-
Notifications
You must be signed in to change notification settings - Fork 77
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #549 from EsupPortail/dev
DEV #2.8.3
- Loading branch information
Showing
96 changed files
with
8,887 additions
and
13,369 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,6 +3,9 @@ | |
| from django.test import TestCase, override_settings | ||
| from pod.authentication.models import Owner, AccessGroup | ||
| from pod.authentication import populatedCASbackend | ||
| from pod.authentication import shibmiddleware | ||
| from pod.authentication.backends import ShibbBackend | ||
| from django.test import RequestFactory | ||
| from django.contrib.auth.models import User | ||
| from importlib import reload | ||
| from xml.etree import ElementTree as ET | ||
|
|
@@ -46,6 +49,35 @@ | |
| }, | ||
| ) | ||
|
|
||
| REMOTE_USER_HEADER = getattr(settings, "REMOTE_USER_HEADER", "REMOTE_USER") | ||
|
|
||
| SHIBBOLETH_ATTRIBUTE_MAP = getattr( | ||
| settings, | ||
| "SHIBBOLETH_ATTRIBUTE_MAP", | ||
| { | ||
| "REMOTE_USER": (True, "username"), | ||
| "Shibboleth-givenName": (True, "first_name"), | ||
| "Shibboleth-sn": (False, "last_name"), | ||
| "Shibboleth-mail": (False, "email"), | ||
| "Shibboleth-primary-affiliation": (False, "affiliation"), | ||
| "Shibboleth-unscoped-affiliation": (False, "affiliations"), | ||
| }, | ||
| ) | ||
|
|
||
| SHIBBOLETH_STAFF_ALLOWED_DOMAINS = getattr( | ||
| settings, "SHIBBOLETH_STAFF_ALLOWED_DOMAINS", None | ||
| ) | ||
|
|
||
| AFFILIATION_STAFF = getattr( | ||
| settings, "AFFILIATION_STAFF", ("employee", "faculty", "staff") | ||
| ) | ||
|
|
||
| SHIB_URL = getattr(settings, "SHIB_URL", "https://univ.fr/Shibboleth.sso/WAYF") | ||
|
|
||
| SHIB_LOGOUT_URL = getattr( | ||
| settings, "SHIB_LOGOUT_URL", "https://univ.fr/Shibboleth.sso/Logout" | ||
| ) | ||
|
|
||
|
|
||
| class PopulatedCASTestCase(TestCase): | ||
| # populate_user_from_tree(user, owner, tree) | ||
|
|
@@ -276,3 +308,137 @@ def test_populate_user_from_entry_affiliation_group(self): | |
| " ---> test_populate_user_from_entry_affiliation_group" | ||
| " of PopulatedLDAPTestCase : OK !" | ||
| ) | ||
|
|
||
|
|
||
| class PopulatedShibTestCase(TestCase): | ||
| def setUp(self): | ||
| """setUp PopulatedShibTestCase create user pod""" | ||
| self.hmap = {} | ||
| for a in SHIBBOLETH_ATTRIBUTE_MAP: | ||
| self.hmap[SHIBBOLETH_ATTRIBUTE_MAP[a][1]] = a | ||
| # print(SHIBBOLETH_ATTRIBUTE_MAP[a][1] + ' > ' + a) | ||
|
|
||
| print(" ---> SetUp of PopulatedShibTestCase : OK !") | ||
|
|
||
| def _authenticate_shib_user(self, u): | ||
| """Simulate shibboleth header""" | ||
| fake_shib_header = { | ||
| "REMOTE_USER": u["username"], | ||
| self.hmap["username"]: u["username"], | ||
| self.hmap["email"]: u["email"], | ||
| self.hmap["first_name"]: u["first_name"], | ||
| self.hmap["last_name"]: u["last_name"], | ||
| } | ||
| if "groups" in u.keys(): | ||
| fake_shib_header[self.hmap["groups"]] = u["groups"] | ||
| if "affiliations" in u.keys(): | ||
| fake_shib_header[self.hmap["affiliation"]] = u["affiliations"].split(";")[0] | ||
| fake_shib_header[self.hmap["affiliations"]] = u["affiliations"] | ||
|
|
||
| """ Get valid shib_meta from simulated shibboleth header """ | ||
| request = RequestFactory().get("/", REMOTE_USER=u["username"]) | ||
| request.META.update(**fake_shib_header) | ||
| shib_meta, error = shibmiddleware.ShibbMiddleware.parse_attributes(request) | ||
| self.assertFalse(error, "Generating shibboleth attribute mapping contains errors") | ||
|
|
||
| """ Check user authentication """ | ||
| user = ShibbBackend.authenticate( | ||
| ShibbBackend(), | ||
| request=request, | ||
