Jeff Mitchell
22462cdd84
* Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed. * Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing. * Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.
59 lines
1.8 KiB
Go
59 lines
1.8 KiB
Go
package controller_test
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/hashicorp/boundary/api/authmethods"
|
|
"github.com/hashicorp/boundary/api/scopes"
|
|
"github.com/hashicorp/boundary/internal/servers/controller"
|
|
"github.com/hashicorp/boundary/internal/types/scope"
|
|
"github.com/hashicorp/go-hclog"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAuthenticationMulti(t *testing.T) {
|
|
assert, require := assert.New(t), require.New(t)
|
|
logger := hclog.New(&hclog.LoggerOptions{
|
|
Level: hclog.Trace,
|
|
})
|
|
|
|
c1 := controller.NewTestController(t, &controller.TestControllerOpts{
|
|
Logger: logger.Named("c1"),
|
|
})
|
|
defer c1.Shutdown()
|
|
|
|
c2 := c1.AddClusterControllerMember(t, &controller.TestControllerOpts{
|
|
Logger: logger.Named("c2"),
|
|
})
|
|
defer c2.Shutdown()
|
|
|
|
auth := authmethods.NewClient(c1.Client())
|
|
token1Result, err := auth.Authenticate(c1.Context(), c1.Server().DevAuthMethodId, map[string]interface{}{"login_name": c1.Server().DevLoginName, "password": c1.Server().DevPassword})
|
|
require.Nil(err)
|
|
token1 := token1Result.Item
|
|
require.NotNil(token1)
|
|
|
|
time.Sleep(5 * time.Second)
|
|
auth = authmethods.NewClient(c2.Client())
|
|
token2Result, err := auth.Authenticate(c2.Context(), c2.Server().DevAuthMethodId, map[string]interface{}{"login_name": c2.Server().DevLoginName, "password": c2.Server().DevPassword})
|
|
require.Nil(err)
|
|
token2 := token2Result.Item
|
|
require.NotNil(token2)
|
|
|
|
assert.NotEqual(token1.Token, token2.Token)
|
|
|
|
c1.Client().SetToken(token1.Token)
|
|
c2.Client().SetToken(token1.Token) // Same token, as it should work on both
|
|
|
|
// Create a project, read from the other
|
|
org, err := scopes.NewClient(c1.Client()).Create(c1.Context(), scope.Global.String())
|
|
require.NoError(err)
|
|
require.NotNil(org.Item)
|
|
|
|
proj, err := scopes.NewClient(c2.Client()).Read(c2.Context(), org.Item.Id)
|
|
require.NoError(err)
|
|
require.NotNil(proj.Item)
|
|
}
|