devise_ldap_authenticatable 0.6.1 → 0.7.0

data/spec/rails_app/config/locales/devise.en.yml

@@ -0,0 +1,58 @@
+# Additional translations at https://github.com/plataformatec/devise/wiki/I18n
+
+en:
+  errors:
+    messages:
+      expired: "has expired, please request a new one"
+      not_found: "not found"
+      already_confirmed: "was already confirmed, please try signing in"
+      not_locked: "was not locked"
+      not_saved:
+        one: "1 error prohibited this %{resource} from being saved:"
+        other: "%{count} errors prohibited this %{resource} from being saved:"
+
+  devise:
+    failure:
+      already_authenticated: 'You are already signed in.'
+      unauthenticated: 'You need to sign in or sign up before continuing.'
+      unconfirmed: 'You have to confirm your account before continuing.'
+      locked: 'Your account is locked.'
+      invalid: 'Invalid email or password.'
+      invalid_token: 'Invalid authentication token.'
+      timeout: 'Your session expired, please sign in again to continue.'
+      inactive: 'Your account was not activated yet.'
+    sessions:
+      signed_in: 'Signed in successfully.'
+      signed_out: 'Signed out successfully.'
+    passwords:
+      send_instructions: 'You will receive an email with instructions about how to reset your password in a few minutes.'
+      updated: 'Your password was changed successfully. You are now signed in.'
+      updated_not_active: 'Your password was changed successfully.'
+      send_paranoid_instructions: "If your email address exists in our database, you will receive a password recovery link at your email address in a few minutes."
+      no_token: "You can't access this page without coming from a password reset email. If you do come from a password reset email, please make sure you used the full URL provided."
+    confirmations:
+      send_instructions: 'You will receive an email with instructions about how to confirm your account in a few minutes.'
+      send_paranoid_instructions: 'If your email address exists in our database, you will receive an email with instructions about how to confirm your account in a few minutes.'
+      confirmed: 'Your account was successfully confirmed. You are now signed in.'
+    registrations:
+      signed_up: 'Welcome! You have signed up successfully.'
+      signed_up_but_unconfirmed: 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
+      signed_up_but_inactive: 'You have signed up successfully. However, we could not sign you in because your account is not yet activated.'
+      signed_up_but_locked: 'You have signed up successfully. However, we could not sign you in because your account is locked.'
+      updated: 'You updated your account successfully.'
+      update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and click on the confirm link to finalize confirming your new email address."
+      destroyed: 'Bye! Your account was successfully cancelled. We hope to see you again soon.'
+    unlocks:
+      send_instructions: 'You will receive an email with instructions about how to unlock your account in a few minutes.'
+      unlocked: 'Your account has been unlocked successfully. Please sign in to continue.'
+      send_paranoid_instructions: 'If your account exists, you will receive an email with instructions about how to unlock it in a few minutes.'
+    omniauth_callbacks:
+      success: 'Successfully authenticated from %{kind} account.'
+      failure: 'Could not authenticate you from %{kind} because "%{reason}".'
+    mailer:
+      confirmation_instructions:
+        subject: 'Confirmation instructions'
+      reset_password_instructions:
+        subject: 'Reset password instructions'
+      unlock_instructions:
+        subject: 'Unlock Instructions'

data/{test → spec}/rails_app/db/migrate/20100708120448_devise_create_users.rb

@@ -1,10 +1,24 @@
 class DeviseCreateUsers < ActiveRecord::Migration
   def self.up
     create_table(:users) do |t|
-      t.database_authenticatable :null => false
-      t.recoverable
-      t.rememberable
-      t.trackable
+      ## Database authenticatable
+      t.string :email,              :null => false, :default => ""
+      t.string :encrypted_password, :null => false, :default => ""
+
+      ## Recoverable
+      t.string   :reset_password_token
+      t.datetime :reset_password_sent_at
+
+      ## Rememberable
+      t.datetime :remember_created_at
+
+      ## Trackable
+      t.integer  :sign_in_count, :default => 0
+      t.datetime :current_sign_in_at
+      t.datetime :last_sign_in_at
+      t.string   :current_sign_in_ip
+      t.string   :last_sign_in_ip
+
       t.string :uid
 
