backend_test.go

// Copyright IBM Corp. 2020, 2025
// SPDX-License-Identifier: MPL-2.0

package openldap

import (
	"context"
	"errors"
	"testing"
	"time"

	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"

	"github.com/hashicorp/vault/sdk/rotation"

	"github.com/go-ldap/ldif"
	log "github.com/hashicorp/go-hclog"
	"github.com/hashicorp/vault-plugin-secrets-openldap/client"
	"github.com/hashicorp/vault/sdk/helper/logging"
	"github.com/hashicorp/vault/sdk/logical"
	"github.com/hashicorp/vault/sdk/queue"
)

var (
	defaultLeaseTTLVal      = time.Hour * 12
	maxLeaseTTLVal          = time.Hour * 24
	testPasswordPolicy1     = "test_policy_1"
	testPasswordPolicy2     = "test_policy_2"
	testPasswordFromPolicy1 = "TestPolicy1Password"
	testPasswordFromPolicy2 = "TestPolicy2Password"
)

type testSystemView struct {
	logical.StaticSystemView
}

func (t testSystemView) RegisterRotationJob(_ context.Context, _ *rotation.RotationJobConfigureRequest) (string, error) {
	return "", automatedrotationutil.ErrRotationManagerUnsupported
}

func (t testSystemView) DeregisterRotationJob(_ context.Context, _ *rotation.RotationJobDeregisterRequest) error {
	return nil
}

// getBackend returns an initialized test backend with InmemStorage
func getBackend(throwsErr bool) (*backend, logical.Storage) {
	b, config := getBackendWithConfig(testBackendConfig(), throwsErr)
	return b, config.StorageView
}

// getBackendWithConfig returns an initialized test backend for the given
// config
func getBackendWithConfig(c *logical.BackendConfig, throwsErr bool) (*backend, *logical.BackendConfig) {
	b := Backend(&fakeLdapClient{throwErrs: throwsErr})
	b.Setup(context.Background(), c)

	b.credRotationQueue = queue.New()
	// Create a context with a cancel method for processing any WAL entries and
	// populating the queue
	initCtx := context.Background()
	ictx, cancel := context.WithCancel(initCtx)
	b.cancelQueue = cancel

	// Load managed LDAP users into memory from storage
	staticRoles, err := b.loadManagedUsers(ictx, c.StorageView)
	if err != nil {
		// TODO: make this fatal? Requires refactoring all tests to pass in a testing.T
		b.Logger().Error("error configuring backend: could not read roles from storage")
	}

	// Load queue and kickoff new periodic ticker
	b.initQueue(ictx, &logical.InitializationRequest{
		Storage: c.StorageView,
	}, staticRoles)

	return b, c
}

// testBackendConfig returns a backend config with inmem storage
func testBackendConfig() *logical.BackendConfig {
	sv := testSystemView{}
	sv.DefaultLeaseTTLVal = defaultLeaseTTLVal
	sv.MaxLeaseTTLVal = maxLeaseTTLVal
	sv.PasswordPolicies = map[string]logical.PasswordGenerator{
		testPasswordPolicy1: func() (string, error) {
			return testPasswordFromPolicy1, nil
		},
		testPasswordPolicy2: func() (string, error) {
			return testPasswordFromPolicy2, nil
		},
	}

	return &logical.BackendConfig{
		Logger:      logging.NewVaultLogger(log.Debug),
		System:      sv,
		StorageView: &logical.InmemStorage{},
	}
}

var _ ldapClient = (*fakeLdapClient)(nil)

type fakeLdapClient struct {
	throwErrs bool
}

func (f *fakeLdapClient) UpdateUserPassword(_ *client.Config, _ string, _ string) error {
	var err error
	if f.throwErrs {
		err = errors.New("forced error")
	}
	return err
}

func (f *fakeLdapClient) UpdateDNPassword(_ *client.Config, _ string, _ string) error {
	var err error
	if f.throwErrs {
		err = errors.New("forced error")
	}
	return err
}

func (f *fakeLdapClient) Execute(_ *client.Config, _ []*ldif.Entry, _ bool) error {
	var err error
	if f.throwErrs {
		err = errors.New("forced error")
	}
	return err
}

