activeldap 0.9.0

data/test/test_syntax.rb

@@ -0,0 +1,329 @@
+require 'al-test-utils'
+
+class TestSyntax < Test::Unit::TestCase
+  include AlTestUtils
+  include ActiveLdap::Helper
+
+  SYNTAXES = \
+  [
+   "( 1.3.6.1.1.16.1 DESC 'UUID' )",
+   "( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' )",
+   "( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' " +
+     "X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' X-NOT-HUMAN-READABLE 'TRUE' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone Number' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )",
+   "( 1.2.36.79672281.1.5.0 DESC 'RDN' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' " +
+     "X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' " +
+     "X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' " +
+     "X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' X-NOT-HUMAN-READABLE 'TRUE' )",
+   "( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' X-NOT-HUMAN-READABLE 'TRUE' )"
+  ]
+
+  def setup
+    @schema = ActiveLdap::Schema.new("ldapSyntaxes" => SYNTAXES.dup)
+    @syntaxes = {}
+    @schema.ldap_syntaxes.each do |syntax|
+      @syntaxes[syntax.description] = syntax
+    end
+  end
+
+  def teardown
+  end
+
+  priority :must
+  def test_id_with_length
+    id = "1.3.6.1.4.1.1466.115.121.1.26"
+
+    syntax = ActiveLdap::Schema::Syntax.new(id, @schema)
+    assert_equal([id, nil], [syntax.id, syntax.length])
+
+    syntax = ActiveLdap::Schema::Syntax.new("#{id}{128}", @schema)
+    assert_equal([id, 128], [syntax.id, syntax.length])
+  end
+
+  priority :normal
+  def test_bit_string_type_cast
+    assert_type_cast_without_validation(nil, nil, 'Bit String')
+    assert_type_cast("0101111101", "'0101111101'B", 'Bit String')
+  end
+
+  def test_boolean_type_cast
+    assert_type_cast_without_validation(nil, nil, 'Boolean')
+    assert_type_cast(true, "TRUE", "Boolean")
+    assert_type_cast(false, "FALSE", "Boolean")
+  end
+
+  def test_dn_type_cast
+    assert_type_cast_without_validation(nil, nil, 'Distinguished Name')
+    assert_dn_type_cast("cn=test", 'Distinguished Name')
+  end
+
+  def test_generalized_time_type_cast
+    assert_type_cast_without_validation(nil, nil, "Generalized Time")
+    assert_type_cast(Time.parse("1994/12/16 10:32"), "199412161032",
+                     "Generalized Time")
+    assert_type_cast(Time.parse("1994/12/16 10:32Z"), "199412161032Z",
+                     "Generalized Time")
+    assert_type_cast(Time.parse("1994/12/16 10:32 +09:00"), "199412161032+0900",
+                     "Generalized Time")
+  end
+
+  def test_integer_type_cast
+    assert_type_cast_without_validation(nil, nil, "Generalized Time")
+    assert_type_cast(1321, "1321", "Integer")
+  end
+
+  def test_bit_string_validate
+    assert_valid("'0101111101'B", 'Bit String')
+    assert_valid("''B", 'Bit String')
+
+    value = "0101111101'B"
+    assert_invalid(_("%s doesn't have the first \"'\"") % value.inspect,
+                   value, 'Bit String')
+
+    value = "'0101111101'"
+    assert_invalid(_("%s doesn't have the last \"'B\"") % value.inspect,
+                   value, 'Bit String')
+
+    value = "'0101111101B"
+    assert_invalid(_("%s doesn't have the last \"'B\"") % value.inspect,
+                   value, 'Bit String')
+
+    value = "'0A'B"
+    assert_invalid(_("%s has invalid character '%s'") % [value.inspect, "A"],
+                   value, 'Bit String')
+  end
+
+  def test_boolean_validate
+    assert_valid("TRUE", "Boolean")
+    assert_valid("FALSE", "Boolean")
+
+    value = "true"
+    assert_invalid(_("%s should be TRUE or FALSE") % value.inspect,
+                   value, "Boolean")
+  end
+
+  def test_country_string_validate
+    assert_valid("ja", "Country String")
