@@ -7,20 +7,18 @@ import (
77 "net/http"
88 "net/http/httptest"
99 "net/url"
10− "testing"
1110
1211 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1312 . "github.com/onsi/ginkgo"
1413 . "github.com/onsi/ginkgo/extensions/table"
1514 . "github.com/onsi/gomega"
16− "github.com/stretchr/testify/assert"
1715)
1816
1917const (
2018 keycloakAccessToken = "eyJKeycloak.eyJAccess.Token"
2119 keycloakUserinfoPath = "/api/v3/user"
2220
23− // Userinfo Test Cases
21+ // Userinfo Test Cases querystring toggles
2422 tcUIStandard = "userinfo-standard"
2523 tcUIFail = "userinfo-fail"
2624 tcUISingleGroup = "userinfo-single-group"
@@ -111,139 +109,125 @@ func testKeycloakBackend() *httptest.Server {
111109}
112110
113111var _ = Describe("Keycloak Provider Tests", func() {
114− var p *KeycloakProvider
115− var b *httptest.Server
116−
117− BeforeEach(func() {
118− b = testKeycloakBackend()
119−
120− var err error
121− p, err = testKeycloakProvider(b)
122− Expect(err).To(BeNil())
112+ Context("New Provider Init", func() {
113+ It("uses defaults", func() {
114+ providerData := NewKeycloakProvider(&ProviderData{}).Data()
115+ Expect(providerData.ProviderName).To(Equal("Keycloak"))
116+ Expect(providerData.LoginURL.String()).To(Equal("https://keycloak.org/oauth/authorize"))
117+ Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak.org/oauth/token"))
118+ Expect(providerData.ProfileURL.String()).To(Equal(""))
119+ Expect(providerData.ValidateURL.String()).To(Equal("https://keycloak.org/api/v3/user"))
120+ Expect(providerData.Scope).To(Equal("api"))
121+ })
122+
123+ It("overrides defaults", func() {
124+ p := NewKeycloakProvider(
125+ &ProviderData{
126+ LoginURL: &url.URL{
127+ Scheme: "https",
128+ Host: "example.com",
129+ Path: "/oauth/auth"},
130+ RedeemURL: &url.URL{
131+ Scheme: "https",
132+ Host: "example.com",
133+ Path: "/oauth/token"},
134+ ValidateURL: &url.URL{
135+ Scheme: "https",
136+ Host: "example.com",
137+ Path: "/api/v3/user"},
138+ Scope: "profile"})
139+ providerData := p.Data()
140+
141+ Expect(providerData.ProviderName).To(Equal("Keycloak"))
142+ Expect(providerData.LoginURL.String()).To(Equal("https://example.com/oauth/auth"))
143+ Expect(providerData.RedeemURL.String()).To(Equal("https://example.com/oauth/token"))
144+ Expect(providerData.ProfileURL.String()).To(Equal(""))
145+ Expect(providerData.ValidateURL.String()).To(Equal("https://example.com/api/v3/user"))
146+ Expect(providerData.Scope).To(Equal("profile"))
147+ })
123148 })
124149
125− AfterEach(func() {
126− b.Close()
127− })
128−
129− Context("EnrichSession", func() {
130− type enrichSessionTableInput struct {
131− testcase string
132− expectedError error
133− expectedEmail string
134− expectedGroups []string
135− }
150+ Context("With a test HTTP Server & Provider", func() {
151+ var p *KeycloakProvider
152+ var b *httptest.Server
136153
137− DescribeTable("should return expected results",
138− func(in enrichSessionTableInput) {
139− var err error
140− p.ValidateURL, err = url.Parse(
141− fmt.Sprintf("%s%s?testcase=%s", b.URL, keycloakUserinfoPath, in.testcase),
142− )
143− Expect(err).To(BeNil())
154+ BeforeEach(func() {
155+ b = testKeycloakBackend()
144156
145− session := &sessions.SessionState{AccessToken: keycloakAccessToken}
146− err = p.EnrichSession(context.Background(), session)
157+ var err error
158+ p, err = testKeycloakProvider(b)
159+ Expect(err).To(BeNil())
160+ })
161+
162+ AfterEach(func() {
163+ b.Close()
164+ })
165+
166+ Context("EnrichSession", func() {
167+ type enrichSessionTableInput struct {
168+ testcase string
169+ expectedError error
170+ expectedEmail string
171+ expectedGroups []string
172+ }
147173
148− if in.expectedError != nil {
149− Expect(err).To(Equal(in.expectedError))
150− } else {
174+ DescribeTable("should return expected results",
175+ func(in enrichSessionTableInput) {
176+ var err error
177+ p.ValidateURL, err = url.Parse(
178+ fmt.Sprintf("%s%s?testcase=%s", b.URL, keycloakUserinfoPath, in.testcase),
179+ )
151180 Expect(err).To(BeNil())
152− }
153−
154− Expect(session.Email).To(Equal(in.expectedEmail))
155−
156− if in.expectedGroups != nil {
157− Expect(session.Groups).To(Equal(in.expectedGroups))
158− } else {
159− Expect(session.Groups).To(BeNil())
160− }
161− },
162− Entry("email and multiple groups", enrichSessionTableInput{
163− testcase: tcUIStandard,
164− expectedError: nil,
165− expectedEmail: "michael.bland@gsa.gov",
166− expectedGroups: []string{"test-grp1", "test-grp2"},
167− }),
168− Entry("email and single group", enrichSessionTableInput{
169− testcase: tcUISingleGroup,
