Ben Cooke
@@ -13,9 +13,11 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/dgryski/dgoogauth"
|
||||
"github.com/stretchr/testify/mock"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mattermost/mattermost/server/public/model"
|
||||
"github.com/mattermost/mattermost/server/v8/einterfaces/mocks"
|
||||
)
|
||||
|
||||
func TestParseAuthTokenFromRequest(t *testing.T) {
|
||||
@@ -153,3 +155,211 @@ func TestCheckPasswordAndAllCriteria(t *testing.T) {
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestCheckLdapUserPasswordAndAllCriteria(t *testing.T) {
|
||||
th := SetupEnterprise(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
// update config
|
||||
const maxFailedLoginAttempts = 3
|
||||
th.App.UpdateConfig(func(cfg *model.Config) {
|
||||
*cfg.LdapSettings.MaximumLoginAttempts = maxFailedLoginAttempts
|
||||
*cfg.ServiceSettings.EnableMultifactorAuthentication = true
|
||||
})
|
||||
|
||||
mockLdap := &mocks.LdapInterface{}
|
||||
th.App.Channels().Ldap = mockLdap
|
||||
|
||||
authData := model.NewRandomString(32)
|
||||
|
||||
// create an ldap user by calling createUser
|
||||
ldapUser := &model.User{
|
||||
Email: "ldapuser@mattermost-customer.com",
|
||||
Username: "ldapuser",
|
||||
AuthService: model.UserAuthServiceLdap,
|
||||
AuthData: &authData,
|
||||
EmailVerified: true,
|
||||
}
|
||||
user, appErr := th.App.CreateUser(th.Context, ldapUser)
|
||||
require.Nil(t, appErr)
|
||||
user.AuthData = &authData
|
||||
|
||||
testCases := []struct {
|
||||
name string
|
||||
password string
|
||||
expectedErrID string
|
||||
mockDoLogin func()
|
||||
}{
|
||||
{
|
||||
name: "valid password",
|
||||
password: "password",
|
||||
expectedErrID: "",
|
||||
mockDoLogin: func() {
|
||||
mockLdap.Mock.On("DoLogin", th.Context, authData, "password").Return(user, nil)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "invalid password",
|
||||
password: "wrongpassword",
|
||||
expectedErrID: "api.user.check_user_password.invalid.app_error",
|
||||
mockDoLogin: func() {
|
||||
mockLdap.Mock.On("DoLogin", th.Context, authData, "wrongpassword").Return(nil, &model.AppError{Id: "ent.ldap.do_login.invalid_password.app_error"})
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "too many login attempts",
|
||||
password: "wrongpassword",
|
||||
expectedErrID: "api.user.check_user_login_attempts.too_many_ldap.app_error",
|
||||
mockDoLogin: func() {
|
||||
mockLdap.Mock.On("DoLogin", th.Context, authData, "wrongpassword").Return(nil, &model.AppError{Id: "ent.ldap.do_login.invalid_password.app_error"}).Once()
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
// Reset login attempts
|
||||
err := th.App.Srv().Store().User().UpdateFailedPasswordAttempts(user.Id, 0)
|
||||
require.NoError(t, err)
|
||||
|
||||
tc.mockDoLogin()
|
||||
|
||||
ldapUser := user
|
||||
|
||||
// Simulate failed login attempts if necessary
|
||||
if tc.expectedErrID == "api.user.check_user_login_attempts.too_many_ldap.app_error" {
|
||||
for i := 0; i < maxFailedLoginAttempts-1; i++ {
|
||||
_, appErr = th.App.checkLdapUserPasswordAndAllCriteria(th.Context, ldapUser, "wrongpassword", "")
|
||||
require.NotNil(t, appErr)
|
||||
require.Equal(t, "ent.ldap.do_login.invalid_password.app_error", appErr.Id)
|
||||
}
|
||||
}
|
||||
// Call the method with the test case parameters
|
||||
_, appErr := th.App.checkLdapUserPasswordAndAllCriteria(th.Context, ldapUser, tc.password, "")
|
||||
|
||||
// Verify the returned error matches the expected error
|
||||
if tc.expectedErrID == "" {
|
||||
require.Nil(t, appErr)
|
||||
} else {
|
||||
require.NotNil(t, appErr)
|
||||
}
|
||||
|
||||
if tc.expectedErrID == "api.user.check_user_login_attempts.too_many_ldap.app_error" {
|
||||
updatedUser, err := th.App.GetUser(ldapUser.Id)
|
||||
require.Nil(t, err)
|
||||
require.Equal(t, maxFailedLoginAttempts, updatedUser.FailedAttempts)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckLdapUserPasswordConcurrency(t *testing.T) {
|
||||
