github-ldap 1.3.3 → 1.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.travis.yml +15 -2
- data/CHANGELOG.md +13 -0
- data/Gemfile +4 -0
- data/README.md +15 -1
- data/Rakefile +1 -1
- data/github-ldap.gemspec +2 -2
- data/lib/github/ldap.rb +55 -12
- data/lib/github/ldap/domain.rb +6 -2
- data/lib/github/ldap/filter.rb +15 -7
- data/lib/github/ldap/group.rb +1 -1
- data/lib/github/ldap/instrumentation.rb +28 -0
- data/lib/github/ldap/membership_validators.rb +18 -0
- data/lib/github/ldap/membership_validators/active_directory.rb +56 -0
- data/lib/github/ldap/membership_validators/base.rb +37 -0
- data/lib/github/ldap/membership_validators/classic.rb +34 -0
- data/lib/github/ldap/membership_validators/recursive.rb +93 -0
- data/lib/github/ldap/server.rb +2 -0
- data/script/changelog +29 -0
- data/script/cibuild-apacheds +7 -0
- data/script/cibuild-openldap +7 -0
- data/script/install-openldap +44 -0
- data/script/package +7 -0
- data/script/release +16 -0
- data/test/domain_test.rb +71 -89
- data/test/filter_test.rb +12 -1
- data/test/fixtures/common/seed.ldif +369 -0
- data/test/fixtures/openldap/memberof.ldif +33 -0
- data/test/fixtures/openldap/slapd.conf.ldif +67 -0
- data/test/fixtures/posixGroup.schema.ldif +34 -8
- data/test/group_test.rb +19 -25
- data/test/ldap_test.rb +28 -21
- data/test/membership_validators/active_directory_test.rb +68 -0
- data/test/membership_validators/classic_test.rb +51 -0
- data/test/membership_validators/recursive_test.rb +56 -0
- data/test/membership_validators_test.rb +46 -0
- data/test/posix_group_test.rb +25 -28
- data/test/support/vm/openldap/.gitignore +1 -0
- data/test/support/vm/openldap/README.md +32 -0
- data/test/support/vm/openldap/Vagrantfile +35 -0
- data/test/test_helper.rb +72 -10
- metadata +52 -27
- data/test/fixtures/github-with-looped-subgroups.ldif +0 -82
- data/test/fixtures/github-with-missing-entries.ldif +0 -85
- data/test/fixtures/github-with-posixGroups.ldif +0 -50
- data/test/fixtures/github-with-subgroups.ldif +0 -146
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
module GitHub
|
|
2
|
+
class Ldap
|
|
3
|
+
module MembershipValidators
|
|
4
|
+
# Validates membership recursively.
|
|
5
|
+
#
|
|
6
|
+
# The first step checks whether the entry is a direct member of the given
|
|
7
|
+
# groups. If they are, then we've validated membership successfully.
|
|
8
|
+
#
|
|
9
|
+
# If not, query for all of the groups that have our groups as members,
|
|
10
|
+
# then we check if the entry is a member of any of those.
|
|
11
|
+
#
|
|
12
|
+
# This is repeated until the entry is found, recursing and requesting
|
|
13
|
+
# groups in bulk each iteration until we hit the maximum depth allowed
|
|
14
|
+
# and have to give up.
|
|
15
|
+
#
|
|
16
|
+
# This results in a maximum of `depth` queries (per domain) to validate
|
|
17
|
+
# membership in a list of groups.
|
|
18
|
+
class Recursive < Base
|
|
19
|
+
include Filter
|
|
20
|
+
|
|
21
|
+
DEFAULT_MAX_DEPTH = 9
|
|
22
|
+
ATTRS = %w(dn cn)
|
|
23
|
+
|
|
24
|
+
def perform(entry, depth = DEFAULT_MAX_DEPTH)
|
|
25
|
+
# short circuit validation if there are no groups to check against
|
|
26
|
+
return true if groups.empty?
|
|
27
|
+
|
|
28
|
+
domains.each do |domain|
|
|
29
|
+
# find groups entry is an immediate member of
|
|
30
|
+
membership = domain.search(filter: member_filter(entry), attributes: ATTRS)
|
|
31
|
+
|
|
32
|
+
# success if any of these groups match the restricted auth groups
|
|
33
|
+
return true if membership.any? { |entry| group_dns.include?(entry.dn) }
|
|
34
|
+
|
|
35
|
+
# give up if the entry has no memberships to recurse
|
|
36
|
+
next if membership.empty?
