Martino Ferrari
61 lines
2.0 KiB
Go
61 lines
2.0 KiB
Go
package ldapauth
|
|
|
|
import (
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestNewRequiresURIAndBase(t *testing.T) {
|
|
if _, err := New(Config{SearchBase: "dc=x"}); err == nil {
|
|
t.Fatal("want error for missing uri")
|
|
}
|
|
if _, err := New(Config{URIs: []string{"ldap://x"}}); err == nil {
|
|
t.Fatal("want error for missing search_base")
|
|
}
|
|
}
|
|
|
|
func TestNewAppliesSSSDDefaults(t *testing.T) {
|
|
a, err := New(Config{URIs: []string{"ldap://x"}, SearchBase: "dc=x"})
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if a.cfg.UserAttr != "uid" {
|
|
t.Errorf("UserAttr default = %q, want uid", a.cfg.UserAttr)
|
|
}
|
|
if a.cfg.UserObjectClass != "posixAccount" {
|
|
t.Errorf("UserObjectClass default = %q, want posixAccount", a.cfg.UserObjectClass)
|
|
}
|
|
if a.cfg.Timeout <= 0 {
|
|
t.Errorf("Timeout default not applied: %v", a.cfg.Timeout)
|
|
}
|
|
}
|
|
|
|
// Empty passwords must be rejected before any bind: a non-empty DN + empty
|
|
// password is an "unauthenticated bind" many servers accept as success.
|
|
func TestAuthenticateRejectsEmptyPasswordWithoutDialing(t *testing.T) {
|
|
// An unreachable URI guarantees the test fails loudly if it ever tries to dial.
|
|
a, err := New(Config{URIs: []string{"ldap://127.0.0.1:1"}, SearchBase: "dc=x"})
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if err := a.Authenticate("alice", ""); !errors.Is(err, ErrInvalidCredentials) {
|
|
t.Fatalf("want ErrInvalidCredentials for empty password, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestNewRejectsBadCACert(t *testing.T) {
|
|
dir := t.TempDir()
|
|
bad := filepath.Join(dir, "ca.pem")
|
|
if err := os.WriteFile(bad, []byte("not a certificate"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := New(Config{URIs: []string{"ldaps://x"}, SearchBase: "dc=x", CACertFile: bad}); err == nil {
|
|
t.Fatal("want error for CA file with no certificates")
|
|
}
|
|
if _, err := New(Config{URIs: []string{"ldaps://x"}, SearchBase: "dc=x", CACertFile: filepath.Join(dir, "missing.pem")}); err == nil {
|
|
t.Fatal("want error for missing CA file")
|
|
}
|
|
}
|