364 lines
11 KiB
Go
364 lines
11 KiB
Go
package validation
|
|
|
|
import (
|
|
"crypto"
|
|
"net/url"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
|
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
const (
|
|
cookieSecret = "secretthirtytwobytes+abcdefghijk"
|
|
clientID = "bazquux"
|
|
clientSecret = "xyzzyplugh"
|
|
providerID = "providerID"
|
|
)
|
|
|
|
func testOptions() *options.Options {
|
|
o := options.NewOptions()
|
|
o.UpstreamServers.Upstreams = append(o.UpstreamServers.Upstreams, options.Upstream{
|
|
ID: "upstream",
|
|
Path: "/",
|
|
URI: "http://127.0.0.1:8080/",
|
|
})
|
|
o.Cookie.Secret = cookieSecret
|
|
o.Providers[0].ID = providerID
|
|
o.Providers[0].ClientID = clientID
|
|
o.Providers[0].ClientSecret = clientSecret
|
|
o.EmailDomains = []string{"*"}
|
|
return o
|
|
}
|
|
|
|
func errorMsg(msgs []string) string {
|
|
result := make([]string, 0)
|
|
result = append(result, "invalid configuration:")
|
|
result = append(result, msgs...)
|
|
return strings.Join(result, "\n ")
|
|
}
|
|
|
|
func TestNewOptions(t *testing.T) {
|
|
o := options.NewOptions()
|
|
o.EmailDomains = []string{"*"}
|
|
err := Validate(o)
|
|
assert.NotEqual(t, nil, err)
|
|
|
|
expected := errorMsg([]string{
|
|
"missing setting: cookie-secret or cookie-secret-file",
|
|
"provider has empty id: ids are required for all providers",
|
|
"provider missing setting: client-id",
|
|
"missing setting: client-secret or client-secret-file"})
|
|
assert.Equal(t, expected, err.Error())
|
|
}
|
|
|
|
func TestGoogleGroupOptionsWithoutServiceAccountJSON(t *testing.T) {
|
|
o := testOptions()
|
|
o.Providers[0].GoogleConfig.AdminEmail = "admin@example.com"
|
|
err := Validate(o)
|
|
assert.NotEqual(t, nil, err)
|
|
|
|
expected := errorMsg([]string{
|
|
"missing setting: google-service-account-json or google-use-application-default-credentials"})
|
|
assert.Equal(t, expected, err.Error())
|
|
}
|
|
|
|
func TestGoogleGroupOptionsWithoutAdminEmail(t *testing.T) {
|
|
o := testOptions()
|
|
o.Providers[0].GoogleConfig.UseApplicationDefaultCredentials = ptr.To(true)
|
|
err := Validate(o)
|
|
assert.NotEqual(t, nil, err)
|
|
|
|
expected := errorMsg([]string{
|
|
"missing setting: google-admin-email"})
|
|
assert.Equal(t, expected, err.Error())
|
|
}
|
|
|
|
func TestGoogleGroupOptionsWithoutGroups(t *testing.T) {
|
|
o := testOptions()
|
|
// Set admin email and application default credentials but no groups - should still require them
|
|
o.Providers[0].GoogleConfig.AdminEmail = "admin@example.com"
|
|
o.Providers[0].GoogleConfig.UseApplicationDefaultCredentials = ptr.To(true)
|
|
err := Validate(o)
|
|
// Should pass validation since google-group is now optional
|
|
assert.Equal(t, nil, err)
|
|
}
|
|
|
|
func TestGoogleGroupInvalidFile(t *testing.T) {
|
|
o := testOptions()
|
|
o.Providers[0].GoogleConfig.Groups = []string{"test_group"}
|
|
o.Providers[0].GoogleConfig.AdminEmail = "admin@example.com"
|
|
o.Providers[0].GoogleConfig.ServiceAccountJSON = "file_doesnt_exist.json"
|
|
err := Validate(o)
|
|
assert.NotEqual(t, nil, err)
|
|
|
|
expected := errorMsg([]string{
|
|
"Google credentials file not found: file_doesnt_exist.json",
|
|
})
|
|
assert.Equal(t, expected, err.Error())
|
|
}
|
|
|
|
func TestInitializedOptions(t *testing.T) {
|
|
o := testOptions()
|
|
assert.Equal(t, nil, Validate(o))
|
|
}
|
|
|
|
// Note that it's not worth testing nonparseable URLs, since url.Parse()
|
|
// seems to parse damn near anything.
