BookStack Code Mirror - bookstack/blob - tests/Auth/LdapTest.php

1 <?php namespace Tests;

2 use BookStack\Auth\Role;

3 use BookStack\Auth\Access\Ldap;

4 use BookStack\Auth\User;

5 use Mockery\MockInterface;

6

7 class LdapTest extends BrowserKitTest

8 {

9

10 /**

11 * @var MockInterface

12 */

13 protected $mockLdap;

14

15 protected $mockUser;

16 protected $resourceId = 'resource-test';

17

18 public function setUp()

19 {

20 parent::setUp();

21 if (!defined('LDAP_OPT_REFERRALS')) define('LDAP_OPT_REFERRALS', 1);

22 app('config')->set([

23 'auth.method' => 'ldap',

24 'services.ldap.base_dn' => 'dc=ldap,dc=local',

25 'services.ldap.email_attribute' => 'mail',

26 'services.ldap.display_name_attribute' => 'cn',

27 'services.ldap.user_to_groups' => false,

28 'auth.providers.users.driver' => 'ldap',

29 ]);

30 $this->mockLdap = \Mockery::mock(Ldap::class);

31 $this->app[Ldap::class] = $this->mockLdap;

32 $this->mockUser = factory(User::class)->make();

33 }

34

35 protected function mockEscapes($times = 1)

36 {

37 $this->mockLdap->shouldReceive('escape')->times($times)->andReturnUsing(function($val) {

38 return ldap_escape($val);

39 });

40 }

41

42 protected function mockExplodes($times = 1)

43 {

44 $this->mockLdap->shouldReceive('explodeDn')->times($times)->andReturnUsing(function($dn, $withAttrib) {

45 return ldap_explode_dn($dn, $withAttrib);

46 });

47 }

48

49 public function test_login()

50 {

51 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

52 $this->mockLdap->shouldReceive('setVersion')->once();

53 $this->mockLdap->shouldReceive('setOption')->times(4);

54 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

55 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

56 ->andReturn(['count' => 1, 0 => [

57 'uid' => [$this->mockUser->name],

58 'cn' => [$this->mockUser->name],

59 'dn' => ['dc=test' . config('services.ldap.base_dn')]

60 ]]);

61 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

62 $this->mockEscapes(4);

63

64 $this->visit('/login')

65 ->see('Username')

66 ->type($this->mockUser->name, '#username')

67 ->type($this->mockUser->password, '#password')

68 ->press('Log In')

69 ->seePageIs('/login')->see('Please enter an email to use for this account.');

70

71 $this->type($this->mockUser->email, '#email')

72 ->press('Log In')

73 ->seePageIs('/')

74 ->see($this->mockUser->name)

75 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $this->mockUser->name]);

76 }

77

78 public function test_login_works_when_no_uid_provided_by_ldap_server()

79 {

80 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

81 $this->mockLdap->shouldReceive('setVersion')->once();

82 $ldapDn = 'cn=test-user,dc=test' . config('services.ldap.base_dn');

83 $this->mockLdap->shouldReceive('setOption')->times(2);

84 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)

85 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

86 ->andReturn(['count' => 1, 0 => [

87 'cn' => [$this->mockUser->name],

88 'dn' => $ldapDn,

89 'mail' => [$this->mockUser->email]

90 ]]);

91 $this->mockLdap->shouldReceive('bind')->times(3)->andReturn(true);

92 $this->mockEscapes(2);

93

94 $this->visit('/login')

95 ->see('Username')

96 ->type($this->mockUser->name, '#username')

97 ->type($this->mockUser->password, '#password')

98 ->press('Log In')

99 ->seePageIs('/')

100 ->see($this->mockUser->name)

101 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $ldapDn]);

102 }

103

104 public function test_initial_incorrect_details()

105 {

106 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

107 $this->mockLdap->shouldReceive('setVersion')->once();

108 $this->mockLdap->shouldReceive('setOption')->times(2);

109 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)

110 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

111 ->andReturn(['count' => 1, 0 => [

112 'uid' => [$this->mockUser->name],

113 'cn' => [$this->mockUser->name],

114 'dn' => ['dc=test' . config('services.ldap.base_dn')]

115 ]]);

116 $this->mockLdap->shouldReceive('bind')->times(3)->andReturn(true, true, false);

117 $this->mockEscapes(2);

118

119 $this->visit('/login')

120 ->see('Username')

121 ->type($this->mockUser->name, '#username')

122 ->type($this->mockUser->password, '#password')

123 ->press('Log In')

124 ->seePageIs('/login')->see('These credentials do not match our records.')

