git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/providers/google_test.go
407 lines 13 kB history raw
1package providers
3import (
4 "context"
5 "encoding/base64"
6 "encoding/json"
7 "fmt"
8 "net/http"
9 "net/http/httptest"
10 "net/url"
11 "testing"
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
15 . "github.com/onsi/gomega"
16 "github.com/stretchr/testify/assert"
17 admin "google.golang.org/api/admin/directory/v1"
18 option "google.golang.org/api/option"
21func newRedeemServer(body []byte) (*url.URL, *httptest.Server) {
22 s := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
23 rw.Write(body)
24 }))
25 u, _ := url.Parse(s.URL)
26 return u, s
29func newGoogleProvider(t *testing.T) *GoogleProvider {
30 g := NewWithT(t)
31 p, err := NewGoogleProvider(
32 &ProviderData{
33 ProviderName: "",
34 LoginURL: &url.URL{},
35 RedeemURL: &url.URL{},
36 ProfileURL: &url.URL{},
37 ValidateURL: &url.URL{},
38 Scope: ""},
39 options.GoogleOptions{})
40 g.Expect(err).ToNot(HaveOccurred())
41 return p
44func TestNewGoogleProvider(t *testing.T) {
45 g := NewWithT(t)
47 // Test that defaults are set when calling for a new provider with nothing set
48 provider, err := NewGoogleProvider(&ProviderData{}, options.GoogleOptions{})
49 g.Expect(err).ToNot(HaveOccurred())
50 providerData := provider.Data()
52 g.Expect(providerData.ProviderName).To(Equal("Google"))
53 g.Expect(providerData.LoginURL.String()).To(Equal("https://accounts.google.com/o/oauth2/auth?access_type=offline"))
54 g.Expect(providerData.RedeemURL.String()).To(Equal("https://www.googleapis.com/oauth2/v3/token"))
55 g.Expect(providerData.ProfileURL.String()).To(Equal(""))
56 g.Expect(providerData.ValidateURL.String()).To(Equal("https://www.googleapis.com/oauth2/v1/tokeninfo"))
57 g.Expect(providerData.Scope).To(Equal("profile email"))
60func TestGoogleProviderOverrides(t *testing.T) {
61 p, err := NewGoogleProvider(
62 &ProviderData{
63 LoginURL: &url.URL{
64 Scheme: "https",
65 Host: "example.com",
66 Path: "/oauth/auth"},
67 RedeemURL: &url.URL{
68 Scheme: "https",
69 Host: "example.com",
70 Path: "/oauth/token"},
71 ProfileURL: &url.URL{
72 Scheme: "https",
73 Host: "example.com",
74 Path: "/oauth/profile"},
75 ValidateURL: &url.URL{
76 Scheme: "https",
77 Host: "example.com",
78 Path: "/oauth/tokeninfo"},
79 Scope: "profile"},
80 options.GoogleOptions{})
81 assert.NoError(t, err)
82 assert.NotEqual(t, nil, p)
83 assert.Equal(t, "Google", p.Data().ProviderName)
84 assert.Equal(t, "https://example.com/oauth/auth",
85 p.Data().LoginURL.String())
86 assert.Equal(t, "https://example.com/oauth/token",
87 p.Data().RedeemURL.String())
88 assert.Equal(t, "https://example.com/oauth/profile",
89 p.Data().ProfileURL.String())
90 assert.Equal(t, "https://example.com/oauth/tokeninfo",
91 p.Data().ValidateURL.String())
92 assert.Equal(t, "profile", p.Data().Scope)
95type redeemResponse struct {
96 AccessToken string `json:"access_token"`
97 RefreshToken string `json:"refresh_token"`
98 ExpiresIn int64 `json:"expires_in"`
99 IDToken string `json:"id_token"`
102func TestGoogleProviderGetEmailAddress(t *testing.T) {
103 p := newGoogleProvider(t)
104 body, err := json.Marshal(redeemResponse{
105 AccessToken: "a1234",
106 ExpiresIn: 10,
107 RefreshToken: "refresh12345",
108 IDToken: "ignored prefix." + base64.URLEncoding.EncodeToString([]byte(`{"email": "michael.bland@gsa.gov", "email_verified":true}`)),
109 })
110 assert.Equal(t, nil, err)
111 var server *httptest.Server
112 p.RedeemURL, server = newRedeemServer(body)
113 defer server.Close()
115 session, err := p.Redeem(context.Background(), "http://redirect/", "code1234", "123")
116 assert.Equal(t, nil, err)
117 assert.NotEqual(t, session, nil)
118 assert.Equal(t, "michael.bland@gsa.gov", session.Email)
119 assert.Equal(t, "a1234", session.AccessToken)
120 assert.Equal(t, "refresh12345", session.RefreshToken)
123func TestGoogleProviderGroupValidator(t *testing.T) {
124 const sessionEmail = "michael.bland@gsa.gov"
126 testCases := map[string]struct {
127 session *sessions.SessionState
128 validatorFunc func(*sessions.SessionState) bool
129 expectedAuthZ bool
130 }{
131 "Email is authorized with groupValidator": {
132 session: &sessions.SessionState{
133 Email: sessionEmail,
134 },
