From ceefdea6be51ada3492772f9866a011232bb98bc Mon Sep 17 00:00:00 2001 From: princemelvin <51328781+princemelvin@users.noreply.github.com> Date: Thu, 6 May 2021 16:23:41 +0530 Subject: [PATCH] fix testcases for oidc test --- providers/oidc.go | 3 +- providers/oidc_test.go | 214 ++++++++++++++++++++++++++++------------- 2 files changed, 150 insertions(+), 67 deletions(-) diff --git a/providers/oidc.go b/providers/oidc.go index 95578bdf..bd8fe7ce 100644 --- a/providers/oidc.go +++ b/providers/oidc.go @@ -137,8 +137,7 @@ func (p *OIDCProvider) enrichFromIntrospectURL(ctx context.Context, s *sessions. Do() if result.StatusCode() != http.StatusOK { - logger.Errorf("Warning: unable to while requesting introspection claims , status code - %d", result.StatusCode()) - return nil + return fmt.Errorf("error while requesting introspect claims, status code - %d", result.StatusCode()) } s.IntrospectClaims = b64.StdEncoding.EncodeToString(result.Body()) return nil diff --git a/providers/oidc_test.go b/providers/oidc_test.go index ec045d07..e1905024 100644 --- a/providers/oidc_test.go +++ b/providers/oidc_test.go @@ -161,14 +161,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "email": "new@thing.com", "groups": []string{"new", "thing"}, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "already", - Email: "already@populated.com", - Groups: []string{"already", "populated"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "already", + Email: "already@populated.com", + Groups: []string{"already", "populated"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Email": { @@ -185,14 +189,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "email": "found@email.com", "groups": []string{"new", "thing"}, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "missing.email", - Email: "found@email.com", - Groups: []string{"already", "populated"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "missing.email", + Email: "found@email.com", + Groups: []string{"already", "populated"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, @@ -208,13 +216,17 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { ProfileJSON: map[string]interface{}{ "email": "found@email.com", }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "missing.email", - Email: "found@email.com", - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "missing.email", + Email: "found@email.com", + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Email with Custom Claim": { @@ -231,14 +243,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "weird": "weird@claim.com", "groups": []string{"new", "thing"}, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "missing.email", - Email: "weird@claim.com", - Groups: []string{"already", "populated"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "missing.email", + Email: "weird@claim.com", + Groups: []string{"already", "populated"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Email not in Profile URL": { @@ -254,13 +270,17 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { ProfileJSON: map[string]interface{}{ "groups": []string{"new", "thing"}, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: errors.New("neither the id_token nor the profileURL set an email"), ExpectedSession: &sessions.SessionState{ - User: "missing.email", - Groups: []string{"already", "populated"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "missing.email", + Groups: []string{"already", "populated"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Groups": { @@ -278,14 +298,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "email": "new@thing.com", "groups": []string{"new", "thing"}, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "already", - Email: "already@populated.com", - Groups: []string{"new", "thing"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "already", + Email: "already@populated.com", + Groups: []string{"new", "thing"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Groups with Complex Groups in Profile URL": { @@ -308,14 +332,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { }, }, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "already", - Email: "already@populated.com", - Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "already", + Email: "already@populated.com", + Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Groups with Singleton Complex Group in Profile URL": { @@ -336,14 +364,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "roles": []string{"Admin"}, }, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "already", - Email: "already@populated.com", - Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "already", + Email: "already@populated.com", + Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Empty Groups Claims": { @@ -361,14 +393,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "email": "new@thing.com", "groups": []string{"new", "thing"}, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "already", - Email: "already@populated.com", - Groups: []string{}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "already", + Email: "already@populated.com", + Groups: []string{}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Groups with Custom Claim": { @@ -386,14 +422,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "email": "new@thing.com", "roles": []string{"new", "thing", "roles"}, }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "already", - Email: "already@populated.com", - Groups: []string{"new", "thing", "roles"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "already", + Email: "already@populated.com", + Groups: []string{"new", "thing", "roles"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Groups String Profile URL Response": { @@ -411,14 +451,18 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { "email": "new@thing.com", "groups": "singleton", }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ - User: "already", - Email: "already@populated.com", - Groups: []string{"singleton"}, - IDToken: idToken, - AccessToken: accessToken, - RefreshToken: refreshToken, + User: "already", + Email: "already@populated.com", + Groups: []string{"singleton"}, + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", }, }, "Missing Groups in both Claims and Profile URL": { @@ -434,14 +478,55 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { ProfileJSON: map[string]interface{}{ "email": "new@thing.com", }, + IntrospectJSON: map[string]interface{}{ + "active": true, + }, ExpectedError: nil, ExpectedSession: &sessions.SessionState{ + User: "already", + Email: "already@populated.com", + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWV9", + }, + }, + "Introspection Response added in session": { + ExistingSession: &sessions.SessionState{ User: "already", Email: "already@populated.com", IDToken: idToken, AccessToken: accessToken, RefreshToken: refreshToken, }, + EmailClaim: "email", + GroupsClaim: "groups", + ProfileJSON: map[string]interface{}{ + "email": "new@thing.com", + }, + IntrospectJSON: map[string]interface{}{ + "active": true, + "exp": 1613553280, + "iat": 1613549680, + "sub": "00u65ah10oSUDoNd65d6", + "aud": "0oa5t6ts1XZgPOOSA5d6", + "iss": "https://dev.authprovider.com/oauth2/default", + "jti": "ID.ShxppK0vysORHsr8S9GSPPRV-Dy1PFhqx3fPYwtijc0", + "token_type": "Bearer", + "at_hash": "_1EsbE1ZpyMOLiu-VdBTlg", + "idp": "0oa5t8x90SALHBBk85d6", + "auth_time": 1613549026, + "amr": []string{"pwd"}, + }, + ExpectedError: nil, + ExpectedSession: &sessions.SessionState{ + User: "already", + Email: "already@populated.com", + IDToken: idToken, + AccessToken: accessToken, + RefreshToken: refreshToken, + IntrospectClaims: "eyJhY3RpdmUiOnRydWUsImFtciI6WyJwd2QiXSwiYXRfaGFzaCI6Il8xRXNiRTFacHlNT0xpdS1WZEJUbGciLCJhdWQiOiIwb2E1dDZ0czFYWmdQT09TQTVkNiIsImF1dGhfdGltZSI6MTYxMzU0OTAyNiwiZXhwIjoxNjEzNTUzMjgwLCJpYXQiOjE2MTM1NDk2ODAsImlkcCI6IjBvYTV0OHg5MFNBTEhCQms4NWQ2IiwiaXNzIjoiaHR0cHM6Ly9kZXYuYXV0aHByb3ZpZGVyLmNvbS9vYXV0aDIvZGVmYXVsdCIsImp0aSI6IklELlNoeHBwSzB2eXNPUkhzcjhTOUdTUFBSVi1EeTFQRmhxeDNmUFl3dGlqYzAiLCJzdWIiOiIwMHU2NWFoMTBvU1VEb05kNjVkNiIsInRva2VuX3R5cGUiOiJCZWFyZXIifQ==", + }, }, } for testName, tc := range testCases { @@ -453,7 +538,6 @@ func TestOIDCProvider_EnrichSession(t *testing.T) { assert.NoError(t, err) server, provider := newTestOIDCSetup([]byte(`{}`), profileJSON, introspectJSON) - provider.ProfileURL, err = url.Parse(server.URL) assert.NoError(t, err) provider.EmailClaim = tc.EmailClaim