125 ->dontSeeInDatabase('users', ['external_auth_id' => $this->mockUser->name]);

126 }

127

128 public function test_create_user_form()

129 {

130 $this->asAdmin()->visit('/settings/users/create')

131 ->dontSee('Password')

132 ->type($this->mockUser->name, '#name')

133 ->type($this->mockUser->email, '#email')

134 ->press('Save')

135 ->see('The external auth id field is required.')

136 ->type($this->mockUser->name, '#external_auth_id')

137 ->press('Save')

138 ->seePageIs('/settings/users')

139 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'external_auth_id' => $this->mockUser->name, 'email_confirmed' => true]);

140 }

141

142 public function test_user_edit_form()

143 {

144 $editUser = $this->getNormalUser();

145 $this->asAdmin()->visit('/settings/users/' . $editUser->id)

146 ->see('Edit User')

147 ->dontSee('Password')

148 ->type('test_auth_id', '#external_auth_id')

149 ->press('Save')

150 ->seePageIs('/settings/users')

151 ->seeInDatabase('users', ['email' => $editUser->email, 'external_auth_id' => 'test_auth_id']);

152 }

153

154 public function test_registration_disabled()

155 {

156 $this->visit('/register')

157 ->seePageIs('/login');

158 }

159

160 public function test_non_admins_cannot_change_auth_id()

161 {

162 $testUser = $this->getNormalUser();

163 $this->actingAs($testUser)->visit('/settings/users/' . $testUser->id)

164 ->dontSee('External Authentication');

165 }

166

167 public function test_login_maps_roles_and_retains_existing_roles()

168 {

169 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

170 $roleToReceive2 = factory(Role::class)->create(['name' => 'ldaptester-second', 'display_name' => 'LdapTester Second']);

171 $existingRole = factory(Role::class)->create(['name' => 'ldaptester-existing']);

172 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

173 $this->mockUser->attachRole($existingRole);

174

175 app('config')->set([

176 'services.ldap.user_to_groups' => true,

177 'services.ldap.group_attribute' => 'memberOf',

178 'services.ldap.remove_from_groups' => false,

179 ]);

180 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

181 $this->mockLdap->shouldReceive('setVersion')->times(2);

182 $this->mockLdap->shouldReceive('setOption')->times(5);

183 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(5)

184 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

185 ->andReturn(['count' => 1, 0 => [

186 'uid' => [$this->mockUser->name],

187 'cn' => [$this->mockUser->name],

188 'dn' => ['dc=test' . config('services.ldap.base_dn')],

189 'mail' => [$this->mockUser->email],

190 'memberof' => [

191 'count' => 2,

192 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

193 1 => "cn=ldaptester-second,ou=groups,dc=example,dc=com",

194 ]

195 ]]);

196 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

197 $this->mockEscapes(5);

198 $this->mockExplodes(6);

199

200 $this->visit('/login')

201 ->see('Username')

202 ->type($this->mockUser->name, '#username')

203 ->type($this->mockUser->password, '#password')

204 ->press('Log In')

205 ->seePageIs('/');

206

207 $user = User::where('email', $this->mockUser->email)->first();

208 $this->seeInDatabase('role_user', [

209 'user_id' => $user->id,

210 'role_id' => $roleToReceive->id

211 ]);

212 $this->seeInDatabase('role_user', [

213 'user_id' => $user->id,

214 'role_id' => $roleToReceive2->id

215 ]);

216 $this->seeInDatabase('role_user', [

217 'user_id' => $user->id,

218 'role_id' => $existingRole->id

219 ]);

220 }

221

222 public function test_login_maps_roles_and_removes_old_roles_if_set()

223 {

224 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

225 $existingRole = factory(Role::class)->create(['name' => 'ldaptester-existing']);

226 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

227 $this->mockUser->attachRole($existingRole);

