authentik.sources.scim.tests.test_users_patch

  1from rest_framework.test import APITestCase
  2
  3from authentik.core.tests.utils import create_test_user
  4from authentik.lib.generators import generate_id
  5from authentik.sources.scim.constants import SCIM_URN_USER_ENTERPRISE
  6from authentik.sources.scim.models import SCIMSource, SCIMSourceUser
  7from authentik.sources.scim.patch.processor import SCIMPatchProcessor
  8
  9
 10class TestSCIMUsersPatch(APITestCase):
 11    """Test SCIM User Patch"""
 12
 13    def test_add(self):
 14        req = {
 15            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
 16            "Operations": [
 17                {"op": "Add", "path": "name.givenName", "value": "aqwer"},
 18                {"op": "Add", "path": "name.familyName", "value": "qwerqqqq"},
 19                {"op": "Add", "path": "name.formatted", "value": "aqwer qwerqqqq"},
 20            ],
 21        }
 22        user = create_test_user()
 23        source = SCIMSource.objects.create(slug=generate_id())
 24        connection = SCIMSourceUser.objects.create(
 25            user=user,
 26            id=generate_id(),
 27            source=source,
 28            attributes={
 29                "meta": {"resourceType": "User"},
 30                "active": True,
 31                "schemas": [
 32                    "urn:ietf:params:scim:schemas:core:2.0:User",
 33                    SCIM_URN_USER_ENTERPRISE,
 34                ],
 35                "userName": "test@t.goauthentik.io",
 36                "externalId": "test",
 37                "displayName": "Test MS",
 38            },
 39        )
 40        updated = SCIMPatchProcessor().apply_patches(connection.attributes, req["Operations"])
 41        self.assertEqual(
 42            updated,
 43            {
 44                "meta": {"resourceType": "User"},
 45                "active": True,
 46                "name": {
 47                    "givenName": "aqwer",
 48                    "familyName": "qwerqqqq",
 49                    "formatted": "aqwer qwerqqqq",
 50                },
 51                "schemas": [
 52                    "urn:ietf:params:scim:schemas:core:2.0:User",
 53                    SCIM_URN_USER_ENTERPRISE,
 54                ],
 55                "userName": "test@t.goauthentik.io",
 56                "externalId": "test",
 57                "displayName": "Test MS",
 58            },
 59        )
 60
 61    def test_add_no_path(self):
 62        """Test add patch with no path set"""
 63        req = {
 64            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
 65            "Operations": [
 66                {"op": "Add", "value": {"externalId": "aqwer"}},
 67            ],
 68        }
 69        user = create_test_user()
 70        source = SCIMSource.objects.create(slug=generate_id())
 71        connection = SCIMSourceUser.objects.create(
 72            user=user,
 73            id=generate_id(),
 74            source=source,
 75            attributes={
 76                "meta": {"resourceType": "User"},
 77                "active": True,
 78                "schemas": [
 79                    "urn:ietf:params:scim:schemas:core:2.0:User",
 80                    SCIM_URN_USER_ENTERPRISE,
 81                ],
 82                "userName": "test@t.goauthentik.io",
 83                "displayName": "Test MS",
 84            },
 85        )
 86        updated = SCIMPatchProcessor().apply_patches(connection.attributes, req["Operations"])
 87        self.assertEqual(
 88            updated,
 89            {
 90                "meta": {"resourceType": "User"},
 91                "active": True,
 92                "schemas": [
 93                    "urn:ietf:params:scim:schemas:core:2.0:User",
 94                    SCIM_URN_USER_ENTERPRISE,
 95                ],
 96                "userName": "test@t.goauthentik.io",
 97                "externalId": "aqwer",
 98                "displayName": "Test MS",
 99            },
100        )
101
102    def test_replace(self):
103        req = {
104            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
105            "Operations": [
106                {"op": "Replace", "path": "name", "value": {"givenName": "aqwer"}},
107            ],
108        }
109        user = create_test_user()
110        source = SCIMSource.objects.create(slug=generate_id())
111        connection = SCIMSourceUser.objects.create(
112            user=user,
113            id=generate_id(),
114            source=source,
115            attributes={
116                "meta": {"resourceType": "User"},
117                "active": True,
118                "schemas": [
119                    "urn:ietf:params:scim:schemas:core:2.0:User",
120                    SCIM_URN_USER_ENTERPRISE,
121                ],
122                "userName": "test@t.goauthentik.io",
123                "externalId": "test",
124                "displayName": "Test MS",
125            },
126        )
127        updated = SCIMPatchProcessor().apply_patches(connection.attributes, req["Operations"])
128        self.assertEqual(
129            updated,
130            {
131                "meta": {"resourceType": "User"},
