2016-05-13 06:51:14 +03:00
|
|
|
// Copyright 2016 The etcd Authors
|
2016-04-27 19:15:23 +03:00
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package auth
|
|
|
|
|
|
|
|
import (
|
|
|
|
"os"
|
2017-01-26 09:22:36 +03:00
|
|
|
"reflect"
|
2016-04-27 19:15:23 +03:00
|
|
|
"testing"
|
|
|
|
|
2017-01-26 09:22:36 +03:00
|
|
|
"github.com/coreos/etcd/auth/authpb"
|
2016-04-27 19:15:23 +03:00
|
|
|
pb "github.com/coreos/etcd/etcdserver/etcdserverpb"
|
|
|
|
"github.com/coreos/etcd/mvcc/backend"
|
2017-01-26 09:22:36 +03:00
|
|
|
|
2016-07-07 09:01:09 +03:00
|
|
|
"golang.org/x/crypto/bcrypt"
|
2016-06-09 03:11:26 +03:00
|
|
|
"golang.org/x/net/context"
|
2017-01-26 09:22:36 +03:00
|
|
|
"google.golang.org/grpc/metadata"
|
2016-04-27 19:15:23 +03:00
|
|
|
)
|
|
|
|
|
2016-07-07 09:01:09 +03:00
|
|
|
func init() { BcryptCost = bcrypt.MinCost }
|
|
|
|
|
2016-11-24 10:34:29 +03:00
|
|
|
func dummyIndexWaiter(index uint64) <-chan struct{} {
|
|
|
|
ch := make(chan struct{})
|
|
|
|
go func() {
|
|
|
|
ch <- struct{}{}
|
|
|
|
}()
|
|
|
|
return ch
|
|
|
|
}
|
|
|
|
|
2017-02-22 01:37:15 +03:00
|
|
|
// TestNewAuthStoreRevision ensures newly auth store
|
|
|
|
// keeps the old revision when there are no changes.
|
|
|
|
func TestNewAuthStoreRevision(t *testing.T) {
|
|
|
|
b, tPath := backend.NewDefaultTmpBackend()
|
|
|
|
defer os.Remove(tPath)
|
|
|
|
|
2016-07-21 08:13:57 +03:00
|
|
|
tp, err := NewTokenProvider("simple", dummyIndexWaiter)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
as := NewAuthStore(b, tp)
|
|
|
|
err = enableAuthAndCreateRoot(as)
|
2017-02-22 01:37:15 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
old := as.Revision()
|
|
|
|
b.Close()
|
|
|
|
as.Close()
|
|
|
|
|
|
|
|
// no changes to commit
|
|
|
|
b2 := backend.NewDefaultBackend(tPath)
|
2016-07-21 08:13:57 +03:00
|
|
|
as = NewAuthStore(b2, tp)
|
2017-02-22 01:37:15 +03:00
|
|
|
new := as.Revision()
|
|
|
|
b2.Close()
|
|
|
|
as.Close()
|
|
|
|
|
|
|
|
if old != new {
|
|
|
|
t.Fatalf("expected revision %d, got %d", old, new)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-01-25 22:08:50 +03:00
|
|
|
func setupAuthStore(t *testing.T) (store *authStore, teardownfunc func(t *testing.T)) {
|
2016-04-27 19:15:23 +03:00
|
|
|
b, tPath := backend.NewDefaultTmpBackend()
|
|
|
|
|
2016-07-21 08:13:57 +03:00
|
|
|
tp, err := NewTokenProvider("simple", dummyIndexWaiter)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
as := NewAuthStore(b, tp)
|
|
|
|
err = enableAuthAndCreateRoot(as)
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2017-01-25 22:08:50 +03:00
|
|
|
|
|
|
|
// adds a new role
|
|
|
|
_, err = as.RoleAdd(&pb.AuthRoleAddRequest{Name: "role-test"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
2016-04-27 19:15:23 +03:00
|
|
|
}
|
2016-11-02 07:37:37 +03:00
|
|
|
|
2017-01-25 22:08:50 +03:00
|
|
|
ua := &pb.AuthUserAddRequest{Name: "foo", Password: "bar"}
|
|
|
|
_, err = as.UserAdd(ua) // add a non-existing user
|
|
|
|
if err != nil {
|
2016-11-02 07:37:37 +03:00
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2017-01-25 22:08:50 +03:00
|
|
|
|
|
|
|
tearDown := func(t *testing.T) {
|
|
|
|
b.Close()
|
|
|
|
os.Remove(tPath)
|
|
|
|
as.Close()
|
|
|
|
}
|
|
|
|
return as, tearDown
|
2016-04-27 19:15:23 +03:00
|
|
|
}
|
|
|
|
|
2016-06-20 11:09:13 +03:00
|
|
|
func enableAuthAndCreateRoot(as *authStore) error {
|
|
|
|
_, err := as.UserAdd(&pb.AuthUserAddRequest{Name: "root", Password: "root"})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = as.RoleAdd(&pb.AuthRoleAddRequest{Name: "root"})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = as.UserGrantRole(&pb.AuthUserGrantRoleRequest{User: "root", Role: "root"})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return as.AuthEnable()
|
|
|
|
}
|
|
|
|
|
2017-01-25 22:08:50 +03:00
|
|
|
func TestUserAdd(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
2016-04-27 19:15:23 +03:00
|
|
|
|
2017-01-25 22:08:50 +03:00
|
|
|
ua := &pb.AuthUserAddRequest{Name: "foo"}
|
|
|
|
_, err := as.UserAdd(ua) // add an existing user
