lib/controller/localdb/login_oidc_test.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package localdb
   6
   7 import (
   8         "bytes"
   9         "context"
  10         "crypto/rand"
  11         "crypto/rsa"
  12         "encoding/base64"
  13         "encoding/json"
  14         "fmt"
  15         "net/http"
  16         "net/http/httptest"
  17         "net/url"
  18         "sort"
  19         "strings"
  20         "testing"
  21         "time"
  22
  23         "git.arvados.org/arvados.git/lib/config"
  24         "git.arvados.org/arvados.git/lib/controller/rpc"
  25         "git.arvados.org/arvados.git/sdk/go/arvados"
  26         "git.arvados.org/arvados.git/sdk/go/arvadostest"
  27         "git.arvados.org/arvados.git/sdk/go/auth"
  28         "git.arvados.org/arvados.git/sdk/go/ctxlog"
  29         check "gopkg.in/check.v1"
  30         jose "gopkg.in/square/go-jose.v2"
  31 )
  32
  33 // Gocheck boilerplate
  34 func Test(t *testing.T) {
  35         check.TestingT(t)
  36 }
  37
  38 var _ = check.Suite(&OIDCLoginSuite{})
  39
  40 type OIDCLoginSuite struct {
  41         cluster               *arvados.Cluster
  42         ctx                   context.Context
  43         localdb               *Conn
  44         railsSpy              *arvadostest.Proxy
  45         fakeIssuer            *httptest.Server
  46         fakePeopleAPI         *httptest.Server
  47         fakePeopleAPIResponse map[string]interface{}
  48         issuerKey             *rsa.PrivateKey
  49
  50         // expected token request
  51         validCode         string
  52         validClientID     string
  53         validClientSecret string
  54         // desired response from token endpoint
  55         authEmail         string
  56         authEmailVerified bool
  57         authName          string
  58 }
  59
  60 func (s *OIDCLoginSuite) TearDownSuite(c *check.C) {
  61         // Undo any changes/additions to the user database so they
  62         // don't affect subsequent tests.
  63         arvadostest.ResetEnv()
  64         c.Check(arvados.NewClientFromEnv().RequestAndDecode(nil, "POST", "database/reset", nil, nil), check.IsNil)
  65 }
  66
  67 func (s *OIDCLoginSuite) SetUpTest(c *check.C) {
  68         var err error
  69         s.issuerKey, err = rsa.GenerateKey(rand.Reader, 2048)
  70         c.Assert(err, check.IsNil)
  71
  72         s.authEmail = "active-user@arvados.local"
  73         s.authEmailVerified = true
  74         s.authName = "Fake User Name"
  75         s.fakeIssuer = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
  76                 req.ParseForm()
  77                 c.Logf("fakeIssuer: got req: %s %s %s", req.Method, req.URL, req.Form)
  78                 w.Header().Set("Content-Type", "application/json")
  79                 switch req.URL.Path {
  80                 case "/.well-known/openid-configuration":
  81                         json.NewEncoder(w).Encode(map[string]interface{}{
  82                                 "issuer":                 s.fakeIssuer.URL,
  83                                 "authorization_endpoint": s.fakeIssuer.URL + "/auth",
  84                                 "token_endpoint":         s.fakeIssuer.URL + "/token",
  85                                 "jwks_uri":               s.fakeIssuer.URL + "/jwks",
  86                                 "userinfo_endpoint":      s.fakeIssuer.URL + "/userinfo",
  87                         })
  88                 case "/token":
  89                         var clientID, clientSecret string
  90                         auth, _ := base64.StdEncoding.DecodeString(strings.TrimPrefix(req.Header.Get("Authorization"), "Basic "))
  91                         authsplit := strings.Split(string(auth), ":")
  92                         if len(authsplit) == 2 {
  93                                 clientID, _ = url.QueryUnescape(authsplit[0])
  94                                 clientSecret, _ = url.QueryUnescape(authsplit[1])
  95                         }
  96                         if clientID != s.validClientID || clientSecret != s.validClientSecret {
  97                                 c.Logf("fakeIssuer: expected (%q, %q) got (%q, %q)", s.validClientID, s.validClientSecret, clientID, clientSecret)
  98                                 w.WriteHeader(http.StatusUnauthorized)
