Ilker ManapandClaude Opus 5.5
ac25a9136a
People → Sign-in shows single sign-on, Active Directory and SCIM, and the directory's last sync. E sets up Entra ID from the tenant and client IDs; D sets up Active Directory, tried from the control plane first: each server bound, people who may sign in, members of each mapped group. The secrets go into the store as store:auth/..., sealed by the master key, and the CA into the settings, so no control plane needs a file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
46 lines
1.2 KiB
Go
46 lines
1.2 KiB
Go
package store
|
|
|
|
import (
|
|
"errors"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestAClusterSecretIsMadeOnceAndKept(t *testing.T) {
|
|
db, err := Open(t.Context(), filepath.Join(t.TempDir(), "s.db"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer db.Close()
|
|
a, err := db.ClusterSecret(t.Context(), "engine-key")
|
|
if err != nil || len(a) != 64 {
|
|
t.Fatalf("%q %v", a, err)
|
|
}
|
|
b, err := db.ClusterSecret(t.Context(), "engine-key")
|
|
if err != nil || a != b {
|
|
t.Errorf("a second read made a new secret: %q then %q", a, b)
|
|
}
|
|
if c, _ := db.ClusterSecret(t.Context(), "other"); c == a {
|
|
t.Error("two names share a secret")
|
|
}
|
|
}
|
|
|
|
func TestASecretGivenIsKeptReplacedAndNeverMade(t *testing.T) {
|
|
db, err := Open(t.Context(), filepath.Join(t.TempDir(), "s.db"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer db.Close()
|
|
if _, err := db.StoredSecret(t.Context(), "auth/ldap-bind"); !errors.Is(err, ErrNotFound) {
|
|
t.Errorf("a secret never given: %v", err)
|
|
}
|
|
for _, v := range []string{"first", "second"} {
|
|
if err := db.SetClusterSecret(t.Context(), "auth/ldap-bind", v); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got, err := db.StoredSecret(t.Context(), "auth/ldap-bind"); err != nil || got != v {
|
|
t.Errorf("read %q %v, want %q", got, err, v)
|
|
}
|
|
}
|
|
}
|