// TestBackend_Events_Config tests that config operations emit the correct events
func TestBackend_Events_Config(t *testing.T) {
	// Create backend config with event sender
	config := testBackendConfig()
	eventSender := logical.NewMockEventSender()
	config.EventsSender = eventSender

	b, _ := getBackendWithConfig(config, false)

	// Create config
	configData := map[string]interface{}{
		"binddn":       "cn=admin,dc=example,dc=org",
		"bindpass":     "admin-password",
		"url":          "ldap://localhost:389",
		"schema":       "openldap",
		"userattr":     "cn",
		"userdn":       "ou=users,dc=example,dc=org",
		"certificate":  "",
		"insecure_tls": true,
		"starttls":     false,
	}

	req := &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "config",
		Storage:   config.StorageView,
		Data:      configData,
	}

	resp, err := b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Update config
	configData["userattr"] = "uid"
	req.Operation = logical.UpdateOperation

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Delete config
	req = &logical.Request{
		Operation: logical.DeleteOperation,
		Path:      "config",
		Storage:   config.StorageView,
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Verify events
	if len(eventSender.Events) != 3 {
		t.Fatalf("expected 3 events, got %d", len(eventSender.Events))
	}

	if string(eventSender.Events[0].Type) != "ldap/config-write" {
		t.Errorf("expected event type ldap/config-write, got %s", eventSender.Events[0].Type)
	}
	if eventSender.Events[0].Event.Metadata.AsMap()["path"] != "config" {
		t.Errorf("expected path config, got %s", eventSender.Events[0].Event.Metadata.AsMap()["path"])
	}
	if eventSender.Events[0].Event.Metadata.AsMap()["modified"] != "true" {
		t.Errorf("expected modified true, got %s", eventSender.Events[0].Event.Metadata.AsMap()["modified"])
	}

	if string(eventSender.Events[1].Type) != "ldap/config-write" {
		t.Errorf("expected event type ldap/config-write, got %s", eventSender.Events[1].Type)
	}

	if string(eventSender.Events[2].Type) != "ldap/config-delete" {
		t.Errorf("expected event type ldap/config-delete, got %s", eventSender.Events[2].Type)
	}
}

// TestBackend_Events_StaticRole tests that static role operations emit the correct events
func TestBackend_Events_StaticRole(t *testing.T) {
	// Create backend config with event sender
	config := testBackendConfig()
	eventSender := logical.NewMockEventSender()
	config.EventsSender = eventSender

	b, _ := getBackendWithConfig(config, false)

	// Create config first
	configData := map[string]interface{}{
		"binddn":       "cn=admin,dc=example,dc=org",
		"bindpass":     "admin-password",
		"url":          "ldap://localhost:389",
		"schema":       "openldap",
		"userattr":     "cn",
		"userdn":       "ou=users,dc=example,dc=org",
		"insecure_tls": true,
	}

	req := &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "config",
		Storage:   config.StorageView,
		Data:      configData,
	}

	resp, err := b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Clear events from config creation
	eventSender.Events = nil

	// Create static role
	roleData := map[string]interface{}{
		"username":             "testuser",
		"dn":                   "cn=testuser,ou=users,dc=example,dc=org",
		"rotation_period":      "24h",
		"skip_import_rotation": true,
	}

	req = &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "static-role/testrole",
		Storage:   config.StorageView,
		Data:      roleData,
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Update static role
	roleData["rotation_period"] = "48h"
	delete(roleData, "skip_import_rotation") // Remove this field as it causes an error on updates
	req.Operation = logical.UpdateOperation
	req.Data = roleData

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Delete static role
	req = &logical.Request{
		Operation: logical.DeleteOperation,
		Path:      "static-role/testrole",
		Storage:   config.StorageView,
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Verify events
	if len(eventSender.Events) != 3 {
		t.Fatalf("expected 3 events, got %d", len(eventSender.Events))
	}

	if string(eventSender.Events[0].Type) != "ldap/static-role-create" {
		t.Errorf("expected event type ldap/static-role-create, got %s", eventSender.Events[0].Type)
	}
	if eventSender.Events[0].Event.Metadata.AsMap()["name"] != "testrole" {
		t.Errorf("expected name testrole, got %s", eventSender.Events[0].Event.Metadata.AsMap()["name"])
	}

	if string(eventSender.Events[1].Type) != "ldap/static-role-update" {
		t.Errorf("expected event type ldap/static-role-update, got %s", eventSender.Events[1].Type)
	}

	if string(eventSender.Events[2].Type) != "ldap/static-role-delete" {
		t.Errorf("expected event type ldap/static-role-delete, got %s", eventSender.Events[2].Type)
	}
}