  99                                 return
 100                         }
 101
 102                         if req.Form.Get("code") != s.validCode || s.validCode == "" {
 103                                 w.WriteHeader(http.StatusUnauthorized)
 104                                 return
 105                         }
 106                         idToken, _ := json.Marshal(map[string]interface{}{
 107                                 "iss":            s.fakeIssuer.URL,
 108                                 "aud":            []string{clientID},
 109                                 "sub":            "fake-user-id",
 110                                 "exp":            time.Now().UTC().Add(time.Minute).Unix(),
 111                                 "iat":            time.Now().UTC().Unix(),
 112                                 "nonce":          "fake-nonce",
 113                                 "email":          s.authEmail,
 114                                 "email_verified": s.authEmailVerified,
 115                                 "name":           s.authName,
 116                                 "alt_verified":   true,                    // for custom claim tests
 117                                 "alt_email":      "alt_email@example.com", // for custom claim tests
 118                         })
 119                         json.NewEncoder(w).Encode(struct {
 120                                 AccessToken  string `json:"access_token"`
 121                                 TokenType    string `json:"token_type"`
 122                                 RefreshToken string `json:"refresh_token"`
 123                                 ExpiresIn    int32  `json:"expires_in"`
 124                                 IDToken      string `json:"id_token"`
 125                         }{
 126                                 AccessToken:  s.fakeToken(c, []byte("fake access token")),
 127                                 TokenType:    "Bearer",
 128                                 RefreshToken: "test-refresh-token",
 129                                 ExpiresIn:    30,
 130                                 IDToken:      s.fakeToken(c, idToken),
 131                         })
 132                 case "/jwks":
 133                         json.NewEncoder(w).Encode(jose.JSONWebKeySet{
 134                                 Keys: []jose.JSONWebKey{
 135                                         {Key: s.issuerKey.Public(), Algorithm: string(jose.RS256), KeyID: ""},
 136                                 },
 137                         })
 138                 case "/auth":
 139                         w.WriteHeader(http.StatusInternalServerError)
 140                 case "/userinfo":
 141                         w.WriteHeader(http.StatusInternalServerError)
 142                 default:
 143                         w.WriteHeader(http.StatusNotFound)
 144                 }
 145         }))
 146         s.validCode = fmt.Sprintf("abcdefgh-%d", time.Now().Unix())
 147
 148         s.fakePeopleAPI = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 149                 req.ParseForm()
 150                 c.Logf("fakePeopleAPI: got req: %s %s %s", req.Method, req.URL, req.Form)
 151                 w.Header().Set("Content-Type", "application/json")
 152                 switch req.URL.Path {
 153                 case "/v1/people/me":
 154                         if f := req.Form.Get("personFields"); f != "emailAddresses,names" {
 155                                 w.WriteHeader(http.StatusBadRequest)
 156                                 break
 157                         }
 158                         json.NewEncoder(w).Encode(s.fakePeopleAPIResponse)
 159                 default:
 160                         w.WriteHeader(http.StatusNotFound)
 161                 }
 162         }))
 163         s.fakePeopleAPIResponse = map[string]interface{}{}
 164
 165         cfg, err := config.NewLoader(nil, ctxlog.TestLogger(c)).Load()
 166         c.Assert(err, check.IsNil)
 167         s.cluster, err = cfg.GetCluster("")
 168         c.Assert(err, check.IsNil)
 169         s.cluster.Login.SSO.Enable = false
 170         s.cluster.Login.Google.Enable = true
 171         s.cluster.Login.Google.ClientID = "test%client$id"
 172         s.cluster.Login.Google.ClientSecret = "test#client/secret"
