git.iko.soy/typeable/oauth2-proxy
on remove-gap-headers help sign in
typeable/oauth2-proxy/providers/azure_test.go
222 lines 7.2 kB history raw
1package providers
3import (
4 "context"
5 "net/http"
6 "net/http/httptest"
7 "net/url"
8 "testing"
9 "time"
11 . "github.com/onsi/gomega"
12 "github.com/stretchr/testify/assert"
15func testAzureProvider(hostname string) *AzureProvider {
16 p := NewAzureProvider(
17 &ProviderData{
18 ProviderName: "",
19 LoginURL: &url.URL{},
20 RedeemURL: &url.URL{},
21 ProfileURL: &url.URL{},
22 ValidateURL: &url.URL{},
23 ProtectedResource: &url.URL{},
24 Scope: ""})
26 if hostname != "" {
27 updateURL(p.Data().LoginURL, hostname)
28 updateURL(p.Data().RedeemURL, hostname)
29 updateURL(p.Data().ProfileURL, hostname)
30 updateURL(p.Data().ValidateURL, hostname)
31 updateURL(p.Data().ProtectedResource, hostname)
32 }
33 return p
36func TestNewAzureProvider(t *testing.T) {
37 g := NewWithT(t)
39 // Test that defaults are set when calling for a new provider with nothing set
40 providerData := NewAzureProvider(&ProviderData{}).Data()
41 g.Expect(providerData.ProviderName).To(Equal("Azure"))
42 g.Expect(providerData.LoginURL.String()).To(Equal("https://login.microsoftonline.com/common/oauth2/authorize"))
43 g.Expect(providerData.RedeemURL.String()).To(Equal("https://login.microsoftonline.com/common/oauth2/token"))
44 g.Expect(providerData.ProfileURL.String()).To(Equal("https://graph.microsoft.com/v1.0/me"))
45 g.Expect(providerData.ValidateURL.String()).To(Equal(""))
46 g.Expect(providerData.Scope).To(Equal("openid"))
49func TestAzureProviderOverrides(t *testing.T) {
50 p := NewAzureProvider(
51 &ProviderData{
52 LoginURL: &url.URL{
53 Scheme: "https",
54 Host: "example.com",
55 Path: "/oauth/auth"},
56 RedeemURL: &url.URL{
57 Scheme: "https",
58 Host: "example.com",
59 Path: "/oauth/token"},
60 ProfileURL: &url.URL{
61 Scheme: "https",
62 Host: "example.com",
63 Path: "/oauth/profile"},
64 ValidateURL: &url.URL{
65 Scheme: "https",
66 Host: "example.com",
67 Path: "/oauth/tokeninfo"},
68 ProtectedResource: &url.URL{
69 Scheme: "https",
70 Host: "example.com"},
71 Scope: "profile"})
72 assert.NotEqual(t, nil, p)
73 assert.Equal(t, "Azure", p.Data().ProviderName)
74 assert.Equal(t, "https://example.com/oauth/auth",
75 p.Data().LoginURL.String())
76 assert.Equal(t, "https://example.com/oauth/token",
77 p.Data().RedeemURL.String())
78 assert.Equal(t, "https://example.com/oauth/profile",
79 p.Data().ProfileURL.String())
80 assert.Equal(t, "https://example.com/oauth/tokeninfo",
81 p.Data().ValidateURL.String())
82 assert.Equal(t, "https://example.com",
83 p.Data().ProtectedResource.String())
84 assert.Equal(t, "profile", p.Data().Scope)
87func TestAzureSetTenant(t *testing.T) {
88 p := testAzureProvider("")
89 p.Configure("example")
90 assert.Equal(t, "Azure", p.Data().ProviderName)
91 assert.Equal(t, "example", p.Tenant)
92 assert.Equal(t, "https://login.microsoftonline.com/example/oauth2/authorize",
93 p.Data().LoginURL.String())
94 assert.Equal(t, "https://login.microsoftonline.com/example/oauth2/token",
95 p.Data().RedeemURL.String())
96 assert.Equal(t, "https://graph.microsoft.com/v1.0/me",
97 p.Data().ProfileURL.String())
98 assert.Equal(t, "https://graph.microsoft.com",
99 p.Data().ProtectedResource.String())
100 assert.Equal(t, "", p.Data().ValidateURL.String())
101 assert.Equal(t, "openid", p.Data().Scope)
104func testAzureBackend(payload string) *httptest.Server {
105 path := "/v1.0/me"
107 return httptest.NewServer(http.HandlerFunc(
108 func(w http.ResponseWriter, r *http.Request) {
109 if (r.URL.Path != path) && r.Method != http.MethodPost {
110 w.WriteHeader(404)
111 } else if r.Method == http.MethodPost && r.Body != nil {
112 w.WriteHeader(200)
113 w.Write([]byte(payload))
