|
2 | 2 | use warnings; |
3 | 3 | use TestLib; |
4 | 4 | use PostgresNode; |
5 | | -use Test::More tests => 15; |
| 5 | +use Test::More tests => 19; |
6 | 6 |
|
7 | 7 | my ($slapd, $ldap_bin_dir, $ldap_schema_dir); |
8 | 8 |
|
|
33 | 33 | $ENV{PATH} = "$ldap_bin_dir:$ENV{PATH}" if $ldap_bin_dir; |
34 | 34 |
|
35 | 35 | my $ldap_datadir = "${TestLib::tmp_check}/openldap-data"; |
| 36 | +my $slapd_certs = "${TestLib::tmp_check}/slapd-certs"; |
36 | 37 | my $slapd_conf = "${TestLib::tmp_check}/slapd.conf"; |
37 | 38 | my $slapd_pidfile = "${TestLib::tmp_check}/slapd.pid"; |
38 | 39 | my $slapd_logfile = "${TestLib::tmp_check}/slapd.log"; |
39 | 40 | my $ldap_conf = "${TestLib::tmp_check}/ldap.conf"; |
40 | 41 | my $ldap_server = 'localhost'; |
41 | 42 | my $ldap_port = int(rand() * 16384) + 49152; |
| 43 | +my $ldaps_port = $ldap_port + 1; |
42 | 44 | my $ldap_url = "ldap://$ldap_server:$ldap_port"; |
| 45 | +my $ldaps_url = "ldaps://$ldap_server:$ldaps_port"; |
43 | 46 | my $ldap_basedn = 'dc=example,dc=net'; |
44 | 47 | my $ldap_rootdn = 'cn=Manager,dc=example,dc=net'; |
45 | 48 | my $ldap_rootpw = 'secret'; |
|
63 | 66 | database ldif |
64 | 67 | directory $ldap_datadir |
65 | 68 |
|
| 69 | +TLSCACertificateFile $slapd_certs/ca.crt |
| 70 | +TLSCertificateFile $slapd_certs/server.crt |
| 71 | +TLSCertificateKeyFile $slapd_certs/server.key |
| 72 | +
|
66 | 73 | suffix "dc=example,dc=net" |
67 | 74 | rootdn "$ldap_rootdn" |
68 | 75 | rootpw $ldap_rootpw}); |
69 | 76 |
|
| 77 | +# don't bother to check the server's cert (though perhaps we should) |
| 78 | +append_to_file($ldap_conf, |
| 79 | +qq{TLS_REQCERT never |
| 80 | +}); |
| 81 | + |
70 | 82 | mkdir $ldap_datadir or die; |
| 83 | +mkdir $slapd_certs or die; |
| 84 | + |
| 85 | +system_or_bail "openssl", "req", "-new", "-nodes", "-keyout", "$slapd_certs/ca.key", "-x509", "-out", "$slapd_certs/ca.crt", "-subj", "/cn=CA"; |
| 86 | +system_or_bail "openssl", "req", "-new", "-nodes", "-keyout", "$slapd_certs/server.key", "-out", "$slapd_certs/server.csr", "-subj", "/cn=server"; |
| 87 | +system_or_bail "openssl", "x509", "-req", "-in", "$slapd_certs/server.csr", "-CA", "$slapd_certs/ca.crt", "-CAkey", "$slapd_certs/ca.key", "-CAcreateserial", "-out", "$slapd_certs/server.crt"; |
71 | 88 |
|
72 | | -system_or_bail $slapd, '-f', $slapd_conf, '-h', $ldap_url; |
| 89 | +system_or_bail $slapd, '-f', $slapd_conf, '-h', "$ldap_url $ldaps_url"; |
73 | 90 |
|
74 | 91 | END |
75 | 92 | { |
|
81 | 98 |
|
82 | 99 | $ENV{'LDAPURI'} = $ldap_url; |
83 | 100 | $ENV{'LDAPBINDDN'} = $ldap_rootdn; |
| 101 | +$ENV{'LDAPCONF'} = $ldap_conf; |
84 | 102 |
|
85 | 103 | note "loading LDAP data"; |
86 | 104 |
|
@@ -178,9 +196,44 @@ sub test_access |
178 | 196 |
|
179 | 197 | note "diagnostic message"; |
180 | 198 |
|
| 199 | +# note bad ldapprefix with a question mark that triggers a diagnostic message |
| 200 | +unlink($node->data_dir . '/pg_hba.conf'); |
| 201 | +$node->append_conf('pg_hba.conf', qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapprefix="?uid=" ldapsuffix=""}); |
| 202 | +$node->reload; |
| 203 | + |
| 204 | +$ENV{"PGPASSWORD"} = 'secret1'; |
| 205 | +test_access($node, 'test1', 2, 'any attempt fails due to bad search pattern'); |
| 206 | + |
| 207 | +note "TLS"; |
| 208 | + |
| 209 | +# request StartTLS with ldaptls=1 |
| 210 | +unlink($node->data_dir . '/pg_hba.conf'); |
| 211 | +$node->append_conf('pg_hba.conf', qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapbasedn="$ldap_basedn" ldapsearchfilter="(uid=\$username)" ldaptls=1}); |
| 212 | +$node->reload; |
| 213 | + |
| 214 | +$ENV{"PGPASSWORD"} = 'secret1'; |
| 215 | +test_access($node, 'test1', 0, 'StartTLS'); |
| 216 | + |
| 217 | +# request LDAPS with ldapscheme=ldaps |
| 218 | +unlink($node->data_dir . '/pg_hba.conf'); |
| 219 | +$node->append_conf('pg_hba.conf', qq{local all all ldap ldapserver=$ldap_server ldapscheme=ldaps ldapport=$ldaps_port ldapbasedn="$ldap_basedn" ldapsearchfilter="(uid=\$username)"}); |
| 220 | +$node->reload; |
| 221 | + |
| 222 | +$ENV{"PGPASSWORD"} = 'secret1'; |
| 223 | +test_access($node, 'test1', 0, 'LDAPS'); |
| 224 | + |
| 225 | +# request LDAPS with ldapurl=ldaps://... |
| 226 | +unlink($node->data_dir . '/pg_hba.conf'); |
| 227 | +$node->append_conf('pg_hba.conf', qq{local all all ldap ldapurl="$ldaps_url/$ldap_basedn??sub?(uid=\$username)"}); |
| 228 | +$node->reload; |
| 229 | + |
| 230 | +$ENV{"PGPASSWORD"} = 'secret1'; |
| 231 | +test_access($node, 'test1', 0, 'LDAPS with URL'); |
| 232 | + |
| 233 | +# bad combination of LDAPS and StartTLS |
181 | 234 | unlink($node->data_dir . '/pg_hba.conf'); |
182 | | -$node->append_conf('pg_hba.conf', qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapprefix="uid=" ldapsuffix=",dc=example,dc=net" ldaptls=1}); |
| 235 | +$node->append_conf('pg_hba.conf', qq{local all all ldap ldapurl="$ldaps_url/$ldap_basedn??sub?(uid=\$username)" ldaptls=1}); |
183 | 236 | $node->reload; |
184 | 237 |
|
185 | 238 | $ENV{"PGPASSWORD"} = 'secret1'; |
186 | | -test_access($node, 'test1', 2, 'any attempt fails due to unsupported TLS'); |
| 239 | +test_access($node, 'test1', 2, 'bad combination of LDAPS and StartTLS'); |
0 commit comments