System: Access: Tester: convert to MVC

plist

@@ -169,13 +169,16 @@
 /usr/local/opnsense/mvc/app/config/loader.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/Api/GroupController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/Api/PrivController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/Api/TesterController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/Api/UserController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/GroupController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/PrivController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/TesterController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/UserController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/forms/dialogGroup.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/forms/dialogPriv.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/forms/dialogUser.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Auth/forms/tester.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiMutableModelControllerBase.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Base/ApiMutableServiceControllerBase.php
@@ -980,6 +983,7 @@
 /usr/local/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml
 /usr/local/opnsense/mvc/app/views/OPNsense/Auth/group.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Auth/priv.volt
+/usr/local/opnsense/mvc/app/views/OPNsense/Auth/tester.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Auth/user.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/CaptivePortal/clients.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/CaptivePortal/index.volt
@@ -2585,7 +2589,6 @@
 /usr/local/www/authgui.inc
 /usr/local/www/crash_reporter.php
 /usr/local/www/csrf.inc
-/usr/local/www/diag_authentication.php
 /usr/local/www/diag_backup.php
 /usr/local/www/fbegin.inc
 /usr/local/www/firewall_nat_out.php

src/opnsense/mvc/app/controllers/OPNsense/Auth/Api/TesterController.php

@@ -0,0 +1,151 @@
+<?php
+
+/*
+ * Copyright (C) 2026 Konstantinos Spartalis (cspartalis@potatonetworks.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Auth\Api;
+
+use OPNsense\Base\ApiControllerBase;
+use OPNsense\Auth\AuthenticationFactory;
+use OPNsense\Core\ACL;
+use OPNsense\Core\Config;
+
+/**
+ * Class TesterController
+ * @package OPNsense\Auth\Api
+ */
+class TesterController extends ApiControllerBase
+{
+    /**
+     * Get settings for the tester form
+     * @return array
+     */
+    public function getSettingsAction()
+    {
+        $result = ['tester' => ['authmode' => []]];
+        $authFactory = new AuthenticationFactory();
+        foreach ($authFactory->listServers() as $auth_server_name => $auth_server) {
+            $result['tester']['authmode'][$auth_server_name] = [
+                'value' => $auth_server['name'],
+                'selected' => 0
+            ];
+        }
+        return $result;
+    }
+
+    /**
+     * Run authentication test
+     * @return array
+     */
+    public function testAction()
+    {
+        $result = ['status' => 'failed'];
+        if ($this->request->isPost()) {
+            $postInfo = $this->request->getPost('tester') ?? [];
+            $authmode = !empty($postInfo['authmode']) ? $postInfo['authmode'] : '';
+            $username = !empty($postInfo['username']) ? $postInfo['username'] : '';
+            $password = !empty($postInfo['password']) ? $postInfo['password'] : '';
+
+            $authFactory = new AuthenticationFactory();
+            $authServers = $authFactory->listServers();
+
+            if (!isset($authServers[$authmode])) {
+                $result['errors'] = ['Authmode' => gettext("Invalid authentication server")];
+                return $result;
+            }
+            if (empty($username) || empty($password)) {
+                $result['errors'] = ['Credentials' => gettext("A username and password must be specified.")];
+                return $result;
+            }
+
+            $authName = $authServers[$authmode]['type'] === 'local'
+                ? 'Local Database'
+                : $authServers[$authmode]['name'];
+
+            /** @var \OPNsense\Auth\Base $authenticator */
+            $authenticator = $authFactory->get($authName);
+
+            if ($authenticator->authenticate($username, $password)) {
+                $result['status'] = 'ok';
+                $result['message'] = gettext("User") . ": " . $username . " " . gettext("authenticated successfully.");
+
+                // Config may be updated during LDAP group sync, reload before proceeding
+                Config::getInstance()->forceReload();
+
+                $canonicalUser = $authenticator->getUserName($username) ?: $username;
+                $result['groups'] = $this->getUserGroups($canonicalUser);
+
+                $privileges = [];
+                foreach ((new ACL())->userUrlMasks($canonicalUser) as $item) {
+                    $privileges[] = $item;
+                }
+                $result['privileges'] = $privileges;
+
+                // Format attributes instantly
+                $result['attributes'] = array_map(
+                    fn($v) => is_array($v) ? implode(",", $v) : $v,
+                    $authenticator->getLastAuthProperties()
+                );
+            } else {
+                $result['message'] = gettext("Authentication failed.");
+                $result['errors'] = array_map(
+                    fn($v) => is_array($v) ? implode(",", $v) : $v,
+                    $authenticator->getLastAuthErrors()
+                );
+            }
+        }
+        return $result;
+    }
+
+    private function getUserGroups(string $username): array
+    {
+        $member_groups = [];
+        $configObj = Config::getInstance()->object();
+        $userUID = null;
+
+        foreach ($configObj->system->user ?? [] as $userNode) {
+            if ((string)$userNode->name === $username) {
+                $userUID = (string)$userNode->uid;
+                break;
+            }
+        }
+
+        if ($userUID === null) {
+            return [];
+        }
+
+        foreach ($configObj->system->group ?? [] as $groupNode) {
+            foreach ($groupNode->member as $memberNode) {
+                if (in_array($userUID, explode(',', (string)$memberNode), true)) {
+                    $member_groups[] = (string)$groupNode->name;
+                    break;
+                }
+            }
+        }
+
+        return $member_groups;
+    }
+}

