pkg/validation/options_test.go · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on 597ffeb help sign in

typeable/oauth2-proxy/pkg/validation/options_test.go

299 lines 8.7 kB history raw

1package validation

3import (

4 "crypto"

5 "io/ioutil"

6 "net/url"

7 "os"

8 "strings"

9 "testing"

10 "time"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

13 "github.com/stretchr/testify/assert"

14)

16const (

17 cookieSecret = "secretthirtytwobytes+abcdefghijk"

18 clientID = "bazquux"

19 clientSecret = "xyzzyplugh"

20)

22func testOptions() *options.Options {

23 o := options.NewOptions()

24 o.UpstreamServers = append(o.UpstreamServers, options.Upstream{

25 ID: "upstream",

26 Path: "/",

27 URI: "http://127.0.0.1:8080/",

28 })

29 o.Cookie.Secret = cookieSecret

30 o.ClientID = clientID

31 o.ClientSecret = clientSecret

32 o.EmailDomains = []string{"*"}

33 return o

34}

36func errorMsg(msgs []string) string {

37 result := make([]string, 0)

38 result = append(result, "invalid configuration:")

39 result = append(result, msgs...)

40 return strings.Join(result, "\n ")

41}

43func TestNewOptions(t *testing.T) {

44 o := options.NewOptions()

45 o.EmailDomains = []string{"*"}

46 err := Validate(o)

47 assert.NotEqual(t, nil, err)

49 expected := errorMsg([]string{

50 "missing setting: cookie-secret",

51 "missing setting: client-id",

52 "missing setting: client-secret or client-secret-file"})

53 assert.Equal(t, expected, err.Error())

54}

56func TestClientSecretFileOptionFails(t *testing.T) {

57 o := options.NewOptions()

58 o.Cookie.Secret = cookieSecret

59 o.ClientID = clientID

60 o.ClientSecretFile = clientSecret

61 o.EmailDomains = []string{"*"}

62 err := Validate(o)

63 assert.NotEqual(t, nil, err)

65 p := o.GetProvider().Data()

66 assert.Equal(t, clientSecret, p.ClientSecretFile)

67 assert.Equal(t, "", p.ClientSecret)

69 s, err := p.GetClientSecret()

70 assert.NotEqual(t, nil, err)

71 assert.Equal(t, "", s)

72}

74func TestClientSecretFileOption(t *testing.T) {

75 var err error

76 f, err := ioutil.TempFile("", "client_secret_temp_file_")

77 if err != nil {

78 t.Fatalf("failed to create temp file: %v", err)

79 }

80 _, err = f.WriteString("testcase")

81 if err != nil {

82 t.Fatalf("failed to write to temp file: %v", err)

83 }

84 if err := f.Close(); err != nil {

85 t.Fatalf("failed to close temp file: %v", err)

86 }

87 clientSecretFileName := f.Name()

88 defer func(t *testing.T) {

89 if err := os.Remove(clientSecretFileName); err != nil {

90 t.Fatalf("failed to delete temp file: %v", err)

91 }

92 }(t)

94 o := options.NewOptions()

95 o.Cookie.Secret = cookieSecret

96 o.ClientID = clientID

97 o.ClientSecretFile = clientSecretFileName

98 o.EmailDomains = []string{"*"}

99 err = Validate(o)

100 assert.Equal(t, nil, err)

101

102 p := o.GetProvider().Data()

103 assert.Equal(t, clientSecretFileName, p.ClientSecretFile)

104 assert.Equal(t, "", p.ClientSecret)

105

106 s, err := p.GetClientSecret()

107 assert.Equal(t, nil, err)

108 assert.Equal(t, "testcase", s)

109}

110

111func TestGoogleGroupOptions(t *testing.T) {

112 o := testOptions()

113 o.GoogleGroups = []string{"googlegroup"}

114 err := Validate(o)

115 assert.NotEqual(t, nil, err)

116

117 expected := errorMsg([]string{

118 "missing setting: google-admin-email",

119 "missing setting: google-service-account-json"})

120 assert.Equal(t, expected, err.Error())

121}

122

123func TestGoogleGroupInvalidFile(t *testing.T) {

124 o := testOptions()

125 o.GoogleGroups = []string{"test_group"}

126 o.GoogleAdminEmail = "admin@example.com"

127 o.GoogleServiceAccountJSON = "file_doesnt_exist.json"

128 err := Validate(o)

129 assert.NotEqual(t, nil, err)

130

131 expected := errorMsg([]string{

132 "invalid Google credentials file: file_doesnt_exist.json",

133 })

134 assert.Equal(t, expected, err.Error())

135}

136

137func TestInitializedOptions(t *testing.T) {

138 o := testOptions()

139 assert.Equal(t, nil, Validate(o))

140}

141

142// Note that it's not worth testing nonparseable URLs, since url.Parse()

143// seems to parse damn near anything.