 173         s.cluster.Users.PreferDomainForUsername = "PreferDomainForUsername.example.com"
 174         s.validClientID = "test%client$id"
 175         s.validClientSecret = "test#client/secret"
 176
 177         s.localdb = NewConn(s.cluster)
 178         c.Assert(s.localdb.loginController, check.FitsTypeOf, (*oidcLoginController)(nil))
 179         s.localdb.loginController.(*oidcLoginController).Issuer = s.fakeIssuer.URL
 180         s.localdb.loginController.(*oidcLoginController).peopleAPIBasePath = s.fakePeopleAPI.URL
 181
 182         s.railsSpy = arvadostest.NewProxy(c, s.cluster.Services.RailsAPI)
 183         *s.localdb.railsProxy = *rpc.NewConn(s.cluster.ClusterID, s.railsSpy.URL, true, rpc.PassthroughTokenProvider)
 184 }
 185
 186 func (s *OIDCLoginSuite) TearDownTest(c *check.C) {
 187         s.railsSpy.Close()
 188 }
 189
 190 func (s *OIDCLoginSuite) TestGoogleLogout(c *check.C) {
 191         resp, err := s.localdb.Logout(context.Background(), arvados.LogoutOptions{ReturnTo: "https://foo.example.com/bar"})
 192         c.Check(err, check.IsNil)
 193         c.Check(resp.RedirectLocation, check.Equals, "https://foo.example.com/bar")
 194 }
 195
 196 func (s *OIDCLoginSuite) TestGoogleLogin_Start_Bogus(c *check.C) {
 197         resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{})
 198         c.Check(err, check.IsNil)
 199         c.Check(resp.RedirectLocation, check.Equals, "")
 200         c.Check(resp.HTML.String(), check.Matches, `.*missing return_to parameter.*`)
 201 }
 202
 203 func (s *OIDCLoginSuite) TestGoogleLogin_Start(c *check.C) {
 204         for _, remote := range []string{"", "zzzzz"} {
 205                 resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{Remote: remote, ReturnTo: "https://app.example.com/foo?bar"})
 206                 c.Check(err, check.IsNil)
 207                 target, err := url.Parse(resp.RedirectLocation)
 208                 c.Check(err, check.IsNil)
 209                 issuerURL, _ := url.Parse(s.fakeIssuer.URL)
 210                 c.Check(target.Host, check.Equals, issuerURL.Host)
 211                 q := target.Query()
 212                 c.Check(q.Get("client_id"), check.Equals, "test%client$id")
 213                 state := s.localdb.loginController.(*oidcLoginController).parseOAuth2State(q.Get("state"))
 214                 c.Check(state.verify([]byte(s.cluster.SystemRootToken)), check.Equals, true)
 215                 c.Check(state.Time, check.Not(check.Equals), 0)
 216                 c.Check(state.Remote, check.Equals, remote)
 217                 c.Check(state.ReturnTo, check.Equals, "https://app.example.com/foo?bar")
 218         }
 219 }
 220
 221 func (s *OIDCLoginSuite) TestGoogleLogin_InvalidCode(c *check.C) {
 222         state := s.startLogin(c)
 223         resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 224                 Code:  "first-try-a-bogus-code",
 225                 State: state,
 226         })
 227         c.Check(err, check.IsNil)
 228         c.Check(resp.RedirectLocation, check.Equals, "")
 229         c.Check(resp.HTML.String(), check.Matches, `(?ms).*error in OAuth2 exchange.*cannot fetch token.*`)
 230 }
 231
 232 func (s *OIDCLoginSuite) TestGoogleLogin_InvalidState(c *check.C) {
 233         s.startLogin(c)
 234         resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 235                 Code:  s.validCode,
 236                 State: "bogus-state",
 237         })
 238         c.Check(err, check.IsNil)
 239         c.Check(resp.RedirectLocation, check.Equals, "")
 240         c.Check(resp.HTML.String(), check.Matches, `(?ms).*invalid OAuth2 state.*`)
 241 }
 242
 243 func (s *OIDCLoginSuite) setupPeopleAPIError(c *check.C) {
 244         s.fakePeopleAPI = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 245                 w.WriteHeader(http.StatusForbidden)
 246                 fmt.Fprintln(w, `Error 403: accessNotConfigured`)
 247         }))
 248         s.localdb.loginController.(*oidcLoginController).peopleAPIBasePath = s.fakePeopleAPI.URL
 249 }
 250
 251 func (s *OIDCLoginSuite) TestGoogleLogin_PeopleAPIDisabled(c *check.C) {
 252         s.localdb.loginController.(*oidcLoginController).UseGooglePeopleAPI = false
 253         s.authEmail = "joe.smith@primary.example.com"
