Fix authentication security hole with external providers

James Moger

2014-03-18 b4a63aad7f56486c164a15ae2477bcd251b0bb1b

 src/test/java/com/gitblit/tests/LdapAuthenticationTest.java

@@ -32,6 +32,7 @@
import com.gitblit.IStoredSettings;
import com.gitblit.Keys;
import com.gitblit.auth.LdapAuthProvider;
import com.gitblit.manager.AuthenticationManager;
import com.gitblit.manager.IUserManager;
import com.gitblit.manager.RuntimeManager;
import com.gitblit.manager.UserManager;
@@ -68,6 +69,8 @@

   private IUserManager userManager;

   private AuthenticationManager auth;

   private MemorySettings settings;

   @BeforeClass
@@ -89,6 +92,7 @@
      FileUtils.copyFile(new File(RESOURCE_DIR + "users.conf"), usersConf);
      settings = getSettings();
      ldap = newLdapAuthentication(settings);
      auth = newAuthenticationManager(settings);
   }

   private LdapAuthProvider newLdapAuthentication(IStoredSettings settings) {
@@ -97,6 +101,13 @@
      LdapAuthProvider ldap = new LdapAuthProvider();
      ldap.setup(runtime, userManager);
      return ldap;
   }
	
   private AuthenticationManager newAuthenticationManager(IStoredSettings settings) {
      RuntimeManager runtime = new RuntimeManager(settings, GitBlitSuite.BASEFOLDER).start();
      AuthenticationManager auth = new AuthenticationManager(runtime, userManager);
      auth.addAuthenticationProvider(newLdapAuthentication(settings));
      return auth;
   }

   private MemorySettings getSettings() {
@@ -223,6 +234,31 @@
      assertEquals("Number of ldap groups in gitblit team model", 1, countLdapTeamsInUserManager());
   }

   @Test
   public void testAuthenticationManager() {
      UserModel userOneModel = auth.authenticate("UserOne", "userOnePassword".toCharArray());
      assertNotNull(userOneModel);
      assertNotNull(userOneModel.getTeam("git_admins"));
      assertNotNull(userOneModel.getTeam("git_users"));
      assertTrue(userOneModel.canAdmin);

      UserModel userOneModelFailedAuth = auth.authenticate("UserOne", "userTwoPassword".toCharArray());
      assertNull(userOneModelFailedAuth);

      UserModel userTwoModel = auth.authenticate("UserTwo", "userTwoPassword".toCharArray());
      assertNotNull(userTwoModel);
      assertNotNull(userTwoModel.getTeam("git_users"));
      assertNull(userTwoModel.getTeam("git_admins"));
      assertNotNull(userTwoModel.getTeam("git admins"));
      assertTrue(userTwoModel.canAdmin);

      UserModel userThreeModel = auth.authenticate("UserThree", "userThreePassword".toCharArray());
      assertNotNull(userThreeModel);
      assertNotNull(userThreeModel.getTeam("git_users"));
      assertNull(userThreeModel.getTeam("git_admins"));
      assertTrue(userThreeModel.canAdmin);
   }

   private int countLdapUsersInUserManager() {
      int ldapAccountCount = 0;
      for (UserModel userModel : userManager.getAllUsers()) {