|
|
|
|
if err == nil {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserAlreadyExist, err)
|
|
|
|
}
|
|
|
|
if err != ErrUserAlreadyExist {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserAlreadyExist, err)
|
2016-06-20 11:09:13 +03:00
|
|
|
}
|
2016-04-27 19:15:23 +03:00
|
|
|
|
2017-01-25 22:08:50 +03:00
|
|
|
ua = &pb.AuthUserAddRequest{Name: ""}
|
|
|
|
_, err = as.UserAdd(ua) // add a user with empty name
|
|
|
|
if err != ErrUserEmpty {
|
2016-04-27 19:15:23 +03:00
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2017-01-25 22:08:50 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
func TestCheckPassword(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
2016-04-27 19:15:23 +03:00
|
|
|
|
|
|
|
// auth a non-existing user
|
2017-01-25 22:08:50 +03:00
|
|
|
_, err := as.CheckPassword("foo-test", "bar")
|
2016-04-27 19:15:23 +03:00
|
|
|
if err == nil {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrAuthFailed, err)
|
|
|
|
}
|
|
|
|
if err != ErrAuthFailed {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrAuthFailed, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// auth an existing user with correct password
|
2016-10-13 13:30:35 +03:00
|
|
|
_, err = as.CheckPassword("foo", "bar")
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// auth an existing user but with wrong password
|
2016-10-13 13:30:35 +03:00
|
|
|
_, err = as.CheckPassword("foo", "")
|
2016-04-27 19:15:23 +03:00
|
|
|
if err == nil {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrAuthFailed, err)
|
|
|
|
}
|
|
|
|
if err != ErrAuthFailed {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrAuthFailed, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestUserDelete(t *testing.T) {
|
2017-01-25 22:08:50 +03:00
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
2016-04-27 19:15:23 +03:00
|
|
|
|
|
|
|
// delete an existing user
|
|
|
|
ud := &pb.AuthUserDeleteRequest{Name: "foo"}
|
2017-01-25 22:08:50 +03:00
|
|
|
_, err := as.UserDelete(ud)
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// delete a non-existing user
|
|
|
|
_, err = as.UserDelete(ud)
|
|
|
|
if err == nil {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserNotFound, err)
|
|
|
|
}
|
|
|
|
if err != ErrUserNotFound {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserNotFound, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestUserChangePassword(t *testing.T) {
|
2017-01-25 22:08:50 +03:00
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
2016-06-09 03:11:26 +03:00
|
|
|
|
|
|
|
ctx1 := context.WithValue(context.WithValue(context.TODO(), "index", uint64(1)), "simpleToken", "dummy")
|
2016-07-21 08:13:57 +03:00
|
|
|
_, err := as.Authenticate(ctx1, "foo", "bar")
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
2016-07-21 08:13:57 +03:00
|
|
|
_, err = as.UserChangePassword(&pb.AuthUserChangePasswordRequest{Name: "foo", Password: "baz"})
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2016-06-09 03:11:26 +03:00
|
|
|
|
|
|
|
ctx2 := context.WithValue(context.WithValue(context.TODO(), "index", uint64(2)), "simpleToken", "dummy")
|
2016-07-21 08:13:57 +03:00
|
|
|
_, err = as.Authenticate(ctx2, "foo", "baz")
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// change a non-existing user
|
|
|
|
_, err = as.UserChangePassword(&pb.AuthUserChangePasswordRequest{Name: "foo-test", Password: "bar"})
|
|
|
|
if err == nil {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserNotFound, err)
|
|
|
|
}
|
|
|
|
if err != ErrUserNotFound {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserNotFound, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestRoleAdd(t *testing.T) {
|
2017-01-25 22:08:50 +03:00
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
2016-04-27 19:15:23 +03:00
|
|
|
|
|
|
|
// adds a new role
|
2017-01-25 22:08:50 +03:00
|
|
|
_, err := as.RoleAdd(&pb.AuthRoleAddRequest{Name: "role-test-1"})
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestUserGrant(t *testing.T) {
|
2017-01-25 22:08:50 +03:00
