+ 'cn' => [$this->mockUser->name],
+ 'dn' => 'dc=test' . config('services.ldap.base_dn'),
+ ]]);
+
+ $this->mockUserLogin()->assertRedirect('/login');
+ $this->get('/login')->assertSee('Please enter an email to use for this account.');
+
+ $resp = $this->mockUserLogin($this->mockUser->email);
+ $resp->assertRedirect('/');
+ $this->get('/')->assertSee($this->mockUser->name);
+ $this->assertDatabaseHas('users', [
+ 'email' => $this->mockUser->email,
+ 'email_confirmed' => false,
+ 'external_auth_id' => $this->mockUser->name,
+ 'name' => $this->mockUser->name,
+ ]);
+ }
+
+ protected function checkLdapReceivesCorrectDetails($serverString, $expectedHostString): void
+ {
+ app('config')->set(['services.ldap.server' => $serverString]);
+
+ $this->mockLdap->shouldReceive('connect')
+ ->once()
+ ->with($expectedHostString)
+ ->andReturn(false);
+
+ $this->mockUserLogin();
+ }
+
+ public function test_ldap_receives_correct_connect_host_from_config()
+ {
+ $expectedResultByInput = [
+ 'ldaps://bookstack:8080' => 'ldaps://bookstack:8080',
+ 'ldap.bookstack.com:8080' => 'ldap://ldap.bookstack.com:8080',
+ 'ldap.bookstack.com' => 'ldap://ldap.bookstack.com',
+ 'ldaps://ldap.bookstack.com' => 'ldaps://ldap.bookstack.com',
+ 'ldaps://ldap.bookstack.com ldap://a.b.com' => 'ldaps://ldap.bookstack.com ldap://a.b.com',
+ ];
+
+ foreach ($expectedResultByInput as $input => $expectedResult) {
+ $this->checkLdapReceivesCorrectDetails($input, $expectedResult);
+ $this->refreshApplication();
+ $this->setUp();
+ }
+ }
+
+ public function test_forgot_password_routes_inaccessible()
+ {
+ $resp = $this->get('/password/email');
+ $this->assertPermissionError($resp);
+
+ $resp = $this->post('/password/email');
+ $this->assertPermissionError($resp);
+
+ $resp = $this->get('/password/reset/abc123');
+ $this->assertPermissionError($resp);
+
+ $resp = $this->post('/password/reset');
+ $this->assertPermissionError($resp);
+ }
+
+ public function test_user_invite_routes_inaccessible()
+ {
+ $resp = $this->get('/register/invite/abc123');
+ $this->assertPermissionError($resp);
+
+ $resp = $this->post('/register/invite/abc123');
+ $this->assertPermissionError($resp);
+ }
+
+ public function test_user_register_routes_inaccessible()
+ {
+ $resp = $this->get('/register');
+ $this->assertPermissionError($resp);
+
+ $resp = $this->post('/register');
+ $this->assertPermissionError($resp);
+ }
+
+ public function test_dump_user_details_option_works()
+ {
+ config()->set(['services.ldap.dump_user_details' => true, 'services.ldap.thumbnail_attribute' => 'jpegphoto']);
+
+ $this->commonLdapMocks(1, 1, 1, 1, 1);
+ $this->mockLdap->shouldReceive('searchAndGetEntries')->times(1)
+ ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))
+ ->andReturn(['count' => 1, 0 => [
+ 'uid' => [$this->mockUser->name],
+ 'cn' => [$this->mockUser->name],
+ // Test dumping binary data for avatar responses
+ 'jpegphoto' => base64_decode('/9j/4AAQSkZJRg=='),
+ 'dn' => 'dc=test' . config('services.ldap.base_dn'),
+ ]]);
+
+ $resp = $this->post('/login', [
+ 'username' => $this->mockUser->name,
+ 'password' => $this->mockUser->password,
+ ]);
+ $resp->assertJsonStructure([
+ 'details_from_ldap' => [],
+ 'details_bookstack_parsed' => [],
+ ]);
+ }
+
+ public function test_start_tls_called_if_option_set()
+ {
+ config()->set(['services.ldap.start_tls' => true]);
+ $this->mockLdap->shouldReceive('startTls')->once()->andReturn(true);
+ $this->runFailedAuthLogin();
+ }
+
+ public function test_connection_fails_if_tls_fails()
+ {
+ config()->set(['services.ldap.start_tls' => true]);
+ $this->mockLdap->shouldReceive('startTls')->once()->andReturn(false);
+ $this->commonLdapMocks(1, 1, 0, 0, 0);
+ $resp = $this->post('/login', ['username' => 'timmyjenkins', 'password' => 'cattreedog']);
+ $resp->assertStatus(500);
+ }
+
+ public function test_ldap_attributes_can_be_binary_decoded_if_marked()
+ {
+ config()->set(['services.ldap.id_attribute' => 'BIN;uid']);
