Skip to content

Commit 7399778

Browse files
RevolyssupRevolyssup
authored
chore: backport ldap auth test (#2569)
1 parent 7262683 commit 7399778

File tree

5 files changed

+179
-0
lines changed

5 files changed

+179
-0
lines changed

‎.github/workflows/apisix-e2e-test.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,9 @@ jobs:
9999
node $(pwd)/adc.js -v
100100
echo "ADC_BIN=node $(pwd)/adc.js" >> $GITHUB_ENV
101101
102+
- name: Start OpenLDAP server
103+
run: make e2e-ldap
104+
102105
- name: Run E2E test suite
103106
shell: bash
104107
env:

‎Makefile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,17 @@ ifndef ignore-not-found
268268
ignore-not-found = false
269269
endif
270270

271+
.PHONY: e2e-ldap
272+
e2e-ldap:
273+
ifeq ("$(E2E_FOCUS)", "")
274+
chmod +x ./test/e2e/testdata/ldap/cmd.sh && ./test/e2e/testdata/ldap/cmd.sh start
275+
endif
276+
ifneq ("$(E2E_FOCUS)", "")
277+
echo $(E2E_FOCUS) | grep -E 'suite-plugins-authentication|consumer|ldap' || exit 0 \
278+
&& chmod +x ./test/e2e/testdata/ldap/cmd.sh \
279+
&& ./test/e2e/testdata/ldap/cmd.sh start
280+
endif
281+
271282
.PHONY: install-gateway-api
272283
install-gateway-api: ## Install Gateway API CRDs into the K8s cluster specified in ~/.kube/config.
273284
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/$(GATEAY_API_VERSION)/experimental-install.yaml

‎test/e2e/crds/v2/consumer.go‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,13 @@ import (
2323
"encoding/base64"
2424
"fmt"
2525
"net/http"
26+
"os"
27+
"os/exec"
2628
"time"
2729

2830
. "github.com/onsi/ginkgo/v2"
2931
. "github.com/onsi/gomega"
32+
"github.com/stretchr/testify/assert"
3033
"k8s.io/apimachinery/pkg/types"
3134

3235
apiv2 "github.com/apache/apisix-ingress-controller/api/v2"
@@ -585,4 +588,87 @@ spec:
585588
Expect(err).ShouldNot(HaveOccurred(), "deleting Secret")
586589
})
587590
})
591+
Context("Test LDAPAuth", func() {
592+
getLDAPServerURL := func() (string, error) {
593+
wd, _ := os.Getwd()
594+
cmd := exec.Command("sh", "../testdata/ldap/cmd.sh", "ip")
595+
ip, err := cmd.Output()
596+
errr := fmt.Sprintf("cd %s/testdata/ldap && sh cmd.sh ip failed", wd)
597+
if err != nil {
598+
return "", fmt.Errorf(errr+" : %v", err)
599+
}
600+
if len(ip) == 0 {
601+
return "", fmt.Errorf("ldap-server start failed")
602+
}
603+
return fmt.Sprintf("%s:1389", string(ip)), nil
604+
}
605+
request := func(path string, username, password string) int {
606+
return s.NewAPISIXClient().GET(path).WithBasicAuth(username, password).WithHost("httpbin").Expect().Raw().StatusCode
607+
}
608+
It("ApisixRoute with ldapAuth consumer using secret", func() {
609+
secret := `
610+
apiVersion: v1
611+
kind: Secret
612+
metadata:
613+
name: ldap
614+
data:
615+
user_dn: Y249amFjayxvdT11c2VycyxkYz1sZGFwLGRjPWV4YW1wbGUsZGM9b3Jn
616+
`
617+
assert.Nil(GinkgoT(), s.CreateResourceFromString(secret), "creating ldapAuth secret for ApisixConsumer")
618+
619+
ac := `
620+
apiVersion: apisix.apache.org/v2
621+
kind: ApisixConsumer
622+
metadata:
623+
name: jack
624+
spec:
625+
ingressClassName: %s
626+
authParameter:
627+
ldapAuth:
628+
secretRef:
629+
name: ldap
630+
`
631+
632+
By("apply ApisixConsumer")
633+
applier.MustApplyAPIv2(types.NamespacedName{Namespace: s.Namespace(), Name: "jack"},
634+
&apiv2.ApisixConsumer{}, fmt.Sprintf(ac, s.Namespace()))
635+
636+
ldapSvr, err := getLDAPServerURL()
637+
assert.Nil(GinkgoT(), err, "check ldap server")
638+
ar := fmt.Sprintf(`
639+
apiVersion: apisix.apache.org/v2
640+
kind: ApisixRoute
641+
metadata:
642+
name: httpbin-route
643+
spec:
644+
ingressClassName: %s
645+
http:
646+
- name: rule1
647+
match:
648+
hosts:
649+
- httpbin
650+
paths:
651+
- /get
652+
backends:
653+
- serviceName: httpbin-service-e2e-test
654+
servicePort: 80
655+
authentication:
656+
enable: true
657+
type: ldapAuth
658+
ldapAuth:
659+
ldap_uri: %s
660+
base_dn: "ou=users,dc=ldap,dc=example,dc=org"
661+
use_tls: false
662+
uid: "cn"
663+
`, s.Namespace(), ldapSvr)
664+
applier.MustApplyAPIv2(types.NamespacedName{Namespace: s.Namespace(), Name: "httpbin-route"},
665+
&apiv2.ApisixRoute{}, ar)
666+
667+
By("verify ApisixRoute with ApisixConsumer")
668+
Eventually(request).WithArguments("/get", "", "").WithTimeout(5 * time.Second).ProbeEvery(time.Second).Should(Equal(http.StatusUnauthorized))
669+
670+
By("verify ApisixRoute with ApisixConsumer")
671+
Eventually(request).WithArguments("/get", "jack", "jackPassword").WithTimeout(5 * time.Second).ProbeEvery(time.Second).Should(Equal(http.StatusOK))
672+
})
673+
})
588674
})

