ldap_fluff 0.1.1

data/etc/ldap_fluff.yml

@@ -0,0 +1,9 @@
+---
+host: ## ip address or hostname
+encryption: ## blank or :start_tls
+base_dn: ## baseDN for ldap auth, eg dc=redhat,dc=com
+group_base: ##baseDN for your ldap groups, eg ou=Groups,dc=redhat,dc=com
+server_type: ## type of server. default == posix. :active_directory, :posix, :free_ipa
+ad_domain: ## domain for your users if using active directory, eg redhat.com
+ad_service_user: ## service account for authenticating ldap calls in active directory 
+ad_service_pass: ## service password for authenticating ldap calls in active directory 

data/lib/ldap_fluff/active_directory.rb

@@ -0,0 +1,63 @@
+class LdapFluff::ActiveDirectory
+  attr_accessor :ldap, :member_service
+
+  def initialize(config={})
+    @ldap = Net::LDAP.new :host => config.host,
+                         :base => config.base_dn,
+                         :port => config.port,
+                         :encryption => config.encryption
+    @group_base = config.group_base
+    @group_base ||= config.base_dn
+    @ad_domain = config.domain
+    @bind_user = config.service_user
+    @bind_pass = config.service_pass
+    @anon = config.ad_anon_queries
+
+    @member_service = MemberService.new(@ldap,@group_base)
+  end
+
+  def bind?(uid=nil, password=nil)
+    @ldap.auth "#{uid}@#{@ad_domain}", password
+    @ldap.bind
+  end
+
+  # AD generally does not support un-authenticated searching
+  # Typically AD admins configure a public user for searching
+  def service_bind
+    unless @anon || bind?(@bind_user, @bind_pass)
+      raise UnauthenticatedActiveDirectoryException, "Could not bind to AD Service User"
+    end
+  end
+
+  # returns the list of groups to which a user belongs
+  # this query is simpler in active directory
+  def groups_for_uid(uid)
+    service_bind
+    begin
+      @member_service.find_user_groups(uid)
+    rescue MemberService::UIDNotFoundException
+      return []
+    end
+  end
+
+  # active directory stores group membership on a users model
+  # TODO query by group individually not like this
+  def is_in_groups(uid, gids = [], all = false)
+    service_bind
+    return true if gids == []
+    begin
+      groups = @member_service.find_user_groups(uid)
+      intersection = gids & groups
+      if all
+        return intersection == gids
+      else
+        return intersection.size > 0
+      end
+    rescue MemberService::UIDNotFoundException
+      return false
+    end
+  end
+
+  class UnauthenticatedActiveDirectoryException < StandardError
+  end
+end

data/lib/ldap_fluff/ad_member_service.rb

@@ -0,0 +1,75 @@
+require 'net/ldap'
+
+# Naughty bits of active directory ldap queries
+class LdapFluff::ActiveDirectory::MemberService
+
+  attr_accessor :ldap
+
+  def initialize(ldap,group_base)
+    @ldap = ldap
+    @group_base = group_base
+  end
+
+  # get a list [] of ldap groups for a given user
+  # in active directory, this means a recursive lookup
+  def find_user_groups(uid)
+    data = @ldap.search(:filter => name_filter(uid))
+    raise UIDNotFoundException if (data == nil || data.empty?)
+    _groups_from_ldap_data(data.first)
+  end
+
+  # return the :memberof attrs + parents, recursively
+  def _groups_from_ldap_data(payload)
+    data = []
+    if payload != nil
+      first_level = _group_names_from_cn(payload[:memberof])
+      total_groups = _walk_group_ancestry(first_level)
+      data = (first_level + total_groups).uniq
+    end
+    data
+  end
+
+  # recursively loop over the parent list
+  def _walk_group_ancestry(gids=[])
+    set = []
+    gids.each do |g|
+      filter = group_filter(g) & class_filter
+      search = @ldap.search(:filter => filter, :base => @group_base)
+      if search != nil && search.first != nil
+        group = search.first
+        set += _group_names_from_cn(group[:memberof])
+        set += _walk_group_ancestry(set)
+      end
+    end
+    set
+  end
+
+  def group_filter(gid)
+    Net::LDAP::Filter.eq("cn", gid)
+  end
+
+  def class_filter
+    Net::LDAP::Filter.eq("objectclass","group")
+  end
+
+  def name_filter(uid)
+    Net::LDAP::Filter.eq("samaccountname",uid)
+  end
+
+  # extract the group names from the LDAP style response,
+  # return string will be something like
+  # CN=bros,OU=bropeeps,DC=jomara,DC=redhat,DC=com
+  #
+  # AD group proc from
+  # http://erniemiller.org/2008/04/04/simplified-active-directory-authentication/
+  #
+  # I think we would normally want to just do the collect at the end,
+  # but we need the individual names for recursive queries
+  def _group_names_from_cn(grouplist)
+    p = Proc.new { |g| g.sub(/.*?CN=(.*?),.*/, '\1') }
+    grouplist.collect(&p)
+  end
+
+  class UIDNotFoundException < StandardError
+  end
+end

