git.iko.soy/typeable/oauth2-proxy
on master help sign in
Move all Keycloak unit tests to Ginkgo
0886f80Nick Meves
providers/keycloak_test.go+114−130
compare with master
unifiedsplit
@@ -7,20 +7,18 @@ import (
7 "net/http"
7 "net/http"
8 "net/http/httptest"
8 "net/http/httptest"
9 "net/url"
9 "net/url"
10− "testing"
11
10
12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
13 . "github.com/onsi/ginkgo"
12 . "github.com/onsi/ginkgo"
14 . "github.com/onsi/ginkgo/extensions/table"
13 . "github.com/onsi/ginkgo/extensions/table"
15 . "github.com/onsi/gomega"
14 . "github.com/onsi/gomega"
16− "github.com/stretchr/testify/assert"
17)
15)
18
16
19const (
17const (
20 keycloakAccessToken = "eyJKeycloak.eyJAccess.Token"
18 keycloakAccessToken = "eyJKeycloak.eyJAccess.Token"
21 keycloakUserinfoPath = "/api/v3/user"
19 keycloakUserinfoPath = "/api/v3/user"
22
20
23− // Userinfo Test Cases
21+ // Userinfo Test Cases querystring toggles
24 tcUIStandard = "userinfo-standard"
22 tcUIStandard = "userinfo-standard"
25 tcUIFail = "userinfo-fail"
23 tcUIFail = "userinfo-fail"
26 tcUISingleGroup = "userinfo-single-group"
24 tcUISingleGroup = "userinfo-single-group"
@@ -111,139 +109,125 @@ func testKeycloakBackend() *httptest.Server {
111}
109}
112
110
113var _ = Describe("Keycloak Provider Tests", func() {
111var _ = Describe("Keycloak Provider Tests", func() {
114− var p *KeycloakProvider
112+ Context("New Provider Init", func() {
115− var b *httptest.Server
113+ It("uses defaults", func() {
116−
114+ providerData := NewKeycloakProvider(&ProviderData{}).Data()
117− BeforeEach(func() {
115+ Expect(providerData.ProviderName).To(Equal("Keycloak"))
118− b = testKeycloakBackend()
116+ Expect(providerData.LoginURL.String()).To(Equal("https://keycloak.org/oauth/authorize"))
119−
117+ Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak.org/oauth/token"))
120− var err error
118+ Expect(providerData.ProfileURL.String()).To(Equal(""))
121− p, err = testKeycloakProvider(b)
119+ Expect(providerData.ValidateURL.String()).To(Equal("https://keycloak.org/api/v3/user"))
122− Expect(err).To(BeNil())
120+ Expect(providerData.Scope).To(Equal("api"))
121+ })
122+
123+ It("overrides defaults", func() {
124+ p := NewKeycloakProvider(
125+ &ProviderData{
126+ LoginURL: &url.URL{
127+ Scheme: "https",
128+ Host: "example.com",
129+ Path: "/oauth/auth"},
130+ RedeemURL: &url.URL{
131+ Scheme: "https",
132+ Host: "example.com",
133+ Path: "/oauth/token"},
134+ ValidateURL: &url.URL{
135+ Scheme: "https",
136+ Host: "example.com",
137+ Path: "/api/v3/user"},
138+ Scope: "profile"})
139+ providerData := p.Data()
140+
141+ Expect(providerData.ProviderName).To(Equal("Keycloak"))
142+ Expect(providerData.LoginURL.String()).To(Equal("https://example.com/oauth/auth"))
143+ Expect(providerData.RedeemURL.String()).To(Equal("https://example.com/oauth/token"))
144+ Expect(providerData.ProfileURL.String()).To(Equal(""))
145+ Expect(providerData.ValidateURL.String()).To(Equal("https://example.com/api/v3/user"))
146+ Expect(providerData.Scope).To(Equal("profile"))
147+ })
123 })
148 })
124
149
125− AfterEach(func() {
150+ Context("With a test HTTP Server & Provider", func() {
126− b.Close()
151+ var p *KeycloakProvider
127− })
152+ var b *httptest.Server
128−
