Added unit testing

src/customer-key-store/Models/RoleAuthorizer.cs

@@ -20,12 +20,10 @@ public RoleAuthorizer(IConfiguration configuration)
             configuration.ThrowIfNull(nameof(configuration));
 
             ldapPath = configuration["RoleAuthorizer:LDAPPath"];
-        }
-
-        public static string GetRole(string memberOf)
-        {
-            memberOf.ThrowIfNull(nameof(memberOf));
-            return ParseCN(memberOf);
+            if(ldapPath == null)
+            {
+                throw new System.ArgumentException("LDAPPath is required");
+            }
         }
 
         public void AddRole(string role)
@@ -37,38 +35,22 @@ public void CanUserAccessKey(string sid)
         {
             sid.ThrowIfNull(nameof(sid));
 
-            using(DirectoryEntry entry = new DirectoryEntry("LDAP://" + ldapPath))
+            bool success = false;
+            foreach(var member in GetMembersOfFromSID(sid))
             {
-                using(DirectorySearcher dSearch = new DirectorySearcher(entry))
+                //Split out the first part of the role to the comma
+                var role = ParseCN(member);
+                if(!string.IsNullOrEmpty(role) && roles.Contains(role))
                 {
-                    dSearch.Filter = "(objectSid=" + sid + ")";
-
-                    var result = dSearch.FindOne();
-
-                    if(result == null)
-                    {
-                        throw new System.ArgumentException("User not found");
-                    }
-
-                    var memberof = result.Properties[RoleProperty];
-                    bool success = false;
-                    foreach(var member in memberof)
-                    {
-                        //Split out the first part of the role to the comma
-                        var role = GetRole(member.ToString());
-                        if(!string.IsNullOrEmpty(role) && roles.Contains(role))
-                        {
-                            success = true;
-                            break;
-                        }
-                    }
-
-                    if(!success)
-                    {
-                        throw new CustomerKeyStore.Models.KeyAccessException("User does not have access to the key");
-                    }
+                    success = true;
+                    break;
                 }
             }
+
+            if(!success)
+            {
+                throw new CustomerKeyStore.Models.KeyAccessException("User does not have access to the key");
+            }
         }
 
         public void CanUserAccessKey(ClaimsPrincipal user, KeyStoreData key)
@@ -94,7 +76,7 @@ public void CanUserAccessKey(ClaimsPrincipal user, KeyStoreData key)
             CanUserAccessKey(sid);
         }
 
-        private static string ParseCN(string distinguishedName)
+        protected static string ParseCN(string distinguishedName)
         {
             distinguishedName.ThrowIfNull(nameof(distinguishedName));
 
@@ -139,5 +121,34 @@ private static string ParseCN(string distinguishedName)
 
             return role.ToString();
         }
+
+        protected virtual IEnumerable<string> GetMembersOfFromSID(string sid)
+        {
+            sid.ThrowIfNull(nameof(sid));
+            List<string> membersOf = new List<string>();
+
+            using(DirectoryEntry entry = new DirectoryEntry("LDAP://" + ldapPath))
+            {
+                using(DirectorySearcher dSearch = new DirectorySearcher(entry))
+                {
+                    dSearch.Filter = "(objectSid=" + sid + ")";
+
+                    var result = dSearch.FindOne();
+
+                    if(result == null)
+                    {
+                        throw new System.ArgumentException("User not found");
+                    }
+
+                    var memberof = result.Properties[RoleProperty];
+                    foreach(var member in memberof)
+                    {
+                        membersOf.Add(member.ToString());
+                    }
+                }
+            }
+
+            return membersOf;
+        }
     }
 }

