pkg/validation/options_test.go · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

typeable/oauth2-proxy/pkg/validation/options_test.go

238 lines 7.2 kB history raw

1package validation

3import (

4 "crypto"

5 "net/url"

6 "os"

7 "strings"

8 "testing"

9 "time"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

13 "github.com/stretchr/testify/assert"

14)

16const (

17 cookieSecret = "secretthirtytwobytes+abcdefghijk"

18 clientID = "bazquux"

19 clientSecret = "xyzzyplugh"

20 providerID = "providerID"

21)

23func testOptions() *options.Options {

24 o := options.NewOptions()

25 o.UpstreamServers.Upstreams = append(o.UpstreamServers.Upstreams, options.Upstream{

26 ID: "upstream",

27 Path: "/",

28 URI: "http://127.0.0.1:8080/",

29 })

30 o.Cookie.Secret = cookieSecret

31 o.Providers[0].ID = providerID

32 o.Providers[0].ClientID = clientID

33 o.Providers[0].ClientSecret = clientSecret

34 o.EmailDomains = []string{"*"}

35 return o

36}

38func errorMsg(msgs []string) string {

39 result := make([]string, 0)

40 result = append(result, "invalid configuration:")

41 result = append(result, msgs...)

42 return strings.Join(result, "\n ")

43}

45func TestNewOptions(t *testing.T) {

46 o := options.NewOptions()

47 o.EmailDomains = []string{"*"}

48 err := Validate(o)

49 assert.NotEqual(t, nil, err)

51 expected := errorMsg([]string{

52 "missing setting: cookie-secret or cookie-secret-file",

53 "provider has empty id: ids are required for all providers",

54 "provider missing setting: client-id",

55 "missing setting: client-secret or client-secret-file"})

56 assert.Equal(t, expected, err.Error())

57}

59func TestGoogleGroupOptionsWithoutServiceAccountJSON(t *testing.T) {

60 o := testOptions()

61 o.Providers[0].GoogleConfig.AdminEmail = "admin@example.com"

62 err := Validate(o)

63 assert.NotEqual(t, nil, err)

65 expected := errorMsg([]string{

66 "missing setting: google-service-account-json or google-use-application-default-credentials"})

67 assert.Equal(t, expected, err.Error())

68}

70func TestGoogleGroupOptionsWithoutAdminEmail(t *testing.T) {

71 o := testOptions()

72 o.Providers[0].GoogleConfig.UseApplicationDefaultCredentials = ptr.To(true)

73 err := Validate(o)

74 assert.NotEqual(t, nil, err)

76 expected := errorMsg([]string{

77 "missing setting: google-admin-email"})

78 assert.Equal(t, expected, err.Error())

79}

81func TestGoogleGroupOptionsWithoutGroups(t *testing.T) {

82 o := testOptions()

83 // Set admin email and application default credentials but no groups - should still require them

84 o.Providers[0].GoogleConfig.AdminEmail = "admin@example.com"

85 o.Providers[0].GoogleConfig.UseApplicationDefaultCredentials = ptr.To(true)

86 err := Validate(o)

87 // Should pass validation since google-group is now optional

88 assert.Equal(t, nil, err)

89}

91func TestGoogleGroupInvalidFile(t *testing.T) {

92 o := testOptions()

93 o.Providers[0].GoogleConfig.Groups = []string{"test_group"}

94 o.Providers[0].GoogleConfig.AdminEmail = "admin@example.com"

95 o.Providers[0].GoogleConfig.ServiceAccountJSON = "file_doesnt_exist.json"

96 err := Validate(o)

97 assert.NotEqual(t, nil, err)

99 expected := errorMsg([]string{

100 "Google credentials file not found: file_doesnt_exist.json",

101 })

102 assert.Equal(t, expected, err.Error())

103}

104

105func TestInitializedOptions(t *testing.T) {

106 o := testOptions()

107 assert.Equal(t, nil, Validate(o))

108}

109

110// Note that it's not worth testing nonparseable URLs, since url.Parse()

111// seems to parse damn near anything.

