feat(op): dynamic issuer depending on request / host
BREAKING CHANGE: The OpenID Provider package is now able to handle multiple issuers with a single storage implementation. The issuer will be selected from the host of the request and passed into the context, where every function can read it from if necessary. This results in some fundamental changes:
- `Configuration` interface:
- `Issuer() string` has been changed to `IssuerFromRequest(r *http.Request) string`
- `Insecure() bool` has been added
- OpenIDProvider interface and dependants:
- `Issuer` has been removed from Config struct
- `NewOpenIDProvider` now takes an additional parameter `issuer` and returns a pointer to the public/default implementation and not an OpenIDProvider interface:
`NewOpenIDProvider(ctx context.Context, config *Config, storage Storage, opOpts ...Option) (OpenIDProvider, error)` changed to `NewOpenIDProvider(ctx context.Context, issuer string, config *Config, storage Storage, opOpts ...Option) (*Provider, error)`
- therefore the parameter type Option changed to the public type as well: `Option func(o *Provider) error`
- `AuthCallbackURL(o OpenIDProvider) func(string) string` has been changed to `AuthCallbackURL(o OpenIDProvider) func(context.Context, string) string`
- `IDTokenHintVerifier() IDTokenHintVerifier` (Authorizer, OpenIDProvider, SessionEnder interfaces), `AccessTokenVerifier() AccessTokenVerifier` (Introspector, OpenIDProvider, Revoker, UserinfoProvider interfaces) and `JWTProfileVerifier() JWTProfileVerifier` (IntrospectorJWTProfile, JWTAuthorizationGrantExchanger, OpenIDProvider, RevokerJWTProfile interfaces) now take a context.Context parameter `IDTokenHintVerifier(context.Context) IDTokenHintVerifier`, `AccessTokenVerifier(context.Context) AccessTokenVerifier` and `JWTProfileVerifier(context.Context) JWTProfileVerifier`
- `OidcDevMode` (CAOS_OIDC_DEV) environment variable check has been removed, use `WithAllowInsecure()` Option
- Signing: the signer is not kept in memory anymore, but created on request from the loaded key:
- `Signer` interface and func `NewSigner` have been removed
- `ReadySigner(s Signer) ProbesFn` has been removed
- `CreateDiscoveryConfig(c Configuration, s Signer) *oidc.DiscoveryConfiguration` has been changed to `CreateDiscoveryConfig(r *http.Request, config Configuration, storage DiscoverStorage) *oidc.DiscoveryConfiguration`
- `Storage` interface:
- `GetSigningKey(context.Context, chan<- jose.SigningKey)` has been changed to `SigningKey(context.Context) (SigningKey, error)`
- `KeySet(context.Context) ([]Key, error)` has been added
- `GetKeySet(context.Context) (*jose.JSONWebKeySet, error)` has been changed to `KeySet(context.Context) ([]Key, error)`
- `SigAlgorithms(s Signer) []string` has been changed to `SigAlgorithms(ctx context.Context, storage DiscoverStorage) []string`
- KeyProvider interface: `GetKeySet(context.Context) (*jose.JSONWebKeySet, error)` has been changed to `KeySet(context.Context) ([]Key, error)`
- `CreateIDToken`: the Signer parameter has been removed
This commit is contained in:
Livio Amstutz
parent
885fe0d45c
commit
a27ba09872
33 changed files with 1504 additions and 657 deletions
|
|
@ -1,13 +1,17 @@
|
|||
package op
|
||||
|
||||
import (
|
||||
"os"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
func TestValidateIssuer(t *testing.T) {
|
||||
type args struct {
|
||||
issuer string
|
||||
issuer string
|
||||
allowInsecure bool
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
|
|
@ -16,65 +20,97 @@ func TestValidateIssuer(t *testing.T) {
|
|||
}{
|
||||
{
|
||||
"missing issuer fails",
|
||||
