User command: check LDAP user existence if LDAP enabled

tracim/tracim/command/__init__.py

@@ -19,8 +19,22 @@ class BaseCommand(Command):
         try:
             super().run(parsed_args)
         except CommandAbortedError as exc:
+            if parsed_args.raise_error:
+                raise
             print(exc)
 
+    def get_parser(self, prog_name):
+        parser = super().get_parser(prog_name)
+
+        parser.add_argument(
+            "--raise",
+            help='Raise CommandAbortedError errors instead print it\'s message',
+            dest='raise_error',
+            action='store_true',
+        )
+
+        return parser
+
 
 class AppContextCommand(BaseCommand):
     """

tracim/tracim/command/user.py

@@ -1,8 +1,10 @@
 # -*- coding: utf-8 -*-
 import transaction
 from sqlalchemy.exc import IntegrityError
+from tg import config
 
 from tracim.command import AppContextCommand, Extender
+from tracim.lib.auth.ldap import LDAPAuth
 from tracim.lib.exception import AlreadyExistError, CommandAbortedError
 from tracim.lib.group import GroupApi
 from tracim.lib.user import UserApi
@@ -88,7 +90,9 @@ class UserCommand(AppContextCommand):
 
     def _create_user(self, login, password, **kwargs):
         if not password:
-            raise CommandAbortedError("You must provide -p/--password parameter")
+            if self._password_required():
+                raise CommandAbortedError("You must provide -p/--password parameter")
+            password = ''
 
         try:
             user = User(email=login, password=password, **kwargs)
@@ -115,6 +119,8 @@ class UserCommand(AppContextCommand):
         print("User created/updated")
 
     def _proceed_user(self, parsed_args):
+        self._check_context(parsed_args)
+
         if self.action == self.ACTION_CREATE:
             try:
                 user = self._create_user(login=parsed_args.login, password=parsed_args.password)
@@ -137,6 +143,19 @@ class UserCommand(AppContextCommand):
         for group_name in parsed_args.remove_from_group:
             self._remove_user_from_named_group(user, group_name)
 
+    def _password_required(self):
+        if config.get('auth_type') == LDAPAuth.name:
+            return False
+        return True
+
+    def _check_context(self, parsed_args):
+        if config.get('auth_type') == LDAPAuth.name:
+            auth_instance = config.get('auth_instance')
+            if not auth_instance.ldap_auth.user_exist(parsed_args.login):
+                raise LDAPUserUnknown(
+                    "LDAP is enabled and user with login/email \"%s\" not found in LDAP" % parsed_args.login
+                )
+
 
 class CreateUserCommand(UserCommand):
     action = UserCommand.ACTION_CREATE
@@ -144,3 +163,7 @@ class CreateUserCommand(UserCommand):
 
 class UpdateUserCommand(UserCommand):
     action = UserCommand.ACTION_UPDATE
+
+
+class LDAPUserUnknown(CommandAbortedError):
+    pass

tracim/tracim/lib/auth/ldap.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 import transaction
 from tg.configuration.auth import TGAuthMetadata
-from who_ldap import LDAPAttributesPlugin as BaseLDAPAttributesPlugin
+from who_ldap import LDAPAttributesPlugin as BaseLDAPAttributesPlugin, make_connection
 from who_ldap import LDAPGroupsPlugin as BaseLDAPGroupsPlugin
 from who_ldap import LDAPSearchAuthenticatorPlugin as BaseLDAPSearchAuthenticatorPlugin
 
@@ -115,6 +115,22 @@ class LDAPSearchAuthenticatorPlugin(BaseLDAPSearchAuthenticatorPlugin):
         DBSession.flush()
         transaction.commit()
 
+    def user_exist(self, email):
+        with make_connection(self.url, self.bind_dn, self.bind_pass) as conn:
+            if self.start_tls:
+                conn.start_tls()
+
+            if not conn.bind():
+                return False
+
+            search = self.search_pattern % email
+            conn.search(self.base_dn, search, self.search_scope)
+
+            if len(conn.response) > 0:
+                return True
+
+            return False
+
 
 class LDAPApplicationAuthMetadata(TGAuthMetadata):
 

tracim/tracim/tests/__init__.py

@@ -176,26 +176,10 @@ class TestStandard(object):
 
 
 class TestCommand(TestStandard):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        # We disable app loading from commands classes
-        BaseCommand.auto_setup_app = False
-        # Hack parser object to test conditions
-        BaseCommand.get_parser = self._get_test_parser()
-
-    def _get_test_parser(self):
-        def get_parser(self, prog_name):
-            parser = ArgumentParser(
-                description=self.get_description(),
-                prog=prog_name,
-                add_help=False
-            )
-            return parser
-        return get_parser
-
     def _execute_command(self, command_class, command_name, sub_argv):
         parser = argparse.ArgumentParser()
         command = command_class(self.app, parser)
+        command.auto_setup_app = False
         cmd_parser = command.get_parser(command_name)
         parsed_args = cmd_parser.parse_args(sub_argv)
         return command.run(parsed_args)

tracim/tracim/tests/command/user_ldap.py

@@ -0,0 +1,33 @@
+from nose.tools import eq_, raises
+from nose.tools import ok_
+
+from tracim.command.user import CreateUserCommand, LDAPUserUnknown
+from tracim.fixtures.ldap import ldap_test_server_fixtures
+from tracim.lib.exception import CommandAbortedError
+from tracim.tests import TestCommand, LDAPTest
+
+
+class TestLDAPUserCommand(LDAPTest, TestCommand):
+    """
+    Test LDAP user verification when execute command
+    """
+    application_under_test = 'ldap'
+    ldap_server_data = ldap_test_server_fixtures
+
+    @raises(LDAPUserUnknown)
+    def test_user_not_in_ldap(self):
+        self._execute_command(
+            CreateUserCommand,
+            'gearbox user create',
+            ['-l', 'unknown-user@fsf.org', '-p', 'foo', '--raise']
+        )
+
+    def test_user_in_ldap(self):
+        try:
+            self._execute_command(
+                CreateUserCommand,
+                'gearbox user create',
+                ['-l', 'richard-not-real-email@fsf.org', '-p', 'foo', '--raise']
+            )
+        except LDAPUserUnknown:
+            ok_(False, "Command should not raise LDAPUserUnknown exception")