228

229 app('config')->set([

230 'services.ldap.user_to_groups' => true,

231 'services.ldap.group_attribute' => 'memberOf',

232 'services.ldap.remove_from_groups' => true,

233 ]);

234 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

235 $this->mockLdap->shouldReceive('setVersion')->times(2);

236 $this->mockLdap->shouldReceive('setOption')->times(4);

237 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

238 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

239 ->andReturn(['count' => 1, 0 => [

240 'uid' => [$this->mockUser->name],

241 'cn' => [$this->mockUser->name],

242 'dn' => ['dc=test' . config('services.ldap.base_dn')],

243 'mail' => [$this->mockUser->email],

244 'memberof' => [

245 'count' => 1,

246 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

247 ]

248 ]]);

249 $this->mockLdap->shouldReceive('bind')->times(5)->andReturn(true);

250 $this->mockEscapes(4);

251 $this->mockExplodes(2);

252

253 $this->visit('/login')

254 ->see('Username')

255 ->type($this->mockUser->name, '#username')

256 ->type($this->mockUser->password, '#password')

257 ->press('Log In')

258 ->seePageIs('/');

259

260 $user = User::where('email', $this->mockUser->email)->first();

261 $this->seeInDatabase('role_user', [

262 'user_id' => $user->id,

263 'role_id' => $roleToReceive->id

264 ]);

265 $this->dontSeeInDatabase('role_user', [

266 'user_id' => $user->id,

267 'role_id' => $existingRole->id

268 ]);

269 }

270

271 public function test_external_auth_id_visible_in_roles_page_when_ldap_active()

272 {

273 $role = factory(Role::class)->create(['name' => 'ldaptester', 'external_auth_id' => 'ex-auth-a, test-second-param']);

274 $this->asAdmin()->visit('/settings/roles/' . $role->id)

275 ->see('ex-auth-a');

276 }

277

278 public function test_login_maps_roles_using_external_auth_ids_if_set()

279 {

280 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'external_auth_id' => 'test-second-param, ex-auth-a']);

281 $roleToNotReceive = factory(Role::class)->create(['name' => 'ldaptester-not-receive', 'display_name' => 'ex-auth-a', 'external_auth_id' => 'test-second-param']);

282

283 app('config')->set([

284 'services.ldap.user_to_groups' => true,

285 'services.ldap.group_attribute' => 'memberOf',

286 'services.ldap.remove_from_groups' => true,

287 ]);

288 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

289 $this->mockLdap->shouldReceive('setVersion')->times(2);

290 $this->mockLdap->shouldReceive('setOption')->times(4);

291 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

292 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

293 ->andReturn(['count' => 1, 0 => [

294 'uid' => [$this->mockUser->name],

295 'cn' => [$this->mockUser->name],

296 'dn' => ['dc=test' . config('services.ldap.base_dn')],

297 'mail' => [$this->mockUser->email],

298 'memberof' => [

299 'count' => 1,

300 0 => "cn=ex-auth-a,ou=groups,dc=example,dc=com",

301 ]

302 ]]);

303 $this->mockLdap->shouldReceive('bind')->times(5)->andReturn(true);

304 $this->mockEscapes(4);

305 $this->mockExplodes(2);

306

307 $this->visit('/login')

308 ->see('Username')

309 ->type($this->mockUser->name, '#username')

310 ->type($this->mockUser->password, '#password')

311 ->press('Log In')

312 ->seePageIs('/');

313

314 $user = User::where('email', $this->mockUser->email)->first();

315 $this->seeInDatabase('role_user', [

316 'user_id' => $user->id,

317 'role_id' => $roleToReceive->id

318 ]);

319 $this->dontSeeInDatabase('role_user', [

320 'user_id' => $user->id,

321 'role_id' => $roleToNotReceive->id

322 ]);

323 }

324

325 public function test_login_group_mapping_does_not_conflict_with_default_role()

326 {

327 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

328 $roleToReceive2 = factory(Role::class)->create(['name' => 'ldaptester-second', 'display_name' => 'LdapTester Second']);

329 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

330

331 setting()->put('registration-role', $roleToReceive->id);

