BookStack Code Mirror - bookstack/blob - tests/Auth/LdapTest.php

1 <?php namespace Tests;

2 use BookStack\Auth\Role;

3 use BookStack\Auth\Access\Ldap;

4 use BookStack\Auth\User;

5 use Mockery\MockInterface;

6

7 class LdapTest extends BrowserKitTest

8 {

9

10 /**

11 * @var MockInterface

12 */

13 protected $mockLdap;

14

15 protected $mockUser;

16 protected $resourceId = 'resource-test';

17

18 public function setUp()

19 {

20 parent::setUp();

21 if (!defined('LDAP_OPT_REFERRALS')) define('LDAP_OPT_REFERRALS', 1);

22 app('config')->set([

23 'auth.method' => 'ldap',

24 'services.ldap.base_dn' => 'dc=ldap,dc=local',

25 'services.ldap.email_attribute' => 'mail',

26 'services.ldap.display_name_attribute' => 'cn',

27 'services.ldap.user_to_groups' => false,

28 'auth.providers.users.driver' => 'ldap',

29 ]);

30 $this->mockLdap = \Mockery::mock(Ldap::class);

31 $this->app[Ldap::class] = $this->mockLdap;

32 $this->mockUser = factory(User::class)->make();

33 }

34

35 protected function mockEscapes($times = 1)

36 {

37 $this->mockLdap->shouldReceive('escape')->times($times)->andReturnUsing(function($val) {

38 return ldap_escape($val);

39 });

40 }

41

42 protected function mockExplodes($times = 1)

43 {

44 $this->mockLdap->shouldReceive('explodeDn')->times($times)->andReturnUsing(function($dn, $withAttrib) {

45 return ldap_explode_dn($dn, $withAttrib);

46 });

47 }

48

49 protected function mockUserLogin()

50 {

51 return $this->visit('/login')

52 ->see('Username')

53 ->type($this->mockUser->name, '#username')

54 ->type($this->mockUser->password, '#password')

55 ->press('Log In');

56 }

57

58 public function test_login()

59 {

60 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

61 $this->mockLdap->shouldReceive('setVersion')->once();

62 $this->mockLdap->shouldReceive('setOption')->times(4);

63 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

64 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

65 ->andReturn(['count' => 1, 0 => [

66 'uid' => [$this->mockUser->name],

67 'cn' => [$this->mockUser->name],

68 'dn' => ['dc=test' . config('services.ldap.base_dn')]

69 ]]);

70 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

71 $this->mockEscapes(4);

72

73 $this->mockUserLogin()

74 ->seePageIs('/login')->see('Please enter an email to use for this account.');

75

76 $this->type($this->mockUser->email, '#email')

77 ->press('Log In')

78 ->seePageIs('/')

79 ->see($this->mockUser->name)

80 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $this->mockUser->name]);

81 }

82

83 public function test_login_works_when_no_uid_provided_by_ldap_server()

84 {

85 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

86 $this->mockLdap->shouldReceive('setVersion')->once();

87 $ldapDn = 'cn=test-user,dc=test' . config('services.ldap.base_dn');

88 $this->mockLdap->shouldReceive('setOption')->times(2);

89 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)

90 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

91 ->andReturn(['count' => 1, 0 => [

92 'cn' => [$this->mockUser->name],

93 'dn' => $ldapDn,

94 'mail' => [$this->mockUser->email]

95 ]]);

96 $this->mockLdap->shouldReceive('bind')->times(3)->andReturn(true);

97 $this->mockEscapes(2);

98

99 $this->mockUserLogin()

100 ->seePageIs('/')

101 ->see($this->mockUser->name)

102 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $ldapDn]);

103 }

104

105 public function test_initial_incorrect_details()

106 {

107 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

108 $this->mockLdap->shouldReceive('setVersion')->once();

109 $this->mockLdap->shouldReceive('setOption')->times(2);

110 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)

111 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

112 ->andReturn(['count' => 1, 0 => [

113 'uid' => [$this->mockUser->name],

114 'cn' => [$this->mockUser->name],

115 'dn' => ['dc=test' . config('services.ldap.base_dn')]

116 ]]);

117 $this->mockLdap->shouldReceive('bind')->times(3)->andReturn(true, true, false);

118 $this->mockEscapes(2);

119

120 $this->mockUserLogin()

121 ->seePageIs('/login')->see('These credentials do not match our records.')

