Added test suite.
The testsuite depends on nginx test suite, and requires an OpenLDAP server installed.
This commit is contained in:
Vladimir Homutov
parent
850f5ea5ca
commit
57fb98b528
|
|
@ -0,0 +1,22 @@
|
|||
Test suite is available at http://hg.nginx.org/nginx-tests.
|
||||
Check the http://hg.nginx.org/nginx-tests/file/tip/README file
|
||||
for instructions on how to use it.
|
||||
|
||||
Additionally, the test requires a working installation
|
||||
of OpenLDAP server and utilities (http://www.openldap.org/),
|
||||
and python's coverage tool (https://coverage.readthedocs.io)
|
||||
|
||||
copy ldap-auth.t into testsuite, setup environment variables:
|
||||
|
||||
$ export TEST_LDAP_DAEMON=/usr/lib64/openldap/slapd
|
||||
$ export TEST_LDAP_AUTH_DAEMON=/path/to/nginx-ldap-auth-daemon.py
|
||||
$ prove 'ldap-auth.t'
|
||||
|
||||
to get coverage report:
|
||||
|
||||
$ export TEST_NGINX_LEAVE=1
|
||||
$ prove 'ldap-auth.t'
|
||||
$ cd /tmp/nginx-test-xxxx
|
||||
$ coverage2 html
|
||||
|
||||
report is now generated in htmlcov/
|
||||
|
|
@ -0,0 +1,444 @@
|
|||
#!/usr/bin/perl
|
||||
|
||||
# (C) Nginx, Inc.
|
||||
|
||||
# Test for nginx-ldap-auth daemon with OpenLDAP.
|
||||
|
||||
###############################################################################
|
||||
|
||||
use warnings;
|
||||
use strict;
|
||||
|
||||
use Test::More;
|
||||
|
||||
use MIME::Base64;
|
||||
|
||||
BEGIN { use FindBin; chdir($FindBin::Bin); }
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx;
|
||||
|
||||
###############################################################################
|
||||
|
||||
select STDERR; $| = 1;
|
||||
select STDOUT; $| = 1;
|
||||
|
||||
my $t = Test::Nginx->new()->has(qw/http proxy rewrite auth_request/)
|
||||
->write_file_expand('nginx.conf', <<'EOF');
|
||||
|
||||
%%TEST_GLOBALS%%
|
||||
|
||||
events { }
|
||||
|
||||
daemon off;
|
||||
|
||||
http {
|
||||
|
||||
%%TEST_GLOBALS_HTTP%%
|
||||
|
||||
#proxy_cache_path cache/ keys_zone=auth_cache:10m;
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:8082;
|
||||
|
||||
location / {
|
||||
return 200 "ACCESS GRANTED\n";
|
||||
}
|
||||
|
||||
location /login {
|
||||
return 200 "LOGIN PAGE\n";
|
||||
}
|
||||
}
|
||||
|
||||
upstream backend {
|
||||
server 127.0.0.1:8082;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:8080;
|
||||
|
||||
location / {
|
||||
auth_request /auth-proxy;
|
||||
|
||||
error_page 401 =200 /login;
|
||||
|
||||
proxy_pass http://backend/;
|
||||
}
|
||||
|
||||
location /ssl {
|
||||
auth_request /auth-proxy-ssl;
|
||||
|
||||
error_page 401 =200 /login;
|
||||
|
||||
proxy_pass http://backend/;
|
||||
}
|
||||
|
||||
location /starttls {
|
||||
auth_request /auth-proxy-starttls;
|
||||
|
||||
error_page 401 =200 /login;
|
||||
|
||||
proxy_pass http://backend/;
|
||||
}
|
||||
|
||||
location /nodn {
|
||||
auth_request /auth-nodn;
|
||||
|
||||
error_page 401 =200 /login;
|
||||
|
||||
proxy_pass http://backend/;
|
||||
}
|
||||
|
||||
location /nourl {
|
||||
auth_request /auth-nourl;
|
||||
|
||||
error_page 401 =200 /login;
|
||||
|
||||
proxy_pass http://backend/;
|
||||
}
|
||||
|
||||
location /login {
|
||||
proxy_pass http://backend/login;
|
||||
|
||||
proxy_set_header X-Target $request_uri;
|
||||
}
|
||||
|
||||
location = /auth-proxy {
|
||||
internal;
|
||||
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
#proxy_cache auth_cache;
|
||||
#proxy_cache_valid 200 10m;
|
||||
#proxy_cache_key "$http_authorization$cookie_nginxauth";
|
||||
|
||||
proxy_set_header X-Ldap-URL "ldap://127.0.0.1:8083";
|
||||
proxy_set_header X-Ldap-BaseDN "ou=Users,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindPass "secret";
|
||||
|
||||
proxy_set_header X-CookieName "nginxauth";