112func TestRedirectURL(t *testing.T) {

113 o := testOptions()

114 o.RawRedirectURL = "https://myhost.com/oauth2/callback"

115 assert.Equal(t, nil, Validate(o))

116 expected := &url.URL{

117 Scheme: "https", Host: "myhost.com", Path: "/oauth2/callback"}

118 assert.Equal(t, expected, o.GetRedirectURL())

119}

120

121func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {

122 o := testOptions()

123 assert.Equal(t, nil, Validate(o))

124

125 o.Cookie.Secret = "0123456789abcdef"

126 o.Cookie.Refresh = o.Cookie.Expire

127 assert.NotEqual(t, nil, Validate(o))

128

129 o.Cookie.Refresh -= time.Duration(1)

130 assert.Equal(t, nil, Validate(o))

131}

132

133func TestBase64CookieSecret(t *testing.T) {

134 o := testOptions()

135 assert.Equal(t, nil, Validate(o))

136

137 // 32 byte, base64 (urlsafe) encoded key

138 o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="

139 assert.Equal(t, nil, Validate(o))

140

141 // 32 byte, base64 (urlsafe) encoded key, w/o padding

142 o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"

143 assert.Equal(t, nil, Validate(o))

144

145 // 24 byte, base64 (urlsafe) encoded key

146 o.Cookie.Secret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"

147 assert.Equal(t, nil, Validate(o))

148

149 // 16 byte, base64 (urlsafe) encoded key

150 o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA=="

151 assert.Equal(t, nil, Validate(o))

152

153 // 16 byte, base64 (urlsafe) encoded key, w/o padding

154 o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA"

155 assert.Equal(t, nil, Validate(o))

156}

157

158func TestValidateSignatureKey(t *testing.T) {

159 o := testOptions()

160 o.SignatureKey = "sha1:secret"

161 assert.Equal(t, nil, Validate(o))

162 assert.Equal(t, o.GetSignatureData().Hash, crypto.SHA1)

163 assert.Equal(t, o.GetSignatureData().Key, "secret")

164}

165

166func TestValidateSignatureKeyInvalidSpec(t *testing.T) {

167 o := testOptions()

168 o.SignatureKey = "invalid spec"

169 err := Validate(o)

170 assert.Equal(t, err.Error(), "invalid configuration:\n"+

171 " invalid signature hash:key spec: "+o.SignatureKey)

172}

173

174func TestValidateSignatureKeyUnsupportedAlgorithm(t *testing.T) {

175 o := testOptions()

176 o.SignatureKey = "unsupported:default secret"

177 err := Validate(o)

178 assert.Equal(t, err.Error(), "invalid configuration:\n"+

179 " unsupported signature hash algorithm: "+o.SignatureKey)

180}

181

182func TestGCPHealthcheck(t *testing.T) {

183 o := testOptions()

184 o.GCPHealthChecks = true

185 assert.Equal(t, nil, Validate(o))

186}

187

188func TestRealClientIPHeader(t *testing.T) {

189 // Ensure nil if ReverseProxy not set.

190 o := testOptions()

191 o.RealClientIPHeader = "X-Real-IP"

192 assert.Equal(t, nil, Validate(o))

193 assert.Nil(t, o.GetRealClientIPParser())

194

195 // Ensure simple use case works.

196 o = testOptions()

197 o.ReverseProxy = true

198 o.RealClientIPHeader = "X-Forwarded-For"

199 assert.Equal(t, nil, Validate(o))

200 assert.NotNil(t, o.GetRealClientIPParser())

201

202 // Ensure unknown header format process an error.

203 o = testOptions()

204 o.ReverseProxy = true

205 o.RealClientIPHeader = "Forwarded"

206 err := Validate(o)

207 assert.NotEqual(t, nil, err)

208 expected := errorMsg([]string{

209 "real_client_ip_header (Forwarded) not accepted parameter value: the http header key (Forwarded) is either invalid or unsupported",

210 })

211 assert.Equal(t, expected, err.Error())

212 assert.Nil(t, o.GetRealClientIPParser())

213

214 // Ensure invalid header format produces an error.

215 o = testOptions()

216 o.ReverseProxy = true

217 o.RealClientIPHeader = "!934invalidheader-23:"

218 err = Validate(o)

219 assert.NotEqual(t, nil, err)

220 expected = errorMsg([]string{

221 "real_client_ip_header (!934invalidheader-23:) not accepted parameter value: the http header key (!934invalidheader-23:) is either invalid or unsupported",

222 })

223 assert.Equal(t, expected, err.Error())

224 assert.Nil(t, o.GetRealClientIPParser())

225}

226

227func TestProviderCAFilesError(t *testing.T) {

228 file, err := os.CreateTemp("", "absent.*.crt")

229 assert.NoError(t, err)

230 assert.NoError(t, file.Close())

231 assert.NoError(t, os.Remove(file.Name()))

232

233 o := testOptions()

234 o.Providers[0].CAFiles = append(o.Providers[0].CAFiles, file.Name())

235 err = Validate(o)

236 assert.Error(t, err)

237 assert.Contains(t, err.Error(), "unable to load provider CA file(s)")

238}