LDAP: Move to single package cluster (#63035)
* move multildap to ldap package * move LDAP api and tests to ldap package * register background service * lint
This commit is contained in:
Jo
@@ -655,11 +655,6 @@ func (hs *HTTPServer) registerRoutes() {
|
||||
adminRoute.Post("/provisioning/datasources/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ActionProvisioningReload, ScopeProvisionersDatasources)), routing.Wrap(hs.AdminProvisioningReloadDatasources))
|
||||
adminRoute.Post("/provisioning/notifications/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ActionProvisioningReload, ScopeProvisionersNotifications)), routing.Wrap(hs.AdminProvisioningReloadNotifications))
|
||||
adminRoute.Post("/provisioning/alerting/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ActionProvisioningReload, ScopeProvisionersAlertRules)), routing.Wrap(hs.AdminProvisioningReloadAlerting))
|
||||
|
||||
adminRoute.Post("/ldap/reload", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPConfigReload)), routing.Wrap(hs.ReloadLDAPCfg))
|
||||
adminRoute.Post("/ldap/sync/:id", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPUsersSync)), routing.Wrap(hs.PostSyncUserWithLDAP))
|
||||
adminRoute.Get("/ldap/:username", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPUsersRead)), routing.Wrap(hs.GetUserFromLDAP))
|
||||
adminRoute.Get("/ldap/status", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPStatusRead)), routing.Wrap(hs.GetLDAPStatus))
|
||||
}, reqSignedIn)
|
||||
|
||||
// Administering users
|
||||
|
||||
@@ -56,7 +56,6 @@ import (
|
||||
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
||||
"github.com/grafana/grafana/pkg/services/folder"
|
||||
"github.com/grafana/grafana/pkg/services/hooks"
|
||||
"github.com/grafana/grafana/pkg/services/ldap"
|
||||
"github.com/grafana/grafana/pkg/services/libraryelements"
|
||||
"github.com/grafana/grafana/pkg/services/librarypanels"
|
||||
"github.com/grafana/grafana/pkg/services/licensing"
|
||||
@@ -174,7 +173,6 @@ type HTTPServer struct {
|
||||
grafanaUpdateChecker *updatechecker.GrafanaService
|
||||
pluginsUpdateChecker *updatechecker.PluginsService
|
||||
searchUsersService searchusers.Service
|
||||
ldapGroups ldap.Groups
|
||||
teamGuardian teamguardian.TeamGuardian
|
||||
queryDataService *query.Service
|
||||
serviceAccountsService serviceaccounts.Service
|
||||
@@ -241,7 +239,7 @@ func ProvideHTTPServer(opts ServerOptions, cfg *setting.Cfg, routeRegister routi
|
||||
encryptionService encryption.Internal, grafanaUpdateChecker *updatechecker.GrafanaService,
|
||||
pluginsUpdateChecker *updatechecker.PluginsService, searchUsersService searchusers.Service,
|
||||
dataSourcesService datasources.DataSourceService, queryDataService *query.Service,
|
||||
ldapGroups ldap.Groups, teamGuardian teamguardian.TeamGuardian, serviceaccountsService serviceaccounts.Service,
|
||||
teamGuardian teamguardian.TeamGuardian, serviceaccountsService serviceaccounts.Service,
|
||||
authInfoService login.AuthInfoService, storageService store.StorageService, httpEntityStore httpentitystore.HTTPEntityStore,
|
||||
notificationService *notifications.NotificationService, dashboardService dashboards.DashboardService,
|
||||
dashboardProvisioningService dashboards.DashboardProvisioningService, folderService folder.Service,
|
||||
@@ -325,7 +323,6 @@ func ProvideHTTPServer(opts ServerOptions, cfg *setting.Cfg, routeRegister routi
|
||||
httpEntityStore: httpEntityStore,
|
||||
DataSourcesService: dataSourcesService,
|
||||
searchUsersService: searchUsersService,
|
||||
ldapGroups: ldapGroups,
|
||||
teamGuardian: teamGuardian,
|
||||
queryDataService: queryDataService,
|
||||
serviceAccountsService: serviceaccountsService,
|
||||
|
||||
@@ -1,396 +0,0 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/grafana/grafana/pkg/api/response"
|
||||
"github.com/grafana/grafana/pkg/infra/log"
|
||||
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
|
||||
"github.com/grafana/grafana/pkg/services/ldap"
|
||||
"github.com/grafana/grafana/pkg/services/login"
|
||||
"github.com/grafana/grafana/pkg/services/multildap"
|
||||
"github.com/grafana/grafana/pkg/services/org"
|
||||
"github.com/grafana/grafana/pkg/services/user"
|
||||
"github.com/grafana/grafana/pkg/util"
|
||||
"github.com/grafana/grafana/pkg/web"
|
||||
)
|
||||
|
||||
var (
|
||||
getLDAPConfig = multildap.GetConfig
|
||||
newLDAP = multildap.New
|
||||
|
||||
ldapLogger = log.New("LDAP.debug")
|
||||
|
||||
errOrganizationNotFound = func(orgId int64) error {
|
||||
return fmt.Errorf("unable to find organization with ID '%d'", orgId)
|
||||
}
|
||||
)
|
||||
|
||||
// LDAPAttribute is a serializer for user attributes mapped from LDAP. Is meant to display both the serialized value and the LDAP key we received it from.
