@@ -379,13 +379,6 @@ func (tp *TestProvider) ValidateSessionState(session *sessions.SessionState) boo
379379 return tp.ValidToken
380380}
381381
382−func (tp *TestProvider) ValidateGroup(email string) bool {
383− if tp.GroupValidator != nil {
384− return tp.GroupValidator(email)
385− }
386− return true
387−}
388−
389382func TestBasicAuthPassword(t *testing.T) {
390383 providerServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
391384 logger.Printf("%#v", r)
@@ -1052,25 +1045,6 @@ func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
10521045 assert.Equal(t, "unauthorized request\n", string(bodyBytes))
10531046}
10541047
1055−func TestAuthOnlyEndpointUnauthorizedOnProviderGroupValidationFailure(t *testing.T) {
1056− test := NewAuthOnlyEndpointTest()
1057− startSession := &sessions.SessionState{
1058− Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: time.Now()}
1059− test.SaveSession(startSession)
1060− provider := &TestProvider{
1061− ValidToken: true,
1062− GroupValidator: func(s string) bool {
1063− return false
1064− },
1065− }
1066−
1067− test.proxy.provider = provider
1068− test.proxy.ServeHTTP(test.rw, test.req)
1069− assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
1070− bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
1071− assert.Equal(t, "unauthorized request\n", string(bodyBytes))
1072−}
1073−
10741048func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
10751049 var pcTest ProcessCookieTest
10761050
@@ -1489,41 +1463,6 @@ func TestGetJwtSession(t *testing.T) {
14891463 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-Email"), "john@example.com")
14901464}
14911465
1492−func TestJwtUnauthorizedOnGroupValidationFailure(t *testing.T) {
1493− goodJwt := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9." +
1494− "eyJzdWIiOiIxMjM0NTY3ODkwIiwiYXVkIjoiaHR0cHM6Ly90ZXN0Lm15YXBwLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImVtY" +
1495− "WlsIjoiam9obkBleGFtcGxlLmNvbSIsImlzcyI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNTUzNjkxMj" +
1496− "E1LCJleHAiOjE5MTIxNTE4MjF9." +
1497− "rLVyzOnEldUq_pNkfa-WiV8TVJYWyZCaM2Am_uo8FGg11zD7l-qmz3x1seTvqpH6Y0Ty00fmv6dJnGnC8WMnPXQiodRTfhBSe" +
1498− "OKZMu0HkMD2sg52zlKkbfLTO6ic5VnbVgwjjrB8am_Ta6w7kyFUaB5C1BsIrrLMldkWEhynbb8"
1499−
1500− keyset := NoOpKeySet{}
1501− verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
1502− &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
1503−
1504− test := NewAuthOnlyEndpointTest(func(opts *Options) {
1505− opts.PassAuthorization = true
1506− opts.SetAuthorization = true
1507− opts.SetXAuthRequest = true
1508− opts.SkipJwtBearerTokens = true
1509− opts.jwtBearerVerifiers = append(opts.jwtBearerVerifiers, verifier)
1510− })
1511− tp, _ := test.proxy.provider.(*TestProvider)
1512− // Verify ValidateGroup fails JWT authorization
1513− tp.GroupValidator = func(s string) bool {
1514− return false
1515− }
1516−
1517− authHeader := fmt.Sprintf("Bearer %s", goodJwt)
1518− test.req.Header = map[string][]string{
1519− "Authorization": {authHeader},
1520− }
1521− test.proxy.ServeHTTP(test.rw, test.req)
1522− if test.rw.Code != http.StatusUnauthorized {
1523− t.Fatalf("expected 401 got %d", test.rw.Code)
1524− }
1525−}
1526−
15271466func TestFindJwtBearerToken(t *testing.T) {
15281467 p := OAuthProxy{CookieName: "oauth2", CookieDomain: "abc"}
15291468 getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: "example.com"}}