|
|
func TestRedirectURL(t *testing.T) {
|
|
o := testOptions()
|
|
o.RawRedirectURL = "https://myhost.com/oauth2/callback"
|
|
assert.Equal(t, nil, Validate(o))
|
|
expected := &url.URL{
|
|
Scheme: "https", Host: "myhost.com", Path: "/oauth2/callback"}
|
|
assert.Equal(t, expected, o.GetRedirectURL())
|
|
}
|
|
|
|
func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {
|
|
o := testOptions()
|
|
assert.Equal(t, nil, Validate(o))
|
|
|
|
o.Cookie.Secret = "0123456789abcdef"
|
|
o.Cookie.Refresh = o.Cookie.Expire
|
|
assert.NotEqual(t, nil, Validate(o))
|
|
|
|
o.Cookie.Refresh -= time.Duration(1)
|
|
assert.Equal(t, nil, Validate(o))
|
|
}
|
|
|
|
func TestBase64CookieSecret(t *testing.T) {
|
|
o := testOptions()
|
|
assert.Equal(t, nil, Validate(o))
|
|
|
|
// 32 byte, base64 (urlsafe) encoded key
|
|
o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="
|
|
assert.Equal(t, nil, Validate(o))
|
|
|
|
// 32 byte, base64 (urlsafe) encoded key, w/o padding
|
|
o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"
|
|
assert.Equal(t, nil, Validate(o))
|
|
|
|
// 24 byte, base64 (urlsafe) encoded key
|
|
o.Cookie.Secret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"
|
|
assert.Equal(t, nil, Validate(o))
|
|
|
|
// 16 byte, base64 (urlsafe) encoded key
|
|
o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA=="
|
|
assert.Equal(t, nil, Validate(o))
|
|
|
|
// 16 byte, base64 (urlsafe) encoded key, w/o padding
|
|
o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA"
|
|
assert.Equal(t, nil, Validate(o))
|
|
}
|
|
|
|
func TestValidateSignatureKey(t *testing.T) {
|
|
o := testOptions()
|
|
o.SignatureKey = "sha1:secret"
|
|
assert.Equal(t, nil, Validate(o))
|
|
assert.Equal(t, o.GetSignatureData().Hash, crypto.SHA1)
|
|
assert.Equal(t, o.GetSignatureData().Key, "secret")
|
|
}
|
|
|
|
func TestValidateSignatureKeyInvalidSpec(t *testing.T) {
|
|
o := testOptions()
|
|
o.SignatureKey = "invalid spec"
|
|
err := Validate(o)
|
|
assert.Equal(t, err.Error(), "invalid configuration:\n"+
|
|
" invalid signature hash:key spec: "+o.SignatureKey)
|
|
}
|
|
|
|
func TestValidateSignatureKeyUnsupportedAlgorithm(t *testing.T) {
|
|
o := testOptions()
|
|
o.SignatureKey = "unsupported:default secret"
|
|
err := Validate(o)
|
|
assert.Equal(t, err.Error(), "invalid configuration:\n"+
|
|
" unsupported signature hash algorithm: "+o.SignatureKey)
|
|
}
|
|
|
|
func TestGCPHealthcheck(t *testing.T) {
|
|
o := testOptions()
|
|
o.GCPHealthChecks = true
|
|
assert.Equal(t, nil, Validate(o))
|
|
}
|
|
|
|
func TestRealClientIPHeader(t *testing.T) {
|
|
// Ensure nil if ReverseProxy not set.