144func TestRedirectURL(t *testing.T) {

145 o := testOptions()

146 o.RawRedirectURL = "https://myhost.com/oauth2/callback"

147 assert.Equal(t, nil, Validate(o))

148 expected := &url.URL{

149 Scheme: "https", Host: "myhost.com", Path: "/oauth2/callback"}

150 assert.Equal(t, expected, o.GetRedirectURL())

151}

152

153func TestDefaultProviderApiSettings(t *testing.T) {

154 o := testOptions()

155 assert.Equal(t, nil, Validate(o))

156 p := o.GetProvider().Data()

157 assert.Equal(t, "https://accounts.google.com/o/oauth2/auth?access_type=offline",

158 p.LoginURL.String())

159 assert.Equal(t, "https://www.googleapis.com/oauth2/v3/token",

160 p.RedeemURL.String())

161 assert.Equal(t, "", p.ProfileURL.String())

162 assert.Equal(t, "profile email", p.Scope)

163}

164

165func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {

166 o := testOptions()

167 assert.Equal(t, nil, Validate(o))

168

169 o.Cookie.Secret = "0123456789abcdef"

170 o.Cookie.Refresh = o.Cookie.Expire

171 assert.NotEqual(t, nil, Validate(o))

172

173 o.Cookie.Refresh -= time.Duration(1)

174 assert.Equal(t, nil, Validate(o))

175}

176

177func TestBase64CookieSecret(t *testing.T) {

178 o := testOptions()

179 assert.Equal(t, nil, Validate(o))

180

181 // 32 byte, base64 (urlsafe) encoded key

182 o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="

183 assert.Equal(t, nil, Validate(o))

184

185 // 32 byte, base64 (urlsafe) encoded key, w/o padding

186 o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"

187 assert.Equal(t, nil, Validate(o))

188

189 // 24 byte, base64 (urlsafe) encoded key

190 o.Cookie.Secret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"

191 assert.Equal(t, nil, Validate(o))

192

193 // 16 byte, base64 (urlsafe) encoded key

194 o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA=="

195 assert.Equal(t, nil, Validate(o))

196

197 // 16 byte, base64 (urlsafe) encoded key, w/o padding

198 o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA"

199 assert.Equal(t, nil, Validate(o))

200}

201

202func TestValidateSignatureKey(t *testing.T) {

203 o := testOptions()

204 o.SignatureKey = "sha1:secret"

205 assert.Equal(t, nil, Validate(o))

206 assert.Equal(t, o.GetSignatureData().Hash, crypto.SHA1)

207 assert.Equal(t, o.GetSignatureData().Key, "secret")

208}

209

210func TestValidateSignatureKeyInvalidSpec(t *testing.T) {

211 o := testOptions()

212 o.SignatureKey = "invalid spec"

213 err := Validate(o)

214 assert.Equal(t, err.Error(), "invalid configuration:\n"+

215 " invalid signature hash:key spec: "+o.SignatureKey)

216}

217

218func TestValidateSignatureKeyUnsupportedAlgorithm(t *testing.T) {

219 o := testOptions()

220 o.SignatureKey = "unsupported:default secret"

221 err := Validate(o)

222 assert.Equal(t, err.Error(), "invalid configuration:\n"+

223 " unsupported signature hash algorithm: "+o.SignatureKey)

224}

225

226func TestSkipOIDCDiscovery(t *testing.T) {

227 o := testOptions()

228 o.ProviderType = "oidc"

229 o.OIDCIssuerURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/v2.0/"

230 o.SkipOIDCDiscovery = true

231

232 err := Validate(o)

233 assert.Equal(t, "invalid configuration:\n"+

234 " missing setting: login-url\n missing setting: redeem-url\n missing setting: oidc-jwks-url", err.Error())

235

236 o.LoginURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_sign_in"

237 o.RedeemURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_sign_in"

238 o.OIDCJwksURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/discovery/v2.0/keys"

239

240 assert.Equal(t, nil, Validate(o))

241}

242

243func TestGCPHealthcheck(t *testing.T) {

244 o := testOptions()

245 o.GCPHealthChecks = true

246 assert.Equal(t, nil, Validate(o))

247}

248

249func TestRealClientIPHeader(t *testing.T) {

250 // Ensure nil if ReverseProxy not set.

251 o := testOptions()

252 o.RealClientIPHeader = "X-Real-IP"

253 assert.Equal(t, nil, Validate(o))

254 assert.Nil(t, o.GetRealClientIPParser())

255

256 // Ensure simple use case works.

257 o = testOptions()

258 o.ReverseProxy = true

259 o.RealClientIPHeader = "X-Forwarded-For"

260 assert.Equal(t, nil, Validate(o))

261 assert.NotNil(t, o.GetRealClientIPParser())

262

263 // Ensure unknown header format process an error.

264 o = testOptions()

265 o.ReverseProxy = true

266 o.RealClientIPHeader = "Forwarded"

267 err := Validate(o)

268 assert.NotEqual(t, nil, err)

269 expected := errorMsg([]string{

270 "real_client_ip_header (Forwarded) not accepted parameter value: the http header key (Forwarded) is either invalid or unsupported",

271 })

272 assert.Equal(t, expected, err.Error())

273 assert.Nil(t, o.GetRealClientIPParser())

274

275 // Ensure invalid header format produces an error.

276 o = testOptions()

277 o.ReverseProxy = true

278 o.RealClientIPHeader = "!934invalidheader-23:"

279 err = Validate(o)

280 assert.NotEqual(t, nil, err)

281 expected = errorMsg([]string{

282 "real_client_ip_header (!934invalidheader-23:) not accepted parameter value: the http header key (!934invalidheader-23:) is either invalid or unsupported",

283 })

284 assert.Equal(t, expected, err.Error())

285 assert.Nil(t, o.GetRealClientIPParser())

286}

287

288func TestProviderCAFilesError(t *testing.T) {

289 file, err := ioutil.TempFile("", "absent.*.crt")

290 assert.NoError(t, err)

291 assert.NoError(t, file.Close())

292 assert.NoError(t, os.Remove(file.Name()))

293

294 o := testOptions()

295 o.ProviderCAFiles = append(o.ProviderCAFiles, file.Name())

296 err = Validate(o)

297 assert.Error(t, err)

298 assert.Contains(t, err.Error(), "unable to load provider CA file(s)")

299}