|
|
37
|
+
|
|
38
|
+
# recurse to at most `depth`
|
|
39
|
+
depth.times do |n|
|
|
40
|
+
# find groups whose members include membership groups
|
|
41
|
+
membership = domain.search(filter: membership_filter(membership), attributes: ATTRS)
|
|
42
|
+
|
|
43
|
+
# success if any of these groups match the restricted auth groups
|
|
44
|
+
return true if membership.any? { |entry| group_dns.include?(entry.dn) }
|
|
45
|
+
|
|
46
|
+
# give up if there are no more membersips to recurse
|
|
47
|
+
break if membership.empty?
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
# give up on this base if there are no memberships to test
|
|
51
|
+
next if membership.empty?
|
|
52
|
+
end
|
|
53
|
+
|
|
54
|
+
false
|
|
55
|
+
end
|
|
56
|
+
|
|
57
|
+
# Internal: Construct a filter to find groups this entry is a direct
|
|
58
|
+
# member of.
|
|
59
|
+
#
|
|
60
|
+
# Overloads the included `GitHub::Ldap::Filters#member_filter` method
|
|
61
|
+
# to inject `posixGroup` handling.
|
|
62
|
+
#
|
|
63
|
+
# Returns a Net::LDAP::Filter object.
|
|
64
|
+
def member_filter(entry_or_uid, uid = ldap.uid)
|
|
65
|
+
filter = super(entry_or_uid)
|
|
66
|
+
|
|
67
|
+
if ldap.posix_support_enabled?
|
|
68
|
+
if posix_filter = posix_member_filter(entry_or_uid, uid)
|
|
69
|
+
filter |= posix_filter
|
|
70
|
+
end
|
|
71
|
+
end
|
|
72
|
+
|
|
73
|
+
filter
|
|
74
|
+
end
|
|
75
|
+
|
|
76
|
+
# Internal: Construct a filter to find groups whose members are the
|
|
77
|
+
# Array of String group DNs passed in.
|
|
78
|
+
#
|
|
79
|
+
# Returns a String filter.
|
|
80
|
+
def membership_filter(groups)
|
|
81
|
+
groups.map { |entry| member_filter(entry, :cn) }.reduce(:|)
|
|
82
|
+
end
|
|
83
|
+
|
|
84
|
+
# Internal: the group DNs to check against.
|
|
85
|
+
#
|
|
86
|
+
# Returns an Array of String DNs.
|
|
87
|
+
def group_dns
|
|
88
|
+
@group_dns ||= groups.map(&:dn)
|
|
89
|
+
end
|
|
90
|
+
end
|
|
91
|
+
end
|
|
92
|
+
end
|
|
93
|
+
end
|
data/lib/github/ldap/server.rb
CHANGED
|
@@ -38,6 +38,8 @@ module GitHub
|
|
|
38
38
|
@server_options[:domain] = @server_options[:user_domain]
|
|
39
39
|
@server_options[:tmpdir] ||= server_tmp
|
|
40
40
|
|
|
41
|
+
@server_options[:quiet] = false if @server_options[:verbose]
|
|
42
|
+
|
|
41
43
|
@ldap_server = Ladle::Server.new(@server_options)