| remote_user=u["username"], | ||
| shib_meta=shib_meta, | ||
| ) | ||
| self.assertTrue(user.is_authenticated()) | ||
|
|
||
| return (user, shib_meta) | ||
|
|
||
| @override_settings(DEBUG=False) | ||
| def test_make_profile(self): | ||
| """Test if user attributes are retreived""" | ||
| user, shib_meta = self._authenticate_shib_user( | ||
| { | ||
| "username": "[email protected]", | ||
| "first_name": "John", | ||
| "last_name": "Do", | ||
| "email": "[email protected]", | ||
| "affiliations": "teacher;staff;member", | ||
| } | ||
| ) | ||
| self.assertEqual(user.username, "[email protected]") | ||
| self.assertEqual(user.email, "[email protected]") | ||
| self.assertEqual(user.first_name, "John") | ||
| self.assertEqual(user.last_name, "Do") | ||
|
|
||
| """ Test if user can be staff if SHIBBOLETH_STAFF_ALLOWED_DOMAINS is None """ | ||
| settings.SHIBBOLETH_STAFF_ALLOWED_DOMAINS = None | ||
| reload(shibmiddleware) | ||
| shibmiddleware.ShibbMiddleware.make_profile( | ||
| shibmiddleware.ShibbMiddleware(), user, shib_meta | ||
| ) | ||
| self.assertTrue(user.is_staff) | ||
|
|
||
| owner = Owner.objects.get(user__username="[email protected]") | ||
| self.assertEqual(owner.affiliation, "teacher") | ||
|
|
||
| """ Test if user can be staff when SHIBBOLETH_STAFF_ALLOWED_DOMAINS | ||
| is restricted """ | ||
| settings.SHIBBOLETH_STAFF_ALLOWED_DOMAINS = ( | ||
| "univ-a.fr", | ||
| "univ-b.fr", | ||
| ) | ||
| user.is_staff = False # Staff status is not remove | ||
| user.save() | ||
| reload(shibmiddleware) | ||
| shibmiddleware.ShibbMiddleware.make_profile( | ||
| shibmiddleware.ShibbMiddleware(), user, shib_meta | ||
| ) | ||
| self.assertFalse(user.is_staff) | ||
|
|
||
| """ Test if user become staff when SHIBBOLETH_STAFF_ALLOWED_DOMAINS | ||
| is restrict and contains his domain """ | ||
| settings.SHIBBOLETH_STAFF_ALLOWED_DOMAINS = ("univ.fr",) | ||
| reload(shibmiddleware) | ||
| shibmiddleware.ShibbMiddleware.make_profile( | ||
| shibmiddleware.ShibbMiddleware(), user, shib_meta | ||
| ) | ||
| self.assertTrue(user.is_staff) | ||
|
|
||
| """ Test if same user with new unstaffable affiliation keep his staff status """ | ||
| unstaffable_affiliation = ["member", "unprobable"] | ||
| for a in unstaffable_affiliation: | ||
| self.assertFalse(a in AFFILIATION_STAFF) | ||
| user, shib_meta = self._authenticate_shib_user( | ||
| { | ||
| "username": "[email protected]", | ||
| "first_name": "Jean", | ||
| "last_name": "Do", | ||
| "email": "[email protected]", | ||
| "affiliations": ";".join(unstaffable_affiliation), | ||
| } | ||
| ) | ||
| shibmiddleware.ShibbMiddleware.make_profile( | ||
| shibmiddleware.ShibbMiddleware(), user, shib_meta | ||
| ) | ||
| self.assertTrue(user.is_staff) # Staff status is not remove | ||
|
|
||
| """ Test if the main affiliation of this same user | ||
| with new unstaffable affiliation has changed """ | ||
| owner = Owner.objects.get(user__username="[email protected]") | ||
| self.assertEqual(owner.affiliation, "member") | ||
|
|
||
| """ Test if a new user with same unstaffable affiliations has no staff status""" | ||
| user, shib_meta = self._authenticate_shib_user( | ||
| { | ||
| "username": "[email protected]", | ||
| "first_name": "Ada", | ||
| "last_name": "Da", | ||
| "email": "[email protected]", | ||
| "affiliations": ";".join(unstaffable_affiliation), | ||
| } | ||
| ) | ||
| shibmiddleware.ShibbMiddleware.make_profile( | ||
| shibmiddleware.ShibbMiddleware(), user, shib_meta | ||
| ) | ||
| self.assertFalse(user.is_staff) | ||
|
|
||
| print(" ---> test_make_profile" " of PopulatedShibTestCase : OK !") | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.