153 lines
7.1 KiB
Erlang
153 lines
7.1 KiB
Erlang
%%--------------------------------------------------------------------
|
|
%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
%%
|
|
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
%% you may not use this file except in compliance with the License.
|
|
%% You may obtain a copy of the License at
|
|
%%
|
|
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
%%
|
|
%% Unless required by applicable law or agreed to in writing, software
|
|
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
%% See the License for the specific language governing permissions and
|
|
%% limitations under the License.
|
|
%%--------------------------------------------------------------------
|
|
|
|
-module(emqx_auth_ldap_SUITE).
|
|
|
|
-compile(export_all).
|
|
-compile(nowarn_export_all).
|
|
|
|
-include_lib("emqx/include/emqx.hrl").
|
|
-include_lib("eunit/include/eunit.hrl").
|
|
-include_lib("common_test/include/ct.hrl").
|
|
|
|
-define(PID, emqx_auth_ldap).
|
|
|
|
-define(APP, emqx_auth_ldap).
|
|
|
|
-define(DeviceDN, "ou=test_device,dc=emqx,dc=io").
|
|
|
|
-define(AuthDN, "ou=test_auth,dc=emqx,dc=io").
|
|
|
|
%%--------------------------------------------------------------------
|
|
%% Setups
|
|
%%--------------------------------------------------------------------
|
|
|
|
all() ->
|
|
[{group, nossl}, {group, ssl}].
|
|
|
|
groups() ->
|
|
Cases = emqx_ct:all(?MODULE),
|
|
[{nossl, Cases}, {ssl, Cases}].
|
|
|
|
init_per_group(GrpName, Cfg) ->
|
|
Fun = fun(App) -> set_special_configs(GrpName, App) end,
|
|
emqx_ct_helpers:start_apps([emqx_auth_ldap], Fun),
|
|
Cfg.
|
|
|
|
end_per_group(_GrpName, _Cfg) ->
|
|
emqx_ct_helpers:stop_apps([emqx_auth_ldap]).
|
|
|
|
%%--------------------------------------------------------------------
|
|
%% Cases
|
|
%%--------------------------------------------------------------------
|
|
|
|
t_check_auth(_) ->
|
|
MqttUser1 = #{clientid => <<"mqttuser1">>,
|
|
username => <<"mqttuser0001">>,
|
|
password => <<"mqttuser0001">>,
|
|
zone => external},
|
|
MqttUser2 = #{clientid => <<"mqttuser2">>,
|
|
username => <<"mqttuser0002">>,
|
|
password => <<"mqttuser0002">>,
|
|
zone => external},
|
|
MqttUser3 = #{clientid => <<"mqttuser3">>,
|
|
username => <<"mqttuser0003">>,
|
|
password => <<"mqttuser0003">>,
|
|
zone => external},
|
|
MqttUser4 = #{clientid => <<"mqttuser4">>,
|
|
username => <<"mqttuser0004">>,
|
|
password => <<"mqttuser0004">>,
|
|
zone => external},
|
|
MqttUser5 = #{clientid => <<"mqttuser5">>,
|
|
username => <<"mqttuser0005">>,
|
|
password => <<"mqttuser0005">>,
|
|
zone => external},
|
|
NonExistUser1 = #{clientid => <<"mqttuser6">>,
|
|
username => <<"mqttuser0006">>,
|
|
password => <<"mqttuser0006">>,
|
|
zone => external},
|
|
NonExistUser2 = #{clientid => <<"mqttuser7">>,
|
|
username => <<"mqttuser0005">>,
|
|
password => <<"mqttuser0006">>,
|
|
zone => external},
|
|
ct:log("MqttUser: ~p", [emqx_access_control:authenticate(MqttUser1)]),
|
|
?assertMatch({ok, #{auth_result := success}}, emqx_access_control:authenticate(MqttUser1)),
|
|
?assertMatch({ok, #{auth_result := success}}, emqx_access_control:authenticate(MqttUser2)),
|
|
?assertMatch({ok, #{auth_result := success}}, emqx_access_control:authenticate(MqttUser3)),
|
|
?assertMatch({ok, #{auth_result := success}}, emqx_access_control:authenticate(MqttUser4)),
|
|
?assertMatch({ok, #{auth_result := success}}, emqx_access_control:authenticate(MqttUser5)),
|
|
?assertEqual({error, not_authorized}, emqx_access_control:authenticate(NonExistUser1)),
|
|
?assertEqual({error, bad_username_or_password}, emqx_access_control:authenticate(NonExistUser2)).