 254         s.setupPeopleAPIError(c)
 255         state := s.startLogin(c)
 256         _, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 257                 Code:  s.validCode,
 258                 State: state,
 259         })
 260         c.Check(err, check.IsNil)
 261         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 262         c.Check(authinfo.Email, check.Equals, "joe.smith@primary.example.com")
 263 }
 264
 265 func (s *OIDCLoginSuite) TestConfig(c *check.C) {
 266         s.cluster.Login.Google.Enable = false
 267         s.cluster.Login.OpenIDConnect.Enable = true
 268         s.cluster.Login.OpenIDConnect.Issuer = "https://accounts.example.com/"
 269         s.cluster.Login.OpenIDConnect.ClientID = "oidc-client-id"
 270         s.cluster.Login.OpenIDConnect.ClientSecret = "oidc-client-secret"
 271         localdb := NewConn(s.cluster)
 272         ctrl := localdb.loginController.(*oidcLoginController)
 273         c.Check(ctrl.Issuer, check.Equals, "https://accounts.example.com/")
 274         c.Check(ctrl.ClientID, check.Equals, "oidc-client-id")
 275         c.Check(ctrl.ClientSecret, check.Equals, "oidc-client-secret")
 276         c.Check(ctrl.UseGooglePeopleAPI, check.Equals, false)
 277
 278         for _, enableAltEmails := range []bool{false, true} {
 279                 s.cluster.Login.OpenIDConnect.Enable = false
 280                 s.cluster.Login.Google.Enable = true
 281                 s.cluster.Login.Google.ClientID = "google-client-id"
 282                 s.cluster.Login.Google.ClientSecret = "google-client-secret"
 283                 s.cluster.Login.Google.AlternateEmailAddresses = enableAltEmails
 284                 localdb = NewConn(s.cluster)
 285                 ctrl = localdb.loginController.(*oidcLoginController)
 286                 c.Check(ctrl.Issuer, check.Equals, "https://accounts.google.com")
 287                 c.Check(ctrl.ClientID, check.Equals, "google-client-id")
 288                 c.Check(ctrl.ClientSecret, check.Equals, "google-client-secret")
 289                 c.Check(ctrl.UseGooglePeopleAPI, check.Equals, enableAltEmails)
 290         }
 291 }
 292
 293 func (s *OIDCLoginSuite) TestGoogleLogin_PeopleAPIError(c *check.C) {
 294         s.setupPeopleAPIError(c)
 295         state := s.startLogin(c)
 296         resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 297                 Code:  s.validCode,
 298                 State: state,
 299         })
 300         c.Check(err, check.IsNil)
 301         c.Check(resp.RedirectLocation, check.Equals, "")
 302 }
 303
 304 func (s *OIDCLoginSuite) TestGenericOIDCLogin(c *check.C) {
 305         s.cluster.Login.Google.Enable = false
 306         s.cluster.Login.OpenIDConnect.Enable = true
 307         json.Unmarshal([]byte(fmt.Sprintf("%q", s.fakeIssuer.URL)), &s.cluster.Login.OpenIDConnect.Issuer)
 308         s.cluster.Login.OpenIDConnect.ClientID = "oidc#client#id"
 309         s.cluster.Login.OpenIDConnect.ClientSecret = "oidc#client#secret"
 310         s.validClientID = "oidc#client#id"
 311         s.validClientSecret = "oidc#client#secret"
 312         for _, trial := range []struct {
 313                 expectEmail string // "" if failure expected
 314                 setup       func()
 315         }{
 316                 {
 317                         expectEmail: "user@oidc.example.com",
 318                         setup: func() {
 319                                 c.Log("=== succeed because email_verified is false but not required")
 320                                 s.authEmail = "user@oidc.example.com"
 321                                 s.authEmailVerified = false
 322                                 s.cluster.Login.OpenIDConnect.EmailVerifiedClaim = ""
 323                         },
 324                 },
 325                 {
 326                         expectEmail: "",
 327                         setup: func() {
 328                                 c.Log("=== fail because email_verified is false and required")
 329                                 s.authEmail = "user@oidc.example.com"
 330                                 s.authEmailVerified = false
 331                                 s.cluster.Login.OpenIDConnect.EmailVerifiedClaim = "email_verified"
 332                         },
 333                 },
