public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix testcases for oidc test

This commit is contained in:
princemelvin 2021-05-06 16:23:41 +05:30
parent 1d486e4e33
commit ceefdea6be
2 changed files with 150 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
providers/oidc.go
View File

@ -137,8 +137,7 @@ func (p *OIDCProvider) enrichFromIntrospectURL(ctx context.Context, s *sessions.
Do()
if result.StatusCode() != http.StatusOK {
logger.Errorf("Warning: unable to while requesting introspection claims , status code - %d", result.StatusCode())
return nil
return fmt.Errorf("error while requesting introspect claims, status code - %d", result.StatusCode())
}
s.IntrospectClaims = b64.StdEncoding.EncodeToString(result.Body())
return nil

214
providers/oidc_test.go
View File

@ -161,14 +161,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"email": "new@thing.com",
"groups": []string{"new", "thing"},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "already",
Email: "already@populated.com",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Email": {
@ -185,14 +189,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"email": "found@email.com",
"groups": []string{"new", "thing"},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "missing.email",
Email: "found@email.com",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "missing.email",
Email: "found@email.com",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
@ -208,13 +216,17 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
ProfileJSON: map[string]interface{}{
"email": "found@email.com",
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "missing.email",
Email: "found@email.com",
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "missing.email",
Email: "found@email.com",
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Email with Custom Claim": {
@ -231,14 +243,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"weird": "weird@claim.com",
"groups": []string{"new", "thing"},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "missing.email",
Email: "weird@claim.com",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "missing.email",
Email: "weird@claim.com",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Email not in Profile URL": {
@ -254,13 +270,17 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
ProfileJSON: map[string]interface{}{
"groups": []string{"new", "thing"},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: errors.New("neither the id_token nor the profileURL set an email"),
ExpectedSession: &sessions.SessionState{
User: "missing.email",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "missing.email",
Groups: []string{"already", "populated"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Groups": {
@ -278,14 +298,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"email": "new@thing.com",
"groups": []string{"new", "thing"},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
Groups: []string{"new", "thing"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "already",
Email: "already@populated.com",
Groups: []string{"new", "thing"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Groups with Complex Groups in Profile URL": {
@ -308,14 +332,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
},
},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "already",
Email: "already@populated.com",
Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Groups with Singleton Complex Group in Profile URL": {
@ -336,14 +364,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"roles": []string{"Admin"},
},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "already",
Email: "already@populated.com",
Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Empty Groups Claims": {
@ -361,14 +393,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"email": "new@thing.com",
"groups": []string{"new", "thing"},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
Groups: []string{},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "already",
Email: "already@populated.com",
Groups: []string{},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Groups with Custom Claim": {
@ -386,14 +422,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"email": "new@thing.com",
"roles": []string{"new", "thing", "roles"},
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
Groups: []string{"new", "thing", "roles"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "already",
Email: "already@populated.com",
Groups: []string{"new", "thing", "roles"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Groups String Profile URL Response": {
@ -411,14 +451,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
"email": "new@thing.com",
"groups": "singleton",
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
Groups: []string{"singleton"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
User: "already",
Email: "already@populated.com",
Groups: []string{"singleton"},
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Missing Groups in both Claims and Profile URL": {
@ -434,14 +478,55 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
ProfileJSON: map[string]interface{}{
"email": "new@thing.com",
},
IntrospectJSON: map[string]interface{}{
"active": true,
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
},
},
"Introspection Response added in session": {
ExistingSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
},
EmailClaim: "email",
GroupsClaim: "groups",
ProfileJSON: map[string]interface{}{
"email": "new@thing.com",
},
IntrospectJSON: map[string]interface{}{
"active": true,
"exp": 1613553280,
"iat": 1613549680,
"sub": "00u65ah10oSUDoNd65d6",
"aud": "0oa5t6ts1XZgPOOSA5d6",
"iss": "https://dev.authprovider.com/oauth2/default",
"jti": "ID.ShxppK0vysORHsr8S9GSPPRV-Dy1PFhqx3fPYwtijc0",
"token_type": "Bearer",
"at_hash": "_1EsbE1ZpyMOLiu-VdBTlg",
"idp": "0oa5t8x90SALHBBk85d6",
"auth_time": 1613549026,
"amr": []string{"pwd"},
},
ExpectedError: nil,
ExpectedSession: &sessions.SessionState{
User: "already",
Email: "already@populated.com",
IDToken: idToken,
AccessToken: accessToken,
RefreshToken: refreshToken,
IntrospectClaims: "eyJhY3RpdmUiOnRydWUsImFtciI6WyJwd2QiXSwiYXRfaGFzaCI6Il8xRXNiRTFacHlNT0xpdS1WZEJUbGciLCJhdWQiOiIwb2E1dDZ0czFYWmdQT09TQTVkNiIsImF1dGhfdGltZSI6MTYxMzU0OTAyNiwiZXhwIjoxNjEzNTUzMjgwLCJpYXQiOjE2MTM1NDk2ODAsImlkcCI6IjBvYTV0OHg5MFNBTEhCQms4NWQ2IiwiaXNzIjoiaHR0cHM6Ly9kZXYuYXV0aHByb3ZpZGVyLmNvbS9vYXV0aDIvZGVmYXVsdCIsImp0aSI6IklELlNoeHBwSzB2eXNPUkhzcjhTOUdTUFBSVi1EeTFQRmhxeDNmUFl3dGlqYzAiLCJzdWIiOiIwMHU2NWFoMTBvU1VEb05kNjVkNiIsInRva2VuX3R5cGUiOiJCZWFyZXIifQ==",
},
},
}
for testName, tc := range testCases {
@ -453,7 +538,6 @@ func TestOIDCProvider_EnrichSession(t *testing.T) {
assert.NoError(t, err)
server, provider := newTestOIDCSetup([]byte(`{}`), profileJSON, introspectJSON)
provider.ProfileURL, err = url.Parse(server.URL)
assert.NoError(t, err)
provider.EmailClaim = tc.EmailClaim