@@ -1,6 +1,7 @@
11package options
22
33import (
4+ "encoding/base64"
45 "time"
56
67 . "github.com/onsi/ginkgo"
@@ -259,4 +260,425 @@ var _ = Describe("Legacy Options", func() {
259260 }),
260261 )
261262 })
263+
264+ Context("Legacy Headers", func() {
265+ const basicAuthSecret = "super-secret-password"
266+
267+ type legacyHeadersTableInput struct {
268+ legacyHeaders *LegacyHeaders
269+ expectedRequestHeaders []Header
270+ expectedResponseHeaders []Header
271+ }
272+
273+ withPreserveRequestValue := func(h Header, preserve bool) Header {
274+ h.PreserveRequestValue = preserve
275+ return h
276+ }
277+
278+ xForwardedUser := Header{
279+ Name: "X-Forwarded-User",
280+ PreserveRequestValue: true,
281+ Values: []HeaderValue{
282+ {
283+ ClaimSource: &ClaimSource{
284+ Claim: "user",
285+ },
286+ },
287+ },
288+ }
289+
290+ xForwardedEmail := Header{
291+ Name: "X-Forwarded-Email",
292+ PreserveRequestValue: true,
293+ Values: []HeaderValue{
294+ {
295+ ClaimSource: &ClaimSource{
296+ Claim: "email",
297+ },
298+ },
299+ },
300+ }
301+
302+ xForwardedGroups := Header{
303+ Name: "X-Forwarded-Groups",
304+ PreserveRequestValue: true,
305+ Values: []HeaderValue{
306+ {
307+ ClaimSource: &ClaimSource{
308+ Claim: "groups",
309+ },
310+ },
311+ },
312+ }
313+
314+ xForwardedPreferredUsername := Header{
315+ Name: "X-Forwarded-Preferred-Username",
316+ PreserveRequestValue: true,
317+ Values: []HeaderValue{
318+ {
319+ ClaimSource: &ClaimSource{
320+ Claim: "preferred_username",
321+ },
322+ },
323+ },
324+ }
325+
326+ basicAuthHeader := Header{
327+ Name: "Authorization",
328+ PreserveRequestValue: true,
329+ Values: []HeaderValue{
330+ {
331+ ClaimSource: &ClaimSource{
332+ Claim: "user",
333+ BasicAuthPassword: &SecretSource{
334+ Value: []byte(base64.StdEncoding.EncodeToString([]byte(basicAuthSecret))),
335+ },
336+ },
337+ },
338+ },
339+ }
340+
341+ xForwardedUserWithEmail := Header{
342+ Name: "X-Forwarded-User",
343+ PreserveRequestValue: true,
344+ Values: []HeaderValue{
345+ {
346+ ClaimSource: &ClaimSource{
347+ Claim: "email",
348+ },
349+ },
350+ },
351+ }
352+
353+ basicAuthHeaderWithEmail := Header{
354+ Name: "Authorization",
355+ PreserveRequestValue: true,
356+ Values: []HeaderValue{
357+ {
358+ ClaimSource: &ClaimSource{
359+ Claim: "email",
360+ BasicAuthPassword: &SecretSource{
361+ Value: []byte(base64.StdEncoding.EncodeToString([]byte(basicAuthSecret))),
362+ },
363+ },
364+ },
365+ },
366+ }
367+
368+ xAuthRequestUser := Header{
369+ Name: "X-Auth-Request-User",
370+ PreserveRequestValue: false,
371+ Values: []HeaderValue{
372+ {
373+ ClaimSource: &ClaimSource{
374+ Claim: "user",
375+ },
376+ },
377+ },
378+ }
379+
380+ xAuthRequestEmail := Header{
381+ Name: "X-Auth-Request-Email",
382+ PreserveRequestValue: false,
383+ Values: []HeaderValue{
384+ {
385+ ClaimSource: &ClaimSource{
386+ Claim: "email",
387+ },
388+ },
389+ },
390+ }
391+
392+ xAuthRequestGroups := Header{
393+ Name: "X-Auth-Request-Groups",
394+ PreserveRequestValue: false,
395+ Values: []HeaderValue{
396+ {
397+ ClaimSource: &ClaimSource{
398+ Claim: "groups",
399+ },
400+ },
401+ },
402+ }
403+
404+ xForwardedAccessToken := Header{
405+ Name: "X-Forwarded-Access-Token",
406+ PreserveRequestValue: true,
407+ Values: []HeaderValue{
408+ {
409+ ClaimSource: &ClaimSource{
410+ Claim: "access_token",
411+ },
412+ },
413+ },
414+ }
415+
416+ xAuthRequestAccessToken := Header{
417+ Name: "X-Auth-Request-Access-Token",
418+ PreserveRequestValue: false,
419+ Values: []HeaderValue{
420+ {
421+ ClaimSource: &ClaimSource{
422+ Claim: "access_token",
423+ },
424+ },
425+ },
426+ }
427+