|
||||
type LDAPAttribute struct {
|
||||
ConfigAttributeValue string `json:"cfgAttrValue"`
|
||||
LDAPAttributeValue string `json:"ldapValue"`
|
||||
}
|
||||
|
||||
// RoleDTO is a serializer for mapped roles from LDAP
|
||||
type LDAPRoleDTO struct {
|
||||
OrgId int64 `json:"orgId"`
|
||||
OrgName string `json:"orgName"`
|
||||
OrgRole org.RoleType `json:"orgRole"`
|
||||
GroupDN string `json:"groupDN"`
|
||||
}
|
||||
|
||||
// LDAPUserDTO is a serializer for users mapped from LDAP
|
||||
type LDAPUserDTO struct {
|
||||
Name *LDAPAttribute `json:"name"`
|
||||
Surname *LDAPAttribute `json:"surname"`
|
||||
Email *LDAPAttribute `json:"email"`
|
||||
Username *LDAPAttribute `json:"login"`
|
||||
IsGrafanaAdmin *bool `json:"isGrafanaAdmin"`
|
||||
IsDisabled bool `json:"isDisabled"`
|
||||
OrgRoles []LDAPRoleDTO `json:"roles"`
|
||||
Teams []ldap.TeamOrgGroupDTO `json:"teams"`
|
||||
}
|
||||
|
||||
// LDAPServerDTO is a serializer for LDAP server statuses
|
||||
type LDAPServerDTO struct {
|
||||
Host string `json:"host"`
|
||||
Port int `json:"port"`
|
||||
Available bool `json:"available"`
|
||||
Error string `json:"error"`
|
||||
}
|
||||
|
||||
// FetchOrgs fetches the organization(s) information by executing a single query to the database. Then, populating the DTO with the information retrieved.
|
||||
func (user *LDAPUserDTO) FetchOrgs(ctx context.Context, orga org.Service) error {
|
||||
orgIds := []int64{}
|
||||
|
||||
for _, or := range user.OrgRoles {
|
||||
orgIds = append(orgIds, or.OrgId)
|
||||
}
|
||||
|
||||
q := &org.SearchOrgsQuery{}
|
||||
q.IDs = orgIds
|
||||
|
||||
result, err := orga.Search(ctx, q)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
orgNamesById := map[int64]string{}
|
||||
for _, org := range result {
|
||||
orgNamesById[org.ID] = org.Name
|
||||
}
|
||||
|
||||
for i, orgDTO := range user.OrgRoles {
|
||||
if orgDTO.OrgId < 1 {
|
||||
continue
|
||||
}
|
||||
|
||||
orgName := orgNamesById[orgDTO.OrgId]
|
||||
|
||||
if orgName != "" {
|
||||
user.OrgRoles[i].OrgName = orgName
|
||||
} else {
|
||||
return errOrganizationNotFound(orgDTO.OrgId)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// swagger:route POST /admin/ldap/reload admin_ldap reloadLDAPCfg
|
||||
//
|
||||
// Reloads the LDAP configuration.
|
||||
//
|
||||
// If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.config:reload`.
|
||||
//
|
||||
// Security:
|
||||
// - basic:
|
||||
//
|
||||
// Responses:
|
||||
// 200: okResponse
|
||||
// 401: unauthorisedError
|
||||
// 403: forbiddenError
|
||||
// 500: internalServerError
|
||||
func (hs *HTTPServer) ReloadLDAPCfg(c *contextmodel.ReqContext) response.Response {
|
||||
if !ldap.IsEnabled() {
|
||||
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
|
||||
}
|
||||
|
||||
err := ldap.ReloadConfig()
|
||||
if err != nil {
|
||||
return response.Error(http.StatusInternalServerError, "Failed to reload LDAP config", err)
|
||||
}
|
||||
return response.Success("LDAP config reloaded")
|
||||
}
|
||||
|
||||
// swagger:route GET /admin/ldap/status admin_ldap getLDAPStatus
|
||||
//
|
||||
// Attempts to connect to all the configured LDAP servers and returns information on whenever they're available or not.
|
||||
//
|
||||
// If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.status:read`.
|
||||
//
|
||||
// Security:
|
||||
// - basic:
|
||||
//
|
||||
// Responses:
|
||||
// 200: okResponse
|
||||
// 401: unauthorisedError
|
||||
// 403: forbiddenError
|
||||
// 500: internalServerError
|
||||
func (hs *HTTPServer) GetLDAPStatus(c *contextmodel.ReqContext) response.Response {
|
||||
if !ldap.IsEnabled() {
|
||||
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
|
||||
}
|
||||
|
||||
ldapConfig, err := getLDAPConfig(hs.Cfg)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusBadRequest, "Failed to obtain the LDAP configuration. Please verify the configuration and try again", err)
|
||||
}
|
||||
|
||||
ldap := newLDAP(ldapConfig.Servers)
|
||||
|
||||
if ldap == nil {
|
||||
return response.Error(http.StatusInternalServerError, "Failed to find the LDAP server", nil)
|
||||
}
|
||||
|
||||
statuses, err := ldap.Ping()
|
||||
if err != nil {
|
||||
return response.Error(http.StatusBadRequest, "Failed to connect to the LDAP server(s)", err)
|
||||
}
|
||||
|
||||
serverDTOs := []*LDAPServerDTO{}
|
||||
for _, status := range statuses {
|
||||
s := &LDAPServerDTO{
|
||||
Host: status.Host,
|
||||
Available: status.Available,
|
||||
Port: status.Port,
|
||||
}
|
||||
|
||||
if status.Error != nil {
|
||||
s.Error = status.Error.Error()
|
||||
}
|
||||
|
||||
serverDTOs = append(serverDTOs, s)
|
||||
}
|
||||
|
||||
return response.JSON(http.StatusOK, serverDTOs)
|
||||
}
|
||||
|
||||
// swagger:route POST /admin/ldap/sync/{user_id} admin_ldap postSyncUserWithLDAP
|
||||
//
|
||||
// Enables a single Grafana user to be synchronized against LDAP.
|
||||
//
|
||||
// If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.user:sync`.