129− Context("EnrichSession", func() {
130− type enrichSessionTableInput struct {
131− testcase string
132− expectedError error
133− expectedEmail string
134− expectedGroups []string
135− }
136
153
137− DescribeTable("should return expected results",
154+ BeforeEach(func() {
138− func(in enrichSessionTableInput) {
155+ b = testKeycloakBackend()
139− var err error
140− p.ValidateURL, err = url.Parse(
141− fmt.Sprintf("%s%s?testcase=%s", b.URL, keycloakUserinfoPath, in.testcase),
142− )
143− Expect(err).To(BeNil())
144
156
145− session := &sessions.SessionState{AccessToken: keycloakAccessToken}
157+ var err error
158+ p, err = testKeycloakProvider(b)
159+ Expect(err).To(BeNil())
160+ })
161+
162+ AfterEach(func() {
163+ b.Close()
164+ })
165+
146− err = p.EnrichSession(context.Background(), session)
166+ Context("EnrichSession", func() {
167+ type enrichSessionTableInput struct {
168+ testcase string
169+ expectedError error
170+ expectedEmail string
171+ expectedGroups []string
172+ }
147
173
148− if in.expectedError != nil {
174+ DescribeTable("should return expected results",
149− Expect(err).To(Equal(in.expectedError))
175+ func(in enrichSessionTableInput) {
150− } else {
176+ var err error
177+ p.ValidateURL, err = url.Parse(
178+ fmt.Sprintf("%s%s?testcase=%s", b.URL, keycloakUserinfoPath, in.testcase),
179+ )
151 Expect(err).To(BeNil())
180 Expect(err).To(BeNil())
152− }
153−
154− Expect(session.Email).To(Equal(in.expectedEmail))
155−
156− if in.expectedGroups != nil {
157− Expect(session.Groups).To(Equal(in.expectedGroups))
158− } else {
159− Expect(session.Groups).To(BeNil())
160− }
161− },
162− Entry("email and multiple groups", enrichSessionTableInput{
163− testcase: tcUIStandard,
164− expectedError: nil,
165− expectedEmail: "michael.bland@gsa.gov",
166− expectedGroups: []string{"test-grp1", "test-grp2"},
167− }),
168− Entry("email and single group", enrichSessionTableInput{
169− testcase: tcUISingleGroup,
170− expectedError: nil,
171− expectedEmail: "michael.bland@gsa.gov",
172− expectedGroups: []string{"test-grp1"},
173− }),
174− Entry("email and no groups", enrichSessionTableInput{
175− testcase: tcUIMissingGroups,
176− expectedError: nil,
177− expectedEmail: "michael.bland@gsa.gov",
178− expectedGroups: nil,
179− }),
180− Entry("missing email", enrichSessionTableInput{
181− testcase: tcUIMissingEmail,
182− expectedError: errors.New(
183− "unable to extract email from userinfo endpoint: type assertion to string failed"),
184− expectedEmail: "",
185− expectedGroups: []string{"test-grp1", "test-grp2"},
186− }),
187− Entry("request failure", enrichSessionTableInput{
188− testcase: tcUIFail,
189− expectedError: errors.New(`unexpected status "500": `),
190− expectedEmail: "",
191− expectedGroups: nil,
192− }),
193− )
194− })
195−})
196
181
197−func TestKeycloakProviderDefaults(t *testing.T) {
182+ session := &sessions.SessionState{AccessToken: keycloakAccessToken}
198− p, err := testKeycloakProvider(nil)
183+ err = p.EnrichSession(context.Background(), session)
199− assert.NoError(t, err)
200− assert.NotEqual(t, nil, p)
201− assert.Equal(t, "Keycloak", p.Data().ProviderName)
202− assert.Equal(t, "https://keycloak.org/oauth/authorize",
203− p.Data().LoginURL.String())
204− assert.Equal(t, "https://keycloak.org/oauth/token",