data/lib/ldap_fluff/config.rb

@@ -0,0 +1,51 @@
+require 'singleton'
+require 'yaml'
+
+class LdapFluff
+  ####################################################################
+  # Module constants
+  ####################################################################
+  CONFIG = "/etc/ldap_fluff.yml"
+  ####################################################################
+  # Module class definitions
+  ####################################################################
+  class Config
+    include Singleton
+    attr_accessor :host,
+                  :port,
+                  :encryption,
+                  :base_dn,
+                  :group_base,
+                  :server_type,
+                  :ad_domain,
+                  :service_user,
+                  :service_pass,
+                  :anon_queries
+
+    def initialize
+      begin
+        config = YAML.load_file(LdapFluff::CONFIG)
+        @host = config["host"]
+        @port = config["port"]
+        if config["encryption"].respond_to? :to_sym
+          @encryption = config["encryption"].to_sym
+        else
+          @encryption = nil
+        end
+        @base_dn = config["base_dn"]
+        @group_base = config["group_base"]
+        @ad_domain = config["ad_domain"]
+        @service_user = config["service_user"]
+        @service_pass = config["service_pass"]
+        @anon_queries = config["anon_queries"]
+        @server_type = config["server_type"]
+      rescue Errno::ENOENT
+        $stderr.puts("The #{LdapFluff::CONFIG} config file you specified was not found")
+        exit
+      rescue Errno::EACCES
+        $stderr.puts("The #{LdapFluff::CONFIG} config file you specified is not readable")
+        exit
+      end
+    end
+  end
+end

data/lib/ldap_fluff/freeipa.rb

@@ -0,0 +1,65 @@
+class LdapFluff::FreeIPA
+
+  attr_accessor :ldap, :member_service
+
+  def initialize(config={})
+    @ldap = Net::LDAP.new :host => config.host,
+                         :base => config.base_dn,
+                         :port => config.port,
+                         :encryption => config.encryption
+    @group_base = config.group_base
+    @group_base ||= config.base
+    @base = config.base_dn
+    @bind_user = config.service_user
+    @bind_pass = config.service_pass
+    @anon = config.anon_queries
+
+    @member_service = MemberService.new(@ldap,@group_base)
+  end
+
+  def bind?(uid=nil, password=nil)
+    @ldap.auth "uid=#{uid},cn=users,cn=accounts,#{@base}", password
+    @ldap.bind
+  end
+
+  def groups_for_uid(uid)
+    service_bind
+    begin
+      @member_service.find_user_groups(uid)
+    rescue MemberService::UIDNotFoundException
+      return []
+    rescue MemberService::InsufficientQueryPrivilegesException
+      raise UnauthenticatedFreeIPAException, "Insufficient Privileges to query groups data"
+    end
+  end
+
+  # AD generally does not support un-authenticated searching
+  # Typically AD admins configure a public user for searching
+  def service_bind
+    unless @anon || bind?(@bind_user, @bind_pass)
+      raise UnauthenticatedFreeIPAException, "Could not bind to FreeIPA Query User"
+    end
+  end
+
+  # In freeipa, a simple user query returns a full set
+  # of nested groups! yipee
+  #
+  # gids should be an array of group common names
+  #
+  # returns true if owner is in ALL of the groups if all=true, otherwise
+  # returns true if owner is in ANY of the groups
+  def is_in_groups(uid, gids = [], all=true)
+    service_bind
+    groups = @member_service.find_user_groups(uid)
+    if all
+      return groups & gids == gids
+    else
+      return groups & gids != []
+    end
+  end
+
+  class UnauthenticatedFreeIPAException < StandardError
+  end
+
+end
+

