1 # Copyright (C) The Arvados Authors. All rights reserved.
3 # SPDX-License-Identifier: AGPL-3.0
6 require 'webrick/https'
8 require 'helpers/users_test_helper'
10 class RemoteUsersTest < ActionDispatch::IntegrationTest
13 def salted_active_token(remote:)
14 salt_token(fixture: :active, remote: remote).sub('/zzzzz-', '/'+remote+'-')
18 token = salted_active_token(remote: remote)
19 {"HTTP_AUTHORIZATION" => "Bearer #{token}"}
22 # For remote authentication tests, we bring up a simple stub server
23 # (on a port chosen by webrick) and configure the SUT so the stub is
24 # responsible for clusters "zbbbb" (a well-behaved cluster) and
25 # "zbork" (a misbehaving cluster).
27 # Test cases can override the stub's default response to
28 # .../users/current by changing @stub_status and @stub_content.
31 clnt.ssl_config.verify_mode = OpenSSL::SSL::VERIFY_NONE
32 HTTPClient.stubs(:new).returns clnt
34 @controller = Arvados::V1::UsersController.new
35 ready = Thread::Queue.new
40 ['zbbbb', 'zbork'].each do |clusterid|
41 srv = WEBrick::HTTPServer.new(
43 Logger: WEBrick::Log.new(
44 Rails.root.join("log", "webrick.log").to_s,
46 AccessLog: [[File.open(Rails.root.join(
47 "log", "webrick_access.log").to_s, 'a+'),
48 WEBrick::AccessLog::COMBINED_LOG_FORMAT]],
50 SSLVerifyClient: OpenSSL::SSL::VERIFY_NONE,
51 SSLPrivateKey: OpenSSL::PKey::RSA.new(
52 File.open(Rails.root.join("tmp", "self-signed.key")).read),
53 SSLCertificate: OpenSSL::X509::Certificate.new(
54 File.open(Rails.root.join("tmp", "self-signed.pem")).read),
55 SSLCertName: [["CN", WEBrick::Utils::getservername]],
56 StartCallback: lambda { ready.push(true) })
57 srv.mount_proc '/discovery/v1/apis/arvados/v1/rest' do |req, res|
58 Rails.cache.delete 'arvados_v1_rest_discovery'
59 res.body = Arvados::V1::SchemaController.new.send(:discovery_doc).to_json
61 srv.mount_proc '/arvados/v1/users/current' do |req, res|
62 if clusterid == 'zbbbb' and req.header['authorization'][0][10..14] == 'zbork'
63 # asking zbbbb about zbork should yield an error, zbbbb doesn't trust zbork
67 res.status = @stub_status
68 res.body = @stub_content.is_a?(String) ? @stub_content : @stub_content.to_json
70 srv.mount_proc '/arvados/v1/api_client_authorizations/current' do |req, res|
71 if clusterid == 'zbbbb' and req.header['authorization'][0][10..14] == 'zbork'
72 # asking zbbbb about zbork should yield an error, zbbbb doesn't trust zbork
76 res.status = @stub_token_status
79 uuid: api_client_authorizations(:active).uuid.sub('zzzzz', clusterid),
80 scopes: @stub_token_scopes,
89 @remote_host << "127.0.0.1:#{srv.config[:Port]}"
91 Rails.configuration.RemoteClusters = Rails.configuration.RemoteClusters.merge({zbbbb: ActiveSupport::InheritableOptions.new({Host: @remote_host[0]}),
92 zbork: ActiveSupport::InheritableOptions.new({Host: @remote_host[1]})})
93 Arvados::V1::SchemaController.any_instance.stubs(:root_url).returns "https://#{@remote_host[0]}"
96 uuid: 'zbbbb-tpzed-000000000000001',
97 email: 'foo@example.com',
103 @stub_token_status = 200
104 @stub_token_scopes = ["all"]
108 @remote_server.each do |srv|
113 test 'authenticate with remote token that has limited scope' do
114 get '/arvados/v1/collections',
115 params: {format: 'json'},
116 headers: auth(remote: 'zbbbb')
117 assert_response :success
119 @stub_token_scopes = ["GET /arvados/v1/users/current"]
121 # re-authorize before cache expires
122 get '/arvados/v1/collections',
123 params: {format: 'json'},
124 headers: auth(remote: 'zbbbb')
