1 # -*- coding: utf-8 -*-
2 # pylint: disable=dangerous-default-value,too-many-public-methods
3 from __future__
import absolute_import
8 from ..services
.sso
import load_sso_db
9 from ..tests
import CLICommandTestMixin
, CmdException
12 class AccessControlTest(unittest
.TestCase
, CLICommandTestMixin
):
13 IDP_METADATA
= '''<?xml version="1.0"?>
14 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
15 xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
16 entityID="https://testidp.ceph.com/simplesamlphp/saml2/idp/metadata.php"
17 ID="pfx8ca6fbd7-6062-d4a9-7995-0730aeb8114f">
20 <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
21 <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
22 <ds:Reference URI="#pfx8ca6fbd7-6062-d4a9-7995-0730aeb8114f">
24 <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
25 <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
27 <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
28 <ds:DigestValue>v6V8fooEUeq/LO/59JCfJF69Tw3ohN52OGAY6X3jX8w=</ds:DigestValue>
31 <ds:SignatureValue>IDP_SIGNATURE_VALUE</ds:SignatureValue>
34 <ds:X509Certificate>IDP_X509_CERTIFICATE</ds:X509Certificate>
38 <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
39 <md:KeyDescriptor use="signing">
40 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
42 <ds:X509Certificate>IDP_X509_CERTIFICATE</ds:X509Certificate>
46 <md:KeyDescriptor use="encryption">
47 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
49 <ds:X509Certificate>IDP_X509_CERTIFICATE</ds:X509Certificate>
53 <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
54 Location="https://testidp.ceph.com/simplesamlphp/saml2/idp/SingleLogoutService.php"/>
55 <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
56 <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
57 Location="https://testidp.ceph.com/simplesamlphp/saml2/idp/SSOService.php"/>
58 </md:IDPSSODescriptor>
59 </md:EntityDescriptor>'''
65 def validate_onelogin_settings(self
, onelogin_settings
, ceph_dashboard_base_url
, uid
,
66 sp_x509cert
, sp_private_key
, signature_enabled
):
67 self
.assertIn('sp', onelogin_settings
)
68 self
.assertIn('entityId', onelogin_settings
['sp'])
69 self
.assertEqual(onelogin_settings
['sp']['entityId'],
70 '{}/auth/saml2/metadata'.format(ceph_dashboard_base_url
))
72 self
.assertIn('assertionConsumerService', onelogin_settings
['sp'])
73 self
.assertIn('url', onelogin_settings
['sp']['assertionConsumerService'])
74 self
.assertEqual(onelogin_settings
['sp']['assertionConsumerService']['url'],
75 '{}/auth/saml2'.format(ceph_dashboard_base_url
))
77 self
.assertIn('attributeConsumingService', onelogin_settings
['sp'])
78 attribute_consuming_service
= onelogin_settings
['sp']['attributeConsumingService']
79 self
.assertIn('requestedAttributes', attribute_consuming_service
)
80 requested_attributes
= attribute_consuming_service
['requestedAttributes']
81 self
.assertEqual(len(requested_attributes
), 1)
82 self
.assertIn('name', requested_attributes
[0])
83 self
.assertEqual(requested_attributes
[0]['name'], uid
)
85 self
.assertIn('singleLogoutService', onelogin_settings
['sp'])
86 self
.assertIn('url', onelogin_settings
['sp']['singleLogoutService'])
87 self
.assertEqual(onelogin_settings
['sp']['singleLogoutService']['url'],
88 '{}/auth/saml2/logout'.format(ceph_dashboard_base_url
))
90 self
.assertIn('x509cert', onelogin_settings
['sp'])
91 self
.assertEqual(onelogin_settings
['sp']['x509cert'], sp_x509cert
)
93 self
.assertIn('privateKey', onelogin_settings
['sp'])
94 self
.assertEqual(onelogin_settings
['sp']['privateKey'], sp_private_key
)
96 self
.assertIn('security', onelogin_settings
)
97 self
.assertIn('authnRequestsSigned', onelogin_settings
['security'])
98 self
.assertEqual(onelogin_settings
['security']['authnRequestsSigned'], signature_enabled
)
100 self
.assertIn('logoutRequestSigned', onelogin_settings
['security'])
101 self
.assertEqual(onelogin_settings
['security']['logoutRequestSigned'], signature_enabled
)
103 self
.assertIn('logoutResponseSigned', onelogin_settings
['security'])
104 self
.assertEqual(onelogin_settings
['security']['logoutResponseSigned'], signature_enabled
)
106 self
.assertIn('wantMessagesSigned', onelogin_settings
['security'])
107 self
.assertEqual(onelogin_settings
['security']['wantMessagesSigned'], signature_enabled
)
109 self
.assertIn('wantAssertionsSigned', onelogin_settings
['security'])
110 self
.assertEqual(onelogin_settings
['security']['wantAssertionsSigned'], signature_enabled
)
112 def test_sso_saml2_setup(self
):
113 result
= self
.exec_cmd('sso setup saml2',
114 ceph_dashboard_base_url
='https://cephdashboard.local',
115 idp_metadata
=self
.IDP_METADATA
)
116 self
.validate_onelogin_settings(result
, 'https://cephdashboard.local', 'uid', '', '',
119 def test_sso_enable_saml2(self
):
120 with self
.assertRaises(CmdException
) as ctx
:
121 self
.exec_cmd('sso enable saml2')
123 self
.assertEqual(ctx
.exception
.retcode
, -errno
.EPERM
)
124 self
.assertEqual(str(ctx
.exception
), 'Single Sign-On is not configured: '
125 'use `ceph dashboard sso setup saml2`')
127 self
.exec_cmd('sso setup saml2',
128 ceph_dashboard_base_url
='https://cephdashboard.local',
129 idp_metadata
=self
.IDP_METADATA
)
131 result
= self
.exec_cmd('sso enable saml2')
132 self
.assertEqual(result
, 'SSO is "enabled" with "SAML2" protocol.')
134 def test_sso_disable(self
):
135 result
= self
.exec_cmd('sso disable')
136 self
.assertEqual(result
, 'SSO is "disabled".')
138 def test_sso_status(self
):
139 result
= self
.exec_cmd('sso status')
140 self
.assertEqual(result
, 'SSO is "disabled".')
142 self
.exec_cmd('sso setup saml2',
143 ceph_dashboard_base_url
='https://cephdashboard.local',
144 idp_metadata
=self
.IDP_METADATA
)
146 result
= self
.exec_cmd('sso status')
147 self
.assertEqual(result
, 'SSO is "enabled" with "SAML2" protocol.')
149 def test_sso_show_saml2(self
):
150 result
= self
.exec_cmd('sso show saml2')
151 self
.assertEqual(result
, {
152 'onelogin_settings': {}