|
|
42
44
|
@ldap_server.start
|
|
43
45
|
end
|
data/script/changelog
ADDED
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
#!/usr/bin/env sh
|
|
2
|
+
# Usage: script/changelog [-r <repo>] [-b <base>] [-h <head>]
|
|
3
|
+
#
|
|
4
|
+
# repo: base string of GitHub repository url. e.g. "user_or_org/repository". Defaults to git remote url.
|
|
5
|
+
# base: git ref to compare from. e.g. "v1.3.1". Defaults to latest git tag.
|
|
6
|
+
# head: git ref to compare to. Defaults to "HEAD".
|
|
7
|
+
#
|
|
8
|
+
# Generate a changelog preview from pull requests merged between `base` and
|
|
9
|
+
# `head`.
|
|
10
|
+
#
|
|
11
|
+
set -e
|
|
12
|
+
|
|
13
|
+
[ $# -eq 0 ] && set -- --help
|
|
14
|
+
|
|
15
|
+
# parse args
|
|
16
|
+
repo=$(git remote -v | grep push | awk '{print $2}' | cut -d'/' -f4-)
|
|
17
|
+
base=$(git tag -l | sort -n | tail -n 1)
|
|
18
|
+
head="HEAD"
|
|
19
|
+
api_url="https://api.github.com"
|
|
20
|
+
|
|
21
|
+
echo "# $base..$head"
|
|
22
|
+
echo
|
|
23
|
+
|
|
24
|
+
# get merged PR's. Better way is to query the API for these, but this is easier
|
|
25
|
+
for pr in $(git log --oneline v1.3.6..HEAD | grep "Merge pull request" | awk '{gsub("#",""); print $5}')
|
|
26
|
+
do
|
|
27
|
+
# frustrated with trying to pull out the right values, fell back to ruby
|
|
28
|
+
curl -s "$api_url/repos/$repo/pulls/$pr" | ruby -rjson -e 'pr=JSON.parse(STDIN.read); puts "* #{pr[%q(title)]} [##{pr[%q(number)]}](#{pr[%q(html_url)]})"'
|
|
29
|
+
done
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
#!/usr/bin/env sh
|
|
2
|
+
set -e
|
|
3
|
+
set -x
|
|
4
|
+
|
|
5
|
+
BASE_PATH="$( cd `dirname $0`/../test/fixtures/openldap && pwd )"
|
|
6
|
+
SEED_PATH="$( cd `dirname $0`/../test/fixtures/common && pwd )"
|
|
7
|
+
|
|
8
|
+
DEBIAN_FRONTEND=noninteractive sudo -E apt-get install -y --force-yes slapd time ldap-utils
|
|
9
|
+
|
|
10
|
+
sudo /etc/init.d/slapd stop
|
|
11
|
+
|
|
12
|
+
TMPDIR=$(mktemp -d)