|
||||
//
|
||||
// Security:
|
||||
// - basic:
|
||||
//
|
||||
// Responses:
|
||||
// 200: okResponse
|
||||
// 401: unauthorisedError
|
||||
// 403: forbiddenError
|
||||
// 500: internalServerError
|
||||
func (hs *HTTPServer) PostSyncUserWithLDAP(c *contextmodel.ReqContext) response.Response {
|
||||
if !ldap.IsEnabled() {
|
||||
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
|
||||
}
|
||||
|
||||
ldapConfig, err := getLDAPConfig(hs.Cfg)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusBadRequest, "Failed to obtain the LDAP configuration. Please verify the configuration and try again", err)
|
||||
}
|
||||
|
||||
userId, err := strconv.ParseInt(web.Params(c.Req)[":id"], 10, 64)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusBadRequest, "id is invalid", err)
|
||||
}
|
||||
|
||||
query := user.GetUserByIDQuery{ID: userId}
|
||||
|
||||
usr, err := hs.userService.GetByID(c.Req.Context(), &query)
|
||||
if err != nil { // validate the userId exists
|
||||
if errors.Is(err, user.ErrUserNotFound) {
|
||||
return response.Error(404, user.ErrUserNotFound.Error(), nil)
|
||||
}
|
||||
|
||||
return response.Error(500, "Failed to get user", err)
|
||||
}
|
||||
|
||||
authModuleQuery := &login.GetAuthInfoQuery{UserId: usr.ID, AuthModule: login.LDAPAuthModule}
|
||||
if err := hs.authInfoService.GetAuthInfo(c.Req.Context(), authModuleQuery); err != nil { // validate the userId comes from LDAP
|
||||
if errors.Is(err, user.ErrUserNotFound) {
|
||||
return response.Error(404, user.ErrUserNotFound.Error(), nil)
|
||||
}
|
||||
|
||||
return response.Error(500, "Failed to get user", err)
|
||||
}
|
||||
|
||||
ldapServer := newLDAP(ldapConfig.Servers)
|
||||
userInfo, _, err := ldapServer.User(usr.Login)
|
||||
if err != nil {
|
||||
if errors.Is(err, multildap.ErrDidNotFindUser) { // User was not in the LDAP server - we need to take action:
|
||||
if hs.Cfg.AdminUser == usr.Login { // User is *the* Grafana Admin. We cannot disable it.
|
||||
errMsg := fmt.Sprintf(`Refusing to sync grafana super admin "%s" - it would be disabled`, usr.Login)
|
||||
ldapLogger.Error(errMsg)
|
||||
return response.Error(http.StatusBadRequest, errMsg, err)
|
||||
}
|
||||
|
||||
// Since the user was not in the LDAP server. Let's disable it.
|
||||
err := hs.Login.DisableExternalUser(c.Req.Context(), usr.Login)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusInternalServerError, "Failed to disable the user", err)
|
||||
}
|
||||
|
||||
err = hs.AuthTokenService.RevokeAllUserTokens(c.Req.Context(), userId)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusInternalServerError, "Failed to remove session tokens for the user", err)
|
||||
}
|
||||
|
||||
return response.Error(http.StatusBadRequest, "User not found in LDAP. Disabled the user without updating information", nil) // should this be a success?
|
||||
}
|
||||
|
||||
ldapLogger.Debug("Failed to sync the user with LDAP", "err", err)
|
||||
return response.Error(http.StatusBadRequest, "Something went wrong while finding the user in LDAP", err)
|
||||
}
|
||||
|
||||
upsertCmd := &login.UpsertUserCommand{
|
||||
ReqContext: c,
|
||||
ExternalUser: userInfo,
|
||||
SignupAllowed: hs.Cfg.LDAPAllowSignup,
|
||||
UserLookupParams: login.UserLookupParams{
|
||||
UserID: &usr.ID, // Upsert by ID only
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
}
|
||||
|
||||
err = hs.Login.UpsertUser(c.Req.Context(), upsertCmd)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusInternalServerError, "Failed to update the user", err)
|
||||
}
|
||||
|
||||
return response.Success("User synced successfully")
|
||||
}
|
||||
|
||||
// swagger:route GET /admin/ldap/{user_name} admin_ldap getUserFromLDAP
|
||||
//
|
||||
// Finds an user based on a username in LDAP. This helps illustrate how would the particular user be mapped in Grafana when synced.
|
||||
//
|
||||
// If you are running Grafana Enterprise and have Fine-grained access control enabled, you need to have a permission with action `ldap.user:read`.
