"net/http"
"net/http/httptest"
"net/url"
+ "regexp"
"sort"
"strings"
"sync"
"testing"
"time"
- "git.arvados.org/arvados.git/lib/config"
"git.arvados.org/arvados.git/lib/controller/rpc"
"git.arvados.org/arvados.git/lib/ctrlctx"
"git.arvados.org/arvados.git/sdk/go/arvados"
"git.arvados.org/arvados.git/sdk/go/arvadostest"
"git.arvados.org/arvados.git/sdk/go/auth"
- "git.arvados.org/arvados.git/sdk/go/ctxlog"
"github.com/jmoiron/sqlx"
check "gopkg.in/check.v1"
)
var _ = check.Suite(&OIDCLoginSuite{})
type OIDCLoginSuite struct {
- cluster *arvados.Cluster
- localdb *Conn
- railsSpy *arvadostest.Proxy
+ localdbSuite
trustedURL *arvados.URL
fakeProvider *arvadostest.OIDCProvider
}
-func (s *OIDCLoginSuite) TearDownSuite(c *check.C) {
- // Undo any changes/additions to the user database so they
- // don't affect subsequent tests.
- arvadostest.ResetEnv()
- c.Check(arvados.NewClientFromEnv().RequestAndDecode(nil, "POST", "database/reset", nil, nil), check.IsNil)
-}
-
func (s *OIDCLoginSuite) SetUpTest(c *check.C) {
- s.trustedURL = &arvados.URL{Scheme: "https", Host: "app.example.com", Path: "/"}
+ s.trustedURL = &arvados.URL{Scheme: "https", Host: "app.example.com:443", Path: "/"}
s.fakeProvider = arvadostest.NewOIDCProvider(c)
s.fakeProvider.AuthEmail = "active-user@arvados.local"
s.fakeProvider.ValidCode = fmt.Sprintf("abcdefgh-%d", time.Now().Unix())
s.fakeProvider.PeopleAPIResponse = map[string]interface{}{}
- cfg, err := config.NewLoader(nil, ctxlog.TestLogger(c)).Load()
- c.Assert(err, check.IsNil)
- s.cluster, err = cfg.GetCluster("")
- c.Assert(err, check.IsNil)
+ s.localdbSuite.SetUpTest(c)
+
s.cluster.Login.Test.Enable = false
s.cluster.Login.Google.Enable = true
s.cluster.Login.Google.ClientID = "test%client$id"
s.fakeProvider.ValidClientID = "test%client$id"
s.fakeProvider.ValidClientSecret = "test#client/secret"
- s.localdb = NewConn(context.Background(), s.cluster, (&ctrlctx.DBConnector{PostgreSQL: s.cluster.PostgreSQL}).GetDB)
+ s.localdb = NewConn(s.ctx, s.cluster, (&ctrlctx.DBConnector{PostgreSQL: s.cluster.PostgreSQL}).GetDB)
c.Assert(s.localdb.loginController, check.FitsTypeOf, (*oidcLoginController)(nil))
s.localdb.loginController.(*oidcLoginController).Issuer = s.fakeProvider.Issuer.URL
s.localdb.loginController.(*oidcLoginController).peopleAPIBasePath = s.fakeProvider.PeopleAPI.URL
- s.railsSpy = arvadostest.NewProxy(c, s.cluster.Services.RailsAPI)
*s.localdb.railsProxy = *rpc.NewConn(s.cluster.ClusterID, s.railsSpy.URL, true, rpc.PassthroughTokenProvider)
}
-func (s *OIDCLoginSuite) TearDownTest(c *check.C) {
- s.railsSpy.Close()
-}
-
func (s *OIDCLoginSuite) TestGoogleLogout(c *check.C) {
s.cluster.Login.TrustedClients[arvados.URL{Scheme: "https", Host: "foo.example", Path: "/"}] = struct{}{}
s.cluster.Login.TrustPrivateNetworks = false
c.Check(resp.RedirectLocation, check.Equals, "https://192.168.1.1/bar")
}
+func (s *OIDCLoginSuite) checkRPInitiatedLogout(c *check.C, returnTo string) {
+ if !c.Check(s.fakeProvider.EndSessionEndpoint, check.NotNil,
+ check.Commentf("buggy test: EndSessionEndpoint not configured")) {
+ return
+ }
+ expURL, err := url.Parse(s.fakeProvider.Issuer.URL)
+ if !c.Check(err, check.IsNil, check.Commentf("error parsing expected URL")) {
+ return
+ }
+ expURL.Path = expURL.Path + s.fakeProvider.EndSessionEndpoint.Path
+
+ accessToken := s.fakeProvider.ValidAccessToken()
+ ctx := ctrlctx.NewWithToken(s.ctx, s.cluster, accessToken)
+ resp, err := s.localdb.Logout(ctx, arvados.LogoutOptions{ReturnTo: returnTo})
+ if !c.Check(err, check.IsNil) {
+ return
+ }
+ loc, err := url.Parse(resp.RedirectLocation)