|
|
13
|
+
cd $TMPDIR
|
|
14
|
+
|
|
15
|
+
# Delete data and reconfigure.
|
|
16
|
+
sudo cp -v /var/lib/ldap/DB_CONFIG ./DB_CONFIG
|
|
17
|
+
sudo rm -rf /etc/ldap/slapd.d/*
|
|
18
|
+
sudo rm -rf /var/lib/ldap/*
|
|
19
|
+
sudo cp -v ./DB_CONFIG /var/lib/ldap/DB_CONFIG
|
|
20
|
+
sudo slapadd -F /etc/ldap/slapd.d -b "cn=config" -l $BASE_PATH/slapd.conf.ldif
|
|
21
|
+
# Load memberof and ref-int overlays and configure them.
|
|
22
|
+
sudo slapadd -F /etc/ldap/slapd.d -b "cn=config" -l $BASE_PATH/memberof.ldif
|
|
23
|
+
|
|
24
|
+
# Add base domain.
|
|
25
|
+
sudo slapadd -F /etc/ldap/slapd.d <<EOM
|
|
26
|
+
dn: dc=github,dc=com
|
|
27
|
+
objectClass: top
|
|
28
|
+
objectClass: domain
|
|
29
|
+
dc: github
|
|
30
|
+
EOM
|
|
31
|
+
|
|
32
|
+
sudo chown -R openldap.openldap /etc/ldap/slapd.d
|
|
33
|
+
sudo chown -R openldap.openldap /var/lib/ldap
|
|
34
|
+
|
|
35
|
+
sudo /etc/init.d/slapd start
|
|
36
|
+
|
|
37
|
+
# Import seed data.
|
|
38
|
+
# NOTE: use ldapadd in order for memberOf and refint to apply, instead of:
|
|
39
|
+
# /vagrant/services/ldap/openldap/seed.rb | sudo slapadd -F /etc/ldap/slapd.d
|
|
40
|
+
cat $SEED_PATH/seed.ldif |
|
|
41
|
+
/usr/bin/time sudo ldapadd -x -D "cn=admin,dc=github,dc=com" -w passworD1 \
|
|
42
|
+
-h localhost -p 389
|
|
43
|
+
|
|
44
|
+
sudo rm -rf $TMPDIR
|
data/script/package
ADDED
data/script/release
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
#!/usr/bin/env bash
|
|
2
|
+
# Usage: script/release
|
|
3
|
+
# Build the package, tag a commit, push it to origin, and then release the
|
|
4
|
+
# package publicly.
|
|
5
|
+
|
|
6
|
+
set -e
|
|
7
|
+
|
|
8
|
+
version="$(script/package | grep Version: | awk '{print $2}')"
|
|
9
|
+
[ -n "$version" ] || exit 1
|
|
10
|
+
|
|
11
|
+
echo $version
|
|
12
|
+
git commit --allow-empty -a -m "Release $version"
|
|
13
|
+
git tag "v$version"
|
|
14
|
+
git push origin
|
|
15
|
+
git push origin "v$version"
|
|
16
|
+
gem push pkg/*-${version}.gem
|
data/test/domain_test.rb
CHANGED
|
@@ -7,13 +7,13 @@ module GitHubLdapDomainTestCases
|
|
|
7
7
|
end
|
|
8
8
|
|
|
9
9
|
def test_user_valid_login
|
|
10
|
-
user = @domain.valid_login?('
|
|
11
|
-
assert_equal 'uid=
|
|
10
|
+
assert user = @domain.valid_login?('user1', 'passworD1')
|
|
11
|
+
assert_equal 'uid=user1,ou=People,dc=github,dc=com', user.dn
|
|
12
12
|
end
|
|
13
13
|
|
|
14
14
|
def test_user_with_invalid_password
|
|
15
|
-
assert !@domain.valid_login?('
|
|
16
|
-
"Login `
|
|
15
|
+
assert !@domain.valid_login?('user1', 'foo'),
|
|
16
|
+
"Login `user1` expected to be invalid with password `foo`"
|
|
17
17
|
end
|
|
18
18
|
|
|
19
19
|
def test_user_with_invalid_login
|
|
@@ -22,115 +22,123 @@ module GitHubLdapDomainTestCases
|
|
|
22
22
|
end
|
|
23
23
|
|
|
24
24
|
def test_groups_in_server
|
|
25
|
-
assert_equal 2, @domain.groups(%w(
|
|
25
|
+
assert_equal 2, @domain.groups(%w(ghe-users ghe-admins)).size
|
|
26
26
|
end
|
|
27
27
|
|
|
28
28
|
def test_user_in_group
|
|
29
|
-
user = @domain.valid_login?('
|
|
29
|
+
assert user = @domain.valid_login?('user1', 'passworD1')
|
|
30
30
|
|
|
31
|
-
assert @domain.is_member?(user, %w(
|
|
32
|
-
"Expected `
|
|
31
|
+
assert @domain.is_member?(user, %w(ghe-users ghe-admins)),
|
|
32
|
+
"Expected `ghe-users` or `ghe-admins` to include the member `#{user.dn}`"
|
|
33
33
|
end
|
|
34
34
|
|
|
35
35
|
def test_user_not_in_different_group
|
|
36
|
-
user = @domain.valid_login?('
|
|
36
|
+
user = @domain.valid_login?('user1', 'passworD1')
|
|
37
37
|
|
|
38
|
-
|
|
39
|
-
"Expected `
|
|
38
|
+
refute @domain.is_member?(user, %w(ghe-admins)),
|
|
39
|
+
"Expected `ghe-admins` not to include the member `#{user.dn}`"
|
|
40
40
|
end
|
|
41
41
|
|
|
42
42
|
def test_user_without_group
|
|
43
|
-
user = @domain.valid_login?('
|
|
43
|
+
user = @domain.valid_login?('groupless-user1', 'passworD1')
|
|
44
44
|
|
|
45
|
-
assert !@domain.is_member?(user, %w(