|
|
o := testOptions()
|
|
o.RealClientIPHeader = "X-Real-IP"
|
|
assert.Equal(t, nil, Validate(o))
|
|
assert.Nil(t, o.GetRealClientIPParser())
|
|
|
|
// Ensure simple use case works.
|
|
o = testOptions()
|
|
o.ReverseProxy = true
|
|
o.RealClientIPHeader = "X-Forwarded-For"
|
|
assert.Equal(t, nil, Validate(o))
|
|
assert.NotNil(t, o.GetRealClientIPParser())
|
|
|
|
// Ensure unknown header format process an error.
|
|
o = testOptions()
|
|
o.ReverseProxy = true
|
|
o.RealClientIPHeader = "Forwarded"
|
|
err := Validate(o)
|
|
assert.NotEqual(t, nil, err)
|
|
expected := errorMsg([]string{
|
|
"real_client_ip_header (Forwarded) not accepted parameter value: the http header key (Forwarded) is either invalid or unsupported",
|
|
})
|
|
assert.Equal(t, expected, err.Error())
|
|
assert.Nil(t, o.GetRealClientIPParser())
|
|
|
|
// Ensure invalid header format produces an error.
|
|
o = testOptions()
|
|
o.ReverseProxy = true
|
|
o.RealClientIPHeader = "!934invalidheader-23:"
|
|
err = Validate(o)
|
|
assert.NotEqual(t, nil, err)
|
|
expected = errorMsg([]string{
|
|
"real_client_ip_header (!934invalidheader-23:) not accepted parameter value: the http header key (!934invalidheader-23:) is either invalid or unsupported",
|
|
})
|
|
assert.Equal(t, expected, err.Error())
|
|
assert.Nil(t, o.GetRealClientIPParser())
|
|
}
|
|
|
|
func TestProviderCAFilesError(t *testing.T) {
|
|
file, err := os.CreateTemp("", "absent.*.crt")
|
|
assert.NoError(t, err)
|
|
assert.NoError(t, file.Close())
|
|
assert.NoError(t, os.Remove(file.Name()))
|
|
|
|
o := testOptions()
|
|
o.Providers[0].CAFiles = append(o.Providers[0].CAFiles, file.Name())
|
|
err = Validate(o)
|
|
assert.Error(t, err)
|
|
assert.Contains(t, err.Error(), "unable to load provider CA file(s)")
|
|
}
|
|
|
|
func TestParseJwtIssuers(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
issuers []string
|
|
jwksURLs []string
|
|
expected []jwtIssuer
|
|
msgs []string
|
|
}{
|
|
{
|
|
name: "issuer and audience without jwks url",
|
|
issuers: []string{"https://issuer.example.com=client-id"},
|
|
expected: []jwtIssuer{
|
|
{issuerURI: "https://issuer.example.com", audience: "client-id"},
|
|
},
|
|
},
|
|
{
|
|
name: "audience containing an equals sign",
|
|
issuers: []string{"https://issuer.example.com=aud=with=equals"},
|
|
expected: []jwtIssuer{
|
|
{issuerURI: "https://issuer.example.com", audience: "aud=with=equals"},
|
|
},
|
|
},
|
|
{
|
|
name: "explicit jwks url overrides the derived url",
|
|
issuers: []string{"http://sts.example.com/adfs/services/trust=urn:microsoft:userinfo"},
|
|
jwksURLs: []string{"http://sts.example.com/adfs/services/trust=https://sts.example.com/adfs/discovery/keys"},
|
|
expected: []jwtIssuer{
|
|
{
|
|
issuerURI: "http://sts.example.com/adfs/services/trust",
|
|
audience: "urn:microsoft:userinfo",
|
|
jwksURI: "https://sts.example.com/adfs/discovery/keys",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "jwks url containing an equals sign",
|
|
issuers: []string{"https://issuer.example.com=client-id"},
|
|
jwksURLs: []string{"https://issuer.example.com=https://issuer.example.com/keys?format=jwks"},
|
|
expected: []jwtIssuer{
