prathe_devise_ldap_authenticatable 0.4.10

data/test/rails_app/public/javascripts/rails.js

@@ -0,0 +1,118 @@
+document.observe("dom:loaded", function() {
+  function handleRemote(element) {
+    var method, url, params;
+
+    if (element.tagName.toLowerCase() === 'form') {
+      method = element.readAttribute('method') || 'post';
+      url    = element.readAttribute('action');
+      params = element.serialize(true);
+    } else {
+      method = element.readAttribute('data-method') || 'get';
+      url    = element.readAttribute('href');
+      params = {};
+    }
+
+    var event = element.fire("ajax:before");
+    if (event.stopped) return false;
+
+    new Ajax.Request(url, {
+      method: method,
+      parameters: params,
+      asynchronous: true,
+      evalScripts: true,
+
+      onLoading:     function(request) { element.fire("ajax:loading", {request: request}); },
+      onLoaded:      function(request) { element.fire("ajax:loaded", {request: request}); },
+      onInteractive: function(request) { element.fire("ajax:interactive", {request: request}); },
+      onComplete:    function(request) { element.fire("ajax:complete", {request: request}); },
+      onSuccess:     function(request) { element.fire("ajax:success", {request: request}); },
+      onFailure:     function(request) { element.fire("ajax:failure", {request: request}); }
+    });
+
+    element.fire("ajax:after");
+  }
+
+  function handleMethod(element) {
+    var method, url, token_name, token;
+
+    method     = element.readAttribute('data-method');
+    url        = element.readAttribute('href');
+    csrf_param = $$('meta[name=csrf-param]').first();
+    csrf_token = $$('meta[name=csrf-token]').first();
+
+    var form = new Element('form', { method: "POST", action: url, style: "display: none;" });
+    element.parentNode.appendChild(form);
+
+    if (method != 'post') {
+      var field = new Element('input', { type: 'hidden', name: '_method', value: method });
+      form.appendChild(field);
+    }
+
+    if (csrf_param) {
+      var param = csrf_param.readAttribute('content');
+      var token = csrf_token.readAttribute('content');
+      var field = new Element('input', { type: 'hidden', name: param, value: token });
+      form.appendChild(field);
+    }
+
+    form.submit();
+  }
+
+  $(document.body).observe("click", function(event) {
+    var message = event.findElement().readAttribute('data-confirm');
+    if (message && !confirm(message)) {
+      event.stop();
+      return false;
+    }
+
+    var element = event.findElement("a[data-remote]");
+    if (element) {
+      handleRemote(element);
+      event.stop();
+      return true;
+    }
+
+    var element = event.findElement("a[data-method]");
+    if (element) {
+      handleMethod(element);
+      event.stop();
+      return true;
+    }
+  });
+
+  // TODO: I don't think submit bubbles in IE
+  $(document.body).observe("submit", function(event) {
+    var element = event.findElement(),
+        message = element.readAttribute('data-confirm');
+    if (message && !confirm(message)) {
+      event.stop();
+      return false;
+    }
+
+    var inputs = element.select("input[type=submit][data-disable-with]");
+    inputs.each(function(input) {
+      input.disabled = true;
+      input.writeAttribute('data-original-value', input.value);
+      input.value = input.readAttribute('data-disable-with');
+    });
+
+    var element = event.findElement("form[data-remote]");
+    if (element) {
+      handleRemote(element);
+      event.stop();
+    }
+  });
+
+  $(document.body).observe("ajax:after", function(event) {
+    var element = event.findElement();
+
+    if (element.tagName.toLowerCase() === 'form') {
+      var inputs = element.select("input[type=submit][disabled=true][data-disable-with]");
+      inputs.each(function(input) {
+        input.value = input.readAttribute('data-original-value');
+        input.writeAttribute('data-original-value', null);
+        input.disabled = false;
+      });
+    }
+  });
+});