|
|
46
|
-
"Expected `
|
|
45
|
+
assert !@domain.is_member?(user, %w(all-users)),
|
|
46
|
+
"Expected `all-users` not to include the member `#{user.dn}`"
|
|
47
47
|
end
|
|
48
48
|
|
|
49
|
-
def
|
|
50
|
-
user = @domain.authenticate!('
|
|
51
|
-
assert_equal 'uid=
|
|
49
|
+
def test_authenticate_returns_valid_users
|
|
50
|
+
user = @domain.authenticate!('user1', 'passworD1')
|
|
51
|
+
assert_equal 'uid=user1,ou=People,dc=github,dc=com', user.dn
|
|
52
52
|
end
|
|
53
53
|
|
|
54
54
|
def test_authenticate_doesnt_return_invalid_users
|
|
55
|
-
|
|
55
|
+
refute @domain.authenticate!('user1', 'foo'),
|
|
56
56
|
"Expected `authenticate!` to not return an invalid user"
|
|
57
57
|
end
|
|
58
58
|
|
|
59
59
|
def test_authenticate_check_valid_user_and_groups
|
|
60
|
-
user = @domain.authenticate!('
|
|
60
|
+
user = @domain.authenticate!('user1', 'passworD1', %w(ghe-users ghe-admins))
|
|
61
61
|
|
|
62
|
-
assert_equal 'uid=
|
|
62
|
+
assert_equal 'uid=user1,ou=People,dc=github,dc=com', user.dn
|
|
63
63
|
end
|
|
64
64
|
|
|
65
65
|
def test_authenticate_doesnt_return_valid_users_in_different_groups
|
|
66
|
-
|
|
66
|
+
refute @domain.authenticate!('user1', 'passworD1', %w(ghe-admins)),
|
|
67
67
|
"Expected `authenticate!` to not return an user"
|
|
68
68
|
end
|
|
69
69
|
|
|
70
70
|
def test_membership_empty_for_non_members
|
|
71
|
-
user = @ldap.domain('uid=
|
|
71
|
+
user = @ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
72
72
|
|
|
73
|
-
assert @domain.membership(user, %w(
|
|
74
|
-
"Expected `
|
|
73
|
+
assert @domain.membership(user, %w(ghe-admins)).empty?,
|
|
74
|
+
"Expected `user1` not to be a member of `ghe-admins`."
|
|
75
75
|
end
|
|
76
76
|
|
|
77
77
|
def test_membership_groups_for_members
|
|
78
|
-
user = @ldap.domain('uid=
|
|
79
|
-
groups = @domain.membership(user, %w(
|
|
78
|
+
user = @ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
79
|
+
groups = @domain.membership(user, %w(ghe-users ghe-admins))
|
|
80
80
|
|
|
81
81
|
assert_equal 1, groups.size
|
|
82
|
-
assert_equal 'cn=
|
|
82
|
+
assert_equal 'cn=ghe-users,ou=Groups,dc=github,dc=com', groups.first.dn
|
|
83
83
|
end
|
|
84
84
|
|
|
85
85
|
def test_membership_with_virtual_attributes
|
|
86
86
|
ldap = GitHub::Ldap.new(options.merge(virtual_attributes: true))
|
|
87
|
-
|
|
88
|
-
user
|
|
87
|
+
|
|
88
|
+
user = ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
89
|
+
user[:memberof] = 'cn=ghe-admins,ou=Groups,dc=github,dc=com'
|
|
89
90
|
|
|
90
91
|
domain = ldap.domain("dc=github,dc=com")
|
|
91
|
-
groups = domain.membership(user, %w(
|
|
92
|
+
groups = domain.membership(user, %w(ghe-admins))
|
|
92
93
|
|
|
93
94
|
assert_equal 1, groups.size
|
|
94
|
-
assert_equal 'cn=
|
|
95
|
+
assert_equal 'cn=ghe-admins,ou=Groups,dc=github,dc=com', groups.first.dn
|
|
95
96
|
end
|
|
96
97
|
|
|
97
98
|
def test_search
|
|
98
99
|
assert 1, @domain.search(
|
|
99
100
|
attributes: %w(uid),
|
|
100
|
-
filter: Net::LDAP::Filter.eq('uid', '
|
|
101
|
+
filter: Net::LDAP::Filter.eq('uid', 'user1')).size
|
|
101
102
|
end
|
|
102
103
|
|
|
103
104
|
def test_search_override_base_name
|
|
104
105
|
assert 1, @domain.search(
|
|
105
106
|
base: "this base name is incorrect",
|
|
106
107
|
attributes: %w(uid),
|
|
107
|
-
filter: Net::LDAP::Filter.eq('uid', '
|
|
108
|
+
filter: Net::LDAP::Filter.eq('uid', 'user1')).size
|
|
108
109
|
end
|
|
109
110
|
|
|
110
111
|
def test_user_exists
|
|
111
|
-
|
|
112
|
+
assert user = @domain.user?('user1')
|
|
113
|
+
assert_equal 'uid=user1,ou=People,dc=github,dc=com', user.dn
|
|
112
114
|
end
|
|
113
115
|
|
|
114
116
|
def test_user_wildcards_are_filtered
|
|
115
|
-
|
|
117
|
+
refute @domain.user?('user*'), 'Expected uid `user*` to not complete'
|
|
116
118
|
end
|
|
117
119
|
|
|
118
120
|
def test_user_does_not_exist
|
|
119
|
-
|
|
121
|
+
refute @domain.user?('foobar'), 'Expected uid `foobar` to not exist.'
