Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf0e60ee

Browse files
committed
Add LDAP authentication test suite
Like the SSL test suite, this will not be run by default.Reviewed-by: Thomas Munro <thomas.munro@enterprisedb.com>
1 parent71aa480 commitf0e60ee

File tree

6 files changed

+255
-3
lines changed

6 files changed

+255
-3
lines changed

‎src/test/Makefile

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,10 @@ include $(top_builddir)/src/Makefile.global
1515
SUBDIRS = perl regress isolation modules authentication recovery subscription
1616

1717
# We don't build or execute examples/, locale/, or thread/ by default,
18-
# but we do want "make clean" etc to recurse into them. Likewise for ssl/,
19-
# because the SSL test suite is not secure to run on a multi-user system.
20-
ALWAYS_SUBDIRS = examples locale thread ssl
18+
# but we do want "make clean" etc to recurse into them. Likewise for
19+
# ldap/ and ssl/, because these test suites are not secure to run on a
20+
# multi-user system.
21+
ALWAYS_SUBDIRS = examples ldap locale thread ssl
2122

2223
# We want to recurse to all subdirs for all standard targets, except that
2324
# installcheck and install should not recurse into the subdirectory "modules".

‎src/test/ldap/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Generated by test suite
2+
/tmp_check/

‎src/test/ldap/Makefile

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#-------------------------------------------------------------------------
2+
#
3+
# Makefile for src/test/ldap
4+
#
5+
# Portions Copyright (c) 1996-2017, PostgreSQL Global Development Group
6+
# Portions Copyright (c) 1994, Regents of the University of California
7+
#
8+
# src/test/ldap/Makefile
9+
#
10+
#-------------------------------------------------------------------------
11+
12+
subdir = src/test/ldap
13+
top_builddir = ../../..
14+
include$(top_builddir)/src/Makefile.global
15+
16+
check:
17+
$(prove_check)
18+
19+
cleandistcleanmaintainer-clean:
20+
rm -rf tmp_check

‎src/test/ldap/README

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
src/test/ldap/README
2+
3+
Tests for LDAP functionality
4+
============================
5+
6+
This directory contains a test suite for LDAP functionality. This
7+
requires a full OpenLDAP installation, including server and client
8+
tools, and is therefore kept separate and not run by default. You
9+
might need to adjust some paths in the test file to have it find
10+
OpenLDAP in a place that hadn't been thought of yet.
11+
12+
Also, this test suite creates an LDAP server that listens for TCP/IP
13+
connections on localhost without any real access control, so it is not
14+
safe to run this on a system where there might be untrusted local
15+
users.
16+
17+
Running the tests
18+
=================
19+
20+
make check

‎src/test/ldap/authdata.ldif

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
dn: dc=example,dc=net
2+
objectClass: top
3+
objectClass: dcObject
4+
objectClass: organization
5+
dc: example
6+
o: ExampleCo
7+
8+
dn: uid=test1,dc=example,dc=net
9+
objectClass: inetOrgPerson
10+
objectClass: posixAccount
11+
uid: test1
12+
sn: Lastname
13+
givenName: Firstname
14+
cn: First Test User
15+
displayName: First Test User
16+
uidNumber: 101
17+
gidNumber: 100
18+
homeDirectory: /home/test1
19+
mail: test1@example.net
20+
21+
dn: uid=test2,dc=example,dc=net
22+
objectClass: inetOrgPerson
23+
objectClass: posixAccount
24+
uid: test2
25+
sn: Lastname
26+
givenName: Firstname
27+
cn: Second Test User
28+
displayName: Second Test User
29+
uidNumber: 102
30+
gidNumber: 100
31+
homeDirectory: /home/test2
32+
mail: test2@example.net

