pkg/validation/options_test.go · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on ea261ca help sign in

typeable/oauth2-proxy/pkg/validation/options_test.go

304 lines 9.2 kB history raw

1package validation

3import (

4 "crypto"

5 "io/ioutil"

6 "net/url"

7 "os"

8 "strings"

9 "testing"

10 "time"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

13 "github.com/stretchr/testify/assert"

14)

16const (

17 cookieSecret = "secretthirtytwobytes+abcdefghijk"

18 clientID = "bazquux"

19 clientSecret = "xyzzyplugh"

20 providerID = "providerID"

21)

23func testOptions() *options.Options {

24 o := options.NewOptions()

25 o.UpstreamServers.Upstreams = append(o.UpstreamServers.Upstreams, options.Upstream{

26 ID: "upstream",

27 Path: "/",

28 URI: "http://127.0.0.1:8080/",

29 })

30 o.Cookie.Secret = cookieSecret

31 o.Providers[0].ID = providerID

32 o.Providers[0].ClientID = clientID

33 o.Providers[0].ClientSecret = clientSecret

34 o.EmailDomains = []string{"*"}

35 return o

36}

38func errorMsg(msgs []string) string {

39 result := make([]string, 0)

40 result = append(result, "invalid configuration:")

41 result = append(result, msgs...)

42 return strings.Join(result, "\n ")

43}

45func TestNewOptions(t *testing.T) {

46 o := options.NewOptions()

47 o.EmailDomains = []string{"*"}

48 err := Validate(o)

49 assert.NotEqual(t, nil, err)

51 expected := errorMsg([]string{

52 "missing setting: cookie-secret",

53 "provider has empty id: ids are required for all providers",

54 "provider missing setting: client-id",

55 "missing setting: client-secret or client-secret-file"})

56 assert.Equal(t, expected, err.Error())

57}

59func TestClientSecretFileOptionFails(t *testing.T) {

60 o := options.NewOptions()

61 o.Cookie.Secret = cookieSecret

62 o.Providers[0].ID = providerID

63 o.Providers[0].ClientID = clientID

64 o.Providers[0].ClientSecretFile = clientSecret

65 o.EmailDomains = []string{"*"}

66 err := Validate(o)

67 assert.NotEqual(t, nil, err)

69 p := o.GetProvider().Data()

70 assert.Equal(t, clientSecret, p.ClientSecretFile)

71 assert.Equal(t, "", p.ClientSecret)

73 s, err := p.GetClientSecret()

74 assert.NotEqual(t, nil, err)

75 assert.Equal(t, "", s)

76}

78func TestClientSecretFileOption(t *testing.T) {

79 var err error

80 f, err := ioutil.TempFile("", "client_secret_temp_file_")

81 if err != nil {

82 t.Fatalf("failed to create temp file: %v", err)

83 }

84 _, err = f.WriteString("testcase")

85 if err != nil {

86 t.Fatalf("failed to write to temp file: %v", err)

87 }

88 if err := f.Close(); err != nil {

89 t.Fatalf("failed to close temp file: %v", err)

90 }

91 clientSecretFileName := f.Name()

92 defer func(t *testing.T) {

93 if err := os.Remove(clientSecretFileName); err != nil {

94 t.Fatalf("failed to delete temp file: %v", err)

95 }

96 }(t)

98 o := options.NewOptions()

99 o.Cookie.Secret = cookieSecret

100 o.Providers[0].ID = providerID

101 o.Providers[0].ClientID = clientID

102 o.Providers[0].ClientSecretFile = clientSecretFileName

103 o.EmailDomains = []string{"*"}

104 err = Validate(o)

105 assert.Equal(t, nil, err)

106

107 p := o.GetProvider().Data()

108 assert.Equal(t, clientSecretFileName, p.ClientSecretFile)

109 assert.Equal(t, "", p.ClientSecret)

110

111 s, err := p.GetClientSecret()

112 assert.Equal(t, nil, err)