args{""},
|
||||
args{
|
||||
issuer: "",
|
||||
},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"invalid url for issuer fails",
|
||||
args{":issuer"},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"invalid url for issuer fails",
|
||||
args{":issuer"},
|
||||
args{
|
||||
issuer: ":issuer",
|
||||
},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"host for issuer missing fails",
|
||||
args{"https:///issuer"},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"host for not https fails",
|
||||
args{"http://issuer.com"},
|
||||
args{
|
||||
issuer: "https:///issuer",
|
||||
},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"host with fragment fails",
|
||||
args{"https://issuer.com/#issuer"},
|
||||
args{
|
||||
issuer: "https://issuer.com/#issuer",
|
||||
},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"host with query fails",
|
||||
args{"https://issuer.com?issuer=me"},
|
||||
args{
|
||||
issuer: "https://issuer.com?issuer=me",
|
||||
},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"host with http fails",
|
||||
args{
|
||||
issuer: "http://issuer.com",
|
||||
},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"host with https ok",
|
||||
args{"https://issuer.com"},
|
||||
args{
|
||||
issuer: "https://issuer.com",
|
||||
},
|
||||
false,
|
||||
},
|
||||
{
|
||||
"localhost with http fails",
|
||||
args{"http://localhost:9999"},
|
||||
"custom scheme fails",
|
||||
args{
|
||||
issuer: "custom://localhost:9999",
|
||||
},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"http with allowInsecure ok",
|
||||
args{
|
||||
issuer: "http://localhost:9999",
|
||||
allowInsecure: true,
|
||||
},
|
||||
false,
|
||||
},
|
||||
{
|
||||
"https with allowInsecure ok",
|
||||
args{
|
||||
issuer: "https://localhost:9999",
|
||||
allowInsecure: true,
|
||||
},
|
||||
false,
|
||||
},
|
||||
{
|
||||
"custom scheme with allowInsecure fails",
|
||||
args{
|
||||
issuer: "custom://localhost:9999",
|
||||
allowInsecure: true,
|
||||
},
|
||||
true,
|
||||
},
|
||||
}
|
||||
//ensure env is not set
|
||||
//nolint:errcheck
|
||||
os.Unsetenv(OidcDevMode)
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
if err := ValidateIssuer(tt.args.issuer); (err != nil) != tt.wantErr {
|
||||
if err := ValidateIssuer(tt.args.issuer, tt.args.allowInsecure); (err != nil) != tt.wantErr {
|
||||
t.Errorf("ValidateIssuer() error = %v, wantErr %v", err, tt.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateIssuerDevLocalAllowed(t *testing.T) {
|
||||
func TestValidateIssuerPath(t *testing.T) {
|
||||
type args struct {
|
||||
issuer string
|
||||
issuerPath *url.URL
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
|
|
@ -82,17 +118,217 @@ func TestValidateIssuerDevLocalAllowed(t *testing.T) {
|
|||
wantErr bool
|
||||
}{
|
||||
{
|
||||
"localhost with http with dev ok",
|
||||
args{"http://localhost:9999"},
|
||||
"empty ok",
|
||||
args{func() *url.URL {
|
||||
u, _ := url.Parse("")
|
||||
return u
|
||||
}()},
|
||||
false,
|
||||
},
|
||||
{
|
||||
"custom ok",
|
||||
args{func() *url.URL {
|
||||
u, _ := url.Parse("/custom")
|
||||
return u
|
||||
}()},
|
||||
false,
|
||||
},
|
||||
{
|
||||
"fragment fails",
|
||||
args{func() *url.URL {
|
||||
u, _ := url.Parse("#fragment")
|
||||
return u
|
||||
}()},
|
||||
true,
|
||||
},
|
||||
{
|
||||
"query fails",
|
||||
args{func() *url.URL {
|
||||
u, _ := url.Parse("?query=value")
|
||||
return u
|
||||
}()},
|
||||
true,
|
||||
},
|
||||
}
|
||||
//nolint:errcheck
|
||||
os.Setenv(OidcDevMode, "true")
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