data/lib/ldap_fluff/freeipa_member_service.rb

@@ -0,0 +1,39 @@
+require 'net/ldap'
+
+# handles the naughty bits of posix ldap
+class LdapFluff::FreeIPA::MemberService
+
+  attr_accessor :ldap
+
+  def initialize(ldap,group_base)
+    @ldap = ldap
+    @group_base = group_base
+  end
+
+  # return an ldap user with groups attached
+  # note : this method is not particularly fast for large ldap systems
+  def find_user_groups(uid)
+    user = @ldap.search(:filter => name_filter(uid))
+    raise UIDNotFoundException if (user == nil || user.empty?)
+    # if group data is missing, they aren't querying with a user
+    # with enough privileges
+    raise InsufficientQueryPrivilegesException if user.size <= 1
+    _group_names_from_cn(user[1][:memberof])
+  end
+
+  def name_filter(uid)
+    Net::LDAP::Filter.eq("uid",uid)
+  end
+
+  def _group_names_from_cn(grouplist)
+    p = Proc.new { |g| g.sub(/.*?cn=(.*?),.*/, '\1') }
+    grouplist.collect(&p)
+  end
+
+  class UIDNotFoundException < StandardError
+  end
+
+  class InsufficientQueryPrivilegesException < StandardError
+  end
+end
+

data/lib/ldap_fluff/ldap_fluff.rb

@@ -0,0 +1,40 @@
+require 'net/ldap'
+
+class LdapFluff
+
+  attr_accessor :ldap
+
+  def initialize(config=nil)
+    config ||= LdapFluff::Config.instance
+    type = config.server_type
+    if type.respond_to? :to_sym
+      if type.to_sym == :posix
+        @ldap = Posix.new(config)
+      elsif type.to_sym == :active_directory
+        @ldap = ActiveDirectory.new(config)
+      elsif type.to_sym == :free_ipa
+        @ldap = FreeIPA.new(config)
+      else
+        raise Exception, "Unsupported connection type. Supported types = :active_directory, :posix, :free_ipa"
+      end
+    end
+  end
+
+  # return true if the user password combination
+  # authenticates the user, otherwise false
+  def authenticate?(uid, password)
+    @ldap.bind? uid, password
+  end
+
+  # return a list[] of groups for a given uid
+  def group_list(uid)
+    @ldap.groups_for_uid(uid)
+  end
+
+  # return true if a user is in all of the groups
+  # in grouplist
+  def is_in_groups?(uid, grouplist)
+    @ldap.is_in_groups(uid, grouplist, true)
+  end
+
+end

data/lib/ldap_fluff/posix.rb

@@ -0,0 +1,36 @@
+class LdapFluff::Posix
+
+  attr_accessor :ldap, :member_service
+
+  def initialize(config={})
+    @ldap = Net::LDAP.new :host => config.host,
+                         :base => config.base_dn,
+                         :port => config.port,
+                         :encryption => config.encryption
+    @group_base = config.group_base
+    @group_base ||= config.base
+    @base = config.base_dn
+    @member_service = MemberService.new(@ldap,@group_base)
+  end
+
+  def bind?(uid=nil, password=nil)
+    @ldap.auth "uid=#{uid},#{@base}", password
+    @ldap.bind
+  end
+
+  def groups_for_uid(uid)
+    @member_service.find_user_groups(uid)
+  end
+
+  # returns whether a user is a member of ALL or ANY particular groups
+  # note: this method is much faster than groups_for_uid
+  #
+  # gids should be an array of group common names
+  #
+  # returns true if owner is in ALL of the groups if all=true, otherwise
+  # returns true if owner is in ANY of the groups
+  def is_in_groups(uid, gids = [], all=true)
+    (gids.empty? || @member_service.times_in_groups(uid, gids, all) > 0)
+  end
+
+end

