oauthproxy_test.go · typeable/oauth2-proxy

967 expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"],\"preferredUsername\":\"john\"}\n",

968 },

969 }

970

971 for _, tc := range testCases {

972 t.Run(tc.name, func(t *testing.T) {

973 test, err := NewUserInfoEndpointTest()

974 if err != nil {

975 t.Fatal(err)

976 }

977 err = test.SaveSession(tc.session)

978 assert.NoError(t, err)

979

980 test.proxy.ServeHTTP(test.rw, test.req)

981 assert.Equal(t, http.StatusOK, test.rw.Code)

982 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

983 assert.Equal(t, tc.expectedResponse, string(bodyBytes))

984 })

985 }

986}

987

988func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

989 test, err := NewUserInfoEndpointTest()

990 if err != nil {

991 t.Fatal(err)

992 }

993

994 test.proxy.ServeHTTP(test.rw, test.req)

995 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

996}

997

998func TestEncodedUrlsStayEncoded(t *testing.T) {

999 encodeTest, err := NewSignInPageTest(false)

1000 if err != nil {

1001 t.Fatal(err)

1002 }

1003 code, _ := encodeTest.GetEndpoint("/%2F/test1/%2F/test2")

1004 assert.Equal(t, 403, code)

1005}

1006

1007func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {

1008 pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)

1009 if err != nil {

1010 return nil, err

1011 }

1012 pcTest.req, _ = http.NewRequest(

1013 "GET",

1014 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),

1015 nil)

1016 return pcTest, nil

1017}

1018

1019func TestAuthOnlyEndpointAccepted(t *testing.T) {

1020 test, err := NewAuthOnlyEndpointTest("")

1021 if err != nil {

1022 t.Fatal(err)

1023 }

1024

1025 created := time.Now()

1026 startSession := &sessions.SessionState{

1027 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}

1028 err = test.SaveSession(startSession)

1029 assert.NoError(t, err)

1030

1031 test.proxy.ServeHTTP(test.rw, test.req)

1032 assert.Equal(t, http.StatusAccepted, test.rw.Code)

1033 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1034 assert.Equal(t, "", string(bodyBytes))

1035}

1036

1037func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

1038 test, err := NewAuthOnlyEndpointTest("")

1039 if err != nil {

1040 t.Fatal(err)

1041 }

1042

1043 test.proxy.ServeHTTP(test.rw, test.req)

1044 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1045 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1046 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1047}

1048

1049func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

1050 test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {

1051 opts.Cookie.Expire = time.Duration(24) * time.Hour

1052 })

1053 if err != nil {

1054 t.Fatal(err)

1055 }

1056

1057 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

1058 startSession := &sessions.SessionState{

1059 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}

1060 err = test.SaveSession(startSession)

1061 assert.NoError(t, err)

1062

1063 test.proxy.ServeHTTP(test.rw, test.req)

1064 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1065 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1066 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1067}

1068

1069func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {

1070 test, err := NewAuthOnlyEndpointTest("")

1071 if err != nil {

1072 t.Fatal(err)

1073 }

1074

1075 created := time.Now()

1076 startSession := &sessions.SessionState{

1077 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}

1078 err = test.SaveSession(startSession)

1079 assert.NoError(t, err)

1080 test.validateUser = false

1081

1082 test.proxy.ServeHTTP(test.rw, test.req)

1083 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1084 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1085 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1086}

1087

1088func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {

1089 var pcTest ProcessCookieTest

1090

1091 pcTest.opts = baseTestOptions()

1092 pcTest.opts.InjectResponseHeaders = []options.Header{

1093 {

1094 Name: "X-Auth-Request-User",

1095 Values: []options.HeaderValue{

1096 {

1097 ClaimSource: &options.ClaimSource{

1098 Claim: "user",

1099 },

1100 },

1101 },

1102 },

1103 {

1104 Name: "X-Auth-Request-Email",

1105 Values: []options.HeaderValue{

1106 {

1107 ClaimSource: &options.ClaimSource{

1108 Claim: "email",

1109 },

1110 },

1111 },

1112 },

1113 {

1114 Name: "X-Auth-Request-Groups",

1115 Values: []options.HeaderValue{

1116 {

1117 ClaimSource: &options.ClaimSource{

1118 Claim: "groups",

1119 },

1120 },

1121 },

1122 },

1123 {

1124 Name: "X-Forwarded-Preferred-Username",

1125 Values: []options.HeaderValue{

1126 {

1127 ClaimSource: &options.ClaimSource{

1128 Claim: "preferred_username",

1129 },

1130 },

1131 },

1132 },

1133 }

1134 pcTest.opts.Providers[0].AllowedGroups = []string{"oauth_groups"}

1135 err := validation.Validate(pcTest.opts)

1136 assert.NoError(t, err)

1137

1138 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1139 return pcTest.validateUser

1140 })

1141 if err != nil {

1142 t.Fatal(err)

1143 }

1144 pcTest.proxy.provider = &TestProvider{

1145 ProviderData: &providers.ProviderData{},

1146 ValidToken: true,

1147 }

1148

1149 pcTest.validateUser = true

1150

1151 pcTest.rw = httptest.NewRecorder()

1152 pcTest.req, _ = http.NewRequest("GET",

1153 pcTest.opts.ProxyPrefix+"/auth", nil)

1154

1155 created := time.Now()

1156 startSession := &sessions.SessionState{

1157 User: "oauth_user", Groups: []string{"oauth_groups"}, Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1158 err = pcTest.SaveSession(startSession)

1159 assert.NoError(t, err)

1160

1161 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1162 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1163 assert.Equal(t, "oauth_user", pcTest.rw.Header().Get("X-Auth-Request-User"))

1164 assert.Equal(t, startSession.Groups, pcTest.rw.Header().Values("X-Auth-Request-Groups"))

1165 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Get("X-Auth-Request-Email"))

1166}

1167

1168func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {

1169 var pcTest ProcessCookieTest

1170

1171 pcTest.opts = baseTestOptions()

1172 pcTest.opts.InjectResponseHeaders = []options.Header{

1173 {

1174 Name: "X-Auth-Request-User",

1175 Values: []options.HeaderValue{

1176 {

1177 ClaimSource: &options.ClaimSource{

1178 Claim: "user",

1179 },

1180 },

1181 },

1182 },

1183 {

1184 Name: "X-Auth-Request-Email",

1185 Values: []options.HeaderValue{

1186 {

1187 ClaimSource: &options.ClaimSource{

1188 Claim: "email",

1189 },

1190 },

1191 },

1192 },

1193 {

1194 Name: "X-Auth-Request-Groups",

1195 Values: []options.HeaderValue{

1196 {

1197 ClaimSource: &options.ClaimSource{

1198 Claim: "groups",

1199 },

1200 },

1201 },

1202 },

1203 {

1204 Name: "X-Forwarded-Preferred-Username",

1205 Values: []options.HeaderValue{

1206 {

1207 ClaimSource: &options.ClaimSource{

1208 Claim: "preferred_username",

1209 },

1210 },

1211 },

1212 },

1213 {

1214 Name: "Authorization",

1215 Values: []options.HeaderValue{

1216 {

1217 ClaimSource: &options.ClaimSource{

1218 Claim: "user",

1219 BasicAuthPassword: &options.SecretSource{

1220 Value: []byte("This is a secure password"),

1221 },

1222 },

1223 },

1224 },

1225 },

1226 }

1227

1228 err := validation.Validate(pcTest.opts)

1229 assert.NoError(t, err)