|
||||
//
|
||||
// Security:
|
||||
// - basic:
|
||||
//
|
||||
// Responses:
|
||||
// 200: okResponse
|
||||
// 401: unauthorisedError
|
||||
// 403: forbiddenError
|
||||
// 500: internalServerError
|
||||
func (hs *HTTPServer) GetUserFromLDAP(c *contextmodel.ReqContext) response.Response {
|
||||
if !ldap.IsEnabled() {
|
||||
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
|
||||
}
|
||||
|
||||
ldapConfig, err := getLDAPConfig(hs.Cfg)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusBadRequest, "Failed to obtain the LDAP configuration", err)
|
||||
}
|
||||
|
||||
multiLDAP := newLDAP(ldapConfig.Servers)
|
||||
|
||||
username := web.Params(c.Req)[":username"]
|
||||
|
||||
if len(username) == 0 {
|
||||
return response.Error(http.StatusBadRequest, "Validation error. You must specify an username", nil)
|
||||
}
|
||||
|
||||
user, serverConfig, err := multiLDAP.User(username)
|
||||
if user == nil || err != nil {
|
||||
return response.Error(http.StatusNotFound, "No user was found in the LDAP server(s) with that username", err)
|
||||
}
|
||||
|
||||
ldapLogger.Debug("user found", "user", user)
|
||||
|
||||
name, surname := splitName(user.Name)
|
||||
|
||||
u := &LDAPUserDTO{
|
||||
Name: &LDAPAttribute{serverConfig.Attr.Name, name},
|
||||
Surname: &LDAPAttribute{serverConfig.Attr.Surname, surname},
|
||||
Email: &LDAPAttribute{serverConfig.Attr.Email, user.Email},
|
||||
Username: &LDAPAttribute{serverConfig.Attr.Username, user.Login},
|
||||
IsGrafanaAdmin: user.IsGrafanaAdmin,
|
||||
IsDisabled: user.IsDisabled,
|
||||
}
|
||||
|
||||
unmappedUserGroups := map[string]struct{}{}
|
||||
for _, userGroup := range user.Groups {
|
||||
unmappedUserGroups[strings.ToLower(userGroup)] = struct{}{}
|
||||
}
|
||||
|
||||
orgIDs := []int64{} // IDs of the orgs the user is a member of
|
||||
orgRolesMap := map[int64]org.RoleType{}
|
||||
for _, group := range serverConfig.Groups {
|
||||
// only use the first match for each org
|
||||
if orgRolesMap[group.OrgId] != "" {
|
||||
continue
|
||||
}
|
||||
|
||||
if ldap.IsMemberOf(user.Groups, group.GroupDN) {
|
||||
orgRolesMap[group.OrgId] = group.OrgRole
|
||||
u.OrgRoles = append(u.OrgRoles, LDAPRoleDTO{GroupDN: group.GroupDN,
|
||||
OrgId: group.OrgId, OrgRole: group.OrgRole})
|
||||
delete(unmappedUserGroups, strings.ToLower(group.GroupDN))
|
||||
orgIDs = append(orgIDs, group.OrgId)
|
||||
}
|
||||
}
|
||||
|
||||
for userGroup := range unmappedUserGroups {
|
||||
u.OrgRoles = append(u.OrgRoles, LDAPRoleDTO{GroupDN: userGroup})
|
||||
}
|
||||
|
||||
ldapLogger.Debug("mapping org roles", "orgsRoles", u.OrgRoles)
|
||||
if err := u.FetchOrgs(c.Req.Context(), hs.orgService); err != nil {
|
||||
return response.Error(http.StatusBadRequest, "An organization was not found - Please verify your LDAP configuration", err)
|
||||
}
|
||||
|
||||
u.Teams, err = hs.ldapGroups.GetTeams(user.Groups, orgIDs)
|
||||
if err != nil {
|
||||
return response.Error(http.StatusBadRequest, "Unable to find the teams for this user", err)
|
||||
}
|
||||
|
||||
return response.JSON(http.StatusOK, u)
|
||||
}
|
||||
|
||||
// splitName receives the full name of a user and splits it into two parts: A name and a surname.
|
||||
func splitName(name string) (string, string) {
|
||||
names := util.SplitString(name)
|
||||
|
||||
switch len(names) {
|
||||
case 0:
|
||||
return "", ""
|
||||
case 1:
|
||||
return names[0], ""
|
||||
default:
|
||||
return names[0], names[1]
|
||||
}
|
||||
}
|
||||
|
||||
// swagger:parameters getUserFromLDAP
|
||||
type GetLDAPUserParams struct {
|
||||
// in:path
|
||||
// required:true
|
||||
UserName string `json:"user_name"`
|
||||
}
|
||||
|
||||
// swagger:parameters postSyncUserWithLDAP
|
||||
type SyncLDAPUserParams struct {
|
||||
// in:path
|
||||
// required:true
|
||||
UserID int64 `json:"user_id"`
|
||||
}
|
||||
@@ -1,640 +0,0 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/grafana/grafana/pkg/api/response"
|
||||
"github.com/grafana/grafana/pkg/api/routing"
|
||||
"github.com/grafana/grafana/pkg/infra/db/dbtest"
|
||||
"github.com/grafana/grafana/pkg/services/accesscontrol"
|
||||
"github.com/grafana/grafana/pkg/services/auth/authtest"
|
||||
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
|
||||
"github.com/grafana/grafana/pkg/services/ldap"
|
||||
"github.com/grafana/grafana/pkg/services/login"
|
||||
"github.com/grafana/grafana/pkg/services/login/loginservice"
|
||||
"github.com/grafana/grafana/pkg/services/login/logintest"
|
||||
"github.com/grafana/grafana/pkg/services/multildap"
|
||||
"github.com/grafana/grafana/pkg/services/org"
|
||||