 334                 {
 335                         expectEmail: "user@oidc.example.com",
 336                         setup: func() {
 337                                 c.Log("=== succeed because email_verified is false but config uses custom 'verified' claim")
 338                                 s.authEmail = "user@oidc.example.com"
 339                                 s.authEmailVerified = false
 340                                 s.cluster.Login.OpenIDConnect.EmailVerifiedClaim = "alt_verified"
 341                         },
 342                 },
 343                 {
 344                         expectEmail: "alt_email@example.com",
 345                         setup: func() {
 346                                 c.Log("=== succeed with custom 'email' and 'email_verified' claims")
 347                                 s.authEmail = "bad@wrong.example.com"
 348                                 s.authEmailVerified = false
 349                                 s.cluster.Login.OpenIDConnect.EmailClaim = "alt_email"
 350                                 s.cluster.Login.OpenIDConnect.EmailVerifiedClaim = "alt_verified"
 351                         },
 352                 },
 353         } {
 354                 trial.setup()
 355                 if s.railsSpy != nil {
 356                         s.railsSpy.Close()
 357                 }
 358                 s.railsSpy = arvadostest.NewProxy(c, s.cluster.Services.RailsAPI)
 359                 s.localdb = NewConn(s.cluster)
 360                 *s.localdb.railsProxy = *rpc.NewConn(s.cluster.ClusterID, s.railsSpy.URL, true, rpc.PassthroughTokenProvider)
 361
 362                 state := s.startLogin(c)
 363                 resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 364                         Code:  s.validCode,
 365                         State: state,
 366                 })
 367                 c.Assert(err, check.IsNil)
 368                 if trial.expectEmail == "" {
 369                         c.Check(resp.HTML.String(), check.Matches, `(?ms).*Login error.*`)
 370                         c.Check(resp.RedirectLocation, check.Equals, "")
 371                         continue
 372                 }
 373                 c.Check(resp.HTML.String(), check.Equals, "")
 374                 target, err := url.Parse(resp.RedirectLocation)
 375                 c.Assert(err, check.IsNil)
 376                 token := target.Query().Get("api_token")
 377                 c.Check(token, check.Matches, `v2/zzzzz-gj3su-.{15}/.{32,50}`)
 378                 authinfo := getCallbackAuthInfo(c, s.railsSpy)
 379                 c.Check(authinfo.Email, check.Equals, trial.expectEmail)
 380         }
 381 }
 382
 383 func (s *OIDCLoginSuite) TestGoogleLogin_Success(c *check.C) {
 384         state := s.startLogin(c)
 385         resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 386                 Code:  s.validCode,
 387                 State: state,
 388         })
 389         c.Check(err, check.IsNil)
 390         c.Check(resp.HTML.String(), check.Equals, "")
 391         target, err := url.Parse(resp.RedirectLocation)
 392         c.Check(err, check.IsNil)
 393         c.Check(target.Host, check.Equals, "app.example.com")
 394         c.Check(target.Path, check.Equals, "/foo")
 395         token := target.Query().Get("api_token")
 396         c.Check(token, check.Matches, `v2/zzzzz-gj3su-.{15}/.{32,50}`)
 397
 398         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 399         c.Check(authinfo.FirstName, check.Equals, "Fake User")
 400         c.Check(authinfo.LastName, check.Equals, "Name")
 401         c.Check(authinfo.Email, check.Equals, "active-user@arvados.local")
 402         c.Check(authinfo.AlternateEmails, check.HasLen, 0)
 403
 404         // Try using the returned Arvados token.
 405         c.Logf("trying an API call with new token %q", token)
 406         ctx := auth.NewContext(context.Background(), &auth.Credentials{Tokens: []string{token}})
 407         cl, err := s.localdb.CollectionList(ctx, arvados.ListOptions{Limit: -1})
 408         c.Check(cl.ItemsAvailable, check.Not(check.Equals), 0)
 409         c.Check(cl.Items, check.Not(check.HasLen), 0)
 410         c.Check(err, check.IsNil)
 411
 412         // Might as well check that bogus tokens aren't accepted.