+    assert_valid("JA", "Country String")
+
+    value = "japan"
+    assert_invalid(_("%s should be just 2 printable characters") % value.inspect,
+                   value, "Country String")
+  end
+
+  def test_dn_validate
+    assert_valid("cn=test", 'Distinguished Name')
+    assert_valid("CN=Steve Kille,O=Isode Limited,C=GB", 'Distinguished Name')
+    assert_valid("OU=Sales+CN=J. Smith,O=Widget Inc.,C=US", 'Distinguished Name')
+    assert_valid("CN=L. Eagle,O=Sue\\, Grabbit and Runn,C=GB",
+                 'Distinguished Name')
+    assert_valid("CN=Before\\0DAfter,O=Test,C=GB", 'Distinguished Name')
+    assert_valid("1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB",
+                 'Distinguished Name')
+    assert_valid("SN=Lu\\C4\\8Di\\C4\\87", 'Distinguished Name')
+
+    value = "test"
+    params = [value, _("attribute value is missing")]
+    assert_invalid(_('%s is invalid distinguished name (DN): %s') % params,
+                   value, 'Distinguished Name')
+  end
+
+  def test_directory_string_validate
+    assert_valid("This is a string of DirectoryString containing \#!%\#@",
+                 "Directory String")
+    assert_valid("これはDirectoryString文字列です。",
+                 "Directory String")
+
+    value = NKF.nkf("-We", "これはDirectoryString文字列です。")
+    assert_invalid(_("%s has invalid UTF-8 character") % value.inspect,
+                   value, "Directory String")
+  end
+
+  def test_generalized_time_validate
+    assert_valid("199412161032", "Generalized Time")
+    assert_valid("199412161032Z", "Generalized Time")
+    assert_valid("199412161032+0900", "Generalized Time")
+
+    value = "1994"
+    params = [value.inspect, %w(month day hour minute).join(", ")]
+    assert_invalid(_("%s has missing components: %s") % params,
+                   value, "Generalized Time")
+  end
+
+  def test_integer_validate
+    assert_valid("1321", "Integer")
+
+    assert_invalid_integer("13.5")
+    assert_invalid_integer("string")
+  end
+
+  def test_jpeg_validate
+    assert_valid([0xffd8].pack("n"), "JPEG")
+
+    assert_invalid(_("invalid JPEG format"), "", "JPEG")
+    assert_invalid(_("invalid JPEG format"), "jpeg", "JPEG")
+  end
+
+  def test_name_and_optional_uid_validate
+    assert_valid("1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB#'0101'B",
+                 "Name And Optional UID")
+    assert_valid("cn=test", "Name And Optional UID")
+
+    value = "test"
+    params = [value, _("attribute value is missing")]
+    assert_invalid(_('%s is invalid distinguished name (DN): %s') % params,
+                   value, "Name And Optional UID")
+
+    bit_string = "'00x'B"
+    params = [bit_string.inspect, "x"]
+    assert_invalid(_("%s has invalid character '%s'") % params,
+                   "cn=test\##{bit_string}", "Name And Optional UID")
+  end
+
+  def test_numeric_string_validate
+    assert_valid("1997", "Numeric String")
+
+    assert_invalid_numeric_string("-3")
+    assert_invalid_numeric_string("-3.5")
+    assert_invalid_numeric_string("string")
+  end
+
+  def test_oid_validate
+    assert_valid("1.2.3.4", "OID")
+    assert_valid("cn", "OID")
+
+    assert_invalid_oid("\#@!")
+  end
+
+  def test_other_mailbox_validate
+    assert_valid("smtp$bob@example.com", "Other Mailbox")
+
+
+    value = "smtp"
+    assert_invalid(_("%s has no mailbox") % value.inspect,
+                   value, "Other Mailbox")
+
+    value = "smtp$"
+    assert_invalid(_("%s has no mailbox") % value.inspect,
+                   value, "Other Mailbox")
+
+    value = "$bob@example.com"
+    assert_invalid(_("%s has no mailbox type") % value.inspect,
+                   value, "Other Mailbox")
+
+    value = "!$bob@example.com"
+    params = [value.inspect, "!"]