data/test/rails_app/script/cucumber

@@ -0,0 +1,10 @@
+#!/usr/bin/env ruby
+
+vendored_cucumber_bin = Dir["#{File.dirname(__FILE__)}/../vendor/{gems,plugins}/cucumber*/bin/cucumber"].first
+if vendored_cucumber_bin
+  load File.expand_path(vendored_cucumber_bin)
+else
+  require 'rubygems' unless ENV['NO_RUBYGEMS']
+  require 'cucumber'
+  load Cucumber::BINARY
+end

data/test/rails_app/script/rails

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
+
+APP_PATH = File.expand_path('../../config/application',  __FILE__)
+require File.expand_path('../../config/boot',  __FILE__)
+require 'rails/commands'

data/test/rails_app/test/factories/users.rb

@@ -0,0 +1,14 @@
+Factory.define :user do |f|
+  f.email "example.user@test.com"
+  f.password "secret"
+end
+
+Factory.define :admin, :class => "user" do |f|
+  f.email "example.admin@test.com"
+  f.password "admin_secret"
+end
+
+Factory.define :other, :class => "user" do |f|
+  f.email "other.user@test.com"
+  f.password "other_secret"
+end

data/test/rails_app/test/functional/posts_controller_test.rb

@@ -0,0 +1,58 @@
+require 'test_helper'
+
+class PostsControllerTest < ActionController::TestCase
+  
+  include Devise::TestHelpers
+
+  context "not logged in" do
+    should "should get INDEX" do
+      get :index
+      assert_response :success
+      assert_equal(response.body, "posts#index")
+    end
+    
+    context "go to NEW page" do
+      setup do
+        get :new
+      end
+
+      should "not get NEW" do
+        assert_response :redirect
+      end      
+    end
+  end
+  
+  context "logged in" do
+    setup do
+      @user = Factory(:user)
+      sign_in(@user)
+    end
+
+    context "get NEW action" do
+      setup do
+        get :new
+      end
+
+      should "get the NEW action" do
+        assert_response :success
+        assert_equal(response.body, "posts#new")
+      end
+    end
+    
+    context "log out user" do
+      setup do
+        sign_out(@user)
+        get :new
+      end
+
+      should "get redirected to the login page" do
+        assert_response :redirect
+      end
+    end
+    
+
+  end
+  
+
+
+end

data/test/rails_app/test/performance/browsing_test.rb

@@ -0,0 +1,9 @@
+require 'test_helper'
+require 'rails/performance_test_help'
+
+# Profiling results for each test method are written to tmp/performance.
+class BrowsingTest < ActionDispatch::PerformanceTest
+  def test_homepage
+    get '/'
+  end
+end

data/test/rails_app/test/test_helper.rb

@@ -0,0 +1,36 @@
+ENV["RAILS_ENV"] = "test"
+require File.expand_path('../../config/environment', __FILE__)
+require 'rails/test_help'
+
+class ActiveSupport::TestCase
+  
+  def ldap_connect_string
+    if ENV["LDAP_SSL"]
+      "-x -H ldaps://localhost:3389 -D 'cn=admin,dc=test,dc=com' -w secret"
+    else
+      "-x -h localhost -p 3389 -D 'cn=admin,dc=test,dc=com' -w secret"
+    end
+  end
+  
+  def reset_ldap_server!
+    if ENV["LDAP_SSL"]
+      `ldapmodify #{ldap_connect_string} -f ../ldap/clear.ldif`
+      `ldapadd #{ldap_connect_string} -f ../ldap/base.ldif`
+    else
+      `ldapmodify #{ldap_connect_string} -f ../ldap/clear.ldif`
+      `ldapadd #{ldap_connect_string} -f ../ldap/base.ldif`
+    end
+  end
+  
+  def default_devise_settings!
+    ::Devise.ldap_logger = true
+    ::Devise.ldap_create_user = false
+    ::Devise.ldap_update_password = true
+    ::Devise.ldap_config = "#{Rails.root}/config/#{"ssl_" if ENV["LDAP_SSL"]}ldap.yml"
+    ::Devise.ldap_check_group_membership = false
+    ::Devise.ldap_check_attributes = false
+    ::Devise.ldap_auth_username_builder = Proc.new() {|attribute, login, ldap| "#{attribute}=#{login},#{ldap.base}" }
+    ::Devise.authentication_keys = [:email]
+  end
+  
+end

