-
Notifications
You must be signed in to change notification settings - Fork 56
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
maintain: move allowed login domains to a global org field (#3704)
- move domains that are allowed to use social login to the org table rather than on specific providers - remove allowed domains from providers - set allowed domains to match the org admin on sign-up - remove validation added for provider allowed domains
- Loading branch information
Showing
25 changed files
with
272 additions
and
352 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,7 +9,6 @@ import ( | |
| "gotest.tools/v3/assert" | ||
| is "gotest.tools/v3/assert/cmp" | ||
|
|
||
| "github.com/infrahq/infra/internal" | ||
| "github.com/infrahq/infra/internal/server/data" | ||
| "github.com/infrahq/infra/internal/server/models" | ||
| "github.com/infrahq/infra/internal/server/providers" | ||
|
|
@@ -52,24 +51,23 @@ func TestOIDCAuthenticate(t *testing.T) { | |
| // setup | ||
| db := setupDB(t) | ||
|
|
||
| mocktaProvider := models.Provider{Name: "mockta", Kind: models.ProviderKindOkta} | ||
| err := data.CreateProvider(db, &mocktaProvider) | ||
| mocktaProvider := &models.Provider{Name: "mockta", Kind: models.ProviderKindOkta} | ||
| err := data.CreateProvider(db, mocktaProvider) | ||
| assert.NilError(t, err) | ||
|
|
||
| oidc := &mockOIDCImplementation{ | ||
| UserEmailResp: "[email protected]", | ||
| UserGroupsResp: []string{"Everyone", "developers"}, | ||
| } | ||
|
|
||
| t.Run("invalid provider", func(t *testing.T) { | ||
| unknownProviderOIDCAuthn := NewOIDCAuthentication(uid.New(), "localhost:8031", "1234", oidc) | ||
| _, err := unknownProviderOIDCAuthn.Authenticate(context.Background(), db, time.Now().Add(1*time.Minute)) | ||
|
|
||
| assert.ErrorIs(t, err, internal.ErrNotFound) | ||
| t.Run("nil provider", func(t *testing.T) { | ||
| _, err := NewOIDCAuthentication(nil, "localhost:8031", "1234", oidc, []string{}) | ||
| assert.ErrorContains(t, err, "nil provider in oidc authentication") | ||
| }) | ||
|
|
||
| t.Run("successful authentication", func(t *testing.T) { | ||
| oidcAuthn := NewOIDCAuthentication(mocktaProvider.ID, "localhost:8031", "1234", oidc) | ||
| oidcAuthn, err := NewOIDCAuthentication(mocktaProvider, "localhost:8031", "1234", oidc, []string{}) | ||
| assert.NilError(t, err) | ||
| authnIdentity, err := oidcAuthn.Authenticate(context.Background(), db, time.Now().Add(1*time.Minute)) | ||
|
|
||
| assert.NilError(t, err) | ||
|
|
@@ -262,7 +260,8 @@ func TestExchangeAuthCodeForProviderTokens(t *testing.T) { | |
| assert.NilError(t, err) | ||
|
|
||
| mockOIDC := tc.setup(t, db) | ||
| loginMethod := NewOIDCAuthentication(provider.ID, "mockOIDC.example.com/redirect", "AAA", mockOIDC) | ||
| loginMethod, err := NewOIDCAuthentication(provider, "mockOIDC.example.com/redirect", "AAA", mockOIDC, []string{}) | ||
| assert.NilError(t, err) | ||
|
|
||
| a, err := loginMethod.Authenticate(context.Background(), db, sessionExpiry) | ||
| assert.NilError(t, err) | ||
|
|
@@ -278,63 +277,3 @@ func TestExchangeAuthCodeForProviderTokens(t *testing.T) { | |
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestExchangeAuthCodeForProviderTokensAllowedDomains(t *testing.T) { | ||
| sessionExpiry := time.Now().Add(5 * time.Minute) | ||
|
|
||
| type testCase struct { | ||
| client providers.OIDCClient | ||
| expected func(t *testing.T, authnIdentity AuthenticatedIdentity, err error) | ||
| } | ||
|
|
||
| testCases := map[string]testCase{ | ||
| "UserWithAllowedEmailDomain": { | ||
| client: &mockOIDCImplementation{ | ||
| UserEmailResp: "[email protected]", | ||
| }, | ||
| expected: func(t *testing.T, a AuthenticatedIdentity, err error) { | ||
| assert.NilError(t, err) | ||
| assert.Equal(t, "[email protected]", a.Identity.Name) | ||
| assert.Equal(t, "mockoidc", a.Provider.Name) | ||
| assert.Assert(t, a.SessionExpiry.Equal(sessionExpiry)) | ||
| }, | ||
| }, | ||
| "UserWithEmailDomainNotAllowed": { | ||
| client: &mockOIDCImplementation{ | ||
| UserEmailResp: "[email protected]", | ||
| }, | ||
| expected: func(t *testing.T, a AuthenticatedIdentity, err error) { | ||
| assert.ErrorContains(t, err, "infra.app is not an allowed email domain") | ||
| }, | ||
| }, | ||
| "UserIdentifierWithNoAtSign": { | ||
| client: &mockOIDCImplementation{ | ||
| UserEmailResp: "example.com", | ||
| }, | ||
| expected: func(t *testing.T, a AuthenticatedIdentity, err error) { | ||
| assert.ErrorContains(t, err, "example.com is an invalid email address") | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| for name, tc := range testCases { | ||
| t.Run(name, func(t *testing.T) { | ||
| db := setupDB(t) | ||
|
|
||
| // setup fake identity provider with allowed domains specified | ||
| provider := &models.Provider{ | ||
| Name: "mockoidc", | ||
| URL: "mockOIDC.example.com", | ||
| Kind: models.ProviderKindOIDC, | ||
| AllowedDomains: []string{"example.com", "infrahq.com"}, | ||
| } | ||
| err := data.CreateProvider(db, provider) | ||
| assert.NilError(t, err) | ||
|
|
||
| loginMethod := NewOIDCAuthentication(provider.ID, "mockOIDC.example.com/redirect", "AAA", tc.client) | ||
|
|
||
| a, err := loginMethod.Authenticate(context.Background(), db, sessionExpiry) | ||
| tc.expected(t, a, err) | ||
| }) | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.