+ if !c.Check(err, check.IsNil, check.Commentf("error parsing response URL")) {
+ return
+ }
+
+ c.Check(loc.Scheme, check.Equals, "https")
+ c.Check(loc.Host, check.Equals, expURL.Host)
+ c.Check(loc.Path, check.Equals, expURL.Path)
+
+ var expReturn string
+ switch returnTo {
+ case "":
+ expReturn = s.cluster.Services.Workbench2.ExternalURL.String()
+ default:
+ expReturn = returnTo
+ }
+ values := loc.Query()
+ c.Check(values.Get("client_id"), check.Equals, s.cluster.Login.Google.ClientID)
+ c.Check(values.Get("post_logout_redirect_uri"), check.Equals, expReturn)
+}
+
+func (s *OIDCLoginSuite) TestRPInitiatedLogoutWithoutReturnTo(c *check.C) {
+ s.fakeProvider.EndSessionEndpoint = &url.URL{Path: "/logout/fromRP"}
+ s.checkRPInitiatedLogout(c, "")
+}
+
+func (s *OIDCLoginSuite) TestRPInitiatedLogoutWithReturnTo(c *check.C) {
+ s.fakeProvider.EndSessionEndpoint = &url.URL{Path: "/rp_logout"}
+ u := arvados.URL{Scheme: "https", Host: "foo.example", Path: "/"}
+ s.cluster.Login.TrustedClients[u] = struct{}{}
+ s.checkRPInitiatedLogout(c, u.String())
+}
+
+func (s *OIDCLoginSuite) TestEndSessionEndpointBadScheme(c *check.C) {
+ // RP-Initiated Logout 1.0 says: "This URL MUST use the https scheme..."
+ u := url.URL{Scheme: "http", Host: "example.com"}
+ s.fakeProvider.EndSessionEndpoint = &u
+ _, err := s.localdb.Logout(s.ctx, arvados.LogoutOptions{})
+ c.Check(err, check.ErrorMatches,
+ `.*\bend_session_endpoint MUST use HTTPS but does not: `+regexp.QuoteMeta(u.String()))
+}
+
+func (s *OIDCLoginSuite) TestNoRPInitiatedLogoutWithoutToken(c *check.C) {
+ endPath := "/TestNoRPInitiatedLogoutWithoutToken"
+ s.fakeProvider.EndSessionEndpoint = &url.URL{Path: endPath}
+ resp, _ := s.localdb.Logout(s.ctx, arvados.LogoutOptions{})
+ u, err := url.Parse(resp.RedirectLocation)
+ c.Check(err, check.IsNil)
+ c.Check(strings.HasSuffix(u.Path, endPath), check.Equals, false,
+ check.Commentf("logout redirected to end_session_endpoint without token"))
+}
+
func (s *OIDCLoginSuite) TestGoogleLogin_Start_Bogus(c *check.C) {
resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{})
c.Check(err, check.IsNil)
cleanup()
defer cleanup()
- ctx := auth.NewContext(context.Background(), &auth.Credentials{Tokens: []string{accessToken}})
+ ctx := ctrlctx.NewWithToken(s.ctx, s.cluster, accessToken)
// Check behavior on 5xx/network errors (don't cache) vs 4xx
// (do cache)
s.fakeProvider.AccessTokenPayload = map[string]interface{}{"scope": "openid profile foobar"}
accessToken = s.fakeProvider.ValidAccessToken()
- ctx = auth.NewContext(context.Background(), &auth.Credentials{Tokens: []string{accessToken}})
+ ctx = ctrlctx.NewWithToken(s.ctx, s.cluster, accessToken)
mac = hmac.New(sha256.New, []byte(s.cluster.SystemRootToken))
io.WriteString(mac, accessToken)
// Try using the returned Arvados token.
c.Logf("trying an API call with new token %q", token)
- ctx := auth.NewContext(context.Background(), &auth.Credentials{Tokens: []string{token}})
+ ctx := ctrlctx.NewWithToken(s.ctx, s.cluster, token)
cl, err := s.localdb.CollectionList(ctx, arvados.ListOptions{Limit: -1})
c.Check(cl.ItemsAvailable, check.Not(check.Equals), 0)
c.Check(cl.Items, check.Not(check.HasLen), 0)
// Might as well check that bogus tokens aren't accepted.
badtoken := token + "plussomeboguschars"
c.Logf("trying an API call with mangled token %q", badtoken)
- ctx = auth.NewContext(context.Background(), &auth.Credentials{Tokens: []string{badtoken}})
+ ctx = ctrlctx.NewWithToken(s.ctx, s.cluster, badtoken)
cl, err = s.localdb.CollectionList(ctx, arvados.ListOptions{Limit: -1})
c.Check(cl.Items, check.HasLen, 0)
c.Check(err, check.NotNil)
projects / arvados.git / blobdiff