1230

1231 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1232 return pcTest.validateUser

1233 })

1234 if err != nil {

1235 t.Fatal(err)

1236 }

1237 pcTest.proxy.provider = &TestProvider{

1238 ProviderData: &providers.ProviderData{},

1239 ValidToken: true,

1240 }

1241

1242 pcTest.validateUser = true

1243

1244 pcTest.rw = httptest.NewRecorder()

1245 pcTest.req, _ = http.NewRequest("GET",

1246 pcTest.opts.ProxyPrefix+"/auth", nil)

1247

1248 created := time.Now()

1249 startSession := &sessions.SessionState{

1250 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1251 err = pcTest.SaveSession(startSession)

1252 assert.NoError(t, err)

1253

1254 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1255 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1256 assert.Equal(t, "oauth_user", pcTest.rw.Header().Values("X-Auth-Request-User")[0])

1257 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Values("X-Auth-Request-Email")[0])

1258 expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte("oauth_user:This is a secure password"))

1259 assert.Equal(t, expectedHeader, pcTest.rw.Header().Values("Authorization")[0])

1260}

1261

1262func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {

1263 var pcTest ProcessCookieTest

1264

1265 pcTest.opts = baseTestOptions()

1266 pcTest.opts.InjectResponseHeaders = []options.Header{

1267 {

1268 Name: "X-Auth-Request-User",

1269 Values: []options.HeaderValue{

1270 {

1271 ClaimSource: &options.ClaimSource{

1272 Claim: "user",

1273 },

1274 },

1275 },

1276 },

1277 {

1278 Name: "X-Auth-Request-Email",

1279 Values: []options.HeaderValue{

1280 {

1281 ClaimSource: &options.ClaimSource{

1282 Claim: "email",

1283 },

1284 },

1285 },

1286 },

1287 {

1288 Name: "X-Auth-Request-Groups",

1289 Values: []options.HeaderValue{

1290 {

1291 ClaimSource: &options.ClaimSource{

1292 Claim: "groups",

1293 },

1294 },

1295 },

1296 },

1297 {

1298 Name: "X-Forwarded-Preferred-Username",

1299 Values: []options.HeaderValue{

1300 {

1301 ClaimSource: &options.ClaimSource{

1302 Claim: "preferred_username",

1303 },

1304 },

1305 },

1306 },

1307 }

1308 err := validation.Validate(pcTest.opts)

1309 assert.NoError(t, err)

1310

1311 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1312 return pcTest.validateUser

1313 })

1314 if err != nil {

1315 t.Fatal(err)

1316 }

1317 pcTest.proxy.provider = &TestProvider{

1318 ProviderData: &providers.ProviderData{},

1319 ValidToken: true,

1320 }

1321

1322 pcTest.validateUser = true

1323

1324 pcTest.rw = httptest.NewRecorder()

1325 pcTest.req, _ = http.NewRequest("GET",

1326 pcTest.opts.ProxyPrefix+"/auth", nil)

1327

1328 created := time.Now()

1329 startSession := &sessions.SessionState{

1330 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1331 err = pcTest.SaveSession(startSession)

1332 assert.NoError(t, err)

1333

1334 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1335 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1336 assert.Equal(t, "oauth_user", pcTest.rw.Header().Values("X-Auth-Request-User")[0])

1337 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Values("X-Auth-Request-Email")[0])

1338 assert.Equal(t, 0, len(pcTest.rw.Header().Values("Authorization")), "should not have Authorization header entries")

1339}

1340

1341func TestAuthSkippedForPreflightRequests(t *testing.T) {

1342 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

1343 w.WriteHeader(200)

1344 _, err := w.Write([]byte("response"))

1345 if err != nil {

1346 t.Fatal(err)

1347 }

1348 }))

1349 t.Cleanup(upstreamServer.Close)

1350

1351 opts := baseTestOptions()

1352 opts.UpstreamServers = options.UpstreamConfig{

1353 Upstreams: []options.Upstream{

1354 {

1355 ID: upstreamServer.URL,

1356 Path: "/",

1357 URI: upstreamServer.URL,

1358 },

1359 },

1360 }

1361 opts.SkipAuthPreflight = true

1362 err := validation.Validate(opts)

1363 assert.NoError(t, err)

1364

1365 upstreamURL, _ := url.Parse(upstreamServer.URL)

1366

1367 proxy, err := NewOAuthProxy(opts, func(string) bool { return false })

1368 if err != nil {

1369 t.Fatal(err)

1370 }

1371 proxy.provider = NewTestProvider(upstreamURL, "")

1372 rw := httptest.NewRecorder()

1373 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)

1374 proxy.ServeHTTP(rw, req)

1375

1376 assert.Equal(t, 200, rw.Code)

1377 assert.Equal(t, "response", rw.Body.String())

1378}

1379

1380type SignatureAuthenticator struct {

1381 auth hmacauth.HmacAuth

1382}

1383

1384func (v *SignatureAuthenticator) Authenticate(w http.ResponseWriter, r *http.Request) {

1385 result, headerSig, computedSig := v.auth.AuthenticateRequest(r)

1386

1387 var msg string

1388 switch result {

1389 case hmacauth.ResultNoSignature:

1390 msg = "no signature received"

1391 case hmacauth.ResultMatch:

1392 msg = "signatures match"

1393 case hmacauth.ResultMismatch:

1394 msg = fmt.Sprintf(

1395 "signatures do not match:\n received: %s\n computed: %s",

1396 headerSig,

1397 computedSig)

1398 default:

1399 panic("unknown result value: " + result.String())

1400 }

1401

1402 _, err := w.Write([]byte(msg))

1403 if err != nil {

1404 panic(err)

1405 }

1406}

1407

1408type SignatureTest struct {

1409 opts *options.Options

1410 upstream *httptest.Server

1411 upstreamHost string

1412 provider *httptest.Server

1413 header http.Header

1414 rw *httptest.ResponseRecorder

1415 authenticator *SignatureAuthenticator

1416 authProvider providers.Provider

1417}

1418

1419func NewSignatureTest() (*SignatureTest, error) {

1420 opts := baseTestOptions()

1421 opts.EmailDomains = []string{"acm.org"}

1422

1423 authenticator := &SignatureAuthenticator{}

1424 upstreamServer := httptest.NewServer(

1425 http.HandlerFunc(authenticator.Authenticate))

1426 upstreamURL, err := url.Parse(upstreamServer.URL)

1427 if err != nil {

1428 return nil, err

1429 }

1430 opts.UpstreamServers = options.UpstreamConfig{

1431 Upstreams: []options.Upstream{

1432 {

1433 ID: upstreamServer.URL,

1434 Path: "/",

1435 URI: upstreamServer.URL,

1436 },

1437 },

1438 }

1439

1440 providerHandler := func(w http.ResponseWriter, r *http.Request) {

1441 _, err := w.Write([]byte(`{"access_token": "my_auth_token"}`))

1442 if err != nil {

1443 panic(err)

1444 }

1445 }

1446 provider := httptest.NewServer(http.HandlerFunc(providerHandler))

1447 providerURL, err := url.Parse(provider.URL)

1448 if err != nil {

1449 return nil, err

1450 }

1451 testProvider := NewTestProvider(providerURL, "mbland@acm.org")

1452

1453 return &SignatureTest{

1454 opts,

1455 upstreamServer,

1456 upstreamURL.Host,

1457 provider,

1458 make(http.Header),

1459 httptest.NewRecorder(),

1460 authenticator,

1461 testProvider,

1462 }, nil

1463}

1464

1465func (st *SignatureTest) Close() {

1466 st.provider.Close()