       # t.confirmable

data/{test → spec}/rails_app/db/schema.rb

@@ -12,27 +12,20 @@
 
 ActiveRecord::Schema.define(:version => 20100708120448) do
 
-  create_table "posts", :force => true do |t|
-    t.string   "title"
-    t.text     "body"
-    t.datetime "created_at"
-    t.datetime "updated_at"
-  end
-
   create_table "users", :force => true do |t|
-    t.string   "email",                               :default => "", :null => false
-    t.string   "encrypted_password",   :limit => 128, :default => "", :null => false
+    t.string   "email",                  :default => "", :null => false
+    t.string   "encrypted_password",     :default => "", :null => false
     t.string   "reset_password_token"
-    t.string   "remember_token"
+    t.datetime "reset_password_sent_at"
     t.datetime "remember_created_at"
-    t.integer  "sign_in_count",                       :default => 0
+    t.integer  "sign_in_count",          :default => 0
     t.datetime "current_sign_in_at"
     t.datetime "last_sign_in_at"
     t.string   "current_sign_in_ip"
     t.string   "last_sign_in_ip"
     t.string   "uid"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                             :null => false
+    t.datetime "updated_at",                             :null => false
   end
 
   add_index "users", ["email"], :name => "index_users_on_email", :unique => true

data/spec/spec_helper.rb

@@ -0,0 +1,47 @@
+ENV["RAILS_ENV"] = "test"
+
+require File.expand_path("rails_app/config/environment.rb",  File.dirname(__FILE__))
+require 'rspec/rails'
+require 'rspec/autorun'
+require 'factory_girl' # not sure why this is not already required
+
+Dir[File.expand_path("support/**/*.rb", File.dirname(__FILE__))].each {|f| require f}
+
+RSpec.configure do |config|
+  config.mock_with :rspec
+  config.use_transactional_fixtures = true
+  config.infer_base_class_for_anonymous_controllers = false
+end
+
+def ldap_root
+  File.expand_path('ldap', File.dirname(__FILE__))
+end
+
+def ldap_connect_string
+  if ENV["LDAP_SSL"]
+    "-x -H ldaps://localhost:3389 -D 'cn=admin,dc=test,dc=com' -w secret"
+  else
+    "-x -h localhost -p 3389 -D 'cn=admin,dc=test,dc=com' -w secret"
+  end
+end
+
+def reset_ldap_server!
+  if ENV["LDAP_SSL"]
+    `ldapmodify #{ldap_connect_string} -f #{File.join(ldap_root, 'clear.ldif')}`
+    `ldapadd #{ldap_connect_string} -f #{File.join(ldap_root, 'base.ldif')}`
+  else
+    `ldapmodify #{ldap_connect_string} -f #{File.join(ldap_root, 'clear.ldif')}`
+    `ldapadd #{ldap_connect_string} -f #{File.join(ldap_root, 'base.ldif')}`
+  end
+end
+
+def default_devise_settings!
+  ::Devise.ldap_logger = true
+  ::Devise.ldap_create_user = false
+  ::Devise.ldap_update_password = true
+  ::Devise.ldap_config = "#{Rails.root}/config/#{"ssl_" if ENV["LDAP_SSL"]}ldap.yml"
+  ::Devise.ldap_check_group_membership = false
+  ::Devise.ldap_check_attributes = false
+  ::Devise.ldap_auth_username_builder = Proc.new() {|attribute, login, ldap| "#{attribute}=#{login},#{ldap.base}" }
+  ::Devise.authentication_keys = [:email]
+end

data/spec/support/factories.rb

@@ -0,0 +1,16 @@
+FactoryGirl.define do
+  factory :user do
+    email "example.user@test.com"
+    password "secret"
+  end
+
+  factory :admin, :class => User do
+    email "example.admin@test.com"
+    password "admin_secret"
+  end
+
+  factory :other, :class => User do
+    email "other.user@test.com"
+    password "other_secret"
+  end
+end

