mirror of https://gitee.com/bigwinds/arangodb
474 lines
14 KiB
JavaScript
474 lines
14 KiB
JavaScript
/*jshint globalstrict:false, strict:false */
|
|
/*global fail, assertTrue */
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief test the authentication
|
|
///
|
|
/// @file
|
|
///
|
|
/// DISCLAIMER
|
|
///
|
|
/// Copyright 2010-2012 triagens GmbH, Cologne, Germany
|
|
///
|
|
/// Licensed under the Apache License, Version 2.0 (the "License");
|
|
/// you may not use this file except in compliance with the License.
|
|
/// You may obtain a copy of the License at
|
|
///
|
|
/// http://www.apache.org/licenses/LICENSE-2.0
|
|
///
|
|
/// Unless required by applicable law or agreed to in writing, software
|
|
/// distributed under the License is distributed on an "AS IS" BASIS,
|
|
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
/// See the License for the specific language governing permissions and
|
|
/// limitations under the License.
|
|
///
|
|
/// Copyright holder is triAGENS GmbH, Cologne, Germany
|
|
///
|
|
/// @author Jan Steemann
|
|
/// @author Copyright 2013, triAGENS GmbH, Cologne, Germany
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
var jsunity = require("jsunity");
|
|
var arango = require("@arangodb").arango;
|
|
var db = require("internal").db;
|
|
var users = require("@arangodb/users");
|
|
var request = require('@arangodb/request');
|
|
var crypto = require('@arangodb/crypto');
|
|
var expect = require('expect.js');
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief test suite
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
function AuthSuite () {
|
|
'use strict';
|
|
var baseUrl = function () {
|
|
return arango.getEndpoint().replace(/^tcp:/, 'http:').replace(/^ssl:/, 'https:');
|
|
};
|
|
|
|
const jwtSecret = 'haxxmann';
|
|
|
|
return {
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief set up
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
setUp : function () {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "root", "");
|
|
|
|
try {
|
|
users.remove("hackers@arangodb.com");
|
|
}
|
|
catch (err) {
|
|
}
|
|
},
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief tear down
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
tearDown : function () {
|
|
try {
|
|
users.remove("hackers@arangodb.com");
|
|
}
|
|
catch (err) {
|
|
}
|
|
},
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief test creating a new user
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
testNewUser : function () {
|
|
users.save("hackers@arangodb.com", "foobar");
|
|
users.grantDatabase('hackers@arangodb.com', db._name());
|
|
users.reload();
|
|
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "foobar");
|
|
|
|
// this will issue a request using the new user
|
|
assertTrue(db._collections().length > 0);
|
|
|
|
// double check with wrong passwords
|
|
let isBroken;
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "foobar2");
|
|
}
|
|
catch (err1) {
|
|
isBroken = false;
|
|
}
|
|
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "");
|
|
}
|
|
catch (err2) {
|
|
isBroken = false;
|
|
}
|
|
},
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief test creating a new user with empty password
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
testEmptyPassword : function () {
|
|
users.save("hackers@arangodb.com", "");
|
|
users.grantDatabase('hackers@arangodb.com', db._name());
|
|
users.reload();
|
|
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "");
|
|
|
|
// this will issue a request using the new user
|
|
assertTrue(db._collections().length > 0);
|
|
|
|
// double check with wrong password
|
|
let isBroken;
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "foobar");
|
|
}
|
|
catch (err1) {
|
|
isBroken = false;
|
|
}
|
|
},
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief test creating a new user with case sensitive password
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
testPasswordCase : function () {
|
|