+    reason = _("%s has unprintable character in mailbox type: '%s'") % params
+    assert_invalid(reason, value, "Other Mailbox")
+  end
+
+  def test_postal_address_validate
+    assert_valid("1234 Main St.$Anytown, CA 12345$USA", "Postal Address")
+    assert_valid("\\241,000,000 Sweepstakes$PO Box 1000000$Anytown, " +
+                 "CA 12345$USA", "Postal Address")
+    assert_valid("$", "Postal Address")
+    assert_valid("1234 Main St.$", "Postal Address")
+
+
+    assert_invalid(_("empty string"), "", "Postal Address")
+
+    value = NKF.nkf("-We", "東京")
+    assert_invalid(_("%s has invalid UTF-8 character") % value.inspect,
+                   value, "Postal Address")
+  end
+
+  def test_printable_string_validate
+    assert_valid("This is a PrintableString", "Printable String")
+
+    assert_invalid(_("empty string"), "", "Printable String")
+
+
+    value = "abc!def"
+    params = [value.inspect, "!"]
+    reason = _("%s has unprintable character: '%s'") % params
+    assert_invalid(reason, value, "Printable String")
+
+    value = "abcあdef"
+    params = [value.inspect, "あ"]
+    reason = _("%s has unprintable character: '%s'") % params
+    assert_invalid(reason, value, "Printable String")
+  end
+
+  def test_telephone_number_validate
+    assert_valid("+1 512 305 0280", "Telephone Number")
+
+    assert_invalid(_("empty string"), "", "Telephone Number")
+
+    value = "+1 5!2 305 0280"
+    params = [value.inspect, "!"]
+    reason = _("%s has unprintable character: '%s'") % params
+    assert_invalid(reason, value, "Telephone Number")
+  end
+
+  private
+  def assert_valid(value, syntax_name)
+    assert_nil(@syntaxes[syntax_name].validate(value))
+  end
+
+  def assert_invalid(reason, value, syntax_name)
+    assert_equal(reason, @syntaxes[syntax_name].validate(value))
+  end
+
+  def assert_invalid_integer(value)
+    assert_invalid(_("%s is invalid integer format") % value.inspect,
+                   value, "Integer")
+  end
+
+  def assert_invalid_numeric_string(value)
+    assert_invalid(_("%s is invalid numeric format") % value.inspect,
+                   value, "Numeric String")
+  end
+
+  def assert_invalid_oid(value)
+    assert_invalid(_("%s is invalid OID format") % value.inspect,
+                   value, "OID")
+  end
+
+  def assert_type_cast_without_validation(type_casted_value, original_value,
+                                          syntax_name)
+    syntax = @syntaxes[syntax_name]
+    assert_equal(type_casted_value, syntax.type_cast(original_value))
+    assert_equal(type_casted_value, syntax.type_cast(type_casted_value))
+  end
+
+  def assert_type_cast(type_casted_value, original_value, syntax_name)
+    assert_type_cast_without_validation(type_casted_value, original_value,
+                                        syntax_name)
+    assert_valid(type_casted_value, syntax_name)
+  end
+
+  def assert_dn_type_cast(original_value, syntax_name)
+    assert_type_cast(ActiveLdap::DN.parse(original_value), original_value,
+                     syntax_name)
+  end
+end

data/test/test_user.rb

@@ -0,0 +1,227 @@
+require 'al-test-utils'
+
+class TestUser < Test::Unit::TestCase
+  include AlTestUtils
+
+  # This adds all required attributes and writes
+  def test_add
+    ensure_delete_user("test-user") do |uid|
+      user = @user_class.new(uid)
+
+      assert(user.new_entry?, "#{uid} must not exist in LDAP prior to testing")
+
+      assert_equal(['posixAccount', 'person'].sort, user.classes.sort,
+                   "Class User's ldap_mapping should specify " +
+                   "['posixAccount', 'person']. This was not returned.")
