|
| 1 | +#!/usr/bin/env bash |
| 2 | +bash -n "$0" | exit 1 |
| 3 | + |
| 4 | +set -e |
| 5 | +source ${TESTSROOTDIR}/tools/runit_common.sh |
| 6 | + |
| 7 | +dbnm=$1 |
| 8 | + |
| 9 | +if [ "x$dbnm" == "x" ] ; then |
| 10 | + failexit "need a DB name" |
| 11 | +fi |
| 12 | + |
| 13 | +SA="${TESTSBUILDDIR}/simpleauth_test ${dbnm}" |
| 14 | +OP="bpi:procauth:cluster:test:user:op:bpkg:setup" |
| 15 | +MOHIT="bpi:procauth:cluster:testcluster:user:mohit:bpkg:myapp" |
| 16 | + |
| 17 | +passed=0 |
| 18 | +failed=0 |
| 19 | + |
| 20 | +run_expect_success() { |
| 21 | + local principal="$1" |
| 22 | + local sql="$2" |
| 23 | + local desc="$3" |
| 24 | + if $SA "$principal" "$sql" > /dev/null 2>&1; then |
| 25 | + echo " PASS: $desc" |
| 26 | + passed=$((passed + 1)) |
| 27 | + else |
| 28 | + echo " FAIL: $desc" |
| 29 | + failed=$((failed + 1)) |
| 30 | + fi |
| 31 | +} |
| 32 | + |
| 33 | +run_expect_failure() { |
| 34 | + local principal="$1" |
| 35 | + local sql="$2" |
| 36 | + local desc="$3" |
| 37 | + if $SA "$principal" "$sql" > /dev/null 2>&1; then |
| 38 | + echo " FAIL: $desc (expected failure but succeeded)" |
| 39 | + failed=$((failed + 1)) |
| 40 | + else |
| 41 | + echo " PASS: $desc" |
| 42 | + passed=$((passed + 1)) |
| 43 | + fi |
| 44 | +} |
| 45 | + |
| 46 | +# Run SQL via admin connection with OP password user (bypasses IAM). |
| 47 | +admin_sql() { |
| 48 | + local sql="$1" |
| 49 | + ${CDB2SQL_EXE} --admin ${CDB2_OPTIONS} ${dbnm} default - <<EOF |
| 50 | +set user admin_user |
| 51 | +set password adminpass |
| 52 | +$sql |
| 53 | +EOF |
| 54 | +} |
| 55 | + |
| 56 | +#--------------------------------------------------------------- |
| 57 | +echo "Test: Setup comdb2_simple_auth table and IAM rules" |
| 58 | +#--------------------------------------------------------------- |
| 59 | +run_expect_success "$OP" "create table if not exists comdb2_simple_auth(cluster cstring(20) default '*', user cstring(20) default '*', bpkg cstring(50) default '*', verb cstring(20) default '*', resourcetype cstring(20) default '*', resourcename cstring(50) default '*')" \ |
| 60 | + "create auth table" |
| 61 | +run_expect_success "$OP" "create unique index if not exists comdb2_simple_auth_ix on comdb2_simple_auth(cluster, user, bpkg, verb, resourcetype, resourcename)" \ |
| 62 | + "create auth index" |
| 63 | +# Wildcard rule: allow everyone everything via IAM |
| 64 | +run_expect_success "$OP" "insert into comdb2_simple_auth(cluster, user, bpkg, verb, resourcetype, resourcename) values('*', '*', '*', '*', '*', '*') on conflict do nothing" \ |
| 65 | + "insert wildcard IAM rule" |
| 66 | +run_expect_success "$OP" "insert into comdb2_simple_auth(cluster, user, bpkg, verb, resourcetype, resourcename) values('*', '*', '*', 'Connect', '*', '*') on conflict do nothing" \ |
| 67 | + "insert Connect rule" |
| 68 | +# OP needs explicit IAM access to auth table after wildcard removal |
| 69 | +run_expect_success "$OP" "insert into comdb2_simple_auth(cluster, user, bpkg, verb, resourcetype, resourcename) values('*', 'op', '*', 'Write', 'table', 'comdb2_simple_auth') on conflict do nothing" \ |
| 70 | + "grant op IAM write on auth table" |
| 71 | +run_expect_success "$OP" "insert into comdb2_simple_auth(cluster, user, bpkg, verb, resourcetype, resourcename) values('*', 'op', '*', 'Read', 'table', 'comdb2_simple_auth') on conflict do nothing" \ |
| 72 | + "grant op IAM read on auth table" |
| 73 | + |
| 74 | +#--------------------------------------------------------------- |
| 75 | +echo "Test: Create test table and enable password auth" |
| 76 | +#--------------------------------------------------------------- |
| 77 | +run_expect_success "$OP" "create table if not exists t1(i int)" \ |
| 78 | + "create test table t1" |
| 79 | +# Create password users: 'default' (non-OP) for data tests, |
| 80 | +# 'admin_user' (OP) for management via admin connection. |
| 81 | +run_expect_success "$OP" "put password '' for 'default'" \ |
| 82 | + "create default password user" |
| 83 | +run_expect_success "$OP" "put password 'adminpass' for 'admin_user'" \ |
| 84 | + "create admin password user" |
| 85 | +run_expect_success "$OP" "grant op to 'admin_user'" \ |
| 86 | + "grant OP to admin_user" |
| 87 | +# Grant table-level password ACLs to default user |
| 88 | +run_expect_success "$OP" "grant read on t1 to 'default'" \ |
| 89 | + "grant password read on t1 to default" |
| 90 | +run_expect_success "$OP" "grant write on t1 to 'default'" \ |
| 91 | + "grant password write on t1 to default" |
| 92 | +# Enable password authentication -- from this point both IAM and |
| 93 | +# password checks must pass. |