src/test/customerkeystoretest/ConfigurationMock.cs

@@ -0,0 +1,29 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+namespace Customerkeystoretest
+{
+    using System.Collections.Generic;
+    using Microsoft.Extensions.Configuration;
+
+    public class ConfigurationMock : Microsoft.Extensions.Configuration.IConfiguration
+    {
+        private Dictionary<string, string> properties = new Dictionary<string, string>();
+        public string this[string key]
+        { 
+            get { return properties.ContainsKey(key) ? properties[key] : null; }
+            set { properties[key] = value; }
+        }
+        public IEnumerable<IConfigurationSection> GetChildren()
+        {
+            throw new System.NotImplementedException();
+        }
+        public Microsoft.Extensions.Primitives.IChangeToken GetReloadToken()
+        {
+            throw new System.NotImplementedException();
+        }
+        public IConfigurationSection GetSection(string key)
+        {
+            throw new System.NotImplementedException();
+        }
+    }
+}

src/test/customerkeystoretest/EmailAuthorizerTests.cs

@@ -0,0 +1,70 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+namespace Customerkeystoretest
+{
+    using System.Collections.Generic;
+    using System.Security.Claims;
+    using Xunit;
+
+    using Microsoft.InformationProtection.Web.Models;
+    public class EmailAuthorizerTests
+    {
+        [Fact]
+        public void NoClaims_Fail()
+        {
+            EmailAuthorizer auth = new EmailAuthorizer();
+            ClaimsPrincipal principal = new ClaimsPrincipal();
+            Assert.Throws<System.ArgumentException>(() => auth.CanUserAccessKey(principal, null));
+        }
+
+        [Theory]
+        [InlineData(ClaimTypes.Email)]
+        [InlineData(ClaimTypes.Upn)]
+        public void NoValidEmails_Fail(string claimType)
+        {
+            EmailAuthorizer auth = new EmailAuthorizer();
+            ClaimsPrincipal principal = new ClaimsPrincipal();
+            ClaimsIdentity identity = new ClaimsIdentity(new List<Claim>(){new Claim(claimType, "[email protected]")});
+            principal.AddIdentity(identity);
+            Assert.Throws<CustomerKeyStore.Models.KeyAccessException>(() => auth.CanUserAccessKey(principal, null));
+        }
+
+        [Theory]
+        [InlineData(ClaimTypes.Email)]
+        [InlineData(ClaimTypes.Upn)]
+        public void ValidEmail_OneEmail_Success(string claimType)
+        {
+            EmailAuthorizer auth = new EmailAuthorizer();
+            auth.AddEmail("[email protected]");
+            ClaimsPrincipal principal = new ClaimsPrincipal();
+            ClaimsIdentity identity = new ClaimsIdentity(new List<Claim>(){new Claim(claimType, "[email protected]")});
+            principal.AddIdentity(identity);
+            auth.CanUserAccessKey(principal, null);
+        }
+
+        [Theory]
+        [InlineData(ClaimTypes.Email)]
+        [InlineData(ClaimTypes.Upn)]
+        public void ValidEmail_ManyEmails_Success(string claimType)
+        {
+            EmailAuthorizer auth = new EmailAuthorizer();
+            auth.AddEmail("[email protected]");
+            auth.AddEmail("[email protected]");
+            auth.AddEmail("[email protected]");
+            ClaimsPrincipal principalUser1 = new ClaimsPrincipal();
+            ClaimsIdentity identityUser1 = new ClaimsIdentity(new List<Claim>(){new Claim(claimType, "[email protected]")});
+            principalUser1.AddIdentity(identityUser1);
+            auth.CanUserAccessKey(principalUser1, null);
+
+            ClaimsPrincipal principalUser2 = new ClaimsPrincipal();
+            ClaimsIdentity identityUser2 = new ClaimsIdentity(new List<Claim>(){new Claim(claimType, "[email protected]")});
+            principalUser2.AddIdentity(identityUser2);
+            auth.CanUserAccessKey(principalUser2, null);
+
+            ClaimsPrincipal principalUser3 = new ClaimsPrincipal();
+            ClaimsIdentity identityUser3 = new ClaimsIdentity(new List<Claim>(){new Claim(claimType, "[email protected]")});
+            principalUser3.AddIdentity(identityUser3);
+            auth.CanUserAccessKey(principalUser3, null);
+        }
+    }
+}