+
+      user.add_class('posixAccount', 'shadowAccount',
+                     'person', 'inetOrgPerson', 'organizationalPerson')
+
+      cn = 'Test User (Default Language)'
+      user.cn = cn
+      assert_equal(cn, user.cn, 'user.cn should have returned "#{cn}"')
+
+      # test force_array
+      assert_equal([cn], user.cn(true),
+                   'user.cn(true) should have returned "[#{cn}]"')
+
+      cn = {'lang-en-us' => 'Test User (EN-US Language)'}
+      user.cn = cn
+      # Test subtypes
+      assert_equal(cn, user.cn, 'user.cn should match')
+
+      cn = ['Test User (Default Language)',
+            {'lang-en-us' => ['Test User (EN-US Language)', 'Foo']}]
+      user.cn = cn
+      # Test multiple entries with subtypes
+      assert_equal(cn, user.cn,
+                   'This should have returned an array of a ' +
+                   'normal cn and a lang-en-us cn.')
+
+      uid_number = 9000
+      user.uid_number = uid_number
+      # Test to_s on Fixnums
+      assert_equal(uid_number, user.uid_number)
+      assert_equal(uid_number.to_s, user.uid_number_before_type_cast)
+
+      gid_number = 9000
+      user.gid_number = gid_number
+      # Test to_s on Fixnums
+      assert_equal(gid_number, user.gid_number)
+      assert_equal(gid_number.to_s, user.gid_number_before_type_cast)
+
+      home_directory = '/home/foo'
+      user.home_directory = home_directory
+      # just for sanity's sake
+      assert_equal(home_directory, user.home_directory,
+                   'This should be #{home_directory.dump}.')
+      assert_equal([home_directory], user.home_directory(true),
+                   'This should be [#{home_directory.dump}].')
+
+      see_also = "cn=XXX,dc=local,dc=net"
+      user.see_also = see_also
+      assert_equal(ActiveLdap::DN.parse(see_also), user.see_also)
+
+      see_also = ActiveLdap::DN.parse(see_also)
+      user.see_also = see_also
+      assert_equal(see_also, user.see_also)
+
+      assert(!user.valid?)
+      assert(user.errors.invalid?(:sn))
+      errors = %w(person organizationalPerson
+                  inetOrgPerson).collect do |object_class|
+        if ActiveLdap.get_text_supported?
+          format = _("%{fn} is required attribute by objectClass '%s': " \
+                     "aliases: %s")
+          format = user.gettext(format)
+          format = format % {:fn => user.class.human_attribute_name("sn")}
+          format % [user.class.human_object_class_name(object_class),
+                    user.class.human_attribute_name("surname")]
+        else
+          format = "is required attribute by objectClass '%s': aliases: %s"
+          user.gettext(format) % [object_class, "surname"]
+        end
+      end
+      assert_equal(errors.sort, user.errors.on(:sn).sort)
+      user.sn = ['User']
+      assert(user.valid?)
+      assert_equal(0, user.errors.size)
+
+      assert_nothing_raised {user.save!}
+
+      user.user_certificate = certificate
+      user.jpeg_photo = jpeg_photo
+
+      assert(ActiveLdap::Base.schema.attribute('jpegPhoto').binary?,
+             'jpegPhoto is binary?')
+
+      assert(ActiveLdap::Base.schema.attribute('userCertificate').binary?,
+             'userCertificate is binary?')
+      assert_nothing_raised {user.save!}
+    end
+  end
+
+
+  # This tests the reload of a binary_required type
+  def test_binary_required
+    make_temporary_user do |user, password|
+      # validate add
+      user.user_certificate = nil
+      assert_equal({'binary' => nil}, user.user_certificate)
+      assert_nothing_raised() { user.save! }
+      assert_equal({'binary' => nil}, user.user_certificate)
+
+      user.user_certificate = {"binary" => [certificate]}
+      assert_equal({'binary' => certificate},
+                   user.user_certificate,
+                   'This should have been forced to be a binary subtype.')