122 ->dontSeeInDatabase('users', ['external_auth_id' => $this->mockUser->name]);

123 }

124

125 public function test_create_user_form()

126 {

127 $this->asAdmin()->visit('/settings/users/create')

128 ->dontSee('Password')

129 ->type($this->mockUser->name, '#name')

130 ->type($this->mockUser->email, '#email')

131 ->press('Save')

132 ->see('The external auth id field is required.')

133 ->type($this->mockUser->name, '#external_auth_id')

134 ->press('Save')

135 ->seePageIs('/settings/users')

136 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'external_auth_id' => $this->mockUser->name, 'email_confirmed' => true]);

137 }

138

139 public function test_user_edit_form()

140 {

141 $editUser = $this->getNormalUser();

142 $this->asAdmin()->visit('/settings/users/' . $editUser->id)

143 ->see('Edit User')

144 ->dontSee('Password')

145 ->type('test_auth_id', '#external_auth_id')

146 ->press('Save')

147 ->seePageIs('/settings/users')

148 ->seeInDatabase('users', ['email' => $editUser->email, 'external_auth_id' => 'test_auth_id']);

149 }

150

151 public function test_registration_disabled()

152 {

153 $this->visit('/register')

154 ->seePageIs('/login');

155 }

156

157 public function test_non_admins_cannot_change_auth_id()

158 {

159 $testUser = $this->getNormalUser();

160 $this->actingAs($testUser)->visit('/settings/users/' . $testUser->id)

161 ->dontSee('External Authentication');

162 }

163

164 public function test_login_maps_roles_and_retains_existing_roles()

165 {

166 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

167 $roleToReceive2 = factory(Role::class)->create(['name' => 'ldaptester-second', 'display_name' => 'LdapTester Second']);

168 $existingRole = factory(Role::class)->create(['name' => 'ldaptester-existing']);

169 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

170 $this->mockUser->attachRole($existingRole);

171

172 app('config')->set([

173 'services.ldap.user_to_groups' => true,

174 'services.ldap.group_attribute' => 'memberOf',

175 'services.ldap.remove_from_groups' => false,

176 ]);

177 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

178 $this->mockLdap->shouldReceive('setVersion')->times(2);

179 $this->mockLdap->shouldReceive('setOption')->times(5);

180 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(5)

181 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

182 ->andReturn(['count' => 1, 0 => [

183 'uid' => [$this->mockUser->name],

184 'cn' => [$this->mockUser->name],

185 'dn' => ['dc=test' . config('services.ldap.base_dn')],

186 'mail' => [$this->mockUser->email],

187 'memberof' => [

188 'count' => 2,

189 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

190 1 => "cn=ldaptester-second,ou=groups,dc=example,dc=com",

191 ]

192 ]]);

193 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

194 $this->mockEscapes(5);

195 $this->mockExplodes(6);

196

197 $this->mockUserLogin()->seePageIs('/');

198

199 $user = User::where('email', $this->mockUser->email)->first();

200 $this->seeInDatabase('role_user', [

201 'user_id' => $user->id,

202 'role_id' => $roleToReceive->id

203 ]);

204 $this->seeInDatabase('role_user', [

205 'user_id' => $user->id,

206 'role_id' => $roleToReceive2->id

207 ]);

208 $this->seeInDatabase('role_user', [

209 'user_id' => $user->id,

210 'role_id' => $existingRole->id

211 ]);

212 }

213

214 public function test_login_maps_roles_and_removes_old_roles_if_set()

215 {

216 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

217 $existingRole = factory(Role::class)->create(['name' => 'ldaptester-existing']);

218 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

219 $this->mockUser->attachRole($existingRole);

220

221 app('config')->set([

222 'services.ldap.user_to_groups' => true,

223 'services.ldap.group_attribute' => 'memberOf',

224 'services.ldap.remove_from_groups' => true,

225 ]);

