Skip to content

Commit 2756d41

Browse files
DaanHooglandDaanHoogland
authored
manual mapped ldap fix (#2517)
* translate groovy test for ADLdapUserManagerImpl to java * fixed by returning the actual result instead of false * unit test case for manual mapped user in ldap
1 parent 9cf1532 commit 2756d41

5 files changed

Lines changed: 173 additions & 5 deletions

File tree

‎plugins/user-authenticators/ldap/src/org/apache/cloudstack/ldap/ADLdapUserManagerImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ public List<LdapUser> getUsersInGroup(String groupName, LdapContext context, Lon
5959
return users;
6060
}
6161

62-
private String generateADGroupSearchFilter(String groupName, Long domainId) {
62+
String generateADGroupSearchFilter(String groupName, Long domainId) {
6363
final StringBuilder userObjectFilter = new StringBuilder();
6464
userObjectFilter.append("(objectClass=");
6565
userObjectFilter.append(_ldapConfiguration.getUserObject(domainId));

‎plugins/user-authenticators/ldap/src/org/apache/cloudstack/ldap/LdapAuthenticator.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ private void processLdapUser(String password, Long domainId, UserAccount user, P
215215
* @param user cloudstack user object
216216
* @return false if either user object does not exist or authenitication fails
217217
*/
218-
private Pair<Boolean, ActionOnFailedAuthentication> authenticate(String username, String password, Long domainId, UserAccount user) {
218+
Pair<Boolean, ActionOnFailedAuthentication> authenticate(String username, String password, Long domainId, UserAccount user) {
219219
boolean result = false;
220220

221221
if(user != null ) {
@@ -231,8 +231,8 @@ private Pair<Boolean, ActionOnFailedAuthentication> authenticate(String username
231231
}
232232
}
233233
return (!result && user != null) ?
234-
new Pair<Boolean, ActionOnFailedAuthentication>(false, ActionOnFailedAuthentication.INCREMENT_INCORRECT_LOGIN_ATTEMPT_COUNT):
235-
new Pair<Boolean, ActionOnFailedAuthentication>(false, null);
234+
new Pair<Boolean, ActionOnFailedAuthentication>(result, ActionOnFailedAuthentication.INCREMENT_INCORRECT_LOGIN_ATTEMPT_COUNT):
235+
new Pair<Boolean, ActionOnFailedAuthentication>(result, null);
236236
}
237237

238238
private void enableUserInCloudStack(UserAccount user) {

‎plugins/user-authenticators/ldap/test/org/apache/cloudstack/api/command/LdapConfigurationChanger.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ default void setHiddenField(Object target, final String name, final Object o) th
3838
* the first field found by this name in the class "klas" or any of it's superclasses except for {@code Object}. Implementers of this interface can decide to also return any field in implemented interfaces or in {@code Object}.
3939
*
4040
* @param name of the field to find
41-
* @param klas class to gat a field by name "name" from
41+
* @param klas class to get a field by name "name" from
4242
* @return a {@code Field} by the name "name"
4343
* @throws NoSuchFieldException
4444
*/

