DevOps/www
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TLS

Browse Source
This commit is contained in:
eric
2026-10-26 18:06:22 -04:00
parent caf8839edd
commit d01f4a8fb7
5 changed files with 44 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
membership/members/tests/test_membership.py
+27 -1
View File
@@ -471,7 +471,7 @@ class DirectoryTests(SimpleTestCase):
with self.assertRaises(ValueError):
directory.identity_for_login("*)(uid=*)")
@override_settings(LDAP_URL="ldap://ldap.example.org", LDAP_BIND_DN="cn=service", LDAP_BIND_PASSWORD="test-only", LDAP_ACCOUNT_BASE_DN=BASE)
@override_settings(LDAP_URL="ldap://ldap.example.org", LDAP_ALLOW_INSECURE=False, LDAP_BIND_DN="cn=service", LDAP_BIND_PASSWORD="test-only", LDAP_ACCOUNT_BASE_DN=BASE)
@patch("members.directory.Connection")
def test_starttls_failure_never_binds_credentials(self, conn_factory):
conn_factory.return_value.start_tls.return_value = False
@@ -480,3 +480,29 @@ class DirectoryTests(SimpleTestCase):
pass
conn_factory.return_value.bind.assert_not_called()
conn_factory.return_value.unbind.assert_called_once()
@override_settings(LDAP_BIND_DN="cn=service", LDAP_BIND_PASSWORD="test-only", LDAP_ACCOUNT_BASE_DN=BASE, LDAP_CA_CERT_FILE=None)
@patch("members.directory.Connection")
@patch("members.directory.Server")
def test_ldap_transport_modes(self, server_factory, conn_factory):
import ssl
for scheme, insecure, starttls, port in (
("ldap", False, True, 389),
("ldap", True, False, 389),
("ldaps", False, False, 636),
("ldaps", True, False, 636),
):
with self.subTest(scheme=scheme, insecure=insecure):
conn_factory.reset_mock()
with override_settings(LDAP_URL=f"{scheme}://ldap.example.org", LDAP_ALLOW_INSECURE=insecure):
with directory.connection() as conn:
self.assertIs(conn, conn_factory.return_value)
self.assertEqual(conn_factory.return_value.start_tls.call_count, int(starttls))
conn_factory.return_value.open.assert_called_once()
conn_factory.return_value.bind.assert_called_once()
conn_factory.return_value.unbind.assert_called_once()
options = server_factory.call_args.kwargs
self.assertEqual(options["use_ssl"], scheme == "ldaps")
self.assertEqual(options["port"], port)
self.assertEqual(options["tls"].validate, ssl.CERT_REQUIRED)