// TestBackend_Events_DynamicRole tests that dynamic role operations emit the correct events
func TestBackend_Events_DynamicRole(t *testing.T) {
	// Create backend config with event sender
	config := testBackendConfig()
	eventSender := logical.NewMockEventSender()
	config.EventsSender = eventSender

	b, _ := getBackendWithConfig(config, false)

	// Create dynamic role
	roleData := map[string]interface{}{
		"creation_ldif": `dn: cn={{.Username}},ou=users,dc=example,dc=org
objectClass: person
objectClass: top
cn: {{.Username}}
sn: {{.Username}}
userPassword: {{.Password}}`,
		"deletion_ldif": `dn: cn={{.Username}},ou=users,dc=example,dc=org
changetype: delete`,
		"rollback_ldif": "",
		"default_ttl":   "1h",
		"max_ttl":       "24h",
	}

	req := &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "role/testrole",
		Storage:   config.StorageView,
		Data:      roleData,
	}

	resp, err := b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Update dynamic role
	roleData["default_ttl"] = "2h"
	req.Operation = logical.UpdateOperation

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Delete dynamic role
	req = &logical.Request{
		Operation: logical.DeleteOperation,
		Path:      "role/testrole",
		Storage:   config.StorageView,
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Verify events
	if len(eventSender.Events) != 3 {
		t.Fatalf("expected 3 events, got %d", len(eventSender.Events))
	}

	if string(eventSender.Events[0].Type) != "ldap/role-create" {
		t.Errorf("expected event type ldap/role-create, got %s", eventSender.Events[0].Type)
	}
	if eventSender.Events[0].Event.Metadata.AsMap()["name"] != "testrole" {
		t.Errorf("expected name testrole, got %s", eventSender.Events[0].Event.Metadata.AsMap()["name"])
	}

	if string(eventSender.Events[1].Type) != "ldap/role-update" {
		t.Errorf("expected event type ldap/role-update, got %s", eventSender.Events[1].Type)
	}

	if string(eventSender.Events[2].Type) != "ldap/role-delete" {
		t.Errorf("expected event type ldap/role-delete, got %s", eventSender.Events[2].Type)
	}
}

// TestBackend_Events_LibrarySet tests that library set operations emit the correct events
func TestBackend_Events_LibrarySet(t *testing.T) {
	// Create backend config with event sender
	config := testBackendConfig()
	eventSender := logical.NewMockEventSender()
	config.EventsSender = eventSender

	b, _ := getBackendWithConfig(config, false)

	// Create config first
	configData := map[string]interface{}{
		"binddn":       "cn=admin,dc=example,dc=org",
		"bindpass":     "admin-password",
		"url":          "ldap://localhost:389",
		"schema":       "openldap",
		"userattr":     "cn",
		"userdn":       "ou=users,dc=example,dc=org",
		"insecure_tls": true,
	}

	req := &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "config",
		Storage:   config.StorageView,
		Data:      configData,
	}

	resp, err := b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Clear events from config creation
	eventSender.Events = nil

	// Create library set
	setData := map[string]interface{}{
		"service_account_names": []string{"testaccount1", "testaccount2"},
		"ttl":                   86400,
		"max_ttl":               86400,
	}

	req = &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "library/testset",
		Storage:   config.StorageView,
		Data:      setData,
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Update library set
	setData["max_ttl"] = 172800
	req.Operation = logical.UpdateOperation
	req.Data = setData