data/spec/unit/user_spec.rb

@@ -0,0 +1,303 @@
+require File.expand_path('../spec_helper', File.dirname(__FILE__))
+
+describe 'Users' do
+
+  def should_be_validated(user, password, message = "Password is invalid")
+    assert(user.valid_ldap_authentication?(password), message)
+  end
+
+  def should_not_be_validated(user, password, message = "Password is not properly set")
+     assert(!user.valid_ldap_authentication?(password), message)
+  end
+
+  describe "With default settings" do
+    before do
+      default_devise_settings!
+      reset_ldap_server!
+    end
+
+    describe "look up and ldap user" do
+      it "should return true for a user that does exist in LDAP" do
+        assert_equal true, ::Devise::LdapAdapter.valid_login?('example.user@test.com')
+      end
+
+      it "should return false for a user that doesn't exist in LDAP" do
+        assert_equal false, ::Devise::LdapAdapter.valid_login?('barneystinson')
+      end
+    end
+
+    describe "create a basic user" do
+      before do
+        @user = Factory.create(:user)
+      end
+
+      it "should check for password validation" do
+        assert_equal(@user.email, "example.user@test.com")
+        should_be_validated @user, "secret"
+        should_not_be_validated @user, "wrong_secret"
+        should_not_be_validated @user, "Secret"
+      end
+    end
+
+    describe "change a LDAP password" do
+      before do
+        @user = Factory.create(:user)
+      end
+
+      it "should change password" do
+        should_be_validated @user, "secret"
+        @user.password = "changed"
+        @user.change_password!("secret")
+        should_be_validated @user, "changed", "password was not changed properly on the LDAP sevrer"
+      end
+
+      it "should not allow to change password if setting is false" do
+        should_be_validated @user, "secret"
+        ::Devise.ldap_update_password = false
+        @user.reset_password!("wrong_secret", "wrong_secret")
+        should_not_be_validated @user, "wrong_secret"
+        should_be_validated @user, "secret"
+      end
+    end
+
+    describe "create new local user if user is in LDAP" do
+
+      before do
+        assert(User.all.blank?, "There shouldn't be any users in the database")
+      end
+
+      it "should don't create user in the database" do
+        @user = User.authenticate_with_ldap(:email => "example.user@test.com", :password => "secret")
+        assert(User.all.blank?)
+      end
+
+      describe "creating users is enabled" do
+        before do
+          ::Devise.ldap_create_user = true
+        end
+
+        it "should create a user in the database" do
+          @user = User.authenticate_with_ldap(:email => "example.user@test.com", :password => "secret")
+          assert_equal(User.all.size, 1)
+          User.all.collect(&:email).should include("example.user@test.com")
+        end
+
+        it "should not create a user in the database if the password is wrong_secret" do
+          @user = User.authenticate_with_ldap(:email => "example.user", :password => "wrong_secret")
+          assert(User.all.blank?, "There's users in the database")
+        end
+
+        it "should create a user if the user is not in LDAP" do
+          @user = User.authenticate_with_ldap(:email => "wrong_secret.user@test.com", :password => "wrong_secret")
+          assert(User.all.blank?, "There's users in the database")
+        end
+
+        it "should create a user in the database if case insensitivity does not matter" do
+          ::Devise.case_insensitive_keys = []
+          @user = Factory.create(:user)
+
+          expect do
+            User.authenticate_with_ldap(:email => "EXAMPLE.user@test.com", :password => "secret")
+          end.to change { User.count }.by(1)
+        end
+
+        it "should not create a user in the database if case insensitivity matters" do
+          ::Devise.case_insensitive_keys = [:email]
+          @user = Factory.create(:user)
+
+          expect do
+            User.authenticate_with_ldap(:email => "EXAMPLE.user@test.com", :password => "secret")
+          end.to_not change { User.count }
+        end
+
+        it "should create a user with downcased email in the database if case insensitivity matters" do
+          ::Devise.case_insensitive_keys = [:email]
+
+          @user = User.authenticate_with_ldap(:email => "EXAMPLE.user@test.com", :password => "secret")
+          User.all.collect(&:email).should include("example.user@test.com")
+        end
+      end
+
+    end
+
+    describe "use groups for authorization" do
+      before do
+        @admin = Factory.create(:admin)
+        @user = Factory.create(:user)
+        ::Devise.authentication_keys = [:email]
+        ::Devise.ldap_check_group_membership = true
+      end
+
+      it "should admin should be allowed in" do
+        should_be_validated @admin, "admin_secret"
+      end
+
+      it "should admin should have the proper groups set" do
