BookStack Code Mirror - bookstack/blob - tests/Auth/LdapTest.php

1 <?php namespace Tests;

2 use BookStack\Auth\Role;

3 use BookStack\Auth\Access\Ldap;

4 use BookStack\Auth\User;

5 use Mockery\MockInterface;

6

7 class LdapTest extends BrowserKitTest

8 {

9

10 /**

11 * @var MockInterface

12 */

13 protected $mockLdap;

14

15 protected $mockUser;

16 protected $resourceId = 'resource-test';

17

18 public function setUp()

19 {

20 parent::setUp();

21 if (!defined('LDAP_OPT_REFERRALS')) define('LDAP_OPT_REFERRALS', 1);

22 app('config')->set([

23 'auth.method' => 'ldap',

24 'services.ldap.base_dn' => 'dc=ldap,dc=local',

25 'services.ldap.email_attribute' => 'mail',

26 'services.ldap.user_to_groups' => false,

27 'auth.providers.users.driver' => 'ldap',

28 ]);

29 $this->mockLdap = \Mockery::mock(Ldap::class);

30 $this->app[Ldap::class] = $this->mockLdap;

31 $this->mockUser = factory(User::class)->make();

32 }

33

34 protected function mockEscapes($times = 1)

35 {

36 $this->mockLdap->shouldReceive('escape')->times($times)->andReturnUsing(function($val) {

37 return ldap_escape($val);

38 });

39 }

40

41 protected function mockExplodes($times = 1)

42 {

43 $this->mockLdap->shouldReceive('explodeDn')->times($times)->andReturnUsing(function($dn, $withAttrib) {

44 return ldap_explode_dn($dn, $withAttrib);

45 });

46 }

47

48 public function test_login()

49 {

50 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

51 $this->mockLdap->shouldReceive('setVersion')->once();

52 $this->mockLdap->shouldReceive('setOption')->times(4);

53 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

54 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

55 ->andReturn(['count' => 1, 0 => [

56 'uid' => [$this->mockUser->name],

57 'cn' => [$this->mockUser->name],

58 'dn' => ['dc=test' . config('services.ldap.base_dn')]

59 ]]);

60 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

61 $this->mockEscapes(4);

62

63 $this->visit('/login')

64 ->see('Username')

65 ->type($this->mockUser->name, '#username')

66 ->type($this->mockUser->password, '#password')

67 ->press('Log In')

68 ->seePageIs('/login')->see('Please enter an email to use for this account.');

69

70 $this->type($this->mockUser->email, '#email')

71 ->press('Log In')

72 ->seePageIs('/')

73 ->see($this->mockUser->name)

74 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $this->mockUser->name]);

75 }

76

77 public function test_login_works_when_no_uid_provided_by_ldap_server()

78 {

79 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

80 $this->mockLdap->shouldReceive('setVersion')->once();

81 $ldapDn = 'cn=test-user,dc=test' . config('services.ldap.base_dn');

82 $this->mockLdap->shouldReceive('setOption')->times(2);

83 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)

84 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

85 ->andReturn(['count' => 1, 0 => [

86 'cn' => [$this->mockUser->name],

87 'dn' => $ldapDn,

88 'mail' => [$this->mockUser->email]

89 ]]);

90 $this->mockLdap->shouldReceive('bind')->times(3)->andReturn(true);

91 $this->mockEscapes(2);

92

93 $this->visit('/login')

94 ->see('Username')

95 ->type($this->mockUser->name, '#username')

96 ->type($this->mockUser->password, '#password')

97 ->press('Log In')

98 ->seePageIs('/')

99 ->see($this->mockUser->name)

100 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $ldapDn]);

101 }

102

103 public function test_initial_incorrect_details()

104 {

105 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

106 $this->mockLdap->shouldReceive('setVersion')->once();

107 $this->mockLdap->shouldReceive('setOption')->times(2);

108 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)

109 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

110 ->andReturn(['count' => 1, 0 => [

111 'uid' => [$this->mockUser->name],

112 'cn' => [$this->mockUser->name],

113 'dn' => ['dc=test' . config('services.ldap.base_dn')]

114 ]]);

115 $this->mockLdap->shouldReceive('bind')->times(3)->andReturn(true, true, false);

116 $this->mockEscapes(2);

117

118 $this->visit('/login')

119 ->see('Username')

120 ->type($this->mockUser->name, '#username')

121 ->type($this->mockUser->password, '#password')

122 ->press('Log In')

123 ->seePageIs('/login')->see('These credentials do not match our records.')