1467 st.upstream.Close()

1468}

1469

1470// fakeNetConn simulates an http.Request.Body buffer that will be consumed

1471// when it is read by the hmacauth.HmacAuth if not handled properly. See:

1472// https://github.com/18F/hmacauth/pull/4

1473type fakeNetConn struct {

1474 reqBody string

1475}

1476

1477func (fnc *fakeNetConn) Read(p []byte) (n int, err error) {

1478 if bodyLen := len(fnc.reqBody); bodyLen != 0 {

1479 copy(p, fnc.reqBody)

1480 fnc.reqBody = ""

1481 return bodyLen, io.EOF

1482 }

1483 return 0, io.EOF

1484}

1485

1486func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) error {

1487 err := validation.Validate(st.opts)

1488 if err != nil {

1489 return err

1490 }

1491 proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })

1492 if err != nil {

1493 return err

1494 }

1495 proxy.provider = st.authProvider

1496

1497 var bodyBuf io.ReadCloser

1498 if body != "" {

1499 bodyBuf = ioutil.NopCloser(&fakeNetConn{reqBody: body})

1500 }

1501 req := httptest.NewRequest(method, "/foo/bar", bodyBuf)

1502 req.Header = st.header

1503

1504 state := &sessions.SessionState{

1505 Email: "mbland@acm.org", AccessToken: "my_access_token"}

1506 err = proxy.SaveSession(st.rw, req, state)

1507 if err != nil {

1508 return err

1509 }

1510 for _, c := range st.rw.Result().Cookies() {

1511 req.AddCookie(c)

1512 }

1513 // This is used by the upstream to validate the signature.

1514 st.authenticator.auth = hmacauth.NewHmacAuth(

1515 crypto.SHA1, []byte(key), upstream.SignatureHeader, upstream.SignatureHeaders)

1516 proxy.ServeHTTP(st.rw, req)

1517

1518 return nil

1519}

1520

1521func TestRequestSignature(t *testing.T) {

1522 testCases := map[string]struct {

1523 method string

1524 body string

1525 key string

1526 resp string

1527 }{

1528 "No request signature": {

1529 method: "GET",

1530 body: "",

1531 key: "",

1532 resp: "no signature received",

1533 },

1534 "Get request": {

1535 method: "GET",

1536 body: "",

1537 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",

1538 resp: "signatures match",

1539 },

1540 "Post request": {

1541 method: "POST",

1542 body: `{ "hello": "world!" }`,

1543 key: "d90df39e2d19282840252612dd7c81421a372f61",

1544 resp: "signatures match",

1545 },

1546 }

1547 for name, tc := range testCases {

1548 t.Run(name, func(t *testing.T) {

1549 st, err := NewSignatureTest()

1550 if err != nil {

1551 t.Fatal(err)

1552 }

1553 t.Cleanup(st.Close)

1554 if tc.key != "" {

1555 st.opts.SignatureKey = fmt.Sprintf("sha1:%s", tc.key)

1556 }

1557 err = st.MakeRequestWithExpectedKey(tc.method, tc.body, tc.key)

1558 assert.NoError(t, err)

1559 assert.Equal(t, 200, st.rw.Code)

1560 assert.Equal(t, tc.resp, st.rw.Body.String())

1561 })

1562 }

1563}

1564

1565type ajaxRequestTest struct {

1566 opts *options.Options

1567 proxy *OAuthProxy

1568}

1569

1570func newAjaxRequestTest(forceJSONErrors bool) (*ajaxRequestTest, error) {

1571 test := &ajaxRequestTest{}

1572 test.opts = baseTestOptions()

1573 test.opts.ForceJSONErrors = forceJSONErrors

1574 err := validation.Validate(test.opts)

1575 if err != nil {

1576 return nil, err

1577 }

1578

1579 test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {

1580 return true

1581 })

1582 if err != nil {

1583 return nil, err

1584 }

1585 return test, nil

1586}

1587

1588func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (int, http.Header, []byte, error) {

1589 rw := httptest.NewRecorder()

1590 req, err := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))

1591 if err != nil {

1592 return 0, nil, nil, err

1593 }

1594 req.Header = header

1595 test.proxy.ServeHTTP(rw, req)

1596 return rw.Code, rw.Header(), rw.Body.Bytes(), nil

1597}

1598

1599func testAjaxUnauthorizedRequest(t *testing.T, header http.Header, forceJSONErrors bool) {

1600 test, err := newAjaxRequestTest(forceJSONErrors)

1601 if err != nil {

1602 t.Fatal(err)

1603 }

1604 endpoint := "/test"

1605

1606 code, rh, body, err := test.getEndpoint(endpoint, header)

1607 assert.NoError(t, err)

1608 assert.Equal(t, http.StatusUnauthorized, code)

1609 mime := rh.Get("Content-Type")

1610 assert.Equal(t, applicationJSON, mime)

1611 assert.Equal(t, []byte("{}"), body)

1612}

1613func TestAjaxUnauthorizedRequest1(t *testing.T) {

1614 header := make(http.Header)

1615 header.Add("accept", applicationJSON)

1616

1617 testAjaxUnauthorizedRequest(t, header, false)

1618}

1619

1620func TestAjaxUnauthorizedRequest2(t *testing.T) {

1621 header := make(http.Header)

1622 header.Add("Accept", applicationJSON)

1623

1624 testAjaxUnauthorizedRequest(t, header, false)

1625}

1626

1627func TestAjaxUnauthorizedRequestAccept1(t *testing.T) {

1628 header := make(http.Header)

1629 header.Add("Accept", "application/json, text/plain, */*")

1630

1631 testAjaxUnauthorizedRequest(t, header, false)

1632}

1633

1634func TestForceJSONErrorsUnauthorizedRequest(t *testing.T) {

1635 testAjaxUnauthorizedRequest(t, nil, true)

1636}

1637

1638func TestAjaxForbiddendRequest(t *testing.T) {

1639 test, err := newAjaxRequestTest(false)

1640 if err != nil {

1641 t.Fatal(err)

1642 }

1643 endpoint := "/test"

1644 header := make(http.Header)

1645 code, rh, _, err := test.getEndpoint(endpoint, header)

1646 assert.NoError(t, err)

1647 assert.Equal(t, http.StatusForbidden, code)

1648 mime := rh.Get("Content-Type")

1649 assert.NotEqual(t, applicationJSON, mime)

1650}

1651

1652func TestClearSplitCookie(t *testing.T) {

1653 opts := baseTestOptions()

1654 opts.Cookie.Secret = base64CookieSecret

1655 opts.Cookie.Name = "oauth2"

1656 opts.Cookie.Domains = []string{"abc"}

1657 err := validation.Validate(opts)

1658 assert.NoError(t, err)

1659

1660 store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)

1661 if err != nil {

1662 t.Fatal(err)

1663 }

1664

1665 p := OAuthProxy{CookieOptions: &opts.Cookie, sessionStore: store}

1666 var rw = httptest.NewRecorder()

1667 req := httptest.NewRequest("get", "/", nil)

1668

1669 req.AddCookie(&http.Cookie{

1670 Name: "test1",

1671 Value: "test1",

1672 })

1673 req.AddCookie(&http.Cookie{

1674 Name: "oauth2_0",

1675 Value: "oauth2_0",

1676 })

1677 req.AddCookie(&http.Cookie{

1678 Name: "oauth2_1",

1679 Value: "oauth2_1",

1680 })