113 assert.Equal(t, "testcase", s)

114}

115

116func TestGoogleGroupOptions(t *testing.T) {

117 o := testOptions()

118 o.Providers[0].GoogleConfig.Groups = []string{"googlegroup"}

119 err := Validate(o)

120 assert.NotEqual(t, nil, err)

121

122 expected := errorMsg([]string{

123 "missing setting: google-admin-email",

124 "missing setting: google-service-account-json"})

125 assert.Equal(t, expected, err.Error())

126}

127

128func TestGoogleGroupInvalidFile(t *testing.T) {

129 o := testOptions()

130 o.Providers[0].GoogleConfig.Groups = []string{"test_group"}

131 o.Providers[0].GoogleConfig.AdminEmail = "admin@example.com"

132 o.Providers[0].GoogleConfig.ServiceAccountJSON = "file_doesnt_exist.json"

133 err := Validate(o)

134 assert.NotEqual(t, nil, err)

135

136 expected := errorMsg([]string{

137 "invalid Google credentials file: file_doesnt_exist.json",

138 })

139 assert.Equal(t, expected, err.Error())

140}

141

142func TestInitializedOptions(t *testing.T) {

143 o := testOptions()

144 assert.Equal(t, nil, Validate(o))

145}

146

147// Note that it's not worth testing nonparseable URLs, since url.Parse()

148// seems to parse damn near anything.

149func TestRedirectURL(t *testing.T) {

150 o := testOptions()

151 o.RawRedirectURL = "https://myhost.com/oauth2/callback"

152 assert.Equal(t, nil, Validate(o))

153 expected := &url.URL{

154 Scheme: "https", Host: "myhost.com", Path: "/oauth2/callback"}

155 assert.Equal(t, expected, o.GetRedirectURL())

156}

157

158func TestDefaultProviderApiSettings(t *testing.T) {

159 o := testOptions()

160 assert.Equal(t, nil, Validate(o))

161 p := o.GetProvider().Data()

162 assert.Equal(t, "https://accounts.google.com/o/oauth2/auth?access_type=offline",

163 p.LoginURL.String())

164 assert.Equal(t, "https://www.googleapis.com/oauth2/v3/token",

165 p.RedeemURL.String())

166 assert.Equal(t, "", p.ProfileURL.String())

167 assert.Equal(t, "profile email", p.Scope)

168}

169

170func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {

171 o := testOptions()

172 assert.Equal(t, nil, Validate(o))

173

174 o.Cookie.Secret = "0123456789abcdef"

175 o.Cookie.Refresh = o.Cookie.Expire

176 assert.NotEqual(t, nil, Validate(o))

177

178 o.Cookie.Refresh -= time.Duration(1)

179 assert.Equal(t, nil, Validate(o))

180}

181

182func TestBase64CookieSecret(t *testing.T) {

183 o := testOptions()

184 assert.Equal(t, nil, Validate(o))

185

186 // 32 byte, base64 (urlsafe) encoded key

187 o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="

188 assert.Equal(t, nil, Validate(o))

189

190 // 32 byte, base64 (urlsafe) encoded key, w/o padding

191 o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"

192 assert.Equal(t, nil, Validate(o))

193

194 // 24 byte, base64 (urlsafe) encoded key

195 o.Cookie.Secret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"

196 assert.Equal(t, nil, Validate(o))

197

198 // 16 byte, base64 (urlsafe) encoded key

199 o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA=="

200 assert.Equal(t, nil, Validate(o))

201

202 // 16 byte, base64 (urlsafe) encoded key, w/o padding

203 o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA"

204 assert.Equal(t, nil, Validate(o))

205}

206

207func TestValidateSignatureKey(t *testing.T) {

208 o := testOptions()

209 o.SignatureKey = "sha1:secret"

210 assert.Equal(t, nil, Validate(o))

211 assert.Equal(t, o.GetSignatureData().Hash, crypto.SHA1)

212 assert.Equal(t, o.GetSignatureData().Key, "secret")

