6 files changed, 147 insertions, 0 deletions
diff --git a/apps/files_external/tests/sso-setup/apps.config.php b/apps/files_external/tests/sso-setup/apps.config.php
new file mode 100644
index 00000000000..b3889956a53
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/apps.config.php
@@ -0,0 +1,20 @@
+<?php
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+$CONFIG = [
+	'apps_paths' => [
+		[
+			'path' => '/var/www/html/apps',
+			'url' => '/apps',
+			'writable' => false,
+		],
+		[
+			'path' => '/var/www/html/extra-apps',
+			'url' => '/extra-apps',
+			'writable' => true,
+		],
+	],
+];
diff --git a/apps/files_external/tests/sso-setup/client-cmd.sh b/apps/files_external/tests/sso-setup/client-cmd.sh
new file mode 100755
index 00000000000..38b50bada67
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/client-cmd.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+
+DC_IP=$1
+shift
+
+docker run --rm --name client -v /tmp/shared:/shared --dns $DC_IP --hostname client.domain.test icewind1991/samba-krb-test-client $@
diff --git a/apps/files_external/tests/sso-setup/setup-sso-nc.sh b/apps/files_external/tests/sso-setup/setup-sso-nc.sh
new file mode 100755
index 00000000000..d0029ea684e
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/setup-sso-nc.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+
+set -e
+
+docker exec --user 33 apache ./occ maintenance:install --verbose --database=sqlite --database-name=nextcloud --database-host=127.0.0.1 --database-user=root --database-pass=rootpassword --admin-user admin --admin-pass password
+docker exec --user 33 apache ./occ config:system:set trusted_domains 1 --value 'httpd.domain.test'
+
+# setup user_saml
+docker exec --user 33 apache ./occ app:enable user_saml --force
+docker exec --user 33 apache ./occ config:app:set user_saml type --value 'environment-variable'
+docker exec --user 33 apache ./occ saml:config:create
+docker exec --user 33 apache ./occ saml:config:set 1 --general-uid_mapping=REMOTE_USER
+
+# create user
+docker exec -e OC_PASS=test --user 33 apache ./occ user:add 'testuser@DOMAIN.TEST' --password-from-env
+
+# setup external storage
+docker exec --user 33 apache ./occ app:enable files_external --force
+docker exec --user 33 apache ./occ files_external:create smb smb smb::kerberosapache
+docker exec --user 33 apache ./occ files_external:config 1 host krb.domain.test
+docker exec --user 33 apache ./occ files_external:config 1 share netlogon
+docker exec --user 33 apache ./occ files_external:list
diff --git a/apps/files_external/tests/sso-setup/start-apache.sh b/apps/files_external/tests/sso-setup/start-apache.sh
new file mode 100755
index 00000000000..58ad71e3a3a
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/start-apache.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+
+set -e
+
+SCRIPT_DIR="${0%/*}"
+
+docker rm -f apache 2>/dev/null > /dev/null
+
+docker run -d --name apache -v $2:/var/www/html -v /var/www/html/data -v /var/www/html/config -v /var/www/html/extra-apps -v /tmp/shared:/shared --dns $1 --hostname httpd.domain.test icewind1991/samba-krb-test-apache 1>&2
+APACHE_IP=$(docker inspect apache --format '{{.NetworkSettings.IPAddress}}')
+docker exec apache chown 33 /var/www/html/config /var/www/html/data /var/www/html/extra-apps
+docker cp "$SCRIPT_DIR/apps.config.php" apache:/var/www/html/config/apps.config.php
+
+# ensure that samba is started (see https://github.com/icewind1991/samba-krb-test/pull/8)
+docker exec dc service samba-ad-dc status || docker exec dc service samba-ad-dc start
+
+# add the dns record for apache
+docker exec dc samba-tool dns add krb.domain.test domain.test httpd A $APACHE_IP -U administrator --password=passwOrd1 1>&2
+
+echo $APACHE_IP
diff --git a/apps/files_external/tests/sso-setup/start-dc.sh b/apps/files_external/tests/sso-setup/start-dc.sh
new file mode 100755
index 00000000000..c08b49477b3
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/start-dc.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+
+set -e
+
+function getContainerHealth {
+  docker inspect --format "{{.State.Health.Status}}" $1
+}
+
+function waitContainer {
+  while STATUS=$(getContainerHealth $1); [ $STATUS != "healthy" ]; do
+    if [ $STATUS == "unhealthy" ]; then
+      echo "Failed!" 1>&2
+      exit -1
+    fi
+    printf . 1>&2
+    lf=$'\n'
+    sleep 1
+  done
+  printf "$lf" 1>&2
+}
+
+docker rm -f dc 2>/dev/null > /dev/null
+
+mkdir -p /tmp/shared
+
+# start the dc
+docker run -dit --name dc -v /tmp/shared:/shared --hostname krb.domain.test --cap-add SYS_ADMIN icewind1991/samba-krb-test-dc 1>&2
+
+waitContainer dc
+
+docker inspect dc --format '{{.NetworkSettings.IPAddress}}'
diff --git a/apps/files_external/tests/sso-setup/test-sso-smb.sh b/apps/files_external/tests/sso-setup/test-sso-smb.sh
new file mode 100755
index 00000000000..46955ae0d3c
--- /dev/null
+++ b/apps/files_external/tests/sso-setup/test-sso-smb.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+#
+# SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+
+set -e
+
+DC_IP="$1"
+SCRIPT_DIR="${0%/*}"
+
+echo -n "Checking that we can authenticate using kerberos: "
+LOGIN_CONTENT=$("$SCRIPT_DIR/client-cmd.sh" $DC_IP curl -i -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/index.php/apps/user_saml/saml/login?originalUrl=http://localhost/success)
+
+if [[ "$LOGIN_CONTENT" =~ "Location: http://localhost/success" ]]; then
+  echo "✔️"
+else
+  echo "❌"
+  echo "$CONTENT"
+  exit 1
+fi
+echo -n "Getting test file: "
+CONTENT=$("$SCRIPT_DIR/client-cmd.sh" $DC_IP curl -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/remote.php/webdav/smb/test.txt)
+CONTENT=$(echo $CONTENT | head -n 1 | tr -d '[:space:]')
+
+if [[ $CONTENT == "testfile" ]]; then
+  echo "✔️"
+else
+  echo "❌"
+  echo "$CONTENT"
+  exit 1
+fi