"github.com/grafana/grafana/pkg/services/org/orgtest"
|
||||
"github.com/grafana/grafana/pkg/services/user"
|
||||
"github.com/grafana/grafana/pkg/services/user/usertest"
|
||||
"github.com/grafana/grafana/pkg/setting"
|
||||
"github.com/grafana/grafana/pkg/web/webtest"
|
||||
)
|
||||
|
||||
type LDAPMock struct {
|
||||
Results []*login.ExternalUserInfo
|
||||
}
|
||||
|
||||
var userSearchResult *login.ExternalUserInfo
|
||||
var userSearchConfig ldap.ServerConfig
|
||||
var userSearchError error
|
||||
var pingResult []*multildap.ServerStatus
|
||||
var pingError error
|
||||
|
||||
func (m *LDAPMock) Ping() ([]*multildap.ServerStatus, error) {
|
||||
return pingResult, pingError
|
||||
}
|
||||
|
||||
func (m *LDAPMock) Login(query *login.LoginUserQuery) (*login.ExternalUserInfo, error) {
|
||||
return &login.ExternalUserInfo{}, nil
|
||||
}
|
||||
|
||||
func (m *LDAPMock) Users(logins []string) ([]*login.ExternalUserInfo, error) {
|
||||
s := []*login.ExternalUserInfo{}
|
||||
return s, nil
|
||||
}
|
||||
|
||||
func (m *LDAPMock) User(login string) (*login.ExternalUserInfo, ldap.ServerConfig, error) {
|
||||
return userSearchResult, userSearchConfig, userSearchError
|
||||
}
|
||||
|
||||
// ***
|
||||
// GetUserFromLDAP tests
|
||||
// ***
|
||||
|
||||
func getUserFromLDAPContext(t *testing.T, requestURL string, searchOrgRst []*org.OrgDTO) *scenarioContext {
|
||||
t.Helper()
|
||||
|
||||
sc := setupScenarioContext(t, requestURL)
|
||||
|
||||
origLDAP := setting.LDAPEnabled
|
||||
setting.LDAPEnabled = true
|
||||
t.Cleanup(func() { setting.LDAPEnabled = origLDAP })
|
||||
|
||||
hs := &HTTPServer{Cfg: setting.NewCfg(), ldapGroups: ldap.ProvideGroupsService(), orgService: &orgtest.FakeOrgService{ExpectedOrgs: searchOrgRst}}
|
||||
|
||||
sc.defaultHandler = routing.Wrap(func(c *contextmodel.ReqContext) response.Response {
|
||||
sc.context = c
|
||||
return hs.GetUserFromLDAP(c)
|
||||
})
|
||||
|
||||
sc.m.Get("/api/admin/ldap/:username", sc.defaultHandler)
|
||||
|
||||
sc.resp = httptest.NewRecorder()
|
||||
req, _ := http.NewRequest(http.MethodGet, requestURL, nil)
|
||||
sc.req = req
|
||||
sc.exec()
|
||||
|
||||
return sc
|
||||
}
|
||||
|
||||
func TestGetUserFromLDAPAPIEndpoint_UserNotFound(t *testing.T) {
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
userSearchResult = nil
|
||||
|
||||
sc := getUserFromLDAPContext(t, "/api/admin/ldap/user-that-does-not-exist", []*org.OrgDTO{})
|
||||
|
||||
require.Equal(t, sc.resp.Code, http.StatusNotFound)
|
||||
assert.JSONEq(t, "{\"message\":\"No user was found in the LDAP server(s) with that username\"}", sc.resp.Body.String())
|
||||
}
|
||||
|
||||
func TestGetUserFromLDAPAPIEndpoint_OrgNotfound(t *testing.T) {
|
||||
isAdmin := true
|
||||
userSearchResult = &login.ExternalUserInfo{
|
||||
Name: "John Doe",
|
||||
Email: "john.doe@example.com",
|
||||
Login: "johndoe",
|
||||
Groups: []string{"cn=admins,ou=groups,dc=grafana,dc=org"},
|
||||
OrgRoles: map[int64]org.RoleType{1: org.RoleAdmin, 2: org.RoleViewer},
|
||||
IsGrafanaAdmin: &isAdmin,
|
||||
}
|
||||
|
||||
userSearchConfig = ldap.ServerConfig{
|
||||
Attr: ldap.AttributeMap{
|
||||
Name: "ldap-name",
|
||||
Surname: "ldap-surname",
|
||||
Email: "ldap-email",
|
||||
Username: "ldap-username",
|
||||
},
|
||||
Groups: []*ldap.GroupToOrgRole{
|
||||
{
|
||||
GroupDN: "cn=admins,ou=groups,dc=grafana,dc=org",
|
||||
OrgId: 1,
|
||||
OrgRole: org.RoleAdmin,
|
||||
},
|
||||
{
|
||||
GroupDN: "cn=admins,ou=groups,dc=grafana,dc=org",
|
||||
OrgId: 2,
|
||||
OrgRole: org.RoleViewer,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
mockOrgSearchResult := []*org.OrgDTO{
|
||||
{ID: 1, Name: "Main Org."},
|
||||
}
|
||||
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
sc := getUserFromLDAPContext(t, "/api/admin/ldap/johndoe", mockOrgSearchResult)
|
||||
|
||||
require.Equal(t, http.StatusBadRequest, sc.resp.Code)
|
||||
|
||||
var res map[string]interface{}
|
||||
err := json.Unmarshal(sc.resp.Body.Bytes(), &res)
|
||||
assert.NoError(t, err)
|
||||
assert.Equal(t, "unable to find organization with ID '2'", res["error"])
|
||||
assert.Equal(t, "An organization was not found - Please verify your LDAP configuration", res["message"])
|
||||
}
|
||||
|
||||
func TestGetUserFromLDAPAPIEndpoint(t *testing.T) {
|
||||
isAdmin := true
|
||||
userSearchResult = &login.ExternalUserInfo{
|
||||
Name: "John Doe",
|
||||
Email: "john.doe@example.com",
|
||||
Login: "johndoe",
|
||||
Groups: []string{"cn=admins,ou=groups,dc=grafana,dc=org", "another-group-not-matched"},
|
||||
OrgRoles: map[int64]org.RoleType{1: org.RoleAdmin},
|
||||
IsGrafanaAdmin: &isAdmin,
