diff --git a/testing/tests/ldap_memcache/0001-test-ldap.test b/testing/tests/ldap_memcache/0001-test-ldap.test index 3275a696..0cc99595 100644 --- a/testing/tests/ldap_memcache/0001-test-ldap.test +++ b/testing/tests/ldap_memcache/0001-test-ldap.test @@ -39,6 +39,8 @@ $evaled{'ldap_client'} = $ldap; #sleep 100; ENDPERL +APPCONF=common + TYPE=PROPFIND HEADER=Content-Type: text/xml HEADER=Depth: 1 diff --git a/testing/tests/ldap_memcache/0003-test-ldap.test b/testing/tests/ldap_memcache/0003-test-ldap.test index 6c10fbf5..02cc30d2 100644 --- a/testing/tests/ldap_memcache/0003-test-ldap.test +++ b/testing/tests/ldap_memcache/0003-test-ldap.test @@ -39,6 +39,8 @@ $evaled{'ldap_client'} = $ldap; #sleep 100; ENDPERL +APPCONF=common + TYPE=PROPFIND HEADER=Content-Type: text/xml HEADER=Depth: 1 diff --git a/testing/tests/ldap_memcache/0005-test-invalid-user.test b/testing/tests/ldap_memcache/0005-test-invalid-user.test index c25cff1d..198ed89f 100644 --- a/testing/tests/ldap_memcache/0005-test-invalid-user.test +++ b/testing/tests/ldap_memcache/0005-test-invalid-user.test @@ -39,6 +39,8 @@ $evaled{'ldap_client'} = $ldap; #sleep 100; ENDPERL +APPCONF=common + TYPE=PROPFIND HEADER=Content-Type: text/xml HEADER=Depth: 1 diff --git a/testing/tests/ldap_memcache/0007-test-invalid-user.test b/testing/tests/ldap_memcache/0007-test-invalid-user.test index 5d5857b6..b139ca58 100644 --- a/testing/tests/ldap_memcache/0007-test-invalid-user.test +++ b/testing/tests/ldap_memcache/0007-test-invalid-user.test @@ -41,6 +41,8 @@ $evaled{'ldap_client'} = $ldap; #sleep 100; ENDPERL +APPCONF=common + TYPE=PROPFIND HEADER=Content-Type: text/xml HEADER=Depth: 1 @@ -104,7 +106,7 @@ if (defined $request_id) { } if ($ldap_conn) { - print "Conencted to LDAP server, unexpected, failed\n"; + print "Connected to LDAP server, unexpected, failed\n"; } else { print "No connection to LDAP, auth bailed out due to cached credentials, passed\n"; } diff --git a/testing/tests/ldap_memcache/0008-fail_cache_disabled.result b/testing/tests/ldap_memcache/0008-fail_cache_disabled.result new file mode 100644 index 00000000..c394698e --- /dev/null +++ b/testing/tests/ldap_memcache/0008-fail_cache_disabled.result @@ -0,0 +1,27 @@ +OK +HTTP/1.1 401 Unauthorized +Date: Dow, 01 Jan 2000 00:00:00 GMT +WWW-Authenticate: Basic realm="DAViCal CalDAV Server" +Content-Length: 40 +Content-Type: text/plain; ; charset="utf-8" + +Please log in for access to this system. +SQL Query 1 Result: +No salt for ldap2 found, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for failed attempts disabled, passed + + + +HTTP/1.1 401 Unauthorized +Date: Dow, 01 Jan 2000 00:00:00 GMT +WWW-Authenticate: Basic realm="DAViCal CalDAV Server" +Content-Length: 40 +Content-Type: text/plain; ; charset="utf-8" + +Please log in for access to this system. +No salt for ldap2 found, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for failed attempts disabled, passed diff --git a/testing/tests/ldap_memcache/0008-fail_cache_disabled.test b/testing/tests/ldap_memcache/0008-fail_cache_disabled.test new file mode 100644 index 00000000..f63622e7 --- /dev/null +++ b/testing/tests/ldap_memcache/0008-fail_cache_disabled.test @@ -0,0 +1,194 @@ +# Test again for an invalid user with fail caching disabled to make sure +# the failure isn't cached. +BEGINPERL +if ($debug) { $ENV{'LDAP_DEBUG'} = 1 }; + +use Net::LDAP::Server::Test; +use Net::LDAP; +use IO::Socket::INET; + +#my $port = find_idle_port(); + +#my $ldap_port = RT::Test->find_idle_port; +my $ldap_port = 21394; +my $ldap_socket = IO::Socket::INET->new( + Listen => 5, + Proto => 'tcp', + Reuse => 1, + LocalPort => $ldap_port, +); + +# Keep it around after this block exits. +$evaled{'ldap_server'} = Net::LDAP::Server::Test->new( $ldap_socket, auto_schema => 1 ); + +my $ldap = Net::LDAP->new("localhost:$ldap_port") || die "Failed to instantiate Net::LDAP: $!"; +$ldap->bind(); +my $username = "ldap1"; +my $base = "dc=example,dc=com"; +my $dn = "uid=$username,ou=users,$base"; +my $entry = { + cn => $username, + mail => "$username\@example.com", + uid => $username, + objectClass => 'User', + userPassword => 'ldap1', +}; +$ldap->add( $base ); +$ldap->add( $dn, attr => [%$entry] ); + +# We need to keep the client around, otherwise the test server will exit. +$evaled{'ldap_client'} = $ldap; +#sleep 100; +ENDPERL + +APPCONF=common + +# Disabled caching of failed auth checks. +BEGINAPPCONF +$c->auth_cache_fail = 0; +ENDAPPCONF + +# Clear cache +SCRIPT=echo flush_all | nc -N 127.0.0.1 11211 + +TYPE=PROPFIND +HEADER=Content-Type: text/xml +HEADER=Depth: 1 +AUTH=ldap2:ldap2 +HEAD + +BEGINDATA + + + + + + +ENDDATA + +URL=http://regression_ldap.host/caldav.php/ + +# Check that no usr record has been created. +QUERY +SELECT active, email, fullname, last_used, password, username, user_no +FROM usr +WHERE username = 'ldap2'; +ENDQUERY + +# Check to make sure there is no status line about caching credentials +# and that LDAP is checked. The result should not get cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $failed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap2,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap2/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $failed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap2 found, passed\n"; + } else { + print "Salt found for ldap2, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, failed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth bailed out due to cached credentials, failed\n"; + } + + if ($failed_disabled) { + print "Credential caching for failed attempts disabled, passed\n"; + } else { + print "Credential caching for failed attempts disabled not seen, failed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL + +URL=http://regression_ldap.host/caldav.php/ + +# Check again to make sure there is no status line about caching credentials +# and that LDAP is checked. The result should not get cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $failed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap2,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap2/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $failed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap2 found, passed\n"; + } else { + print "Salt found for ldap2, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, failed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth bailed out due to cached credentials, failed\n"; + } + + if ($failed_disabled) { + print "Credential caching for failed attempts disabled, passed\n"; + } else { + print "Credential caching for failed attempts disabled not seen, failed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} +ENDPERL + diff --git a/testing/tests/ldap_memcache/0009-fail_cache_enabled.result b/testing/tests/ldap_memcache/0009-fail_cache_enabled.result new file mode 100644 index 00000000..21d7d9eb --- /dev/null +++ b/testing/tests/ldap_memcache/0009-fail_cache_enabled.result @@ -0,0 +1,44 @@ +OK +HTTP/1.1 401 Unauthorized +Date: Dow, 01 Jan 2000 00:00:00 GMT +WWW-Authenticate: Basic realm="DAViCal CalDAV Server" +Content-Length: 40 +Content-Type: text/plain; ; charset="utf-8" + +Please log in for access to this system. +SQL Query 1 Result: +No salt for ldap2 found, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for failed attempts disabled not seen, passed + + + +HTTP/1.1 401 Unauthorized +Date: Dow, 01 Jan 2000 00:00:00 GMT +WWW-Authenticate: Basic realm="DAViCal CalDAV Server" +Content-Length: 40 +Content-Type: text/plain; ; charset="utf-8" + +Please log in for access to this system. +Salt found for ldap2, passed +Cached credentials found, correct, passed +No connection to LDAP, passed +Credential caching for failed attempts disabled not seen, passed + + + +HTTP/1.1 401 Unauthorized +Date: Dow, 01 Jan 2000 00:00:00 GMT +WWW-Authenticate: Basic realm="DAViCal CalDAV Server" +Content-Length: 40 +Content-Type: text/plain; ; charset="utf-8" + +Please log in for access to this system. +Salt found for ldap2, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for failed attempts disabled not seen, passed + + + diff --git a/testing/tests/ldap_memcache/0009-fail_cache_enabled.test b/testing/tests/ldap_memcache/0009-fail_cache_enabled.test new file mode 100644 index 00000000..0e466bdf --- /dev/null +++ b/testing/tests/ldap_memcache/0009-fail_cache_enabled.test @@ -0,0 +1,260 @@ +# Test again for an invalid user with fail caching enable to make sure +# the failure is cached, then wait a short while to see it is expired. +BEGINPERL +if ($debug) { $ENV{'LDAP_DEBUG'} = 1 }; + +use Net::LDAP::Server::Test; +use Net::LDAP; +use IO::Socket::INET; + +#my $port = find_idle_port(); + +#my $ldap_port = RT::Test->find_idle_port; +my $ldap_port = 21394; +my $ldap_socket = IO::Socket::INET->new( + Listen => 5, + Proto => 'tcp', + Reuse => 1, + LocalPort => $ldap_port, +); + +# Keep it around after this block exits. +$evaled{'ldap_server'} = Net::LDAP::Server::Test->new( $ldap_socket, auto_schema => 1 ); + +my $ldap = Net::LDAP->new("localhost:$ldap_port") || die "Failed to instantiate Net::LDAP: $!"; +$ldap->bind(); +my $username = "ldap1"; +my $base = "dc=example,dc=com"; +my $dn = "uid=$username,ou=users,$base"; +my $entry = { + cn => $username, + mail => "$username\@example.com", + uid => $username, + objectClass => 'User', + userPassword => 'ldap1', +}; +$ldap->add( $base ); +$ldap->add( $dn, attr => [%$entry] ); + +# We need to keep the client around, otherwise the test server will exit. +$evaled{'ldap_client'} = $ldap; +#sleep 100; +ENDPERL + +APPCONF=common + +# Cache failed auth checks for 10 seconds. +BEGINAPPCONF +$c->auth_cache_fail = 10; +ENDAPPCONF + +# Clear cache +SCRIPT=echo flush_all | nc -N 127.0.0.1 11211 + +TYPE=PROPFIND +HEADER=Content-Type: text/xml +HEADER=Depth: 1 +AUTH=ldap2:ldap2 +HEAD + +BEGINDATA + + + + + + +ENDDATA + +URL=http://regression_ldap.host/caldav.php/ + +# Check that no usr record has been created. +QUERY +SELECT active, email, fullname, last_used, password, username, user_no +FROM usr +WHERE username = 'ldap2'; +ENDQUERY + +# Check to make sure there is log line about no cached credentials +# and that LDAP is checked. Then entry is cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $failed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap2,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap2/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $failed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap2 found, passed\n"; + } else { + print "Salt found for ldap2, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, failed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth bailed out due to cached credentials, failed\n"; + } + + if ($failed_disabled) { + print "Credential caching for failed attempts disabled, failed\n"; + } else { + print "Credential caching for failed attempts disabled not seen, passed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL + +URL=http://regression_ldap.host/caldav.php/ + +# Check again to make sure cached credentialsare checked. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $failed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap2,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap2 are good and invalid/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $failed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap2 found, failed\n"; + } else { + print "Salt found for ldap2, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, correct, passed\n"; + } else { + print "No cached credentials found, failed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, failed\n"; + } else { + print "No connection to LDAP, passed\n"; + } + + if ($failed_disabled) { + print "Credential caching for failed attempts disabled, failed\n"; + } else { + print "Credential caching for failed attempts disabled not seen, passed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Wait longer than failed cache expiry time. +sleep 15; + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL + +URL=http://regression_ldap.host/caldav.php/ + +# Check to make sure there is log line about no cached credentials +# and that LDAP is checked. Then entry is cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $failed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap2,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap2/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $failed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap2 found, failed\n"; + } else { + print "Salt found for ldap2, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, failed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth bailed out due to cached credentials, failed\n"; + } + + if ($failed_disabled) { + print "Credential caching for failed attempts disabled, failed\n"; + } else { + print "Credential caching for failed attempts disabled not seen, passed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL + diff --git a/testing/tests/ldap_memcache/0010-pass_cache_disabled.result b/testing/tests/ldap_memcache/0010-pass_cache_disabled.result new file mode 100644 index 00000000..37bfdd72 --- /dev/null +++ b/testing/tests/ldap_memcache/0010-pass_cache_disabled.result @@ -0,0 +1,139 @@ +OK +HTTP/1.1 207 Multi-Status +Date: Dow, 01 Jan 2000 00:00:00 GMT +DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule +DAV: extended-mkcol, bind, addressbook, calendar-auto-schedule, calendar-proxy +ETag: "ed58709591152964fd4a584af5b55d79" +Content-Length: 