git.iko.soy/typeable/oauth2-proxy
on v5.1.1 help sign in
typeable/oauth2-proxy/options_test.go
328 lines 9.3 kB history raw
1package main
3import (
4 "crypto"
5 "fmt"
6 "io/ioutil"
7 "net/url"
8 "os"
9 "strings"
10 "testing"
11 "time"
13 "github.com/stretchr/testify/assert"
16const (
17 cookieSecret = "foobar"
18 clientID = "bazquux"
19 clientSecret = "xyzzyplugh"
22func testOptions() *Options {
23 o := NewOptions()
24 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8080/")
25 o.CookieSecret = cookieSecret
26 o.ClientID = clientID
27 o.ClientSecret = clientSecret
28 o.EmailDomains = []string{"*"}
29 return o
32func errorMsg(msgs []string) string {
33 result := make([]string, 0)
34 result = append(result, "Invalid configuration:")
35 result = append(result, msgs...)
36 return strings.Join(result, "\n ")
39func TestNewOptions(t *testing.T) {
40 o := NewOptions()
41 o.EmailDomains = []string{"*"}
42 err := o.Validate()
43 assert.NotEqual(t, nil, err)
45 expected := errorMsg([]string{
46 "missing setting: cookie-secret",
47 "missing setting: client-id",
48 "missing setting: client-secret or client-secret-file"})
49 assert.Equal(t, expected, err.Error())
52func TestClientSecretFileOptionFails(t *testing.T) {
53 o := NewOptions()
54 o.CookieSecret = cookieSecret
55 o.ClientID = clientID
56 o.ClientSecretFile = clientSecret
57 o.EmailDomains = []string{"*"}
58 err := o.Validate()
59 assert.NotEqual(t, nil, err)
61 p := o.provider.Data()
62 assert.Equal(t, clientSecret, p.ClientSecretFile)
63 assert.Equal(t, "", p.ClientSecret)
65 s, err := p.GetClientSecret()
66 assert.NotEqual(t, nil, err)
67 assert.Equal(t, "", s)
70func TestClientSecretFileOption(t *testing.T) {
71 var err error
72 f, err := ioutil.TempFile("", "client_secret_temp_file_")
73 if err != nil {
74 t.Fatalf("failed to create temp file: %v", err)
75 }
76 f.WriteString("testcase")
77 if err := f.Close(); err != nil {
78 t.Fatalf("failed to close temp file: %v", err)
79 }
80 clientSecretFileName := f.Name()
81 defer os.Remove(clientSecretFileName)
83 o := NewOptions()
84 o.CookieSecret = cookieSecret
85 o.ClientID = clientID
86 o.ClientSecretFile = clientSecretFileName
87 o.EmailDomains = []string{"*"}
88 err = o.Validate()
89 assert.Equal(t, nil, err)
91 p := o.provider.Data()
92 assert.Equal(t, clientSecretFileName, p.ClientSecretFile)
93 assert.Equal(t, "", p.ClientSecret)
95 s, err := p.GetClientSecret()
96 assert.Equal(t, nil, err)
97 assert.Equal(t, "testcase", s)
100func TestGoogleGroupOptions(t *testing.T) {
101 o := testOptions()
102 o.GoogleGroups = []string{"googlegroup"}
103 err := o.Validate()
104 assert.NotEqual(t, nil, err)
106 expected := errorMsg([]string{
107 "missing setting: google-admin-email",
108 "missing setting: google-service-account-json"})
109 assert.Equal(t, expected, err.Error())
112func TestGoogleGroupInvalidFile(t *testing.T) {
113 o := testOptions()
114 o.GoogleGroups = []string{"test_group"}
115 o.GoogleAdminEmail = "admin@example.com"
116 o.GoogleServiceAccountJSON = "file_doesnt_exist.json"
117 err := o.Validate()
118 assert.NotEqual(t, nil, err)
120 expected := errorMsg([]string{
121 "invalid Google credentials file: file_doesnt_exist.json",
122 })
123 assert.Equal(t, expected, err.Error())
126func TestInitializedOptions(t *testing.T) {
127 o := testOptions()
128 assert.Equal(t, nil, o.Validate())
131// Note that it's not worth testing nonparseable URLs, since url.Parse()
132// seems to parse damn near anything.
