jcoffey-dev
7dae9b29fd
Upstream commit: 474dd0229cb20cf513036619781ed97bd8073c3f Enterprise-only files removed or emptied: 63 Enterprise-only snippets removed: 117 in 50 files Dangling module declarations removed: 5 Cargo edits turning enterprise off: 14 Verification: clean Enterprise feature gates left for rebuilt features: 19 in 18 files Produced by tools/fork/strip.py. The full report is in docs/fork/strip-reports/ on main.
79 lines
2.5 KiB
Rust
79 lines
2.5 KiB
Rust
/*
|
|
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
|
|
*
|
|
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
|
|
*/
|
|
|
|
use directory::{Credentials, Directory, UnavailableDirectory, backend::oidc::OpenIdDirectory};
|
|
use registry::{
|
|
schema::{enums::DirectoryType, structs},
|
|
types::map::Map,
|
|
};
|
|
use std::time::{Duration, Instant};
|
|
|
|
const DISCOVERY_RETRY_FOR: Duration = Duration::from_secs(30);
|
|
|
|
pub async fn test() {
|
|
println!("Running unavailable directory tests...");
|
|
|
|
let started_at = Instant::now();
|
|
let error = OpenIdDirectory::open(structs::OidcDirectory {
|
|
description: "Unreachable OIDC directory".to_string(),
|
|
issuer_url: "http://localhost:59999/realms/stalwart".to_string(),
|
|
claim_username: "preferred_username".to_string(),
|
|
claim_name: None,
|
|
claim_groups: None,
|
|
username_domain: None,
|
|
require_audience: None,
|
|
require_scopes: Map::new(vec![]),
|
|
member_tenant_id: None,
|
|
})
|
|
.await
|
|
.expect_err("Discovery against an unreachable issuer must fail");
|
|
let elapsed = started_at.elapsed();
|
|
assert!(
|
|
elapsed >= DISCOVERY_RETRY_FOR,
|
|
"Discovery gave up after {elapsed:?}: {error}"
|
|
);
|
|
|
|
let oidc = Directory::Unavailable(UnavailableDirectory::new(DirectoryType::Oidc, error));
|
|
assert!(
|
|
oidc.authenticate(&Credentials::Basic {
|
|
username: "[email protected]".to_string(),
|
|
secret: "this is an OIDC password".to_string(),
|
|
mfa_token: None,
|
|
})
|
|
.await
|
|
.is_err(),
|
|
"Password authentication must not fall back to internal credentials"
|
|
);
|
|
assert!(
|
|
oidc.authenticate(&Credentials::Bearer {
|
|
username: None,
|
|
token: "not a token".to_string(),
|
|
})
|
|
.await
|
|
.is_err()
|
|
);
|
|
assert!(oidc.has_bearer_token_support());
|
|
assert!(!oidc.can_lookup_recipients());
|
|
assert!(oidc.oidc_discovery_document().is_none());
|
|
|
|
let ldap = Directory::Unavailable(UnavailableDirectory::new(
|
|
DirectoryType::Ldap,
|
|
"LDAP bind password is required when bind DN is set",
|
|
));
|
|
assert!(
|
|
ldap.authenticate(&Credentials::Basic {
|
|
username: "[email protected]".to_string(),
|
|
secret: "this is John's LDAP password".to_string(),
|
|
mfa_token: None,
|
|
})
|
|
.await
|
|
.is_err()
|
|
);
|
|
assert!(ldap.recipient("[email protected]").await.is_err());
|
|
assert!(ldap.can_lookup_recipients());
|
|
assert!(!ldap.has_bearer_token_support());
|
|
}
|