+        @admin.ldap_groups.should include('cn=admins,ou=groups,dc=test,dc=com')
+      end
+
+      it "should user should not be allowed in" do
+        should_not_be_validated @user, "secret"
+      end
+    end
+    
+    describe "check group membership" do
+      before do
+        @admin = Factory.create(:admin)
+        @user = Factory.create(:user)
+      end
+      
+      it "should return true for admin being in the admins group" do
+        assert_equal true, @admin.in_ldap_group?('cn=admins,ou=groups,dc=test,dc=com')
+      end
+      
+      it "should return false for admin being in the admins group using the 'foobar' group attribute" do
+        assert_equal false, @admin.in_ldap_group?('cn=admins,ou=groups,dc=test,dc=com', 'foobar')
+      end
+      
+      it "should return true for user being in the users group" do
+        assert_equal true, @user.in_ldap_group?('cn=users,ou=groups,dc=test,dc=com')
+      end   
+      
+      it "should return false for user being in the admins group" do
+        assert_equal false, @user.in_ldap_group?('cn=admins,ou=groups,dc=test,dc=com')
+      end
+
+      it "should return false for a user being in a nonexistent group" do
+        assert_equal false, @user.in_ldap_group?('cn=thisgroupdoesnotexist,ou=groups,dc=test,dc=com')
+      end
+    end
+    
+
+    describe "use role attribute for authorization" do
+      before do
+        @admin = Factory.create(:admin)
+        @user = Factory.create(:user)
+        ::Devise.ldap_check_attributes = true
+      end
+
+      it "should admin should be allowed in" do
+        should_be_validated @admin, "admin_secret"
+      end
+
+      it "should user should not be allowed in" do
+        should_not_be_validated @user, "secret"
+      end
+    end
+
+    describe "use admin setting to bind" do
+      before do
+        @admin = Factory.create(:admin)
+        @user = Factory.create(:user)
+        ::Devise.ldap_use_admin_to_bind = true
+      end
+
+      it "should description" do
+        should_be_validated @admin, "admin_secret"
+      end
+    end
+
+  end
+
+  describe "use uid for login" do
+    before do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_config = "#{Rails.root}/config/#{"ssl_" if ENV["LDAP_SSL"]}ldap_with_uid.yml"
+      ::Devise.authentication_keys = [:uid]
+    end
+
+    describe "description" do
+      before do
+        @admin = Factory.create(:admin)
+        @user = Factory.create(:user, :uid => "example_user")
+      end
+
+      it "should be able to authenticate using uid" do
+        should_be_validated @user, "secret"
+        should_not_be_validated @admin, "admin_secret"
+      end
+    end
+
+    describe "create user" do
+      before do
+        ::Devise.ldap_create_user = true
+      end
+
+      it "should create a user in the database" do
+        @user = User.authenticate_with_ldap(:uid => "example_user", :password => "secret")
+        assert_equal(User.all.size, 1)
+        User.all.collect(&:uid).should include("example_user")
+      end
+
+      it "should call ldap_before_save hooks" do
+        User.class_eval do
+          def ldap_before_save
+            @foobar = 'foobar'
+          end
+        end
+        user = User.authenticate_with_ldap(:uid => "example_user", :password => "secret")
+        assert_equal 'foobar', user.instance_variable_get(:"@foobar")
+        User.class_eval do
+          undef ldap_before_save
+        end
+      end
+
+      it "should not call ldap_before_save hook if not defined" do
+        assert_nothing_raised do
+          should_be_validated Factory.create(:user, :uid => "example_user"), "secret"
+        end
+      end
+    end
+  end
+
+  describe "using ERB in the config file" do
+    before do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_config = "#{Rails.root}/config/#{"ssl_" if ENV["LDAP_SSL"]}ldap_with_erb.yml"
+    end
+
+    describe "authenticate" do
+      before do
+        @admin = Factory.create(:admin)
+        @user = Factory.create(:user)
+      end
+
+      it "should be able to authenticate" do
+        should_be_validated @user, "secret"
+        should_be_validated @admin, "admin_secret"
+      end
+    end
+  end
+
+  describe "using variants in the config file" do
+    before do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_config = Rails.root.join 'config', 'ldap_with_boolean_ssl.yml'
+    end
+
+    it "should not fail if config file has ssl: true" do
+      assert_nothing_raised do
+        Devise::LdapAdapter::LdapConnect.new
+      end
+    end
+  end
+
+  describe "use username builder" do
+    before do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_auth_username_builder = Proc.new() do |attribute, login, ldap|
+        "#{attribute}=#{login},ou=others,dc=test,dc=com"
+      end
+      @other = Factory.create(:other)
+    end
+
+    it "should be able to authenticate" do
+      should_be_validated @other, "other_secret"
+    end
+  end
+
+end