data/test/rails_app/test/unit/helpers/posts_helper_test.rb

@@ -0,0 +1,4 @@
+require 'test_helper'
+
+class PostsHelperTest < ActionView::TestCase
+end

data/test/rails_app/test/unit/post_test.rb

@@ -0,0 +1,4 @@
+require 'test_helper'
+
+class PostTest < ActiveSupport::TestCase
+end

data/test/rails_app/test/unit/user_test.rb

@@ -0,0 +1,254 @@
+require 'test_helper'
+
+class UserTest < ActiveSupport::TestCase
+
+  def should_be_validated(user, password, message = "Password is invalid")
+    assert(user.valid_ldap_authentication?(password), message)
+  end
+  
+  def should_not_be_validated(user, password, message = "Password is not properly set")
+     assert(!user.valid_ldap_authentication?(password), message)
+  end
+
+  context "With default settings" do
+    setup do
+      default_devise_settings!
+      reset_ldap_server!
+    end
+
+    context "look up and ldap user" do
+      should "return true for a user that does exist in LDAP" do
+        assert_equal true, ::Devise::LdapAdapter.valid_login?('example.user@test.com')
+      end
+
+      should "return false for a user that doesn't exist in LDAP" do
+        assert_equal false, ::Devise::LdapAdapter.valid_login?('barneystinson')
+      end
+    end
+  
+    context "create a basic user" do
+      setup do
+        @user = Factory(:user)
+      end
+  
+      should "check for password validation" do
+        assert_equal(@user.email, "example.user@test.com")
+        should_be_validated @user, "secret"
+        should_not_be_validated @user, "wrong_secret"
+        should_not_be_validated @user, "Secret"
+      end
+    end
+  
+    context "change a LDAP password" do
+      setup do
+        @user = Factory(:user)
+      end
+  
+      should "change password" do
+        should_be_validated @user, "secret"
+        @user.reset_password!("changed","changed")
+        should_be_validated @user, "changed", "password was not changed properly on the LDAP sevrer"
+      end
+    
+      should "not allow to change password if setting is false" do
+        should_be_validated @user, "secret"
+        ::Devise.ldap_update_password = false
+        @user.reset_password!("wrong_secret", "wrong_secret")
+        should_not_be_validated @user, "wrong_secret"
+        should_be_validated @user, "secret"
+      end
+    end
+  
+    context "create new local user if user is in LDAP" do
+    
+      setup do
+        assert(User.all.blank?, "There shouldn't be any users in the database")
+      end
+    
+      should "don't create user in the database" do
+        @user = User.authenticate_with_ldap(:email => "example.user@test.com", :password => "secret")
+        assert(User.all.blank?)
+      end
+    
+      context "creating users is enabled" do
+        setup do
+          ::Devise.ldap_create_user = true
+        end
+      
+        should "create a user in the database" do
+          @user = User.authenticate_with_ldap(:email => "example.user@test.com", :password => "secret")
+          assert_equal(User.all.size, 1)
+          assert_contains(User.all.collect(&:email), "example.user@test.com", "user not in database")
+        end
+  
+        should "not create a user in the database if the password is wrong_secret" do
+          @user = User.authenticate_with_ldap(:email => "example.user", :password => "wrong_secret")
+          assert(User.all.blank?, "There's users in the database")
+        end
+      
+        should "create a user if the user is not in LDAP" do
+          @user = User.authenticate_with_ldap(:email => "wrong_secret.user@test.com", :password => "wrong_secret")
+          assert(User.all.blank?, "There's users in the database")
+        end
+      end
+    
+    end
+  
+    context "use groups for authorization" do
+      setup do
+        @admin = Factory(:admin)
+        @user = Factory(:user)
+        ::Devise.authentication_keys = [:email]
+        ::Devise.ldap_check_group_membership = true
+      end
+  
+      should "admin should be allowed in" do
+        should_be_validated @admin, "admin_secret"
+      end
+    
+      should "admin should have the proper groups set" do