src/opnsense/mvc/app/controllers/OPNsense/Auth/TesterController.php

@@ -0,0 +1,38 @@
+<?php
+
+/*
+ * Copyright (C) 2026 Konstantinos Spartalis (cspartalis@potatonetworks.com)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Auth;
+
+class TesterController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->testerForm = $this->getForm("tester");
+        $this->view->pick('OPNsense/Auth/tester');
+    }
+}

src/opnsense/mvc/app/controllers/OPNsense/Auth/forms/tester.xml

@@ -0,0 +1,18 @@
+<form>
+    <field>
+        <id>tester.authmode</id>
+        <label>Authentication Server</label>
+        <type>dropdown</type>
+        <help>Select authentication server to test</help>
+    </field>
+    <field>
+        <id>tester.username</id>
+        <label>Username</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>tester.password</id>
+        <label>Password</label>
+        <type>password</type>
+    </field>
+</form>

src/opnsense/mvc/app/library/OPNsense/Auth/Base.php

@@ -246,9 +246,9 @@ public function getUserName($username)
             if ($user) {
                 return (string)$user->name;
             }
-        } else {
-            return $username;
         }
+
+        return $username;
     }
 
     /**

src/opnsense/mvc/app/models/OPNsense/Core/ACL.php

@@ -260,16 +260,18 @@ private function isAddressAllowed($group, $remote_addr)
      */
     public function userUrlMasks($username)
     {
-        foreach ($this->userDatabase[$username]["priv"] as $privset) {
-            foreach ($privset as $urlmask) {
-                yield [$urlmask, []];
+        if (array_key_exists($username, $this->userDatabase)) {
+            foreach ($this->userDatabase[$username]["priv"] as $privset) {
+                foreach ($privset as $urlmask) {
+                    yield [$urlmask, []];
+                }
             }
-        }
-        foreach ($this->userDatabase[$username]["groups"] as $itemkey => $group) {
-            if (array_key_exists($group, $this->allGroupPrivs)) {
-                foreach ($this->allGroupPrivs[$group]['priv'] as $privset) {
-                    foreach ($privset as $urlmask) {
-                        yield [$urlmask, $this->allGroupPrivs[$group]['source_networks']];
+            foreach ($this->userDatabase[$username]["groups"] as $itemkey => $group) {
+                if (array_key_exists($group, $this->allGroupPrivs)) {
+                    foreach ($this->allGroupPrivs[$group]['priv'] as $privset) {
+                        foreach ($privset as $urlmask) {
+                            yield [$urlmask, $this->allGroupPrivs[$group]['source_networks']];
+                        }
                     }
                 }
             }

src/opnsense/mvc/app/models/OPNsense/Core/ACL/ACL.xml

@@ -47,7 +47,8 @@
     <page-diagnostics-authentication>
         <name>Diagnostics: Authentication</name>
         <patterns>
-            <pattern>diag_authentication.php*</pattern>
+            <pattern>ui/auth/tester*</pattern>
+            <pattern>api/auth/tester/*</pattern>
         </patterns>
     </page-diagnostics-authentication>
     <page-diagnostics-configurationhistory>

src/opnsense/mvc/app/models/OPNsense/Core/Menu/Menu.xml

@@ -24,7 +24,7 @@
             <Servers order="30" url="/system_authservers.php">
                 <Edit url="/system_authservers.php*" visibility="hidden"/>
             </Servers>
-            <Tester order="40" url="/diag_authentication.php"/>
+            <Tester order="40" url="/ui/auth/tester"/>
         </Access>
         <Configuration cssClass="fa fa-history fa-fw">
             <Backups url="/diag_backup.php"/>