Login

membership/members/tests/test_oidc.py

@@ -48,6 +48,19 @@ class AuthlibFlowTests(TestCase):
         with self.assertRaises(Exception):
             self.exchange(remote, callback, token)
 
+    def test_verified_callback_creates_account_without_ldap(self):
+        from members import views
+        from members.models import Account
+
+        remote, callback, token = self.flow(preferred_username="alice", email="alice@example.org", email_verified=True, federated_claims={"connector_id": settings.DEX_CONNECTOR_ID, "user_id": "alice"})
+        with patch("members.views.dex", return_value=remote), patch.object(remote, "fetch_access_token", return_value=token), patch.object(remote, "fetch_jwk_set", return_value={"keys": [self.key.as_dict(private=False)]}), patch("members.directory.Connection", side_effect=AssertionError("Login must not bind to LDAP")) as ldap:
+            response = views.callback(callback)
+        self.assertEqual(response.status_code, 302)
+        member = Account.objects.get(oidc_issuer=settings.DEX_ISSUER, oidc_sub="test-sub")
+        self.assertIsNone(member.ldap_uuid)
+        self.assertEqual(dict(callback.session), {"account_id": str(member.pk)})
+        ldap.assert_not_called()
+
     def test_wrong_nonce_issuer_audience_expiry_rejected(self):
         for changes in ({"nonce": "attacker"}, {"iss": "https://evil.example"}, {"aud": "another-client"}, {"exp": int(time.time()) - 100}):
             with self.subTest(changes=changes):