| 94 | +# Note: put authentication on uses comdb2AuthenticateOpPassword which |
| 95 | +# requires password-based OP credentials (ignores IAM), so we must |
| 96 | +# use admin_sql with admin_user/adminpass rather than simpleauth_test. |
| 97 | +admin_sql "put authentication on" |
| 98 | +echo " password authentication enabled" |
| 99 | + |
| 100 | +#--------------------------------------------------------------- |
| 101 | +echo "Test: Both IAM and password pass" |
| 102 | +#--------------------------------------------------------------- |
| 103 | +# simpleauth_test provides IAM identity (wildcard allows everything). |
| 104 | +# Password user is 'default' with correct password and table ACLs. |
| 105 | +run_expect_success "$MOHIT" "select * from t1" \ |
| 106 | + "read t1: IAM pass + password pass" |
| 107 | +run_expect_success "$MOHIT" "insert into t1 values(1)" \ |
| 108 | + "write t1: IAM pass + password pass" |
| 109 | + |
| 110 | +#--------------------------------------------------------------- |
| 111 | +echo "Test: IAM passes but password table ACL denied" |
| 112 | +#--------------------------------------------------------------- |
| 113 | +# Revoke password-based table ACLs for default user. |
| 114 | +# IAM wildcard still allows, but bdb_check_user_tbl_access will fail |
| 115 | +# because 'default' is not OP and has no table grants. |
| 116 | +admin_sql "revoke read on t1 from 'default'" |
| 117 | +admin_sql "revoke write on t1 from 'default'" |
| 118 | +run_expect_failure "$MOHIT" "select * from t1" \ |
| 119 | + "read t1: IAM pass + password ACL denied" |
| 120 | +run_expect_failure "$MOHIT" "insert into t1 values(2)" \ |
| 121 | + "write t1: IAM pass + password ACL denied" |
| 122 | +# Restore password ACLs |
| 123 | +admin_sql "grant read on t1 to 'default'" |
| 124 | +admin_sql "grant write on t1 to 'default'" |
| 125 | +# Verify restored |
| 126 | +run_expect_success "$MOHIT" "select * from t1" \ |
| 127 | + "read t1 after restore: both pass" |
| 128 | + |
| 129 | +#--------------------------------------------------------------- |
| 130 | +echo "Test: IAM denied but password passes" |
| 131 | +#--------------------------------------------------------------- |
| 132 | +# Remove wildcard IAM rule. Keep the Connect rule so MakeRequest |
| 133 | +# still passes (allows connection but not table-level access). |
| 134 | +admin_sql "delete from comdb2_simple_auth where cluster='*' and user='*' and bpkg='*' and verb='*' and resourcetype='*' and resourcename='*'" |
| 135 | +# MOHIT has no IAM Read/Write rule for t1 -> IAM table check fails |
| 136 | +# before reaching the password ACL check. |
| 137 | +run_expect_failure "$MOHIT" "select * from t1" \ |
| 138 | + "read t1: IAM denied + password pass (fails at IAM)" |
| 139 | +run_expect_failure "$MOHIT" "insert into t1 values(3)" \ |
| 140 | + "write t1: IAM denied + password pass (fails at IAM)" |
| 141 | +# Restore wildcard IAM rule |
| 142 | +admin_sql "insert into comdb2_simple_auth(cluster, user, bpkg, verb, resourcetype, resourcename) values('*', '*', '*', '*', '*', '*') on conflict do nothing" |
| 143 | +# Verify restored |
| 144 | +run_expect_success "$MOHIT" "select * from t1" \ |
| 145 | + "read t1 after IAM restore: both pass" |
| 146 | + |
| 147 | +#--------------------------------------------------------------- |
| 148 | +echo "Test: Neither IAM nor password passes" |
| 149 | +#--------------------------------------------------------------- |
| 150 | +admin_sql "delete from comdb2_simple_auth where cluster='*' and user='*' and bpkg='*' and verb='*' and resourcetype='*' and resourcename='*'" |
| 151 | +admin_sql "revoke read on t1 from 'default'" |
| 152 | +admin_sql "revoke write on t1 from 'default'" |
| 153 | +run_expect_failure "$MOHIT" "select * from t1" \ |
| 154 | + "read t1: IAM denied + password denied" |
| 155 | +run_expect_failure "$MOHIT" "insert into t1 values(4)" \ |
| 156 | + "write t1: IAM denied + password denied" |
| 157 | + |
| 158 | +#--------------------------------------------------------------- |
| 159 | +echo "Test: Cleanup" |
| 160 | +#--------------------------------------------------------------- |
| 161 | +admin_sql "insert into comdb2_simple_auth(cluster, user, bpkg, verb, resourcetype, resourcename) values('*', '*', '*', '*', '*', '*') on conflict do nothing" |
| 162 | +admin_sql "drop table if exists t1" |
| 163 | +admin_sql "delete from comdb2_simple_auth where user != '*'" |
| 164 | + |
| 165 | +echo "" |
| 166 | +echo "Results: $passed passed, $failed failed" |
| 167 | + |
| 168 | +if [ $failed -gt 0 ] ; then |
| 169 | + failexit "$failed tests failed" |
| 170 | +fi |
| 171 | + |
| 172 | +echo "Success" |
| 173 | +exit 0 |
0 commit comments