1 # -*- coding: utf-8 -*-
2 # pylint: disable=dangerous-default-value,too-many-public-methods
3 from __future__
import absolute_import
8 from . import CmdException
, exec_dashboard_cmd
, KVStoreMockMixin
9 from ..services
.sso
import handle_sso_command
, load_sso_db
12 class AccessControlTest(unittest
.TestCase
, KVStoreMockMixin
):
13 IDP_METADATA
= '''<?xml version="1.0"?>
14 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
15 xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
16 entityID="https://testidp.ceph.com/simplesamlphp/saml2/idp/metadata.php"
17 ID="pfx8ca6fbd7-6062-d4a9-7995-0730aeb8114f">
20 <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
21 <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
22 <ds:Reference URI="#pfx8ca6fbd7-6062-d4a9-7995-0730aeb8114f">
24 <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
25 <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
27 <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
28 <ds:DigestValue>v6V8fooEUeq/LO/59JCfJF69Tw3ohN52OGAY6X3jX8w=</ds:DigestValue>
31 <ds:SignatureValue>IDP_SIGNATURE_VALUE</ds:SignatureValue>
34 <ds:X509Certificate>IDP_X509_CERTIFICATE</ds:X509Certificate>
38 <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
39 <md:KeyDescriptor use="signing">
40 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
42 <ds:X509Certificate>IDP_X509_CERTIFICATE</ds:X509Certificate>
46 <md:KeyDescriptor use="encryption">
47 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
49 <ds:X509Certificate>IDP_X509_CERTIFICATE</ds:X509Certificate>
53 <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
54 Location="https://testidp.ceph.com/simplesamlphp/saml2/idp/SingleLogoutService.php"/>
55 <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
56 <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
57 Location="https://testidp.ceph.com/simplesamlphp/saml2/idp/SSOService.php"/>
58 </md:IDPSSODescriptor>
59 </md:EntityDescriptor>'''
66 def exec_cmd(cls
, cmd
, **kwargs
):
67 return exec_dashboard_cmd(handle_sso_command
, cmd
, **kwargs
)
69 def validate_onelogin_settings(self
, onelogin_settings
, ceph_dashboard_base_url
, uid
,
70 sp_x509cert
, sp_private_key
, signature_enabled
):
71 self
.assertIn('sp', onelogin_settings
)
72 self
.assertIn('entityId', onelogin_settings
['sp'])
73 self
.assertEqual(onelogin_settings
['sp']['entityId'],
74 '{}/auth/saml2/metadata'.format(ceph_dashboard_base_url
))
76 self
.assertIn('assertionConsumerService', onelogin_settings
['sp'])
77 self
.assertIn('url', onelogin_settings
['sp']['assertionConsumerService'])
78 self
.assertEqual(onelogin_settings
['sp']['assertionConsumerService']['url'],
79 '{}/auth/saml2'.format(ceph_dashboard_base_url
))
81 self
.assertIn('attributeConsumingService', onelogin_settings
['sp'])
82 attribute_consuming_service
= onelogin_settings
['sp']['attributeConsumingService']
83 self
.assertIn('requestedAttributes', attribute_consuming_service
)
84 requested_attributes
= attribute_consuming_service
['requestedAttributes']
85 self
.assertEqual(len(requested_attributes
), 1)
86 self
.assertIn('name', requested_attributes
[0])
87 self
.assertEqual(requested_attributes
[0]['name'], uid
)
89 self
.assertIn('singleLogoutService', onelogin_settings
['sp'])
90 self
.assertIn('url', onelogin_settings
['sp']['singleLogoutService'])
91 self
.assertEqual(onelogin_settings
['sp']['singleLogoutService']['url'],
92 '{}/auth/saml2/logout'.format(ceph_dashboard_base_url
))
94 self
.assertIn('x509cert', onelogin_settings
['sp'])
95 self
.assertEqual(onelogin_settings
['sp']['x509cert'], sp_x509cert
)
97 self
.assertIn('privateKey', onelogin_settings
['sp'])
98 self
.assertEqual(onelogin_settings
['sp']['privateKey'], sp_private_key
)
100 self
.assertIn('security', onelogin_settings
)
101 self
.assertIn('authnRequestsSigned', onelogin_settings
['security'])
102 self
.assertEqual(onelogin_settings
['security']['authnRequestsSigned'], signature_enabled
)
104 self
.assertIn('logoutRequestSigned', onelogin_settings
['security'])
105 self
.assertEqual(onelogin_settings
['security']['logoutRequestSigned'], signature_enabled
)
107 self
.assertIn('logoutResponseSigned', onelogin_settings
['security'])
108 self
.assertEqual(onelogin_settings
['security']['logoutResponseSigned'], signature_enabled
)
110 self
.assertIn('wantMessagesSigned', onelogin_settings
['security'])
111 self
.assertEqual(onelogin_settings
['security']['wantMessagesSigned'], signature_enabled
)
113 self
.assertIn('wantAssertionsSigned', onelogin_settings
['security'])
114 self
.assertEqual(onelogin_settings
['security']['wantAssertionsSigned'], signature_enabled
)
116 def test_sso_saml2_setup(self
):
117 result
= self
.exec_cmd('sso setup saml2',
118 ceph_dashboard_base_url
='https://cephdashboard.local',
119 idp_metadata
=self
.IDP_METADATA
)
120 self
.validate_onelogin_settings(result
, 'https://cephdashboard.local', 'uid', '', '',
123 def test_sso_enable_saml2(self
):
124 with self
.assertRaises(CmdException
) as ctx
:
125 self
.exec_cmd('sso enable saml2')
127 self
.assertEqual(ctx
.exception
.retcode
, -errno
.EPERM
)
128 self
.assertEqual(str(ctx
.exception
), 'Single Sign-On is not configured: '
129 'use `ceph dashboard sso setup saml2`')
131 self
.exec_cmd('sso setup saml2',
132 ceph_dashboard_base_url
='https://cephdashboard.local',
133 idp_metadata
=self
.IDP_METADATA
)
135 result
= self
.exec_cmd('sso enable saml2')
136 self
.assertEqual(result
, 'SSO is "enabled" with "SAML2" protocol.')
138 def test_sso_disable(self
):
139 result
= self
.exec_cmd('sso disable')
140 self
.assertEqual(result
, 'SSO is "disabled".')
142 def test_sso_status(self
):
143 result
= self
.exec_cmd('sso status')
144 self
.assertEqual(result
, 'SSO is "disabled".')
146 self
.exec_cmd('sso setup saml2',
147 ceph_dashboard_base_url
='https://cephdashboard.local',
148 idp_metadata
=self
.IDP_METADATA
)
150 result
= self
.exec_cmd('sso status')
151 self
.assertEqual(result
, 'SSO is "enabled" with "SAML2" protocol.')
153 def test_sso_show_saml2(self
):
154 result
= self
.exec_cmd('sso show saml2')
155 self
.assertEqual(result
, {
156 'onelogin_settings': {}