‎src/test/ldap/t/001_auth.pl

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
use strict;
2+
use warnings;
3+
use TestLib;
4+
use PostgresNode;
5+
use Test::Moretests=> 14;
6+
7+
my ($slapd,$ldap_bin_dir,$ldap_schema_dir);
8+
9+
$ldap_bin_dir =undef;# usually in PATH
10+
11+
if ($^Oeq'darwin')
12+
{
13+
$slapd ='/usr/local/opt/openldap/libexec/slapd';
14+
$ldap_schema_dir ='/usr/local/etc/openldap/schema';
15+
}
16+
elsif ($^Oeq'linux')
17+
{
18+
$slapd ='/usr/sbin/slapd';
19+
$ldap_schema_dir ='/etc/ldap/schema'if-f'/etc/ldap/schema';
20+
$ldap_schema_dir ='/etc/openldap/schema'if-f'/etc/openldap/schema';
21+
}
22+
elsif ($^Oeq'freebsd')
23+
{
24+
$slapd ='/usr/local/libexec/slapd';
25+
$ldap_schema_dir ='/usr/local/etc/openldap/schema';
26+
}
27+
28+
# make your own edits here
29+
#$slapd = '';
30+
#$ldap_bin_dir = '';
31+
#$ldap_schema_dir = '';
32+
33+
$ENV{PATH} ="$ldap_bin_dir:$ENV{PATH}"if$ldap_bin_dir;
34+
35+
my$ldap_datadir ="${TestLib::tmp_check}/openldap-data";
36+
my$slapd_conf ="${TestLib::tmp_check}/slapd.conf";
37+
my$slapd_pidfile ="${TestLib::tmp_check}/slapd.pid";
38+
my$slapd_logfile ="${TestLib::tmp_check}/slapd.log";
39+
my$ldap_conf ="${TestLib::tmp_check}/ldap.conf";
40+
my$ldap_server ='localhost';
41+
my$ldap_port =int(rand() * 16384) + 49152;
42+
my$ldap_url ="ldap://$ldap_server:$ldap_port";
43+
my$ldap_basedn ='dc=example,dc=net';
44+
my$ldap_rootdn ='cn=Manager,dc=example,dc=net';
45+
my$ldap_rootpw ='secret';
46+
my$ldap_pwfile ="${TestLib::tmp_check}/ldappassword";
47+
48+
note"setting up slapd";
49+
50+
append_to_file($slapd_conf,
51+
qq{include$ldap_schema_dir/core.schema
52+
include$ldap_schema_dir/cosine.schema
53+
include$ldap_schema_dir/nis.schema
54+
include$ldap_schema_dir/inetorgperson.schema
55+
56+
pidfile$slapd_pidfile
57+
logfile$slapd_logfile
58+
59+
access to *
60+
by * read
61+
by anonymous auth
62+
63+
database ldif
64+
directory$ldap_datadir
65+
66+
suffix "dc=example,dc=net"
67+
rootdn "$ldap_rootdn"
68+
rootpw$ldap_rootpw});
69+
70+
mkdir$ldap_datadirordie;
71+
72+
system_or_bail$slapd,'-f',$slapd_conf,'-h',$ldap_url;
73+
74+
END
75+
{
76+
kill'INT',`cat$slapd_pidfile`if-f$slapd_pidfile;
77+
}
78+
79+
append_to_file($ldap_pwfile,$ldap_rootpw);
80+
chmod 0600,$ldap_pwfileordie;
81+
82+
$ENV{'LDAPURI'} =$ldap_url;
83+
$ENV{'LDAPBINDDN'} =$ldap_rootdn;
84+
85+
note"loading LDAP data";
86+
87+
system_or_bail'ldapadd','-x','-y',$ldap_pwfile,'-f','authdata.ldif';
88+
system_or_bail'ldappasswd','-x','-y',$ldap_pwfile,'-s','secret1','uid=test1,dc=example,dc=net';
89+
system_or_bail'ldappasswd','-x','-y',$ldap_pwfile,'-s','secret2','uid=test2,dc=example,dc=net';
90+
91+
note"setting up PostgreSQL instance";
92+
93+
my$node = get_new_node('node');
94+
$node->init;
95+
$node->start;
96+
97+
$node->safe_psql('postgres','CREATE USER test0;');
98+
$node->safe_psql('postgres','CREATE USER test1;');
99+
$node->safe_psql('postgres','CREATE USER "test2@example.net";');
100+
101+
note"running tests";
102+
103+
subtest_access
104+
{
105+
my ($node,$role,$expected_res,$test_name) =@_;
106+
107+
my$res =$node->psql('postgres','SELECT 1',extra_params=> ['-U',$role ]);
108+
is($res,$expected_res,$test_name);