|
||||
}
|
||||
|
||||
userSearchConfig = ldap.ServerConfig{
|
||||
Attr: ldap.AttributeMap{
|
||||
Name: "ldap-name",
|
||||
Surname: "ldap-surname",
|
||||
Email: "ldap-email",
|
||||
Username: "ldap-username",
|
||||
},
|
||||
Groups: []*ldap.GroupToOrgRole{
|
||||
{
|
||||
GroupDN: "cn=admins,ou=groups,dc=grafana,dc=org",
|
||||
OrgId: 1,
|
||||
OrgRole: org.RoleAdmin,
|
||||
},
|
||||
{
|
||||
GroupDN: "cn=admins2,ou=groups,dc=grafana,dc=org",
|
||||
OrgId: 1,
|
||||
OrgRole: org.RoleAdmin,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
mockOrgSearchResult := []*org.OrgDTO{
|
||||
{ID: 1, Name: "Main Org."},
|
||||
}
|
||||
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
sc := getUserFromLDAPContext(t, "/api/admin/ldap/johndoe", mockOrgSearchResult)
|
||||
|
||||
assert.Equal(t, sc.resp.Code, http.StatusOK)
|
||||
|
||||
expected := `
|
||||
{
|
||||
"name": {
|
||||
"cfgAttrValue": "ldap-name", "ldapValue": "John"
|
||||
},
|
||||
"surname": {
|
||||
"cfgAttrValue": "ldap-surname", "ldapValue": "Doe"
|
||||
},
|
||||
"email": {
|
||||
"cfgAttrValue": "ldap-email", "ldapValue": "john.doe@example.com"
|
||||
},
|
||||
"login": {
|
||||
"cfgAttrValue": "ldap-username", "ldapValue": "johndoe"
|
||||
},
|
||||
"isGrafanaAdmin": true,
|
||||
"isDisabled": false,
|
||||
"roles": [
|
||||
{ "orgId": 1, "orgRole": "Admin", "orgName": "Main Org.", "groupDN": "cn=admins,ou=groups,dc=grafana,dc=org" },
|
||||
{ "orgId": 0, "orgRole": "", "orgName": "", "groupDN": "another-group-not-matched" }
|
||||
],
|
||||
"teams": null
|
||||
}
|
||||
`
|
||||
|
||||
assert.JSONEq(t, expected, sc.resp.Body.String())
|
||||
}
|
||||
|
||||
func TestGetUserFromLDAPAPIEndpoint_WithTeamHandler(t *testing.T) {
|
||||
isAdmin := true
|
||||
userSearchResult = &login.ExternalUserInfo{
|
||||
Name: "John Doe",
|
||||
Email: "john.doe@example.com",
|
||||
Login: "johndoe",
|
||||
Groups: []string{"cn=admins,ou=groups,dc=grafana,dc=org"},
|
||||
OrgRoles: map[int64]org.RoleType{1: org.RoleAdmin},
|
||||
IsGrafanaAdmin: &isAdmin,
|
||||
}
|
||||
|
||||
userSearchConfig = ldap.ServerConfig{
|
||||
Attr: ldap.AttributeMap{
|
||||
Name: "ldap-name",
|
||||
Surname: "ldap-surname",
|
||||
Email: "ldap-email",
|
||||
Username: "ldap-username",
|
||||
},
|
||||
Groups: []*ldap.GroupToOrgRole{
|
||||
{
|
||||
GroupDN: "cn=admins,ou=groups,dc=grafana,dc=org",
|
||||
OrgId: 1,
|
||||
OrgRole: org.RoleAdmin,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
mockOrgSearchResult := []*org.OrgDTO{
|
||||
{ID: 1, Name: "Main Org."},
|
||||
}
|
||||
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
sc := getUserFromLDAPContext(t, "/api/admin/ldap/johndoe", mockOrgSearchResult)
|
||||
|
||||
require.Equal(t, sc.resp.Code, http.StatusOK)
|
||||
|
||||
expected := `
|
||||
{
|
||||
"name": {
|
||||
"cfgAttrValue": "ldap-name", "ldapValue": "John"
|
||||
},
|
||||
"surname": {
|
||||
"cfgAttrValue": "ldap-surname", "ldapValue": "Doe"
|
||||
},
|
||||
"email": {
|
||||
"cfgAttrValue": "ldap-email", "ldapValue": "john.doe@example.com"
|
||||
},
|
||||
"login": {
|
||||
"cfgAttrValue": "ldap-username", "ldapValue": "johndoe"
|
||||
},
|
||||
"isGrafanaAdmin": true,
|
||||
"isDisabled": false,
|
||||
"roles": [
|
||||
{ "orgId": 1, "orgRole": "Admin", "orgName": "Main Org.", "groupDN": "cn=admins,ou=groups,dc=grafana,dc=org" }
|
||||
],
|
||||
"teams": null
|
||||
}
|
||||
`
|
||||
|
||||
assert.JSONEq(t, expected, sc.resp.Body.String())
|
||||
}
|
||||
|
||||
// ***
|
||||
// GetLDAPStatus tests
|
||||
// ***
|
||||
|
||||
func getLDAPStatusContext(t *testing.T) *scenarioContext {
|
||||
t.Helper()
|
||||
|
||||
requestURL := "/api/admin/ldap/status"
|
||||
sc := setupScenarioContext(t, requestURL)
|
||||
|
||||
ldap := setting.LDAPEnabled
|
||||
setting.LDAPEnabled = true
|
||||
t.Cleanup(func() { setting.LDAPEnabled = ldap })
|
||||
|
||||
hs := &HTTPServer{Cfg: setting.NewCfg()}
|
||||
|
||||
sc.defaultHandler = routing.Wrap(func(c *contextmodel.ReqContext) response.Response {
|
||||
sc.context = c
|
||||
return hs.GetLDAPStatus(c)
|
||||
})
|
||||
|
||||
sc.m.Get("/api/admin/ldap/status", sc.defaultHandler)
|
||||
|
||||
sc.resp = httptest.NewRecorder()
|
||||
req, _ := http.NewRequest(http.MethodGet, requestURL, nil)
|
||||
sc.req = req
|
||||
sc.exec()
|
||||
|
||||
return sc
|
||||
}
|
||||
|
||||
func TestGetLDAPStatusAPIEndpoint(t *testing.T) {
|
||||
pingResult = []*multildap.ServerStatus{
|
||||
{Host: "10.0.0.3", Port: 361, Available: true, Error: nil},
|
||||
{Host: "10.0.0.3", Port: 362, Available: true, Error: nil},
|
||||
