mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
1c5700a8c4
For #27042. Ready for review, just missing integration tests that I will be writing today. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features. - [X] If database migrations are included, checked table schema to confirm autoupdate - For new Fleet configuration settings - [X] Verified that the setting can be managed via GitOps, or confirmed that the setting is explicitly being excluded from GitOps. If managing via Gitops: - [X] Verified that the setting is exported via `fleetctl generate-gitops` - [X] Added the setting to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [X] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [x] Verified that any relevant UI is disabled when GitOps mode is enabled - For database migrations: - [X] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [X] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [X] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Added/updated automated tests - [X] Manual QA for all new/changed functionality --------- Co-authored-by: jacobshandling <61553566+jacobshandling@users.noreply.github.com> Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
187 lines
6.2 KiB
Go
187 lines
6.2 KiB
Go
package mysql
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestConditionalAccess(t *testing.T) {
|
|
ds := CreateMySQLDS(t)
|
|
|
|
cases := []struct {
|
|
name string
|
|
fn func(t *testing.T, ds *Datastore)
|
|
}{
|
|
{"Setup", testConditionalAccessSetup},
|
|
{"Hosts", testConditionalAccessHosts},
|
|
}
|
|
|
|
for _, c := range cases {
|
|
t.Helper()
|
|
t.Run(c.name, func(t *testing.T) {
|
|
defer TruncateTables(t, ds)
|
|
|
|
c.fn(t, ds)
|
|
})
|
|
}
|
|
}
|
|
|
|
func testConditionalAccessSetup(t *testing.T, ds *Datastore) {
|
|
ctx := context.Background()
|
|
|
|
_, err := ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
err = ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar", "insecure")
|
|
require.NoError(t, err)
|
|
ca, err := ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.False(t, ca.SetupDone)
|
|
require.Equal(t, "insecure", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar", ca.TenantID)
|
|
|
|
// ConditionalAccessMicrosoftCreateIntegration replaces the existing one.
|
|
err = ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar2", "insecure2")
|
|
require.NoError(t, err)
|
|
ca, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.False(t, ca.SetupDone)
|
|
require.Equal(t, "insecure2", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar2", ca.TenantID)
|
|
|
|
err = ds.ConditionalAccessMicrosoftMarkSetupDone(ctx)
|
|
require.NoError(t, err)
|
|
|
|
ca, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.True(t, ca.SetupDone)
|
|
require.Equal(t, "insecure2", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar2", ca.TenantID)
|
|
|
|
err = ds.ConditionalAccessMicrosoftDelete(ctx)
|
|
require.NoError(t, err)
|
|
|
|
_, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
// Create a new one after deleting the existing.
|
|
err = ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar3", "insecure3")
|
|
require.NoError(t, err)
|
|
ca, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.False(t, ca.SetupDone)
|
|
require.Equal(t, "insecure3", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar3", ca.TenantID)
|
|
}
|
|
|
|
func testConditionalAccessHosts(t *testing.T, ds *Datastore) {
|
|
ctx := context.Background()
|
|
|
|
err := ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar", "insecure")
|
|
require.NoError(t, err)
|
|
|
|
// Test with non-existent host.
|
|
_, err = ds.LoadHostConditionalAccessStatus(ctx, 999_999)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
noTeamHost := newTestHostWithPlatform(t, ds, "host1", "darwin", nil)
|
|
|
|
// Test with an existent host but no status yet.
|
|
_, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
// Nothing happens if the host doesn't have an entry yet.
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, false, false)
|
|
require.NoError(t, err)
|
|
_, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID", "foobar@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
|
|
s, err := ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID", s.DeviceID)
|
|
require.Equal(t, "foobar@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
// When the status entry is created, these are not set yet.
|
|
// These values are updated during detail query ingestion.
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
|
|
// Execute with same values should do nothing.
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID", "foobar@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID", s.DeviceID)
|
|
require.Equal(t, "foobar@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
// These values are updated during detail query ingestion.
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, true, false)
|
|
require.NoError(t, err)
|
|
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID", s.DeviceID)
|
|
require.Equal(t, "foobar@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
require.NotNil(t, s.Managed)
|
|
require.True(t, *s.Managed)
|
|
require.NotNil(t, s.Compliant)
|
|
require.False(t, *s.Compliant)
|
|
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, false, true)
|
|
require.NoError(t, err)
|
|
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, s.Managed)
|
|
require.False(t, *s.Managed)
|
|
require.NotNil(t, s.Compliant)
|
|
require.True(t, *s.Compliant)
|
|
|
|
// Simulate a device changing its device ID and user principal name
|
|
// (e.g. log out from Entra on device and log in again).
|
|
// We should update its data and clear its statuses.
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID2", "foobar2@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID2", s.DeviceID)
|
|
require.Equal(t, "foobar2@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
}
|