132                "active": True,
133                "name": {
134                    "givenName": "aqwer",
135                },
136                "schemas": [
137                    "urn:ietf:params:scim:schemas:core:2.0:User",
138                    SCIM_URN_USER_ENTERPRISE,
139                ],
140                "userName": "test@t.goauthentik.io",
141                "externalId": "test",
142                "displayName": "Test MS",
143            },
144        )
145
146    def test_replace_no_path(self):
147        """Test value replace with no path"""
148        req = {
149            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
150            "Operations": [
151                {"op": "Replace", "value": {"externalId": "aqwer"}},
152            ],
153        }
154        user = create_test_user()
155        source = SCIMSource.objects.create(slug=generate_id())
156        connection = SCIMSourceUser.objects.create(
157            user=user,
158            id=generate_id(),
159            source=source,
160            attributes={
161                "meta": {"resourceType": "User"},
162                "active": True,
163                "schemas": [
164                    "urn:ietf:params:scim:schemas:core:2.0:User",
165                    SCIM_URN_USER_ENTERPRISE,
166                ],
167                "userName": "test@t.goauthentik.io",
168                "externalId": "test",
169                "displayName": "Test MS",
170            },
171        )
172        updated = SCIMPatchProcessor().apply_patches(connection.attributes, req["Operations"])
173        self.assertEqual(
174            updated,
175            {
176                "meta": {"resourceType": "User"},
177                "active": True,
178                "schemas": [
179                    "urn:ietf:params:scim:schemas:core:2.0:User",
180                    SCIM_URN_USER_ENTERPRISE,
181                ],
182                "userName": "test@t.goauthentik.io",
183                "externalId": "aqwer",
184                "displayName": "Test MS",
185            },
186        )
187
188    def test_remove(self):
189        req = {
190            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
191            "Operations": [
192                {"op": "Remove", "path": "name", "value": {"givenName": "aqwer"}},
193            ],
194        }
195        user = create_test_user()
196        source = SCIMSource.objects.create(slug=generate_id())
197        connection = SCIMSourceUser.objects.create(
198            user=user,
199            id=generate_id(),
200            source=source,
201            attributes={
202                "meta": {"resourceType": "User"},
203                "active": True,
204                "name": {
205                    "givenName": "aqwer",
206                },
207                "schemas": [
208                    "urn:ietf:params:scim:schemas:core:2.0:User",
209                    SCIM_URN_USER_ENTERPRISE,
210                ],
211                "userName": "test@t.goauthentik.io",
212                "externalId": "test",
213                "displayName": "Test MS",
214            },
215        )
216        updated = SCIMPatchProcessor().apply_patches(connection.attributes, req["Operations"])
217        self.assertEqual(
218            updated,
219            {
220                "meta": {"resourceType": "User"},
221                "active": True,
222                "schemas": [
223                    "urn:ietf:params:scim:schemas:core:2.0:User",
224                    SCIM_URN_USER_ENTERPRISE,
225                ],
226                "userName": "test@t.goauthentik.io",
227                "externalId": "test",
228                "displayName": "Test MS",
229            },
230        )
231
232    def test_large(self):
233        """Large amount of patch operations"""
234        req = {
235            "Operations": [
236                {
237                    "op": "replace",
238                    "path": "emails[primary eq true].value",
239                    "value": "dandre_kling@wintheiser.info",
240                },
241                {
242                    "op": "replace",
243                    "path": "phoneNumbers[primary eq true].value",
244                    "value": "72-634-1548",
245                },
246                {
247                    "op": "replace",
248                    "path": "phoneNumbers[primary eq true].display",
249                    "value": "72-634-1548",
250                },
251                {"op": "replace", "path": "ims[primary eq true].value", "value": "GXSGJKWGHVVS"},
252                {"op": "replace", "path": "ims[primary eq true].display", "value": "IMCHDKUQIPYB"},
253                {
254                    "op": "replace",
255                    "path": "photos[primary eq true].display",
256                    "value": "TWAWLHHSUNIV",
257                },
258                {
259                    "op": "replace",
260                    "path": "addresses[primary eq true].formatted",
261                    "value": "TMINZQAJQDCL",
262                },
263                {
264                    "op": "replace",
265                    "path": "addresses[primary eq true].streetAddress",