+        assert_contains(@admin.ldap_groups, /cn=admins/, "groups attribute not being set properly")
+      end
+    
+      should "user should not be allowed in" do
+        should_not_be_validated @user, "secret"
+      end
+      
+      should "not be validated if group with different attribute is removed" do
+        `ldapmodify #{ldap_connect_string} -f ../ldap/delete_authorization_role.ldif`
+        should_not_be_validated @admin, "admin_secret"
+      end
+    end
+  
+    context "use role attribute for authorization" do
+      setup do
+        @admin = Factory(:admin)
+        @user = Factory(:user)
+        ::Devise.ldap_check_attributes = true
+      end
+  
+      should "admin should be allowed in" do
+        should_be_validated @admin, "admin_secret"
+      end
+    
+      should "user should not be allowed in" do
+        should_not_be_validated @user, "secret"
+      end
+    end
+    
+    context "use admin setting to bind" do
+      setup do
+        @admin = Factory(:admin)
+        @user = Factory(:user)
+        ::Devise.ldap_use_admin_to_bind = true
+      end
+  
+      should "description" do
+        should_be_validated @admin, "admin_secret"
+      end
+    end
+  
+  end
+  
+  context "use uid for login" do
+    setup do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_config = "#{Rails.root}/config/#{"ssl_" if ENV["LDAP_SSL"]}ldap_with_uid.yml"
+      ::Devise.authentication_keys = [:uid]
+    end
+  
+    context "description" do
+      setup do
+        @admin = Factory(:admin)
+        @user = Factory(:user, :uid => "example_user")
+      end
+  
+      should "be able to authenticate using uid" do
+        should_be_validated @user, "secret"
+        should_not_be_validated @admin, "admin_secret"
+      end
+    end
+    
+    context "create user" do
+      setup do
+        ::Devise.ldap_create_user = true
+      end
+  
+      should "create a user in the database" do
+        @user = User.authenticate_with_ldap(:uid => "example_user", :password => "secret")
+        assert_equal(User.all.size, 1)
+        assert_contains(User.all.collect(&:uid), "example_user", "user not in database")
+      end
+
+      should "call ldap_before_save hooks" do
+        User.class_eval do
+          def ldap_before_save
+            @foobar = 'foobar'
+          end
+        end
+        user = User.authenticate_with_ldap(:uid => "example_user", :password => "secret")
+        assert_equal 'foobar', user.instance_variable_get(:"@foobar")
+        User.class_eval do
+          undef ldap_before_save
+        end
+      end
+
+      should "not call ldap_before_save hook if not defined" do
+        assert_nothing_raised do
+          should_be_validated Factory(:user, :uid => "example_user"), "secret"
+        end
+      end
+    end    
+  end
+  
+  context "using ERB in the config file" do
+    setup do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_config = "#{Rails.root}/config/#{"ssl_" if ENV["LDAP_SSL"]}ldap_with_erb.yml"
+    end
+  
+    context "authenticate" do
+      setup do
+        @admin = Factory(:admin)
+        @user = Factory(:user)
+      end
+  
+      should "be able to authenticate" do
+        should_be_validated @user, "secret"
+        should_be_validated @admin, "admin_secret"
+      end
+    end
+  end
+
+  context "using variants in the config file" do
+    setup do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_config = Rails.root.join 'config', 'ldap_with_boolean_ssl.yml'
+    end
+
+    should "not fail if config file has ssl: true" do
+      assert_nothing_raised do
+        Devise::LdapAdapter::LdapConnect.new
+      end
+    end
+  end
+  
+  context "use username builder" do
+    setup do
+      default_devise_settings!
+      reset_ldap_server!
+      ::Devise.ldap_auth_username_builder = Proc.new() do |attribute, login, ldap|
+        "#{attribute}=#{login},ou=others,dc=test,dc=com"
+      end
+      @other = Factory(:other)
+    end
+
+    should "be able to authenticate" do
+      should_be_validated @other, "other_secret"
+    end
+  end
+  
+end