X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/e04c307f011f5ce3b42dff062e1394256f604037..569982eaa34ca549fc25953bcd20570af8e53398:/lib/controller/localdb/login_oidc_test.go

diff --git a/lib/controller/localdb/login_oidc_test.go b/lib/controller/localdb/login_oidc_test.go
index 9bc6f90ea9..e3c72adddc 100644
--- a/lib/controller/localdb/login_oidc_test.go
+++ b/lib/controller/localdb/login_oidc_test.go
@@ -7,8 +7,11 @@ package localdb
 import (
 	"bytes"
 	"context"
+	"crypto/hmac"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -23,6 +26,7 @@ import (
 	"git.arvados.org/arvados.git/sdk/go/arvadostest"
 	"git.arvados.org/arvados.git/sdk/go/auth"
 	"git.arvados.org/arvados.git/sdk/go/ctxlog"
+	"github.com/jmoiron/sqlx"
 	check "gopkg.in/check.v1"
 )
 
@@ -161,12 +165,14 @@ func (s *OIDCLoginSuite) TestConfig(c *check.C) {
 	s.cluster.Login.OpenIDConnect.Issuer = "https://accounts.example.com/"
 	s.cluster.Login.OpenIDConnect.ClientID = "oidc-client-id"
 	s.cluster.Login.OpenIDConnect.ClientSecret = "oidc-client-secret"
+	s.cluster.Login.OpenIDConnect.AuthenticationRequestParameters = map[string]string{"testkey": "testvalue"}
 	localdb := NewConn(s.cluster)
 	ctrl := localdb.loginController.(*oidcLoginController)
 	c.Check(ctrl.Issuer, check.Equals, "https://accounts.example.com/")
 	c.Check(ctrl.ClientID, check.Equals, "oidc-client-id")
 	c.Check(ctrl.ClientSecret, check.Equals, "oidc-client-secret")
 	c.Check(ctrl.UseGooglePeopleAPI, check.Equals, false)
+	c.Check(ctrl.AuthParams["testkey"], check.Equals, "testvalue")
 
 	for _, enableAltEmails := range []bool{false, true} {
 		s.cluster.Login.OpenIDConnect.Enable = false
@@ -174,12 +180,14 @@ func (s *OIDCLoginSuite) TestConfig(c *check.C) {
 		s.cluster.Login.Google.ClientID = "google-client-id"
 		s.cluster.Login.Google.ClientSecret = "google-client-secret"
 		s.cluster.Login.Google.AlternateEmailAddresses = enableAltEmails
+		s.cluster.Login.Google.AuthenticationRequestParameters = map[string]string{"testkey": "testvalue"}
 		localdb = NewConn(s.cluster)
 		ctrl = localdb.loginController.(*oidcLoginController)
 		c.Check(ctrl.Issuer, check.Equals, "https://accounts.google.com")
 		c.Check(ctrl.ClientID, check.Equals, "google-client-id")
 		c.Check(ctrl.ClientSecret, check.Equals, "google-client-secret")
 		c.Check(ctrl.UseGooglePeopleAPI, check.Equals, enableAltEmails)
+		c.Check(ctrl.AuthParams["testkey"], check.Equals, "testvalue")
 	}
 }
 
@@ -194,12 +202,69 @@ func (s *OIDCLoginSuite) TestGoogleLogin_PeopleAPIError(c *check.C) {
 	c.Check(resp.RedirectLocation, check.Equals, "")
 }
 
