authentik.enterprise.providers.microsoft_entra.tests.test_groups

  1"""Microsoft Entra Group tests"""
  2
  3from unittest.mock import AsyncMock, MagicMock, patch
  4
  5from azure.identity.aio import ClientSecretCredential
  6from django.test import TestCase
  7from msgraph.generated.models.group import Group as MSGroup
  8from msgraph.generated.models.group_collection_response import GroupCollectionResponse
  9from msgraph.generated.models.organization import Organization
 10from msgraph.generated.models.organization_collection_response import OrganizationCollectionResponse
 11from msgraph.generated.models.user import User as MSUser
 12from msgraph.generated.models.user_collection_response import UserCollectionResponse
 13from msgraph.generated.models.verified_domain import VerifiedDomain
 14
 15from authentik.blueprints.tests import apply_blueprint
 16from authentik.core.models import Application, Group, User
 17from authentik.core.tests.utils import create_test_user
 18from authentik.enterprise.providers.microsoft_entra.models import (
 19    MicrosoftEntraProvider,
 20    MicrosoftEntraProviderGroup,
 21    MicrosoftEntraProviderMapping,
 22    MicrosoftEntraProviderUser,
 23)
 24from authentik.enterprise.providers.microsoft_entra.tasks import microsoft_entra_sync
 25from authentik.events.models import Event, EventAction
 26from authentik.lib.generators import generate_id
 27from authentik.lib.sync.outgoing.models import OutgoingSyncDeleteAction
 28from authentik.tenants.models import Tenant
 29
 30
 31class MicrosoftEntraGroupTests(TestCase):
 32    """Microsoft Entra Group tests"""
 33
 34    @apply_blueprint("system/providers-microsoft-entra.yaml")
 35    def setUp(self) -> None:
 36        # Delete all groups and groups as the mocked HTTP responses only return one ID
 37        # which will cause errors with multiple groups
 38        Tenant.objects.update(avatars="none")
 39        User.objects.all().exclude_anonymous().delete()
 40        Group.objects.all().delete()
 41        self.provider: MicrosoftEntraProvider = MicrosoftEntraProvider.objects.create(
 42            name=generate_id(),
 43            client_id=generate_id(),
 44            client_secret=generate_id(),
 45            tenant_id=generate_id(),
 46            exclude_users_service_account=True,
 47        )
 48        self.app: Application = Application.objects.create(
 49            name=generate_id(),
 50            slug=generate_id(),
 51        )
 52        self.app.backchannel_providers.add(self.provider)
 53        self.provider.property_mappings.add(
 54            MicrosoftEntraProviderMapping.objects.get(
 55                managed="goauthentik.io/providers/microsoft_entra/user"
 56            )
 57        )
 58        self.provider.property_mappings_group.add(
 59            MicrosoftEntraProviderMapping.objects.get(
 60                managed="goauthentik.io/providers/microsoft_entra/group"
 61            )
 62        )
 63        self.creds = ClientSecretCredential(generate_id(), generate_id(), generate_id())
 64
 65    def test_group_create(self):
 66        """Test group creation"""
 67        uid = generate_id()
 68        with (
 69            patch(
 70                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
 71                MagicMock(return_value={"credentials": self.creds}),
 72            ),
 73            patch(
 74                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
 75                AsyncMock(
 76                    return_value=OrganizationCollectionResponse(
 77                        value=[
 78                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
 79                        ]
 80                    )
 81                ),
 82            ),
 83            patch(
 84                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
 85                AsyncMock(return_value=MSGroup(id=generate_id())),
 86            ) as group_create,
 87        ):
 88            group = Group.objects.create(name=uid)
 89            microsoft_group = MicrosoftEntraProviderGroup.objects.filter(
 90                provider=self.provider, group=group
 91            ).first()
 92            self.assertIsNotNone(microsoft_group)
 93            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
 94            group_create.assert_called_once()
 95
 96    def test_group_not_created(self):
 97        """Test without group property mappings, no group is created"""
 98        self.provider.property_mappings_group.clear()
 99        uid = generate_id()
100        with (
101            patch(
102                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
103                MagicMock(return_value={"credentials": self.creds}),
104            ),
105            patch(
106                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
107                AsyncMock(
108                    return_value=OrganizationCollectionResponse(
109                        value=[
110                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
111                        ]
112                    )
113                ),
114            ),
115            patch(
116                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
117                AsyncMock(return_value=MSGroup(id=generate_id())),
118            ) as group_create,
119        ):
120            group = Group.objects.create(name=uid)
121            microsoft_group = MicrosoftEntraProviderGroup.objects.filter(
122                provider=self.provider, group=group
123            ).first()
124            self.assertIsNone(microsoft_group)
125            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
