Merge branch 'master' into issue_3508issue_3508

1 files changed, 67 insertions, 99 deletions

diff --git a/spec/lib/gitlab/saml/user_spec.rb b/spec/lib/gitlab/saml/user_spec.rb
index de7cd99d49d..c2a51d9249c 100644
--- a/spec/lib/gitlab/saml/user_spec.rb
+++ b/spec/lib/gitlab/saml/user_spec.rb
@@ -5,7 +5,7 @@ describe Gitlab::Saml::User, lib: true do
   let(:gl_user) { saml_user.gl_user }
   let(:uid) { 'my-uid' }
   let(:provider) { 'saml' }
-  let(:auth_hash) { OmniAuth::AuthHash.new(uid: uid, provider: provider, info: info_hash) }
+  let(:auth_hash) { OmniAuth::AuthHash.new(uid: uid, provider: provider, info: info_hash, extra: { raw_info: OneLogin::RubySaml::Attributes.new({ 'groups' => %w(Developers Freelancers Designers) }) }) }
   let(:info_hash) do
     {
       name: 'John',
@@ -23,10 +23,20 @@ describe Gitlab::Saml::User, lib: true do
       allow(Gitlab::LDAP::Config).to receive_messages(messages)
     end
 
+    def stub_basic_saml_config
+      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', args: {} } })
+    end
+
+    def stub_saml_group_config(groups)
+      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', external_groups: groups, args: {} } })
+    end
+
+    before { stub_basic_saml_config }
+
     describe 'account exists on server' do
       before { stub_omniauth_config({ allow_single_sign_on: ['saml'], auto_link_saml_user: true }) }
+      let!(:existing_user) { create(:user, email: 'john@mail.com', username: 'john') }
       context 'and should bind with SAML' do
-        let!(:existing_user) { create(:user, email: 'john@mail.com', username: 'john') }
         it 'adds the SAML identity to the existing user' do
           saml_user.save
           expect(gl_user).to be_valid
@@ -36,6 +46,35 @@ describe Gitlab::Saml::User, lib: true do
           expect(identity.provider).to eql 'saml'
         end
       end
+
+      context 'external groups' do
+        context 'are defined' do
+          it 'marks the user as external' do
+            stub_saml_group_config(%w(Freelancers))
+            saml_user.save
+            expect(gl_user).to be_valid
+            expect(gl_user.external).to be_truthy
+          end
+        end
+
+        before { stub_saml_group_config(%w(Interns)) }
+        context 'are defined but the user does not belong there' do
+          it 'does not mark the user as external' do
+            saml_user.save
+            expect(gl_user).to be_valid
+            expect(gl_user.external).to be_falsey
+          end
+        end
+
+        context 'user was external, now should not be' do
+          it 'should make user internal' do
+            existing_user.update_attribute('external', true)
+            saml_user.save
+            expect(gl_user).to be_valid
+            expect(gl_user.external).to be_falsey
+          end
+        end
+      end
     end
 
     describe 'no account exists on server' do
@@ -68,6 +107,26 @@ describe Gitlab::Saml::User, lib: true do
         end
       end
 
+      context 'external groups' do
+        context 'are defined' do
+          it 'marks the user as external' do
+            stub_saml_group_config(%w(Freelancers))
+            saml_user.save
+            expect(gl_user).to be_valid
+            expect(gl_user.external).to be_truthy
+          end
+        end
+
+        context 'are defined but the user does not belong there' do
+          it 'does not mark the user as external' do
+            stub_saml_group_config(%w(Interns))
+            saml_user.save
+            expect(gl_user).to be_valid
+            expect(gl_user.external).to be_falsey
+          end
+        end
+      end
+
       context 'with auto_link_ldap_user disabled (default)' do
         before { stub_omniauth_config({ auto_link_ldap_user: false, auto_link_saml_user: false, allow_single_sign_on: ['saml'] }) }
         include_examples 'to verify compliance with allow_single_sign_on'
@@ -76,12 +135,6 @@ describe Gitlab::Saml::User, lib: true do
       context 'with auto_link_ldap_user enabled' do
         before { stub_omniauth_config({ auto_link_ldap_user: true, auto_link_saml_user: false }) }
 
-        context 'and no LDAP provider defined' do
-          before { stub_ldap_config(providers: []) }
-
-          include_examples 'to verify compliance with allow_single_sign_on'
-        end
-
         context 'and at least one LDAP provider is defined' do
           before { stub_ldap_config(providers: %w(ldapmain)) }
 
@@ -89,19 +142,18 @@ describe Gitlab::Saml::User, lib: true do
             before do
               allow(ldap_user).to receive(:uid) { uid }
               allow(ldap_user).to receive(:username) { uid }
-              allow(ldap_user).to receive(:email) { ['johndoe@example.com','john2@example.com'] }
+              allow(ldap_user).to receive(:email) { %w(john@mail.com john2@example.com) }
               allow(ldap_user).to receive(:dn) { 'uid=user1,ou=People,dc=example' }
               allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
             end
 
             context 'and no account for the LDAP user' do
-
               it 'creates a user with dual LDAP and SAML identities' do
                 saml_user.save
 
