/*
 * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
 * or more contributor license agreements. Licensed under the Elastic License;
 * you may not use this file except in compliance with the Elastic License.
 */
package org.elasticsearch.xpack.security.authc.ldap;

import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.common.unit.TimeValue;
import org.elasticsearch.xpack.security.support.NoOpLogger;
import org.elasticsearch.test.junit.annotations.Network;

import java.util.List;

import static org.hamcrest.Matchers.containsInAnyOrder;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.empty;
import static org.hamcrest.Matchers.hasItems;

@Network
public class UserAttributeGroupsResolverTests extends GroupsResolverTestCase {

    public static final String BRUCE_BANNER_DN = "cn=Bruce Banner,CN=Users,DC=ad,DC=test,DC=elasticsearch,DC=com";

    public void testResolve() throws Exception {
        //falling back on the 'memberOf' attribute
        UserAttributeGroupsResolver resolver = new UserAttributeGroupsResolver(Settings.EMPTY);
        List<String> groups =
                resolveBlocking(resolver, ldapConnection, BRUCE_BANNER_DN, TimeValue.timeValueSeconds(20), NoOpLogger.INSTANCE, null);
        assertThat(groups, containsInAnyOrder(
                containsString("Avengers"),
                containsString("SHIELD"),
                containsString("Geniuses"),
                containsString("Philanthropists")));
    }

    public void testResolveCustomGroupAttribute() throws Exception {
        Settings settings = Settings.builder()
                .put("user_group_attribute", "seeAlso")
                .build();
        UserAttributeGroupsResolver resolver = new UserAttributeGroupsResolver(settings);
        List<String> groups =
                resolveBlocking(resolver, ldapConnection, BRUCE_BANNER_DN, TimeValue.timeValueSeconds(20), NoOpLogger.INSTANCE, null);
        assertThat(groups, hasItems(containsString("Avengers")));  //seeAlso only has Avengers
    }

    public void testResolveInvalidGroupAttribute() throws Exception {
        Settings settings = Settings.builder()
                .put("user_group_attribute", "doesntExist")
                .build();
        UserAttributeGroupsResolver resolver = new UserAttributeGroupsResolver(settings);
        List<String> groups =
                resolveBlocking(resolver, ldapConnection, BRUCE_BANNER_DN, TimeValue.timeValueSeconds(20), NoOpLogger.INSTANCE, null);
        assertThat(groups, empty());
    }

    @Override
    protected String ldapUrl() {
        return ActiveDirectorySessionFactoryTests.AD_LDAP_URL;
    }

    @Override
    protected String bindDN() {
        return BRUCE_BANNER_DN;
    }

    @Override
    protected String bindPassword() {
        return ActiveDirectorySessionFactoryTests.PASSWORD;
    }
}
@@ -289,16 +289,145 @@
 .ldap;%0A%0A
+import com.unboundid.ldap.sdk.Attribute;%0Aimport com.unboundid.ldap.sdk.SearchRequest;%0Aimport com.unboundid.ldap.sdk.SearchScope;%0A
 import o
@@ -517,16 +517,86 @@
 eValue;%0A
+import org.elasticsearch.xpack.security.authc.ldap.support.LdapUtils;%0A
 import o
@@ -705,16 +705,45 @@
 twork;%0A%0A
+import java.util.Collection;%0A
 import j
@@ -1751,32 +1751,856 @@
 sts%22)));%0A    %7D%0A%0A
+    public void testResolveFromPreloadedAttributes() throws Exception %7B%0A        SearchRequest preSearch = new SearchRequest(BRUCE_BANNER_DN, SearchScope.BASE, LdapUtils.OBJECT_CLASS_PRESENCE_FILTER, %22memberOf%22);%0A        final Collection%3CAttribute%3E attributes = ldapConnection.searchForEntry(preSearch).getAttributes();%0A%0A        UserAttributeGroupsResolver resolver = new UserAttributeGroupsResolver(Settings.EMPTY);%0A        List%3CString%3E groups =%0A                resolveBlocking(resolver, ldapConnection, BRUCE_BANNER_DN, TimeValue.timeValueSeconds(20), NoOpLogger.INSTANCE, attributes);%0A        assertThat(groups, containsInAnyOrder(%0A                containsString(%22Avengers%22),%0A                containsString(%22SHIELD%22),%0A                containsString(%22Geniuses%22),%0A                containsString(%22Philanthropists%22)));%0A    %7D%0A%0A
     public void 
@@ -3961,8 +3961,9 @@
 %0A    %7D%0A%7D
+%0A

Test resolving ldap groups with preloaded attributes (elastic/elasticsearch#4530)