266                    "value": "081 Wisoky Key",
267                },
268                {
269                    "op": "replace",
270                    "path": "addresses[primary eq true].locality",
271                    "value": "DPFASBZRPMDP",
272                },
273                {
274                    "op": "replace",
275                    "path": "addresses[primary eq true].region",
276                    "value": "WHSTJSPIPTCF",
277                },
278                {
279                    "op": "replace",
280                    "path": "addresses[primary eq true].postalCode",
281                    "value": "ko28 1qa",
282                },
283                {"op": "replace", "path": "addresses[primary eq true].country", "value": "Taiwan"},
284                {
285                    "op": "replace",
286                    "path": "entitlements[primary eq true].value",
287                    "value": "NGBJMUYZVVBX",
288                },
289                {"op": "replace", "path": "roles[primary eq true].value", "value": "XEELVFMMWCVM"},
290                {
291                    "op": "replace",
292                    "path": "x509Certificates[primary eq true].value",
293                    "value": "UYISMEDOXUZY",
294                },
295                {
296                    "op": "replace",
297                    "value": {
298                        "externalId": "7faaefb0-0774-4d8e-8f6d-863c361bc72c",
299                        "name.formatted": "Dell",
300                        "name.familyName": "Gay",
301                        "name.givenName": "Kyler",
302                        "name.middleName": "Hannah",
303                        "name.honorificPrefix": "Cassie",
304                        "name.honorificSuffix": "Yolanda",
305                        "displayName": "DPRLIJSFQMTL",
306                        "nickName": "BKSPMIRMFBTI",
307                        "title": "NBZCOAXVYJUY",
308                        "userType": "ZGJMYZRUORZE",
309                        "preferredLanguage": "as-IN",
310                        "locale": "JLOJHLPWZODG",
311                        "timezone": "America/Argentina/Rio_Gallegos",
312                        "active": True,
313                        f"{SCIM_URN_USER_ENTERPRISE}:employeeNumber": "PDFWRRZBQOHB",
314                        f"{SCIM_URN_USER_ENTERPRISE}:costCenter": "HACMZWSEDOTQ",
315                        f"{SCIM_URN_USER_ENTERPRISE}:organization": "LXVHJUOLNCLS",
316                        f"{SCIM_URN_USER_ENTERPRISE}:division": "JASVTPKPBPMG",
317                        f"{SCIM_URN_USER_ENTERPRISE}:department": "GMSBFLMNPABY",
318                    },
319                },
320            ],
321            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
322        }
323        user = create_test_user()
324        source = SCIMSource.objects.create(slug=generate_id())
325        connection = SCIMSourceUser.objects.create(
326            user=user,
327            id=generate_id(),
328            source=source,
329            attributes={
330                "active": True,
331                "addresses": [
332                    {
333                        "primary": "true",
334                        "formatted": "BLJMCNXHYLZK",
335                        "streetAddress": "7801 Jacobs Fork",
336                        "locality": "HZJBJWFAKXDD",
337                        "region": "GJXCXPMIIKWK",
338                        "postalCode": "pv82 8ua",
339                        "country": "India",
340                    }
341                ],
342                "displayName": "KEFXCHKHAFOT",
343                "emails": [{"primary": "true", "value": "scot@zemlak.uk"}],
344                "entitlements": [{"primary": "true", "value": "FTTUXWYDAAQC"}],
345                "externalId": "448d2786-7bf6-4e03-a4ef-64cbaf162fa7",
346                "ims": [{"primary": "true", "value": "IGWZUUMCMKXS", "display": "PJVGMMKYYHRU"}],
347                "locale": "PJNYJHWJILTI",
348                "name": {
349                    "formatted": "Ladarius",
350                    "familyName": "Manley",
351                    "givenName": "Mazie",
352                    "middleName": "Vernon",
353                    "honorificPrefix": "Melyssa",
354                    "honorificSuffix": "Demarcus",
355                },
356                "nickName": "HTPKOXMWZKHL",
357                "phoneNumbers": [
358                    {"primary": "true", "value": "50-608-7660", "display": "50-608-7660"}
359                ],
360                "photos": [{"primary": "true", "display": "KCONLNLSYTBP"}],
361                "preferredLanguage": "wae",
362                "profileUrl": "HPSEOIPXMGOH",
363                "roles": [{"primary": "true", "value": "TLGYITOIZGKP"}],
364                "schemas": [
365                    "urn:ietf:params:scim:schemas:core:2.0:User",
366                    SCIM_URN_USER_ENTERPRISE,
367                ],
368                "timezone": "America/Indiana/Petersburg",
369                "title": "EJWFXLHNHMCD",
370                SCIM_URN_USER_ENTERPRISE: {