125 assert_response :success
127 # simulate cache expiry
128 ApiClientAuthorization.where('uuid like ?', 'zbbbb-%').
129 update_all(expires_at: db_current_time - 1.minute)
131 # re-authorize after cache expires
132 get '/arvados/v1/collections',
133 params: {format: 'json'},
134 headers: auth(remote: 'zbbbb')
138 test 'authenticate with remote token' do
139 get '/arvados/v1/users/current',
140 params: {format: 'json'},
141 headers: auth(remote: 'zbbbb')
142 assert_response :success
143 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
144 assert_equal false, json_response['is_admin']
145 assert_equal false, json_response['is_active']
146 assert_equal 'foo@example.com', json_response['email']
147 assert_equal 'barney', json_response['username']
149 # revoke original token
152 # re-authorize before cache expires
153 get '/arvados/v1/users/current',
154 params: {format: 'json'},
155 headers: auth(remote: 'zbbbb')
156 assert_response :success
158 # simulate cache expiry
159 ApiClientAuthorization.where('uuid like ?', 'zbbbb-%').
160 update_all(expires_at: db_current_time - 1.minute)
162 # re-authorize after cache expires
163 get '/arvados/v1/users/current',
164 params: {format: 'json'},
165 headers: auth(remote: 'zbbbb')
168 # simulate cached token indicating wrong user (e.g., local user
169 # entry was migrated out of the way taking the cached token with
170 # it, or authorizing cluster reassigned auth to a different user)
171 ApiClientAuthorization.where(
172 uuid: salted_active_token(remote: 'zbbbb').split('/')[1]).
173 update_all(user_id: users(:active).id)
175 # revive original token and re-authorize
177 @stub_content[:username] = 'blarney'
178 @stub_content[:email] = 'blarney@example.com'
179 get '/arvados/v1/users/current',
180 params: {format: 'json'},
181 headers: auth(remote: 'zbbbb')
182 assert_response :success
183 assert_equal 'barney', json_response['username'], 'local username should not change once assigned'
184 assert_equal 'blarney@example.com', json_response['email']
187 test 'remote user is deactivated' do
188 Rails.configuration.RemoteClusters['zbbbb'].ActivateUsers = true
189 get '/arvados/v1/users/current',
190 params: {format: 'json'},
191 headers: auth(remote: 'zbbbb')
192 assert_response :success
193 assert_equal true, json_response['is_active']
195 # revoke original token
196 @stub_content[:is_active] = false
197 @stub_content[:is_invited] = false
199 # simulate cache expiry
200 ApiClientAuthorization.where(
201 uuid: salted_active_token(remote: 'zbbbb').split('/')[1]).