133func TestRedirectURL(t *testing.T) {
134 o := testOptions()
135 o.RedirectURL = "https://myhost.com/oauth2/callback"
136 assert.Equal(t, nil, o.Validate())
137 expected := &url.URL{
138 Scheme: "https", Host: "myhost.com", Path: "/oauth2/callback"}
139 assert.Equal(t, expected, o.redirectURL)
142func TestProxyURLs(t *testing.T) {
143 o := testOptions()
144 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8081")
145 assert.Equal(t, nil, o.Validate())
146 expected := []*url.URL{
147 {Scheme: "http", Host: "127.0.0.1:8080", Path: "/"},
148 // note the '/' was added
149 {Scheme: "http", Host: "127.0.0.1:8081", Path: "/"},
150 }
151 assert.Equal(t, expected, o.proxyURLs)
154func TestProxyURLsError(t *testing.T) {
155 o := testOptions()
156 o.Upstreams = append(o.Upstreams, "127.0.0.1:8081")
157 err := o.Validate()
158 assert.NotEqual(t, nil, err)
159 assert.Contains(t, err.Error(), "error parsing upstream")
162func TestCompiledRegex(t *testing.T) {
163 o := testOptions()
164 regexps := []string{"/foo/.*", "/ba[rz]/quux"}
165 o.SkipAuthRegex = regexps
166 assert.Equal(t, nil, o.Validate())
167 actual := make([]string, 0)
168 for _, regex := range o.CompiledRegex {
169 actual = append(actual, regex.String())
170 }
171 assert.Equal(t, regexps, actual)
174func TestCompiledRegexError(t *testing.T) {
175 o := testOptions()
176 o.SkipAuthRegex = []string{"(foobaz", "barquux)"}
177 err := o.Validate()
178 assert.NotEqual(t, nil, err)
180 expected := errorMsg([]string{
181 "error compiling regex=\"(foobaz\" error parsing regexp: " +
182 "missing closing ): `(foobaz`",
183 "error compiling regex=\"barquux)\" error parsing regexp: " +
184 "unexpected ): `barquux)`"})
185 assert.Equal(t, expected, err.Error())
187 o.SkipAuthRegex = []string{"foobaz", "barquux)"}
188 err = o.Validate()
189 assert.NotEqual(t, nil, err)
191 expected = errorMsg([]string{
192 "error compiling regex=\"barquux)\" error parsing regexp: " +
193 "unexpected ): `barquux)`"})
194 assert.Equal(t, expected, err.Error())
197func TestDefaultProviderApiSettings(t *testing.T) {
198 o := testOptions()
199 assert.Equal(t, nil, o.Validate())
200 p := o.provider.Data()
201 assert.Equal(t, "https://accounts.google.com/o/oauth2/auth?access_type=offline",
202 p.LoginURL.String())
203 assert.Equal(t, "https://www.googleapis.com/oauth2/v3/token",
204 p.RedeemURL.String())
205 assert.Equal(t, "", p.ProfileURL.String())
206 assert.Equal(t, "profile email", p.Scope)
209func TestPassAccessTokenRequiresSpecificCookieSecretLengths(t *testing.T) {
210 o := testOptions()
211 assert.Equal(t, nil, o.Validate())
213 assert.Equal(t, false, o.PassAccessToken)
214 o.PassAccessToken = true
215 o.CookieSecret = "cookie of invalid length-"
216 assert.NotEqual(t, nil, o.Validate())
218 o.PassAccessToken = false
219 o.CookieRefresh = time.Duration(24) * time.Hour
220 assert.NotEqual(t, nil, o.Validate())
222 o.CookieSecret = "16 bytes AES-128"
223 assert.Equal(t, nil, o.Validate())
225 o.CookieSecret = "24 byte secret AES-192--"
226 assert.Equal(t, nil, o.Validate())
228 o.CookieSecret = "32 byte secret for AES-256------"
229 assert.Equal(t, nil, o.Validate())
232func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {
233 o := testOptions()
234 assert.Equal(t, nil, o.Validate())
236 o.CookieSecret = "0123456789abcdefabcd"
237 o.CookieRefresh = o.CookieExpire
238 assert.NotEqual(t, nil, o.Validate())
240 o.CookieRefresh -= time.Duration(1)
241 assert.Equal(t, nil, o.Validate())
244func TestBase64CookieSecret(t *testing.T) {
245 o := testOptions()
246 assert.Equal(t, nil, o.Validate())
248 // 32 byte, base64 (urlsafe) encoded key
249 o.CookieSecret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="
250 assert.Equal(t, nil, o.Validate())
252 // 32 byte, base64 (urlsafe) encoded key, w/o padding
253 o.CookieSecret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"
254 assert.Equal(t, nil, o.Validate())
256 // 24 byte, base64 (urlsafe) encoded key
257 o.CookieSecret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"
258 assert.Equal(t, nil, o.Validate())
260 // 16 byte, base64 (urlsafe) encoded key
261 o.CookieSecret = "LFEqZYvYUwKwzn0tEuTpLA=="
262 assert.Equal(t, nil, o.Validate())
264 // 16 byte, base64 (urlsafe) encoded key, w/o padding
265 o.CookieSecret = "LFEqZYvYUwKwzn0tEuTpLA"
266 assert.Equal(t, nil, o.Validate())
269func TestValidateSignatureKey(t *testing.T) {
270 o := testOptions()
271 o.SignatureKey = "sha1:secret"
272 assert.Equal(t, nil, o.Validate())
273 assert.Equal(t, o.signatureData.hash, crypto.SHA1)
274 assert.Equal(t, o.signatureData.key, "secret")
277func TestValidateSignatureKeyInvalidSpec(t *testing.T) {
278 o := testOptions()
279 o.SignatureKey = "invalid spec"
280 err := o.Validate()
281 assert.Equal(t, err.Error(), "Invalid configuration:\n"+
282 " invalid signature hash:key spec: "+o.SignatureKey)
285func TestValidateSignatureKeyUnsupportedAlgorithm(t *testing.T) {
286 o := testOptions()
287 o.SignatureKey = "unsupported:default secret"
288 err := o.Validate()
289 assert.Equal(t, err.Error(), "Invalid configuration:\n"+
290 " unsupported signature hash algorithm: "+o.SignatureKey)
293func TestValidateCookie(t *testing.T) {
294 o := testOptions()
295 o.CookieName = "_valid_cookie_name"
296 assert.Equal(t, nil, o.Validate())
299func TestValidateCookieBadName(t *testing.T) {
300 o := testOptions()
301 o.CookieName = "_bad_cookie_name{}"
302 err := o.Validate()
303 assert.Equal(t, err.Error(), "Invalid configuration:\n"+
304 fmt.Sprintf(" invalid cookie name: %q", o.CookieName))
307func TestSkipOIDCDiscovery(t *testing.T) {
308 o := testOptions()
309 o.Provider = "oidc"
310 o.OIDCIssuerURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/v2.0/"
311 o.SkipOIDCDiscovery = true
313 err := o.Validate()
314 assert.Equal(t, "Invalid configuration:\n"+
315 fmt.Sprintf(" missing setting: login-url\n missing setting: redeem-url\n missing setting: oidc-jwks-url"), err.Error())
317 o.LoginURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_sign_in"
318 o.RedeemURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_sign_in"
319 o.OIDCJwksURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/discovery/v2.0/keys"
321 assert.Equal(t, nil, o.Validate())
324func TestGCPHealthcheck(t *testing.T) {
325 o := testOptions()
326 o.GCPHealthChecks = true
327 assert.Equal(t, nil, o.Validate())