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
2016-04-27 19:15:23 +03:00
|
|
|
|
|
|
|
// grants a role to the user
|
2017-01-25 22:08:50 +03:00
|
|
|
_, err := as.UserGrantRole(&pb.AuthUserGrantRoleRequest{User: "foo", Role: "role-test"})
|
2016-04-27 19:15:23 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// grants a role to a non-existing user
|
2016-06-07 06:17:28 +03:00
|
|
|
_, err = as.UserGrantRole(&pb.AuthUserGrantRoleRequest{User: "foo-test", Role: "role-test"})
|
2016-04-27 19:15:23 +03:00
|
|
|
if err == nil {
|
2017-01-26 09:22:36 +03:00
|
|
|
t.Errorf("expected %v, got %v", ErrUserNotFound, err)
|
2016-04-27 19:15:23 +03:00
|
|
|
}
|
|
|
|
if err != ErrUserNotFound {
|
2017-01-26 09:22:36 +03:00
|
|
|
t.Errorf("expected %v, got %v", ErrUserNotFound, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestGetUser(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
_, err := as.UserGrantRole(&pb.AuthUserGrantRoleRequest{User: "foo", Role: "role-test"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
u, err := as.UserGet(&pb.AuthUserGetRequest{Name: "foo"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if u == nil {
|
|
|
|
t.Fatal("expect user not nil, got nil")
|
|
|
|
}
|
|
|
|
expected := []string{"role-test"}
|
|
|
|
if !reflect.DeepEqual(expected, u.Roles) {
|
|
|
|
t.Errorf("expected %v, got %v", expected, u.Roles)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestListUsers(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
ua := &pb.AuthUserAddRequest{Name: "user1", Password: "pwd1"}
|
|
|
|
_, err := as.UserAdd(ua) // add a non-existing user
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ul, err := as.UserList(&pb.AuthUserListRequest{})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if !contains(ul.Users, "root") {
|
|
|
|
t.Errorf("expected %v in %v", "root", ul.Users)
|
|
|
|
}
|
|
|
|
if !contains(ul.Users, "user1") {
|
|
|
|
t.Errorf("expected %v in %v", "user1", ul.Users)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestRoleGrantPermission(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
_, err := as.RoleAdd(&pb.AuthRoleAddRequest{Name: "role-test-1"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
perm := &authpb.Permission{
|
|
|
|
PermType: authpb.WRITE,
|
|
|
|
Key: []byte("Keys"),
|
|
|
|
RangeEnd: []byte("RangeEnd"),
|
|
|
|
}
|
|
|
|
_, err = as.RoleGrantPermission(&pb.AuthRoleGrantPermissionRequest{
|
|
|
|
Name: "role-test-1",
|
|
|
|
Perm: perm,
|
|
|
|
})
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
t.Error(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
r, err := as.RoleGet(&pb.AuthRoleGetRequest{Role: "role-test-1"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if !reflect.DeepEqual(perm, r.Perm[0]) {
|
|
|
|
t.Errorf("expected %v, got %v", perm, r.Perm[0])
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestRoleRevokePermission(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
_, err := as.RoleAdd(&pb.AuthRoleAddRequest{Name: "role-test-1"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
perm := &authpb.Permission{
|
|
|
|
PermType: authpb.WRITE,
|
|
|
|
Key: []byte("Keys"),
|
|
|
|
RangeEnd: []byte("RangeEnd"),
|
|
|
|
}
|
|
|
|
_, err = as.RoleGrantPermission(&pb.AuthRoleGrantPermissionRequest{
|
|
|
|
Name: "role-test-1",
|
|
|
|
Perm: perm,
|
|
|
|
})
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
2017-03-07 01:08:46 +03:00
|
|
|
_, err = as.RoleGet(&pb.AuthRoleGetRequest{Role: "role-test-1"})
|
2017-01-26 09:22:36 +03:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = as.RoleRevokePermission(&pb.AuthRoleRevokePermissionRequest{
|
|
|
|
Role: "role-test-1",
|
|
|
|
Key: "Keys",
|
|
|
|
RangeEnd: "RangeEnd",
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
2017-03-07 01:08:46 +03:00
|
|
|
var r *pb.AuthRoleGetResponse
|
2017-01-26 09:22:36 +03:00
|
|
|
r, err = as.RoleGet(&pb.AuthRoleGetRequest{Role: "role-test-1"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if len(r.Perm) != 0 {
|
|
|
|
