forked from TrueCloudLab/distribution
ffe56ebe41
This change refactors the basic authentication implementation to better follow Go coding standards. Many types are no longer exported. The parser is now a separate function from the authentication code. The standard functions (*http.Request).BasicAuth/SetBasicAuth are now used where appropriate. Signed-off-by: Stephen J Day <stephen.day@docker.com>
109 lines
2.8 KiB
Go
109 lines
2.8 KiB
Go
package basic
|
|
|
|
import (
|
|
"io/ioutil"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/docker/distribution/context"
|
|
"github.com/docker/distribution/registry/auth"
|
|
)
|
|
|
|
func TestBasicAccessController(t *testing.T) {
|
|
|
|
testRealm := "The-Shire"
|
|
testUsers := []string{"bilbo", "frodo", "MiShil", "DeokMan"}
|
|
testPasswords := []string{"baggins", "baggins", "새주", "공주님"}
|
|
testHtpasswdContent := `bilbo:{SHA}5siv5c0SHx681xU6GiSx9ZQryqs=
|
|
frodo:$2y$05$926C3y10Quzn/LnqQH86VOEVh/18T6RnLaS.khre96jLNL/7e.K5W
|
|
MiShil:$2y$05$0oHgwMehvoe8iAWS8I.7l.KoECXrwVaC16RPfaSCU5eVTFrATuMI2
|
|
DeokMan:공주님`
|
|
|
|
tempFile, err := ioutil.TempFile("", "htpasswd-test")
|
|
if err != nil {
|
|
t.Fatal("could not create temporary htpasswd file")
|
|
}
|
|
if _, err = tempFile.WriteString(testHtpasswdContent); err != nil {
|
|
t.Fatal("could not write temporary htpasswd file")
|
|
}
|
|
|
|
options := map[string]interface{}{
|
|
"realm": testRealm,
|
|
"path": tempFile.Name(),
|
|
}
|
|
ctx := context.Background()
|
|
|
|
accessController, err := newAccessController(options)
|
|
if err != nil {
|
|
t.Fatal("error creating access controller")
|
|
}
|
|
|
|
tempFile.Close()
|
|
|
|
var userNumber = 0
|
|
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
ctx := context.WithRequest(ctx, r)
|
|
authCtx, err := accessController.Authorized(ctx)
|
|
if err != nil {
|
|
switch err := err.(type) {
|
|
case auth.Challenge:
|
|
err.ServeHTTP(w, r)
|
|
return
|
|
default:
|
|
t.Fatalf("unexpected error authorizing request: %v", err)
|
|
}
|
|
}
|
|
|
|
userInfo, ok := authCtx.Value("auth.user").(auth.UserInfo)
|
|
if !ok {
|
|
t.Fatal("basic accessController did not set auth.user context")
|
|
}
|
|
|
|
if userInfo.Name != testUsers[userNumber] {
|
|
t.Fatalf("expected user name %q, got %q", testUsers[userNumber], userInfo.Name)
|
|
}
|
|
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
client := &http.Client{
|
|
CheckRedirect: nil,
|
|
}
|
|
|
|
req, _ := http.NewRequest("GET", server.URL, nil)
|
|
resp, err := client.Do(req)
|
|
|
|
if err != nil {
|
|
t.Fatalf("unexpected error during GET: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
// Request should not be authorized
|
|
if resp.StatusCode != http.StatusUnauthorized {
|
|
t.Fatalf("unexpected non-fail response status: %v != %v", resp.StatusCode, http.StatusUnauthorized)
|
|
}
|
|
|
|
for i := 0; i < len(testUsers); i++ {
|
|
userNumber = i
|
|
req, err := http.NewRequest("GET", server.URL, nil)
|
|
if err != nil {
|
|
t.Fatalf("error allocating new request: %v", err)
|
|
}
|
|
|
|
req.SetBasicAuth(testUsers[i], testPasswords[i])
|
|
|
|
resp, err = client.Do(req)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error during GET: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
// Request should be authorized
|
|
if resp.StatusCode != http.StatusNoContent {
|
|
t.Fatalf("unexpected non-success response status: %v != %v for %s %s", resp.StatusCode, http.StatusNoContent, testUsers[i], testPasswords[i])
|
|
}
|
|
}
|
|
|
|
}
|