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql uid
-                expect(gl_user.email).to eql 'johndoe@example.com'
+                expect(gl_user.email).to eql 'john@mail.com'
                 expect(gl_user.identities.length).to eql 2
                 identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
                 expect(identities_as_hash).to match_array([ { provider: 'ldapmain', extern_uid: 'uid=user1,ou=People,dc=example' },
@@ -111,13 +163,13 @@ describe Gitlab::Saml::User, lib: true do
             end
 
             context 'and LDAP user has an account already' do
-              let!(:existing_user) { create(:omniauth_user, email: 'john@example.com', extern_uid: 'uid=user1,ou=People,dc=example', provider: 'ldapmain', username: 'john') }
-              it "adds the omniauth identity to the LDAP account" do
+              let!(:existing_user) { create(:omniauth_user, email: 'john@mail.com', extern_uid: 'uid=user1,ou=People,dc=example', provider: 'ldapmain', username: 'john') }
+              it 'adds the omniauth identity to the LDAP account' do
                 saml_user.save
 
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql 'john'
-                expect(gl_user.email).to eql 'john@example.com'
+                expect(gl_user.email).to eql 'john@mail.com'
                 expect(gl_user.identities.length).to eql 2
                 identities_as_hash = gl_user.identities.map { |id| { provider: id.provider, extern_uid: id.extern_uid } }
                 expect(identities_as_hash).to match_array([ { provider: 'ldapmain', extern_uid: 'uid=user1,ou=People,dc=example' },
@@ -126,19 +178,13 @@ describe Gitlab::Saml::User, lib: true do
               end
             end
           end
-
-          context 'and no corresponding LDAP person' do
-            before { allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(nil) }
-
-            include_examples 'to verify compliance with allow_single_sign_on'
-          end
         end
       end
 
     end
 
     describe 'blocking' do
-      before { stub_omniauth_config({ allow_saml_sign_up: true, auto_link_saml_user: true }) }
+      before { stub_omniauth_config({ allow_single_sign_on: ['saml'], auto_link_saml_user: true }) }
 
       context 'signup with SAML only' do
         context 'dont block on create' do
@@ -162,64 +208,6 @@ describe Gitlab::Saml::User, lib: true do
         end
       end
 
-      context 'signup with linked omniauth and LDAP account' do
-        before do
-          stub_omniauth_config(auto_link_ldap_user: true)
-          allow(ldap_user).to receive(:uid) { uid }
-          allow(ldap_user).to receive(:username) { uid }
-          allow(ldap_user).to receive(:email) { ['johndoe@example.com','john2@example.com'] }
-          allow(ldap_user).to receive(:dn) { 'uid=user1,ou=People,dc=example' }
-          allow(saml_user).to receive(:ldap_person).and_return(ldap_user)
-        end
-
-        context "and no account for the LDAP user" do
-          context 'dont block on create (LDAP)' do
-            before { allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: false) }
-
-            it do
-              saml_user.save
-              expect(gl_user).to be_valid
-              expect(gl_user).not_to be_blocked
-            end
-          end
-
-          context 'block on create (LDAP)' do
-            before { allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: true) }
-
-            it do
-              saml_user.save
-              expect(gl_user).to be_valid
-              expect(gl_user).to be_blocked
-            end
-          end
-        end
-
-        context 'and LDAP user has an account already' do
-          let!(:existing_user) { create(:omniauth_user, email: 'john@example.com', extern_uid: 'uid=user1,ou=People,dc=example', provider: 'ldapmain', username: 'john') }
-
-          context 'dont block on create (LDAP)' do
-            before { allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: false) }
-
-            it do
-              saml_user.save
-              expect(gl_user).to be_valid
-              expect(gl_user).not_to be_blocked
-            end
-          end
-
-          context 'block on create (LDAP)' do
-            before { allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: true) }
-
-            it do
-              saml_user.save
-              expect(gl_user).to be_valid
-              expect(gl_user).not_to be_blocked
-            end
-          end
-        end
-      end
-
-
       context 'sign-in' do
         before do
           saml_user.save
@@ -245,26 +233,6 @@ describe Gitlab::Saml::User, lib: true do
             expect(gl_user).not_to be_blocked
           end
         end
-
-        context 'dont block on create (LDAP)' do
-          before { allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: false) }
-
-          it do
-            saml_user.save
-            expect(gl_user).to be_valid
-            expect(gl_user).not_to be_blocked
-          end
-        end
-
-        context 'block on create (LDAP)' do
-          before { allow_any_instance_of(Gitlab::LDAP::Config).to receive_messages(block_auto_created_users: true) }
-
-          it do
-            saml_user.save
-            expect(gl_user).to be_valid
-            expect(gl_user).not_to be_blocked
-          end
-        end
       end
     end
   end