126            group_create.assert_not_called()
127
128    def test_group_create_update(self):
129        """Test group updating"""
130        uid = generate_id()
131        ext_id = generate_id()
132        with (
133            patch(
134                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
135                MagicMock(return_value={"credentials": self.creds}),
136            ),
137            patch(
138                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
139                AsyncMock(
140                    return_value=OrganizationCollectionResponse(
141                        value=[
142                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
143                        ]
144                    )
145                ),
146            ),
147            patch(
148                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
149                AsyncMock(return_value=MSGroup(id=ext_id)),
150            ) as group_create,
151            patch(
152                "msgraph.generated.groups.item.group_item_request_builder.GroupItemRequestBuilder.patch",
153                AsyncMock(return_value=MSGroup(id=ext_id)),
154            ) as group_patch,
155        ):
156            group = Group.objects.create(name=uid)
157            microsoft_group = MicrosoftEntraProviderGroup.objects.filter(
158                provider=self.provider, group=group
159            ).first()
160            self.assertIsNotNone(microsoft_group)
161
162            group.name = "new name"
163            group.save()
164            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
165            group_create.assert_called_once()
166            group_patch.assert_called_once()
167
168    def test_group_create_delete(self):
169        """Test group deletion"""
170        uid = generate_id()
171        ext_id = generate_id()
172        with (
173            patch(
174                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
175                AsyncMock(
176                    return_value=OrganizationCollectionResponse(
177                        value=[
178                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
179                        ]
180                    )
181                ),
182            ),
183            patch(
184                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
185                MagicMock(return_value={"credentials": self.creds}),
186            ),
187            patch(
188                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
189                AsyncMock(return_value=MSGroup(id=ext_id)),
190            ) as group_create,
191            patch(
192                "msgraph.generated.groups.item.group_item_request_builder.GroupItemRequestBuilder.delete",
193                AsyncMock(return_value=MSGroup(id=ext_id)),
194            ) as group_delete,
195        ):
196            group = Group.objects.create(name=uid)
197            microsoft_group = MicrosoftEntraProviderGroup.objects.filter(
198                provider=self.provider, group=group
199            ).first()
200            self.assertIsNotNone(microsoft_group)
201
202            group.delete()
203            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
204            group_create.assert_called_once()
205            group_delete.assert_called_once()
206
207    def test_group_create_member_add(self):
208        """Test group creation"""
209        uid = generate_id()
210        with (
211            patch(
212                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
213                MagicMock(return_value={"credentials": self.creds}),
214            ),
215            patch(
216                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
217                AsyncMock(
218                    return_value=OrganizationCollectionResponse(
219                        value=[
220                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
221                        ]
222                    )
223                ),
224            ),
225            patch(
226                "msgraph.generated.users.users_request_builder.UsersRequestBuilder.post",
227                AsyncMock(return_value=MSUser(id=generate_id())),
228            ) as user_create,
229            patch(
230                "msgraph.generated.users.item.user_item_request_builder.UserItemRequestBuilder.patch",
231                AsyncMock(return_value=MSUser(id=generate_id())),
232            ),
233            patch(
234                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
235                AsyncMock(return_value=MSGroup(id=uid)),
236            ) as group_create,
237            patch(
238                "msgraph.generated.groups.item.members.ref.ref_request_builder.RefRequestBuilder.post",
239                AsyncMock(),
240            ) as member_add,
241        ):
242            user = create_test_user(uid)
243            group = Group.objects.create(name=uid)
244            group.users.add(user)
245            microsoft_group = MicrosoftEntraProviderGroup.objects.filter(
246                provider=self.provider, group=group
247            ).first()
248            self.assertIsNotNone(microsoft_group)
249            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
250            user_create.assert_called_once()
251            group_create.assert_called_once()
252            member_add.assert_called_once()
253            self.assertEqual(
254                member_add.call_args[0][0].odata_id,
255                f"https://graph.microsoft.com/v1.0/directoryObjects/{
256                    MicrosoftEntraProviderUser.objects.filter(
