coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Map explicit tenant groups into OIDC claims
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 26s
Details

Browse source
This commit is contained in:
tegwick 2026-07-28 00:34:19 +02:00
parent 993a4dd589
commit e8b4eded88
3 changed files with 96 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

48
src/internal/adapters/lldap/adapter_test.go
View file

@ -119,6 +119,54 @@ func TestLookupUser_Success(t *testing.T) {
}
}
func TestLookupUser_MapsExplicitTenantAdminGroup(t *testing.T) {
conn := &mockConn{
searchFn: func(req *ldap.SearchRequest) (*ldap.SearchResult, error) {
return singleEntryResult(
"uid=bernd,ou=people,dc=test,dc=local",
"bernd", "Bernd", "Worsch", "bernd.worsch@binky-hedgehog.com",
[]string{
"cn=tenant:friendly:binky:users,ou=groups,dc=test,dc=local",
"cn=tenant:friendly:binky:admins,ou=groups,dc=test,dc=local",
},
), nil
},
}
adapter := makeAdapter(testConfig(), conn)
user, err := adapter.LookupUser(context.Background(), "bernd")
if err != nil {
t.Fatal(err)
}
if user.Tenant != "tenant:friendly:binky" {
t.Fatalf("tenant = %q", user.Tenant)
}
if len(user.Roles) != 2 || user.Roles[1] != "tenant-admin" {
t.Fatalf("roles = %v", user.Roles)
}
}
func TestLookupUser_IgnoresAmbiguousTenantGroups(t *testing.T) {
conn := &mockConn{
searchFn: func(req *ldap.SearchRequest) (*ldap.SearchResult, error) {
return singleEntryResult(
"uid=multi,ou=people,dc=test,dc=local",
"multi", "Multi", "Tenant", "multi@example.test",
[]string{
"cn=tenant:friendly:binky:users,ou=groups,dc=test,dc=local",
"cn=tenant:coulomb:users,ou=groups,dc=test,dc=local",
},
), nil
},
}
user, err := makeAdapter(testConfig(), conn).LookupUser(context.Background(), "multi")
if err != nil {
t.Fatal(err)
}
if user.Tenant != "" || len(user.Roles) != 0 {
t.Fatalf("ambiguous envelope must be empty, got tenant=%q roles=%v", user.Tenant, user.Roles)
}
}
func TestLookupUser_DisplayName_FallsBackToSN(t *testing.T) {
dn := "uid=bob,ou=users,dc=netkingdom,dc=local"
conn := &mockConn{