Changeset 1662

Timestamp:

11/11/08 17:45:35 (2 months ago)

Author:

ton

Message:

Fixed problem where an existing session for a user which logged in with
the authtkt_default_username was thrown back out because the ids did not
match

Files:

• trunk/opsview-web/lib/Opsview/Web/Controller/Root.pm (modified) (1 diff)
• trunk/opsview-web/t/040auth.t (modified) (2 diffs)
• trunk/opsview-web/t/800login.t (modified) (5 diffs)

trunk/opsview-web/lib/Opsview/Web/Controller/Root.pm

@@ -143 +143 @@
-    }
-
-    # Check session matches with auth_tkt user
-    # Need this, otherwise effectively logs in user each time
-    if ($c->user_exists) {
-      # For some reason, sometimes $c->user could return undef back
-      if ($c->user && $info->{'uid'} ne $c->user->username()) {
-        $c->stash( login_error => $c->loc("Authentication ticket does not match with existing session user") );
-        my $audit_text = $c->loc("Authentication ticket contains '[_1]' but current session is '[_2]'", $info->{uid}, $c->user->username());
-        $c->log->info($audit_text);
-        Opsview::Auditlog->system($audit_text);
-        $c->forward("/expire_ticket");
-        return 0;
-      }
-    }
-
-    # Create user
+    # If a session cookie is found, will restore the user from the session cookie
+    # This also will check that the user exists in the database
-    if (! $c->user) {
-      $c->log->debug("Going to retrieve info for $info->{'uid'}");

trunk/opsview-web/t/040auth.t

@@ -1 +1 @@
-#!/usr/bin/perl
-
-33
+29
-
-use FindBin qw($Bin);
@@ -87 +87 @@
-is( $stash->{login_error}, "Authentication ticket has expired" );
-
-$forward = "";
-$c->config->{session}->{expires} = 4000;
-$c->set_true("user_exists");
-$rc = Opsview::Web::Controller::Root->validate_ticket( $c );
-is( $rc, 0, "Returned 0 because of different userid in ticket" );
-is( $log_info, "Authentication ticket contains '[_1]' but current session is '[_2]'" );
-is( $forward, "/expire_ticket" );
-is( $stash->{login_error}, "Authentication ticket does not match with existing session user" );
-
-$forward = "";

trunk/opsview-web/t/800login.t

@@ -17 +17 @@
-use Opsview::Contact;
-
-1
+7
-use Test::Deep;
-
@@ -97 +97 @@
-
-
+# NOTE: This is no longer checked because of authtkt_default_username
-# Have a ticket with a mismatch of uid
-
-
-
-
-
-
+#
+#
+#
+#
+#
+#
-
-
@@ -142 +143 @@
-
-
+
-# Test with a newly generated ticket cookie. Add the cookie directly to the request
-use HTTP::Request;
@@ -149 +151 @@
-my $response = $ua->request( $request );
-like( $response->content, "/Status Summary For Hostgroup Opsview/", "Found HH page from self generated cookie");
-
-
-# Try same, but use ip_addr as 0.0.0.0. This should fail because Opsview will use the incoming ip address
@@ -159 +160 @@
-like( $response->content, "/Invalid authentication ticket/i", "Displayed error of invalid authentication ticket" );
-
+
+
+
+# This test is to prove that a user which is deleted in the backend will not be
+# allowed access in again, even if they have an authtkt and a session cookie
+$ua = WWW::Mechanize->new;
+$res = $ua->get("http://$hostname/");
+ok( $res->is_success, "Got successful response" );
+is( $res->code, 200, "Status 200" );
+like( $res->content, "/login_username/s", "Returned login_username, so is a login page" );
+unlike( $res->content, "/<h3>/s", "Check that no login error is displayed" );
+
+$ua->field( 'login_username', 'somehosts' );
+$ua->field( 'login_password', 'somehosts' );
+$ua->current_form->action;
+$ua->submit;
+
+ok( $ua->res->is_success, "Successful reply" );
+
+$ua->get("http://$hostname/");
+like( $ua->content, "/Status Summary/" );
+
+Opsview::Contact->search( name => "somehosts" )->delete_all;
+$ua->get("http://$hostname/");
+like( $ua->content, "/login_username/s", "Login page" );
+like( $ua->content, "/Authentication ticket found, but user does not exist/" );