{Host: "10.0.0.5", Port: 361, Available: false, Error: errors.New("something is awfully wrong")},
|
||||
}
|
||||
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
sc := getLDAPStatusContext(t)
|
||||
|
||||
require.Equal(t, http.StatusOK, sc.resp.Code)
|
||||
|
||||
expected := `
|
||||
[
|
||||
{ "host": "10.0.0.3", "port": 361, "available": true, "error": "" },
|
||||
{ "host": "10.0.0.3", "port": 362, "available": true, "error": "" },
|
||||
{ "host": "10.0.0.5", "port": 361, "available": false, "error": "something is awfully wrong" }
|
||||
]
|
||||
`
|
||||
assert.JSONEq(t, expected, sc.resp.Body.String())
|
||||
}
|
||||
|
||||
// ***
|
||||
// PostSyncUserWithLDAP tests
|
||||
// ***
|
||||
|
||||
func postSyncUserWithLDAPContext(t *testing.T, requestURL string, preHook func(*testing.T, *scenarioContext), userService user.Service) *scenarioContext {
|
||||
t.Helper()
|
||||
|
||||
sc := setupScenarioContext(t, requestURL)
|
||||
sc.authInfoService = &logintest.AuthInfoServiceFake{}
|
||||
|
||||
ldap := setting.LDAPEnabled
|
||||
t.Cleanup(func() {
|
||||
setting.LDAPEnabled = ldap
|
||||
})
|
||||
setting.LDAPEnabled = true
|
||||
|
||||
hs := &HTTPServer{
|
||||
Cfg: sc.cfg,
|
||||
AuthTokenService: authtest.NewFakeUserAuthTokenService(),
|
||||
Login: loginservice.LoginServiceMock{},
|
||||
authInfoService: sc.authInfoService,
|
||||
userService: userService,
|
||||
}
|
||||
|
||||
sc.defaultHandler = routing.Wrap(func(c *contextmodel.ReqContext) response.Response {
|
||||
sc.context = c
|
||||
return hs.PostSyncUserWithLDAP(c)
|
||||
})
|
||||
|
||||
sc.m.Post("/api/admin/ldap/sync/:id", sc.defaultHandler)
|
||||
|
||||
sc.resp = httptest.NewRecorder()
|
||||
req, err := http.NewRequest(http.MethodPost, requestURL, nil)
|
||||
require.NoError(t, err)
|
||||
|
||||
preHook(t, sc)
|
||||
|
||||
sc.req = req
|
||||
sc.exec()
|
||||
|
||||
return sc
|
||||
}
|
||||
|
||||
func TestPostSyncUserWithLDAPAPIEndpoint_Success(t *testing.T) {
|
||||
userServiceMock := usertest.NewUserServiceFake()
|
||||
userServiceMock.ExpectedUser = &user.User{Login: "ldap-daniel", ID: 34}
|
||||
sc := postSyncUserWithLDAPContext(t, "/api/admin/ldap/sync/34", func(t *testing.T, sc *scenarioContext) {
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
userSearchResult = &login.ExternalUserInfo{
|
||||
Login: "ldap-daniel",
|
||||
}
|
||||
}, userServiceMock)
|
||||
|
||||
assert.Equal(t, http.StatusOK, sc.resp.Code)
|
||||
|
||||
expected := `
|
||||
{
|
||||
"message": "User synced successfully"
|
||||
}
|
||||
`
|
||||
|
||||
assert.JSONEq(t, expected, sc.resp.Body.String())
|
||||
}
|
||||
|
||||
func TestPostSyncUserWithLDAPAPIEndpoint_WhenUserNotFound(t *testing.T) {
|
||||
userServiceMock := usertest.NewUserServiceFake()
|
||||
userServiceMock.ExpectedError = user.ErrUserNotFound
|
||||
sc := postSyncUserWithLDAPContext(t, "/api/admin/ldap/sync/34", func(t *testing.T, sc *scenarioContext) {
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
}, userServiceMock)
|
||||
|
||||
assert.Equal(t, http.StatusNotFound, sc.resp.Code)
|
||||
|
||||
expected := `
|
||||
{
|
||||
"message": "user not found"
|
||||
}
|
||||
`
|
||||
|
||||
assert.JSONEq(t, expected, sc.resp.Body.String())
|
||||
}
|
||||
|
||||
func TestPostSyncUserWithLDAPAPIEndpoint_WhenGrafanaAdmin(t *testing.T) {
|
||||
userServiceMock := usertest.NewUserServiceFake()
|
||||
userServiceMock.ExpectedUser = &user.User{Login: "ldap-daniel", ID: 34}
|
||||
sc := postSyncUserWithLDAPContext(t, "/api/admin/ldap/sync/34", func(t *testing.T, sc *scenarioContext) {
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
userSearchError = multildap.ErrDidNotFindUser
|
||||
|
||||
sc.cfg.AdminUser = "ldap-daniel"
|
||||
}, userServiceMock)
|
||||
assert.Equal(t, http.StatusBadRequest, sc.resp.Code)
|
||||
|
||||
var res map[string]interface{}
|
||||
err := json.Unmarshal(sc.resp.Body.Bytes(), &res)
|
||||
assert.NoError(t, err)
|
||||
assert.Equal(t, "did not find a user", res["error"])
|
||||
assert.Equal(t, "Refusing to sync grafana super admin \"ldap-daniel\" - it would be disabled", res["message"])
|
||||
}
|
||||
|
||||
func TestPostSyncUserWithLDAPAPIEndpoint_WhenUserNotInLDAP(t *testing.T) {
|
||||
userServiceMock := usertest.NewUserServiceFake()
|
||||
userServiceMock.ExpectedUser = &user.User{Login: "ldap-daniel", ID: 34}
|
||||
sc := postSyncUserWithLDAPContext(t, "/api/admin/ldap/sync/34", func(t *testing.T, sc *scenarioContext) {
|
||||
sc.authInfoService.ExpectedExternalUser = &login.ExternalUserInfo{IsDisabled: true, UserId: 34}
|
||||
getLDAPConfig = func(*setting.Cfg) (*ldap.Config, error) {
|
||||
return &ldap.Config{}, nil
|