109+
}
110+
111+
note"simple bind";
112+
113+
unlink($node->data_dir .'/pg_hba.conf');
114+
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapprefix="uid=" ldapsuffix=",dc=example,dc=net"});
115+
$node->reload;
116+
117+
$ENV{"PGPASSWORD"} ='wrong';
118+
test_access($node,'test0', 2,'simple bind authentication fails if user not found in LDAP');
119+
test_access($node,'test1', 2,'simple bind authentication fails with wrong password');
120+
$ENV{"PGPASSWORD"} ='secret1';
121+
test_access($node,'test1', 0,'simple bind authentication succeeds');
122+
123+
note"search+bind";
124+
125+
unlink($node->data_dir .'/pg_hba.conf');
126+
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapbasedn="$ldap_basedn"});
127+
$node->reload;
128+
129+
$ENV{"PGPASSWORD"} ='wrong';
130+
test_access($node,'test0', 2,'search+bind authentication fails if user not found in LDAP');
131+
test_access($node,'test1', 2,'search+bind authentication fails with wrong password');
132+
$ENV{"PGPASSWORD"} ='secret1';
133+
test_access($node,'test1', 0,'search+bind authentication succeeds');
134+
135+
note"LDAP URLs";
136+
137+
unlink($node->data_dir .'/pg_hba.conf');
138+
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapurl="$ldap_url/$ldap_basedn?uid?sub"});
139+
$node->reload;
140+
141+
$ENV{"PGPASSWORD"} ='wrong';
142+
test_access($node,'test0', 2,'search+bind with LDAP URL authentication fails if user not found in LDAP');
143+
test_access($node,'test1', 2,'search+bind with LDAP URL authentication fails with wrong password');
144+
$ENV{"PGPASSWORD"} ='secret1';
145+
test_access($node,'test1', 0,'search+bind with LDAP URL authentication succeeds');
146+
147+
note"search filters";
148+
149+
unlink($node->data_dir .'/pg_hba.conf');
150+
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapbasedn="$ldap_basedn" ldapsearchfilter="(|(uid=\$username)(mail=\$username))"});
151+
$node->reload;
152+
153+
$ENV{"PGPASSWORD"} ='secret1';
154+
test_access($node,'test1', 0,'search filter finds by uid');
155+
$ENV{"PGPASSWORD"} ='secret2';
156+
test_access($node,'test2@example.net', 0,'search filter finds by mail');
157+
158+
note"search filters in LDAP URLs";
159+
160+
unlink($node->data_dir .'/pg_hba.conf');
161+
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapurl="$ldap_url/$ldap_basedn??sub?(|(uid=\$username)(mail=\$username))"});
162+
$node->reload;
163+
164+
$ENV{"PGPASSWORD"} ='secret1';
165+
test_access($node,'test1', 0,'search filter finds by uid');
166+
$ENV{"PGPASSWORD"} ='secret2';
167+
test_access($node,'test2@example.net', 0,'search filter finds by mail');
168+
169+
# This is not documented: You can combine ldapurl and other ldap*
170+
# settings. ldapurl is always parsed first, then the other settings
171+
# override. It might be useful in a case like this.
172+
unlink($node->data_dir .'/pg_hba.conf');
173+
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapurl="$ldap_url/$ldap_basedn??sub" ldapsearchfilter="(|(uid=\$username)(mail=\$username))"});
174+
$node->reload;
175+
176+
$ENV{"PGPASSWORD"} ='secret1';
177+
test_access($node,'test1', 0,'combined LDAP URL and search filter');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp