Ilker ManapandClaude Opus 5.5
f27d722111
auth.ldap checks a username and password against the domain controllers over LDAPS or StartTLS: found with a service account, checked by binding as the person. Groups, nested ones included, give staff roles and places in the tree. Accounts are tied to the objectGUID; the leader reads the directory every 15 minutes, suspends whom it disabled or removed and reinstates them after, and refuses a sync that would suspend most. Entra ID sends no groups for someone in more than 200, only where to fetch them; that was read as none and took an administrator's role away. It is now left as it was, and logged. An account made by SCIM or OIDC can be reinstated again. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
64 lines
2.1 KiB
Go
64 lines
2.1 KiB
Go
package account
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
"time"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/store"
|
|
)
|
|
|
|
type fakeDirectory struct {
|
|
asked []string
|
|
u store.User
|
|
err error
|
|
}
|
|
|
|
func (f *fakeDirectory) SignIn(_ context.Context, login, _ string) (store.User, error) {
|
|
f.asked = append(f.asked, login)
|
|
return f.u, f.err
|
|
}
|
|
|
|
// With a directory, a name the store has no password for is the
|
|
// directory's to check; an account with a password here — the
|
|
// administrator init made — is still checked here, so a directory that is
|
|
// down locks nobody out.
|
|
func TestPasswordsKeptElsewhereAreTheDirectorysToCheck(t *testing.T) {
|
|
svc, st := newService(t)
|
|
ctx := t.Context()
|
|
hash, _ := HashPassword("local-secret")
|
|
admin := store.User{ID: "usr-admin", Email: "admin@example.com", Name: "a", PasswordHash: hash,
|
|
State: store.UserActive, CreatedAt: time.Now()}
|
|
ada := store.User{ID: "usr-ada", Email: "ada@corp.example", Name: "Ada", PasswordHash: "!ldap",
|
|
State: store.UserActive, CreatedAt: time.Now()}
|
|
for _, u := range []store.User{admin, ada} {
|
|
if err := st.CreateUser(ctx, u); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
dir := &fakeDirectory{u: ada}
|
|
svc.SetDirectory(dir)
|
|
|
|
if _, _, err := svc.SignIn(ctx, "admin@example.com", "local-secret"); err != nil || len(dir.asked) != 0 {
|
|
t.Fatalf("the local administrator: %v, directory asked %v", err, dir.asked)
|
|
}
|
|
// A name, not an address, and an account kept by the directory.
|
|
for _, login := range []string{`CORP\ada`, "ada@corp.example"} {
|
|
if tok, _, err := svc.SignIn(ctx, login, "ad-secret"); err != nil || tok == "" {
|
|
t.Errorf("%s: %v", login, err)
|
|
}
|
|
}
|
|
if len(dir.asked) != 2 || dir.asked[0] != `CORP\ada` {
|
|
t.Errorf("the directory was asked %v", dir.asked)
|
|
}
|
|
dir.err = ErrBadCredentials
|
|
if _, _, err := svc.SignIn(ctx, "ada", "wrong"); !errors.Is(err, ErrBadCredentials) {
|
|
t.Errorf("a password the directory refused: %v", err)
|
|
}
|
|
// A reset link would give a directory's account a password here.
|
|
if _, _, err := svc.RequestReset(ctx, st, "ada@corp.example"); !errors.Is(err, ErrNoReset) {
|
|
t.Errorf("a directory's account was sent a reset link: %v", err)
|
|
}
|
|
}
|