|
||||
proxy_set_header Cookie nginxauth=$cookie_nginxauth;
|
||||
|
||||
#proxy_set_header X-Ldap-Starttls "true";
|
||||
|
||||
#proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
|
||||
#proxy_set_header X-Ldap-DisableReferrals "true";
|
||||
|
||||
#proxy_set_header X-Ldap-Template "(cn=%(username)s)";
|
||||
#proxy_set_header X-Ldap-Realm "Restricted";
|
||||
}
|
||||
|
||||
location = /auth-proxy-ssl {
|
||||
internal;
|
||||
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
proxy_set_header X-Ldap-URL "ldaps://127.0.0.1:8084";
|
||||
proxy_set_header X-Ldap-BaseDN "ou=Users,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindPass "secret";
|
||||
|
||||
proxy_set_header X-CookieName "nginxauth";
|
||||
proxy_set_header Cookie nginxauth=$cookie_nginxauth;
|
||||
|
||||
#proxy_set_header X-Ldap-Starttls "true";
|
||||
}
|
||||
|
||||
location = /auth-proxy-starttls {
|
||||
internal;
|
||||
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
proxy_set_header X-Ldap-URL "ldap://127.0.0.1:8083";
|
||||
proxy_set_header X-Ldap-BaseDN "ou=Users,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindPass "secret";
|
||||
|
||||
proxy_set_header X-CookieName "nginxauth";
|
||||
proxy_set_header Cookie nginxauth=$cookie_nginxauth;
|
||||
|
||||
proxy_set_header X-Ldap-Starttls "true";
|
||||
}
|
||||
|
||||
location = /auth-nodn {
|
||||
internal;
|
||||
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
proxy_set_header X-Ldap-URL "ldap://127.0.0.1:8083";
|
||||
proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindPass "secret";
|
||||
}
|
||||
|
||||
location = /auth-nourl {
|
||||
internal;
|
||||
|
||||
proxy_pass http://127.0.0.1:8888;
|
||||
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
proxy_set_header X-Ldap-BaseDN "ou=Users,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
|
||||
proxy_set_header X-Ldap-BindPass "secret";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
EOF
|
||||
|
||||
my $d = $t->testdir();
|
||||
|
||||
$t->write_file('openssl.conf', <<EOF);
|
||||
[ req ]
|
||||
default_bits = 1024
|
||||
encrypt_key = no
|
||||
distinguished_name = req_distinguished_name
|
||||
[ req_distinguished_name ]
|
||||
EOF
|
||||
|
||||
foreach my $name ('localhost') {
|
||||
system('openssl req -x509 -new '
|
||||
. "-config $d/openssl.conf -subj /CN=$name/ "
|
||||
. "-out $d/$name.crt -keyout $d/$name.key "
|
||||
. ">>$d/openssl.out 2>&1") == 0
|
||||
or die "Can't create certificate for $name: $!\n";
|
||||
}
|
||||
|
||||
$t->write_file_expand("slapd.conf", <<"EOF");
|
||||
include /etc/openldap/schema/core.schema
|
||||
include /etc/openldap/schema/cosine.schema
|
||||
include /etc/openldap/schema/inetorgperson.schema
|
||||
include /etc/openldap/schema/nis.schema
|
||||
include /etc/openldap/schema/misc.schema
|
||||
|
||||
pidfile $d/slapd.pid
|
||||
argsfile $d/slapd.args
|
||||
logfile $d/slapd.log
|
||||
|
||||
loglevel 256 64
|
||||
|
||||
access to dn.base="" by * read
|
||||
access to dn.base="cn=Subschema" by * read
|
||||
access to *
|
||||
by self write
|
||||
by users read
|
||||
by anonymous read
|
||||
|
||||
database hdb
|
||||
suffix "dc=test,dc=local"
|
||||
rootdn "cn=root,dc=test,dc=local"
|
||||
rootpw secret
|
||||
directory $d/openldap-data
|
||||
index objectClass eq
|
||||
|
||||
TLSCipherSuite HIGH:MEDIUM:+SSLv2
|
||||
TLSCACertificateFile $d/localhost.crt
|
||||
TLSCertificateFile $d/localhost.crt
|
||||
TLSCertificateKeyFile $d/localhost.key
|
||||
|
||||
EOF
|
||||
|
||||
|
||||
$t->write_file_expand("initial.ldif", <<'EOF');
|
||||
dn: dc=test,dc=local
|
||||
dc: test
|
||||
description: BlaBlaBla
|
||||
objectClass: dcObject
|
||||
objectClass: organization
|
||||
o: Example, Inc.