371                    "employeeNumber": "XHDMEJUURJNR",
372                    "costCenter": "RXUYBXOTRCZH",
373                    "organization": "CEXWXMBRYAHN",
374                    "division": "XMPFMDCLRKCW",
375                    "department": "BKMNJVMCJUYS",
376                    "manager": "PNGSGXLYVWMV",
377                },
378                "userName": "imelda.auer@kshlerin.co.uk",
379                "userType": "PZFXORVSUAPU",
380                "x509Certificates": [{"primary": "true", "value": "KOVKWGIVVEHH"}],
381            },
382        )
383        updated = SCIMPatchProcessor().apply_patches(connection.attributes, req["Operations"])
384        self.assertEqual(
385            updated,
386            {
387                "active": True,
388                "addresses": [
389                    {
390                        "primary": "true",
391                        "formatted": "BLJMCNXHYLZK",
392                        "streetAddress": "7801 Jacobs Fork",
393                        "locality": "HZJBJWFAKXDD",
394                        "region": "GJXCXPMIIKWK",
395                        "postalCode": "pv82 8ua",
396                        "country": "India",
397                    }
398                ],
399                "displayName": "DPRLIJSFQMTL",
400                "emails": [{"primary": "true", "value": "scot@zemlak.uk"}],
401                "entitlements": [{"primary": "true", "value": "FTTUXWYDAAQC"}],
402                "externalId": "7faaefb0-0774-4d8e-8f6d-863c361bc72c",
403                "ims": [{"primary": "true", "value": "IGWZUUMCMKXS", "display": "PJVGMMKYYHRU"}],
404                "locale": "JLOJHLPWZODG",
405                "name": {
406                    "formatted": "Dell",
407                    "familyName": "Gay",
408                    "givenName": "Kyler",
409                    "middleName": "Hannah",
410                    "honorificPrefix": "Cassie",
411                    "honorificSuffix": "Yolanda",
412                },
413                "nickName": "BKSPMIRMFBTI",
414                "phoneNumbers": [
415                    {"primary": "true", "value": "50-608-7660", "display": "50-608-7660"}
416                ],
417                "photos": [{"primary": "true", "display": "KCONLNLSYTBP"}],
418                "preferredLanguage": "as-IN",
419                "profileUrl": "HPSEOIPXMGOH",
420                "roles": [{"primary": "true", "value": "TLGYITOIZGKP"}],
421                "schemas": [
422                    "urn:ietf:params:scim:schemas:core:2.0:User",
423                    SCIM_URN_USER_ENTERPRISE,
424                ],
425                "timezone": "America/Argentina/Rio_Gallegos",
426                "title": "NBZCOAXVYJUY",
427                SCIM_URN_USER_ENTERPRISE: {
428                    "employeeNumber": "PDFWRRZBQOHB",
429                    "costCenter": "HACMZWSEDOTQ",
430                    "organization": "LXVHJUOLNCLS",
431                    "division": "JASVTPKPBPMG",
432                    "department": "GMSBFLMNPABY",
433                    "manager": "PNGSGXLYVWMV",
434                },
435                "userName": "imelda.auer@kshlerin.co.uk",
436                "userType": "ZGJMYZRUORZE",
437                "x509Certificates": [{"primary": "true", "value": "KOVKWGIVVEHH"}],
438            },
439        )
440
441    def test_schema_urn_manager(self):
442        req = {
443            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
444            "Operations": [
445                {
446                    "op": "Add",
447                    "value": {
448                        "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager": "foo"
449                    },
450                },
451            ],
452        }
453        user = create_test_user()
454        source = SCIMSource.objects.create(slug=generate_id())
455        connection = SCIMSourceUser.objects.create(
456            user=user,
457            id=generate_id(),
458            source=source,
459            attributes={
460                "meta": {"resourceType": "User"},
461                "active": True,
462                "schemas": [
463                    "urn:ietf:params:scim:schemas:core:2.0:User",
464                    SCIM_URN_USER_ENTERPRISE,
465                ],
466                "userName": "test@t.goauthentik.io",
467                "externalId": "test",
468                "displayName": "Test MS",
469            },
470        )
471        updated = SCIMPatchProcessor().apply_patches(connection.attributes, req["Operations"])
472        self.assertEqual(
473            updated,
474            {
475                "meta": {"resourceType": "User"},
476                "active": True,
477                "schemas": [
478                    "urn:ietf:params:scim:schemas:core:2.0:User",
479                    SCIM_URN_USER_ENTERPRISE,
480                ],
481                "userName": "test@t.goauthentik.io",
482                "externalId": "test",
483                "displayName": "Test MS",
484                "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
485                    "manager": {"value": "foo"}
486                },
487            },
488        )