Skip to content

CI: update tests to also check basic auth fallback #160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 11, 2025
Merged

CI: update tests to also check basic auth fallback #160

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b063262
Update CI script to test basic auth fallback
Alphix May 11, 2025
d455988
CI: update the test password
Alphix May 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
97 changes: 97 additions & 0 deletions scripts/kerberos_ldap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ LDAP_KADMIN_DN="uid=kadmin,${LDAP_KRB_DN}"
LDAP_KADMIN_PW="kadmintest"
LDAP_ADMIN_DN="cn=admin,${LDAP_BASE_DN}"
LDAP_ADMIN_PW="test"
KRB_BOB_PW="bob@BOB@123"
KERBEROS_REALM="$(echo "${DOMAIN}" | tr "[:lower:]" "[:upper:]")"
export LC_ALL=C
export DEBIAN_FRONTEND=noninteractive
Expand Down Expand Up @@ -68,6 +69,7 @@ LDAP kadmin DN : ${LDAP_KADMIN_DN}
LDAP kadmin PW : ${LDAP_KADMIN_PW}
LDAP admin DN : ${LDAP_ADMIN_DN}
LDAP admin PW : ${LDAP_ADMIN_PW}
KRB bob PW : ${KRB_BOB_PW}
==============================================================================
EOF

Expand Down Expand Up @@ -326,6 +328,7 @@ echo "OK"
printf "Creating test user principals ... "
kadmin.local -q "addprinc -randkey -policy defaultpol alice" > /dev/null || die
kadmin.local -q "ktadd -k krb5.alice.keytab alice" > /dev/null || die
kadmin.local -q "addprinc -pw ${KRB_BOB_PW} -policy defaultpol bob" > /dev/null || die
kadmin.local -q "addprinc -randkey -policy defaultpol mallory" > /dev/null || die
kadmin.local -q "ktadd -k krb5.mallory.keytab mallory" > /dev/null || die
echo "OK"
Expand Down Expand Up @@ -416,6 +419,21 @@ server {
auth_gss_service_ccache /tmp/krb5cc_nginx;
}

location /fallback.php {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php-fpm.sock;
auth_gss on;
auth_gss_realm ${KERBEROS_REALM};
auth_gss_keytab /etc/krb5.http.keytab;
auth_gss_service_name HTTP/${TEST_HOST_FQDN};
auth_gss_allow_basic_fallback on;
auth_gss_authorized_principal bob@${KERBEROS_REALM};
auth_gss_format_full on;
fastcgi_param HTTP_AUTHORIZATION "";
fastcgi_param KRB5CCNAME \$krb5_cc_name;
auth_gss_service_ccache /tmp/krb5cc_nginx;
}

location /delegate.php {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php-fpm.sock;
Expand Down Expand Up @@ -471,6 +489,23 @@ fi
echo "OK"


printf "Writing fallback.php ... "
if ! cat <<'EOF' > /var/www/kerberos/fallback.php
<?php
if (!isset($_SERVER["REMOTE_USER"]) || $_SERVER["REMOTE_USER"] == "") {
http_response_code(500);
echo("REMOTE_USER not set");
exit();
}
echo("Authenticated as " . $_SERVER["REMOTE_USER"]);
?>
EOF
then
die
fi
echo "OK"


printf "Writing delegate.php ... "
if ! cat <<EOF > /var/www/kerberos/delegate.php
<?php
Expand Down Expand Up @@ -581,6 +616,46 @@ test_path()
fi
}

test_basic()
{
SUBURL="$1"
EXPECT1="$2"
EXPECT2="$3"

printf "curl %s, incorrect basic auth: http status (expect %s)=" "${SUBURL}" "${EXPECT1}"
rm -f "${CURL_OUTPUT}"
CODE="$($CURL_NONEGOTIATE -u "bob:InVaLiD" -w "%{http_code}" "http://${TEST_HOST_FQDN}:8080/${SUBURL}")" || true
printf "%s ... " "${CODE}"
if [ "$CODE" = "${EXPECT1}" ]; then
echo "OK"
else
EX=1
echo "FAILED"
if [ -e "${CURL_OUTPUT}" ]; then
echo "HTTP body:"
cat "${CURL_OUTPUT}"
echo ""
fi
fi

printf "curl %s, basic auth: http status (expect %s)=" "${SUBURL}" "${EXPECT2}"
rm -f "${CURL_OUTPUT}"
CODE="$($CURL_NONEGOTIATE -u "bob:${KRB_BOB_PW}" -w "%{http_code}" "http://${TEST_HOST_FQDN}:8080/${SUBURL}")" || true
printf "%s ... " "${CODE}"
if [ "$CODE" = "${EXPECT2}" ]; then
echo "OK"
else
EX=1
echo "FAILED"
if [ -e "${CURL_OUTPUT}" ]; then
echo "HTTP body:"
cat "${CURL_OUTPUT}"
echo ""
fi
fi

}

test_ldapwhoami()
{
LDAP_EXPECTED="dn:uid=${1},cn=gss-spnego,cn=auth"
Expand All @@ -606,6 +681,8 @@ test_ldapwhoami()
printf "Destroying Kerberos tickets ... "
kdestroy -q > /dev/null 2>&1 || true
echo "OK"
test_basic "fallback.php" 401 200
test_path "fallback.php" 401 401
test_path "noauth.php" 200 200
test_path "auth.php" 401 401
test_path "delegate.php" 401 401
Expand All @@ -619,6 +696,8 @@ else
EX=1
echo "FAILED"
fi
test_basic "fallback.php" 401 200
test_path "fallback.php" 401 403
test_path "noauth.php" 200 200
test_path "auth.php" 401 200
test_path "delegate.php" 401 200
Expand All @@ -634,6 +713,24 @@ else
EX=1
echo "FAILED"
fi
test_basic "fallback.php" 401 200
test_path "fallback.php" 401 403
test_path "noauth.php" 200 200
test_path "auth.php" 401 403
test_path "delegate.php" 401 403


echo ""
printf "Obtaining Kerberos ticket for bob ... "
kdestroy -q > /dev/null 2>&1 || true
if echo "${KRB_BOB_PW}" | kinit bob > /dev/null 2>&1; then
echo "OK"
else
EX=1
echo "FAILED"
fi
test_basic "fallback.php" 401 200
test_path "fallback.php" 401 200
test_path "noauth.php" 200 200
test_path "auth.php" 401 403
test_path "delegate.php" 401 403
Expand Down