t.Errorf("expected %v, got %v", 0, len(r.Perm))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestUserRevokePermission(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
_, err := as.RoleAdd(&pb.AuthRoleAddRequest{Name: "role-test-1"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = as.UserGrantRole(&pb.AuthUserGrantRoleRequest{User: "foo", Role: "role-test"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = as.UserGrantRole(&pb.AuthUserGrantRoleRequest{User: "foo", Role: "role-test-1"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
u, err := as.UserGet(&pb.AuthUserGetRequest{Name: "foo"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
expected := []string{"role-test", "role-test-1"}
|
|
|
|
if !reflect.DeepEqual(expected, u.Roles) {
|
|
|
|
t.Fatalf("expected %v, got %v", expected, u.Roles)
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = as.UserRevokeRole(&pb.AuthUserRevokeRoleRequest{Name: "foo", Role: "role-test-1"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
u, err = as.UserGet(&pb.AuthUserGetRequest{Name: "foo"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
expected = []string{"role-test"}
|
|
|
|
if !reflect.DeepEqual(expected, u.Roles) {
|
|
|
|
t.Errorf("expected %v, got %v", expected, u.Roles)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestRoleDelete(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
_, err := as.RoleDelete(&pb.AuthRoleDeleteRequest{Role: "role-test"})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
rl, err := as.RoleList(&pb.AuthRoleListRequest{})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
expected := []string{"root"}
|
|
|
|
if !reflect.DeepEqual(expected, rl.Roles) {
|
|
|
|
t.Errorf("expected %v, got %v", expected, rl.Roles)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestAuthInfoFromCtx(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
ctx := context.Background()
|
|
|
|
ai, err := as.AuthInfoFromCtx(ctx)
|
|
|
|
if err != nil && ai != nil {
|
|
|
|
t.Errorf("expected (nil, nil), got (%v, %v)", ai, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx = metadata.NewContext(context.Background(), metadata.New(map[string]string{"tokens": "dummy"}))
|
|
|
|
ai, err = as.AuthInfoFromCtx(ctx)
|
|
|
|
if err != nil && ai != nil {
|
|
|
|
t.Errorf("expected (nil, nil), got (%v, %v)", ai, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx = context.WithValue(context.WithValue(context.TODO(), "index", uint64(1)), "simpleToken", "dummy")
|
|
|
|
resp, err := as.Authenticate(ctx, "foo", "bar")
|
|
|
|
if err != nil {
|
|
|
|
t.Error(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx = metadata.NewContext(context.Background(), metadata.New(map[string]string{"token": "Invalid Token"}))
|
|
|
|
_, err = as.AuthInfoFromCtx(ctx)
|
|
|
|
if err != ErrInvalidAuthToken {
|
|
|
|
t.Errorf("expected %v, got %v", ErrInvalidAuthToken, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx = metadata.NewContext(context.Background(), metadata.New(map[string]string{"token": "Invalid.Token"}))
|
|
|
|
_, err = as.AuthInfoFromCtx(ctx)
|
|
|
|
if err != ErrInvalidAuthToken {
|
|
|
|
t.Errorf("expected %v, got %v", ErrInvalidAuthToken, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx = metadata.NewContext(context.Background(), metadata.New(map[string]string{"token": resp.Token}))
|
|
|
|
ai, err = as.AuthInfoFromCtx(ctx)
|
|
|
|
if err != nil {
|
|
|
|
t.Error(err)
|
|
|
|
}
|
|
|
|
if ai.Username != "foo" {
|
|
|
|
t.Errorf("expected %v, got %v", "foo", ai.Username)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-02-01 05:02:03 +03:00
|
|
|
func TestAuthDisable(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
as.AuthDisable()
|
|
|
|
ctx := context.WithValue(context.WithValue(context.TODO(), "index", uint64(2)), "simpleToken", "dummy")
|
|
|
|
_, err := as.Authenticate(ctx, "foo", "bar")
|
|
|
|
if err != ErrAuthNotEnabled {
|
|
|
|
t.Errorf("expected %v, got %v", ErrAuthNotEnabled, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Disabling disabled auth to make sure it can return safely if store is already disabled.
