Add code and tests for eldap:simple_bind validation.

Author: lukebakken

deps/rabbitmq_auth_backend_ldap/src/rabbit_auth_backend_ldap_mgmt.erl

@@ -22,7 +22,7 @@
 -include_lib("kernel/include/logger.hrl").
 -include_lib("rabbitmq_web_dispatch/include/rabbitmq_web_dispatch_records.hrl").
 
-dispatcher() -> [{"/ldap/validate/bind/:name", ?MODULE, []}].
+dispatcher() -> [{"/ldap/validate/simple-bind", ?MODULE, []}].
 
 web_ui() -> [].
 
@@ -45,22 +45,34 @@ is_authorized(ReqData, Context) ->
 
 accept_content(ReqData0, Context) ->
     F = fun (_Values, BodyMap, ReqData1) ->
-        _Name = name(ReqData1),
         Port = rabbit_mgmt_util:parse_int(maps:get(port, BodyMap, 389)),
         _UseSsl = rabbit_mgmt_util:parse_bool(maps:get(use_ssl, BodyMap, false)),
         _UseStartTls = rabbit_mgmt_util:parse_bool(maps:get(use_starttls, BodyMap, false)),
         Servers = maps:get(servers, BodyMap, []),
-        _Password = maps:get(password, BodyMap, <<"">>),
+        UserDN = maps:get(user_dn, BodyMap, <<"">>),
+        Password = maps:get(password, BodyMap, <<"">>),
         Options = [
             {port, Port},
             {timeout, 5000},
             {ssl, false}
         ],
         ?LOG_DEBUG("eldap:open Servers: ~tp Options: ~tp", [Servers, Options]),
         case eldap:open(Servers, Options) of
-            {ok, H} ->
-                eldap:close(H),
-                {true, ReqData1, Context};
+            {ok, LDAP} ->
+                ?LOG_DEBUG("eldap:simple_bind UserDN: ~tp Password: ~tp", [UserDN, Password]),
+                Result = case eldap:simple_bind(LDAP, UserDN, Password) of
+                    ok ->
+                        {true, ReqData1, Context};
+                    {error, invalidCredentials} ->
+                        rabbit_mgmt_util:not_authorised("invalid credentials", ReqData1, Context);
+                    {error, unwillingToPerform} ->
+                        rabbit_mgmt_util:not_authorised("invalid credentials", ReqData1, Context);
+                    {error, E} ->
+                        Reason = unicode_format(E),
+                        rabbit_mgmt_util:bad_request(Reason, ReqData1, Context)
+                end,
+                eldap:close(LDAP),
+                Result;
             {error, E} ->
                 Reason = unicode_format(E),
                 rabbit_mgmt_util:bad_request(Reason, ReqData1, Context)
@@ -70,11 +82,5 @@ accept_content(ReqData0, Context) ->
 
 %%--------------------------------------------------------------------
 
-name(ReqData) ->
-    case rabbit_mgmt_util:id(name, ReqData) of
-        [Value] -> Value;
-        Value   -> Value
-    end.
-
 unicode_format(Arg) ->
     rabbit_data_coercion:to_utf8_binary(io_lib:format("~tp", [Arg])).

deps/rabbitmq_auth_backend_ldap/test/system_SUITE.erl

@@ -282,12 +282,35 @@ end_per_testcase(Testcase, Config) ->
 %% -------------------------------------------------------------------
 
 validate_ldap_configuration_via_api(Config) ->
+    %% {user_dn_pattern, "cn=${username},ou=People,dc=rabbitmq,dc=com"},
+    UserDNFmt = "cn=~ts,ou=People,dc=rabbitmq,dc=com",
+    AliceUserDN = rabbit_data_coercion:to_utf8_binary(io_lib:format(UserDNFmt, [?ALICE_NAME])),
+    InvalidUserDN = rabbit_data_coercion:to_utf8_binary(io_lib:format(UserDNFmt, ["NOBODY"])),
+    Password = rabbit_data_coercion:to_utf8_binary("password"),
+
     LdapPort = ?config(ldap_port, Config),
-    http_put(Config, io_lib:format("/ldap/validate/bind/~ts", [<<?ALICE_NAME>>]),
+    %% NB: bad resource name
+    http_put(Config, "/ldap/validate/bad-bind-name",
+        #{
+            'user_dn' => AliceUserDN,
+            'password' => Password,
+            'servers' => ["localhost"],
+            'port' => LdapPort
+        }, ?METHOD_NOT_ALLOWED),
+    http_put(Config, "/ldap/validate/simple-bind",
+        #{
+            'user_dn' => AliceUserDN,
+            'password' => Password,
+            'servers' => ["localhost"],
+            'port' => LdapPort
+        }, ?NO_CONTENT),
+    http_put(Config, "/ldap/validate/simple-bind",
         #{
+            'user_dn' => InvalidUserDN,
+            'password' => Password,
             'servers' => ["localhost"],
             'port' => LdapPort
-        }, ?NO_CONTENT).
+        }, ?NOT_AUTHORISED).
 
 purge_connection(Config) ->
     {ok, _} = rabbit_ct_broker_helpers:rpc(Config, 0,

deps/rabbitmq_management/src/rabbit_mgmt_util.erl

@@ -18,7 +18,7 @@
          is_authorized_vhost_visible_for_monitoring/2,
          is_authorized_global_parameters/2]).
 -export([user/1]).
--export([bad_request/3, service_unavailable/3, bad_request_exception/4,
+-export([bad_request/3, service_unavailable/3, not_authorised/3, bad_request_exception/4,
          internal_server_error/3, internal_server_error/4, precondition_failed/3,
          id/2, parse_bool/1, parse_int/1, redirect_to_home/3]).
 -export([with_decode/4, not_found/3]).
@@ -668,7 +668,6 @@ bad_request(Reason, ReqData, Context) ->
 service_unavailable(Reason, ReqData, Context) ->
     halt_response(503, service_unavailable, Reason, ReqData, Context).
 
-
 not_authorised(Reason, ReqData, Context) ->
     rabbit_web_dispatch_access_control:not_authorised(Reason, ReqData, Context).