@@ -2938,12 +2938,75 @@ func TestProxyAllowedGroups(t *testing.T) {
29382938 name string
29392939 allowedGroups []string
29402940 groups []string
2941+ querystring string
29412942 expectUnauthorized bool
29422943 }{
2943− {"NoAllowedGroups", []string{}, []string{}, false},
2944− {"NoAllowedGroupsUserHasGroups", []string{}, []string{"a", "b"}, false},
2945− {"UserInAllowedGroup", []string{"a"}, []string{"a", "b"}, false},
2946− {"UserNotInAllowedGroup", []string{"a"}, []string{"c"}, true},
2944+ {
2945+ name: "NoAllowedGroups",
2946+ allowedGroups: []string{},
2947+ groups: []string{},
2948+ querystring: "",
2949+ expectUnauthorized: false},
2950+ {
2951+ name: "NoAllowedGroupsUserHasGroups",
2952+ allowedGroups: []string{},
2953+ groups: []string{"a", "b"},
2954+ querystring: "",
2955+ expectUnauthorized: false},
2956+ {
2957+ name: "UserInAllowedGroup",
2958+ allowedGroups: []string{"a"},
2959+ groups: []string{"a", "b"},
2960+ querystring: "",
2961+ expectUnauthorized: false},
2962+ {
2963+ name: "UserNotInAllowedGroup",
2964+ allowedGroups: []string{"a"},
2965+ groups: []string{"c"},
2966+ querystring: "",
2967+ expectUnauthorized: true},
2968+ {
2969+ name: "UserInQuerystringGroup",
2970+ allowedGroups: []string{"a", "b"},
2971+ groups: []string{"a", "c"},
2972+ querystring: "?allowed_groups=a",
2973+ expectUnauthorized: false},
2974+ {
2975+ name: "UserInMultiParamQuerystringGroup",
2976+ allowedGroups: []string{"a", "b"},
2977+ groups: []string{"b"},
2978+ querystring: "?allowed_groups=a&allowed_groups=b,d",
2979+ expectUnauthorized: false},
2980+ {
2981+ name: "UserInOnlyQuerystringGroup",
2982+ allowedGroups: []string{},
2983+ groups: []string{"a", "c"},
2984+ querystring: "?allowed_groups=a,b",
2985+ expectUnauthorized: false},
2986+ {
2987+ name: "UserInDelimitedQuerystringGroup",
2988+ allowedGroups: []string{"a", "b", "c"},
2989+ groups: []string{"c"},
2990+ querystring: "?allowed_groups=a,c",
2991+ expectUnauthorized: false},
2992+ {
2993+ name: "UserNotInQuerystringGroup",
2994+ allowedGroups: []string{},
2995+ groups: []string{"c"},
2996+ querystring: "?allowed_groups=a,b",
2997+ expectUnauthorized: true},
2998+ {
2999+ name: "UserInConfigGroupNotInQuerystringGroup",
3000+ allowedGroups: []string{"a", "b", "c"},
3001+ groups: []string{"c"},
3002+ querystring: "?allowed_groups=a,b",
3003+ expectUnauthorized: true},
3004+ {
3005+ name: "UserInQuerystringGroupNotInConfigGroup",
3006+ allowedGroups: []string{"a", "b"},
3007+ groups: []string{"c"},
3008+ querystring: "?allowed_groups=b,c",
3009+ expectUnauthorized: true},
29473010 }
29483011
29493012 for _, tt := range tests {
@@ -2979,7 +3042,7 @@ func TestProxyAllowedGroups(t *testing.T) {
29793042 t.Fatal(err)
29803043 }
29813044
2982− test.req, _ = http.NewRequest("GET", "/", nil)
3045+ test.req, _ = http.NewRequest("GET", fmt.Sprintf("/%s", tt.querystring), nil)
29833046
29843047 test.req.Header.Add("accept", applicationJSON)
29853048 err = test.SaveSession(session)