428+ authorizationHeader := Header{
429+ Name: "Authorization",
430+ PreserveRequestValue: true,
431+ Values: []HeaderValue{
432+ {
433+ ClaimSource: &ClaimSource{
434+ Claim: "id_token",
435+ Prefix: "Bearer ",
436+ },
437+ },
438+ },
439+ }
440+
441+ DescribeTable("should convert to injectRequestHeaders",
442+ func(in legacyHeadersTableInput) {
443+ requestHeaders, responseHeaders := in.legacyHeaders.convert()
444+ Expect(requestHeaders).To(ConsistOf(in.expectedRequestHeaders))
445+ Expect(responseHeaders).To(ConsistOf(in.expectedResponseHeaders))
446+ },
447+ Entry("with all header options off", legacyHeadersTableInput{
448+ legacyHeaders: &LegacyHeaders{
449+ PassBasicAuth: false,
450+ PassAccessToken: false,
451+ PassUserHeaders: false,
452+ PassAuthorization: false,
453+
454+ SetBasicAuth: false,
455+ SetXAuthRequest: false,
456+ SetAuthorization: false,
457+
458+ PreferEmailToUser: false,
459+ BasicAuthPassword: "",
460+ SkipAuthStripHeaders: false,
461+ },
462+ expectedRequestHeaders: []Header{},
463+ expectedResponseHeaders: []Header{},
464+ }),
465+ Entry("with basic auth enabled", legacyHeadersTableInput{
466+ legacyHeaders: &LegacyHeaders{
467+ PassBasicAuth: true,
468+ PassAccessToken: false,
469+ PassUserHeaders: false,
470+ PassAuthorization: false,
471+
472+ SetBasicAuth: true,
473+ SetXAuthRequest: false,
474+ SetAuthorization: false,
475+
476+ PreferEmailToUser: false,
477+ BasicAuthPassword: basicAuthSecret,
478+ SkipAuthStripHeaders: false,
479+ },
480+ expectedRequestHeaders: []Header{
481+ xForwardedUser,
482+ xForwardedEmail,
483+ xForwardedGroups,
484+ xForwardedPreferredUsername,
485+ basicAuthHeader,
486+ },
487+ expectedResponseHeaders: []Header{
488+ withPreserveRequestValue(basicAuthHeader, false),
489+ },
490+ }),
491+ Entry("with basic auth enabled and skipAuthStripHeaders", legacyHeadersTableInput{
492+ legacyHeaders: &LegacyHeaders{
493+ PassBasicAuth: true,
494+ PassAccessToken: false,
495+ PassUserHeaders: false,
496+ PassAuthorization: false,
497+
498+ SetBasicAuth: true,
499+ SetXAuthRequest: false,
500+ SetAuthorization: false,
501+
502+ PreferEmailToUser: false,
503+ BasicAuthPassword: basicAuthSecret,
504+ SkipAuthStripHeaders: true,
505+ },
506+ expectedRequestHeaders: []Header{
507+ withPreserveRequestValue(xForwardedUser, false),
508+ withPreserveRequestValue(xForwardedEmail, false),
509+ withPreserveRequestValue(xForwardedGroups, false),
510+ withPreserveRequestValue(xForwardedPreferredUsername, false),
511+ withPreserveRequestValue(basicAuthHeader, false),
512+ },
513+ expectedResponseHeaders: []Header{
514+ withPreserveRequestValue(basicAuthHeader, false),
515+ },
516+ }),
517+ Entry("with basic auth enabled and preferEmailToUser", legacyHeadersTableInput{
518+ legacyHeaders: &LegacyHeaders{
519+ PassBasicAuth: true,
520+ PassAccessToken: false,
521+ PassUserHeaders: false,
522+ PassAuthorization: false,
523+
524+ SetBasicAuth: true,
525+ SetXAuthRequest: false,
526+ SetAuthorization: false,
527+
528+ PreferEmailToUser: true,
529+ BasicAuthPassword: basicAuthSecret,
530+ SkipAuthStripHeaders: false,
531+ },
532+ expectedRequestHeaders: []Header{
533+ xForwardedUserWithEmail,
534+ xForwardedGroups,
535+ xForwardedPreferredUsername,
536+ basicAuthHeaderWithEmail,
537+ },
538+ expectedResponseHeaders: []Header{
539+ withPreserveRequestValue(basicAuthHeaderWithEmail, false),
540+ },
541+ }),
542+ Entry("with basic auth enabled and passUserHeaders", legacyHeadersTableInput{
543+ legacyHeaders: &LegacyHeaders{
544+ PassBasicAuth: true,
545+ PassAccessToken: false,
546+ PassUserHeaders: true,
547+ PassAuthorization: false,