1681

1682 err = p.ClearSessionCookie(rw, req)

1683 assert.NoError(t, err)

1684 header := rw.Header()

1685

1686 assert.Equal(t, 2, len(header["Set-Cookie"]), "should have 3 set-cookie header entries")

1687}

1688

1689func TestClearSingleCookie(t *testing.T) {

1690 opts := baseTestOptions()

1691 opts.Cookie.Name = "oauth2"

1692 opts.Cookie.Domains = []string{"abc"}

1693 store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)

1694 if err != nil {

1695 t.Fatal(err)

1696 }

1697

1698 p := OAuthProxy{CookieOptions: &opts.Cookie, sessionStore: store}

1699 var rw = httptest.NewRecorder()

1700 req := httptest.NewRequest("get", "/", nil)

1701

1702 req.AddCookie(&http.Cookie{

1703 Name: "test1",

1704 Value: "test1",

1705 })

1706 req.AddCookie(&http.Cookie{

1707 Name: "oauth2",

1708 Value: "oauth2",

1709 })

1710

1711 err = p.ClearSessionCookie(rw, req)

1712 assert.NoError(t, err)

1713 header := rw.Header()

1714

1715 assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")

1716}

1717

1718type NoOpKeySet struct {

1719}

1720

1721func (NoOpKeySet) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {

1722 splitStrings := strings.Split(jwt, ".")

1723 payloadString := splitStrings[1]

1724 return base64.RawURLEncoding.DecodeString(payloadString)

1725}

1726

1727func TestGetJwtSession(t *testing.T) {

1728 /* token payload:

1729 {

1730 "sub": "1234567890",

1731 "aud": "https://test.myapp.com",

1732 "name": "John Doe",

1733 "email": "john@example.com",

1734 "iss": "https://issuer.example.com",

1735 "iat": 1553691215,

1736 "exp": 1912151821

1737 }

1738 */

1739 goodJwt := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9." +

1740 "eyJzdWIiOiIxMjM0NTY3ODkwIiwiYXVkIjoiaHR0cHM6Ly90ZXN0Lm15YXBwLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImVtY" +

1741 "WlsIjoiam9obkBleGFtcGxlLmNvbSIsImlzcyI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNTUzNjkxMj" +

1742 "E1LCJleHAiOjE5MTIxNTE4MjF9." +

1743 "rLVyzOnEldUq_pNkfa-WiV8TVJYWyZCaM2Am_uo8FGg11zD7l-qmz3x1seTvqpH6Y0Ty00fmv6dJnGnC8WMnPXQiodRTfhBSe" +

1744 "OKZMu0HkMD2sg52zlKkbfLTO6ic5VnbVgwjjrB8am_Ta6w7kyFUaB5C1BsIrrLMldkWEhynbb8"

1745

1746 keyset := NoOpKeySet{}

1747 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,

1748 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true,

1749 SkipClientIDCheck: true})

1750 verificationOptions := internaloidc.IDTokenVerificationOptions{

1751 AudienceClaims: []string{"aud"},

1752 ClientID: "https://test.myapp.com",

1753 ExtraAudiences: []string{},

1754 }

1755 internalVerifier := internaloidc.NewVerifier(verifier, verificationOptions)

1756

1757 test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {

1758 opts.InjectRequestHeaders = []options.Header{

1759 {

1760 Name: "Authorization",

1761 Values: []options.HeaderValue{

1762 {

1763 ClaimSource: &options.ClaimSource{

1764 Claim: "id_token",

1765 Prefix: "Bearer ",

1766 },

1767 },

1768 },

1769 },

1770 {

1771 Name: "X-Forwarded-User",

1772 Values: []options.HeaderValue{

1773 {

1774 ClaimSource: &options.ClaimSource{

1775 Claim: "user",

1776 },

1777 },

1778 },

1779 },

1780 {

1781 Name: "X-Forwarded-Email",

1782 Values: []options.HeaderValue{

1783 {

1784 ClaimSource: &options.ClaimSource{

1785 Claim: "email",

1786 },

1787 },

1788 },

1789 },

1790 }

1791

1792 opts.InjectResponseHeaders = []options.Header{

1793 {

1794 Name: "Authorization",

1795 Values: []options.HeaderValue{

1796 {

1797 ClaimSource: &options.ClaimSource{

1798 Claim: "id_token",

1799 Prefix: "Bearer ",

1800 },

1801 },

1802 },

1803 },

1804 {

1805 Name: "X-Auth-Request-User",

1806 Values: []options.HeaderValue{

1807 {

1808 ClaimSource: &options.ClaimSource{

1809 Claim: "user",

1810 },

1811 },

1812 },

1813 },

1814 {

1815 Name: "X-Auth-Request-Email",

1816 Values: []options.HeaderValue{

1817 {

1818 ClaimSource: &options.ClaimSource{

1819 Claim: "email",

1820 },

1821 },

1822 },

1823 },

1824 }

1825 opts.SkipJwtBearerTokens = true

1826 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), internalVerifier))

1827 })

1828 if err != nil {

1829 t.Fatal(err)

1830 }

1831 tp, _ := test.proxy.provider.(*TestProvider)

1832 tp.GroupValidator = func(s string) bool {

1833 return true

1834 }

1835

1836 authHeader := fmt.Sprintf("Bearer %s", goodJwt)

1837 test.req.Header = map[string][]string{

1838 "Authorization": {authHeader},

1839 }

1840

1841 test.proxy.ServeHTTP(test.rw, test.req)

1842 if test.rw.Code >= 400 {

1843 t.Fatalf("expected 3xx got %d", test.rw.Code)

1844 }

1845

1846 // Check PassAuthorization, should overwrite Basic header

1847 assert.Equal(t, test.req.Header.Get("Authorization"), authHeader)

1848 assert.Equal(t, test.req.Header.Get("X-Forwarded-User"), "1234567890")

1849 assert.Equal(t, test.req.Header.Get("X-Forwarded-Email"), "john@example.com")

1850

1851 // SetAuthorization and SetXAuthRequest

1852 assert.Equal(t, test.rw.Header().Get("Authorization"), authHeader)

1853 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-User"), "1234567890")

1854 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-Email"), "john@example.com")

1855}

1856

1857func Test_prepareNoCache(t *testing.T) {

1858 handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

1859 prepareNoCache(w)

1860 })

1861 mux := http.NewServeMux()

1862 mux.Handle("/", handler)

1863

1864 rec := httptest.NewRecorder()

1865 req := httptest.NewRequest(http.MethodGet, "/", nil)

1866 mux.ServeHTTP(rec, req)

1867

1868 for k, v := range noCacheHeaders {

1869 assert.Equal(t, rec.Header().Get(k), v)

1870 }

1871}

1872

1873func Test_noCacheHeaders(t *testing.T) {

1874 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

1875 _, err := w.Write([]byte("upstream"))

1876 if err != nil {

1877 t.Error(err)

1878 }

1879 }))

1880 t.Cleanup(upstreamServer.Close)

1881

1882 opts := baseTestOptions()

1883 opts.UpstreamServers = options.UpstreamConfig{

1884 Upstreams: []options.Upstream{

1885 {

1886 ID: upstreamServer.URL,

1887 Path: "/",

1888 URI: upstreamServer.URL,

1889 },

1890 },

1891 }

1892 opts.SkipAuthRegex = []string{".*"}

1893 err := validation.Validate(opts)

1894 assert.NoError(t, err)

1895 proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })

1896 if err != nil {

1897 t.Fatal(err)

1898 }

1899

1900 t.Run("not exist in response from upstream", func(t *testing.T) {

1901 rec := httptest.NewRecorder()

1902 req := httptest.NewRequest(http.MethodGet, "/upstream", nil)

1903 proxy.ServeHTTP(rec, req)

1904

1905 assert.Equal(t, http.StatusOK, rec.Code)

1906 assert.Equal(t, "upstream", rec.Body.String())

1907

1908 // checking noCacheHeaders does not exists in response headers from upstream

1909 for k := range noCacheHeaders {

1910 assert.Equal(t, "", rec.Header().Get(k))

1911 }

1912 })

1913

1914 t.Run("has no-cache", func(t *testing.T) {

1915 tests := []struct {

1916 path string

1917 hasNoCache bool

1918 }{

1919 {

1920 path: "/oauth2/sign_in",

1921 hasNoCache: true,

1922 },

1923 {

1924 path: "/oauth2/sign_out",

1925 hasNoCache: true,

1926 },

1927 {

1928 path: "/oauth2/start",

1929 hasNoCache: true,

1930 },

1931 {

1932 path: "/oauth2/callback",

1933 hasNoCache: true,

1934 },

1935 {

1936 path: "/oauth2/auth",

1937 hasNoCache: false,

1938 },

1939 {

1940 path: "/oauth2/userinfo",

1941 hasNoCache: true,

1942 },

1943 {

1944 path: "/upstream",

1945 hasNoCache: false,

1946 },

1947 }

1948

1949 for _, tt := range tests {

1950 t.Run(tt.path, func(t *testing.T) {

1951 rec := httptest.NewRecorder()

1952 req := httptest.NewRequest(http.MethodGet, tt.path, nil)

1953 proxy.ServeHTTP(rec, req)

1954 cacheControl := rec.Result().Header.Get("Cache-Control")

1955 if tt.hasNoCache != (strings.Contains(cacheControl, "no-cache")) {

1956 t.Errorf(`unexpected "Cache-Control" header: %s`, cacheControl)

1957 }

1958 })

1959 }

1960

1961 })

1962}

1963

1964func baseTestOptions() *options.Options {

1965 opts := options.NewOptions()

1966 opts.Cookie.Secret = rawCookieSecret

1967 opts.Providers[0].ID = "providerID"

1968 opts.Providers[0].ClientID = clientID

1969 opts.Providers[0].ClientSecret = clientSecret

1970 opts.EmailDomains = []string{"*"}

1971

1972 // Default injected headers for legacy configuration

1973 opts.InjectRequestHeaders = []options.Header{

1974 {

1975 Name: "Authorization",

1976 Values: []options.HeaderValue{

1977 {

1978 ClaimSource: &options.ClaimSource{

1979 Claim: "user",

1980 BasicAuthPassword: &options.SecretSource{

1981 Value: []byte(base64.StdEncoding.EncodeToString([]byte("This is a secure password"))),

1982 },

1983 },

1984 },

1985 },

1986 },

1987 {

1988 Name: "X-Forwarded-User",

1989 Values: []options.HeaderValue{

1990 {

1991 ClaimSource: &options.ClaimSource{

1992 Claim: "user",

1993 },

1994 },

1995 },

1996 },

1997 {

1998 Name: "X-Forwarded-Email",

1999 Values: []options.HeaderValue{

2000 {

2001 ClaimSource: &options.ClaimSource{

2002 Claim: "email",

2003 },

2004 },

2005 },

2006 },

2007 }

2008

2009 return opts

2010}

2011

2012func TestTrustedIPs(t *testing.T) {

2013 tests := []struct {

2014 name string

2015 trustedIPs []string

2016 reverseProxy bool

2017 realClientIPHeader string

2018 req *http.Request

2019 expectTrusted bool

2020 }{

2021 // Check unconfigured behavior.

2022 {

2023 name: "Default",

2024 trustedIPs: nil,

2025 reverseProxy: false,

2026 realClientIPHeader: "X-Real-IP", // Default value

2027 req: func() *http.Request {

2028 req, _ := http.NewRequest("GET", "/", nil)

2029 return req

2030 }(),

2031 expectTrusted: false,

2032 },

2033 // Check using req.RemoteAddr (Options.ReverseProxy == false).

2034 {

2035 name: "WithRemoteAddr",

2036 trustedIPs: []string{"127.0.0.1"},

2037 reverseProxy: false,

2038 realClientIPHeader: "X-Real-IP", // Default value

2039 req: func() *http.Request {

2040 req, _ := http.NewRequest("GET", "/", nil)

2041 req.RemoteAddr = "127.0.0.1:43670"

2042 return req

2043 }(),

2044 expectTrusted: true,

2045 },

2046 // Check ignores req.RemoteAddr match when behind a reverse proxy / missing header.

2047 {

2048 name: "IgnoresRemoteAddrInReverseProxyMode",

2049 trustedIPs: []string{"127.0.0.1"},

2050 reverseProxy: true,

2051 realClientIPHeader: "X-Real-IP", // Default value

2052 req: func() *http.Request {

2053 req, _ := http.NewRequest("GET", "/", nil)

2054 req.RemoteAddr = "127.0.0.1:44324"

2055 return req

2056 }(),

2057 expectTrusted: false,

2058 },

2059 // Check successful trusting of localhost in IPv4.

2060 {

2061 name: "TrustsLocalhostInReverseProxyMode",

2062 trustedIPs: []string{"127.0.0.0/8", "::1"},

2063 reverseProxy: true,

2064 realClientIPHeader: "X-Forwarded-For",

2065 req: func() *http.Request {

2066 req, _ := http.NewRequest("GET", "/", nil)

2067 req.Header.Add("X-Forwarded-For", "127.0.0.1")

2068 return req

2069 }(),

2070 expectTrusted: true,

2071 },

2072 // Check successful trusting of localhost in IPv6.

2073 {

2074 name: "TrustsIP6LocalostInReverseProxyMode",

2075 trustedIPs: []string{"127.0.0.0/8", "::1"},

2076 reverseProxy: true,

2077 realClientIPHeader: "X-Forwarded-For",

2078 req: func() *http.Request {

2079 req, _ := http.NewRequest("GET", "/", nil)

2080 req.Header.Add("X-Forwarded-For", "::1")

2081 return req

2082 }(),

2083 expectTrusted: true,

2084 },

2085 // Check does not trust random IPv4 address.

2086 {

2087 name: "DoesNotTrustRandomIP4Address",

2088 trustedIPs: []string{"127.0.0.0/8", "::1"},

2089 reverseProxy: true,

2090 realClientIPHeader: "X-Forwarded-For",

2091 req: func() *http.Request {

2092 req, _ := http.NewRequest("GET", "/", nil)

2093 req.Header.Add("X-Forwarded-For", "12.34.56.78")

2094 return req

2095 }(),

2096 expectTrusted: false,

2097 },

2098 // Check does not trust random IPv6 address.

2099 {

2100 name: "DoesNotTrustRandomIP6Address",

2101 trustedIPs: []string{"127.0.0.0/8", "::1"},

2102 reverseProxy: true,

2103 realClientIPHeader: "X-Forwarded-For",

2104 req: func() *http.Request {

2105 req, _ := http.NewRequest("GET", "/", nil)

2106 req.Header.Add("X-Forwarded-For", "::2")

2107 return req

2108 }(),

2109 expectTrusted: false,

2110 },

2111 // Check respects correct header.

