Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[18.0][MIG] auth_saml: Migration to 18.0
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -125,7 +125,7 @@ def test__compute_sp_metadata_url__provider_has_sp_baseurl(self): | |
| {"p": self.saml_provider.id, "d": self.env.cr.dbname} | ||
| ) | ||
| expected_url = urllib.parse.urljoin( | ||
| "http://example.com", (f"/auth_saml/metadata?{expected_qs}") | ||
| ) | ||
| # Assert that sp_metadata_url is set correctly | ||
| self.assertEqual(self.saml_provider.sp_metadata_url, expected_url) | ||
|
|
@@ -200,7 +200,10 @@ def test_login_no_saml(self): | |
|
|
||
| # Try to log in with a non-existing SAML token | ||
| with self.assertRaises(AccessDenied): | ||
| self.user._check_credentials( | ||
| {"type": "password", "password": "test_saml_token"}, | ||
| {"interactive": True}, | ||
| ) | ||
|
|
||
| redirect_url = self.saml_provider._get_auth_request() | ||
| self.assertIn("http://localhost:8000/sso/redirect?SAMLRequest=", redirect_url) | ||
|
|
@@ -254,7 +257,10 @@ def test_login_with_saml(self): | |
|
|
||
| # We should not be able to log in with the wrong token | ||
| with self.assertRaises(AccessDenied): | ||
| self.user._check_credentials( | ||
| {"type": "password", "password": "WRONG_TOKEN"}, | ||
| {"interactive": True}, | ||
| ) | ||
|
|
||
| # User should now be able to log in with the token | ||
| self.authenticate(user="[email protected]", password=token) | ||
|
|
@@ -268,8 +274,9 @@ def test_disallow_user_password_when_changing_ir_config_parameter(self): | |
| ).value = "False" | ||
| # The password should be blank and the user should not be able to connect | ||
| with self.assertRaises(AccessDenied): | ||
| self.user._check_credentials( | ||
| {"type": "password", "password": "NesTNSte9340D720te>/-A"}, | ||
| {"interactive": True}, | ||
| ) | ||
|
|
||
| def test_disallow_user_password_new_user(self): | ||
|
|
@@ -332,18 +339,19 @@ def test_disallow_user_password_no_password_set(self): | |
| with self.assertRaises(ValidationError): | ||
| user.password = "new password" | ||
|
|
||
| def test_disallow_user_password_on_option_disable(self): | ||
| """Test that existing user password is deleted when adding an SAML provider when | ||
| the disallow option is set.""" | ||
| self.authenticate(user="[email protected]", password="Lu,ums-7vRU>0i]=YDLa") | ||
| # change the option | ||
| self.browse_ref( | ||
| "auth_saml.allow_saml_uid_and_internal_password" | ||
| ).value = "False" | ||
| with self.assertRaises(AccessDenied): | ||
| self.user._check_credentials( | ||
| {"type": "password", "password": "Lu,ums-7vRU>0i]=YDLa"}, | ||
| {"interactive": True}, | ||
| ) | ||
|
|
||
| def test_disallow_user_admin_can_have_password(self): | ||
| """Test that admin can have its password set | ||
|
|
@@ -417,6 +425,123 @@ def test_disallow_user_password_when_changing_settings(self): | |
| ).execute() | ||
|
|
||
| with self.assertRaises(AccessDenied): | ||
| self.user._check_credentials( | ||
| {"type": "password", "password": "NesTNSte9340D720te>/-A"}, | ||
| {"interactive": True}, | ||
| ) | ||
|
|
||
| def test_saml_metadata_invalid_provider(self): | ||
| """Accessing SAML metadata with an invalid provider ID should return 404.""" | ||
| response = self.url_open(f"/auth_saml/metadata?p=999999&d={self.env.cr.dbname}") | ||
| self.assertEqual(response.status_code, 404) | ||
| self.assertIn("Unknown provider", response.text) | ||
|
|
||
| def test_saml_metadata_missing_parameters(self): | ||
| """Accessing the SAML metadata endpoint without params should return 404.""" | ||
| response = self.url_open("/auth_saml/metadata") | ||
| self.assertEqual(response.status_code, 404) | ||
| self.assertIn("Missing parameters", response.text) | ||
|
|
||
| def test_saml_provider_deactivation(self): | ||
| """A deactivated SAML provider should not be usable for authentication.""" | ||
| self.saml_provider.active = False | ||
|
|
||
| redirect_url = self.saml_provider._get_auth_request() | ||
| response = self.idp.fake_login(redirect_url) | ||
| unpacked_response = response._unpack() | ||
|
|
||
| with self.assertRaises(AccessDenied): | ||
| self.env["res.users"].sudo().auth_saml( | ||
