lib/controller/localdb/login_pam_test.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package localdb
   6
   7 import (
   8         "context"
   9         "io/ioutil"
  10         "net/http"
  11         "os"
  12         "strings"
  13
  14         "git.arvados.org/arvados.git/lib/config"
  15         "git.arvados.org/arvados.git/lib/controller/rpc"
  16         "git.arvados.org/arvados.git/lib/ctrlctx"
  17         "git.arvados.org/arvados.git/sdk/go/arvados"
  18         "git.arvados.org/arvados.git/sdk/go/arvadostest"
  19         "git.arvados.org/arvados.git/sdk/go/ctxlog"
  20         "github.com/jmoiron/sqlx"
  21         check "gopkg.in/check.v1"
  22 )
  23
  24 var _ = check.Suite(&PamSuite{})
  25
  26 type PamSuite struct {
  27         cluster  *arvados.Cluster
  28         ctrl     *pamLoginController
  29         railsSpy *arvadostest.Proxy
  30         db       *sqlx.DB
  31         ctx      context.Context
  32         rollback func() error
  33 }
  34
  35 func (s *PamSuite) SetUpSuite(c *check.C) {
  36         cfg, err := config.NewLoader(nil, ctxlog.TestLogger(c)).Load()
  37         c.Assert(err, check.IsNil)
  38         s.cluster, err = cfg.GetCluster("")
  39         c.Assert(err, check.IsNil)
  40         s.cluster.Login.PAM.Enable = true
  41         s.cluster.Login.PAM.DefaultEmailDomain = "example.com"
  42         s.railsSpy = arvadostest.NewProxy(c, s.cluster.Services.RailsAPI)
  43         s.ctrl = &pamLoginController{
  44                 Cluster: s.cluster,
  45                 Parent:  &Conn{railsProxy: rpc.NewConn(s.cluster.ClusterID, s.railsSpy.URL, true, rpc.PassthroughTokenProvider)},
  46         }
  47         s.db = arvadostest.DB(c, s.cluster)
  48 }
  49
  50 func (s *PamSuite) SetUpTest(c *check.C) {
  51         tx, err := s.db.Beginx()
  52         c.Assert(err, check.IsNil)
  53         s.ctx = ctrlctx.NewWithTransaction(context.Background(), tx)
  54         s.rollback = tx.Rollback
  55 }
  56
  57 func (s *PamSuite) TearDownTest(c *check.C) {
  58         if s.rollback != nil {
  59                 s.rollback()
  60         }
  61 }
  62
  63 func (s *PamSuite) TestLoginFailure(c *check.C) {
  64         resp, err := s.ctrl.UserAuthenticate(s.ctx, arvados.UserAuthenticateOptions{
  65                 Username: "bogususername",
  66                 Password: "boguspassword",
  67         })
  68         c.Check(err, check.ErrorMatches, `PAM: Authentication failure \(with username "bogususername" and password\)`)
  69         hs, ok := err.(interface{ HTTPStatus() int })
  70         if c.Check(ok, check.Equals, true) {
  71                 c.Check(hs.HTTPStatus(), check.Equals, http.StatusUnauthorized)
  72         }
  73         c.Check(resp.APIToken, check.Equals, "")
  74 }
  75
  76 // This test only runs if the ARVADOS_TEST_PAM_CREDENTIALS_FILE env
  77 // var is set. The credentials file should contain a valid username
  78 // and password, separated by \n.
  79 //
  80 // Depending on the host config, this test succeeds only if the test
  81 // credentials are for the same account being used to run tests.
  82 func (s *PamSuite) TestLoginSuccess(c *check.C) {
  83         testCredsFile := os.Getenv("ARVADOS_TEST_PAM_CREDENTIALS_FILE")
  84         if testCredsFile == "" {
  85                 c.Skip("no test credentials file given in ARVADOS_TEST_PAM_CREDENTIALS_FILE")
  86                 return
  87         }
  88         buf, err := ioutil.ReadFile(testCredsFile)
  89         c.Assert(err, check.IsNil)
  90         lines := strings.Split(string(buf), "\n")
  91         c.Assert(len(lines), check.Equals, 2, check.Commentf("credentials file %s should contain \"username\\npassword\"", testCredsFile))
  92         u, p := lines[0], lines[1]
  93
  94         resp, err := s.ctrl.UserAuthenticate(s.ctx, arvados.UserAuthenticateOptions{
  95                 Username: u,
  96                 Password: p,
  97         })
  98         c.Check(err, check.IsNil)
  99         c.Check(resp.APIToken, check.Not(check.Equals), "")
 100         c.Check(resp.UUID, check.Matches, `zzzzz-gj3su-.*`)
 101         c.Check(resp.Scopes, check.DeepEquals, []string{"all"})
 102
 103         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 104         c.Check(authinfo.Email, check.Equals, u+"@"+s.cluster.Login.PAM.DefaultEmailDomain)
 105         c.Check(authinfo.AlternateEmails, check.DeepEquals, []string(nil))
 106 }