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Delete library set
	req = &logical.Request{
		Operation: logical.DeleteOperation,
		Path:      "library/testset",
		Storage:   config.StorageView,
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Verify events
	if len(eventSender.Events) != 3 {
		t.Fatalf("expected 3 events, got %d", len(eventSender.Events))
	}

	if string(eventSender.Events[0].Type) != "ldap/library-create" {
		t.Errorf("expected event type ldap/library-create, got %s", eventSender.Events[0].Type)
	}
	if eventSender.Events[0].Event.Metadata.AsMap()["name"] != "testset" {
		t.Errorf("expected name testset, got %s", eventSender.Events[0].Event.Metadata.AsMap()["name"])
	}

	if string(eventSender.Events[1].Type) != "ldap/library-update" {
		t.Errorf("expected event type ldap/library-update, got %s", eventSender.Events[1].Type)
	}

	if string(eventSender.Events[2].Type) != "ldap/library-delete" {
		t.Errorf("expected event type ldap/library-delete, got %s", eventSender.Events[2].Type)
	}
}

// TestBackend_Events_CheckOutCheckIn tests that check-out and check-in operations emit the correct events
func TestBackend_Events_CheckOutCheckIn(t *testing.T) {
	// Create backend config with event sender
	config := testBackendConfig()
	eventSender := logical.NewMockEventSender()
	config.EventsSender = eventSender

	b, _ := getBackendWithConfig(config, false)

	// Create config first
	configData := map[string]interface{}{
		"binddn":       "cn=admin,dc=example,dc=org",
		"bindpass":     "admin-password",
		"url":          "ldap://localhost:389",
		"schema":       "openldap",
		"userattr":     "cn",
		"userdn":       "ou=users,dc=example,dc=org",
		"insecure_tls": true,
	}

	req := &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "config",
		Storage:   config.StorageView,
		Data:      configData,
	}

	resp, err := b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Create library set
	setData := map[string]interface{}{
		"service_account_names": []string{"testaccount1", "testaccount2"},
		"ttl":                   86400,
		"max_ttl":               86400,
	}

	req = &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "library/testset",
		Storage:   config.StorageView,
		Data:      setData,
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Clear events from config and set creation
	eventSender.Events = nil

	// Check out a service account
	req = &logical.Request{
		Operation:   logical.UpdateOperation,
		Path:        "library/testset/check-out",
		Storage:     config.StorageView,
		EntityID:    "test-entity-id",
		ClientToken: "test-token",
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}
	if resp == nil || resp.Secret == nil {
		t.Fatal("expected secret in response")
	}

	// Verify check-out event
	if len(eventSender.Events) != 1 {
		t.Fatalf("expected 1 event after library-check-out, got %d", len(eventSender.Events))
	}

	if string(eventSender.Events[0].Type) != "ldap/library-check-out" {
		t.Errorf("expected event type ldap/library-check-out, got %s", eventSender.Events[0].Type)
	}
	if eventSender.Events[0].Event.Metadata.AsMap()["name"] != "testset" {
		t.Errorf("expected name testset, got %s", eventSender.Events[0].Event.Metadata.AsMap()["name"])
	}

	// Check in the service account
	req = &logical.Request{
		Operation:   logical.UpdateOperation,
		Path:        "library/testset/check-in",
		Storage:     config.StorageView,
		EntityID:    "test-entity-id",
		ClientToken: "test-token",
	}

	resp, err = b.HandleRequest(context.Background(), req)
	if err != nil {
		t.Fatalf("err:%s resp:%#v\n", err, resp)
	}

	// Verify check-in event
	if len(eventSender.Events) != 2 {
		t.Fatalf("expected 2 events after library-check-in, got %d", len(eventSender.Events))
	}

	if string(eventSender.Events[1].Type) != "ldap/library-check-in" {
		t.Errorf("expected event type ldap/library-check-in, got %s", eventSender.Events[1].Type)
	}
	if eventSender.Events[1].Event.Metadata.AsMap()["name"] != "testset" {
		t.Errorf("expected name testset, got %s", eventSender.Events[1].Event.Metadata.AsMap()["name"])
	}
}