data/lib/ldap_fluff/posix_member_service.rb

@@ -0,0 +1,56 @@
+require 'net/ldap'
+
+# handles the naughty bits of posix ldap
+class LdapFluff::Posix::MemberService
+
+  attr_accessor :ldap
+
+  def initialize(ldap,group_base)
+    @ldap = ldap
+    @group_base = group_base
+  end
+
+  # return an ldap user with groups attached
+  # note : this method is not particularly fast for large ldap systems
+  def find_user_groups(uid)
+    groups = []
+    @ldap.search(:filter => name_filter(uid), :base => @group_base).each do |entry|
+      groups << entry[:cn][0]
+    end
+    groups
+  end
+
+  def times_in_groups(uid, gids, all)
+    matches = 0
+    filters = []
+    gids.each do |cn|
+      filters << group_filter(cn)
+    end
+    group_filters = merge_filters(filters,all)
+    filter = name_filter(uid) & group_filters
+    @ldap.search(:base => @group_base, :filter => filter).size
+  end
+
+  def name_filter(uid)
+    Net::LDAP::Filter.eq("memberUid",uid)
+  end
+
+  def group_filter(cn)
+    Net::LDAP::Filter.eq("cn", cn)
+  end
+
+  # AND or OR all of the filters together
+  def merge_filters(filters = [], all=false)
+    if filters != nil && filters.size >= 1
+      filter = filters[0]
+      filters[1..filters.size-1].each do |gfilter|
+        if all
+          filter = filter & gfilter
+        else
+          filter = filter | gfilter
+        end
+      end
+      return filter
+    end
+  end
+end

data/lib/ldap_fluff.rb

@@ -0,0 +1,8 @@
+require 'ldap_fluff/config'
+require 'ldap_fluff/ldap_fluff'
+require 'ldap_fluff/active_directory'
+require 'ldap_fluff/ad_member_service'
+require 'ldap_fluff/posix'
+require 'ldap_fluff/posix_member_service'
+require 'ldap_fluff/freeipa'
+require 'ldap_fluff/freeipa_member_service'

data/test/ad_member_services_test.rb

@@ -0,0 +1,85 @@
+require 'minitest/autorun'
+
+class TestADMemberService < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+    @ldap = MiniTest::Mock.new
+    @adms = LdapFluff::ActiveDirectory::MemberService.new(@ldap,@config.group_base)
+    @gfilter = group_filter('group') & group_class_filter
+  end
+
+  def basic_user
+    @ldap.expect(:search, ad_user_payload, [:filter => ad_name_filter("john")])
+    @ldap.expect(:search, ad_parent_payload(1), [:filter => @gfilter, :base => @config.group_base])
+  end
+
+  def nest_deep(n)
+    # add all the expects
+    for i in 1..(n-1)
+      gfilter_bros = group_filter("bros#{i}") & group_class_filter
+      @ldap.expect(:search, ad_parent_payload(i+1), [:filter => gfilter_bros, :base => @config.group_base])
+    end
+    # terminate or we loop FOREVER
+    @ldap.expect(:search,[], [:filter => group_filter("bros#{n}") & group_class_filter, :base => @config.group_base])
+  end
+
+  def double_nested(n)
+    # add all the expects
+    for i in 1..(n-1)
+      gfilter_bros = group_filter("bros#{i}") & group_class_filter
+      @ldap.expect(:search, ad_double_payload(i+1), [:filter => gfilter_bros, :base => @config.group_base])
+    end
+    # terminate or we loop FOREVER
+    @ldap.expect(:search,[], [:filter => group_filter("bros#{n}") & group_class_filter, :base => @config.group_base])
+    (n-1).downto(1) do |i|
+      gfilter_bros = group_filter("broskies#{i+1}") & group_class_filter
+      @ldap.expect(:search,[], [:filter => gfilter_bros, :base => @config.group_base])
+    end
+  end
+
+  def test_find_user
+    basic_user
+    gfilter_bros = group_filter('bros1') & group_class_filter
+    @ldap.expect(:search, [], [:filter => gfilter_bros, :base => @config.group_base])
+    @adms.ldap = @ldap
+    assert_equal ['group', 'bros1'], @adms.find_user_groups("john")
+    @ldap.verify
+  end
+
+  def test_missing_user
+    @ldap.expect(:search, nil, [:filter => ad_name_filter("john")])
+    @adms.ldap = @ldap
+    assert_raises(LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException) { @adms.find_user_groups("john").data }
+    @ldap.verify
+  end
+
+  def test_some_deep_recursion
+    basic_user
+    nest_deep(25)
+    @adms.ldap = @ldap
+    assert_equal 26, @adms.find_user_groups('john').size
+    @ldap.verify
+  end
+
+  def test_complex_recursion
+    basic_user
+    double_nested(5)
+    @adms.ldap = @ldap
+    assert_equal 10, @adms.find_user_groups('john').size
+    @ldap.verify
+  end
+
+  def test_nil_payload
+    assert_equal [], @adms._groups_from_ldap_data(nil)
+  end
+
+  def test_empty_user
+    @ldap.expect(:search, [], [:filter => ad_name_filter("john")])
+    @adms.ldap = @ldap
+    assert_raises(LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException) { @adms.find_user_groups("john").data }
+    @ldap.verify
+  end
+
+end