202 update_all(expires_at: db_current_time - 1.minute)
204 # re-authorize after cache expires
205 get '/arvados/v1/users/current',
206 params: {format: 'json'},
207 headers: auth(remote: 'zbbbb')
208 assert_equal false, json_response['is_active']
212 test 'authenticate with remote token, remote username conflicts with local' do
213 @stub_content[:username] = 'active'
214 get '/arvados/v1/users/current',
215 params: {format: 'json'},
216 headers: auth(remote: 'zbbbb')
217 assert_response :success
218 assert_equal 'active2', json_response['username']
221 test 'authenticate with remote token, remote username is nil' do
222 @stub_content.delete :username
223 get '/arvados/v1/users/current',
224 params: {format: 'json'},
225 headers: auth(remote: 'zbbbb')
226 assert_response :success
227 assert_equal 'foo', json_response['username']
230 test 'authenticate with remote token from misbehaving remote cluster' do
231 get '/arvados/v1/users/current',
232 params: {format: 'json'},
233 headers: auth(remote: 'zbork')
237 test 'authenticate with remote token that fails validate' do
240 error: 'not authorized',
242 get '/arvados/v1/users/current',
243 params: {format: 'json'},
244 headers: auth(remote: 'zbbbb')
252 "v2/'; delete from users where 1=1; commit; select '/lol",
254 'v2/zzzzz-gj3su-077z32aux8dg2s1',
255 'v2/zzzzz-gj3su-077z32aux8dg2s1/',
256 'v2/3kg6k6lzmp9kj5cpkcoxie963cmvjahbt2fod9zru30k1jqdmi',
257 'v2/3kg6k6lzmp9kj5cpkcoxie963cmvjahbt2fod9zru30k1jqdmi/zzzzz-gj3su-077z32aux8dg2s1',
258 'v2//3kg6k6lzmp9kj5cpkcoxie963cmvjahbt2fod9zru30k1jqdmi',
259 'v8/zzzzz-gj3su-077z32aux8dg2s1/3kg6k6lzmp9kj5cpkcoxie963cmvjahbt2fod9zru30k1jqdmi',
260 '/zzzzz-gj3su-077z32aux8dg2s1/3kg6k6lzmp9kj5cpkcoxie963cmvjahbt2fod9zru30k1jqdmi',
261 '"v2/zzzzz-gj3su-077z32aux8dg2s1/3kg6k6lzmp9kj5cpkcoxie963cmvjahbt2fod9zru30k1jqdmi"',
266 test "authenticate with malformed remote token #{token}" do
267 get '/arvados/v1/users/current',
268 params: {format: 'json'},
269 headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"}
274 test "ignore extra fields in remote token" do
275 token = salted_active_token(remote: 'zbbbb') + '/foo/bar/baz/*'
276 get '/arvados/v1/users/current',
277 params: {format: 'json'},
278 headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"}
279 assert_response :success
282 test 'remote api server is not an api server' do
284 @stub_content = '<html>bad</html>'
285 get '/arvados/v1/users/current',
286 params: {format: 'json'},
287 headers: auth(remote: 'zbbbb')
291 ['zbbbb', 'z0000'].each do |token_valid_for|
292 test "validate #{token_valid_for}-salted token for remote cluster zbbbb" do
293 salted_token = salt_token(fixture: :active, remote: token_valid_for)
294 get '/arvados/v1/users/current',
295 params: {format: 'json', remote: 'zbbbb'},
296 headers: {"HTTP_AUTHORIZATION" => "Bearer #{salted_token}"}
297 if token_valid_for == 'zbbbb'
299 assert_equal(users(:active).uuid, json_response['uuid'])
306 test "list readable groups with salted token" do
307 salted_token = salt_token(fixture: :active, remote: 'zbbbb')
308 get '/arvados/v1/groups',
314 headers: {"HTTP_AUTHORIZATION" => "Bearer #{salted_token}"}
316 group_uuids = json_response['items'].collect { |i| i['uuid'] }
317 assert_includes(group_uuids, 'zzzzz-j7d0g-fffffffffffffff')
318 refute_includes(group_uuids, 'zzzzz-j7d0g-000000000000000')
319 assert_includes(group_uuids, groups(:aproject).uuid)
320 refute_includes(group_uuids, groups(:trashed_project).uuid)
321 refute_includes(group_uuids, groups(:testusergroup_admins).uuid)
324 test 'do not auto-activate user from untrusted cluster' do
325 Rails.configuration.RemoteClusters['zbbbb'].AutoSetupNewUsers = false
326 Rails.configuration.RemoteClusters['zbbbb'].ActivateUsers = false
327 get '/arvados/v1/users/current',
328 params: {format: 'json'},
329 headers: auth(remote: 'zbbbb')
330 assert_response :success
331 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
332 assert_equal false, json_response['is_admin']