|
|
{
|
|
issuerURI: "https://issuer.example.com",
|
|
audience: "client-id",
|
|
jwksURI: "https://issuer.example.com/keys?format=jwks",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "jwks url for an unrelated issuer is ignored",
|
|
issuers: []string{"https://issuer.example.com=client-id"},
|
|
jwksURLs: []string{"https://other.example.com=https://other.example.com/keys"},
|
|
expected: []jwtIssuer{
|
|
{issuerURI: "https://issuer.example.com", audience: "client-id"},
|
|
},
|
|
},
|
|
{
|
|
name: "invalid issuer spec is reported",
|
|
issuers: []string{"https://issuer.example.com"},
|
|
expected: []jwtIssuer{},
|
|
msgs: []string{"invalid jwt verifier uri=audience spec: https://issuer.example.com"},
|
|
},
|
|
{
|
|
name: "invalid jwks url spec is reported",
|
|
issuers: []string{"https://issuer.example.com=client-id"},
|
|
jwksURLs: []string{"https://issuer.example.com"},
|
|
expected: []jwtIssuer{
|
|
{issuerURI: "https://issuer.example.com", audience: "client-id"},
|
|
},
|
|
msgs: []string{"invalid jwt issuer jwks url spec: https://issuer.example.com"},
|
|
},
|
|
{
|
|
name: "empty jwks url value is reported",
|
|
issuers: []string{"https://issuer.example.com=client-id"},
|
|
jwksURLs: []string{"https://issuer.example.com="},
|
|
expected: []jwtIssuer{
|
|
{issuerURI: "https://issuer.example.com", audience: "client-id"},
|
|
},
|
|
msgs: []string{"invalid jwt issuer jwks url spec: https://issuer.example.com="},
|
|
},
|
|
{
|
|
name: "empty issuer in jwks url spec is reported",
|
|
issuers: []string{"https://issuer.example.com=client-id"},
|
|
jwksURLs: []string{"=https://issuer.example.com/keys"},
|
|
expected: []jwtIssuer{
|
|
{issuerURI: "https://issuer.example.com", audience: "client-id"},
|
|
},
|
|
msgs: []string{"invalid jwt issuer jwks url spec: =https://issuer.example.com/keys"},
|
|
},
|
|
{
|
|
name: "multiple issuers each with their own jwks url",
|
|
issuers: []string{"https://a.example.com=aud-a", "https://b.example.com=aud-b"},
|
|
jwksURLs: []string{
|
|
"https://a.example.com=https://a.example.com/keys",
|
|
"https://b.example.com=https://b.example.com/keys",
|
|
},
|
|
expected: []jwtIssuer{
|
|
{issuerURI: "https://a.example.com", audience: "aud-a", jwksURI: "https://a.example.com/keys"},
|
|
{issuerURI: "https://b.example.com", audience: "aud-b", jwksURI: "https://b.example.com/keys"},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
issuers, msgs := parseJwtIssuers(tc.issuers, tc.jwksURLs, nil)
|
|
assert.Equal(t, tc.expected, issuers)
|
|
assert.Equal(t, tc.msgs, msgs)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestNewVerifierFromJwtIssuerWithExplicitJWKsURL(t *testing.T) {
|
|
// An explicit JWKS URL must skip discovery entirely, so the verifier can be
|
|
// constructed without reaching the issuer (the JWKS is fetched lazily).
|
|
issuer := jwtIssuer{
|
|
issuerURI: "http://sts.example.com/adfs/services/trust",
|
|
audience: "urn:microsoft:userinfo",
|
|
jwksURI: "https://sts.example.com/adfs/discovery/keys",
|
|
}
|
|
|
|
verifier, err := newVerifierFromJwtIssuer(nil, nil, issuer)
|
|
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, verifier)
|
|
}
|