257                        provider=self.provider,
258                    )
259                    .first()
260                    .microsoft_id
261                }",
262            )
263
264    def test_group_create_member_remove(self):
265        """Test group creation"""
266        uid = generate_id()
267        with (
268            patch(
269                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
270                MagicMock(return_value={"credentials": self.creds}),
271            ),
272            patch(
273                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
274                AsyncMock(
275                    return_value=OrganizationCollectionResponse(
276                        value=[
277                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
278                        ]
279                    )
280                ),
281            ),
282            patch(
283                "msgraph.generated.users.users_request_builder.UsersRequestBuilder.post",
284                AsyncMock(return_value=MSUser(id=generate_id())),
285            ) as user_create,
286            patch(
287                "msgraph.generated.users.item.user_item_request_builder.UserItemRequestBuilder.patch",
288                AsyncMock(return_value=MSUser(id=generate_id())),
289            ),
290            patch(
291                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
292                AsyncMock(return_value=MSGroup(id=uid)),
293            ) as group_create,
294            patch(
295                "msgraph.generated.groups.item.members.ref.ref_request_builder.RefRequestBuilder.post",
296                AsyncMock(),
297            ) as member_add,
298            patch(
299                "msgraph.generated.groups.item.members.item.ref.ref_request_builder.RefRequestBuilder.delete",
300                AsyncMock(),
301            ) as member_remove,
302        ):
303            user = create_test_user(uid)
304            group = Group.objects.create(name=uid)
305            group.users.add(user)
306            microsoft_group = MicrosoftEntraProviderGroup.objects.filter(
307                provider=self.provider, group=group
308            ).first()
309            self.assertIsNotNone(microsoft_group)
310            group.users.remove(user)
311
312            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
313            user_create.assert_called_once()
314            group_create.assert_called_once()
315            member_add.assert_called_once()
316            self.assertEqual(
317                member_add.call_args[0][0].odata_id,
318                f"https://graph.microsoft.com/v1.0/directoryObjects/{
319                    MicrosoftEntraProviderUser.objects.filter(
320                        provider=self.provider,
321                    )
322                    .first()
323                    .microsoft_id
324                }",
325            )
326            member_remove.assert_called_once()
327
328    def test_group_create_delete_do_nothing(self):
329        """Test group deletion (delete action = do nothing)"""
330        self.provider.group_delete_action = OutgoingSyncDeleteAction.DO_NOTHING
331        self.provider.save()
332        uid = generate_id()
333        with (
334            patch(
335                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
336                MagicMock(return_value={"credentials": self.creds}),
337            ),
338            patch(
339                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
340                AsyncMock(
341                    return_value=OrganizationCollectionResponse(
342                        value=[
343                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
344                        ]
345                    )
346                ),
347            ),
348            patch(
349                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
350                AsyncMock(return_value=MSGroup(id=uid)),
351            ) as group_create,
352            patch(
353                "msgraph.generated.groups.item.group_item_request_builder.GroupItemRequestBuilder.delete",
354                AsyncMock(return_value=MSGroup(id=uid)),
355            ) as group_delete,
356        ):
357            group = Group.objects.create(name=uid)
358            microsoft_group = MicrosoftEntraProviderGroup.objects.filter(
359                provider=self.provider, group=group
360            ).first()
361            self.assertIsNotNone(microsoft_group)
362
363            group.delete()
364            self.assertFalse(
365                MicrosoftEntraProviderGroup.objects.filter(
366                    provider=self.provider, group__name=uid
367                ).exists()
368            )
369            group_create.assert_called_once()
370            group_delete.assert_not_called()
371
372    def test_sync_discover(self):
373        """Test group discovery"""
374        uid = generate_id()
375        self.app.backchannel_providers.remove(self.provider)
376        different_group = Group.objects.create(
377            name=uid,
378        )
379        self.app.backchannel_providers.add(self.provider)
380        with (
381            patch(
382                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
383                MagicMock(return_value={"credentials": self.creds}),
384            ),
385            patch(
386                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
387                AsyncMock(
388                    return_value=OrganizationCollectionResponse(
389                        value=[