135 validatorFunc: func(s *sessions.SessionState) bool {
136 return s.Email == sessionEmail
137 },
138 expectedAuthZ: true,
139 },
140 "Email is denied with groupValidator": {
141 session: &sessions.SessionState{
142 Email: sessionEmail,
143 },
144 validatorFunc: func(s *sessions.SessionState) bool {
145 return s.Email != sessionEmail
146 },
147 expectedAuthZ: false,
148 },
149 "Default does no authorization checks": {
150 session: &sessions.SessionState{
151 Email: sessionEmail,
152 },
153 validatorFunc: nil,
154 expectedAuthZ: true,
155 },
156 }
157 for name, tc := range testCases {
158 t.Run(name, func(t *testing.T) {
159 g := NewWithT(t)
160 p := newGoogleProvider(t)
161 if tc.validatorFunc != nil {
162 p.groupValidator = tc.validatorFunc
163 }
164 g.Expect(p.groupValidator(tc.session)).To(Equal(tc.expectedAuthZ))
165 })
166 }
169func TestGoogleProviderGetEmailAddressInvalidEncoding(t *testing.T) {
170 p := newGoogleProvider(t)
171 body, err := json.Marshal(redeemResponse{
172 AccessToken: "a1234",
173 IDToken: "ignored prefix." + `{"email": "michael.bland@gsa.gov"}`,
174 })
175 assert.Equal(t, nil, err)
176 var server *httptest.Server
177 p.RedeemURL, server = newRedeemServer(body)
178 defer server.Close()
180 session, err := p.Redeem(context.Background(), "http://redirect/", "code1234", "123")
181 assert.NotEqual(t, nil, err)
182 if session != nil {
183 t.Errorf("expect nill session %#v", session)
184 }
187func TestGoogleProviderRedeemFailsNoCLientSecret(t *testing.T) {
188 p := newGoogleProvider(t)
189 p.ProviderData.ClientSecretFile = "srvnoerre"
191 session, err := p.Redeem(context.Background(), "http://redirect/", "code1234", "123")
192 assert.NotEqual(t, nil, err)
193 if session != nil {
194 t.Errorf("expect nill session %#v", session)
195 }
196 assert.Equal(t, "could not read client secret file", err.Error())
199func TestGoogleProviderGetEmailAddressInvalidJson(t *testing.T) {
200 p := newGoogleProvider(t)
202 body, err := json.Marshal(redeemResponse{
203 AccessToken: "a1234",
204 IDToken: "ignored prefix." + base64.URLEncoding.EncodeToString([]byte(`{"email": michael.bland@gsa.gov}`)),
205 })
206 assert.Equal(t, nil, err)
207 var server *httptest.Server
208 p.RedeemURL, server = newRedeemServer(body)
209 defer server.Close()
211 session, err := p.Redeem(context.Background(), "http://redirect/", "code1234", "123")
212 assert.NotEqual(t, nil, err)
213 if session != nil {
214 t.Errorf("expect nill session %#v", session)
215 }
219func TestGoogleProviderGetEmailAddressEmailMissing(t *testing.T) {
220 p := newGoogleProvider(t)
221 body, err := json.Marshal(redeemResponse{
222 AccessToken: "a1234",
223 IDToken: "ignored prefix." + base64.URLEncoding.EncodeToString([]byte(`{"not_email": "missing"}`)),
224 })
225 assert.Equal(t, nil, err)
226 var server *httptest.Server
227 p.RedeemURL, server = newRedeemServer(body)
228 defer server.Close()
230 session, err := p.Redeem(context.Background(), "http://redirect/", "code1234", "123")
231 assert.NotEqual(t, nil, err)
232 if session != nil {
233 t.Errorf("expect nill session %#v", session)
234 }
238func TestGoogleProvider_userInGroup(t *testing.T) {
239 ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
240 switch r.URL.Path {
241 case "/admin/directory/v1/groups/group@example.com/hasMember/member-in-domain@example.com":
242 fmt.Fprintln(w, `{"isMember":true}`)
243 case "/admin/directory/v1/groups/group@example.com/hasMember/non-member-in-domain@example.com":
244 fmt.Fprintln(w, `{"isMember":false}`)
245 case "/admin/directory/v1/groups/group@example.com/hasMember/member-out-of-domain@otherexample.com":
246 http.Error(
247 w,
248 `{"error":{"errors":[{"domain":"global","reason":"invalid","message":"Invalid Input: memberKey"}],"code":400,"message":"Invalid Input: memberKey"}}`,
249 http.StatusBadRequest,
250 )
251 case "/admin/directory/v1/groups/group@example.com/hasMember/non-member-out-of-domain@otherexample.com":
252 http.Error(
253 w,
254 `{"error":{"errors":[{"domain":"global","reason":"invalid","message":"Invalid Input: memberKey"}],"code":400,"message":"Invalid Input: memberKey"}}`,
255 http.StatusBadRequest,
256 )
257 case "/admin/directory/v1/groups/group@example.com/members/non-member-out-of-domain@otherexample.com":