data/test/ad_test.rb

@@ -0,0 +1,100 @@
+require 'minitest/autorun'
+
+class TestAD < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+    @ad = LdapFluff::ActiveDirectory.new(@config)
+    @ldap = MiniTest::Mock.new
+  end
+
+  # default setup for service bind users
+  def service_bind
+    @ldap.expect(:auth, nil, ["service@internet.com","pass"])
+    @ldap.expect(:bind, true)
+    @ad.ldap = @ldap
+  end
+
+  def basic_user
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, ['bros'], ["john"])
+    @ad.member_service = @md
+  end
+
+  def bigtime_user
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, ['bros','broskies'], ["john"])
+    @ad.member_service = @md
+  end
+
+  def test_good_bind
+    @ldap.expect(:auth, nil, ["internet@internet.com","password"])
+    @ldap.expect(:bind, true)
+    @ad.ldap = @ldap
+    assert_equal @ad.bind?("internet", "password"), true
+    @ldap.verify
+  end
+
+  def test_bad_bind
+    @ldap.expect(:auth, nil, ["internet@internet.com","password"])
+    @ldap.expect(:bind, false)
+    @ad.ldap = @ldap
+    assert_equal @ad.bind?("internet", "password"), false
+    @ldap.verify
+  end
+
+  def test_groups
+    service_bind
+    basic_user
+    assert_equal @ad.groups_for_uid('john'), ['bros']
+  end
+
+  def test_bad_user
+    service_bind
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, nil, ["john"])
+    def @md.find_user_groups(*args)
+      raise LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException
+    end
+    @ad.member_service = @md
+    assert_equal @ad.groups_for_uid('john'), []
+  end
+
+  def test_bad_service_user
+    @ldap.expect(:auth, nil, ["service@internet.com","pass"])
+    @ldap.expect(:bind, false)
+    @ad.ldap = @ldap
+    assert_raises(LdapFluff::ActiveDirectory::UnauthenticatedActiveDirectoryException) { @ad.groups_for_uid('john') }
+  end
+
+  def test_is_in_groups
+    service_bind
+    basic_user
+    assert_equal @ad.is_in_groups("john",["bros"],false), true
+  end
+
+  def test_is_some_groups
+    service_bind
+    basic_user
+    assert_equal @ad.is_in_groups("john",["bros","buds"],false), true
+  end
+
+  def test_isnt_in_all_groups
+    service_bind
+    basic_user
+    assert_equal @ad.is_in_groups("john",["bros","buds"],true), false
+  end
+
+  def test_isnt_in_groups
+    service_bind
+    basic_user
+    assert_equal @ad.is_in_groups("john", ["broskies"],false), false
+  end
+
+  def test_group_subset
+    service_bind
+    bigtime_user
+    assert_equal @ad.is_in_groups("john", ["broskies"],true), true
+  end
+end

