Skip to content

Commit 936a09b

Browse files
n00bcrackern00bcracker
committed
1. Added several high-level tests for login behavior.
2. Avoid usage low-level test framework in checking sysviews It's needed to move passwors hash computing from SchemeShard in further PRs
1 parent 5f595af commit 936a09b

File tree

2 files changed

+120
-8
lines changed

2 files changed

+120
-8
lines changed

‎ydb/core/sys_view/ut_auth.cpp‎

Lines changed: 45 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -178,14 +178,30 @@ Y_UNIT_TEST_SUITE(AuthSystemView) {
178178

179179

180180
{
181-
auto loginResult = env.GetClient().Login(*(env.GetServer().GetRuntime()), "user1", "password1");
182-
UNIT_ASSERT_EQUAL(loginResult.GetError(), "");
181+
auto driverConfig = TDriverConfig()
182+
.SetEndpoint(env.GetEndpoint())
183+
.SetDatabase("/Root")
184+
.SetCredentialsProviderFactory(NYdb::CreateLoginCredentialsProviderFactory({
185+
.User = "user1",
186+
.Password = "password1",
187+
}));
188+
auto driver = TDriver(driverConfig);
189+
190+
NQuery::TQueryClient client(driver);
191+
auto result = client.ExecuteQuery("SELECT 1;", NQuery::TTxControl::NoTx()).GetValueSync();
192+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
183193
}
184194

185195
{
186196
for (size_t i = 0; i < 4; i++) {
187-
auto loginResult = env.GetClient().Login(*(env.GetServer().GetRuntime()), "user1", "wrongPassword");
188-
UNIT_ASSERT_EQUAL(loginResult.GetError(), "Invalid password");
197+
auto driverConfig = TDriverConfig()
198+
.SetEndpoint(env.GetEndpoint())
199+
.SetDatabase("/Root")
200+
.SetCredentialsProviderFactory(NYdb::CreateLoginCredentialsProviderFactory({
201+
.User = "user1",
202+
.Password = "wrongPassword",
203+
}));
204+
auto driver = TDriver(driverConfig);
189205
}
190206
}
191207

@@ -205,8 +221,19 @@ Y_UNIT_TEST_SUITE(AuthSystemView) {
205221

206222
// Check that user is locked out and cannot login
207223
{
208-
auto loginResult = env.GetClient().Login(*(env.GetServer().GetRuntime()), "user1", "password1");
209-
UNIT_ASSERT_EQUAL(loginResult.GetError(), "User user1 login denied: too many failed password attempts");
224+
auto driverConfig = TDriverConfig()
225+
.SetEndpoint(env.GetEndpoint())
226+
.SetDatabase("/Root")
227+
.SetCredentialsProviderFactory(NYdb::CreateLoginCredentialsProviderFactory({
228+
.User = "user1",
229+
.Password = "password1",
230+
}));
231+
auto driver = TDriver(driverConfig);
232+
233+
NQuery::TQueryClient client(driver);
234+
auto result = client.ExecuteQuery("SELECT 1;", NQuery::TTxControl::NoTx()).GetValueSync();
235+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::CLIENT_UNAUTHENTICATED, result.GetIssues().ToString());
236+
UNIT_ASSERT_STRING_CONTAINS(result.GetIssues().ToString(), "User user1 login denied: too many failed password attempts");
210237
}
211238

212239
Sleep(TDuration::Seconds(5));
@@ -227,8 +254,18 @@ Y_UNIT_TEST_SUITE(AuthSystemView) {
227254

228255
// User can login
229256
{
230-
auto loginResult = env.GetClient().Login(*(env.GetServer().GetRuntime()), "user1", "password1");
231-
UNIT_ASSERT_EQUAL(loginResult.GetError(), "");
257+
auto driverConfig = TDriverConfig()
258+
.SetEndpoint(env.GetEndpoint())
259+
.SetDatabase("/Root")
260+
.SetCredentialsProviderFactory(NYdb::CreateLoginCredentialsProviderFactory({
261+
.User = "user1",
262+
.Password = "password1",
263+
}));
264+
auto driver = TDriver(driverConfig);
265+
266+
NQuery::TQueryClient client(driver);
267+
auto result = client.ExecuteQuery("SELECT 1;", NQuery::TTxControl::NoTx()).GetValueSync();
268+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
232269
}
233270

234271
// Check that FailedAttemptCount is reset

‎ydb/services/ydb/ydb_login_ut.cpp‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#include <format>
22

3+
#include <library/cpp/string_utils/base64/base64.h>
34
#include <library/cpp/testing/unittest/tests_data.h>
45
#include <library/cpp/testing/unittest/registar.h>
56

@@ -151,6 +152,41 @@ Y_UNIT_TEST_SUITE(TGRpcAuthentication) {
151152
loginConnection.Stop();
152153
}
153154