 413         badtoken := token + "plussomeboguschars"
 414         c.Logf("trying an API call with mangled token %q", badtoken)
 415         ctx = auth.NewContext(context.Background(), &auth.Credentials{Tokens: []string{badtoken}})
 416         cl, err = s.localdb.CollectionList(ctx, arvados.ListOptions{Limit: -1})
 417         c.Check(cl.Items, check.HasLen, 0)
 418         c.Check(err, check.NotNil)
 419         c.Check(err, check.ErrorMatches, `.*401 Unauthorized: Not logged in.*`)
 420 }
 421
 422 func (s *OIDCLoginSuite) TestGoogleLogin_RealName(c *check.C) {
 423         s.authEmail = "joe.smith@primary.example.com"
 424         s.fakePeopleAPIResponse = map[string]interface{}{
 425                 "names": []map[string]interface{}{
 426                         {
 427                                 "metadata":   map[string]interface{}{"primary": false},
 428                                 "givenName":  "Joe",
 429                                 "familyName": "Smith",
 430                         },
 431                         {
 432                                 "metadata":   map[string]interface{}{"primary": true},
 433                                 "givenName":  "Joseph",
 434                                 "familyName": "Psmith",
 435                         },
 436                 },
 437         }
 438         state := s.startLogin(c)
 439         s.localdb.Login(context.Background(), arvados.LoginOptions{
 440                 Code:  s.validCode,
 441                 State: state,
 442         })
 443
 444         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 445         c.Check(authinfo.FirstName, check.Equals, "Joseph")
 446         c.Check(authinfo.LastName, check.Equals, "Psmith")
 447 }
 448
 449 func (s *OIDCLoginSuite) TestGoogleLogin_OIDCRealName(c *check.C) {
 450         s.authName = "Joe P. Smith"
 451         s.authEmail = "joe.smith@primary.example.com"
 452         state := s.startLogin(c)
 453         s.localdb.Login(context.Background(), arvados.LoginOptions{
 454                 Code:  s.validCode,
 455                 State: state,
 456         })
 457
 458         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 459         c.Check(authinfo.FirstName, check.Equals, "Joe P.")
 460         c.Check(authinfo.LastName, check.Equals, "Smith")
 461 }
 462
 463 // People API returns some additional email addresses.
 464 func (s *OIDCLoginSuite) TestGoogleLogin_AlternateEmailAddresses(c *check.C) {
 465         s.authEmail = "joe.smith@primary.example.com"
 466         s.fakePeopleAPIResponse = map[string]interface{}{
 467                 "emailAddresses": []map[string]interface{}{
 468                         {
 469                                 "metadata": map[string]interface{}{"verified": true},
 470                                 "value":    "joe.smith@work.example.com",
 471                         },
 472                         {
 473                                 "value": "joe.smith@unverified.example.com", // unverified, so this one will be ignored
 474                         },
 475                         {
 476                                 "metadata": map[string]interface{}{"verified": true},
 477                                 "value":    "joe.smith@home.example.com",
 478                         },
 479                 },
 480         }
 481         state := s.startLogin(c)
 482         s.localdb.Login(context.Background(), arvados.LoginOptions{
 483                 Code:  s.validCode,
 484                 State: state,
 485         })
 486
 487         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 488         c.Check(authinfo.Email, check.Equals, "joe.smith@primary.example.com")
 489         c.Check(authinfo.AlternateEmails, check.DeepEquals, []string{"joe.smith@home.example.com", "joe.smith@work.example.com"})
 490 }
 491
 492 // Primary address is not the one initially returned by oidc.