2112 {

2113 name: "RespectsCorrectHeaderInReverseProxyMode",

2114 trustedIPs: []string{"127.0.0.0/8", "::1"},

2115 reverseProxy: true,

2116 realClientIPHeader: "X-Forwarded-For",

2117 req: func() *http.Request {

2118 req, _ := http.NewRequest("GET", "/", nil)

2119 req.Header.Add("X-Real-IP", "::1")

2120 return req

2121 }(),

2122 expectTrusted: false,

2123 },

2124 // Check doesn't trust if garbage is provided.

2125 {

2126 name: "DoesNotTrustGarbageInReverseProxyMode",

2127 trustedIPs: []string{"127.0.0.0/8", "::1"},

2128 reverseProxy: true,

2129 realClientIPHeader: "X-Forwarded-For",

2130 req: func() *http.Request {

2131 req, _ := http.NewRequest("GET", "/", nil)

2132 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")

2133 return req

2134 }(),

2135 expectTrusted: false,

2136 },

2137 // Check doesn't trust if garbage is provided (no reverse-proxy).

2138 {

2139 name: "DoesNotTrustGarbage",

2140 trustedIPs: []string{"127.0.0.0/8", "::1"},

2141 reverseProxy: false,

2142 realClientIPHeader: "X-Real-IP",

2143 req: func() *http.Request {

2144 req, _ := http.NewRequest("GET", "/", nil)

2145 req.RemoteAddr = "adsfljk29242as!!"

2146 return req

2147 }(),

2148 expectTrusted: false,

2149 },

2150 }

2151

2152 for _, tt := range tests {

2153 t.Run(tt.name, func(t *testing.T) {

2154 opts := baseTestOptions()

2155 opts.UpstreamServers = options.UpstreamConfig{

2156 Upstreams: []options.Upstream{

2157 {

2158 ID: "static",

2159 Path: "/",

2160 Static: true,

2161 },

2162 },

2163 }

2164 opts.TrustedIPs = tt.trustedIPs

2165 opts.ReverseProxy = tt.reverseProxy

2166 opts.RealClientIPHeader = tt.realClientIPHeader

2167 err := validation.Validate(opts)

2168 assert.NoError(t, err)

2169

2170 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })

2171 assert.NoError(t, err)

2172 rw := httptest.NewRecorder()

2173

2174 proxy.ServeHTTP(rw, tt.req)

2175 if tt.expectTrusted {

2176 assert.Equal(t, 200, rw.Code)

2177 } else {

2178 assert.Equal(t, 403, rw.Code)

2179 }

2180 })

2181 }

2182}

2183

2184func Test_buildRoutesAllowlist(t *testing.T) {

2185 type expectedAllowedRoute struct {

2186 method string

2187 regexString string

2188 }

2189

2190 testCases := []struct {

2191 name string

2192 skipAuthRegex []string

2193 skipAuthRoutes []string

2194 expectedRoutes []expectedAllowedRoute

2195 shouldError bool

2196 }{

2197 {

2198 name: "No skip auth configured",

2199 skipAuthRegex: []string{},

2200 skipAuthRoutes: []string{},

2201 expectedRoutes: []expectedAllowedRoute{},

2202 shouldError: false,

2203 },

2204 {

2205 name: "Only skipAuthRegex configured",

2206 skipAuthRegex: []string{

2207 "^/foo/bar",

2208 "^/baz/[0-9]+/thing",

2209 },

2210 skipAuthRoutes: []string{},

2211 expectedRoutes: []expectedAllowedRoute{

2212 {

2213 method: "",

2214 regexString: "^/foo/bar",

2215 },

2216 {

2217 method: "",

2218 regexString: "^/baz/[0-9]+/thing",

2219 },

2220 },

2221 shouldError: false,

2222 },

2223 {

2224 name: "Only skipAuthRoutes configured",

2225 skipAuthRegex: []string{},

2226 skipAuthRoutes: []string{

2227 "GET=^/foo/bar",

2228 "POST=^/baz/[0-9]+/thing",

2229 "^/all/methods$",

2230 "WEIRD=^/methods/are/allowed",

2231 "PATCH=/second/equals?are=handled&just=fine",

2232 },

2233 expectedRoutes: []expectedAllowedRoute{

2234 {

2235 method: "GET",

2236 regexString: "^/foo/bar",

2237 },

2238 {

2239 method: "POST",

2240 regexString: "^/baz/[0-9]+/thing",

2241 },

2242 {

2243 method: "",

2244 regexString: "^/all/methods$",

2245 },

2246 {

2247 method: "WEIRD",

2248 regexString: "^/methods/are/allowed",

2249 },

2250 {

2251 method: "PATCH",

2252 regexString: "/second/equals?are=handled&just=fine",

2253 },

2254 },

2255 shouldError: false,

2256 },

2257 {

2258 name: "Both skipAuthRegexes and skipAuthRoutes configured",

2259 skipAuthRegex: []string{

2260 "^/foo/bar/regex",

2261 "^/baz/[0-9]+/thing/regex",

2262 },

2263 skipAuthRoutes: []string{

2264 "GET=^/foo/bar",

2265 "POST=^/baz/[0-9]+/thing",

2266 "^/all/methods$",

2267 },

2268 expectedRoutes: []expectedAllowedRoute{

2269 {

2270 method: "",

2271 regexString: "^/foo/bar/regex",

2272 },

2273 {

2274 method: "",

2275 regexString: "^/baz/[0-9]+/thing/regex",

2276 },

2277 {

2278 method: "GET",

2279 regexString: "^/foo/bar",

2280 },

2281 {

2282 method: "POST",

2283 regexString: "^/baz/[0-9]+/thing",

2284 },

2285 {

2286 method: "",

2287 regexString: "^/all/methods$",

2288 },

2289 },

2290 shouldError: false,

2291 },

2292 {

2293 name: "Invalid skipAuthRegex entry",

2294 skipAuthRegex: []string{

2295 "^/foo/bar",

2296 "^/baz/[0-9]+/thing",

2297 "(bad[regex",

2298 },

2299 skipAuthRoutes: []string{},

2300 expectedRoutes: []expectedAllowedRoute{},

2301 shouldError: true,

2302 },

2303 {

2304 name: "Invalid skipAuthRoutes entry",

2305 skipAuthRegex: []string{},

2306 skipAuthRoutes: []string{

2307 "GET=^/foo/bar",

2308 "POST=^/baz/[0-9]+/thing",

2309 "^/all/methods$",

2310 "PUT=(bad[regex",

2311 },

2312 expectedRoutes: []expectedAllowedRoute{},

2313 shouldError: true,

2314 },

2315 }

2316

2317 for _, tc := range testCases {

2318 t.Run(tc.name, func(t *testing.T) {

2319 opts := &options.Options{

2320 SkipAuthRegex: tc.skipAuthRegex,

2321 SkipAuthRoutes: tc.skipAuthRoutes,

2322 }

2323 routes, err := buildRoutesAllowlist(opts)

2324 if tc.shouldError {

2325 assert.Error(t, err)

2326 return

2327 }

2328 assert.NoError(t, err)

2329

2330 for i, route := range routes {

2331 assert.Greater(t, len(tc.expectedRoutes), i)

2332 assert.Equal(t, route.method, tc.expectedRoutes[i].method)

2333 assert.Equal(t, route.pathRegex.String(), tc.expectedRoutes[i].regexString)

2334 }

2335 })

2336 }

2337}

2338

2339func TestAllowedRequest(t *testing.T) {

2340 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2341 w.WriteHeader(200)