th := SetupEnterprise(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
// update config
|
||||
const maxFailedLoginAttempts = 1
|
||||
const concurrentAttempts = 10
|
||||
th.App.UpdateConfig(func(cfg *model.Config) {
|
||||
*cfg.LdapSettings.MaximumLoginAttempts = maxFailedLoginAttempts
|
||||
*cfg.ServiceSettings.EnableMultifactorAuthentication = true
|
||||
})
|
||||
|
||||
authData := model.NewRandomString(32)
|
||||
|
||||
// create an ldap user by calling createUser
|
||||
ldapUser := &model.User{
|
||||
Email: "ldapuser@mattermost-customer.com",
|
||||
Username: "ldapuser",
|
||||
AuthService: model.UserAuthServiceLdap,
|
||||
AuthData: &authData,
|
||||
EmailVerified: true,
|
||||
}
|
||||
user, appErr := th.App.CreateUser(th.Context, ldapUser)
|
||||
require.Nil(t, appErr)
|
||||
|
||||
// setup MFA
|
||||
secret, appErr := th.App.GenerateMfaSecret(user.Id)
|
||||
require.Nil(t, appErr)
|
||||
err := th.Server.Store().User().UpdateMfaActive(user.Id, true)
|
||||
require.NoError(t, err)
|
||||
err = th.Server.Store().User().UpdateMfaSecret(user.Id, secret.Secret)
|
||||
require.NoError(t, err)
|
||||
|
||||
user, appErr = th.App.GetUser(user.Id)
|
||||
require.Nil(t, appErr)
|
||||
user.AuthData = &authData
|
||||
|
||||
t.Run("validate concurrent failed attempts to bypass checks", func(t *testing.T) {
|
||||
testCases := []struct {
|
||||
name string
|
||||
password string
|
||||
mfaToken string
|
||||
expectedErrID string
|
||||
doLoginExpectedErrID string
|
||||
}{
|
||||
{
|
||||
name: "should not breach max. login attempts when password is wrong",
|
||||
password: "wrong password",
|
||||
mfaToken: "",
|
||||
doLoginExpectedErrID: "ent.ldap.do_login.invalid_password.app_error",
|
||||
expectedErrID: "ent.ldap.do_login.invalid_password.app_error",
|
||||
},
|
||||
{
|
||||
name: "should not breach max. login attempts when MFA is wrong",
|
||||
password: "password",
|
||||
mfaToken: "123456",
|
||||
doLoginExpectedErrID: "",
|
||||
expectedErrID: "api.user.check_user_mfa.bad_code.app_error",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
mockLdap := &mocks.LdapInterface{}
|
||||
th.App.Channels().Ldap = mockLdap
|
||||
// Reset login attempts
|
||||
err := th.App.Srv().Store().User().UpdateFailedPasswordAttempts(user.Id, 0)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Capture all concurrent errors
|
||||
appErrs := make([]*model.AppError, concurrentAttempts)
|
||||
|
||||
// Wait to complete the test
|
||||
var completeWG sync.WaitGroup
|
||||
completeWG.Add(concurrentAttempts)
|
||||
|
||||
for i := 0; i < concurrentAttempts; i++ {
|
||||
go func(i int) {
|
||||
defer completeWG.Done()
|
||||
|
||||
if tc.doLoginExpectedErrID == "ent.ldap.do_login.invalid_password.app_error" {
|
||||
mockLdap.Mock.On("DoLogin", mock.AnythingOfType("*request.Context"), mock.AnythingOfType("string"), mock.AnythingOfType("string")).Return(nil, &model.AppError{Id: tc.doLoginExpectedErrID})
|
||||
} else {
|
||||
mockLdap.Mock.On("DoLogin", mock.AnythingOfType("*request.Context"), mock.AnythingOfType("string"), tc.password).Return(user, nil)
|
||||
}
|
||||
_, appErrs[i] = th.App.checkLdapUserPasswordAndAllCriteria(th.Context, user, tc.password, tc.mfaToken)
|
||||
}(i)
|
||||
}
|
||||
|
||||
completeWG.Wait()
|
||||
|
||||
expectedErrsCount := 0
|
||||
for i := 0; i < concurrentAttempts; i++ {
|
||||
if appErrs[i].Id == tc.expectedErrID {
|
||||
expectedErrsCount++
|
||||
continue
|
||||
}
|
||||
|
||||
if appErrs[i] != nil {
|
||||
require.Equal(t, "api.user.check_user_login_attempts.too_many_ldap.app_error", appErrs[i].Id, "All other errors should be of too many login attempts only.")
|
||||
}
|
||||
}
|
||||
|
||||
// Password/MFA failure attempts should not breach the maxFailedAttempts
|
||||
// even during concurrent access by the same user.
|
||||
require.Equal(t, maxFailedLoginAttempts, expectedErrsCount)
|
||||
})
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
Ссылка в новой задаче
Block a user