Ilker ManapandClaude Opus 5.5
ac25a9136a
People → Sign-in shows single sign-on, Active Directory and SCIM, and the directory's last sync. E sets up Entra ID from the tenant and client IDs; D sets up Active Directory, tried from the control plane first: each server bound, people who may sign in, members of each mapped group. The secrets go into the store as store:auth/..., sealed by the master key, and the CA into the settings, so no control plane needs a file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
54 lines
1.8 KiB
Go
54 lines
1.8 KiB
Go
package adminapi
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
type memSecrets map[string]string
|
|
|
|
func (m memSecrets) SetClusterSecret(_ context.Context, name, value string) error {
|
|
m[name] = value
|
|
return nil
|
|
}
|
|
|
|
func TestSignInIsShownTriedAndItsSecretsKept(t *testing.T) {
|
|
a, _ := setup(t, testModels())
|
|
kept := memSecrets{}
|
|
var tried string
|
|
a.SetAuth(&AuthAdmin{
|
|
Status: func() AuthView { return AuthView{LDAP: &LDAPView{URLs: []string{"ldaps://dc1"}}} },
|
|
TestLDAP: func(_ context.Context, settings, password string) ([]CheckView, error) {
|
|
tried = settings + "|" + password
|
|
return []CheckView{{Step: "ldaps://dc1", OK: true}, {Step: "people", OK: false, Detail: "no one"}}, nil
|
|
},
|
|
Secrets: kept,
|
|
})
|
|
var v AuthView
|
|
if code := call(t, a, "GET", "/api/v1/auth", "", &v); code != 200 || v.LDAP == nil {
|
|
t.Fatalf("status: %d %+v", code, v)
|
|
}
|
|
// One step failing fails the whole.
|
|
var tv LDAPTestView
|
|
if code := call(t, a, "POST", "/api/v1/auth/ldap/test", `{"settings":"urls: [ldaps://dc1]","password":"pw"}`, &tv); code != 200 ||
|
|
tv.OK || len(tv.Checks) != 2 || tried != "urls: [ldaps://dc1]|pw" {
|
|
t.Errorf("test: %d %+v %q", code, tv, tried)
|
|
}
|
|
var ref map[string]string
|
|
if code := call(t, a, "PUT", "/api/v1/auth/secrets/ldap-bind", `{"value":"s3cret"}`, &ref); code != 200 ||
|
|
kept["auth/ldap-bind"] != "s3cret" || ref["ref"] != "store:auth/ldap-bind" {
|
|
t.Errorf("secret: %d %v %v", code, kept, ref)
|
|
}
|
|
// Only the sign-in secrets, and never an empty one.
|
|
if code := call(t, a, "PUT", "/api/v1/auth/secrets/engine-key", `{"value":"x"}`, nil); code != 404 {
|
|
t.Errorf("another secret: %d", code)
|
|
}
|
|
if code := call(t, a, "PUT", "/api/v1/auth/secrets/ldap-bind", `{"value":" "}`, nil); code != 400 {
|
|
t.Errorf("an empty secret: %d", code)
|
|
}
|
|
if strings.Contains(kept["auth/ldap-bind"], " ") {
|
|
t.Error("an empty secret replaced the kept one")
|
|
}
|
|
}
|