124 ->dontSeeInDatabase('users', ['external_auth_id' => $this->mockUser->name]);

125 }

126

127 public function test_create_user_form()

128 {

129 $this->asAdmin()->visit('/settings/users/create')

130 ->dontSee('Password')

131 ->type($this->mockUser->name, '#name')

132 ->type($this->mockUser->email, '#email')

133 ->press('Save')

134 ->see('The external auth id field is required.')

135 ->type($this->mockUser->name, '#external_auth_id')

136 ->press('Save')

137 ->seePageIs('/settings/users')

138 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'external_auth_id' => $this->mockUser->name, 'email_confirmed' => true]);

139 }

140

141 public function test_user_edit_form()

142 {

143 $editUser = $this->getNormalUser();

144 $this->asAdmin()->visit('/settings/users/' . $editUser->id)

145 ->see('Edit User')

146 ->dontSee('Password')

147 ->type('test_auth_id', '#external_auth_id')

148 ->press('Save')

149 ->seePageIs('/settings/users')

150 ->seeInDatabase('users', ['email' => $editUser->email, 'external_auth_id' => 'test_auth_id']);

151 }

152

153 public function test_registration_disabled()

154 {

155 $this->visit('/register')

156 ->seePageIs('/login');

157 }

158

159 public function test_non_admins_cannot_change_auth_id()

160 {

161 $testUser = $this->getNormalUser();

162 $this->actingAs($testUser)->visit('/settings/users/' . $testUser->id)

163 ->dontSee('External Authentication');

164 }

165

166 public function test_login_maps_roles_and_retains_existing_roles()

167 {

168 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

169 $roleToReceive2 = factory(Role::class)->create(['name' => 'ldaptester-second', 'display_name' => 'LdapTester Second']);

170 $existingRole = factory(Role::class)->create(['name' => 'ldaptester-existing']);

171 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

172 $this->mockUser->attachRole($existingRole);

173

174 app('config')->set([

175 'services.ldap.user_to_groups' => true,

176 'services.ldap.group_attribute' => 'memberOf',

177 'services.ldap.remove_from_groups' => false,

178 ]);

179 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

180 $this->mockLdap->shouldReceive('setVersion')->times(2);

181 $this->mockLdap->shouldReceive('setOption')->times(5);

182 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(5)

183 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

184 ->andReturn(['count' => 1, 0 => [

185 'uid' => [$this->mockUser->name],

186 'cn' => [$this->mockUser->name],

187 'dn' => ['dc=test' . config('services.ldap.base_dn')],

188 'mail' => [$this->mockUser->email],

189 'memberof' => [

190 'count' => 2,

191 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

192 1 => "cn=ldaptester-second,ou=groups,dc=example,dc=com",

193 ]

194 ]]);

195 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

196 $this->mockEscapes(5);

197 $this->mockExplodes(6);

198

199 $this->visit('/login')

200 ->see('Username')

201 ->type($this->mockUser->name, '#username')

202 ->type($this->mockUser->password, '#password')

203 ->press('Log In')

204 ->seePageIs('/');

205

206 $user = User::where('email', $this->mockUser->email)->first();

207 $this->seeInDatabase('role_user', [

208 'user_id' => $user->id,

209 'role_id' => $roleToReceive->id

210 ]);

211 $this->seeInDatabase('role_user', [

212 'user_id' => $user->id,

213 'role_id' => $roleToReceive2->id

214 ]);

215 $this->seeInDatabase('role_user', [

216 'user_id' => $user->id,

217 'role_id' => $existingRole->id

218 ]);

219 }

220

221 public function test_login_maps_roles_and_removes_old_roles_if_set()

222 {

223 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

224 $existingRole = factory(Role::class)->create(['name' => 'ldaptester-existing']);

225 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

226 $this->mockUser->attachRole($existingRole);

227

228 app('config')->set([

229 'services.ldap.user_to_groups' => true,

230 'services.ldap.group_attribute' => 'memberOf',

231 'services.ldap.remove_from_groups' => true,

232 ]);

233 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

234 $this->mockLdap->shouldReceive('setVersion')->times(2);

235 $this->mockLdap->shouldReceive('setOption')->times(4);

236 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

237 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

238 ->andReturn(['count' => 1, 0 => [

239 'uid' => [$this->mockUser->name],

240 'cn' => [$this->mockUser->name],

241 'dn' => ['dc=test' . config('services.ldap.base_dn')],

242 'mail' => [$this->mockUser->email],

243 'memberof' => [

244 'count' => 1,

245 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

246 ]

247 ]]);

248 $this->mockLdap->shouldReceive('bind')->times(5)->andReturn(true);

249 $this->mockEscapes(4);

250 $this->mockExplodes(2);

251

252 $this->visit('/login')

253 ->see('Username')