|
||||
|
||||
dn: ou=Users, dc=test,dc=local
|
||||
ou: Users
|
||||
description: All people in organisation
|
||||
objectclass: organizationalunit
|
||||
|
||||
dn: cn=user1,ou=Users,dc=test,dc=local
|
||||
objectclass: inetOrgPerson
|
||||
cn: User number one
|
||||
sn: u1
|
||||
uid: user1
|
||||
userpassword: user1secret
|
||||
mail: user1@example.com
|
||||
description: user1
|
||||
ou: Users
|
||||
|
||||
dn: cn=user2,ou=Users,dc=test,dc=local
|
||||
objectclass: inetOrgPerson
|
||||
cn: User number one
|
||||
sn: u2
|
||||
uid: user2
|
||||
userpassword: user2secret
|
||||
mail: user2@example.com
|
||||
description: user2
|
||||
ou: Users
|
||||
|
||||
dn: cn=user3,ou=Users,dc=test,dc=local
|
||||
objectclass: inetOrgPerson
|
||||
cn: User number one
|
||||
sn: u3
|
||||
uid: user3
|
||||
userpassword: user3secret
|
||||
mail: user3@example.com
|
||||
description: user3
|
||||
ou: Users
|
||||
|
||||
EOF
|
||||
|
||||
# -u ldap -g ldap
|
||||
my $SLAPD = defined $ENV{TEST_LDAP_DAEMON} ? $ENV{TEST_LDAP_DAEMON}
|
||||
: '/usr/lib64/openldap/slapd';
|
||||
|
||||
my $AUTHD = defined $ENV{TEST_LDAP_AUTH_DAEMON} ? $ENV{TEST_LDAP_AUTH_DAEMON}
|
||||
: 'nginx-ldap-auth-daemon.py';
|
||||
|
||||
$t->has_daemon($SLAPD);
|
||||
$t->has_daemon($AUTHD);
|
||||
|
||||
mkdir("$d/openldap-data");
|
||||
|
||||
my $p3 = port(8083);
|
||||
my $p4 = port(8084);
|
||||
|
||||
# change '0' to '1' or more to get debug from slapd
|
||||
$t->run_daemon($SLAPD, '-d', '0', '-f', "$d/slapd.conf",
|
||||
'-h', "ldap://127.0.0.1:$p3 ldaps://127.0.0.1:$p4");
|
||||
|
||||
$t->waitforsocket("127.0.0.1:$p3") or die "Can't start slapd";
|
||||
|
||||
|
||||
system("ldapadd -H ldap://127.0.0.1:$p3 -x -D \"cn=root,dc=test,dc=local\""
|
||||
. " -f $d/initial.ldif -w secret >> $d/ldif.log 2>&1") == 0
|
||||
or die "Can't import initial LDIF\n";
|
||||
|
||||
|
||||
$t->write_file_expand("auth_daemon.sh", <<"EOF");
|
||||
AUTHBIN=\$(realpath $AUTHD)
|
||||
cd $d
|
||||
exec coverage2 run \$AUTHBIN --host 127.0.0.1 \\
|
||||
-p %%PORT_8888%% >$d/nginx-ldap-auth-dameon.stdlog 2>&1
|
||||
EOF
|
||||
|
||||
$t->run_daemon('/bin/sh', "$d/auth_daemon.sh");
|
||||
$t->waitforsocket('127.0.0.1:' . port(8888))
|
||||
or die "Can't start auth daemon";
|
||||
|
||||
$t->plan(19);
|
||||
|
||||
$t->run();
|
||||
|
||||
###############################################################################
|
||||
|
||||
like(http_get_auth('/', 'user1', 'user1secret'), qr!ACCESS GRANTED!,
|
||||
'proper user with proper pass');
|
||||
like(http_get_auth('/', 'user1', 'randompass'), qr!LOGIN PAGE!,
|
||||
'proper user with incorrect pass');
|
||||
like(http_get_auth('/', 'user111', 'user1secret'), qr!LOGIN PAGE!,
|
||||
'similar user with user1 pass');
|
||||
like(http_get_auth('/', 'randomuser', 'randompass'), qr!LOGIN PAGE!,
|
||||
'random user with random pass');
|
||||
like(http_get_auth('/', 'user2', 'user2secret'), qr!ACCESS GRANTED!,
|
||||
'user2 with proper pass');
|
||||
like(http_get_auth('/', 'user3', 'user3secret'), qr!ACCESS GRANTED!,
|
||||