 493 func (s *OIDCLoginSuite) TestGoogleLogin_AlternateEmailAddresses_Primary(c *check.C) {
 494         s.authEmail = "joe.smith@alternate.example.com"
 495         s.fakePeopleAPIResponse = map[string]interface{}{
 496                 "emailAddresses": []map[string]interface{}{
 497                         {
 498                                 "metadata": map[string]interface{}{"verified": true, "primary": true},
 499                                 "value":    "joe.smith@primary.example.com",
 500                         },
 501                         {
 502                                 "metadata": map[string]interface{}{"verified": true},
 503                                 "value":    "joe.smith@alternate.example.com",
 504                         },
 505                         {
 506                                 "metadata": map[string]interface{}{"verified": true},
 507                                 "value":    "jsmith+123@preferdomainforusername.example.com",
 508                         },
 509                 },
 510         }
 511         state := s.startLogin(c)
 512         s.localdb.Login(context.Background(), arvados.LoginOptions{
 513                 Code:  s.validCode,
 514                 State: state,
 515         })
 516         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 517         c.Check(authinfo.Email, check.Equals, "joe.smith@primary.example.com")
 518         c.Check(authinfo.AlternateEmails, check.DeepEquals, []string{"joe.smith@alternate.example.com", "jsmith+123@preferdomainforusername.example.com"})
 519         c.Check(authinfo.Username, check.Equals, "jsmith")
 520 }
 521
 522 func (s *OIDCLoginSuite) TestGoogleLogin_NoPrimaryEmailAddress(c *check.C) {
 523         s.authEmail = "joe.smith@unverified.example.com"
 524         s.authEmailVerified = false
 525         s.fakePeopleAPIResponse = map[string]interface{}{
 526                 "emailAddresses": []map[string]interface{}{
 527                         {
 528                                 "metadata": map[string]interface{}{"verified": true},
 529                                 "value":    "joe.smith@work.example.com",
 530                         },
 531                         {
 532                                 "metadata": map[string]interface{}{"verified": true},
 533                                 "value":    "joe.smith@home.example.com",
 534                         },
 535                 },
 536         }
 537         state := s.startLogin(c)
 538         s.localdb.Login(context.Background(), arvados.LoginOptions{
 539                 Code:  s.validCode,
 540                 State: state,
 541         })
 542
 543         authinfo := getCallbackAuthInfo(c, s.railsSpy)
 544         c.Check(authinfo.Email, check.Equals, "joe.smith@work.example.com") // first verified email in People response
 545         c.Check(authinfo.AlternateEmails, check.DeepEquals, []string{"joe.smith@home.example.com"})
 546         c.Check(authinfo.Username, check.Equals, "")
 547 }
 548
 549 func (s *OIDCLoginSuite) startLogin(c *check.C) (state string) {
 550         // Initiate login, but instead of following the redirect to
 551         // the provider, just grab state from the redirect URL.
 552         resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{ReturnTo: "https://app.example.com/foo?bar"})
 553         c.Check(err, check.IsNil)
 554         target, err := url.Parse(resp.RedirectLocation)
 555         c.Check(err, check.IsNil)
 556         state = target.Query().Get("state")
 557         c.Check(state, check.Not(check.Equals), "")
 558         return
 559 }
 560
 561 func (s *OIDCLoginSuite) fakeToken(c *check.C, payload []byte) string {
 562         signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: s.issuerKey}, nil)
 563         if err != nil {
 564                 c.Error(err)
 565         }
 566         object, err := signer.Sign(payload)
 567         if err != nil {
 568                 c.Error(err)
 569         }
 570         t, err := object.CompactSerialize()
 571         if err != nil {
 572                 c.Error(err)
 573         }
 574         c.Logf("fakeToken(%q) == %q", payload, t)
 575         return t
 576 }
 577
 578 func getCallbackAuthInfo(c *check.C, railsSpy *arvadostest.Proxy) (authinfo rpc.UserSessionAuthInfo) {
 579         for _, dump := range railsSpy.RequestDumps {
 580                 c.Logf("spied request: %q", dump)
 581                 split := bytes.Split(dump, []byte("\r\n\r\n"))
 582                 c.Assert(split, check.HasLen, 2)
 583                 hdr, body := string(split[0]), string(split[1])
 584                 if strings.Contains(hdr, "POST /auth/controller/callback") {
 585                         vs, err := url.ParseQuery(body)
 586                         c.Check(json.Unmarshal([]byte(vs.Get("auth_info")), &authinfo), check.IsNil)
 587                         c.Check(err, check.IsNil)
 588                         sort.Strings(authinfo.AlternateEmails)
 589                         return
 590                 }
 591         }
 592         c.Error("callback not found")
 593         return
 594 }