332

333 app('config')->set([

334 'services.ldap.user_to_groups' => true,

335 'services.ldap.group_attribute' => 'memberOf',

336 'services.ldap.remove_from_groups' => true,

337 ]);

338 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

339 $this->mockLdap->shouldReceive('setVersion')->times(2);

340 $this->mockLdap->shouldReceive('setOption')->times(5);

341 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(5)

342 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

343 ->andReturn(['count' => 1, 0 => [

344 'uid' => [$this->mockUser->name],

345 'cn' => [$this->mockUser->name],

346 'dn' => ['dc=test' . config('services.ldap.base_dn')],

347 'mail' => [$this->mockUser->email],

348 'memberof' => [

349 'count' => 2,

350 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

351 1 => "cn=ldaptester-second,ou=groups,dc=example,dc=com",

352 ]

353 ]]);

354 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

355 $this->mockEscapes(5);

356 $this->mockExplodes(6);

357

358 $this->visit('/login')

359 ->see('Username')

360 ->type($this->mockUser->name, '#username')

361 ->type($this->mockUser->password, '#password')

362 ->press('Log In')

363 ->seePageIs('/');

364

365 $user = User::where('email', $this->mockUser->email)->first();

366 $this->seeInDatabase('role_user', [

367 'user_id' => $user->id,

368 'role_id' => $roleToReceive->id

369 ]);

370 $this->seeInDatabase('role_user', [

371 'user_id' => $user->id,

372 'role_id' => $roleToReceive2->id

373 ]);

374 }

375

376 public function test_login_uses_specified_display_name_attribute()

377 {

378 $originalAttribute = config('services.ldap.display_name_attribute');

379 app('config')->set([

380 'services.ldap.display_name_attribute' => 'displayName'

381 ]);

382

383 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

384 $this->mockLdap->shouldReceive('setVersion')->once();

385 $this->mockLdap->shouldReceive('setOption')->times(4);

386 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

387 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

388 ->andReturn(['count' => 1, 0 => [

389 'uid' => [$this->mockUser->name],

390 'cn' => [$this->mockUser->name],

391 'dn' => ['dc=test' . config('services.ldap.base_dn')],

392 'displayName' => 'displayNameAttribute'

393 ]]);

394 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

395 $this->mockEscapes(4);

396

397 $this->visit('/login')

398 ->see('Username')

399 ->type($this->mockUser->name, '#username')

400 ->type($this->mockUser->password, '#password')

401 ->press('Log In')

402 ->seePageIs('/login')->see('Please enter an email to use for this account.');

403

404 $this->type($this->mockUser->email, '#email')

405 ->press('Log In')

406 ->seePageIs('/')

407 ->see('displayNameAttribute')

408 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $this->mockUser->name, 'name' => 'displayNameAttribute']);

409

410 app('config')->set([

411 'services.ldap.display_name_attribute' => $originalAttribute

412 ]);

413 }

414

415 public function test_login_uses_default_display_name_attribute_if_specified_not_present()

416 {

417 $originalAttribute = config('services.ldap.display_name_attribute');

418 app('config')->set([

419 'services.ldap.display_name_attribute' => 'displayName'

420 ]);

421

422 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

423 $this->mockLdap->shouldReceive('setVersion')->once();

424 $this->mockLdap->shouldReceive('setOption')->times(4);

425 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

426 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

427 ->andReturn(['count' => 1, 0 => [

428 'uid' => [$this->mockUser->name],

429 'cn' => [$this->mockUser->name],

430 'dn' => ['dc=test' . config('services.ldap.base_dn')]

431 ]]);

432 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

433 $this->mockEscapes(4);

434

435 $this->visit('/login')

436 ->see('Username')

437 ->type($this->mockUser->name, '#username')

438 ->type($this->mockUser->password, '#password')

439 ->press('Log In')

440 ->seePageIs('/login')->see('Please enter an email to use for this account.');

441

442 $this->type($this->mockUser->email, '#email')

443 ->press('Log In')

444 ->seePageIs('/')

445 ->see($this->mockUser->name)

446 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $this->mockUser->name, 'name' => $this->mockUser->name]);

447

448 app('config')->set([

449 'services.ldap.display_name_attribute' => $originalAttribute

450 ]);

451 }

452

453 }