942 +Content-Type: text/xml; charset="utf-8" + + + + + /caldav.php/ + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource1/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource2/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/ldap1/ + + + + + + + + HTTP/1.1 200 OK + + + + +SQL Query 1 Result: + active: >1< + email: >ldap1@example.com< + fullname: >ldap1< + last_used: >NULL< + password: >NULL< + user_no: >1001< + username: >ldap1< + +No salt for ldap1 found, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for passed attempts disabled, passed + + + +HTTP/1.1 207 Multi-Status +Date: Dow, 01 Jan 2000 00:00:00 GMT +DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule +DAV: extended-mkcol, bind, addressbook, calendar-auto-schedule, calendar-proxy +ETag: "ed58709591152964fd4a584af5b55d79" +Content-Length: 942 +Content-Type: text/xml; charset="utf-8" + + + + + /caldav.php/ + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource1/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource2/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/ldap1/ + + + + + + + + HTTP/1.1 200 OK + + + + +No salt for ldap1 found, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for failed attempts disabled, passed diff --git a/testing/tests/ldap_memcache/0010-pass_cache_disabled.test b/testing/tests/ldap_memcache/0010-pass_cache_disabled.test new file mode 100644 index 00000000..fe54cdba --- /dev/null +++ b/testing/tests/ldap_memcache/0010-pass_cache_disabled.test @@ -0,0 +1,191 @@ +# Test again for an invalid user with fail caching disabled to make sure +# the failure isn't cached. +BEGINPERL +if ($debug) { $ENV{'LDAP_DEBUG'} = 1 }; + +use Net::LDAP::Server::Test; +use Net::LDAP; +use IO::Socket::INET; + +my $ldap_port = 21394; +my $ldap_socket = IO::Socket::INET->new( + Listen => 5, + Proto => 'tcp', + Reuse => 1, + LocalPort => $ldap_port, +); + +# Keep it around after this block exits. +$evaled{'ldap_server'} = Net::LDAP::Server::Test->new( $ldap_socket, auto_schema => 1 ); + +my $ldap = Net::LDAP->new("localhost:$ldap_port") || die "Failed to instantiate Net::LDAP: $!"; +$ldap->bind(); +my $username = "ldap1"; +my $base = "dc=example,dc=com"; +my $dn = "uid=$username,ou=users,$base"; +my $entry = { + cn => $username, + mail => "$username\@example.com", + uid => $username, + objectClass => 'User', + userPassword => 'ldap1', +}; +$ldap->add( $base ); +$ldap->add( $dn, attr => [%$entry] ); + +# We need to keep the client around, otherwise the test server will exit. +$evaled{'ldap_client'} = $ldap; +#sleep 100; +ENDPERL + +APPCONF=common + +# Disabled caching of failed auth checks. +BEGINAPPCONF +$c->auth_cache_pass = 0; +ENDAPPCONF + +# Clear cache +SCRIPT=echo flush_all | nc -N 127.0.0.1 11211 + +TYPE=PROPFIND +HEADER=Content-Type: text/xml +HEADER=Depth: 1 +AUTH=ldap1:ldap1 +HEAD + +BEGINDATA + + + + + + +ENDDATA + +URL=http://regression_ldap.host/caldav.php/ + +# Check that no usr record has been created. +QUERY +SELECT active, email, fullname, last_used, password, username, user_no +FROM usr +WHERE username = 'ldap1'; +ENDQUERY + +# Check to make sure there is no status line about caching credentials +# and that LDAP is checked. The result should not get cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $passed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap1,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap1/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $passed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap1 found, passed\n"; + } else { + print "Salt found for ldap1, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, failed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth bailed out due to cached credentials, failed\n"; + } + + if ($passed_disabled) { + print "Credential caching for passed attempts disabled, passed\n"; + } else { + print "Credential caching for passed attempts disabled not seen, failed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL + +URL=http://regression_ldap.host/caldav.php/ + +# Check again to make sure there is no status line about caching credentials +# and that LDAP is checked. The result should not get cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $failed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap1,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap1/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $failed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap1 found, passed\n"; + } else { + print "Salt found for ldap1, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, failed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth bailed out due to cached credentials, failed\n"; + } + + if ($failed_disabled) { + print "Credential caching for failed attempts disabled, passed\n"; + } else { + print "Credential caching for failed attempts disabled not seen, failed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} +ENDPERL + diff --git a/testing/tests/ldap_memcache/0011-pass_cache_enabled.result b/testing/tests/ldap_memcache/0011-pass_cache_enabled.result new file mode 100644 index 00000000..e9b16ab0 --- /dev/null +++ b/testing/tests/ldap_memcache/0011-pass_cache_enabled.result @@ -0,0 +1,208 @@ +OK +HTTP/1.1 207 Multi-Status +Date: Dow, 01 Jan 2000 00:00:00 GMT +DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule +DAV: extended-mkcol, bind, addressbook, calendar-auto-schedule, calendar-proxy +ETag: "ed58709591152964fd4a584af5b55d79" +Content-Length: 942 +Content-Type: text/xml; charset="utf-8" + + + + + /caldav.php/ + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource1/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource2/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/ldap1/ + + + + + + + + HTTP/1.1 200 OK + + + + +SQL Query 1 Result: + active: >1< + email: >ldap1@example.com< + fullname: >ldap1< + last_used: >NULL< + password: >NULL< + user_no: >1001< + username: >ldap1< + +No salt for ldap1 found, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for passed attempts disabled not seen, passed + + + +HTTP/1.1 207 Multi-Status +Date: Dow, 01 Jan 2000 00:00:00 GMT +DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule +DAV: extended-mkcol, bind, addressbook, calendar-auto-schedule, calendar-proxy +ETag: "ed58709591152964fd4a584af5b55d79" +Content-Length: 942 +Content-Type: text/xml; charset="utf-8" + + + + + /caldav.php/ + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource1/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource2/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/ldap1/ + + + + + + + + HTTP/1.1 200 OK + + + + +Salt found for ldap1, passed +Cached credentials found, correct, passed +No connection to LDAP, passed +Credential caching for passed attempts disabled not seen, passed + + + +HTTP/1.1 207 Multi-Status +Date: Dow, 01 Jan 2000 00:00:00 GMT +DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule +DAV: extended-mkcol, bind, addressbook, calendar-auto-schedule, calendar-proxy +ETag: "ed58709591152964fd4a584af5b55d79" +Content-Length: 942 +Content-Type: text/xml; charset="utf-8" + + + + + /caldav.php/ + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource1/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/resource2/ + + + + + + + + HTTP/1.1 200 OK + + + + /caldav.php/ldap1/ + + + + + + + + HTTP/1.1 200 OK + + + + +Salt found for ldap1, passed +No cached credentials found, passed +Connected to LDAP server, passed +Credential caching for passed attempts disabled not seen, passed + + + diff --git a/testing/tests/ldap_memcache/0011-pass_cache_enabled.test b/testing/tests/ldap_memcache/0011-pass_cache_enabled.test new file mode 100644 index 00000000..3195abe8 --- /dev/null +++ b/testing/tests/ldap_memcache/0011-pass_cache_enabled.test @@ -0,0 +1,259 @@ +# Test for a valid user with pass caching enabled to make sure the success is +# cached, then wait a short while to see it is expired. +BEGINPERL +if ($debug) { $ENV{'LDAP_DEBUG'} = 1 }; + +use Net::LDAP::Server::Test; +use Net::LDAP; +use IO::Socket::INET; + +#my $port = find_idle_port(); + +#my $ldap_port = RT::Test->find_idle_port; +my $ldap_port = 21394; +my $ldap_socket = IO::Socket::INET->new( + Listen => 5, + Proto => 'tcp', + Reuse => 1, + LocalPort => $ldap_port, +); + +# Keep it around after this block exits. +$evaled{'ldap_server'} = Net::LDAP::Server::Test->new( $ldap_socket, auto_schema => 1 ); + +my $ldap = Net::LDAP->new("localhost:$ldap_port") || die "Failed to instantiate Net::LDAP: $!"; +$ldap->bind(); +my $username = "ldap1"; +my $base = "dc=example,dc=com"; +my $dn = "uid=$username,ou=users,$base"; +my $entry = { + cn => $username, + mail => "$username\@example.com", + uid => $username, + objectClass => 'User', + userPassword => 'ldap1', +}; +$ldap->add( $base ); +$ldap->add( $dn, attr => [%$entry] ); + +# We need to keep the client around, otherwise the test server will exit. +$evaled{'ldap_client'} = $ldap; +#sleep 100; +ENDPERL + +APPCONF=common + +# Caach of passed