Ilker ManapandClaude Opus 5.5
ac25a9136a
People → Sign-in shows single sign-on, Active Directory and SCIM, and the directory's last sync. E sets up Entra ID from the tenant and client IDs; D sets up Active Directory, tried from the control plane first: each server bound, people who may sign in, members of each mapped group. The secrets go into the store as store:auth/..., sealed by the master key, and the CA into the settings, so no control plane needs a file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
46 lines
1.9 KiB
Go
46 lines
1.9 KiB
Go
package router
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/config"
|
|
)
|
|
|
|
// auth.ldap is the cluster's: a CA file one machine lacks must not keep its
|
|
// control plane from starting, where nothing could put the setting right.
|
|
func TestADirectoryThatCannotBeUsedHereLeavesTheGatewayUp(t *testing.T) {
|
|
cfg := baseConfig(config.Endpoint{ID: "a", URL: "http://127.0.0.1:1", Models: []string{"m"}})
|
|
cfg.Auth.Enabled = true
|
|
cfg.Auth.Store = filepath.Join(t.TempDir(), "store.db")
|
|
cfg.Auth.LDAP = config.LDAP{URLs: []string{"ldaps://dc1"}, CAFile: filepath.Join(t.TempDir(), "missing.pem"),
|
|
BindDN: "CN=svc", BindPasswordFile: "/nonexistent", BaseDN: "DC=corp"}
|
|
r := newTestRouter(t, cfg)
|
|
if r.directory != nil {
|
|
t.Fatal("a directory was set up from a CA file that is not there")
|
|
}
|
|
w := httptest.NewRecorder()
|
|
r.Handler().ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/login", nil))
|
|
if w.Code != http.StatusOK || !strings.Contains(w.Body.String(), `type="email"`) {
|
|
t.Errorf("/login: %d", w.Code)
|
|
}
|
|
}
|
|
|
|
// Settings tried are checked as kept ones are: a plaintext server is
|
|
// refused before anything is sent to it.
|
|
func TestDirectorySettingsTriedAreCheckedFirst(t *testing.T) {
|
|
r := &Router{}
|
|
if _, err := r.TestDirectory(t.Context(), "urls: [ldap://dc1]\nbind_dn: CN=svc\nbind_password_file: store:auth/ldap-bind\nbase_dn: DC=corp\n", "pw"); err == nil ||
|
|
!strings.Contains(err.Error(), "plaintext") {
|
|
t.Errorf("err %v", err)
|
|
}
|
|
checks, err := r.TestDirectory(t.Context(), "urls: [ldaps://dc1]\nca: \"-----BEGIN CERTIFICATE-----\\nAAAA\\n-----END CERTIFICATE-----\"\n"+
|
|
"bind_dn: CN=svc\nbind_password_file: store:auth/ldap-bind\nbase_dn: DC=corp\n", "pw")
|
|
if err != nil || len(checks) != 1 || checks[0].Step != "certificate" || checks[0].OK {
|
|
t.Errorf("a broken CA: %+v %v", checks, err)
|
|
}
|
|
}
|