const validCertificate = `
-----BEGIN CERTIFICATE-----
MIIF7zCCA9egAwIBAgIJAOY2qjn64Qq5MA0GCSqGSIb3DQEBCwUAMIGNMQswCQYD
VQQGEwJVUzEQMA4GA1UECAwHTm93aGVyZTERMA8GA1UEBwwIVGltYnVrdHUxEjAQ
BgNVBAoMCVRlc3QgRmFrZTENMAsGA1UECwwETm9uZTEPMA0GA1UEAwwGTm9ib2R5
MSUwIwYJKoZIhvcNAQkBFhZkb25vdHRydXN0QG5vd2hlcmUuY29tMB4XDTE4MDQw
MzIwNDQwOFoXDTE5MDQwMzIwNDQwOFowgY0xCzAJBgNVBAYTAlVTMRAwDgYDVQQI
DAdOb3doZXJlMREwDwYDVQQHDAhUaW1idWt0dTESMBAGA1UECgwJVGVzdCBGYWtl
MQ0wCwYDVQQLDAROb25lMQ8wDQYDVQQDDAZOb2JvZHkxJTAjBgkqhkiG9w0BCQEW
FmRvbm90dHJ1c3RAbm93aGVyZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDzQPGErqjaoFcuUV6QFpSMU6w8wO8F0othik+rrlKERmrGonUGsoum
WqRe6L4ZnxBvCKB6EWjvf894TXOF2cpUnjDAyBePISyPkRBEJS6VS2SEC4AJzmVu
a+P+fZr4Hf7/bEcUr7Ax37yGVZ5i5ByNHgZkBlPxKiGWSmAqIDRZLp9gbu2EkG9q
NOjNLPU+QI2ov6U/laGS1vbE2LahTYeT5yscu9LpllxzFv4lM1f4wYEaM3HuOxzT
l86cGmEr9Q2N4PZ2T0O/s6D4but7c6Bz2XPXy9nWb5bqu0n5bJEpbRFrkryW1ozh
L9uVVz4dyW10pFBJtE42bqA4PRCDQsUof7UfsQF11D1ThrDfKsQa8PxrYdGUHUG9
GFF1MdTTwaoT90RI582p+6XYV+LNlXcdfyNZO9bMThu9fnCvT7Ey0TKU4MfPrlfT
aIhZmyaHt6mL5p881UPDIvy7paTLgL+C1orLjZAiT//c4Zn+0qG0//Cirxr020UF
3YiEFk2H0bBVwOHoOGw4w5HrvLdyy0ZLDSPQbzkSZ0RusHb5TjiyhtTk/h9vvJv7
u1fKJub4MzgrBRi16ejFdiWoVuMXRC6fu/ERy3+9DH6LURerbPrdroYypUmTe9N6
XPeaF1Tc+WO7O/yW96mV7X/D211qjkOtwboZC5kjogVbaZgGzjHCVwIDAQABo1Aw
TjAdBgNVHQ4EFgQU2zWT3HeiMBzusz7AggVqVEL5g0UwHwYDVR0jBBgwFoAU2zWT
3HeiMBzusz7AggVqVEL5g0UwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
AgEAwTGcppY86mNRE43uOimeApTfqHJv+lGDTjEoJCZZmzmtxFe6O9+Vk4bH/8/i
gVQvqzBpaWXRt9OhqlFMK7OkX4ZvqXmnShmxib1dz1XxGhbwSec9ca8bill59Jqa
bIOq2SXVMcFD0GwFxfJRBVzHHuB6AwV9B2QN61zeB1oxNGJrUOo80jVkB7+MWMyD
bQqiFCHWGMa6BG4N91KGOTveZCGdBvvVw5j6lt731KjbvL2hB1UHioucOweKLfa4
QWDImTEjgV68699wKERNL0DCpeD7PcP/L3SY2RJzdyC1CSR7O8yU4lQK7uZGusgB
Mgup+yUaSjxasIqYMebNDDocr5kdwG0+2r2gQdRwc5zLX6YDBn6NLSWjRnY04ZuK
P1cF68rWteWpzJu8bmkJ5r2cqskqrnVK+zz8xMQyEaj548Bnt51ARLHOftR9jkSU
NJWh7zOLZ1r2UUKdDlrMoh3GQO3rvnCJJ16NBM1dB7TUyhMhtF6UOE62BSKdHtQn
d6TqelcRw9WnDsb9IPxRwaXhvGljnYVAgXXlJEI/6nxj2T4wdmL1LWAr6C7DuWGz
8qIvxc4oAau4DsZs2+BwolCFtYc98OjWGcBStBfZz/YYXM+2hKjbONKFxWdEPxGR
Beq3QOqp2+dga36IzQybzPQ8QtotrpSJ3q82zztEvyWiJ7E=
-----END CERTIFICATE-----
`