|
|
120
122
|
end
|
|
121
123
|
|
|
122
124
|
def test_user_returns_every_attribute
|
|
123
|
-
|
|
125
|
+
assert user = @domain.user?('user1')
|
|
126
|
+
assert_equal ['user1@github.com'], user[:mail]
|
|
127
|
+
end
|
|
128
|
+
|
|
129
|
+
def test_user_returns_subset_of_attributes
|
|
130
|
+
assert entry = @domain.user?('user1', :attributes => [:cn])
|
|
131
|
+
assert_equal [:dn, :cn], entry.attribute_names
|
|
124
132
|
end
|
|
125
133
|
|
|
126
134
|
def test_auth_binds
|
|
127
|
-
user = @domain.user?('
|
|
128
|
-
assert @domain.auth(user, 'passworD1'), 'Expected user to
|
|
135
|
+
assert user = @domain.user?('user1')
|
|
136
|
+
assert @domain.auth(user, 'passworD1'), 'Expected user to bind'
|
|
129
137
|
end
|
|
130
138
|
|
|
131
139
|
def test_auth_does_not_bind
|
|
132
|
-
user = @domain.user?('
|
|
133
|
-
|
|
140
|
+
assert user = @domain.user?('user1')
|
|
141
|
+
refute @domain.auth(user, 'foo'), 'Expected user not not bind'
|
|
134
142
|
end
|
|
135
143
|
end
|
|
136
144
|
|
|
@@ -143,48 +151,37 @@ class GitHubLdapDomainUnauthenticatedTest < GitHub::Ldap::UnauthenticatedTest
|
|
|
143
151
|
end
|
|
144
152
|
|
|
145
153
|
class GitHubLdapDomainNestedGroupsTest < GitHub::Ldap::Test
|
|
146
|
-
def self.test_server_options
|
|
147
|
-
{user_fixtures: FIXTURES.join('github-with-subgroups.ldif').to_s}
|
|
148
|
-
end
|
|
149
|
-
|
|
150
154
|
def setup
|
|
151
155
|
@ldap = GitHub::Ldap.new(options)
|
|
152
156
|
@domain = @ldap.domain("dc=github,dc=com")
|
|
153
157
|
end
|
|
154
158
|
|
|
155
159
|
def test_membership_in_subgroups
|
|
156
|
-
user = @ldap.domain('uid=
|
|
160
|
+
user = @ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
157
161
|
|
|
158
|
-
assert @domain.is_member?(user, %w(
|
|
159
|
-
"Expected `
|
|
162
|
+
assert @domain.is_member?(user, %w(nested-groups)),
|
|
163
|
+
"Expected `nested-groups` to include the member `#{user.dn}`"
|
|
160
164
|
end
|
|
161
165
|
|
|
162
166
|
def test_membership_in_deeply_nested_subgroups
|
|
163
|
-
assert user = @ldap.domain('uid=user1
|
|
167
|
+
assert user = @ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
164
168
|
|
|
165
|
-
assert @domain.is_member?(user, %w(
|
|
166
|
-
"Expected `
|
|
169
|
+
assert @domain.is_member?(user, %w(n-depth-nested-group4)),
|
|
170
|
+
"Expected `n-depth-nested-group4` to include the member `#{user.dn}` via deep recursion"
|
|
167
171
|
end
|
|
168
172
|
end
|
|
169
173
|
|
|
170
174
|
class GitHubLdapPosixGroupsWithRecursionFallbackTest < GitHub::Ldap::Test
|
|
171
|
-
def self.test_server_options
|
|
172
|
-
{
|
|
173
|
-
custom_schemas: FIXTURES.join('posixGroup.schema.ldif'),
|
|
174
|
-
user_fixtures: FIXTURES.join('github-with-posixGroups.ldif').to_s,
|
|
175
|
-
# so we exercise the recursive group search fallback
|
|
176
|
-
recursive_group_search_fallback: true
|
|
177
|
-
}
|
|
178
|
-
end
|
|
179
|
-
|
|
180
175
|
def setup
|
|
181
|
-
|
|
176
|
+
opts = options.merge \
|
|
177
|
+
recursive_group_search_fallback: true
|
|
178
|
+
@ldap = GitHub::Ldap.new(opts)
|
|
182
179
|
