap_search { |
| 316 |
my ( $count, $code, $error, $error_text, |
| 317 |
$error_name, $shift_entry ) = @_; |
| 318 |
|
| 319 |
my $mocked_search = Test::MockObject->new(); |
| 320 |
$mocked_search->mock( 'count', sub { return $count; } ); |
| 321 |
$mocked_search->mock( 'code', sub { return $code; } ); |
| 322 |
$mocked_search->mock( 'error', sub { return $error; } ); |
| 323 |
$mocked_search->mock( 'error_name', sub { return $error_name; } ); |
| 324 |
$mocked_search->mock( 'error_text', sub { return $error_text; } ); |
| 325 |
$mocked_search->mock( 'shift_entry', sub { return $shift_entry; } ); |
| 326 |
|
| 327 |
return $mocked_search; |
| 328 |
} |
| 329 |
|
| 330 |
sub mock_net_ldap_message { |
| 331 |
my ( $code, $error, $error_name, $error_text ) = @_; |
| 332 |
|
| 333 |
my $mocked_message = Test::MockObject->new(); |
| 334 |
$mocked_message->mock( 'code', sub { $code } ); |
| 335 |
$mocked_message->mock( 'error', sub { $error } ); |
| 336 |
$mocked_message->mock( 'error_name', sub { $error_name } ); |
| 337 |
$mocked_message->mock( 'error_text', sub { $error_text } ); |
| 338 |
|
| 339 |
return $mocked_message; |
| 340 |
} |
| 341 |
|
| 342 |
sub mock_net_ldap_entry { |
| 343 |
my ( $dn, $exists ) = @_; |
| 344 |
|
| 345 |
my $mocked_entry = Test::MockObject->new(); |
| 346 |
$mocked_entry->mock( 'dn', sub { return $dn; } ); |
| 347 |
$mocked_entry->mock( 'exists', sub { return $exists } ); |
| 348 |
|
| 349 |
return $mocked_entry; |
| 350 |
} |
| 351 |
|
| 352 |
# TODO: Once we remove the global variables in C4::Auth_with_ldap |
| 353 |
# we shouldn't need this... |
| 354 |
# ... Horrible hack |
| 355 |
sub reload_ldap_module { |
| 356 |
delete $INC{'C4/Auth_with_ldap.pm'}; |
| 357 |
require C4::Auth_with_ldap; |
| 358 |
C4::Auth_with_ldap->import; |
| 359 |
} |
| 360 |
|
| 361 |
$dbh->rollback; |
| 362 |
|
| 363 |
1; |