'user3 with proper pass');
|
||||
like(http_get_auth('/', '', ''), qr!LOGIN PAGE!, 'empty user no password');
|
||||
like(http_get('/'), qr!LOGIN PAGE!, 'no auth header');
|
||||
|
||||
like(http_get_cookie('/', 'user1', 'user1secret'), qr!ACCESS GRANTED!,
|
||||
'proper user with proper pass cookie');
|
||||
like(http_get_cookie('/', 'user1', 'randompasz'), qr!LOGIN PAGE!,
|
||||
'proper user with incorrect pass cookie');
|
||||
like(http_get_cookie('/', 'randomuser', 'randompass'), qr!LOGIN PAGE!,
|
||||
'random user with random pass cookie');
|
||||
like(http_get_cookie('/', 'user2', 'user2secret'), qr!ACCESS GRANTED!,
|
||||
'user2 with proper pass cookie');
|
||||
like(http_get_cookie('/', 'user3', 'user3secret'), qr!ACCESS GRANTED!,
|
||||
'user3 with proper pass cookie');
|
||||
|
||||
like(http_get_auth_broken_base64('/', 'user3', 'user3secret'), qr!LOGIN PAGE!,
|
||||
'user3 with proper pass broken base64');
|
||||
like(http_get_cookie_broken_base64('/', 'user3', 'user3secret'), qr!LOGIN PAGE!,
|
||||
'user3 with proper pass broken cookie');
|
||||
|
||||
like(http_get_auth('/ssl', 'user1', 'user1secret'), qr!ACCESS GRANTED!,
|
||||
'proper user with proper pass with ssl');
|
||||
|
||||
like(http_get_auth('/starttls', 'user1', 'user1secret'), qr!ACCESS GRANTED!,
|
||||
'proper user with proper pass with starttls');
|
||||
|
||||
# dn is not set, no default, daemon error => 502
|
||||
like(http_get_auth('/nodn', 'user1', 'user1secret'), qr!Internal Server Error!,
|
||||
'dn must be set');
|
||||
|
||||
# url is not set, default is used, which is not accessible => login page
|
||||
like(http_get_auth('/nourl', 'user1', 'user1secret'), qr!LOGIN PAGE!,
|
||||
'url must be set');
|
||||
|
||||
###############################################################################
|
||||
|
||||
sub http_get_auth {
|
||||
my ($url, $user, $password) = @_;
|
||||
|
||||
my $auth = encode_base64($user . ':' . $password, '');
|
||||
|
||||
return http(<<EOF);
|
||||
GET $url HTTP/1.0
|
||||
Host: localhost
|
||||
Authorization: Basic $auth
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
# do not encode auth with base64, send plain
|
||||
sub http_get_auth_broken_base64 {
|
||||
my ($url, $user, $password) = @_;
|
||||
|
||||
my $auth = $user . ':' . $password;
|
||||
|
||||
return http(<<EOF);
|
||||
GET $url HTTP/1.0
|
||||
Host: localhost
|
||||
Authorization: Basic $auth
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
|
||||
sub http_get_cookie {
|
||||
my ($url, $user, $password) = @_;
|
||||
|
||||
my $auth = encode_base64($user . ':' . $password, '');
|
||||
|
||||
return http(<<EOF);
|
||||
GET $url HTTP/1.0
|
||||
Host: localhost
|
||||
Cookie: nginxauth=$auth
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
sub http_get_cookie_broken_base64 {
|
||||
my ($url, $user, $password) = @_;
|
||||
|
||||
my $auth = $user . ':' . $password;
|
||||
|
||||
return http(<<EOF);
|
||||
GET $url HTTP/1.0
|
||||
Host: localhost
|
||||
Cookie: nginxauth=$auth
|
||||
|
||||
EOF
|
||||
}
|
||||
Loading…
Reference in New Issue