+func (s *OIDCLoginSuite) TestOIDCAuthorizer(c *check.C) {
+	s.cluster.Login.Google.Enable = false
+	s.cluster.Login.OpenIDConnect.Enable = true
+	json.Unmarshal([]byte(fmt.Sprintf("%q", s.fakeProvider.Issuer.URL)), &s.cluster.Login.OpenIDConnect.Issuer)
+	s.cluster.Login.OpenIDConnect.ClientID = "oidc#client#id"
+	s.cluster.Login.OpenIDConnect.ClientSecret = "oidc#client#secret"
+	s.fakeProvider.ValidClientID = "oidc#client#id"
+	s.fakeProvider.ValidClientSecret = "oidc#client#secret"
+	db := arvadostest.DB(c, s.cluster)
+
+	tokenCacheTTL = time.Millisecond
+	tokenCacheRaceWindow = time.Millisecond
+
+	oidcAuthorizer := OIDCAccessTokenAuthorizer(s.cluster, func(context.Context) (*sqlx.DB, error) { return db, nil })
+	accessToken := s.fakeProvider.ValidAccessToken()
+
+	mac := hmac.New(sha256.New, []byte(s.cluster.SystemRootToken))
+	io.WriteString(mac, accessToken)
+	hmac := fmt.Sprintf("%x", mac.Sum(nil))
+
+	cleanup := func() {
+		_, err := db.Exec(`delete from api_client_authorizations where api_token=$1`, hmac)
+		c.Check(err, check.IsNil)
+	}
+	cleanup()
+	defer cleanup()
+
+	ctx := auth.NewContext(context.Background(), &auth.Credentials{Tokens: []string{accessToken}})
+	var exp1 time.Time
+	oidcAuthorizer.WrapCalls(func(ctx context.Context, opts interface{}) (interface{}, error) {
+		creds, ok := auth.FromContext(ctx)
+		c.Assert(ok, check.Equals, true)
+		c.Assert(creds.Tokens, check.HasLen, 1)
+		c.Check(creds.Tokens[0], check.Equals, accessToken)
+
+		err := db.QueryRowContext(ctx, `select expires_at at time zone 'UTC' from api_client_authorizations where api_token=$1`, hmac).Scan(&exp1)
+		c.Check(err, check.IsNil)
+		c.Check(exp1.Sub(time.Now()) > -time.Second, check.Equals, true)
+		c.Check(exp1.Sub(time.Now()) < time.Second, check.Equals, true)
+		return nil, nil
+	})(ctx, nil)
+
+	// If the token is used again after the in-memory cache
+	// expires, oidcAuthorizer must re-checks the token and update
+	// the expires_at value in the database.
+	time.Sleep(3 * time.Millisecond)
+	oidcAuthorizer.WrapCalls(func(ctx context.Context, opts interface{}) (interface{}, error) {
+		var exp time.Time
+		err := db.QueryRowContext(ctx, `select expires_at at time zone 'UTC' from api_client_authorizations where api_token=$1`, hmac).Scan(&exp)
+		c.Check(err, check.IsNil)
+		c.Check(exp.Sub(exp1) > 0, check.Equals, true)
+		c.Check(exp.Sub(exp1) < time.Second, check.Equals, true)
+		return nil, nil
+	})(ctx, nil)
+}
+
 func (s *OIDCLoginSuite) TestGenericOIDCLogin(c *check.C) {
 	s.cluster.Login.Google.Enable = false
 	s.cluster.Login.OpenIDConnect.Enable = true
 	json.Unmarshal([]byte(fmt.Sprintf("%q", s.fakeProvider.Issuer.URL)), &s.cluster.Login.OpenIDConnect.Issuer)
 	s.cluster.Login.OpenIDConnect.ClientID = "oidc#client#id"
 	s.cluster.Login.OpenIDConnect.ClientSecret = "oidc#client#secret"
+	s.cluster.Login.OpenIDConnect.AuthenticationRequestParameters = map[string]string{"testkey": "testvalue"}
 	s.fakeProvider.ValidClientID = "oidc#client#id"
 	s.fakeProvider.ValidClientSecret = "oidc#client#secret"
 	for _, trial := range []struct {
@@ -259,7 +324,9 @@ func (s *OIDCLoginSuite) TestGenericOIDCLogin(c *check.C) {
 		s.localdb = NewConn(s.cluster)
 		*s.localdb.railsProxy = *rpc.NewConn(s.cluster.ClusterID, s.railsSpy.URL, true, rpc.PassthroughTokenProvider)
 
-		state := s.startLogin(c)
+		state := s.startLogin(c, func(form url.Values) {
+			c.Check(form.Get("testkey"), check.Equals, "testvalue")
+		})
 		resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 			Code:  s.fakeProvider.ValidCode,
 			State: state,
@@ -290,7 +357,12 @@ func (s *OIDCLoginSuite) TestGenericOIDCLogin(c *check.C) {
 }
 
 func (s *OIDCLoginSuite) TestGoogleLogin_Success(c *check.C) {
-	state := s.startLogin(c)
+	s.cluster.Login.Google.AuthenticationRequestParameters["prompt"] = "consent"
+	s.cluster.Login.Google.AuthenticationRequestParameters["foo"] = "bar"
+	state := s.startLogin(c, func(form url.Values) {
+		c.Check(form.Get("foo"), check.Equals, "bar")
+		c.Check(form.Get("prompt"), check.Equals, "consent")
+	})
 	resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{
 		Code:  s.fakeProvider.ValidCode,
 		State: state,
@@ -455,7 +527,7 @@ func (s *OIDCLoginSuite) TestGoogleLogin_NoPrimaryEmailAddress(c *check.C) {
 	c.Check(authinfo.Username, check.Equals, "")
 }
 
-func (s *OIDCLoginSuite) startLogin(c *check.C) (state string) {
+func (s *OIDCLoginSuite) startLogin(c *check.C, checks ...func(url.Values)) (state string) {
 	// Initiate login, but instead of following the redirect to
 	// the provider, just grab state from the redirect URL.
 	resp, err := s.localdb.Login(context.Background(), arvados.LoginOptions{ReturnTo: "https://app.example.com/foo?bar"})
@@ -464,6 +536,10 @@ func (s *OIDCLoginSuite) startLogin(c *check.C) (state string) {
 	c.Check(err, check.IsNil)
 	state = target.Query().Get("state")
 	c.Check(state, check.Not(check.Equals), "")
+	for _, fn := range checks {
+		fn(target.Query())
+	}
+	s.cluster.Login.OpenIDConnect.AuthenticationRequestParameters = map[string]string{"testkey": "testvalue"}
 	return
 }