@@ -1,9 +1,11 @@
11package main
22
33import (
4+ "context"
45 "crypto"
56 "encoding/base64"
67 "fmt"
8+ "github.com/coreos/go-oidc"
79 "io"
810 "io/ioutil"
911 "net"
@@ -1134,6 +1136,53 @@ func TestClearSingleCookie(t *testing.T) {
11341136 assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")
11351137}
11361138
1139+type NoOpKeySet struct {
1140+}
1141+
1142+func (NoOpKeySet) VerifySignature(ctx context.Context, jwt string) (payload []byte, err error) {
1143+ splitStrings := strings.Split(jwt, ".")
1144+ payloadString := splitStrings[1]
1145+ jsonString, err := base64.RawURLEncoding.DecodeString(payloadString)
1146+ return []byte(jsonString), err
1147+}
1148+
1149+func TestGetJwtSession(t *testing.T) {
1150+ /* token payload:
1151+ {
1152+ "sub": "1234567890",
1153+ "aud": "https://test.myapp.com",
1154+ "name": "John Doe",
1155+ "email": "john@example.com",
1156+ "iss": "https://issuer.example.com",
1157+ "iat": 1553691215,
1158+ "exp": 1912151821
1159+ }
1160+ */
1161+ goodJwt := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9." +
1162+ "eyJzdWIiOiIxMjM0NTY3ODkwIiwiYXVkIjoiaHR0cHM6Ly90ZXN0Lm15YXBwLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImVtY" +
1163+ "WlsIjoiam9obkBleGFtcGxlLmNvbSIsImlzcyI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNTUzNjkxMj" +
1164+ "E1LCJleHAiOjE5MTIxNTE4MjF9." +
1165+ "rLVyzOnEldUq_pNkfa-WiV8TVJYWyZCaM2Am_uo8FGg11zD7l-qmz3x1seTvqpH6Y0Ty00fmv6dJnGnC8WMnPXQiodRTfhBSe" +
1166+ "OKZMu0HkMD2sg52zlKkbfLTO6ic5VnbVgwjjrB8am_Ta6w7kyFUaB5C1BsIrrLMldkWEhynbb8"
1167+
1168+ keyset := NoOpKeySet{}
1169+ verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
1170+ &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
1171+ p := OAuthProxy{}
1172+ p.jwtBearerVerifiers = append(p.jwtBearerVerifiers, verifier)
1173+ getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: "example.com"}}
1174+
1175+ // Bearer
1176+ getReq.Header = map[string][]string{
1177+ "Authorization": {fmt.Sprintf("Bearer %s", goodJwt)},
1178+ }
1179+ session, _ := p.GetJwtSession(getReq)
1180+ assert.Equal(t, session.User, "john")
1181+ assert.Equal(t, session.Email, "john@example.com")
1182+ assert.Equal(t, session.ExpiresOn, time.Unix(1912151821, 0))
1183+ assert.Equal(t, session.IDToken, goodJwt)
1184+}
1185+
11371186func TestFindJwtBearerToken(t *testing.T) {
11381187 p := OAuthProxy{CookieName: "oauth2", CookieDomain: "abc"}
11391188 getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: "example.com"}}