auth checks for only 10 seconds. +BEGINAPPCONF +$c->auth_cache_pass = 10; +ENDAPPCONF + +# Clear cache +SCRIPT=echo flush_all | nc -N 127.0.0.1 11211 + +TYPE=PROPFIND +HEADER=Content-Type: text/xml +HEADER=Depth: 1 +AUTH=ldap1:ldap1 +HEAD + +BEGINDATA + + + + + + +ENDDATA + +URL=http://regression_ldap.host/caldav.php/ + +# Check that no usr record has been created. +QUERY +SELECT active, email, fullname, last_used, password, username, user_no +FROM usr +WHERE username = 'ldap1'; +ENDQUERY + +# Check to make sure there is a log line about no cached credentials +# and that LDAP is checked. Then entry is cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $passed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap1,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap1/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $passed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap1 found, passed\n"; + } else { + print "Salt found for ldap1, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, passed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth passed out due to cached credentials, failed\n"; + } + + if ($passed_disabled) { + print "Credential caching for passed attempts disabled, failed\n"; + } else { + print "Credential caching for passed attempts disabled not seen, passed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL + +URL=http://regression_ldap.host/caldav.php/ + +# Check that cached credentials are used, and LDAP is not checked. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $passed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap1,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap1 are good and valid/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $passed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap1 found, failed\n"; + } else { + print "Salt found for ldap1, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, correct, passed\n"; + } else { + print "No cached credentials found, failed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, failed\n"; + } else { + print "No connection to LDAP, passed\n"; + } + + if ($passed_disabled) { + print "Credential caching for passed attempts disabled, failed\n"; + } else { + print "Credential caching for passed attempts disabled not seen, passed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Wait longer than cache expiry time. +sleep 15; + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL + +URL=http://regression_ldap.host/caldav.php/ + +# Check to make sure there is log line about no cached credentials +# and that LDAP is checked. Then entry is cached. +BEGINPERL +my $log_file = '/var/log/apache2/regression-error.log'; +open(my $log, "< $log_file") + || die "Failed to open $log_file for reading: $!"; + +my $no_salt = 0; +my $cached_creds = 0; +my $ldap_conn = 0; +my $passed_disabled = 0; + +if (defined $request_id) { + while (<$log>) { + if (/davical: $request_id: (?:\*\*\*|ALL): (?:(?:ERROR:)?HTTPAuth:CheckCache|LDAP:drivers_ldap ): (.*)/) { + my $msg = $1; + if ($msg =~ /^No stored salt for ldap1,/) { + $no_salt = 1; + } elsif ($msg =~ /^Cached credentials for ldap1/) { + $cached_creds = 1; + } elsif ($msg =~ /^Connected to LDAP server/) { + $ldap_conn = 1; + } elsif ($msg =~ /^SetCache: Expiry set to 0, not caching credential/) { + $passed_disabled = 1; + } + } + } + + if ($no_salt) { + print "No salt for ldap1 found, failed\n"; + } else { + print "Salt found for ldap1, passed\n"; + } + + if ($cached_creds) { + print "Cached credentials found, incorrect, failed\n"; + } else { + print "No cached credentials found, passed\n"; + } + + if ($ldap_conn) { + print "Connected to LDAP server, passed\n"; + } else { + print "No connection to LDAP, auth passed due to cached credentials, failed\n"; + } + + if ($passed_disabled) { + print "Credential caching for passed attempts disabled, failed\n"; + } else { + print "Credential caching for passed attempts disabled not seen, passed\n"; + } +} else { + print "No request_id found, can't check log file, failed\n"; +} + +# Put some blank lines in the output to break up the sections. +print "\n\n\n"; +ENDPERL diff --git a/testing/tests/ldap_memcache/common.appconf b/testing/tests/ldap_memcache/common.appconf new file mode 100644 index 00000000..99b99582 --- /dev/null +++ b/testing/tests/ldap_memcache/common.appconf @@ -0,0 +1,7 @@ +auth_cache = true; +$c->auth_cache_secret = 'not safe, regression testing only'; +$c->auth_cache_pass = 15 * 60; +$c->auth_cache_fail = 15 * 60;