548+
549+ SetBasicAuth: true,
550+ SetXAuthRequest: false,
551+ SetAuthorization: false,
552+
553+ PreferEmailToUser: false,
554+ BasicAuthPassword: basicAuthSecret,
555+ SkipAuthStripHeaders: false,
556+ },
557+ expectedRequestHeaders: []Header{
558+ xForwardedUser,
559+ xForwardedEmail,
560+ xForwardedGroups,
561+ xForwardedPreferredUsername,
562+ basicAuthHeader,
563+ },
564+ expectedResponseHeaders: []Header{
565+ withPreserveRequestValue(basicAuthHeader, false),
566+ },
567+ }),
568+ Entry("with passUserHeaders", legacyHeadersTableInput{
569+ legacyHeaders: &LegacyHeaders{
570+ PassBasicAuth: false,
571+ PassAccessToken: false,
572+ PassUserHeaders: true,
573+ PassAuthorization: false,
574+
575+ SetBasicAuth: false,
576+ SetXAuthRequest: false,
577+ SetAuthorization: false,
578+
579+ PreferEmailToUser: false,
580+ BasicAuthPassword: "",
581+ SkipAuthStripHeaders: false,
582+ },
583+ expectedRequestHeaders: []Header{
584+ xForwardedUser,
585+ xForwardedEmail,
586+ xForwardedGroups,
587+ xForwardedPreferredUsername,
588+ },
589+ expectedResponseHeaders: []Header{},
590+ }),
591+ Entry("with setXAuthRequest", legacyHeadersTableInput{
592+ legacyHeaders: &LegacyHeaders{
593+ PassBasicAuth: false,
594+ PassAccessToken: false,
595+ PassUserHeaders: false,
596+ PassAuthorization: false,
597+
598+ SetBasicAuth: false,
599+ SetXAuthRequest: true,
600+ SetAuthorization: false,
601+
602+ PreferEmailToUser: false,
603+ BasicAuthPassword: "",
604+ SkipAuthStripHeaders: false,
605+ },
606+ expectedRequestHeaders: []Header{},
607+ expectedResponseHeaders: []Header{
608+ xAuthRequestUser,
609+ xAuthRequestEmail,
610+ xAuthRequestGroups,
611+ withPreserveRequestValue(xForwardedPreferredUsername, false),
612+ },
613+ }),
614+ Entry("with passAccessToken", legacyHeadersTableInput{
615+ legacyHeaders: &LegacyHeaders{
616+ PassBasicAuth: false,
617+ PassAccessToken: true,
618+ PassUserHeaders: false,
619+ PassAuthorization: false,
620+
621+ SetBasicAuth: false,
622+ SetXAuthRequest: false,
623+ SetAuthorization: false,
624+
625+ PreferEmailToUser: false,
626+ BasicAuthPassword: "",
627+ SkipAuthStripHeaders: false,
628+ },
629+ expectedRequestHeaders: []Header{
630+ xForwardedAccessToken,
631+ },
632+ expectedResponseHeaders: []Header{},
633+ }),
634+ Entry("with passAcessToken and setXAuthRequest", legacyHeadersTableInput{
635+ legacyHeaders: &LegacyHeaders{
636+ PassBasicAuth: false,
637+ PassAccessToken: true,
638+ PassUserHeaders: false,
639+ PassAuthorization: false,
640+
641+ SetBasicAuth: false,
642+ SetXAuthRequest: true,
643+ SetAuthorization: false,
644+
645+ PreferEmailToUser: false,
646+ BasicAuthPassword: "",
647+ SkipAuthStripHeaders: false,
648+ },
649+ expectedRequestHeaders: []Header{
650+ xForwardedAccessToken,
651+ },
652+ expectedResponseHeaders: []Header{
653+ xAuthRequestUser,
654+ xAuthRequestEmail,
655+ xAuthRequestGroups,
656+ withPreserveRequestValue(xForwardedPreferredUsername, false),
657+ xAuthRequestAccessToken,
658+ },
659+ }),
660+ Entry("with authorization headers", legacyHeadersTableInput{
661+ legacyHeaders: &LegacyHeaders{
662+ PassBasicAuth: false,
663+ PassAccessToken: false,
664+ PassUserHeaders: false,
665+ PassAuthorization: true,
666+
667+ SetBasicAuth: false,
668+ SetXAuthRequest: false,
669+ SetAuthorization: true,
670+
671+ PreferEmailToUser: false,
672+ BasicAuthPassword: "",
673+ SkipAuthStripHeaders: false,
674+ },
675+ expectedRequestHeaders: []Header{
676+ authorizationHeader,
677+ },
678+ expectedResponseHeaders: []Header{
679+ withPreserveRequestValue(authorizationHeader, false),
680+ },
681+ }),
682+ )
683+ })
262684})