@domain = @ldap.domain("dc=github,dc=com")
|
|
183
|
-
@cn = "
|
|
180
|
+
@cn = "posix-group1"
|
|
184
181
|
end
|
|
185
182
|
|
|
186
183
|
def test_membership_for_posixGroups
|
|
187
|
-
assert user = @ldap.domain('uid=
|
|
184
|
+
assert user = @ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
188
185
|
|
|
189
186
|
assert @domain.is_member?(user, [@cn]),
|
|
190
187
|
"Expected `#{@cn}` to include the member `#{user.dn}`"
|
|
@@ -192,23 +189,16 @@ class GitHubLdapPosixGroupsWithRecursionFallbackTest < GitHub::Ldap::Test
|
|
|
192
189
|
end
|
|
193
190
|
|
|
194
191
|
class GitHubLdapPosixGroupsWithoutRecursionTest < GitHub::Ldap::Test
|
|
195
|
-
def self.test_server_options
|
|
196
|
-
{
|
|
197
|
-
custom_schemas: FIXTURES.join('posixGroup.schema.ldif'),
|
|
198
|
-
user_fixtures: FIXTURES.join('github-with-posixGroups.ldif').to_s,
|
|
199
|
-
# so we test the test the non-recursive group membership search
|
|
200
|
-
recursive_group_search_fallback: false
|
|
201
|
-
}
|
|
202
|
-
end
|
|
203
|
-
|
|
204
192
|
def setup
|
|
205
|
-
|
|
193
|
+
opts = options.merge \
|
|
194
|
+
recursive_group_search_fallback: false
|
|
195
|
+
@ldap = GitHub::Ldap.new(opts)
|
|
206
196
|
@domain = @ldap.domain("dc=github,dc=com")
|
|
207
|
-
@cn = "
|
|
197
|
+
@cn = "posix-group1"
|
|
208
198
|
end
|
|
209
199
|
|
|
210
200
|
def test_membership_for_posixGroups
|
|
211
|
-
assert user = @ldap.domain('uid=
|
|
201
|
+
assert user = @ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
212
202
|
|
|
213
203
|
assert @domain.is_member?(user, [@cn]),
|
|
214
204
|
"Expected `#{@cn}` to include the member `#{user.dn}`"
|
|
@@ -218,25 +208,17 @@ end
|
|
|
218
208
|
# Specifically testing that this doesn't break when posixGroups are not
|
|
219
209
|
# supported.
|
|
220
210
|
class GitHubLdapWithoutPosixGroupsTest < GitHub::Ldap::Test
|
|
221
|
-
def self.test_server_options
|
|
222
|
-
{
|
|
223
|
-
custom_schemas: FIXTURES.join('posixGroup.schema.ldif'),
|
|
224
|
-
user_fixtures: FIXTURES.join('github-with-posixGroups.ldif').to_s,
|
|
225
|
-
# so we test the test the non-recursive group membership search
|
|
226
|
-
recursive_group_search_fallback: false,
|
|
227
|
-
# explicitly disable posixGroup support (even if the schema supports it)
|
|
228
|
-
posix_support: false
|
|
229
|
-
}
|
|
230
|
-
end
|
|
231
|
-
|
|
232
211
|
def setup
|
|
233
|
-
|
|
212
|
+
opts = options.merge \
|
|
213
|
+
recursive_group_search_fallback: false, # test non-recursive group membership search
|
|
214
|
+
posix_support: false # disable posixGroup support
|
|
215
|
+
@ldap = GitHub::Ldap.new(opts)
|
|
234
216
|
@domain = @ldap.domain("dc=github,dc=com")
|
|
235
|
-
@cn = "
|
|
217
|
+
@cn = "posix-group1"
|
|
236
218
|
end
|
|
237
219
|
|
|
238
220
|
def test_membership_for_posixGroups
|
|
239
|
-
assert user = @ldap.domain('uid=
|
|
221
|
+
assert user = @ldap.domain('uid=user1,ou=People,dc=github,dc=com').bind
|
|
240
222
|
|
|
241
223
|
refute @domain.is_member?(user, [@cn]),
|
|
242
224
|
"Expected `#{@cn}` to not include the member `#{user.dn}`"
|