390                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
391                        ]
392                    )
393                ),
394            ),
395            patch(
396                "msgraph.generated.users.item.user_item_request_builder.UserItemRequestBuilder.patch",
397                AsyncMock(return_value=MSUser(id=generate_id())),
398            ),
399            patch(
400                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
401                AsyncMock(return_value=MSGroup(id=generate_id())),
402            ),
403            patch(
404                "msgraph.generated.groups.item.group_item_request_builder.GroupItemRequestBuilder.patch",
405                AsyncMock(return_value=MSGroup(id=uid)),
406            ),
407            patch(
408                "msgraph.generated.users.users_request_builder.UsersRequestBuilder.get",
409                AsyncMock(
410                    return_value=UserCollectionResponse(
411                        value=[MSUser(mail=f"{uid}@goauthentik.io", id=uid)]
412                    )
413                ),
414            ) as user_list,
415            patch(
416                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.get",
417                AsyncMock(
418                    return_value=GroupCollectionResponse(
419                        value=[MSGroup(display_name=uid, unique_name=uid, id=uid)]
420                    )
421                ),
422            ) as group_list,
423        ):
424            microsoft_entra_sync.send(self.provider.pk).get_result()
425            self.assertTrue(
426                MicrosoftEntraProviderGroup.objects.filter(
427                    group=different_group, provider=self.provider
428                ).exists()
429            )
430            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
431            user_list.assert_called_once()
432            group_list.assert_called_once()
433
434    def test_sync_discover_multiple(self):
435        """Test group discovery"""
436        uid = generate_id()
437        self.app.backchannel_providers.remove(self.provider)
438        different_group = Group.objects.create(
439            name=uid,
440        )
441        self.app.backchannel_providers.add(self.provider)
442        with (
443            patch(
444                "authentik.enterprise.providers.microsoft_entra.models.MicrosoftEntraProvider.microsoft_credentials",
445                MagicMock(return_value={"credentials": self.creds}),
446            ),
447            patch(
448                "msgraph.generated.organization.organization_request_builder.OrganizationRequestBuilder.get",
449                AsyncMock(
450                    return_value=OrganizationCollectionResponse(
451                        value=[
452                            Organization(verified_domains=[VerifiedDomain(name="goauthentik.io")])
453                        ]
454                    )
455                ),
456            ),
457            patch(
458                "msgraph.generated.users.item.user_item_request_builder.UserItemRequestBuilder.patch",
459                AsyncMock(return_value=MSUser(id=generate_id())),
460            ),
461            patch(
462                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.post",
463                AsyncMock(return_value=MSGroup(id=generate_id())),
464            ),
465            patch(
466                "msgraph.generated.groups.item.group_item_request_builder.GroupItemRequestBuilder.patch",
467                AsyncMock(return_value=MSGroup(id=uid)),
468            ),
469            patch(
470                "msgraph.generated.users.users_request_builder.UsersRequestBuilder.get",
471                AsyncMock(
472                    return_value=UserCollectionResponse(
473                        value=[MSUser(mail=f"{uid}@goauthentik.io", id=uid)]
474                    )
475                ),
476            ) as user_list,
477            patch(
478                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.get",
479                AsyncMock(
480                    return_value=GroupCollectionResponse(
481                        value=[MSGroup(display_name=uid, unique_name=uid, id=uid)]
482                    )
483                ),
484            ) as group_list,
485        ):
486            microsoft_entra_sync.send(self.provider.pk).get_result()
487            self.assertTrue(
488                MicrosoftEntraProviderGroup.objects.filter(
489                    group=different_group, provider=self.provider
490                ).exists()
491            )
492            self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
493            user_list.assert_called_once()
494            group_list.assert_called_once()
495
496            with patch(
497                "msgraph.generated.groups.groups_request_builder.GroupsRequestBuilder.get",
498                AsyncMock(
499                    return_value=GroupCollectionResponse(
500                        value=[
501                            MSGroup(display_name=uid, unique_name=uid, id=uid, description="foo")
502                        ]
503                    )
504                ),
505            ) as mod_group_list:
506                microsoft_entra_sync.send(self.provider.pk).get_result()
507                self.assertTrue(
508                    MicrosoftEntraProviderGroup.objects.filter(
509                        group=different_group, provider=self.provider
510                    ).exists()
511                )
512                self.assertFalse(Event.objects.filter(action=EventAction.SYSTEM_EXCEPTION).exists())
513                mod_group_list.assert_called_once()