users.save("hackers@arangodb.com", "FooBar");
|
|
users.grantDatabase('hackers@arangodb.com', db._name());
|
|
users.reload();
|
|
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "FooBar");
|
|
|
|
// this will issue a request using the new user
|
|
assertTrue(db._collections().length > 0);
|
|
|
|
// double check with wrong passwords
|
|
let isBroken;
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "Foobar");
|
|
assertTrue(db._collections().length > 0);
|
|
}
|
|
catch (err1) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "foobar");
|
|
}
|
|
catch (err2) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "FOOBAR");
|
|
}
|
|
catch (err3) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
},
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief test creating a new user with colon in password
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
testColon : function () {
|
|
users.save("hackers@arangodb.com", "fuxx::bar");
|
|
users.grantDatabase('hackers@arangodb.com', db._name());
|
|
users.reload();
|
|
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "fuxx::bar");
|
|
|
|
// this will issue a request using the new user
|
|
assertTrue(db._collections().length > 0);
|
|
|
|
// double check with wrong passwords
|
|
let isBroken;
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "fuxx");
|
|
}
|
|
catch (err1) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "bar");
|
|
}
|
|
catch (err2) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "");
|
|
}
|
|
catch (err3) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
},
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief test creating a new user with special chars in password
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
testSpecialChars : function () {
|
|
users.save("hackers@arangodb.com", ":\\abc'def:foobar@04. x-a");
|
|
users.grantDatabase('hackers@arangodb.com', db._name());
|
|
users.reload();
|
|
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", ":\\abc'def:foobar@04. x-a");
|
|
|
|
// this will issue a request using the new user
|
|
assertTrue(db._collections().length > 0);
|
|
|
|
// double check with wrong passwords
|
|
let isBroken;
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "foobar");
|
|
}
|
|
catch (err1) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "\\abc'def: x-a");
|
|
}
|
|
catch (err2) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
|
|
isBroken = true;
|
|
try {
|
|
arango.reconnect(arango.getEndpoint(), db._name(), "hackers@arangodb.com", "");
|
|
}
|
|
catch (err3) {
|
|
isBroken = false;
|
|
}
|
|
if (isBroken) {
|
|
fail();
|
|
}
|
|
},
|
|
|
|
testAuthOpen: function() {
|
|
var res = request(baseUrl() + "/_open/auth");
|
|
expect(res).to.be.a(request.Response);
|
|
// mop: GET is an unsupported method, but it is skipping auth
|
|
expect(res).to.have.property('statusCode', 405);
|
|
},
|
|
|
|
testAuth: function() {
|
|
var res = request.post({
|
|
url: baseUrl() + "/_open/auth",
|
|
body: JSON.stringify({"username": "root", "password": ""})
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 200);
|
|
|
|
expect(res.body).to.be.an('string');
|
|
var obj = JSON.parse(res.body);
|
|
expect(obj).to.have.property('jwt');
|
|
expect(obj).to.have.property('must_change_password');
|
|
expect(obj.jwt).to.be.a('string');
|
|
expect(obj.jwt.split('.').length).to.be(3);
|
|
expect(obj.must_change_password).to.be.a('boolean');
|
|
},
|
|
|
|
testAuthNewUser: function() {
|
|
users.save("hackers@arangodb.com", "foobar");
|
|
users.reload();
|
|
|
|
var res = request.post({
|
|
url: baseUrl() + "/_open/auth",
|
|
body: JSON.stringify({"username": "hackers@arangodb.com", "password": "foobar"})
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 200);
|
|
expect(res.body).to.be.an('string');
|
|
var obj = JSON.parse(res.body);
|
|
expect(obj).to.have.property('jwt');
|
|
expect(obj).to.have.property('must_change_password');
|
|
expect(obj.jwt).to.be.a('string');
|
|