170− expectedError: nil,
171− expectedEmail: "michael.bland@gsa.gov",
172− expectedGroups: []string{"test-grp1"},
173− }),
174− Entry("email and no groups", enrichSessionTableInput{
175− testcase: tcUIMissingGroups,
176− expectedError: nil,
177− expectedEmail: "michael.bland@gsa.gov",
178− expectedGroups: nil,
179− }),
180− Entry("missing email", enrichSessionTableInput{
181− testcase: tcUIMissingEmail,
182− expectedError: errors.New(
183− "unable to extract email from userinfo endpoint: type assertion to string failed"),
184− expectedEmail: "",
185− expectedGroups: []string{"test-grp1", "test-grp2"},
186− }),
187− Entry("request failure", enrichSessionTableInput{
188− testcase: tcUIFail,
189− expectedError: errors.New(`unexpected status "500": `),
190− expectedEmail: "",
191− expectedGroups: nil,
192− }),
193− )
194− })
195−})
196181
197−func TestKeycloakProviderDefaults(t *testing.T) {
198− p, err := testKeycloakProvider(nil)
199− assert.NoError(t, err)
200− assert.NotEqual(t, nil, p)
201− assert.Equal(t, "Keycloak", p.Data().ProviderName)
202− assert.Equal(t, "https://keycloak.org/oauth/authorize",
203− p.Data().LoginURL.String())
204− assert.Equal(t, "https://keycloak.org/oauth/token",
205− p.Data().RedeemURL.String())
206− assert.Equal(t, "https://keycloak.org/api/v3/user",
207− p.Data().ValidateURL.String())
208− assert.Equal(t, "api", p.Data().Scope)
209−}
182+ session := &sessions.SessionState{AccessToken: keycloakAccessToken}
183+ err = p.EnrichSession(context.Background(), session)
210184
211−func TestNewKeycloakProvider(t *testing.T) {
212− g := NewWithT(t)
213−
214− // Test that defaults are set when calling for a new provider with nothing set
215− providerData := NewKeycloakProvider(&ProviderData{}).Data()
216− g.Expect(providerData.ProviderName).To(Equal("Keycloak"))
217− g.Expect(providerData.LoginURL.String()).To(Equal("https://keycloak.org/oauth/authorize"))
218− g.Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak.org/oauth/token"))
219− g.Expect(providerData.ProfileURL.String()).To(Equal(""))
220− g.Expect(providerData.ValidateURL.String()).To(Equal("https://keycloak.org/api/v3/user"))
221− g.Expect(providerData.Scope).To(Equal("api"))
222−}
185+ if in.expectedError != nil {
186+ Expect(err).To(Equal(in.expectedError))
187+ } else {
188+ Expect(err).To(BeNil())
189+ }
223190
224−func TestKeycloakProviderOverrides(t *testing.T) {
225− p := NewKeycloakProvider(
226− &ProviderData{
227− LoginURL: &url.URL{
228− Scheme: "https",
229− Host: "example.com",
230− Path: "/oauth/auth"},
231− RedeemURL: &url.URL{
232− Scheme: "https",
233− Host: "example.com",
234− Path: "/oauth/token"},
235− ValidateURL: &url.URL{
236− Scheme: "https",
237− Host: "example.com",
238− Path: "/api/v3/user"},
239− Scope: "profile"})
240− assert.NotEqual(t, nil, p)
241− assert.Equal(t, "Keycloak", p.Data().ProviderName)
242− assert.Equal(t, "https://example.com/oauth/auth",
243− p.Data().LoginURL.String())
244− assert.Equal(t, "https://example.com/oauth/token",
245− p.Data().RedeemURL.String())
246− assert.Equal(t, "https://example.com/api/v3/user",
247− p.Data().ValidateURL.String())
248− assert.Equal(t, "profile", p.Data().Scope)
249−}
191+ Expect(session.Email).To(Equal(in.expectedEmail))
192+
193+ if in.expectedGroups != nil {
194+ Expect(session.Groups).To(Equal(in.expectedGroups))
195+ } else {
196+ Expect(session.Groups).To(BeNil())
197+ }
198+ },
199+ Entry("email and multiple groups", enrichSessionTableInput{
200+ testcase: tcUIStandard,
201+ expectedError: nil,
202+ expectedEmail: "michael.bland@gsa.gov",
203+ expectedGroups: []string{"test-grp1", "test-grp2"},
204+ }),
205+ Entry("email and single group", enrichSessionTableInput{
206+ testcase: tcUISingleGroup,
207+ expectedError: nil,
208+ expectedEmail: "michael.bland@gsa.gov",
209+ expectedGroups: []string{"test-grp1"},
210+ }),
211+ Entry("email and no groups", enrichSessionTableInput{
212+ testcase: tcUIMissingGroups,
213+ expectedError: nil,
214+ expectedEmail: "michael.bland@gsa.gov",
215+ expectedGroups: nil,
216+ }),
217+ Entry("missing email", enrichSessionTableInput{
218+ testcase: tcUIMissingEmail,
219+ expectedError: errors.New(
220+ "unable to extract email from userinfo endpoint: type assertion to string failed"),
221+ expectedEmail: "",
222+ expectedGroups: []string{"test-grp1", "test-grp2"},
223+ }),
224+ Entry("request failure", enrichSessionTableInput{
225+ testcase: tcUIFail,
226+ expectedError: errors.New(`unexpected status "500": `),
227+ expectedEmail: "",
228+ expectedGroups: nil,
229+ }),
230+ )
231+ })
232+ })
233+})