114 } else if !IsAuthorizedInHeader(r.Header) {
115 w.WriteHeader(403)
116 } else {
117 w.WriteHeader(200)
118 w.Write([]byte(payload))
119 }
120 }))
123func TestAzureProviderGetEmailAddress(t *testing.T) {
124 b := testAzureBackend(`{ "mail": "user@windows.net" }`)
125 defer b.Close()
127 bURL, _ := url.Parse(b.URL)
128 p := testAzureProvider(bURL.Host)
130 session := CreateAuthorizedSession()
131 email, err := p.GetEmailAddress(context.Background(), session)
132 assert.Equal(t, nil, err)
133 assert.Equal(t, "user@windows.net", email)
136func TestAzureProviderGetEmailAddressMailNull(t *testing.T) {
137 b := testAzureBackend(`{ "mail": null, "otherMails": ["user@windows.net", "altuser@windows.net"] }`)
138 defer b.Close()
140 bURL, _ := url.Parse(b.URL)
141 p := testAzureProvider(bURL.Host)
143 session := CreateAuthorizedSession()
144 email, err := p.GetEmailAddress(context.Background(), session)
145 assert.Equal(t, nil, err)
146 assert.Equal(t, "user@windows.net", email)
149func TestAzureProviderGetEmailAddressGetUserPrincipalName(t *testing.T) {
150 b := testAzureBackend(`{ "mail": null, "otherMails": [], "userPrincipalName": "user@windows.net" }`)
151 defer b.Close()
153 bURL, _ := url.Parse(b.URL)
154 p := testAzureProvider(bURL.Host)
156 session := CreateAuthorizedSession()
157 email, err := p.GetEmailAddress(context.Background(), session)
158 assert.Equal(t, nil, err)
159 assert.Equal(t, "user@windows.net", email)
162func TestAzureProviderGetEmailAddressFailToGetEmailAddress(t *testing.T) {
163 b := testAzureBackend(`{ "mail": null, "otherMails": [], "userPrincipalName": null }`)
164 defer b.Close()
166 bURL, _ := url.Parse(b.URL)
167 p := testAzureProvider(bURL.Host)
169 session := CreateAuthorizedSession()
170 email, err := p.GetEmailAddress(context.Background(), session)
171 assert.Equal(t, "type assertion to string failed", err.Error())
172 assert.Equal(t, "", email)
175func TestAzureProviderGetEmailAddressEmptyUserPrincipalName(t *testing.T) {
176 b := testAzureBackend(`{ "mail": null, "otherMails": [], "userPrincipalName": "" }`)
177 defer b.Close()
179 bURL, _ := url.Parse(b.URL)
180 p := testAzureProvider(bURL.Host)
182 session := CreateAuthorizedSession()
183 email, err := p.GetEmailAddress(context.Background(), session)
184 assert.Equal(t, nil, err)
185 assert.Equal(t, "", email)
188func TestAzureProviderGetEmailAddressIncorrectOtherMails(t *testing.T) {
189 b := testAzureBackend(`{ "mail": null, "otherMails": "", "userPrincipalName": null }`)
190 defer b.Close()
192 bURL, _ := url.Parse(b.URL)
193 p := testAzureProvider(bURL.Host)
195 session := CreateAuthorizedSession()
196 email, err := p.GetEmailAddress(context.Background(), session)
197 assert.Equal(t, "type assertion to string failed", err.Error())
198 assert.Equal(t, "", email)
201func TestAzureProviderRedeemReturnsIdToken(t *testing.T) {
202 b := testAzureBackend(`{ "id_token": "testtoken1234", "expires_on": "1136239445", "refresh_token": "refresh1234" }`)
203 defer b.Close()
204 timestamp, err := time.Parse(time.RFC3339, "2006-01-02T22:04:05Z")
205 assert.Equal(t, nil, err)
207 bURL, _ := url.Parse(b.URL)
208 p := testAzureProvider(bURL.Host)
209 p.Data().RedeemURL.Path = "/common/oauth2/token"
210 s, err := p.Redeem(context.Background(), "https://localhost", "1234")
211 assert.Equal(t, nil, err)
212 assert.Equal(t, "testtoken1234", s.IDToken)
213 assert.Equal(t, timestamp, s.ExpiresOn.UTC())
214 assert.Equal(t, "refresh1234", s.RefreshToken)
217func TestAzureProviderProtectedResourceConfigured(t *testing.T) {
218 p := testAzureProvider("")
219 p.ProtectedResource, _ = url.Parse("http://my.resource.test")
220 result := p.GetLoginURL("https://my.test.app/oauth", "")
221 assert.Contains(t, result, "resource="+url.QueryEscape("http://my.resource.test"))