nextcloud/apps/user_ldap/tests/AccessTest.php

430 lines
12 KiB
PHP
Raw Normal View History

2014-02-20 17:05:45 +04:00
<?php
/**
2016-07-21 17:49:16 +03:00
* @copyright Copyright (c) 2016, ownCloud, Inc.
* @copyright Copyright (c) 2016, Lukas Reschke <lukas@statuscode.ch>
2016-07-21 17:49:16 +03:00
*
2015-03-26 13:44:34 +03:00
* @author Andreas Fischer <bantu@owncloud.com>
2016-05-26 20:56:05 +03:00
* @author Arthur Schiwon <blizzz@arthur-schiwon.de>
2016-07-21 17:49:16 +03:00
* @author Joas Schilling <coding@schilljs.com>
2015-03-26 13:44:34 +03:00
* @author Morris Jobke <hey@morrisjobke.de>
2016-01-12 17:02:16 +03:00
* @author Thomas Müller <thomas.mueller@tmit.eu>
* @author Lukas Reschke <lukas@statuscode.ch>
2015-03-26 13:44:34 +03:00
*
* @license AGPL-3.0
*
* This code is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License, version 3,
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License, version 3,
* along with this program. If not, see <http://www.gnu.org/licenses/>
*
*/
2016-05-12 18:14:59 +03:00
namespace OCA\User_LDAP\Tests;
2014-02-20 17:05:45 +04:00
2016-05-12 17:42:57 +03:00
use OCA\User_LDAP\Access;
use OCA\User_LDAP\Connection;
use OCA\User_LDAP\Exceptions\ConstraintViolationException;
2016-09-02 12:02:12 +03:00
use OCA\User_LDAP\FilesystemHelper;
use OCA\User_LDAP\Helper;
2016-09-02 12:02:12 +03:00
use OCA\User_LDAP\ILDAPWrapper;
use OCA\User_LDAP\LDAP;
2016-09-02 12:02:12 +03:00
use OCA\User_LDAP\LogWrapper;
use OCA\User_LDAP\User\Manager;
2016-09-02 12:02:12 +03:00
use OCP\IAvatarManager;
use OCP\IConfig;
use OCP\IDBConnection;
use OCP\Image;
use OCP\IUserManager;
2014-02-20 17:05:45 +04:00
/**
2016-05-12 18:14:59 +03:00
* Class AccessTest
*
* @group DB
*
2016-05-12 18:14:59 +03:00
* @package OCA\User_LDAP\Tests
*/
2016-05-12 18:14:59 +03:00
class AccessTest extends \Test\TestCase {
/** @var Connection|\PHPUnit_Framework_MockObject_MockObject */
private $connection;
/** @var LDAP|\PHPUnit_Framework_MockObject_MockObject */
private $ldap;
/** @var Manager|\PHPUnit_Framework_MockObject_MockObject */
private $userManager;
/** @var Helper|\PHPUnit_Framework_MockObject_MockObject */
private $helper;
/** @var Access */
private $access;
public function setUp() {
$this->connection = $this->createMock(Connection::class);
$this->ldap = $this->createMock(LDAP::class);
$this->userManager = $this->createMock(Manager::class);
$this->helper = $this->createMock(Helper::class);
$this->access = new Access(
$this->connection,
$this->ldap,
$this->userManager,
$this->helper
);
}
private function getConnectorAndLdapMock() {
2016-09-02 12:02:12 +03:00
$lw = $this->createMock(ILDAPWrapper::class);
$connector = $this->getMockBuilder(Connection::class)
->setConstructorArgs([$lw, null, null])
->getMock();
$um = $this->getMockBuilder(Manager::class)
->setConstructorArgs([
2016-09-02 12:02:12 +03:00
$this->createMock(IConfig::class),
$this->createMock(FilesystemHelper::class),
$this->createMock(LogWrapper::class),
$this->createMock(IAvatarManager::class),
$this->createMock(Image::class),
$this->createMock(IDBConnection::class),
$this->createMock(IUserManager::class)])
->getMock();
$helper = new Helper(\OC::$server->getConfig());
2014-02-20 17:05:45 +04:00
2016-07-22 11:46:29 +03:00
return array($lw, $connector, $um, $helper);
2014-02-20 17:05:45 +04:00
}
public function testEscapeFilterPartValidChars() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
2014-02-20 17:05:45 +04:00
$input = 'okay';
$this->assertTrue($input === $access->escapeFilterPart($input));
}
public function testEscapeFilterPartEscapeWildcard() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
2014-02-20 17:05:45 +04:00
$input = '*';
$expected = '\\\\*';
$this->assertTrue($expected === $access->escapeFilterPart($input));
}