2342 _, err := w.Write([]byte("Allowed Request"))

2343 if err != nil {

2344 t.Fatal(err)

2345 }

2346 }))

2347 t.Cleanup(upstreamServer.Close)

2348

2349 opts := baseTestOptions()

2350 opts.UpstreamServers = options.UpstreamConfig{

2351 Upstreams: []options.Upstream{

2352 {

2353 ID: upstreamServer.URL,

2354 Path: "/",

2355 URI: upstreamServer.URL,

2356 },

2357 },

2358 }

2359 opts.SkipAuthRegex = []string{

2360 "^/skip/auth/regex$",

2361 }

2362 opts.SkipAuthRoutes = []string{

2363 "GET=^/skip/auth/routes/get",

2364 }

2365 err := validation.Validate(opts)

2366 assert.NoError(t, err)

2367 proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })

2368 if err != nil {

2369 t.Fatal(err)

2370 }

2371

2372 testCases := []struct {

2373 name string

2374 method string

2375 url string

2376 allowed bool

2377 }{

2378 {

2379 name: "Regex GET allowed",

2380 method: "GET",

2381 url: "/skip/auth/regex",

2382 allowed: true,

2383 },

2384 {

2385 name: "Regex POST allowed ",

2386 method: "POST",

2387 url: "/skip/auth/regex",

2388 allowed: true,

2389 },

2390 {

2391 name: "Regex denied",

2392 method: "GET",

2393 url: "/wrong/denied",

2394 allowed: false,

2395 },

2396 {

2397 name: "Route allowed",

2398 method: "GET",

2399 url: "/skip/auth/routes/get",

2400 allowed: true,

2401 },

2402 {

2403 name: "Route denied with wrong method",

2404 method: "PATCH",

2405 url: "/skip/auth/routes/get",

2406 allowed: false,

2407 },

2408 {

2409 name: "Route denied with wrong path",

2410 method: "GET",

2411 url: "/skip/auth/routes/wrong/path",

2412 allowed: false,

2413 },

2414 }

2415

2416 for _, tc := range testCases {

2417 t.Run(tc.name, func(t *testing.T) {

2418 req, err := http.NewRequest(tc.method, tc.url, nil)

2419 assert.NoError(t, err)

2420 assert.Equal(t, tc.allowed, proxy.isAllowedRoute(req))

2421

2422 rw := httptest.NewRecorder()

2423 proxy.ServeHTTP(rw, req)

2424

2425 if tc.allowed {

2426 assert.Equal(t, 200, rw.Code)

2427 assert.Equal(t, "Allowed Request", rw.Body.String())

2428 } else {

2429 assert.Equal(t, 403, rw.Code)

2430 }

2431 })

2432 }

2433}

2434

2435func TestProxyAllowedGroups(t *testing.T) {

2436 tests := []struct {

2437 name string

2438 allowedGroups []string

2439 groups []string

2440 expectUnauthorized bool

2441 }{

2442 {"NoAllowedGroups", []string{}, []string{}, false},

2443 {"NoAllowedGroupsUserHasGroups", []string{}, []string{"a", "b"}, false},

2444 {"UserInAllowedGroup", []string{"a"}, []string{"a", "b"}, false},

2445 {"UserNotInAllowedGroup", []string{"a"}, []string{"c"}, true},

2446 }

2447

2448 for _, tt := range tests {

2449 t.Run(tt.name, func(t *testing.T) {

2450 emailAddress := "test"

2451 created := time.Now()

2452

2453 session := &sessions.SessionState{

2454 Groups: tt.groups,

2455 Email: emailAddress,

2456 AccessToken: "oauth_token",

2457 CreatedAt: &created,

2458 }

2459

2460 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2461 w.WriteHeader(200)

2462 }))

2463 t.Cleanup(upstreamServer.Close)

2464

2465 test, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {

2466 opts.Providers[0].AllowedGroups = tt.allowedGroups

2467 opts.UpstreamServers = options.UpstreamConfig{

2468 Upstreams: []options.Upstream{

2469 {

2470 ID: upstreamServer.URL,

2471 Path: "/",

2472 URI: upstreamServer.URL,

2473 },

2474 },

2475 }

2476 })

2477 if err != nil {

2478 t.Fatal(err)

2479 }

2480

2481 test.req, _ = http.NewRequest("GET", "/", nil)

2482

2483 test.req.Header.Add("accept", applicationJSON)

2484 err = test.SaveSession(session)

2485 assert.NoError(t, err)

2486 test.proxy.ServeHTTP(test.rw, test.req)

2487

2488 if tt.expectUnauthorized {

2489 assert.Equal(t, http.StatusForbidden, test.rw.Code)

2490 } else {

2491 assert.Equal(t, http.StatusOK, test.rw.Code)

2492 }

2493 })

2494 }

2495}

2496

2497func TestAuthOnlyAllowedGroups(t *testing.T) {

2498 testCases := []struct {

2499 name string

2500 allowedGroups []string

2501 groups []string

2502 querystring string

2503 expectedStatusCode int

2504 }{

2505 {

2506 name: "NoAllowedGroups",

2507 allowedGroups: []string{},

2508 groups: []string{},

2509 querystring: "",

2510 expectedStatusCode: http.StatusAccepted,

2511 },

2512 {

2513 name: "NoAllowedGroupsUserHasGroups",

2514 allowedGroups: []string{},

2515 groups: []string{"a", "b"},

2516 querystring: "",

2517 expectedStatusCode: http.StatusAccepted,

2518 },

2519 {

2520 name: "UserInAllowedGroup",

2521 allowedGroups: []string{"a"},

2522 groups: []string{"a", "b"},

2523 querystring: "",

2524 expectedStatusCode: http.StatusAccepted,

2525 },

2526 {

2527 name: "UserNotInAllowedGroup",

2528 allowedGroups: []string{"a"},

2529 groups: []string{"c"},

2530 querystring: "",

2531 expectedStatusCode: http.StatusUnauthorized,

2532 },

2533 {

2534 name: "UserInQuerystringGroup",

2535 allowedGroups: []string{"a", "b"},

2536 groups: []string{"a", "c"},

2537 querystring: "?allowed_groups=a",

2538 expectedStatusCode: http.StatusAccepted,

2539 },

2540 {

2541 name: "UserInMultiParamQuerystringGroup",

2542 allowedGroups: []string{"a", "b"},

2543 groups: []string{"b"},

2544 querystring: "?allowed_groups=a&allowed_groups=b,d",

2545 expectedStatusCode: http.StatusAccepted,

2546 },

2547 {

2548 name: "UserInOnlyQuerystringGroup",

2549 allowedGroups: []string{},

2550 groups: []string{"a", "c"},

2551 querystring: "?allowed_groups=a,b",

2552 expectedStatusCode: http.StatusAccepted,

2553 },

2554 {

2555 name: "UserInDelimitedQuerystringGroup",

2556 allowedGroups: []string{"a", "b", "c"},

2557 groups: []string{"c"},

2558 querystring: "?allowed_groups=a,c",

2559 expectedStatusCode: http.StatusAccepted,

2560 },

2561 {

2562 name: "UserNotInQuerystringGroup",

2563 allowedGroups: []string{},

2564 groups: []string{"c"},

2565 querystring: "?allowed_groups=a,b",

2566 expectedStatusCode: http.StatusForbidden,

2567 },

2568 {

2569 name: "UserInConfigGroupNotInQuerystringGroup",

2570 allowedGroups: []string{"a", "b", "c"},

2571 groups: []string{"c"},

2572 querystring: "?allowed_groups=a,b",

2573 expectedStatusCode: http.StatusForbidden,

2574 },

2575 {

2576 name: "UserInQuerystringGroupNotInConfigGroup",

2577 allowedGroups: []string{"a", "b"},

2578 groups: []string{"c"},

2579 querystring: "?allowed_groups=b,c",

2580 expectedStatusCode: http.StatusUnauthorized,

2581 },

2582 }

2583

2584 for _, tc := range testCases {

2585 t.Run(tc.name, func(t *testing.T) {

2586 emailAddress := "test"