data/test/config_test.rb

@@ -0,0 +1,34 @@
+require 'minitest/autorun'
+require 'ldap_fluff'
+
+class ConfigTest < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+  end
+
+  def test_unsupported_type
+    @config.server_type = "inactive_directory"
+    assert_raises(Exception) { LdapFluff.new(@config) }
+  end
+
+  def test_load_posix
+    @config.server_type = "posix"
+    l = LdapFluff.new(@config)
+    assert_instance_of LdapFluff::Posix, l.ldap
+  end
+
+  def test_load_ad
+    @config.server_type = "active_directory"
+    l = LdapFluff.new(@config)
+    assert_instance_of LdapFluff::ActiveDirectory, l.ldap
+  end
+
+  def test_load_ad
+    @config.server_type = "free_ipa"
+    l = LdapFluff.new(@config)
+    assert_instance_of LdapFluff::FreeIPA, l.ldap
+  end
+
+end

data/test/ipa_member_services_test.rb

@@ -0,0 +1,36 @@
+require 'minitest/autorun'
+
+class TestIPAMemberService < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+    @ldap = MiniTest::Mock.new
+    @ipams = LdapFluff::FreeIPA::MemberService.new(@ldap,@config.group_base)
+  end
+
+  def basic_user
+    @ldap.expect(:search, ipa_user_payload, [:filter => ipa_name_filter("john")])
+  end
+
+  def test_find_user
+    basic_user
+    @ipams.ldap = @ldap
+    assert_equal ['group', 'bros'], @ipams.find_user_groups("john")
+    @ldap.verify
+  end
+
+  def test_missing_user
+    @ldap.expect(:search, nil, [:filter => ipa_name_filter("john")])
+    @ipams.ldap = @ldap
+    assert_raises(LdapFluff::FreeIPA::MemberService::UIDNotFoundException) { @ipams.find_user_groups("john").data }
+    @ldap.verify
+  end
+
+  def test_no_groups
+    @ldap.expect(:search, ['',{:memberof=>[]}], [:filter => ipa_name_filter("john")])
+    @ipams.ldap = @ldap
+    assert_equal [], @ipams.find_user_groups('john')
+    @ldap.verify
+  end
+end

data/test/ipa_test.rb

@@ -0,0 +1,101 @@
+require 'minitest/autorun'
+
+class TestIPA < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+    @ipa = LdapFluff::FreeIPA.new(@config)
+    @ldap = MiniTest::Mock.new
+  end
+
+  # default setup for service bind users
+  def service_bind
+    @ldap.expect(:auth, nil, [ipa_user_bind('service'),"pass"])
+    @ldap.expect(:bind, true)
+    @ipa.ldap = @ldap
+  end
+
+  def basic_user
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, ['bros'], ["john"])
+    @ipa.member_service = @md
+  end
+
+  def bigtime_user
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, ['bros','broskies'], ["john"])
+    @ipa.member_service = @md
+  end
+
+  def test_good_bind
+    @ldap.expect(:auth, nil, [ipa_user_bind('internet'),"password"])
+    @ldap.expect(:bind, true)
+    @ipa.ldap = @ldap
+    assert_equal @ipa.bind?("internet", "password"), true
+    @ldap.verify
+  end
+
+  def test_bad_bind
+    @ldap.expect(:auth, nil, [ipa_user_bind('internet'),"password"])
+    @ldap.expect(:bind, false)
+    @ipa.ldap = @ldap
+    assert_equal @ipa.bind?("internet", "password"), false
+    @ldap.verify
+  end
+
+  def test_groups
+    service_bind
+    basic_user
+    assert_equal @ipa.groups_for_uid('john'), ['bros']
+  end
+
+  def test_bad_user
+    service_bind
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, nil, ["john"])
+    def @md.find_user_groups(*args)
+      raise LdapFluff::FreeIPA::MemberService::UIDNotFoundException
+    end
+    @ipa.member_service = @md
+    assert_equal @ipa.groups_for_uid('john'), []
+  end
+
+  def test_bad_service_user
+    @ldap.expect(:auth, nil, [ipa_user_bind('service'),"pass"])
+    @ldap.expect(:bind, false)
+    @ipa.ldap = @ldap
+    assert_raises(LdapFluff::FreeIPA::UnauthenticatedFreeIPAException) { @ipa.groups_for_uid('john') }
+  end
+
+  def test_is_in_groups
+    service_bind
+    basic_user
+    assert_equal @ipa.is_in_groups("john",["bros"],false), true
+  end
+
+  def test_is_some_groups
+    service_bind
+    basic_user
+    assert_equal @ipa.is_in_groups("john",["bros","buds"],false), true
+  end
+
+  def test_isnt_in_all_groups
+    service_bind
+    basic_user
+    assert_equal @ipa.is_in_groups("john",["bros","buds"],true), false
+  end
+
+  def test_isnt_in_groups
+    service_bind
+    basic_user
+    assert_equal @ipa.is_in_groups("john", ["broskies"],false), false
+  end
+
+  def test_group_subset
+    service_bind
+    bigtime_user
+    assert_equal @ipa.is_in_groups('john',["broskies"],true), true
+  end
+end
+