||||
}
|
||||
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
userSearchResult = nil
|
||||
userSearchError = multildap.ErrDidNotFindUser
|
||||
}, userServiceMock)
|
||||
|
||||
assert.Equal(t, http.StatusBadRequest, sc.resp.Code)
|
||||
|
||||
expected := `
|
||||
{
|
||||
"message": "User not found in LDAP. Disabled the user without updating information"
|
||||
}
|
||||
`
|
||||
|
||||
assert.JSONEq(t, expected, sc.resp.Body.String())
|
||||
}
|
||||
|
||||
// ***
|
||||
// Access control tests for ldap endpoints
|
||||
// ***
|
||||
|
||||
func TestLDAP_AccessControl(t *testing.T) {
|
||||
type testCase struct {
|
||||
desc string
|
||||
method string
|
||||
url string
|
||||
expectedCode int
|
||||
permissions []accesscontrol.Permission
|
||||
}
|
||||
tests := []testCase{
|
||||
{
|
||||
url: "/api/admin/ldap/reload",
|
||||
method: http.MethodPost,
|
||||
desc: "ReloadLDAPCfg should return 200 for user with correct permissions",
|
||||
expectedCode: http.StatusOK,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionLDAPConfigReload},
|
||||
},
|
||||
},
|
||||
{
|
||||
url: "/api/admin/ldap/reload",
|
||||
method: http.MethodPost,
|
||||
desc: "ReloadLDAPCfg should return 403 for user without required permissions",
|
||||
expectedCode: http.StatusForbidden,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: "wrong"},
|
||||
},
|
||||
},
|
||||
{
|
||||
url: "/api/admin/ldap/status",
|
||||
method: http.MethodGet,
|
||||
desc: "GetLDAPStatus should return 200 for user without required permissions",
|
||||
expectedCode: http.StatusOK,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionLDAPStatusRead},
|
||||
},
|
||||
},
|
||||
{
|
||||
url: "/api/admin/ldap/status",
|
||||
method: http.MethodGet,
|
||||
desc: "GetLDAPStatus should return 200 for user without required permissions",
|
||||
expectedCode: http.StatusForbidden,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: "wrong"},
|
||||
},
|
||||
},
|
||||
{
|
||||
url: "/api/admin/ldap/test",
|
||||
method: http.MethodGet,
|
||||
desc: "GetUserFromLDAP should return 200 for user with required permissions",
|
||||
expectedCode: http.StatusOK,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionLDAPUsersRead},
|
||||
},
|
||||
},
|
||||
{
|
||||
url: "/api/admin/ldap/test",
|
||||
method: http.MethodGet,
|
||||
desc: "GetUserFromLDAP should return 403 for user without required permissions",
|
||||
expectedCode: http.StatusForbidden,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: "wrong"},
|
||||
},
|
||||
},
|
||||
{
|
||||
url: "/api/admin/ldap/sync/1",
|
||||
method: http.MethodPost,
|
||||
desc: "PostSyncUserWithLDAP should return 200 for user without required permissions",
|
||||
expectedCode: http.StatusOK,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: accesscontrol.ActionLDAPUsersSync},
|
||||
},
|
||||
},
|
||||
{
|
||||
url: "/api/admin/ldap/sync/1",
|
||||
method: http.MethodPost,
|
||||
desc: "PostSyncUserWithLDAP should return 200 for user without required permissions",
|
||||
expectedCode: http.StatusForbidden,
|
||||
permissions: []accesscontrol.Permission{
|
||||
{Action: "wrong"},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.desc, func(t *testing.T) {
|
||||
enabled := setting.LDAPEnabled
|
||||
configFile := setting.LDAPConfigFile
|
||||
|
||||
t.Cleanup(func() {
|
||||
setting.LDAPEnabled = enabled
|
||||
setting.LDAPConfigFile = configFile
|
||||
})
|
||||
|
||||
setting.LDAPEnabled = true
|
||||
path, err := filepath.Abs("../../conf/ldap.toml")
|
||||
assert.NoError(t, err)
|
||||
setting.LDAPConfigFile = path
|
||||
|
||||
server := SetupAPITestServer(t, func(hs *HTTPServer) {
|
||||
cfg := setting.NewCfg()
|
||||
cfg.LDAPEnabled = true
|
||||
hs.Cfg = cfg
|
||||
hs.SQLStore = dbtest.NewFakeDB()
|
||||
hs.orgService = orgtest.NewOrgServiceFake()
|
||||
hs.userService = &usertest.FakeUserService{ExpectedUser: &user.User{}}
|
||||
hs.ldapGroups = &ldap.OSSGroups{}
|
||||
hs.Login = &loginservice.LoginServiceMock{}
|
||||
hs.authInfoService = &logintest.AuthInfoServiceFake{}
|
||||
})
|
||||
// Add minimal setup to pass handler
|
||||
userSearchResult = &login.ExternalUserInfo{}
|
||||
userSearchError = nil
|
||||
newLDAP = func(_ []*ldap.ServerConfig) multildap.IMultiLDAP {
|
||||
return &LDAPMock{}
|
||||
}
|
||||
|
||||
res, err := server.Send(webtest.RequestWithSignedInUser(server.NewRequest(tt.method, tt.url, nil), userWithPermissions(1, tt.permissions)))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedCode, res.StatusCode)
|
||||
require.NoError(t, res.Body.Close())
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user