2587 created := time.Now()

2588

2589 session := &sessions.SessionState{

2590 Groups: tc.groups,

2591 Email: emailAddress,

2592 AccessToken: "oauth_token",

2593 CreatedAt: &created,

2594 }

2595

2596 test, err := NewAuthOnlyEndpointTest(tc.querystring, func(opts *options.Options) {

2597 opts.Providers[0].AllowedGroups = tc.allowedGroups

2598 })

2599 if err != nil {

2600 t.Fatal(err)

2601 }

2602

2603 err = test.SaveSession(session)

2604 assert.NoError(t, err)

2605

2606 test.proxy.ServeHTTP(test.rw, test.req)

2607

2608 assert.Equal(t, tc.expectedStatusCode, test.rw.Code)

2609 })

2610 }

2611}

2612

2613func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {

2614 testCases := []struct {

2615 name string

2616 groups []string

2617 method string

2618 ip string

2619 withSession bool

2620 expectedStatusCode int

2621 }{

2622 {

2623 name: "UserWithGroupSkipAuthPreflight",

2624 groups: []string{"a", "c"},

2625 method: "OPTIONS",

2626 ip: "1.2.3.5:43670",

2627 withSession: true,

2628 expectedStatusCode: http.StatusAccepted,

2629 },

2630 {

2631 name: "UserWithGroupTrustedIp",

2632 groups: []string{"a", "c"},

2633 method: "GET",

2634 ip: "1.2.3.4:43670",

2635 withSession: true,

2636 expectedStatusCode: http.StatusAccepted,

2637 },

2638 {

2639 name: "UserWithoutGroupSkipAuthPreflight",

2640 groups: []string{"c"},

2641 method: "OPTIONS",

2642 ip: "1.2.3.5:43670",

2643 withSession: true,

2644 expectedStatusCode: http.StatusForbidden,

2645 },

2646 {

2647 name: "UserWithoutGroupTrustedIp",

2648 groups: []string{"c"},

2649 method: "GET",

2650 ip: "1.2.3.4:43670",

2651 withSession: true,

2652 expectedStatusCode: http.StatusForbidden,

2653 },

2654 {

2655 name: "UserWithoutSessionSkipAuthPreflight",

2656 method: "OPTIONS",

2657 ip: "1.2.3.5:43670",

2658 withSession: false,

2659 expectedStatusCode: http.StatusAccepted,

2660 },

2661 {

2662 name: "UserWithoutSessionTrustedIp",

2663 method: "GET",

2664 ip: "1.2.3.4:43670",

2665 withSession: false,

2666 expectedStatusCode: http.StatusAccepted,

2667 },

2668 }

2669

2670 for _, tc := range testCases {

2671 t.Run(tc.name, func(t *testing.T) {

2672 test, err := NewAuthOnlyEndpointTest("?allowed_groups=a,b", func(opts *options.Options) {

2673 opts.SkipAuthPreflight = true

2674 opts.TrustedIPs = []string{"1.2.3.4"}

2675 })

2676 if err != nil {

2677 t.Fatal(err)

2678 }

2679

2680 test.req.Method = tc.method

2681 test.req.RemoteAddr = tc.ip

2682

2683 if tc.withSession {

2684 created := time.Now()

2685 session := &sessions.SessionState{

2686 Groups: tc.groups,

2687 Email: "test",

2688 AccessToken: "oauth_token",

2689 CreatedAt: &created,

2690 }

2691 err = test.SaveSession(session)

2692 }

2693 assert.NoError(t, err)

2694

2695 test.proxy.ServeHTTP(test.rw, test.req)

2696

2697 assert.Equal(t, tc.expectedStatusCode, test.rw.Code)

2698 })

2699 }

2700}

2701

2702func TestAuthOnlyAllowedEmailDomains(t *testing.T) {

2703 testCases := []struct {

2704 name string

2705 email string

2706 querystring string

2707 expectedStatusCode int

2708 }{

2709 {

2710 name: "NotEmailRestriction",

2711 email: "toto@example.com",

2712 querystring: "",

2713 expectedStatusCode: http.StatusAccepted,

2714 },

2715 {

2716 name: "UserInAllowedEmailDomain",

2717 email: "toto@example.com",

2718 querystring: "?allowed_email_domains=example.com",

2719 expectedStatusCode: http.StatusAccepted,

2720 },

2721 {

2722 name: "UserNotInAllowedEmailDomain",

2723 email: "toto@example.com",

2724 querystring: "?allowed_email_domains=a.example.com",

2725 expectedStatusCode: http.StatusForbidden,

2726 },

2727 {

2728 name: "UserInAllowedEmailDomains",

2729 email: "toto@example.com",

2730 querystring: "?allowed_email_domains=a.example.com,b.example.com",

2731 expectedStatusCode: http.StatusForbidden,

2732 },

2733 {

2734 name: "UserInAllowedEmailDomains",

2735 email: "toto@example.com",

2736 querystring: "?allowed_email_domains=a.example.com,example.com",

2737 expectedStatusCode: http.StatusAccepted,

2738 },

2739 {

2740 name: "UserInAllowedEmailDomainWildcard",

2741 email: "toto@foo.example.com",

2742 querystring: "?allowed_email_domains=*.example.com",

2743 expectedStatusCode: http.StatusAccepted,

2744 },

2745 {

2746 name: "UserNotInAllowedEmailDomainWildcard",

2747 email: "toto@example.com",

2748 querystring: "?allowed_email_domains=*.a.example.com",

2749 expectedStatusCode: http.StatusForbidden,

2750 },

2751 {

2752 name: "UserInAllowedEmailDomainsWildcard",

2753 email: "toto@example.com",

2754 querystring: "?allowed_email_domains=*.a.example.com,*.b.example.com",

2755 expectedStatusCode: http.StatusForbidden,

2756 },

2757 {

2758 name: "UserInAllowedEmailDomainsWildcard",

2759 email: "toto@c.example.com",

2760 querystring: "?allowed_email_domains=a.b.c.example.com,*.c.example.com",

2761 expectedStatusCode: http.StatusAccepted,

2762 },

2763 }

2764

2765 for _, tc := range testCases {

2766 t.Run(tc.name, func(t *testing.T) {

2767 groups := []string{}

2768

2769 created := time.Now()

2770

2771 session := &sessions.SessionState{

2772 Groups: groups,

2773 Email: tc.email,

2774 AccessToken: "oauth_token",

2775 CreatedAt: &created,

2776 }

2777

2778 test, err := NewAuthOnlyEndpointTest(tc.querystring, func(opts *options.Options) {})

2779 if err != nil {

2780 t.Fatal(err)

2781 }

2782

2783 err = test.SaveSession(session)

2784 assert.NoError(t, err)

2785

2786 test.proxy.ServeHTTP(test.rw, test.req)

2787

2788 assert.Equal(t, tc.expectedStatusCode, test.rw.Code)

2789 })

2790 }

2791}