226 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

227 $this->mockLdap->shouldReceive('setVersion')->times(2);

228 $this->mockLdap->shouldReceive('setOption')->times(4);

229 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

230 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

231 ->andReturn(['count' => 1, 0 => [

232 'uid' => [$this->mockUser->name],

233 'cn' => [$this->mockUser->name],

234 'dn' => ['dc=test' . config('services.ldap.base_dn')],

235 'mail' => [$this->mockUser->email],

236 'memberof' => [

237 'count' => 1,

238 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

239 ]

240 ]]);

241 $this->mockLdap->shouldReceive('bind')->times(5)->andReturn(true);

242 $this->mockEscapes(4);

243 $this->mockExplodes(2);

244

245 $this->mockUserLogin()->seePageIs('/');

246

247 $user = User::where('email', $this->mockUser->email)->first();

248 $this->seeInDatabase('role_user', [

249 'user_id' => $user->id,

250 'role_id' => $roleToReceive->id

251 ]);

252 $this->dontSeeInDatabase('role_user', [

253 'user_id' => $user->id,

254 'role_id' => $existingRole->id

255 ]);

256 }

257

258 public function test_external_auth_id_visible_in_roles_page_when_ldap_active()

259 {

260 $role = factory(Role::class)->create(['name' => 'ldaptester', 'external_auth_id' => 'ex-auth-a, test-second-param']);

261 $this->asAdmin()->visit('/settings/roles/' . $role->id)

262 ->see('ex-auth-a');

263 }

264

265 public function test_login_maps_roles_using_external_auth_ids_if_set()

266 {

267 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'external_auth_id' => 'test-second-param, ex-auth-a']);

268 $roleToNotReceive = factory(Role::class)->create(['name' => 'ldaptester-not-receive', 'display_name' => 'ex-auth-a', 'external_auth_id' => 'test-second-param']);

269

270 app('config')->set([

271 'services.ldap.user_to_groups' => true,

272 'services.ldap.group_attribute' => 'memberOf',

273 'services.ldap.remove_from_groups' => true,

274 ]);

275 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

276 $this->mockLdap->shouldReceive('setVersion')->times(2);

277 $this->mockLdap->shouldReceive('setOption')->times(4);

278 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

279 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

280 ->andReturn(['count' => 1, 0 => [

281 'uid' => [$this->mockUser->name],

282 'cn' => [$this->mockUser->name],

283 'dn' => ['dc=test' . config('services.ldap.base_dn')],

284 'mail' => [$this->mockUser->email],

285 'memberof' => [

286 'count' => 1,

287 0 => "cn=ex-auth-a,ou=groups,dc=example,dc=com",

288 ]

289 ]]);

290 $this->mockLdap->shouldReceive('bind')->times(5)->andReturn(true);

291 $this->mockEscapes(4);

292 $this->mockExplodes(2);

293

294 $this->mockUserLogin()->seePageIs('/');

295

296 $user = User::where('email', $this->mockUser->email)->first();

297 $this->seeInDatabase('role_user', [

298 'user_id' => $user->id,

299 'role_id' => $roleToReceive->id

300 ]);

301 $this->dontSeeInDatabase('role_user', [

302 'user_id' => $user->id,

303 'role_id' => $roleToNotReceive->id

304 ]);

305 }

306

307 public function test_login_group_mapping_does_not_conflict_with_default_role()

308 {

309 $roleToReceive = factory(Role::class)->create(['name' => 'ldaptester', 'display_name' => 'LdapTester']);

310 $roleToReceive2 = factory(Role::class)->create(['name' => 'ldaptester-second', 'display_name' => 'LdapTester Second']);

311 $this->mockUser->forceFill(['external_auth_id' => $this->mockUser->name])->save();

312

313 setting()->put('registration-role', $roleToReceive->id);

314

315 app('config')->set([

316 'services.ldap.user_to_groups' => true,

317 'services.ldap.group_attribute' => 'memberOf',

318 'services.ldap.remove_from_groups' => true,

319 ]);

320 $this->mockLdap->shouldReceive('connect')->times(2)->andReturn($this->resourceId);

321 $this->mockLdap->shouldReceive('setVersion')->times(2);