public function testEscapeFilterPartEscapeWildcard2() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
2014-02-20 17:05:45 +04:00
$input = 'foo*bar';
$expected = 'foo\\\\*bar';
$this->assertTrue($expected === $access->escapeFilterPart($input));
}
/** @dataProvider convertSID2StrSuccessData */
public function testConvertSID2StrSuccess(array $sidArray, $sidExpected) {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
$sidBinary = implode('', $sidArray);
$this->assertSame($sidExpected, $access->convertSID2Str($sidBinary));
}
public function convertSID2StrSuccessData() {
return array(
array(
array(
"\x01",
"\x04",
"\x00\x00\x00\x00\x00\x05",
"\x15\x00\x00\x00",
"\xa6\x81\xe5\x0e",
"\x4d\x6c\x6c\x2b",
"\xca\x32\x05\x5f",
),
'S-1-5-21-249921958-728525901-1594176202',
),
array(
array(
"\x01",
"\x02",
"\xFF\xFF\xFF\xFF\xFF\xFF",
"\xFF\xFF\xFF\xFF",
"\xFF\xFF\xFF\xFF",
),
'S-1-281474976710655-4294967295-4294967295',
),
);
}
public function testConvertSID2StrInputError() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
$sidIllegal = 'foobar';
$sidExpected = '';
$this->assertSame($sidExpected, $access->convertSID2Str($sidIllegal));
}
public function testGetDomainDNFromDNSuccess() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
$inputDN = 'uid=zaphod,cn=foobar,dc=my,dc=server,dc=com';
$domainDN = 'dc=my,dc=server,dc=com';
$lw->expects($this->once())
->method('explodeDN')
->with($inputDN, 0)
->will($this->returnValue(explode(',', $inputDN)));
$this->assertSame($domainDN, $access->getDomainDNFromDN($inputDN));
}
public function testGetDomainDNFromDNError() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
$inputDN = 'foobar';
$expected = '';
$lw->expects($this->once())
->method('explodeDN')
->with($inputDN, 0)
->will($this->returnValue(false));
$this->assertSame($expected, $access->getDomainDNFromDN($inputDN));
}
2014-08-18 18:55:08 +04:00
private function getResemblesDNInputData() {
return $cases = array(
array(
'input' => 'foo=bar,bar=foo,dc=foobar',
'interResult' => array(
'count' => 3,
0 => 'foo=bar',
1 => 'bar=foo',
2 => 'dc=foobar'
),
'expectedResult' => true
),
array(
'input' => 'foobarbarfoodcfoobar',
'interResult' => false,
'expectedResult' => false
)
);
}
2014-08-18 18:55:08 +04:00
public function testStringResemblesDN() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
2014-08-18 18:55:08 +04:00
$cases = $this->getResemblesDNInputData();
2014-08-18 18:55:08 +04:00
$lw->expects($this->exactly(2))
->method('explodeDN')
2014-08-18 18:55:08 +04:00
->will($this->returnCallback(function ($dn) use ($cases) {
foreach($cases as $case) {
if($dn === $case['input']) {
return $case['interResult'];
}
}
2016-08-17 10:46:54 +03:00
return null;
2014-08-18 18:55:08 +04:00
}));
foreach($cases as $case) {
$this->assertSame($case['expectedResult'], $access->stringResemblesDN($case['input']));
}
}
2014-08-18 18:55:08 +04:00
public function testStringResemblesDNLDAPmod() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
2016-05-12 17:21:28 +03:00
$lw = new \OCA\User_LDAP\LDAP();
2016-07-22 11:46:29 +03:00
$access = new Access($con, $lw, $um, $helper);
if(!function_exists('ldap_explode_dn')) {
$this->markTestSkipped('LDAP Module not available');
}
2014-08-18 18:55:08 +04:00
$cases = $this->getResemblesDNInputData();
2014-08-18 18:55:08 +04:00
foreach($cases as $case) {
$this->assertSame($case['expectedResult'], $access->stringResemblesDN($case['input']));
}
}
public function testCacheUserHome() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
$con->expects($this->once())
->method('writeToCache');
$access->cacheUserHome('foobar', '/foobars/path');
}
public function testBatchApplyUserAttributes() {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$access = new Access($con, $lw, $um, $helper);
$mapperMock = $this->getMockBuilder('\OCA\User_LDAP\Mapping\UserMapping')
