@@ -1,6 +1,7 @@
11package main
22
33import (
4+ "encoding/base64"
45 "github.com/bitly/oauth2_proxy/providers"
56 "github.com/bmizerany/assert"
67 "io/ioutil"
@@ -88,6 +89,101 @@ func TestRobotsTxt(t *testing.T) {
8889 assert.Equal(t, "User-agent: *\nDisallow: /", rw.Body.String())
8990}
9091
92+func TestBasicAuthPassword(t *testing.T) {
93+ provider_server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
94+ log.Printf("%#v", r)
95+ url := r.URL
96+ payload := ""
97+ switch url.Path {
98+ case "/oauth/token":
99+ payload = `{"access_token": "my_auth_token"}`
100+ default:
101+ payload = r.Header.Get("Authorization")
102+ if payload == "" {
103+ payload = "No Authorization header found."
104+ }
105+ }
106+ w.WriteHeader(200)
107+ w.Write([]byte(payload))
108+ }))
109+ opts := NewOptions()
110+ opts.Upstreams = append(opts.Upstreams, provider_server.URL)
111+ // The CookieSecret must be 32 bytes in order to create the AES
112+ // cipher.
113+ opts.CookieSecret = "xyzzyplughxyzzyplughxyzzyplughxp"
114+ opts.ClientID = "bazquux"
115+ opts.ClientSecret = "foobar"
116+ opts.CookieSecure = false
117+ opts.PassBasicAuth = true
118+ opts.BasicAuthPassword = "This is a secure password"
119+ opts.Validate()
120+
121+ provider_url, _ := url.Parse(provider_server.URL)
122+ const email_address = "michael.bland@gsa.gov"
123+ const user_name = "michael.bland"
124+
125+ opts.provider = &TestProvider{
126+ ProviderData: &providers.ProviderData{
127+ ProviderName: "Test Provider",
128+ LoginUrl: &url.URL{
129+ Scheme: "http",
130+ Host: provider_url.Host,
131+ Path: "/oauth/authorize",
132+ },
133+ RedeemUrl: &url.URL{
134+ Scheme: "http",
135+ Host: provider_url.Host,
136+ Path: "/oauth/token",
137+ },
138+ ProfileUrl: &url.URL{
139+ Scheme: "http",
140+ Host: provider_url.Host,
141+ Path: "/api/v1/profile",
142+ },
143+ Scope: "profile.email",
144+ },
145+ EmailAddress: email_address,
146+ }
147+
148+ proxy := NewOauthProxy(opts, func(email string) bool {
149+ return email == email_address
150+ })
151+
152+ rw := httptest.NewRecorder()
153+ req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code",
154+ strings.NewReader(""))
155+ proxy.ServeHTTP(rw, req)
156+ cookie := rw.HeaderMap["Set-Cookie"][0]
157+
158+ cookieName := proxy.CookieName
159+ var value string
160+ key_prefix := cookieName + "="
161+
162+ for _, field := range strings.Split(cookie, "; ") {
163+ value = strings.TrimPrefix(field, key_prefix)
164+ if value != field {
165+ break
166+ } else {
167+ value = ""
168+ }
169+ }
170+
171+ req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
172+ req.AddCookie(&http.Cookie{
173+ Name: cookieName,
174+ Value: value,
175+ Path: "/",
176+ Expires: time.Now().Add(time.Duration(24)),
177+ HttpOnly: true,
178+ })
179+
180+ rw = httptest.NewRecorder()
181+ proxy.ServeHTTP(rw, req)
182+ expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(user_name+":"+opts.BasicAuthPassword))
183+ assert.Equal(t, expectedHeader, rw.Body.String())
184+ provider_server.Close()
185+}
186+
91187type TestProvider struct {
92188 *providers.ProviderData
93189 EmailAddress string