如何在 spring 中测试 LDAP 安全配置？

Question

How can I write a test for an ldap security configuration in spring-boot ?

The authentication manager validates first that the user initials are present in ldap, and that the found user is memberOf any group set for the user filter.

Question: How could I mock the ldap response at all? Eg I want to return a user with memberOf=CN=Team-INVALID that should not be authentication in the scope of a test. And I want to return a user that matches the userSearchFilter of course.

But which class do I have to mock for this test?

@Configuration
@Order(1)
@EnableWebSecurity
public class LdapSecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.ldapAuthentication()
            .userSearchFilter("(&(initials={0})(|" +
                    "(memberOf=CN=TEAM-1,OU=Intern,DC=my-company)" +
                    "(memberOf=CN=TEAM-2,OU=Intern,DC=my-company)" +
                    "))")
            .contextSource()
            .url(ldapUrl + ldapBase)
            .managerDn(ldapUsername)
            .managerPassword(ldapPassword);
    }
}

Answer 1

You can define an embedded LDAP server with an LDIF file for your tests, like this:

spring.ldap.embedded.ldif=classpath:test-server.ldif
spring.ldap.embedded.base-dn=dc=springframework,dc=org
spring.ldap.embedded.port=8389

And in your tests you can try to authenticate that specific user like you would do in a normal flow:

@SpringBootTest
@AutoConfigureMockMvc
@TestPropertySource(properties = {
        "spring.ldap.embedded.ldif=classpath:test-server.ldif",
        "spring.ldap.embedded.base-dn=${spring.ldap.base}",
        "spring.ldap.embedded.port=8389",
        "spring.ldap.embedded.url=ldap://localhost:8389/",
        "spring.ldap.embedded.credential.username=uid=admin",
        "spring.ldap.embedded.credential.password=secret",
        "spring.ldap.embedded.validation.enabled=false",
        "spring.ldap.urls=ldap://localhost:8389/",
        "spring.ldap.username=uid=admin",
        "spring.ldap.password=secret"})
public class AuthenticatingLdapApplicationTests {
    @Autowired
    private MockMvc mockMvc;

    @Test
    public void loginWithValidUserThenAuthenticated() throws Exception {
        FormLoginRequestBuilder login = formLogin()
            .user("user")
            .password("userpassword");

        mockMvc.perform(login)
            .andExpect(authenticated().withUsername("user"));
    }

    @Test
    public void loginWithInvalidUserThenUnauthenticated() throws Exception {
        FormLoginRequestBuilder login = formLogin()
            .user("invalid")
            .password("invalidpassword");

        mockMvc.perform(login)
            .andExpect(unauthenticated());
    }
}

I found this example in the Authenticating with LDAP Guide . You can refer to it for more details

Required dependency:

<dependency>
    <groupId>com.unboundid</groupId>
    <artifactId>unboundid-ldapsdk</artifactId>
    <version>5.1.4</version>
    <scope>test</scope>
</dependency>