->disableOriginalConstructor()
->getMock();
$mapperMock->expects($this->any())
->method('getNameByDN')
->will($this->returnValue('a_username'));
2016-05-12 12:25:50 +03:00
$userMock = $this->getMockBuilder('\OCA\User_LDAP\User\User')
->disableOriginalConstructor()
->getMock();
$access->connection->expects($this->any())
->method('__get')
->will($this->returnValue('displayName'));
$access->setUserMapper($mapperMock);
$displayNameAttribute = strtolower($access->connection->ldapUserDisplayName);
$data = array(
array(
'dn' => 'foobar',
$displayNameAttribute => 'barfoo'
),
array(
'dn' => 'foo',
$displayNameAttribute => 'bar'
),
array(
'dn' => 'raboof',
$displayNameAttribute => 'oofrab'
)
);
$userMock->expects($this->exactly(count($data)))
->method('processAttributes');
$um->expects($this->exactly(count($data)))
->method('get')
->will($this->returnValue($userMock));
$access->batchApplyUserAttributes($data);
}
public function dNAttributeProvider() {
// corresponds to Access::resemblesDN()
return array(
'dn' => array('dn'),
'uniqueMember' => array('uniquemember'),
'member' => array('member'),
'memberOf' => array('memberof')
);
}
/**
* @dataProvider dNAttributeProvider
*/
public function testSanitizeDN($attribute) {
2016-07-22 11:46:29 +03:00
list($lw, $con, $um, $helper) = $this->getConnectorAndLdapMock();
$dnFromServer = 'cn=Mixed Cases,ou=Are Sufficient To,ou=Test,dc=example,dc=org';
$lw->expects($this->any())
->method('isResource')
->will($this->returnValue(true));
$lw->expects($this->any())
->method('getAttributes')
->will($this->returnValue(array(
$attribute => array('count' => 1, $dnFromServer)
)));
2016-07-22 11:46:29 +03:00
$access = new Access($con, $lw, $um, $helper);
$values = $access->readAttribute('uid=whoever,dc=example,dc=org', $attribute);
$this->assertSame($values[0], strtolower($dnFromServer));
}
/**
* @expectedException \Exception
* @expectedExceptionMessage LDAP password changes are disabled
*/
public function testSetPasswordWithDisabledChanges() {
$this->connection
->method('__get')
->willReturn(false);
$this->access->setPassword('CN=foo', 'MyPassword');
}
public function testSetPasswordWithLdapNotAvailable() {
$this->connection
->method('__get')
->willReturn(true);
$connection = $this->createMock(LDAP::class);
$this->connection
->expects($this->once())
->method('getConnectionResource')
->willReturn($connection);
$this->ldap
->expects($this->once())
->method('isResource')
->with($connection)
->willReturn(false);
$this->assertFalse($this->access->setPassword('CN=foo', 'MyPassword'));
}
/**
* @expectedException \OC\HintException
* @expectedExceptionMessage Password change rejected.
*/
public function testSetPasswordWithRejectedChange() {
$this->connection
->method('__get')
->willReturn(true);
$connection = $this->createMock(LDAP::class);
$this->connection
->expects($this->once())
->method('getConnectionResource')
->willReturn($connection);
$this->ldap
->expects($this->once())
->method('isResource')
->with($connection)
->willReturn(true);
$this->ldap
->expects($this->once())
->method('modReplace')
->with($connection, 'CN=foo', 'MyPassword')
->willThrowException(new ConstraintViolationException());
$this->access->setPassword('CN=foo', 'MyPassword');
}
public function testSetPassword() {
$this->connection
->method('__get')
->willReturn(true);
$connection = $this->createMock(LDAP::class);
$this->connection
->expects($this->once())
->method('getConnectionResource')
->willReturn($connection);
$this->ldap
->expects($this->once())
->method('isResource')
->with($connection)
->willReturn(true);
$this->ldap
->expects($this->once())
->method('modReplace')
->with($connection, 'CN=foo', 'MyPassword')
->willReturn(true);
$this->assertTrue($this->access->setPassword('CN=foo', 'MyPassword'));
}
}