‎plugins/user-authenticators/ldap/test/org/apache/cloudstack/ldap/ADLdapUserManagerImplTest.java‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.ldap;
18+
19+
import org.junit.Before;
20+
import org.junit.Test;
21+
import org.junit.runner.RunWith;
22+
import org.mockito.Mock;
23+
import org.mockito.runners.MockitoJUnitRunner;
24+
25+
import javax.naming.directory.SearchControls;
26+
import javax.naming.ldap.LdapContext;
27+
28+
import static org.junit.Assert.assertTrue;
29+
import static org.mockito.Matchers.any;
30+
import static org.mockito.Mockito.when;
31+
32+
@RunWith(MockitoJUnitRunner.class)
33+
public class ADLdapUserManagerImplTest {
34+
35+
ADLdapUserManagerImpl adLdapUserManager;
36+
37+
@Mock
38+
LdapConfiguration ldapConfiguration;
39+
40+
@Before
41+
public void init() throws Exception {
42+
adLdapUserManager = new ADLdapUserManagerImpl();
43+
adLdapUserManager._ldapConfiguration = ldapConfiguration;
44+
}
45+
46+
@Test
47+
public void testGenerateADSearchFilterWithNestedGroupsEnabled() {
48+
when(ldapConfiguration.getUserObject(any())).thenReturn("user");
49+
when(ldapConfiguration.getCommonNameAttribute()).thenReturn("CN");
50+
when(ldapConfiguration.getBaseDn(any())).thenReturn("DC=cloud,DC=citrix,DC=com");
51+
when(ldapConfiguration.isNestedGroupsEnabled(any())).thenReturn(true);
52+
53+
String [] groups = {"dev", "dev-hyd"};
54+
for (String group: groups) {
55+
String result = adLdapUserManager.generateADGroupSearchFilter(group, 1L);
56+
assertTrue(("(&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=" + group + ",DC=cloud,DC=citrix,DC=com))").equals(result));
57+
}
58+
59+
}
60+
61+
@Test
62+
public void testGenerateADSearchFilterWithNestedGroupsDisabled() {
63+
when(ldapConfiguration.getUserObject(any())).thenReturn("user");
64+
when(ldapConfiguration.getCommonNameAttribute()).thenReturn("CN");
65+
when(ldapConfiguration.getBaseDn(any())).thenReturn("DC=cloud,DC=citrix,DC=com");
66+
when(ldapConfiguration.isNestedGroupsEnabled(any())).thenReturn(false);
67+
68+
String [] groups = {"dev", "dev-hyd"};
69+
for (String group: groups) {
70+
String result = adLdapUserManager.generateADGroupSearchFilter(group, 1L);
71+
assertTrue(("(&(objectClass=user)(memberOf=CN=" + group + ",DC=cloud,DC=citrix,DC=com))").equals(result));
72+
}
73+
}
74+
75+
@Mock
76+
LdapContext ldapContext;
77+
78+
@Test(expected = IllegalArgumentException.class)
79+
public void testGetUsersInGroupUsingNullGroup() throws Exception {
80+
String[] returnAttributes = {"username", "firstname", "lastname", "email"};
81+
when(ldapConfiguration.getScope()).thenReturn(SearchControls.SUBTREE_SCOPE);
82+
when(ldapConfiguration.getReturnAttributes(null)).thenReturn(returnAttributes);
83+
when(ldapConfiguration.getBaseDn(any())).thenReturn(null).thenReturn(null).thenReturn("DC=cloud,DC=citrix,DC=com");
84+
85+
LdapContext context = ldapContext;
86+
String [] groups = {null, "group", null};
87+
for (String group: groups) {
88+
adLdapUserManager.getUsersInGroup(group, context,null);
89+
}
90+
}
91+
}

‎plugins/user-authenticators/ldap/test/org/apache/cloudstack/ldap/LdapAuthenticatorTest.java‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.ldap;
18+
19+
20+
import com.cloud.server.auth.UserAuthenticator;
21+
import com.cloud.user.UserAccount;
22+
import com.cloud.user.UserAccountVO;
23+
import com.cloud.user.dao.UserAccountDao;
24+
import com.cloud.utils.Pair;
25+
import org.junit.Before;
26+
import org.junit.Test;
27+
import org.junit.runner.RunWith;
28+
import org.mockito.Mock;
29+
import org.mockito.runners.MockitoJUnitRunner;
30+
31+
import static org.junit.Assert.assertEquals;
32+
import static org.junit.Assert.assertFalse;
33+
import static org.junit.Assert.assertNull;
34+
import static org.junit.Assert.assertTrue;
35+
import static org.mockito.Mockito.when;
36+
37+
38+
@RunWith(MockitoJUnitRunner.class)
39+
public class LdapAuthenticatorTest {
40+
41+
@Mock
42+
LdapManager ldapManager;
43+
@Mock
44+
UserAccountDao userAccountDao;
45+
@Mock
46+
UserAccount user = new UserAccountVO();
47+
48+
LdapAuthenticator ldapAuthenticator;
49+
private String username = "bbanner";
50+
private String principal = "cd=bbanner";
51+
private String hardcoded = "password";
52+
private Long domainId = 1L;
53+
54+
@Before
55+
public void setUp() throws Exception {
56+
ldapAuthenticator = new LdapAuthenticator(ldapManager, userAccountDao);
57+
}
58+
59+
@Test
60+
public void authenticateWithoutAccount() throws Exception {
61+
LdapUser ldapUser = new LdapUser(username,"a@b","b","banner",principal,"",false,null);
62+
Pair<Boolean, UserAuthenticator.ActionOnFailedAuthentication> rc;
63+
when(ldapManager.getUser(username, domainId)).thenReturn(ldapUser);
64+
rc = ldapAuthenticator.authenticate(username, "password", domainId, user);
65+
assertFalse("authentication succeded when it should have failed", rc.first());
66+
assertEquals("", UserAuthenticator.ActionOnFailedAuthentication.INCREMENT_INCORRECT_LOGIN_ATTEMPT_COUNT,rc.second());
67+
}
68+
@Test
69+
public void authenticate() throws Exception {
70+
LdapUser ldapUser = new LdapUser(username, "a@b", "b", "banner", principal, "", false, null);
71+
when(ldapManager.getUser(username, domainId)).thenReturn(ldapUser);
72+
when(ldapManager.canAuthenticate(principal, hardcoded, domainId)).thenReturn(true);
73+
Pair<Boolean, UserAuthenticator.ActionOnFailedAuthentication> rc = ldapAuthenticator.authenticate(username, hardcoded, domainId, user);
74+
assertTrue("authentication failed when it should have succeeded", rc.first());
75+
assertNull(rc.second());
76+
}
77+
}

0 commit comments

Comments
 (0)