333 assert_equal false, json_response['is_active']
334 assert_equal 'foo@example.com', json_response['email']
335 assert_equal 'barney', json_response['username']
336 post '/arvados/v1/users/zbbbb-tpzed-000000000000001/activate',
337 params: {format: 'json'},
338 headers: auth(remote: 'zbbbb')
342 test 'auto-activate user from trusted cluster' do
343 Rails.configuration.RemoteClusters['zbbbb'].ActivateUsers = true
344 get '/arvados/v1/users/current',
345 params: {format: 'json'},
346 headers: auth(remote: 'zbbbb')
347 assert_response :success
348 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
349 assert_equal false, json_response['is_admin']
350 assert_equal true, json_response['is_active']
351 assert_equal 'foo@example.com', json_response['email']
352 assert_equal 'barney', json_response['username']
355 test 'get user from Login cluster' do
356 Rails.configuration.Login.LoginCluster = 'zbbbb'
357 get '/arvados/v1/users/current',
358 params: {format: 'json'},
359 headers: auth(remote: 'zbbbb')
360 assert_response :success
361 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
362 assert_equal true, json_response['is_admin']
363 assert_equal true, json_response['is_active']
364 assert_equal 'foo@example.com', json_response['email']
365 assert_equal 'barney', json_response['username']
368 [true, false].each do |trusted|
369 [true, false].each do |logincluster|
370 [true, false].each do |admin|
371 [true, false].each do |active|
372 [true, false].each do |autosetup|
373 [true, false].each do |invited|
374 test "get invited=#{invited}, active=#{active}, admin=#{admin} user from #{if logincluster then "Login" else "peer" end} cluster when AutoSetupNewUsers=#{autosetup} ActivateUsers=#{trusted}" do
375 Rails.configuration.Login.LoginCluster = 'zbbbb' if logincluster
376 Rails.configuration.RemoteClusters['zbbbb'].ActivateUsers = trusted
377 Rails.configuration.Users.AutoSetupNewUsers = autosetup
379 uuid: 'zbbbb-tpzed-000000000000001',
380 email: 'foo@example.com',
386 get '/arvados/v1/users/current',
387 params: {format: 'json'},
388 headers: auth(remote: 'zbbbb')
389 assert_response :success
390 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
391 assert_equal (logincluster && admin && invited && active), json_response['is_admin']
392 assert_equal (invited and (logincluster || trusted || autosetup)), json_response['is_invited']
393 assert_equal (invited and (logincluster || trusted) and active), json_response['is_active']
394 assert_equal 'foo@example.com', json_response['email']
395 assert_equal 'barney', json_response['username']
404 test 'get active user from Login cluster when AutoSetupNewUsers is set' do
405 Rails.configuration.Login.LoginCluster = 'zbbbb'
406 Rails.configuration.Users.AutoSetupNewUsers = true
408 uuid: 'zbbbb-tpzed-000000000000001',
409 email: 'foo@example.com',
415 get '/arvados/v1/users/current',
416 params: {format: 'json'},
417 headers: auth(remote: 'zbbbb')
418 assert_response :success
419 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
420 assert_equal false, json_response['is_admin']
421 assert_equal true, json_response['is_active']
422 assert_equal true, json_response['is_invited']
423 assert_equal 'foo@example.com', json_response['email']
424 assert_equal 'barney', json_response['username']
427 uuid: 'zbbbb-tpzed-000000000000001',
428 email: 'foo@example.com',
435 # Use cached value. User will still be active because we haven't
436 # re-queried the upstream cluster.
437 get '/arvados/v1/users/current',
438 params: {format: 'json'},
439 headers: auth(remote: 'zbbbb')
440 assert_response :success
441 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
442 assert_equal false, json_response['is_admin']
443 assert_equal true, json_response['is_active']
444 assert_equal true, json_response['is_invited']
445 assert_equal 'foo@example.com', json_response['email']
446 assert_equal 'barney', json_response['username']
448 # Delete cached value. User should be inactive now.
