Skip to content

Testing

Functional tests cannot rely on real NTLM/Kerberos. This project ships a test module that fakes the identity source and LDAP bridge.

Test module: ldap_sso_dummy_ldap

Path: tests/modules/ldap_sso_dummy_ldap/

It overrides:

Service Test class Behavior
ldap_sso.server_variable Drupal\ldap_sso_dummy_ldap\ServerVariableLookup Returns hpotter when the URI contains /user/login/sso
ldap.bridge Drupal\ldap_sso_dummy_ldap\FakeBridgeFunctional Fake LDAP connectivity for browser tests

Enable it only in tests (listed in LdapSsoBrowserTest::$modules).

Browser test: LdapSsoBrowserTest

Path: tests/src/Functional/LdapSsoBrowserTest.php

Coverage includes:

  • Seamless redirect exclusions (/user/login, sso_stop cookie)
  • Configurable path exclusions (/node/*, leading wildcards such as *sites/default/files/*, <front>, and a non-match control that still seamless-redirects)
  • Seamless disabled (no redirect)
  • Seamless login success message and destination
  • Language-prefix destinations

The test class notes an inherent limitation: a real mixed setup sets REMOTE_USER only on /user/login/sso, while the dummy module simulates that at the application layer. Redirect-with-cookie behavior is still exercised because that path has historically caused loops.

Running tests

From a Drupal test environment with LDAP dependencies available:

./vendor/bin/phpunit -c phpunit.xml.dist tests/src/Functional/LdapSsoBrowserTest.php

Or via your project’s usual DrupalCI / GitLab CI job for this module.

Pattern for custom tests

  1. Enable ldap_sso plus LDAP and externalauth dependencies.
  2. Override ldap_sso.server_variable (or reuse ldap_sso_dummy_ldap).
  3. Provide a fake or stub LDAP server/bridge so LoginValidatorSso can resolve an account.
  4. Assert redirects, cookies, and final authenticated UID—not the web server’s auth module.