+      assert_nothing_raised() { user.save! }
+      assert_equal({'binary' => certificate},
+                   user.user_certificate,
+                   'This should have been forced to be a binary subtype.')
+
+      # now test modify
+      user.user_certificate = nil
+      assert_equal({"binary" => nil}, user.user_certificate)
+      assert_nothing_raised() { user.save! }
+      assert_equal({"binary" => nil}, user.user_certificate)
+
+      user.user_certificate = certificate
+      assert_equal({'binary' => certificate},
+                   user.user_certificate,
+                   'This should have been forced to be a binary subtype.')
+      assert_nothing_raised() { user.save! }
+
+      # validate modify
+      user = @user_class.find(user.uid)
+      assert_equal({'binary' => certificate},
+                   user.user_certificate,
+                   'This should have been forced to be a binary subtype.')
+
+      expected_cert = OpenSSL::X509::Certificate.new(certificate)
+      actual_cert = user.user_certificate['binary']
+      actual_cert = OpenSSL::X509::Certificate.new(actual_cert)
+      assert_equal(expected_cert.subject.to_s,
+                   actual_cert.subject.to_s,
+                   'Cert must parse correctly still')
+    end
+  end
+
+  def test_binary_required_nested
+    make_temporary_user do |user, password|
+      user.user_certificate = {"lang-en" => [certificate]}
+      assert_equal({'lang-en' => {'binary' => certificate}},
+                   user.user_certificate)
+      assert_nothing_raised() { user.save! }
+      assert_equal({'lang-en' => {'binary' => certificate}},
+                   user.user_certificate)
+    end
+  end
+
+  # This tests the reload of a binary type (not forced!)
+  def test_binary
+    make_temporary_user do |user, password|
+      # reload and see what happens
+      assert_equal(jpeg_photo, user.jpeg_photo,
+                   "This should have been equal to #{jpeg_photo_path.dump}")
+
+      # now test modify
+      user.jpeg_photo = nil
+      assert_nil(user.jpeg_photo)
+      assert_nothing_raised() { user.save! }
+      assert_nil(user.jpeg_photo)
+
+      user.jpeg_photo = jpeg_photo
+      assert_equal(jpeg_photo, user.jpeg_photo)
+      assert_nothing_raised() { user.save! }
+
+      # now validate modify
+      user = @user_class.find(user.uid)
+      assert_equal(jpeg_photo, user.jpeg_photo)
+    end
+  end
+
+  # This tests the removal of a objectclass
+  def test_remove_object_class
+    make_temporary_user do |user, password|
+      assert_nil(user.shadow_max,
+                 'Should get the default nil value for shadowMax')
+
+      # Remove shadowAccount
+      user.remove_class('shadowAccount')
+      assert(user.valid?)
+      assert_nothing_raised() { user.save! }
+
+      assert_raise(NoMethodError,
+                   'shadowMax should not be defined anymore' ) do
+        user.shadow_max
+      end
+    end
+  end
+
+
+  # Just modify a few random attributes
+  def test_modify_with_subtypes
+    make_temporary_user do |user, password|
+      cn = ['Test User', {'lang-en-us' => ['Test User', 'wad']}]
+      user.cn = cn
+      assert_nothing_raised() { user.save! }
+
+      user = @user_class.find(user.uid)
+      assert_equal(cn, user.cn,
+                   'Making sure a modify with mixed subtypes works')
+    end
+  end
+
+  # This tests some invalid input handling
+  def test_invalid_input
+  end
+
+  # This tests deletion
+  def test_destroy
+    make_temporary_user do |user, password|
+      user.destroy
+      assert(user.new_entry?, 'user should no longer exist')
+    end
+  end
+end

data/test/test_user_password.rb

@@ -0,0 +1,93 @@
+require 'al-test-utils'
+
+class TestUserPassword < Test::Unit::TestCase
+  priority :must
+
+  priority :normal
+  def test_valid?
