git.squeep.com Git - akkoma/blob - test/web/oauth/ldap_authorization_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.OAuth.LDAPAuthorizationTest do
   6   use Pleroma.Web.ConnCase
   7   alias Pleroma.Repo
   8   alias Pleroma.Web.OAuth.Token
   9   import Pleroma.Factory
  10   import ExUnit.CaptureLog
  11   import Mock
  12
  13   @skip if !Code.ensure_loaded?(:eldap), do: :skip
  14
  15   setup_all do: clear_config([:ldap, :enabled], true)
  16
  17   setup_all do: clear_config(Pleroma.Web.Auth.Authenticator, Pleroma.Web.Auth.LDAPAuthenticator)
  18
  19   @tag @skip
  20   test "authorizes the existing user using LDAP credentials" do
  21     password = "testpassword"
  22     user = insert(:user, password_hash: Pbkdf2.hash_pwd_salt(password))
  23     app = insert(:oauth_app, scopes: ["read", "write"])
  24
  25     host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
  26     port = Pleroma.Config.get([:ldap, :port])
  27
  28     with_mocks [
  29       {:eldap, [],
  30        [
  31          open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:ok, self()} end,
  32          simple_bind: fn _connection, _dn, ^password -> :ok end,
  33          close: fn _connection ->
  34            send(self(), :close_connection)
  35            :ok
  36          end
  37        ]}
  38     ] do
  39       conn =
  40         build_conn()
  41         |> post("/oauth/token", %{
  42           "grant_type" => "password",
  43           "username" => user.nickname,
  44           "password" => password,
  45           "client_id" => app.client_id,
  46           "client_secret" => app.client_secret
  47         })
  48
  49       assert %{"access_token" => token} = json_response(conn, 200)
  50
  51       token = Repo.get_by(Token, token: token)
  52
  53       assert token.user_id == user.id
  54       assert_received :close_connection
  55     end
  56   end
  57
  58   @tag @skip
  59   test "creates a new user after successful LDAP authorization" do
  60     password = "testpassword"
  61     user = build(:user)
  62     app = insert(:oauth_app, scopes: ["read", "write"])
  63
  64     host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
  65     port = Pleroma.Config.get([:ldap, :port])
  66
  67     with_mocks [
  68       {:eldap, [],
  69        [
  70          open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:ok, self()} end,
  71          simple_bind: fn _connection, _dn, ^password -> :ok end,
  72          equalityMatch: fn _type, _value -> :ok end,
  73          wholeSubtree: fn -> :ok end,
  74          search: fn _connection, _options ->
  75            {:ok, {:eldap_search_result, [{:eldap_entry, '', []}], []}}
  76          end,
  77          close: fn _connection ->
  78            send(self(), :close_connection)
  79            :ok
  80          end
  81        ]}
  82     ] do
  83       conn =
  84         build_conn()
  85         |> post("/oauth/token", %{
  86           "grant_type" => "password",
  87           "username" => user.nickname,
  88           "password" => password,
  89           "client_id" => app.client_id,
  90           "client_secret" => app.client_secret
  91         })
  92
  93       assert %{"access_token" => token} = json_response(conn, 200)
  94
  95       token = Repo.get_by(Token, token: token) |> Repo.preload(:user)
  96
  97       assert token.user.nickname == user.nickname
  98       assert_received :close_connection
  99     end
 100   end
 101
 102   @tag @skip
 103   test "falls back to the default authorization when LDAP is unavailable" do
 104     password = "testpassword"
 105     user = insert(:user, password_hash: Pbkdf2.hash_pwd_salt(password))
 106     app = insert(:oauth_app, scopes: ["read", "write"])
 107
 108     host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
 109     port = Pleroma.Config.get([:ldap, :port])
 110
 111     with_mocks [
 112       {:eldap, [],
 113        [
 114          open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:error, 'connect failed'} end,
 115          simple_bind: fn _connection, _dn, ^password -> :ok end,
 116          close: fn _connection ->
 117            send(self(), :close_connection)
 118            :ok
 119          end
 120        ]}
 121     ] do
 122       log =
 123         capture_log(fn ->
 124           conn =
 125             build_conn()
 126             |> post("/oauth/token", %{
 127               "grant_type" => "password",
 128               "username" => user.nickname,
 129               "password" => password,
 130               "client_id" => app.client_id,
 131               "client_secret" => app.client_secret
 132             })
 133
 134           assert %{"access_token" => token} = json_response(conn, 200)
 135
 136           token = Repo.get_by(Token, token: token)
 137
 138           assert token.user_id == user.id
 139         end)
 140
 141       assert log =~ "Could not open LDAP connection: 'connect failed'"
 142       refute_received :close_connection
 143     end
 144   end
 145
 146   @tag @skip
 147   test "disallow authorization for wrong LDAP credentials" do
 148     password = "testpassword"
 149     user = insert(:user, password_hash: Pbkdf2.hash_pwd_salt(password))
 150     app = insert(:oauth_app, scopes: ["read", "write"])
 151
 152     host = Pleroma.Config.get([:ldap, :host]) |> to_charlist
 153     port = Pleroma.Config.get([:ldap, :port])
 154
 155     with_mocks [
 156       {:eldap, [],
 157        [
 158          open: fn [^host], [{:port, ^port}, {:ssl, false} | _] -> {:ok, self()} end,
 159          simple_bind: fn _connection, _dn, ^password -> {:error, :invalidCredentials} end,
 160          close: fn _connection ->
 161            send(self(), :close_connection)
 162            :ok
 163          end
 164        ]}
 165     ] do
 166       conn =
 167         build_conn()
 168         |> post("/oauth/token", %{
 169           "grant_type" => "password",
 170           "username" => user.nickname,
 171           "password" => password,
 172           "client_id" => app.client_id,
 173           "client_secret" => app.client_secret
 174         })
 175
 176       assert %{"error" => "Invalid credentials"} = json_response(conn, 400)
 177       assert_received :close_connection
 178     end
 179   end
 180 end