| self.saml_provider.id, unpacked_response.get("SAMLResponse"), None | ||
| ) | ||
|
|
||
| def test_compute_sp_metadata_url_for_new_record(self): | ||
| """Test that sp_metadata_url is set to False for a new (unsaved) provider.""" | ||
| new_provider = self.env["auth.saml.provider"].new( | ||
| {"name": "New SAML Provider", "sp_baseurl": "http://example.com"} | ||
| ) | ||
| new_provider._compute_sp_metadata_url() | ||
| self.assertFalse(new_provider.sp_metadata_url) | ||
|
|
||
| def test_store_outstanding_request(self): | ||
| """Test that the SAML request ID is stored in the auth_saml.request model.""" | ||
| reqid = "test-request-id" | ||
| self.saml_provider._store_outstanding_request(reqid) | ||
|
|
||
| request = self.env["auth_saml.request"].search( | ||
| [("saml_request_id", "=", reqid)] | ||
| ) | ||
| self.assertTrue(request) | ||
| self.assertEqual(request.saml_provider_id.id, self.saml_provider.id) | ||
|
|
||
| def test_get_auth_request_redirect_url(self): | ||
| """Test that _get_auth_request returns a valid redirect URL.""" | ||
| redirect_url = self.saml_provider._get_auth_request() | ||
| self.assertIsNotNone(redirect_url) | ||
| self.assertIn("SAMLRequest=", redirect_url) | ||
|
|
||
| def test_fragment_to_query_string_empty_query(self): | ||
| """Test fragment_to_query_string redirects when no query string is provided.""" | ||
| response = self.url_open("/auth_saml/signin") | ||
| self.assertEqual(response.status_code, 200) | ||
| self.assertIn("<script>", response.text) | ||
|
|
||
| def test_get_auth_request_valid_provider(self): | ||
| """Test that get_auth_request returns a redirect for a valid provider.""" | ||
| response = self.url_open( | ||
| f"/auth_saml/get_auth_request?pid={self.saml_provider.id}", | ||
| allow_redirects=False, | ||
| ) | ||
| self.assertEqual(response.status_code, 303) | ||
| self.assertIn("Location", response.headers) | ||
| self.assertIn("SAMLRequest=", response.headers["Location"]) | ||
|
|
||
| def test_create_res_users_saml(self): | ||
| """Test that creating a SAML mapping removes the password when disallowed.""" | ||
| user = self.env['res.users'].create({ | ||
| 'name': 'Test User', | ||
| 'login': '[email protected]', | ||
| 'password': 'securepassword', | ||
| }) | ||
| self.env['ir.config_parameter'].set_param('auth_saml.allow_saml_uid_and_internal_password', 'False') | ||
| self.env['res.users.saml'].create({ | ||
| 'user_id': user.id, | ||
| 'saml_provider_id': self.env['auth.saml.provider'].create({ | ||
| 'name': 'Demo Provider', | ||
| 'sig_alg': 'SIG_RSA_SHA1', | ||
| 'idp_metadata': 'fake_metadata', | ||
| 'sp_pem_public': base64.b64encode(b'public_key'), | ||
| 'sp_pem_private': base64.b64encode(b'private_key'), | ||
| }).id, | ||
| 'saml_uid': '[email protected]', | ||
| }) | ||
| self.assertFalse(user.password) | ||
|
|
||
| def test_missing_parameters_in_metadata(self): | ||
| """Test that missing parameters in the SAML metadata request return a 404.""" | ||
| response = self.url_open('/auth_saml/metadata') | ||
| self.assertEqual(response.status_code, 404) | ||
| self.assertIn('Missing parameters', response.text) | ||
|
|
||
| def test_fragment_to_query_string_redirect(self): | ||
| """Test fragment_to_query_string redirects when no query string is provided.""" | ||
| response = self.url_open('/auth_saml/signin') | ||
| self.assertEqual(response.status_code, 200) | ||
| self.assertIn('<script>', response.text) | ||
|
|
||
| def test_saml_request_creation(self): | ||
| """Test that a SAML request is correctly stored in the auth_saml.request model.""" | ||
| provider = self.env['auth.saml.provider'].create({ | ||
| 'name': 'Test Provider', | ||
| 'sig_alg': 'SIG_RSA_SHA1', | ||
| 'idp_metadata': 'fake_metadata', | ||
| 'sp_pem_public': base64.b64encode(b'public_key'), | ||
| 'sp_pem_private': base64.b64encode(b'private_key'), | ||
| }) | ||
| self.env['auth_saml.request'].create({ | ||
| 'saml_provider_id': provider.id, | ||
| 'saml_request_id': 'test-request-id', | ||
| }) | ||
| request = self.env['auth_saml.request'].search([('saml_request_id', '=', 'test-request-id')]) | ||
| self.assertTrue(request) | ||
| self.assertEqual(request.saml_provider_id.id, provider.id) | ||
Oops, something went wrong.