322 $this->mockLdap->shouldReceive('setOption')->times(5);

323 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(5)

324 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

325 ->andReturn(['count' => 1, 0 => [

326 'uid' => [$this->mockUser->name],

327 'cn' => [$this->mockUser->name],

328 'dn' => ['dc=test' . config('services.ldap.base_dn')],

329 'mail' => [$this->mockUser->email],

330 'memberof' => [

331 'count' => 2,

332 0 => "cn=ldaptester,ou=groups,dc=example,dc=com",

333 1 => "cn=ldaptester-second,ou=groups,dc=example,dc=com",

334 ]

335 ]]);

336 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

337 $this->mockEscapes(5);

338 $this->mockExplodes(6);

339

340 $this->mockUserLogin()->seePageIs('/');

341

342 $user = User::where('email', $this->mockUser->email)->first();

343 $this->seeInDatabase('role_user', [

344 'user_id' => $user->id,

345 'role_id' => $roleToReceive->id

346 ]);

347 $this->seeInDatabase('role_user', [

348 'user_id' => $user->id,

349 'role_id' => $roleToReceive2->id

350 ]);

351 }

352

353 public function test_login_uses_specified_display_name_attribute()

354 {

355 app('config')->set([

356 'services.ldap.display_name_attribute' => 'displayName'

357 ]);

358

359 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

360 $this->mockLdap->shouldReceive('setVersion')->once();

361 $this->mockLdap->shouldReceive('setOption')->times(4);

362 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

363 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

364 ->andReturn(['count' => 1, 0 => [

365 'uid' => [$this->mockUser->name],

366 'cn' => [$this->mockUser->name],

367 'dn' => ['dc=test' . config('services.ldap.base_dn')],

368 'displayName' => 'displayNameAttribute'

369 ]]);

370 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

371 $this->mockEscapes(4);

372

373 $this->mockUserLogin()

374 ->seePageIs('/login')->see('Please enter an email to use for this account.');

375

376 $this->type($this->mockUser->email, '#email')

377 ->press('Log In')

378 ->seePageIs('/')

379 ->see('displayNameAttribute')

380 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $this->mockUser->name, 'name' => 'displayNameAttribute']);

381 }

382

383 public function test_login_uses_default_display_name_attribute_if_specified_not_present()

384 {

385 app('config')->set([

386 'services.ldap.display_name_attribute' => 'displayName'

387 ]);

388

389 $this->mockLdap->shouldReceive('connect')->once()->andReturn($this->resourceId);

390 $this->mockLdap->shouldReceive('setVersion')->once();

391 $this->mockLdap->shouldReceive('setOption')->times(4);

392 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(4)

393 ->with($this->resourceId, config('services.ldap.base_dn'), \Mockery::type('string'), \Mockery::type('array'))

394 ->andReturn(['count' => 1, 0 => [

395 'uid' => [$this->mockUser->name],

396 'cn' => [$this->mockUser->name],

397 'dn' => ['dc=test' . config('services.ldap.base_dn')]

398 ]]);

399 $this->mockLdap->shouldReceive('bind')->times(6)->andReturn(true);

400 $this->mockEscapes(4);

401

402 $this->mockUserLogin()

403 ->seePageIs('/login')->see('Please enter an email to use for this account.');

404

405 $this->type($this->mockUser->email, '#email')

406 ->press('Log In')

407 ->seePageIs('/')

408 ->see($this->mockUser->name)

409 ->seeInDatabase('users', ['email' => $this->mockUser->email, 'email_confirmed' => false, 'external_auth_id' => $this->mockUser->name, 'name' => $this->mockUser->name]);

410 }

411

412 protected function checkLdapReceivesCorrectDetails($serverString, $expectedHost, $expectedPort)

413 {

414 app('config')->set([

415 'services.ldap.server' => $serverString

416 ]);

417

418 // Standard mocks

419 $this->mockLdap->shouldReceive('setVersion')->once();

420 $this->mockLdap->shouldReceive('setOption')->times(2);

421 $this->mockLdap->shouldReceive('searchAndGetEntries')->times(2)->andReturn(['count' => 1, 0 => [