Merge branch 'tc-saml-fix-false-empty' into 'master'

SAML fix when auth hash attributes do not define groups

Closes #38923

See merge request gitlab-org/gitlab-ce!14913

2 files changed, 55 insertions, 17 deletions

diff --git a/spec/lib/gitlab/saml/auth_hash_spec.rb b/spec/lib/gitlab/saml/auth_hash_spec.rb
new file mode 100644
index 00000000000..a555935aea3
--- /dev/null
+++ b/spec/lib/gitlab/saml/auth_hash_spec.rb
@@ -0,0 +1,40 @@
+require 'spec_helper'
+
+describe Gitlab::Saml::AuthHash do
+  include LoginHelpers
+
+  let(:raw_info_attr) { { 'groups' => %w(Developers Freelancers) } }
+  subject(:saml_auth_hash) { described_class.new(omniauth_auth_hash) }
+
+  let(:info_hash) do
+    {
+      name: 'John',
+      email: 'john@mail.com'
+    }
+  end
+
+  let(:omniauth_auth_hash) do
+    OmniAuth::AuthHash.new(uid: 'my-uid',
+                           provider: 'saml',
+                           info: info_hash,
+                           extra: { raw_info: OneLogin::RubySaml::Attributes.new(raw_info_attr) } )
+  end
+
+  before do
+    stub_saml_group_config(%w(Developers Freelancers Designers))
+  end
+
+  describe '#groups' do
+    it 'returns array of groups' do
+      expect(saml_auth_hash.groups).to eq(%w(Developers Freelancers))
+    end
+
+    context 'raw info hash attributes empty' do
+      let(:raw_info_attr) { {} }
+
+      it 'returns an empty array' do
+        expect(saml_auth_hash.groups).to be_a(Array)
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/saml/user_spec.rb b/spec/lib/gitlab/saml/user_spec.rb
index 59923bfb14d..1c23fb5f285 100644
--- a/spec/lib/gitlab/saml/user_spec.rb
+++ b/spec/lib/gitlab/saml/user_spec.rb
@@ -2,13 +2,15 @@ require 'spec_helper'
 
 describe Gitlab::Saml::User do
   include LdapHelpers
+  include LoginHelpers
 
   let(:saml_user) { described_class.new(auth_hash) }
   let(:gl_user) { saml_user.gl_user }
   let(:uid) { 'my-uid' }
   let(:dn) { 'uid=user1,ou=People,dc=example' }
   let(:provider) { 'saml' }
-  let(:auth_hash) { OmniAuth::AuthHash.new(uid: uid, provider: provider, info: info_hash, extra: { raw_info: OneLogin::RubySaml::Attributes.new({ 'groups' => %w(Developers Freelancers Designers) }) }) }
+  let(:raw_info_attr) { { 'groups' => %w(Developers Freelancers Designers) } }
+  let(:auth_hash) { OmniAuth::AuthHash.new(uid: uid, provider: provider, info: info_hash, extra: { raw_info: OneLogin::RubySaml::Attributes.new(raw_info_attr) }) }
   let(:info_hash) do
     {
       name: 'John',
@@ -18,22 +20,6 @@ describe Gitlab::Saml::User do
   let(:ldap_user) { Gitlab::LDAP::Person.new(Net::LDAP::Entry.new, 'ldapmain') }
 
   describe '#save' do
-    def stub_omniauth_config(messages)
-      allow(Gitlab.config.omniauth).to receive_messages(messages)
-    end
-
-    def stub_ldap_config(messages)
-      allow(Gitlab::LDAP::Config).to receive_messages(messages)
-    end
-
-    def stub_basic_saml_config
-      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', args: {} } })
-    end
-
-    def stub_saml_group_config(groups)
-      allow(Gitlab::Saml::Config).to receive_messages({ options: { name: 'saml', groups_attribute: 'groups', external_groups: groups, args: {} } })
-    end
-
     before do
       stub_basic_saml_config
     end
@@ -402,4 +388,16 @@ describe Gitlab::Saml::User do
       end
     end
   end
+
+  describe '#find_user' do
+    context 'raw info hash attributes empty' do
+      let(:raw_info_attr) { {} }
+
+      it 'does not mark user as external' do
+        stub_saml_group_config(%w(Freelancers))
+
+        expect(saml_user.find_user.external).to be_falsy
+      end
+    end
+  end
 end