‎test/e2e/testdata/ldap/cmd.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/sh
2+
3+
#
4+
# Licensed to the Apache Software Foundation (ASF) under one or more
5+
# contributor license agreements. See the NOTICE file distributed with
6+
# this work for additional information regarding copyright ownership.
7+
# The ASF licenses this file to You under the Apache License, Version 2.0
8+
# (the "License"); you may not use this file except in compliance with
9+
# the License. You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
#
19+
20+
cd test/e2e/testdata/ldap/
21+
22+
OPTION=$1
23+
COMPOSE_CMD=""
24+
25+
if command -v "docker-compose" > /dev/null 2>&1; then
26+
COMPOSE_CMD="docker-compose"
27+
elif command -v "docker" > /dev/null 2>&1; then
28+
COMPOSE_CMD="docker compose"
29+
else
30+
echo "docker-compose or docker compose not found"
31+
exit 1
32+
fi
33+
34+
if [ $OPTION = "ip" ]; then
35+
echo -n `docker inspect -f '{{range .NetworkSettings.Networks}}{{.Gateway}}{{end}}' openldap`
36+
elif [ $OPTION = "start" ]; then
37+
$COMPOSE_CMD -f 'docker-compose.yaml' -p 'openldap' down
38+
39+
# start openldap
40+
$COMPOSE_CMD -f 'docker-compose.yaml' -p 'openldap' up -d
41+
42+
elif [ $OPTION = "stop" ]; then
43+
$COMPOSE_CMD -f 'docker-compose.yaml' -p 'openldap' down
44+
else
45+
echo "argument is one of [ip, start, stop]"
46+
fi

‎test/e2e/testdata/ldap/docker-compose.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
version: '3'
19+
20+
services:
21+
openldap:
22+
container_name: openldap
23+
image: docker.io/bitnami/openldap:2.6
24+
ports:
25+
- '1389:1389'
26+
environment:
27+
- LDAP_PORT_NUMBER=1389
28+
- LDAP_ENABLE_TLS=no
29+
- LDAP_ADMIN_USERNAME=admin
30+
- LDAP_ADMIN_PASSWORD=admin
31+
- LDAP_ROOT=dc=ldap,dc=example,dc=org
32+
- LDAP_USERS=jack
33+
- LDAP_PASSWORDS=jackPassword

0 commit comments

Comments
 (0)