213}

214

215func TestValidateSignatureKeyInvalidSpec(t *testing.T) {

216 o := testOptions()

217 o.SignatureKey = "invalid spec"

218 err := Validate(o)

219 assert.Equal(t, err.Error(), "invalid configuration:\n"+

220 " invalid signature hash:key spec: "+o.SignatureKey)

221}

222

223func TestValidateSignatureKeyUnsupportedAlgorithm(t *testing.T) {

224 o := testOptions()

225 o.SignatureKey = "unsupported:default secret"

226 err := Validate(o)

227 assert.Equal(t, err.Error(), "invalid configuration:\n"+

228 " unsupported signature hash algorithm: "+o.SignatureKey)

229}

230

231func TestSkipOIDCDiscovery(t *testing.T) {

232 o := testOptions()

233 o.Providers[0].Type = "oidc"

234 o.Providers[0].OIDCConfig.IssuerURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/v2.0/"

235 o.Providers[0].OIDCConfig.SkipDiscovery = true

236

237 err := Validate(o)

238 assert.Equal(t, "invalid configuration:\n"+

239 " missing setting: login-url\n missing setting: redeem-url\n missing setting: oidc-jwks-url", err.Error())

240

241 o.Providers[0].LoginURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_sign_in"

242 o.Providers[0].RedeemURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_sign_in"

243 o.Providers[0].OIDCConfig.JwksURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/discovery/v2.0/keys"

244

245 assert.Equal(t, nil, Validate(o))

246}

247

248func TestGCPHealthcheck(t *testing.T) {

249 o := testOptions()

250 o.GCPHealthChecks = true

251 assert.Equal(t, nil, Validate(o))

252}

253

254func TestRealClientIPHeader(t *testing.T) {

255 // Ensure nil if ReverseProxy not set.

256 o := testOptions()

257 o.RealClientIPHeader = "X-Real-IP"

258 assert.Equal(t, nil, Validate(o))

259 assert.Nil(t, o.GetRealClientIPParser())

260

261 // Ensure simple use case works.

262 o = testOptions()

263 o.ReverseProxy = true

264 o.RealClientIPHeader = "X-Forwarded-For"

265 assert.Equal(t, nil, Validate(o))

266 assert.NotNil(t, o.GetRealClientIPParser())

267

268 // Ensure unknown header format process an error.

269 o = testOptions()

270 o.ReverseProxy = true

271 o.RealClientIPHeader = "Forwarded"

272 err := Validate(o)

273 assert.NotEqual(t, nil, err)

274 expected := errorMsg([]string{

275 "real_client_ip_header (Forwarded) not accepted parameter value: the http header key (Forwarded) is either invalid or unsupported",

276 })

277 assert.Equal(t, expected, err.Error())

278 assert.Nil(t, o.GetRealClientIPParser())

279

280 // Ensure invalid header format produces an error.

281 o = testOptions()

282 o.ReverseProxy = true

283 o.RealClientIPHeader = "!934invalidheader-23:"

284 err = Validate(o)

285 assert.NotEqual(t, nil, err)

286 expected = errorMsg([]string{

287 "real_client_ip_header (!934invalidheader-23:) not accepted parameter value: the http header key (!934invalidheader-23:) is either invalid or unsupported",

288 })

289 assert.Equal(t, expected, err.Error())

290 assert.Nil(t, o.GetRealClientIPParser())

291}

292

293func TestProviderCAFilesError(t *testing.T) {

294 file, err := ioutil.TempFile("", "absent.*.crt")

295 assert.NoError(t, err)

296 assert.NoError(t, file.Close())

297 assert.NoError(t, os.Remove(file.Name()))

298

299 o := testOptions()

300 o.Providers[0].CAFiles = append(o.Providers[0].CAFiles, file.Name())

301 err = Validate(o)

302 assert.Error(t, err)

303 assert.Contains(t, err.Error(), "unable to load provider CA file(s)")

304}