254 ->type($this->mockUser->name, '#username')

255 ->type($this->mockUser->password, '#password')

256 ->press('Log In')

257 ->seePageIs('/');

258

259 $user = User::where('email', $this->mockUser->email)->first();

260 $this->seeInDatabase('role_user', [

261 'user_id' => $user->id,

262 'role_id' => $roleToReceive->id

263 ]);

264 $this->dontSeeInDatabase('role_user', [

265 'user_id' => $user->id,

266 'role_id' => $existingRole->id

267 ]);

268 }

269

270 public function test_external_auth_id_visible_in_roles_page_when_ldap_active()

271 {

272 $role = factory(Role::class)->create(['name' => 'ldaptester', 'external_auth_id' => 'ex-auth-a, test-second-param']);

273 $this->asAdmin()->visit('/settings/roles/' . $role->id)

274 ->see('ex-auth-a');

275 }

276

277 public function test_login_maps_roles_using_external_auth_ids_if_set()

278 {

279 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'external_auth_id' => 'test-second-param, ex-auth-a']);

280 $roleToNotReceive = factory(Role::class)->create(['name' => 'ldaptester-not-receive', 'display_name' => 'ex-auth-a', 'external_auth_id' => 'test-second-param']);

281

282 app('config')->set([

283 'services.ldap.user_to_groups' => true,

284 'services.ldap.group_attribute' => 'memberOf',

285 'services.ldap.remove_from_groups' => true,

286 ]);

287 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

288 $this->mockLdap->shouldReceive('setVersion')->times(2);

289 $this->mockLdap->shouldReceive('setOption')->times(4);

290 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

291 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

292 ->andReturn(['count' => 1, 0 => [

293 'uid' => [$this->mockUser->name],

294 'cn' => [$this->mockUser->name],

295 'dn' => ['dc=test' . config('services.ldap.base_dn')],

296 'mail' => [$this->mockUser->email],

297 'memberof' => [

298 'count' => 1,

299 0 => "cn=ex-auth-a,ou=groups,dc=example,dc=com",

300 ]

301 ]]);

302 $this->mockLdap->shouldReceive('bind')->times(5)->andReturn(true);

303 $this->mockEscapes(4);

304 $this->mockExplodes(2);

305

306 $this->visit('/login')

307 ->see('Username')

308 ->type($this->mockUser->name, '#username')

309 ->type($this->mockUser->password, '#password')

310 ->press('Log In')

311 ->seePageIs('/');

312

313 $user = User::where('email', $this->mockUser->email)->first();

314 $this->seeInDatabase('role_user', [

315 'user_id' => $user->id,

316 'role_id' => $roleToReceive->id

317 ]);

318 $this->dontSeeInDatabase('role_user', [

319 'user_id' => $user->id,

320 'role_id' => $roleToNotReceive->id

321 ]);

322 }

323

324 public function test_login_group_mapping_does_not_conflict_with_default_role()

325 {

326 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

327 $roleToReceive2 = factory(Role::class)->create(['name' => 'ldaptester-second', 'display_name' => 'LdapTester Second']);

328 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

329

330 setting()->put('registration-role', $roleToReceive->id);

331

332 app('config')->set([

333 'services.ldap.user_to_groups' => true,

334 'services.ldap.group_attribute' => 'memberOf',

335 'services.ldap.remove_from_groups' => true,

336 ]);

337 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

338 $this->mockLdap->shouldReceive('setVersion')->times(2);

339 $this->mockLdap->shouldReceive('setOption')->times(5);

340 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(5)

341 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

342 ->andReturn(['count' => 1, 0 => [

343 'uid' => [$this->mockUser->name],

344 'cn' => [$this->mockUser->name],

345 'dn' => ['dc=test' . config('services.ldap.base_dn')],

346 'mail' => [$this->mockUser->email],

347 'memberof' => [

348 'count' => 2,

349 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

350 1 => "cn=ldaptester-second,ou=groups,dc=example,dc=com",

351 ]

352 ]]);

353 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

354 $this->mockEscapes(5);

355 $this->mockExplodes(6);

356

357 $this->visit('/login')

358 ->see('Username')

359 ->type($this->mockUser->name, '#username')

360 ->type($this->mockUser->password, '#password')

361 ->press('Log In')

362 ->seePageIs('/');

363

364 $user = User::where('email', $this->mockUser->email)->first();

365 $this->seeInDatabase('role_user', [

366 'user_id' => $user->id,

367 'role_id' => $roleToReceive->id

368 ]);

369 $this->seeInDatabase('role_user', [

370 'user_id' => $user->id,

371 'role_id' => $roleToReceive2->id

372 ]);

373 }

374

375 }