205− p.Data().RedeemURL.String())
206− assert.Equal(t, "https://keycloak.org/api/v3/user",
207− p.Data().ValidateURL.String())
208− assert.Equal(t, "api", p.Data().Scope)
209−}
210
184
211−func TestNewKeycloakProvider(t *testing.T) {
185+ if in.expectedError != nil {
212− g := NewWithT(t)
186+ Expect(err).To(Equal(in.expectedError))
213−
187+ } else {
214− // Test that defaults are set when calling for a new provider with nothing set
188+ Expect(err).To(BeNil())
215− providerData := NewKeycloakProvider(&ProviderData{}).Data()
216− g.Expect(providerData.ProviderName).To(Equal("Keycloak"))
217− g.Expect(providerData.LoginURL.String()).To(Equal("https://keycloak.org/oauth/authorize"))
218− g.Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak.org/oauth/token"))
219− g.Expect(providerData.ProfileURL.String()).To(Equal(""))
220− g.Expect(providerData.ValidateURL.String()).To(Equal("https://keycloak.org/api/v3/user"))
221− g.Expect(providerData.Scope).To(Equal("api"))
222−}
189+ }
223
190
224−func TestKeycloakProviderOverrides(t *testing.T) {
191+ Expect(session.Email).To(Equal(in.expectedEmail))
225− p := NewKeycloakProvider(
192+
226− &ProviderData{
193+ if in.expectedGroups != nil {
227− LoginURL: &url.URL{
194+ Expect(session.Groups).To(Equal(in.expectedGroups))
228− Scheme: "https",
195+ } else {
229− Host: "example.com",
196+ Expect(session.Groups).To(BeNil())
230− Path: "/oauth/auth"},
197+ }
231− RedeemURL: &url.URL{
198+ },
232− Scheme: "https",
199+ Entry("email and multiple groups", enrichSessionTableInput{
233− Host: "example.com",
200+ testcase: tcUIStandard,
234− Path: "/oauth/token"},
201+ expectedError: nil,
235− ValidateURL: &url.URL{
202+ expectedEmail: "michael.bland@gsa.gov",
236− Scheme: "https",
203+ expectedGroups: []string{"test-grp1", "test-grp2"},
237− Host: "example.com",
204+ }),
238− Path: "/api/v3/user"},
205+ Entry("email and single group", enrichSessionTableInput{
239− Scope: "profile"})
206+ testcase: tcUISingleGroup,
240− assert.NotEqual(t, nil, p)
207+ expectedError: nil,
241− assert.Equal(t, "Keycloak", p.Data().ProviderName)
208+ expectedEmail: "michael.bland@gsa.gov",
242− assert.Equal(t, "https://example.com/oauth/auth",
209+ expectedGroups: []string{"test-grp1"},
243− p.Data().LoginURL.String())
210+ }),
244− assert.Equal(t, "https://example.com/oauth/token",
211+ Entry("email and no groups", enrichSessionTableInput{
245− p.Data().RedeemURL.String())
212+ testcase: tcUIMissingGroups,
246− assert.Equal(t, "https://example.com/api/v3/user",
213+ expectedError: nil,
247− p.Data().ValidateURL.String())
214+ expectedEmail: "michael.bland@gsa.gov",
248− assert.Equal(t, "profile", p.Data().Scope)
215+ expectedGroups: nil,
216+ }),
217+ Entry("missing email", enrichSessionTableInput{
218+ testcase: tcUIMissingEmail,
219+ expectedError: errors.New(
220+ "unable to extract email from userinfo endpoint: type assertion to string failed"),
221+ expectedEmail: "",
222+ expectedGroups: []string{"test-grp1", "test-grp2"},
223+ }),
224+ Entry("request failure", enrichSessionTableInput{
225+ testcase: tcUIFail,
226+ expectedError: errors.New(`unexpected status "500": `),
227+ expectedEmail: "",
228+ expectedGroups: nil,
229+ }),
230+ )
231+ })
232+ })
249−}
233+})