258 // note that the client currently doesn't care what this response text or code is - any error here results in failure to match the group
259 http.Error(
260 w,
261 `{"kind":"admin#directory#member","etag":"12345","id":"1234567890","email":"member-out-of-domain@otherexample.com","role":"MEMBER","type":"USER","status":"ACTIVE","delivery_settings":"ALL_MAIL"}`,
262 http.StatusNotFound,
263 )
264 case "/admin/directory/v1/groups/group@example.com/members/member-out-of-domain@otherexample.com":
265 fmt.Fprintln(w,
266 `{"kind":"admin#directory#member","etag":"12345","id":"1234567890","email":"member-out-of-domain@otherexample.com","role":"MEMBER","type":"USER","status":"ACTIVE","delivery_settings":"ALL_MAIL"}`,
267 )
268 }
269 }))
270 defer ts.Close()
272 client := ts.Client()
273 ctx := context.Background()
275 service, err := admin.NewService(ctx, option.WithHTTPClient(client))
276 assert.NoError(t, err)
278 service.BasePath = ts.URL
280 result := userInGroup(service, "group@example.com", "member-in-domain@example.com")
281 assert.True(t, result)
283 result = userInGroup(service, "group@example.com", "member-out-of-domain@otherexample.com")
284 assert.True(t, result)
286 result = userInGroup(service, "group@example.com", "non-member-in-domain@example.com")
287 assert.False(t, result)
289 result = userInGroup(service, "group@example.com", "non-member-out-of-domain@otherexample.com")
290 assert.False(t, result)
293func TestGoogleProvider_getUserGroups(t *testing.T) {
294 ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
295 if r.URL.Path == "/admin/directory/v1/groups" && r.URL.Query().Get("userKey") == "test@example.com" {
296 response := `{
297 "kind": "admin#directory#groups",
298 "groups": [
299 {
300 "kind": "admin#directory#group",
301 "id": "1",
302 "email": "group1@example.com",
303 "name": "Group 1"
304 },
305 {
306 "kind": "admin#directory#group",
307 "id": "2",
308 "email": "group2@example.com",
309 "name": "Group 2"
310 }
311 ]
312 }`
313 fmt.Fprintln(w, response)
314 } else {
315 http.NotFound(w, r)
316 }
317 }))
318 defer ts.Close()
320 client := &http.Client{}
321 adminService, err := admin.NewService(context.Background(), option.WithHTTPClient(client), option.WithEndpoint(ts.URL))
322 assert.NoError(t, err)
324 groups, err := getUserGroups(adminService, "test@example.com")
325 assert.NoError(t, err)
326 assert.Equal(t, []string{"group1@example.com", "group2@example.com"}, groups)
329func TestGoogleProvider_getUserInfo(t *testing.T) {
330 ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
331 if r.URL.Path == "/admin/directory/v1/users/test@example.com" {
332 response := `{
333 "kind": "admin#directory#user",
334 "id": "",
335 "etag": "\"\"",
336 "primaryEmail": "test@example.com",
337 "name": {
338 "givenName": "Test",
339 "familyName": "User",
340 "fullName": "Test User"
341 },
342 "isAdmin": false,
343 "isDelegatedAdmin": false,
344 "lastLoginTime": "",
345 "creationTime": "",
346 "agreedToTerms": true,
347 "suspended": false,
348 "archived": false,
349 "changePasswordAtNextLogin": false,
350 "ipWhitelisted": false,
351 "emails": [
352 {
353 "address": "test@example.com",
354 "primary": true
355 }
356 ],
357 "externalIds": [
358 {
359 "value": "test.user",
360 "type": "organization"
361 }
362 ],
363 "organizations": [
364 ],
365 "phones": [
366 ],
367 "languages": [
368 {
369 "languageCode": "en",
370 "preference": "preferred"
371 }
372 ],
373 "aliases": [
374 "test.user@example.com"
375 ],
376 "nonEditableAliases": [
377 "test.user@example.com"
378 ],
379 "gender": {
380 "type": "male"
381 },
382 "customerId": "",
383 "orgUnitPath": "/",
384 "isMailboxSetup": true,
385 "isEnrolledIn2Sv": true,
386 "isEnforcedIn2Sv": false,
387 "includeInGlobalAddressList": true,
388 "thumbnailPhotoUrl": "",
389 "thumbnailPhotoEtag": "\"\"",
390 "recoveryEmail": "test.user@gmail.com",
391 "recoveryPhone": "+55555555555"
392 }`
393 fmt.Fprintln(w, response)
394 } else {
395 http.NotFound(w, r)
396 }
397 }))
398 defer ts.Close()
400 client := &http.Client{}
401 adminService, err := admin.NewService(context.Background(), option.WithHTTPClient(client), option.WithEndpoint(ts.URL))
402 assert.NoError(t, err)
404 info, err := getUserInfo(adminService, "test@example.com")
405 assert.NoError(t, err)
406 assert.Equal(t, "test.user", info)