From da41678694bce9218e384fd7fd9459388f7a247e Mon Sep 17 00:00:00 2001
From: Arthur Schiwon <blizzz@arthur-schiwon.de>
Date: Thu, 9 Nov 2023 23:01:47 +0100
Subject: [PATCH] feat(user_saml): group information for SAML integration tests

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
---
 user_saml-dirsrv/Dockerfile                   |  4 +++
 user_saml-dirsrv/conf/entries.ldif            | 26 +++++++++++++++++++
 .../shibboleth-idp/conf/attribute-filter.xml  |  8 ++++++
 .../conf/attribute-resolver.xml               | 22 +++++++++++++++-
 .../shibboleth-idp/conf/ldap.properties       |  2 ++
 5 files changed, 61 insertions(+), 1 deletion(-)

diff --git a/user_saml-dirsrv/Dockerfile b/user_saml-dirsrv/Dockerfile
index 682cc699..5f8ad38b 100644
--- a/user_saml-dirsrv/Dockerfile
+++ b/user_saml-dirsrv/Dockerfile
@@ -23,6 +23,10 @@ RUN /usr/libexec/dirsrv/dscontainer -r & \
     dsconf localhost backend create --suffix dc=idptestbed --be-name ci_root; \
     mv /var/opt/98nextcloud-schema.ldif /etc/dirsrv/slapd-localhost/schema/; \
     dsconf localhost schema reload; \
+    dsconf localhost plugin memberof enable; \
+    dsctl localhost restart; \
+    dsconf localhost plugin memberof status; \
+    dsconf localhost plugin memberof show; \
     dsconf localhost backend import "dc=idptestbed" /var/opt/entries.ldif; \
     rm /var/opt/entries.ldif;
 
diff --git a/user_saml-dirsrv/conf/entries.ldif b/user_saml-dirsrv/conf/entries.ldif
index 3ba1998a..efda14b0 100644
--- a/user_saml-dirsrv/conf/entries.ldif
+++ b/user_saml-dirsrv/conf/entries.ldif
@@ -1,3 +1,4 @@
+# Structure
 
 dn: dc=idptestbed
 objectClass: top
@@ -23,10 +24,13 @@ objectClass: top
 objectClass: organizationalunit
 ou: People
 
+# Users
+
 dn: uid=student1,ou=People,dc=idptestbed
 objectClass: organizationalPerson
 objectClass: person
 objectClass: top
+objectClass: inetuser
 objectClass: inetOrgPerson
 objectClass: nextcloudUser
 givenName: Stud
@@ -41,6 +45,7 @@ dn: uid=student2,ou=People,dc=idptestbed
 objectClass: organizationalPerson
 objectClass: person
 objectClass: top
+objectClass: inetuser
 objectClass: inetOrgPerson
 objectClass: nextcloudUser
 givenName: Stud
@@ -55,6 +60,7 @@ dn: uid=staff1,ou=People,dc=idptestbed
 objectClass: organizationalPerson
 objectClass: person
 objectClass: top
+objectClass: inetuser
 objectClass: inetOrgPerson
 objectClass: nextcloudUser
 givenName: St
@@ -63,3 +69,23 @@ sn: aff
 cn: St aff
 mail: staff1@idptestbed.edu
 userPassword: password
+
+
+# Groups
+
+dn: cn=Students,ou=Groups,dc=idptestbed
+objectClass: groupOfNames
+cn: Students
+member: uid=student1,ou=People,dc=idptestbed
+member: uid=student2,ou=People,dc=idptestbed
+
+dn: cn=Professors,ou=Groups,dc=idptestbed
+objectClass: groupOfNames
+cn: Professors
+member: uid=staff1,ou=People,dc=idptestbed
+
+dn: cn=Astrophysics,ou=Groups,dc=idptestbed
+objectClass: groupOfNames
+cn: Astrophysics
+member: uid=student1,ou=People,dc=idptestbed
+member: uid=staff1,ou=People,dc=idptestbed
diff --git a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml
index 92513ef3..124772bd 100644
--- a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml
+++ b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml
@@ -37,6 +37,14 @@
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
 
+		<AttributeRule attributeID="quota">
+			<PermitValueRule xsi:type="ANY" />
+		</AttributeRule>
+
+		<AttributeRule attributeID="groups">
+			<PermitValueRule xsi:type="ANY" />
+		</AttributeRule>
+
         <AttributeRule attributeID="eduPersonPrincipalName">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
diff --git a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml
index 0e4a0cd5..6cf41ab3 100644
--- a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml
+++ b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml
@@ -131,8 +131,13 @@
     <AttributeDefinition xsi:type="Simple" id="quota">
 		<InputDataConnector ref="myLDAP" attributeNames="quota" />
         <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:quota" encodeType="false" />
-        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:quota" friendlyName="quota" encodeType="false" />
+        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.49213.1.1.2" friendlyName="quota" encodeType="false" />
     </AttributeDefinition>
+
+	<AttributeDefinition xsi:type="Simple" id="groups">
+		<InputDataConnector ref="groupMemberships" attributeNames="quota" />
+		<AttributeEncoder xsi:type="SAML2String" name="groups" friendlyName="groups" encodeType="false" />
+	</AttributeDefinition>
 <!--
     <resolver:AttributeDefinition xsi:type="ad:Simple" id="initials" sourceAttributeID="initials">
         <resolver:Dependency ref="myLDAP" />
@@ -286,4 +291,19 @@
     -->
     </DataConnector>
 
+	<DataConnector id="groupMemberships" xsi:type="LDAPDirectory"
+				   ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
+				   baseDN="%{idp.attribute.resolver.LDAP.groupBaseDN}"
+				   principal="%{idp.attribute.resolver.LDAP.bindDN}"
+				   principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
+				   useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
+				   maxResultSize="0">
+		<FilterTemplate>
+			<![CDATA[
+				%{idp.attribute.resolver.LDAP.groupFilter}
+			]]>
+		</FilterTemplate>
+		<ReturnAttributes>cn</ReturnAttributes>
+	</DataConnector>
+
 </AttributeResolver>
diff --git a/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties b/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties
index b78ca1f2..e51ba94c 100644
--- a/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties
+++ b/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties
@@ -28,6 +28,7 @@ idp.authn.LDAP.returnAttributes                 = cn,businessCategory,mail
 # Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator
 # for AD: CN=Users,DC=example,DC=org
 idp.authn.LDAP.baseDN                           = ou=people,dc=idptestbed
+idp.authn.LDAP.groupBaseDN                      = ou=groups,dc=idptestbed
 #idp.authn.LDAP.subtreeSearch                   = false
 idp.authn.LDAP.userFilter                       = (uid={user})
 # bind search configuration
@@ -47,6 +48,7 @@ idp.attribute.resolver.LDAP.bindDNCredential    = %{idp.authn.LDAP.bindDNCredent
 idp.attribute.resolver.LDAP.useStartTLS         = %{idp.authn.LDAP.useStartTLS:true}
 idp.attribute.resolver.LDAP.trustCertificates   = %{idp.authn.LDAP.trustCertificates}
 idp.attribute.resolver.LDAP.searchFilter        = (uid=$requestContext.principalName)
+idp.attribute.resolver.LDAP.groupFilter         = (&(objectclass=groupOfNames)(member=uid=$requestContext.principalName,ou=People,*))
 
 # LDAP pool configuration, used for both authn and DN resolution
 #idp.pool.LDAP.minSize                          = 3