155+
Y_UNIT_TEST(ValidHashCredentials) {
156+
TLoginClientConnection loginConnection;
157+
158+
std::string hash = R"(
159+
{
160+
"version": 1,
161+
"argon2id": "HTkpQjtVJgBoA0CZu+i3zg==$ZO37rNB37kP9hzmKRGfwc4aYrboDt4OBDsF1TBn5oLw=",
162+
"scram-sha-256": "4096:s0QSrrFVkMTh3k2TTk860A==$LmCubRpIYV1zHMLucTtu7XjhB+PgWwH8ABCYGyVF1mo=:eUrie0C98tEFgygSOtom/fwPmgnMxeq53l7YTFfYncc="
163+
}
164+
)";
165+
auto createUserQuery = std::format("CREATE USER {0:} HASH '{1:}'", std::string(User), std::string(Base64Encode(hash)));
166+
auto result = loginConnection.ExecuteSql("root@builtin", TString(createUserQuery));
167+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
168+
169+
auto factory = CreateLoginCredentialsProviderFactory({.User = User, .Password = "password1"});
170+
auto loginProvider = factory->CreateProvider(loginConnection.GetCoreFacility());
171+
UNIT_ASSERT_NO_EXCEPTION(loginProvider->GetAuthInfo());
172+
173+
hash = R"(
174+
{
175+
"version": 1,
176+
"argon2id": "HTkpQjtVJgBoA0CZu+i3zg==$ZO37rNB37kP9hzmKRGfwc4aYrboDt4OBDsF1TBn5oLw="
177+
}
178+
)";
179+
auto alterUserQuery = std::format("ALTER USER {0:} HASH '{1:}'", std::string(User), std::string(Base64Encode(hash)));
180+
result = loginConnection.ExecuteSql("root@builtin", TString(alterUserQuery));
181+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
182+
183+
factory = CreateLoginCredentialsProviderFactory({.User = User, .Password = "password1"});
184+
loginProvider = factory->CreateProvider(loginConnection.GetCoreFacility());
185+
UNIT_ASSERT_NO_EXCEPTION(loginProvider->GetAuthInfo());
186+
187+
loginConnection.Stop();
188+
}
189+
154190
Y_UNIT_TEST(InvalidPassword) {
155191
TLoginClientConnection loginConnection;
156192
loginConnection.CreateUser(User, Password);
@@ -159,6 +195,45 @@ Y_UNIT_TEST_SUITE(TGRpcAuthentication) {
159195
auto loginProvider = factory->CreateProvider(loginConnection.GetCoreFacility());
160196
UNIT_ASSERT_EXCEPTION_CONTAINS(loginProvider->GetAuthInfo(), yexception, "Invalid password");
161197

198+
std::string hash = R"(
199+
{
200+
"version": 1,
201+
"argon2id": "HTkpQjtVJgBoA0CZu+i3zg==$ZO37rNB37kP9hzmKRGfwc4aYrboDt4OBDsF1TBn5oLw=",
202+
"scram-sha-256": "4096:s0QSrrFVkMTh3k2TTk860A==$LmCubRpIYV1zHMLucTtu7XjhB+PgWwH8ABCYGyVF1mo=:eUrie0C98tEFgygSOtom/fwPmgnMxeq53l7YTFfYncc="
203+
}
204+
)";
205+
auto alterUserQuery = std::format("ALTER USER {0:} HASH '{1:}'", std::string(User), std::string(Base64Encode(hash)));
206+
auto result = loginConnection.ExecuteSql("root@builtin", TString(alterUserQuery));
207+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
208+
209+
factory = CreateLoginCredentialsProviderFactory({.User = User, .Password = Password});
210+
loginProvider = factory->CreateProvider(loginConnection.GetCoreFacility());
211+
UNIT_ASSERT_EXCEPTION_CONTAINS(loginProvider->GetAuthInfo(), yexception, "Invalid password");
212+
213+
loginConnection.Stop();
214+
}
215+
216+
Y_UNIT_TEST(UnknownUser) {
217+
TLoginClientConnection loginConnection;
218+
219+
auto factory = CreateLoginCredentialsProviderFactory({.User = User, .Password = Password});
220+
auto loginProvider = factory->CreateProvider(loginConnection.GetCoreFacility());
221+
UNIT_ASSERT_EXCEPTION_CONTAINS(loginProvider->GetAuthInfo(), yexception, "Cannot find user 'user'");
222+
223+
loginConnection.CreateUser(User, Password);
224+
225+
factory = CreateLoginCredentialsProviderFactory({.User = User, .Password = Password});
226+
loginProvider = factory->CreateProvider(loginConnection.GetCoreFacility());
227+
UNIT_ASSERT_NO_EXCEPTION(loginProvider->GetAuthInfo());
228+
229+
auto dropUserQuery = std::format("DROP USER {0:}", std::string(User));
230+
auto result = loginConnection.ExecuteSql("root@builtin", TString(dropUserQuery));
231+
UNIT_ASSERT_VALUES_EQUAL_C(result.GetStatus(), EStatus::SUCCESS, result.GetIssues().ToString());
232+
233+
factory = CreateLoginCredentialsProviderFactory({.User = User, .Password = Password});
234+
loginProvider = factory->CreateProvider(loginConnection.GetCoreFacility());
235+
UNIT_ASSERT_EXCEPTION_CONTAINS(loginProvider->GetAuthInfo(), yexception, "Cannot find user 'user'");
236+
162237
loginConnection.Stop();
163238
}
164239

0 commit comments

Comments
 (0)