data/test/ldap_test.rb

@@ -0,0 +1,34 @@
+require 'minitest/autorun'
+
+class TestLDAP < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+    @ldap = MiniTest::Mock.new
+    @fluff = LdapFluff.new(@config)
+  end
+
+  def test_bind
+    @ldap.expect(:bind?, true, ['john','password'])
+    @fluff.ldap = @ldap
+    assert_equal @fluff.authenticate?("john","password"), true
+    @ldap.verify
+  end
+
+  def test_groups
+    @ldap.expect(:groups_for_uid, ['bros'], ['john'])
+    @fluff.ldap = @ldap
+    assert_equal @fluff.group_list('john'), ['bros']
+    @ldap.verify
+  end
+
+  def test_group_membership
+    @ldap.expect(:is_in_groups, false, ['john',['broskies','girlfriends'],true])
+    @fluff.ldap = @ldap
+    assert_equal @fluff.is_in_groups?('john',['broskies','girlfriends']), false
+    @ldap.verify
+  end
+end
+
+

data/test/lib/ldap_test_helper.rb

@@ -0,0 +1,59 @@
+require 'net/ldap'
+require 'ostruct'
+
+module LdapTestHelper
+  attr_accessor :group_base, :class_filter, :user
+
+  def config
+    @config = OpenStruct.new(
+        :host => "internet.com",
+        :port => "387",
+        :encryption => :start_tls,
+        :base_dn => "dc=internet,dc=com",
+        :group_base => "ou=group,dc=internet,dc=com",
+        :service_user => "service",
+        :service_pass => "pass",
+        :domain => "internet.com"
+      )
+  end
+
+  def ad_name_filter(name)
+    Net::LDAP::Filter.eq("samaccountname",name)
+  end
+
+  def ipa_name_filter(name)
+    Net::LDAP::Filter.eq("uid",name)
+  end
+
+  def group_filter(g)
+    Net::LDAP::Filter.eq("cn", g)
+  end
+
+  def group_class_filter
+    Net::LDAP::Filter.eq("objectclass","group")
+  end
+
+  def ipa_user_bind(uid)
+    "uid=#{uid},cn=users,cn=accounts,#{@config.base_dn}"
+  end
+
+  def ad_user_payload
+    [{ :memberof => ["CN=group,dc=internet,dc=com"] }]
+  end
+
+  def ad_parent_payload(num)
+    [{ :memberof => ["CN=bros#{num},dc=internet,dc=com"] }]
+  end
+
+  def ad_double_payload(num)
+    [{ :memberof => ["CN=bros#{num},dc=internet,dc=com", "CN=broskies#{num},dc=internet,dc=com"] }]
+  end
+
+  def posix_user_payload
+    [{:cn => ["bros"]}]
+  end
+
+  def ipa_user_payload
+    [{:cn => 'user'},{:memberof => ['cn=group,dc=internet,dc=com','cn=bros,dc=internet,dc=com']}]
+  end
+end

