public function LdapAuthorizationBasicTests::testFlags in Lightweight Directory Access Protocol (LDAP) 7.2

Same name and namespace in other branches

1. 8.2 ldap_authorization/tests/BasicTests.test \LdapAuthorizationBasicTests::testFlags()
2. 7 ldap_authorization/tests/BasicTests/BasicTests.test \LdapAuthorizationBasicTests::testFlags()

Authorization configuration flags tests clumped together.

File

ldap_authorization/tests/BasicTests.test, line 212

Class

LdapAuthorizationBasicTests

Code

public function testFlags() {
  $sid = 'activedirectory1';
  $this
    ->prepTestData(LDAP_TEST_LDAP_NAME, [
    $sid,
  ], 'provisionToDrupal', 'default', 'drupal_role_default');

  /**
   * LDAP_authorz.Flags.status=0: Disable ldap_authorization_drupal_role configuration and make sure no authorizations performed
   */
  $user = $this
    ->drupalCreateUser([]);
  $hpotter = $this->testFunctions
    ->drupalLdapUpdateUser([
    'name' => 'hpotter',
    'mail' => 'hpotter@hogwarts.edu',
  ], TRUE, $user);

  // Just see if the correct ones are derived.
  list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($hpotter, 'query');
  $roles1 = $new_authorizations['drupal_role'];
  $this->consumerAdminConf['drupal_role']->status = 0;
  $this->consumerAdminConf['drupal_role']
    ->save();

  // Just see if the correct ones are derived.
  list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($hpotter, 'query', 'drupal_role');
  $roles2 = isset($new_authorizations['drupal_role']) ? $new_authorizations['drupal_role'] : [];

  // Not worried about which roles here, just that some are granted.
  $correct_roles = count($roles1) > 0 && count($roles2) == 0;

  /** @FIXME: Broken test
   * $this->assertTrue(
   * $correct_roles,
   * 'disable consumer configuration disallows authorizations.',
   * 'LDAP_authorz.Flags.status.0'
   * );
   */
  if (!$correct_roles) {
    debug('LDAP_authorz.Flags.enable.0 roles with enabled');
    debug($roles1);
    debug('LDAP_authorz.Flags.enable.0 roles with disabled');
    debug($roles2);
  }

  /**
   * LDAP_authorz.onlyLdapAuthenticated=1: create normal user and
   * apply authorization query.  should return no roles
   */
  $this->consumerAdminConf['drupal_role']->onlyApplyToLdapAuthenticated = 1;
  $this->consumerAdminConf['drupal_role']->status = 1;
  $this->consumerAdminConf['drupal_role']
    ->save();
  $user = $this
    ->drupalCreateUser([]);
  $hgrainger = $this->testFunctions
    ->drupalLdapUpdateUser([
    'name' => 'hgrainger',
    'mail' => 'hgrainger@hogwarts.edu',
  ], TRUE, $user);

  // Remove authmap in case it exists so test will work.
  db_delete('authmap')
    ->condition('uid', $user->uid)
    ->condition('module', 'ldap_user')
    ->execute();

  // Just see if the correct ones are derived.
  list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($hgrainger, 'query');
  $roles = isset($new_authorizations['drupal_role']) ? $new_authorizations['drupal_role'] : [];
  $success = count($roles) == 0;
  $this
    ->assertTrue($success, ' only apply to ldap authenticated grants no roles for non ldap user.', 'LDAP_authorz.onlyLdapAuthenticated.1');
  if (!$success) {
    debug('LDAP_authorz.onlyLdapAuthenticated.1');
    debug($roles);
    debug($this->testFunctions
      ->ldapUserIsAuthmapped('hgrainger'));
    debug($new_authorizations);
    debug($notifications);
  }

  /**
   * LDAP_authorz.Flags.synchOnLogon - execute logon and check that no roles are applied if disabled
   */
  $this->consumerAdminConf['drupal_role']->synchOnLogon = 0;
  $this->consumerAdminConf['drupal_role']
    ->save();
  $edit = [
    'name' => 'hgrainger',
    'pass' => 'goodpwd',
  ];
  $this
    ->drupalPost('user', $edit, t('Log in'));
  $this
    ->assertText(t('Member for'), 'New Ldap user with good password authenticated.', 'LDAP_authorz.Flags.synchOnLogon.0');
  $this
    ->assertTrue($this->testFunctions
    ->ldapUserIsAuthmapped('hgrainger'), 'Ldap user properly authmapped.', 'LDAP_authorz.Flags.synchOnLogon.0');
  $hgrainger = user_load_by_name('hgrainger');
  $this
    ->drupalGet('user/logout');
  $this->consumerAdminConf['drupal_role']->synchOnLogon = 1;
  $this->consumerAdminConf['drupal_role']
    ->save();
  $edit = [
    'name' => 'hgrainger',
    'pass' => 'goodpwd',
  ];
  $this
    ->drupalPost('user', $edit, t('Log in'));
  $this
    ->assertText(t('Member for'), 'New Ldap user with good password authenticated.', 'LDAP_authorz.Flags.synchOnLogon=1');
  $hgrainger = user_load_by_name('hgrainger');
  $this
    ->drupalGet('user/logout');

  // Create a couple roles for next 2 tests.
  $troublemaker = new stdClass();
  $troublemaker->name = 'troublemaker';
  user_role_save($troublemaker);
  $troublemaker = user_role_load_by_name('troublemaker');
  $superadmin = new stdClass();
  $superadmin->name = 'superadmin';
  user_role_save($superadmin);
  $superadmin = user_role_load_by_name('superadmin');

