|
| 1 | +# Overview |
| 2 | + |
| 3 | +These are tests for the ESP session ID moving to a 128-bit cryptographically secure format. |
| 4 | + |
| 5 | +# Implementation |
| 6 | + |
| 7 | +## Prerequisites and Assumptions |
| 8 | + |
| 9 | +The tests require a running ESP with security enabled, so they are expected to be run manually. These assumptions about the environment are set as variables in the test script but can be overridden on the CLI: |
| 10 | + |
| 11 | +1. HTTP default, but can support HTTPS |
| 12 | +2. Target ESP host is 127.0.0.1 (port 8010) |
| 13 | +3. Regular user ID is `hpcc_user` |
| 14 | +4. Admin user ID is `hpcc_admin` |
| 15 | + |
| 16 | +The user passwords are expected to be set as environmental values but can be specified on the CLI: |
| 17 | + |
| 18 | +1. Regular user password in `$HPCC_TEST_USER_PW` |
| 19 | +2. Admin user password in `$HPCC_TEST_ADMIN_PW` |
| 20 | + |
| 21 | +The ESP must have WSESPControl authorized for the Admin user, and that user must belong to a group of the same name as the LDAP Admin group. |
| 22 | + |
| 23 | +### Python Dependencies |
| 24 | + |
| 25 | +Install required Python packages: |
| 26 | + |
| 27 | +```bash |
| 28 | +pip install requests |
| 29 | +``` |
| 30 | + |
| 31 | +## Running Tests |
| 32 | + |
| 33 | +### Basic Usage |
| 34 | + |
| 35 | +Set environment variables and run all tests: |
| 36 | + |
| 37 | +```bash |
| 38 | +export HPCC_TEST_USER_PW=your_user_password |
| 39 | +export HPCC_TEST_ADMIN_PW=your_admin_password |
| 40 | +python3 sessionid_test.py |
| 41 | +``` |
| 42 | + |
| 43 | +### Advanced Options |
| 44 | + |
| 45 | +```bash |
| 46 | +# Custom host and port |
| 47 | +python3 sessionid_test.py --host 192.168.1.100 --port 8010 |
| 48 | + |
| 49 | +# Use HTTPS |
| 50 | +python3 sessionid_test.py --protocol https |
| 51 | + |
| 52 | +# Custom credentials |
| 53 | +python3 sessionid_test.py --user myuser --user-pw mypass --admin myadmin --admin-pw adminpass |
| 54 | + |
| 55 | +# Run specific test |
| 56 | +python3 sessionid_test.py -t test_new_format_validation |
| 57 | + |
| 58 | +# Verbose output |
| 59 | +python3 sessionid_test.py -v |
| 60 | + |
| 61 | +# Show help |
| 62 | +python3 sessionid_test.py --help |
| 63 | +``` |
| 64 | + |
| 65 | +## Tests |
| 66 | + |
| 67 | +The test suite (`sessionid_test.py`) implements the following automated tests using ESP APIs. Tests pull data from response fields, headers and cookies as needed. All tests run as regular user unless otherwise specified. |
| 68 | + |
| 69 | +### Test 1: New Format Validation |
| 70 | +- Login via `/esp/login` |
| 71 | +- Extract `ESPSessionID` cookie |
| 72 | +- Validate session ID is 32-character hex string (128-bit) |
| 73 | +- Make authenticated request to `/WsSMC/Activity` |
| 74 | +- Verify successful authentication with new session ID format |
| 75 | + |
| 76 | +### Test 2: Incorrect Format/Unknown Session ID Rejection |
| 77 | +- Craft multiple malformed session IDs: |
| 78 | + - Empty string |
| 79 | + - Too short |
| 80 | + - Too long (33+ characters) |
| 81 | + - Non-hex characters |
| 82 | + - Wrong format (with dashes, etc.) |
| 83 | +- Attempt authenticated requests with each invalid session ID |
| 84 | +- Confirm expected failure (HTTP 401/403 or redirect to login) |
| 85 | + |
| 86 | +### Test 3: ws_espcontrol Session Timeout |
| 87 | +1. Login as regular user |
| 88 | +2. Verify session is active with authenticated request |
| 89 | +3. Login as admin |
| 90 | +4. Use `/WSESPControl/SessionQuery` to find user's external session ID |
| 91 | +5. Call `/WSESPControl/SetSessionTimeout` with `TimeoutMinutes=1` |
| 92 | +6. Wait 90 seconds (timeout + ESP cleanup cycle buffer) |
| 93 | +7. Confirm session has timed out (request fails or redirects) |
| 94 | + |
| 95 | +### Test 4: Logout Session Invalidation |
| 96 | +1. Login as user |
| 97 | +2. Extract session ID and verify it works |
| 98 | +3. Call `/esp/logout` |
| 99 | +4. Attempt authenticated request with old session cookie |
| 100 | +5. Confirm session is invalid (HTTP 401/403 or redirect) |
| 101 | + |
| 102 | +### Test 5: Concurrent Sessions Load Test |
| 103 | +- Use `ThreadPoolExecutor` to create multiple concurrent login sessions |
| 104 | +- All threads login as same user simultaneously |
| 105 | +- Capture session IDs from all successful logins |
| 106 | +- Verify each session is active by making authenticated request to `/WsSMC/Activity` |
| 107 | +- Confirm ESP allows multiple concurrent sessions per user |
| 108 | +- Confirm all captured session IDs are functional |
| 109 | + |
| 110 | +### Test 6: Session ID Uniqueness |
| 111 | +1. Login as admin for session queries |
| 112 | +2. Perform many sequential logins as regular user (configurable count, default 1000) |
| 113 | +3. For each iteration: |
| 114 | + - Login and capture session ID from cookie |
| 115 | + - Use `/WSESPControl/SessionQuery` to retrieve external session ID |
| 116 | + - Store both session ID and external ID |
| 117 | + - Logout to clean up session |
| 118 | +4. Verify all session IDs are unique (no duplicates in set) |
| 119 | +5. Verify all external IDs are unique (no duplicates in set) |
| 120 | +6. Verify external IDs differ from their corresponding session IDs |
| 121 | +7. Report statistics: unique counts, duplicate counts, failed logins/queries |
| 122 | + |
| 123 | +### Test 7: Active Session Collision Detection |
| 124 | +1. Login as admin for session queries |
| 125 | +2. Create many concurrent active sessions (configurable count, default 1000) |
| 126 | +3. Keep all `ESPSession` objects alive (no logout) |
| 127 | +4. Verify all session IDs collected are unique |
| 128 | +5. Use `/WSESPControl/SessionQuery` to retrieve all external session IDs |
| 129 | +6. Extract all external IDs from admin API response |
| 130 | +7. Verify count of external IDs matches count of active sessions |
| 131 | +8. Verify all external IDs are unique |
| 132 | +9. Verify external IDs differ from their session IDs |
| 133 | +10. Confirm collision detection works under realistic concurrent load |
0 commit comments