449 act_as_system_user do
450 ApiClientAuthorization.delete_all
453 get '/arvados/v1/users/current',
454 params: {format: 'json'},
455 headers: auth(remote: 'zbbbb')
456 assert_response :success
457 assert_equal 'zbbbb-tpzed-000000000000001', json_response['uuid']
458 assert_equal false, json_response['is_admin']
459 assert_equal false, json_response['is_active']
460 assert_equal false, json_response['is_invited']
461 assert_equal 'foo@example.com', json_response['email']
462 assert_equal 'barney', json_response['username']
466 test 'pre-activate remote user' do
468 uuid: 'zbbbb-tpzed-000000000001234',
469 email: 'foo@example.com',
476 post '/arvados/v1/users',
479 "uuid" => "zbbbb-tpzed-000000000001234",
480 "email" => 'foo@example.com',
481 "username" => 'barney',
486 headers: {'HTTP_AUTHORIZATION' => "OAuth2 #{api_token(:admin)}"}
487 assert_response :success
489 get '/arvados/v1/users/current',
490 params: {format: 'json'},
491 headers: auth(remote: 'zbbbb')
492 assert_response :success
493 assert_equal 'zbbbb-tpzed-000000000001234', json_response['uuid']
494 assert_equal false, json_response['is_admin']
495 assert_equal true, json_response['is_active']
496 assert_equal 'foo@example.com', json_response['email']
497 assert_equal 'barney', json_response['username']
501 test 'remote user inactive without pre-activation' do
503 uuid: 'zbbbb-tpzed-000000000001234',
504 email: 'foo@example.com',
511 get '/arvados/v1/users/current',
512 params: {format: 'json'},
513 headers: auth(remote: 'zbbbb')
514 assert_response :success
515 assert_equal 'zbbbb-tpzed-000000000001234', json_response['uuid']
516 assert_equal false, json_response['is_admin']
517 assert_equal false, json_response['is_active']
518 assert_equal 'foo@example.com', json_response['email']
519 assert_equal 'barney', json_response['username']
522 test "validate unsalted v2 token for remote cluster zbbbb" do
523 auth = api_client_authorizations(:active)
524 token = "v2/#{auth.uuid}/#{auth.api_token}"
525 get '/arvados/v1/users/current',
526 params: {format: 'json', remote: 'zbbbb'},
527 headers: {"HTTP_AUTHORIZATION" => "Bearer #{token}"}
528 assert_response :success
529 assert_equal(users(:active).uuid, json_response['uuid'])
532 test 'container request with runtime_token' do
533 [["valid local", "v2/#{api_client_authorizations(:active).uuid}/#{api_client_authorizations(:active).api_token}"],
534 ["valid remote", "v2/zbbbb-gj3su-000000000000000/abc"],
535 ["invalid local", "v2/#{api_client_authorizations(:active).uuid}/fakefakefake"],
536 ["invalid remote", "v2/zbork-gj3su-000000000000000/abc"],
537 ].each do |label, runtime_token|
538 post '/arvados/v1/container_requests',
540 "container_request" => {
541 "command" => ["echo"],
542 "container_image" => "xyz",
543 "output_path" => "/",
545 "runtime_token" => runtime_token
548 headers: {"HTTP_AUTHORIZATION" => "Bearer #{api_client_authorizations(:active).api_token}"}
549 if label.include? "invalid"
552 assert_response :success
557 test 'authenticate with remote token, remote user is system user' do
558 @stub_content[:uuid] = 'zbbbb-tpzed-000000000000000'
559 get '/arvados/v1/users/current',
560 params: {format: 'json'},
561 headers: auth(remote: 'zbbbb')
562 assert_equal 'from cluster zbbbb', json_response['last_name']
565 test 'authenticate with remote token, remote user is anonymous user' do
566 @stub_content[:uuid] = 'zbbbb-tpzed-anonymouspublic'
567 get '/arvados/v1/users/current',
568 params: {format: 'json'},
569 headers: auth(remote: 'zbbbb')
570 assert_response :success
571 assert_equal 'zzzzz-tpzed-anonymouspublic', json_response['uuid']