|
|
|
|
t_check_acl(_) ->
|
|
MqttUser = #{clientid => <<"mqttuser1">>, username => <<"mqttuser0001">>, zone => external},
|
|
NoMqttUser = #{clientid => <<"mqttuser2">>, username => <<"mqttuser0007">>, zone => external},
|
|
allow = emqx_access_control:check_acl(MqttUser, publish, <<"mqttuser0001/pub/1">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, publish, <<"mqttuser0001/pub/+">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, publish, <<"mqttuser0001/pub/#">>),
|
|
|
|
allow = emqx_access_control:check_acl(MqttUser, subscribe, <<"mqttuser0001/sub/1">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, subscribe, <<"mqttuser0001/sub/+">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, subscribe, <<"mqttuser0001/sub/#">>),
|
|
|
|
allow = emqx_access_control:check_acl(MqttUser, publish, <<"mqttuser0001/pubsub/1">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, publish, <<"mqttuser0001/pubsub/+">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, publish, <<"mqttuser0001/pubsub/#">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, subscribe, <<"mqttuser0001/pubsub/1">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, subscribe, <<"mqttuser0001/pubsub/+">>),
|
|
allow = emqx_access_control:check_acl(MqttUser, subscribe, <<"mqttuser0001/pubsub/#">>),
|
|
|
|
deny = emqx_access_control:check_acl(NoMqttUser, publish, <<"mqttuser0001/req/mqttuser0001/+">>),
|
|
deny = emqx_access_control:check_acl(MqttUser, publish, <<"mqttuser0001/req/mqttuser0002/+">>),
|
|
deny = emqx_access_control:check_acl(MqttUser, subscribe, <<"mqttuser0001/req/+/mqttuser0002">>),
|
|
ok.
|
|
|
|
%%--------------------------------------------------------------------
|
|
%% Helpers
|
|
%%--------------------------------------------------------------------
|
|
|
|
set_special_configs(_, emqx) ->
|
|
application:set_env(emqx, allow_anonymous, false),
|
|
application:set_env(emqx, enable_acl_cache, false),
|
|
application:set_env(emqx, acl_nomatch, deny),
|
|
AclFilePath = filename:join(["test", "emqx_SUITE_data", "acl.conf"]),
|
|
application:set_env(emqx, acl_file,
|
|
emqx_ct_helpers:deps_path(emqx, AclFilePath)),
|
|
LoadedPluginPath = filename:join(["test", "emqx_SUITE_data", "loaded_plugins"]),
|
|
application:set_env(emqx, plugins_loaded_file,
|
|
emqx_ct_helpers:deps_path(emqx, LoadedPluginPath));
|
|
|
|
set_special_configs(Ssl, emqx_auth_ldap) ->
|
|
case Ssl == ssl of
|
|
true ->
|
|
LdapOpts = application:get_env(emqx_auth_ldap, ldap, []),
|
|
Path = emqx_ct_helpers:deps_path(emqx_auth_ldap, "test/certs/"),
|
|
SslOpts = [{verify, verify_peer},
|
|
{fail_if_no_peer_cert, true},
|
|
{server_name_indication, disable},
|
|
{keyfile, Path ++ "/client-key.pem"},
|
|
{certfile, Path ++ "/client-cert.pem"},
|
|
{cacertfile, Path ++ "/cacert.pem"}],
|
|
LdapOpts1 = lists:keystore(ssl, 1, LdapOpts, {ssl, true}),
|
|
LdapOpts2 = lists:keystore(sslopts, 1, LdapOpts1, {sslopts, SslOpts}),
|
|
LdapOpts3 = lists:keystore(port, 1, LdapOpts2, {port, 636}),
|
|
application:set_env(emqx_auth_ldap, ldap, LdapOpts3);
|
|
_ ->
|
|
ok
|
|
end,
|
|
application:set_env(emqx_auth_ldap, device_dn, "ou=testdevice, dc=emqx, dc=io").
|
|
|