expect(obj.jwt.split('.').length).to.be(3);
|
|
expect(obj.must_change_password).to.be.a('boolean');
|
|
},
|
|
|
|
testAuthNewWrongPassword: function() {
|
|
users.save("hackers@arangodb.com", "foobarJAJA");
|
|
users.reload();
|
|
|
|
var res = request.post({
|
|
url: baseUrl() + "/_open/auth",
|
|
body: JSON.stringify({"username": "hackers@arangodb.com", "password": "foobar"})
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 401);
|
|
},
|
|
|
|
testAuthNoPassword: function() {
|
|
var res = request.post({
|
|
url: baseUrl() + "/_open/auth",
|
|
body: JSON.stringify({"username": "hackers@arangodb.com", "passwordaa": "foobar"}),
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 400);
|
|
},
|
|
|
|
testAuthNoUsername: function() {
|
|
var res = request.post({
|
|
url: baseUrl() + "/_open/auth",
|
|
body: JSON.stringify({"usern": "hackers@arangodb.com", "password": "foobar"}),
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 400);
|
|
},
|
|
|
|
testAuthRequired: function() {
|
|
var res = request.get(baseUrl() + "/_api/version");
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 401);
|
|
},
|
|
|
|
testFullAuthWorkflow: function() {
|
|
var res = request.post({
|
|
url: baseUrl() + "/_open/auth",
|
|
body: JSON.stringify({"username": "root", "password": ""}),
|
|
});
|
|
|
|
var jwt = JSON.parse(res.body).jwt;
|
|
res = request.get({
|
|
url: baseUrl() + "/_api/version",
|
|
auth: {
|
|
bearer: jwt,
|
|
}
|
|
});
|
|
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 200);
|
|
},
|
|
|
|
testViaJS: function() {
|
|
var jwt = crypto.jwtEncode(jwtSecret, {"preferred_username": "root", "iss": "arangodb", "exp": Math.floor(Date.now() / 1000) + 3600}, 'HS256');
|
|
|
|
var res = request.get({
|
|
url: baseUrl() + "/_api/version",
|
|
auth: {
|
|
bearer: jwt,
|
|
}
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 200);
|
|
},
|
|
|
|
testNoneAlgDisabled: function() {
|
|
var jwt = (new Buffer(JSON.stringify({"typ": "JWT","alg": "none"})).toString('base64')) + "." + (new Buffer(JSON.stringify({"preferred_username": "root", "iss": "arangodb"})).toString('base64'));
|
|
// not supported
|
|
var res = request.get({
|
|
url: baseUrl() + "/_api/version",
|
|
auth: {
|
|
bearer: jwt,
|
|
}
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 401);
|
|
},
|
|
|
|
testIssRequired: function() {
|
|
var jwt = crypto.jwtEncode(jwtSecret, {"preferred_username": "root", "exp": Math.floor(Date.now() / 1000) + 3600 }, 'HS256');
|
|
// not supported
|
|
var res = request.get({
|
|
url: baseUrl() + "/_api/version",
|
|
auth: {
|
|
bearer: jwt,
|
|
}
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 401);
|
|
},
|
|
|
|
testIssArangodb: function() {
|
|
var jwt = crypto.jwtEncode(jwtSecret, {"preferred_username": "root", "iss": "arangodbaaa", "exp": Math.floor(Date.now() / 1000) + 3600 }, 'HS256');
|
|
// not supported
|
|
var res = request.get({
|
|
url: baseUrl() + "/_api/version",
|
|
auth: {
|
|
bearer: jwt,
|
|
}
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 401);
|
|
},
|
|
|
|
testExpOptional: function() {
|
|
var jwt = crypto.jwtEncode(jwtSecret, {"preferred_username": "root", "iss": "arangodb" }, 'HS256');
|
|
// not supported
|
|
var res = request.get({
|
|
url: baseUrl() + "/_api/version",
|
|
auth: {
|
|
bearer: jwt,
|
|
}
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 200);
|
|
},
|
|
|
|
testExp: function() {
|
|
var jwt = crypto.jwtEncode(jwtSecret, {"preferred_username": "root", "iss": "arangodbaaa", "exp": Math.floor(Date.now() / 1000) - 1000 }, 'HS256');
|
|
// not supported
|
|
var res = request.get({
|
|
url: baseUrl() + "/_api/version",
|
|
auth: {
|
|
bearer: jwt,
|
|
}
|
|
});
|
|
expect(res).to.be.a(request.Response);
|
|
expect(res).to.have.property('statusCode', 401);
|
|
},
|
|
};
|
|
}
|
|
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
/// @brief executes the test suite
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
jsunity.run(AuthSuite);
|
|
|
|
return jsunity.done();
|
|
|