+    plain_password = "password"
+    %w(crypt md5 smd5 sha ssha).each do |type|
+      hashed_password = ActiveLdap::UserPassword.send(type, plain_password)
+      assert_send([ActiveLdap::UserPassword, :valid?,
+                   plain_password, hashed_password])
+    end
+  end
+
+  def test_crypt
+    salt = ".WoUoU9f3IlUx9Hh7D/8y.xA6ziklGib"
+    assert_equal("{CRYPT}.W57FZhV52w0s",
+                 ActiveLdap::UserPassword.crypt("password", salt))
+
+    password = "PASSWORD"
+    hashed_password = ActiveLdap::UserPassword.crypt(password)
+    salt = hashed_password.sub(/^\{CRYPT\}/, '')
+    assert_equal(hashed_password,
+                 ActiveLdap::UserPassword.crypt(password, salt))
+  end
+
+  def test_extract_salt_for_crypt
+    assert_extract_salt(:crypt, "AB", "ABCDE")
+    assert_extract_salt(:crypt, "$1", "$1")
+    assert_extract_salt(:crypt, "$1$$", "$1$")
+    assert_extract_salt(:crypt, "$1$$", "$1$$")
+    assert_extract_salt(:crypt, "$1$abcdefgh$", "$1$abcdefgh$")
+    assert_extract_salt(:crypt, "$1$abcdefgh$", "$1$abcdefghi$")
+  end
+
+  def test_md5
+    assert_equal("{MD5}X03MO1qnZdYdgyfeuILPmQ==",
+                 ActiveLdap::UserPassword.md5("password"))
+  end
+
+  def test_smd5
+    assert_equal("{SMD5}gjz+SUSfZaux99Xsji/No200cGI=",
+                 ActiveLdap::UserPassword.smd5("password", "m4pb"))
+
+    password = "PASSWORD"
+    hashed_password = ActiveLdap::UserPassword.smd5(password)
+    salt = Base64.decode64(hashed_password.sub(/^\{SMD5\}/, ''))[-4, 4]
+    assert_equal(hashed_password,
+                 ActiveLdap::UserPassword.smd5(password, salt))
+  end
+
+  def test_extract_salt_for_smd5
+    assert_extract_salt(:smd5, nil, Base64.encode64("").chomp)
+    assert_extract_salt(:smd5, nil, Base64.encode64("1").chomp)
+    assert_extract_salt(:smd5, nil, Base64.encode64("12").chomp)
+    assert_extract_salt(:smd5, nil, Base64.encode64("123").chomp)
+    assert_extract_salt(:smd5, "ABCD", Base64.encode64("ABCD").chomp)
+    assert_extract_salt(:smd5, "BCDE", Base64.encode64("ABCDE").chomp)
+  end
+
+  def test_sha
+    assert_equal("{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=",
+                 ActiveLdap::UserPassword.sha("password"))
+  end
+
+  def test_ssha
+    assert_equal("{SSHA}ipnlCLA1HaK3mm3hyneJIp+Px2h1RGk3",
+                 ActiveLdap::UserPassword.ssha("password", "uDi7"))
+
+    password = "PASSWORD"
+    hashed_password = ActiveLdap::UserPassword.ssha(password)
+    salt = Base64.decode64(hashed_password.sub(/^\{SSHA\}/, ''))[-4, 4]
+    assert_equal(hashed_password,
+                 ActiveLdap::UserPassword.ssha(password, salt))
+  end
+
+  def test_extract_salt_for_ssha
+    assert_extract_salt(:ssha, nil, Base64.encode64("").chomp)
+    assert_extract_salt(:ssha, nil, Base64.encode64("1").chomp)
+    assert_extract_salt(:ssha, nil, Base64.encode64("12").chomp)
+    assert_extract_salt(:ssha, nil, Base64.encode64("123").chomp)
+    assert_extract_salt(:ssha, "ABCD", Base64.encode64("ABCD").chomp)
+    assert_extract_salt(:ssha, "BCDE", Base64.encode64("ABCDE").chomp)
+  end
+
+  private
+  def assert_extract_salt(type, expected, hashed_password)
+    actual = ActiveLdap::UserPassword.send("extract_salt_for_#{type}",
+                                           hashed_password)
+    assert_equal(expected, actual)
+  end
+end