|
|
|
|
as.AuthDisable()
|
|
|
|
_, err = as.Authenticate(ctx, "foo", "bar")
|
|
|
|
if err != ErrAuthNotEnabled {
|
|
|
|
t.Errorf("expected %v, got %v", ErrAuthNotEnabled, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-02-01 19:39:09 +03:00
|
|
|
func TestIsAdminPermitted(t *testing.T) {
|
|
|
|
as, tearDown := setupAuthStore(t)
|
|
|
|
defer tearDown(t)
|
|
|
|
|
|
|
|
err := as.IsAdminPermitted(&AuthInfo{Username: "root", Revision: 1})
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("expected nil, got %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// invalid user
|
|
|
|
err = as.IsAdminPermitted(&AuthInfo{Username: "rooti", Revision: 1})
|
|
|
|
if err != ErrUserNotFound {
|
|
|
|
t.Errorf("expected %v, got %v", ErrUserNotFound, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// non-admin user
|
|
|
|
err = as.IsAdminPermitted(&AuthInfo{Username: "foo", Revision: 1})
|
|
|
|
if err != ErrPermissionDenied {
|
|
|
|
t.Errorf("expected %v, got %v", ErrPermissionDenied, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// disabled auth should return nil
|
|
|
|
as.AuthDisable()
|
|
|
|
err = as.IsAdminPermitted(&AuthInfo{Username: "root", Revision: 1})
|
|
|
|
if err != nil {
|
|
|
|
t.Errorf("expected nil, got %v", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-02-02 07:34:59 +03:00
|
|
|
func TestRecoverFromSnapshot(t *testing.T) {
|
|
|
|
as, _ := setupAuthStore(t)
|
|
|
|
|
|
|
|
ua := &pb.AuthUserAddRequest{Name: "foo"}
|
|
|
|
_, err := as.UserAdd(ua) // add an existing user
|
|
|
|
if err == nil {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserAlreadyExist, err)
|
|
|
|
}
|
|
|
|
if err != ErrUserAlreadyExist {
|
|
|
|
t.Fatalf("expected %v, got %v", ErrUserAlreadyExist, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ua = &pb.AuthUserAddRequest{Name: ""}
|
|
|
|
_, err = as.UserAdd(ua) // add a user with empty name
|
|
|
|
if err != ErrUserEmpty {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
as.Close()
|
|
|
|
|
2016-07-21 08:13:57 +03:00
|
|
|
tp, err := NewTokenProvider("simple", dummyIndexWaiter)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
as2 := NewAuthStore(as.be, tp)
|
2017-02-01 11:47:09 +03:00
|
|
|
defer func(a *authStore) {
|
|
|
|
a.Close()
|
|
|
|
}(as2)
|
2017-02-02 07:34:59 +03:00
|
|
|
|
|
|
|
if !as2.isAuthEnabled() {
|
|
|
|
t.Fatal("recovering authStore from existing backend failed")
|
|
|
|
}
|
|
|
|
|
|
|
|
ul, err := as.UserList(&pb.AuthUserListRequest{})
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
if !contains(ul.Users, "root") {
|
|
|
|
t.Errorf("expected %v in %v", "root", ul.Users)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-01-26 09:22:36 +03:00
|
|
|
func contains(array []string, str string) bool {
|
|
|
|
for _, s := range array {
|
|
|
|
if s == str {
|
|
|
|
return true
|
|
|
|
}
|
2016-04-27 19:15:23 +03:00
|
|
|
}
|
2017-01-26 09:22:36 +03:00
|
|
|
return false
|
2016-04-27 19:15:23 +03:00
|
|
|
}
|