@@ -13,6 +13,11 @@ const (
1313 clientID = "bazquux"
1414 clientSecret = "xyzzyplugh"
1515 providerID = "providerID"
16+
17+ msIssuerURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/v2.0/"
18+ msKeysURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/discovery/v2.0/keys"
19+ msAuthURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_sign_in"
20+ msTokenURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_sign_in"
1621)
1722
1823func TestClientSecretFileOptionFails(t *testing.T) {
@@ -76,7 +81,7 @@ func TestSkipOIDCDiscovery(t *testing.T) {
7681 ClientID: clientID,
7782 ClientSecretFile: clientSecret,
7883 OIDCConfig: options.OIDCOptions{
79− IssuerURL: "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/v2.0/",
84+ IssuerURL: msIssuerURL,
8085 SkipDiscovery: true,
8186 },
8287 }
@@ -84,10 +89,85 @@ func TestSkipOIDCDiscovery(t *testing.T) {
8489 _, err := newProviderDataFromConfig(providerConfig)
8590 g.Expect(err).To(MatchError("error setting OIDC configuration: [missing required setting: login-url, missing required setting: redeem-url, missing required setting: oidc-jwks-url]"))
8691
87− providerConfig.LoginURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_sign_in"
88− providerConfig.RedeemURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/token?p=b2c_1_sign_in"
89− providerConfig.OIDCConfig.JwksURL = "https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/discovery/v2.0/keys"
92+ providerConfig.LoginURL = msAuthURL
93+ providerConfig.RedeemURL = msTokenURL
94+ providerConfig.OIDCConfig.JwksURL = msKeysURL
9095
9196 _, err = newProviderDataFromConfig(providerConfig)
9297 g.Expect(err).ToNot(HaveOccurred())
9398}
99+
100+func TestURLsCorrectlyParsed(t *testing.T) {
101+ g := NewWithT(t)
102+
103+ providerConfig := options.Provider{
104+ ID: providerID,
105+ Type: "oidc",
106+ ClientID: clientID,
107+ ClientSecretFile: clientSecret,
108+ LoginURL: msAuthURL,
109+ RedeemURL: msTokenURL,
110+ OIDCConfig: options.OIDCOptions{
111+ IssuerURL: msIssuerURL,
112+ SkipDiscovery: true,
113+ JwksURL: msKeysURL,
114+ },
115+ }
116+
117+ pd, err := newProviderDataFromConfig(providerConfig)
118+ g.Expect(err).ToNot(HaveOccurred())
119+
120+ g.Expect(pd.LoginURL.String()).To(Equal(msAuthURL))
121+ g.Expect(pd.RedeemURL.String()).To(Equal(msTokenURL))
122+}
123+
124+func TestScope(t *testing.T) {
125+ g := NewWithT(t)
126+
127+ testCases := []struct {
128+ name string
129+ configuredScope string
130+ expectedScope string
131+ allowedGroups []string
132+ }{
133+ {
134+ name: "with no scope provided",
135+ configuredScope: "",
136+ expectedScope: "openid email profile",
137+ },
138+ {
139+ name: "with no scope provided and groups",
140+ configuredScope: "",
141+ expectedScope: "openid email profile groups",
142+ allowedGroups: []string{"foo"},
143+ },
144+ {
145+ name: "with a configured scope provided",
146+ configuredScope: "openid",
147+ expectedScope: "openid",
148+ },
149+ }
150+
151+ for _, tc := range testCases {
152+ providerConfig := options.Provider{
153+ ID: providerID,
154+ Type: "oidc",
155+ ClientID: clientID,
156+ ClientSecretFile: clientSecret,
157+ LoginURL: msAuthURL,
158+ RedeemURL: msTokenURL,
159+ Scope: tc.configuredScope,
160+ AllowedGroups: tc.allowedGroups,
161+ OIDCConfig: options.OIDCOptions{
162+ IssuerURL: msIssuerURL,
163+ SkipDiscovery: true,
164+ JwksURL: msKeysURL,
165+ },
166+ }
167+
168+ pd, err := newProviderDataFromConfig(providerConfig)
169+ g.Expect(err).ToNot(HaveOccurred())
170+
171+ g.Expect(pd.Scope).To(Equal(tc.expectedScope))
172+ }
173+}