1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.OAuth.LDAPAuthorizationTest do
6 use Pleroma.Web.ConnCase
8 alias Pleroma.Web.OAuth.Token
10 import ExUnit.CaptureLog
14 ldap_authenticator = Pleroma.Config.get([Pleroma.Web.Auth.Authenticator])
15 ldap_enabled = Pleroma.Config.get([:ldap, :enabled])
18 Pleroma.Config.put([Pleroma.Web.Auth.Authenticator], ldap_authenticator)
19 Pleroma.Config.put([:ldap, :enabled], ldap_enabled)
22 Pleroma.Config.put([Pleroma.Web.Auth.Authenticator], Pleroma.Web.Auth.LDAPAuthenticator)
23 Pleroma.Config.put([:ldap, :enabled], true)
28 test "authorizes the existing user using LDAP credentials" do
29 password = "testpassword"
30 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
31 app = insert(:oauth_app, scopes: ["read", "write"])
33 host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
34 port = Pleroma.Config.get([:ldap, :port])
39 open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:ok, self()} end,
40 simple_bind: fn _connection, _dn, ^password -> :ok end,
41 close: fn _connection ->
42 send(self(), :close_connection)
49 |> post("/oauth/token", %{
50 "grant_type" => "password",
51 "username" => user.nickname,
52 "password" => password,
53 "client_id" => app.client_id,
54 "client_secret" => app.client_secret
57 assert %{"access_token" => token} = json_response(conn, 200)
59 token = Repo.get_by(Token, token: token)
61 assert token.user_id == user.id
62 assert_received :close_connection
66 test "creates a new user after successful LDAP authorization" do
67 password = "testpassword"
69 app = insert(:oauth_app, scopes: ["read", "write"])
71 host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
72 port = Pleroma.Config.get([:ldap, :port])
77 open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:ok, self()} end,
78 simple_bind: fn _connection, _dn, ^password -> :ok end,
79 equalityMatch: fn _type, _value -> :ok end,
80 wholeSubtree: fn -> :ok end,
81 search: fn _connection, _options ->
83 {:eldap_search_result, [{:eldap_entry, '', [{'mail', [to_charlist(user.email)]}]}],
86 close: fn _connection ->
87 send(self(), :close_connection)
94 |> post("/oauth/token", %{
95 "grant_type" => "password",
96 "username" => user.nickname,
97 "password" => password,
98 "client_id" => app.client_id,
99 "client_secret" => app.client_secret
102 assert %{"access_token" => token} = json_response(conn, 200)
104 token = Repo.get_by(Token, token: token) |> Repo.preload(:user)
106 assert token.user.nickname == user.nickname
107 assert_received :close_connection
111 test "falls back to the default authorization when LDAP is unavailable" do
112 password = "testpassword"
113 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
114 app = insert(:oauth_app, scopes: ["read", "write"])
116 host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
117 port = Pleroma.Config.get([:ldap, :port])
122 open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:error, 'connect failed'} end,
123 simple_bind: fn _connection, _dn, ^password -> :ok end,
124 close: fn _connection ->
125 send(self(), :close_connection)
134 |> post("/oauth/token", %{
135 "grant_type" => "password",
136 "username" => user.nickname,
137 "password" => password,
138 "client_id" => app.client_id,
139 "client_secret" => app.client_secret
142 assert %{"access_token" => token} = json_response(conn, 200)
144 token = Repo.get_by(Token, token: token)
146 assert token.user_id == user.id
149 assert log =~ "Could not open LDAP connection: 'connect failed'"
150 refute_received :close_connection
154 test "disallow authorization for wrong LDAP credentials" do
155 password = "testpassword"
156 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
157 app = insert(:oauth_app, scopes: ["read", "write"])
159 host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
160 port = Pleroma.Config.get([:ldap, :port])
165 open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:ok, self()} end,
166 simple_bind: fn _connection, _dn, ^password -> {:error, :invalidCredentials} end,
167 close: fn _connection ->
168 send(self(), :close_connection)
175 |> post("/oauth/token", %{
176 "grant_type" => "password",
177 "username" => user.nickname,
178 "password" => password,
179 "client_id" => app.client_id,
180 "client_secret" => app.client_secret
183 assert %{"error" => "Invalid credentials"} = json_response(conn, 400)
184 assert_received :close_connection