  /**
   * LDAP_authorz.Flags.revokeLdapProvisioned: test flag for
   *   removing manually granted roles
   *
   *   $this->revokeLdapProvisioned == 1 : Revoke !consumer_namePlural previously granted by LDAP Authorization but no longer valid.
   *
   *   grant roles via ldap and some not vai ldap manually,
   *   then alter ldap so they are no longer valid,
   *   then logon again and make sure the ldap provided roles are revoked and the drupal ones are not revoked
   *
   */
  $this->consumerAdminConf['drupal_role']->onlyApplyToLdapAuthenticated = 0;
  $this->consumerAdminConf['drupal_role']->revokeLdapProvisioned = 1;
  $this->consumerAdminConf['drupal_role']->createConsumers = 1;
  $this->consumerAdminConf['drupal_role']
    ->save();

  // Set correct roles manually.
  $hpotter = user_load_by_name('hpotter');
  user_delete($hpotter->uid);
  $user = $this
    ->drupalCreateUser([]);
  $hpotter = $this->testFunctions
    ->drupalLdapUpdateUser([
    'name' => 'hpotter',
    'mail' => 'hpotter@hogwarts.edu',
  ], TRUE, $user);
  $edit = [
    'name' => 'hpotter',
    'pass' => 'goodpwd',
  ];
  $this
    ->drupalPost('user', $edit, t('Log in'));
  $this
    ->assertText(t('Member for'), 'New Ldap user with good password authenticated.', 'LDAP_authorz.Flags.revokeLdapProvisioned=1');
  $hpotter = user_load_by_name('hpotter');

  // Add an underserved, ldap granted drupal role superadmin
  // and an undeserved, non ldap granted role troublemaker.
  $hpotter = user_load($hpotter->uid, TRUE);
  $roles = $hpotter->roles;
  $roles[$troublemaker->rid] = $troublemaker->name;
  $roles[$superadmin->rid] = $superadmin->name;
  $data = [
    'roles' => $roles,
    'data' => [
      'ldap_authorizations' => [
        'drupal_role' => [
          $superadmin->name => [
            'date_granted' => 1304216778,
          ],
        ],
      ],
    ],
  ];
  $hpotter = user_save($hpotter, $data);

  // Apply correct authorizations.  should remove the administrator role but not the manually created 'troublemaker' role.
  list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($hpotter, 'set', 'drupal_role', 'logon');
  $hpotter = user_load($hpotter->uid, TRUE);
  $this
    ->assertTrue(!isset($new_authorizations['drupal_role'][$superadmin->rid]), ' revoke superadmin ldap granted roles when no longer deserved.', 'LDAP_authorz.Flags.revokeLdapProvisioned=1');

  /**
   * LDAP_authorz.Flags.regrantLdapProvisioned
   * $this->regrantLdapProvisioned == 1 :
   *   Re grant !consumer_namePlural previously granted
   *   by LDAP Authorization but removed manually.
   *
   * - manually remove ldap granted role
   * - logon
   * - check if regranted
   */
  $this
    ->drupalGet('user/logout');
  $this->consumerAdminConf['drupal_role']->regrantLdapProvisioned = 1;
  $this->consumerAdminConf['drupal_role']
    ->save();
  $hpotter = user_load($hpotter->uid, TRUE);
  $roles = $hpotter->roles;
  unset($roles[$superadmin->rid]);
  user_save($hpotter, [
    'roles' => $roles,
  ]);
  $hpotter = user_load($hpotter->uid, TRUE);
  list($new_authorizations, $notifications) = ldap_authorizations_user_authorizations($hpotter, 'set', 'drupal_role', 'logon');
  $hpotter = user_load($hpotter->uid, TRUE);
  $success = !in_array('administrator', array_values($hpotter->roles));
  $this
    ->assertTrue($success, 'regrant Ldap Provisioned roles that were manually revoked', 'LDAP_authorz.Flags.regrantLdapProvisioned=1');
  if (!$success) {
    debug('LDAP_authorz.Flags.regrantLdapProvisioned=1');
    debug('hpotter roles');
    debug($hpotter->roles);
    debug('new_authorizations');
    debug($new_authorizations);
  }

  /**
   * LDAP_authorz.Flags.createConsumers=1
   */

  // Add new mapping to and enable create consumers.
  $this
    ->prepTestData(LDAP_TEST_LDAP_NAME, [
    $sid,
  ], 'provisionToDrupal', 'default', 'drupal_role_default');
  $this
    ->drupalGet('user/logout');
  $new_role = 'oompa-loompas';
  $this->consumerAdminConf['drupal_role']->createConsumers = 1;
  $this->consumerAdminConf['drupal_role']->mappings[] = [
    'from' => 'cn=students,ou=groups,dc=hogwarts,dc=edu',
    'user_entered' => $new_role,
    'normalized' => $new_role,
    'simplified' => $new_role,
    'valid' => TRUE,
    'error_message' => '',
  ];
  $this->consumerAdminConf['drupal_role']
    ->save();
  $edit = [
    'name' => 'hpotter',
    'pass' => 'goodpwd',
  ];
  $this
    ->drupalPost('user', $edit, t('Log in'));
  $new_role_created = in_array($new_role, array_values(user_roles()));
  $roles_by_name = array_flip(user_roles());
  $hpotter = user_load_by_name('hpotter');
  $hpotter = user_load($hpotter->uid, TRUE);
  $role_granted = isset($hpotter->roles[$roles_by_name[$new_role]]);
  $this
    ->assertTrue($new_role_created && $role_granted, 'create consumers (e.g. roles)', 'LDAP_authorz.Flags.createConsumers=1');
  if (!($new_role_created && $role_granted)) {
    debug('roles');
    debug(user_roles());
    debug('roles by name');
    debug($roles_by_name);
    debug('hpotter->roles');
    debug($hpotter->roles);
    debug("new role desired: {$new_role}");
    debug("{$new_role_created} AND {$role_granted}");
  }
}