+ $ldapService = app()->make(LdapService::class);
+ $this->commonLdapMocks(1, 1, 1, 1, 1);
+ $this->mockLdap->shouldReceive('searchAndGetEntries')->times(1)
+ ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), ['cn', 'dn', 'uid', 'mail', 'cn'])
+ ->andReturn(['count' => 1, 0 => [
+ 'uid' => [hex2bin('FFF8F7')],
+ 'cn' => [$this->mockUser->name],
+ 'dn' => 'dc=test' . config('services.ldap.base_dn'),
+ ]]);
+
+ $details = $ldapService->getUserDetails('test');
+ $this->assertEquals('fff8f7', $details['uid']);
+ }
+
+ public function test_new_ldap_user_login_with_already_used_email_address_shows_error_message_to_user()
+ {
+ $this->commonLdapMocks(1, 1, 2, 4, 2);
+ $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)
+ ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))
+ ->andReturn(['count' => 1, 0 => [
+ 'uid' => [$this->mockUser->name],
+ 'cn' => [$this->mockUser->name],
+ 'dn' => 'dc=test' . config('services.ldap.base_dn'),
+ ]], ['count' => 1, 0 => [
+ 'uid' => ['Barry'],
+ 'cn' => ['Scott'],
+ 'dn' => 'dc=bscott' . config('services.ldap.base_dn'),
+ ]]);
+
+ // First user login
+ $this->mockUserLogin()->assertRedirect('/');
+
+ // Second user login
+ auth()->logout();
+ $resp = $this->followingRedirects()->post('/login', ['username' => 'bscott', 'password' => 'pass']);
+ $resp->assertSee('A user with the email
[email protected] already exists but with different credentials');
+ }
+
+ public function test_login_with_email_confirmation_required_maps_groups_but_shows_confirmation_screen()
+ {
+ $roleToReceive = Role::factory()->create(['display_name' => 'LdapTester']);
+ $user = User::factory()->make();
+ setting()->put('registration-confirmation', 'true');
+
+ app('config')->set([
+ 'services.ldap.user_to_groups' => true,
+ 'services.ldap.group_attribute' => 'memberOf',
+ 'services.ldap.remove_from_groups' => true,
+ ]);
+
+ $this->commonLdapMocks(1, 1, 6, 8, 4, 2, 2);
+ $this->mockLdap->shouldReceive('searchAndGetEntries')
+ ->times(4)
+ ->andReturn(['count' => 1, 0 => [
+ 'uid' => [$user->name],
+ 'cn' => [$user->name],
+ 'dn' => 'dc=test' . config('services.ldap.base_dn'),
+ 'mail' => [$user->email],
+ 'memberof' => [
+ 'count' => 1,
+ 0 => 'cn=ldaptester,ou=groups,dc=example,dc=com',
+ ],
+ ]]);
+
+ $login = $this->followingRedirects()->mockUserLogin();
+ $login->assertSee('Thanks for registering!');
+ $this->assertDatabaseHas('users', [
+ 'email' => $user->email,
+ 'email_confirmed' => false,
+ ]);
+
+ $user = User::query()->where('email', '=', $user->email)->first();
+ $this->assertDatabaseHas('role_user', [
+ 'user_id' => $user->id,
+ 'role_id' => $roleToReceive->id,
+ ]);
+
+ $this->assertNull(auth()->user());
+
+ $homePage = $this->get('/');
+ $homePage->assertRedirect('/login');
+
+ $login = $this->followingRedirects()->mockUserLogin();
+ $login->assertSee('Email Address Not Confirmed');
+ }
+
+ public function test_failed_logins_are_logged_when_message_configured()
+ {
+ $log = $this->withTestLogger();
+ config()->set(['logging.failed_login.message' => 'Failed login for %u']);
+ $this->runFailedAuthLogin();
+ $this->assertTrue($log->hasWarningThatContains('Failed login for timmyjenkins'));
+ }
+
+ public function test_thumbnail_attribute_used_as_user_avatar_if_configured()
+ {
+ config()->set(['services.ldap.thumbnail_attribute' => 'jpegPhoto']);
+
+ $this->commonLdapMocks(1, 1, 1, 2, 1);
+ $ldapDn = 'cn=test-user,dc=test' . config('services.ldap.base_dn');
+ $this->mockLdap->shouldReceive('searchAndGetEntries')->times(1)
+ ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))
+ ->andReturn(['count' => 1, 0 => [
+ 'cn' => [$this->mockUser->name],
+ 'dn' => $ldapDn,
+ 'jpegphoto' => [base64_decode('/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8Q
+EBEQCgwSExIQEw8QEBD/yQALCAABAAEBAREA/8wABgAQEAX/2gAIAQEAAD8A0s8g/9k=')],
+ 'mail' => [$this->mockUser->email],
projects / bookstack / blobdiff