data/test/posix_member_services_test.rb

@@ -0,0 +1,25 @@
+require 'minitest/autorun'
+
+class TestPosixMemberService < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+    @ldap = MiniTest::Mock.new
+    @ms = LdapFluff::Posix::MemberService.new(@ldap, @config.group_base)
+  end
+
+  def test_find_user
+    user = posix_user_payload
+    @ldap.expect(:search,
+                 user,
+                 [
+                   :filter => @ms.name_filter('john'),
+                  :base =>config.group_base
+                 ]
+                )
+    @ms.ldap = @ldap
+    assert_equal ['bros'], @ms.find_user_groups('john')
+    @ldap.verify
+  end
+end

data/test/posix_test.rb

@@ -0,0 +1,64 @@
+require 'minitest/autorun'
+
+class TestPosix < MiniTest::Unit::TestCase
+  include LdapTestHelper
+
+  def setup
+    config
+    @posix = LdapFluff::Posix.new(@config)
+    @ldap = MiniTest::Mock.new
+  end
+
+  def basic_user
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, ['bros'], ["john"])
+    @posix.member_service = @md
+  end
+
+  def test_groups
+    basic_user
+    assert_equal @posix.groups_for_uid("john"), ['bros']
+  end
+
+  def test_missing_user
+    @md = MiniTest::Mock.new
+    @md.expect(:find_user_groups, [], ['john'])
+    @posix.member_service = @md
+    assert_equal [], @posix.groups_for_uid('john')
+  end
+
+  def test_isnt_in_groups
+    basic_user
+    @md = MiniTest::Mock.new
+    @md.expect(:times_in_groups, 0, ['john', ['bros'], true])
+    @posix.member_service = @md
+    assert_equal @posix.is_in_groups('john', ['bros'], true), false
+  end
+
+  def test_is_in_groups
+    basic_user
+    @md = MiniTest::Mock.new
+    @md.expect(:times_in_groups, 1, ['john', ['bros'], true])
+    @posix.member_service = @md
+    assert_equal @posix.is_in_groups('john', ['bros'], true), true
+  end
+
+  def test_is_in_no_groups
+    basic_user
+    assert_equal @posix.is_in_groups('john', [], true), true
+  end
+
+  def test_good_bind
+    @ldap.expect(:auth, nil, ["uid=internet,dc=internet,dc=com","password"])
+    @ldap.expect(:bind, true)
+    @posix.ldap = @ldap
+    assert_equal @posix.bind?("internet", "password"), true
+  end
+
+  def test_bad_bind
+    @ldap.expect(:auth, nil, ["uid=internet,dc=internet,dc=com","password"])
+    @ldap.expect(:bind, false)
+    @posix.ldap = @ldap
+    assert_equal @posix.bind?("internet", "password"), false
+  end
+end

metadata

@@ -0,0 +1,98 @@
+--- !ruby/object:Gem::Specification
+name: ldap_fluff
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+  prerelease: 
+platform: ruby
+authors:
+- Jordan OMara
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-07-09 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: net-ldap
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: ! 'Simple library for binding & group querying on top of various ldap
+  implementations
+
+'
+email: jomara@redhat.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- etc/ldap_fluff.yml
+- lib/ldap_fluff.rb
+- lib/ldap_fluff/active_directory.rb
+- lib/ldap_fluff/posix.rb
+- lib/ldap_fluff/freeipa.rb
+- lib/ldap_fluff/ldap_fluff.rb
+- lib/ldap_fluff/config.rb
+- lib/ldap_fluff/ad_member_service.rb
+- lib/ldap_fluff/posix_member_service.rb
+- lib/ldap_fluff/freeipa_member_service.rb
+- test/ldap_test.rb
+- test/ipa_member_services_test.rb
+- test/posix_test.rb
+- test/config_test.rb
+- test/ipa_test.rb
+- test/ad_test.rb
+- test/ad_member_services_test.rb
+- test/posix_member_services_test.rb
+- test/lib/ldap_test_helper.rb
+homepage: http://www.redhat.com
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.24
+signing_key: 
+specification_version: 3
+summary: LDAP Querying tools for Active Directory, FreeIPA and Posix-style
+test_files: []