if err := ValidateIssuer(tt.args.issuer); (err != nil) != tt.wantErr {
|
||||
t.Errorf("ValidateIssuer() error = %v, wantErr %v", err, tt.wantErr)
|
||||
if err := ValidateIssuerPath(tt.args.issuerPath); (err != nil) != tt.wantErr {
|
||||
t.Errorf("ValidateIssuerPath() error = %v, wantErr %v", err, tt.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestIssuerFromHost(t *testing.T) {
|
||||
type args struct {
|
||||
path string
|
||||
allowInsecure bool
|
||||
target string
|
||||
}
|
||||
type res struct {
|
||||
issuer string
|
||||
err error
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
res res
|
||||
}{
|
||||
{
|
||||
"invalid issuer path",
|
||||
args{
|
||||
path: "/#fragment",
|
||||
allowInsecure: false,
|
||||
},
|
||||
res{
|
||||
issuer: "",
|
||||
err: ErrInvalidIssuerPath,
|
||||
},
|
||||
},
|
||||
{
|
||||
"empty path secure",
|
||||
args{
|
||||
path: "",
|
||||
allowInsecure: false,
|
||||
target: "https://issuer.com",
|
||||
},
|
||||
res{
|
||||
issuer: "https://issuer.com",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
{
|
||||
"custom path secure",
|
||||
args{
|
||||
path: "/custom/",
|
||||
allowInsecure: false,
|
||||
target: "https://issuer.com",
|
||||
},
|
||||
res{
|
||||
issuer: "https://issuer.com/custom/",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
{
|
||||
"custom path no leading slash",
|
||||
args{
|
||||
path: "custom/",
|
||||
allowInsecure: false,
|
||||
target: "https://issuer.com",
|
||||
},
|
||||
res{
|
||||
issuer: "https://issuer.com/custom/",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
{
|
||||
"empty path unsecure",
|
||||
args{
|
||||
path: "",
|
||||
allowInsecure: true,
|
||||
target: "http://issuer.com",
|
||||
},
|
||||
res{
|
||||
issuer: "http://issuer.com",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
{
|
||||
"custom path unsecure",
|
||||
args{
|
||||
path: "/custom/",
|
||||
allowInsecure: true,
|
||||
target: "http://issuer.com",
|
||||
},
|
||||
res{
|
||||
issuer: "http://issuer.com/custom/",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
issuer, err := IssuerFromHost(tt.args.path)(tt.args.allowInsecure)
|
||||
if tt.res.err == nil {
|
||||
assert.NoError(t, err)
|
||||
req := httptest.NewRequest("", tt.args.target, nil)
|
||||
assert.Equal(t, tt.res.issuer, issuer(req))
|
||||
}
|
||||
if tt.res.err != nil {
|
||||
assert.ErrorIs(t, err, tt.res.err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestStaticIssuer(t *testing.T) {
|
||||
type args struct {
|
||||
issuer string
|
||||
allowInsecure bool
|
||||
}
|
||||
type res struct {
|
||||
issuer string
|
||||
err error
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
res res
|
||||
}{
|
||||
{
|
||||
"invalid issuer",
|
||||
args{
|
||||
issuer: "",
|
||||
allowInsecure: false,
|
||||
},
|
||||
res{
|
||||
issuer: "",
|
||||
err: ErrInvalidIssuerNoIssuer,
|
||||
},
|
||||
},
|
||||
{
|
||||
"empty path secure",
|
||||
args{
|
||||
issuer: "https://issuer.com",
|
||||
allowInsecure: false,
|
||||
},
|
||||
res{
|
||||
issuer: "https://issuer.com",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
{
|
||||
"custom path secure",
|
||||
args{
|
||||
issuer: "https://issuer.com/custom/",
|
||||
allowInsecure: false,
|
||||
},
|
||||
res{
|
||||
issuer: "https://issuer.com/custom/",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
{
|
||||
"unsecure",
|
||||
args{
|
||||
issuer: "http://issuer.com",
|
||||
allowInsecure: true,
|
||||
},
|
||||
res{
|
||||
issuer: "http://issuer.com",
|
||||
err: nil,
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
issuer, err := StaticIssuer(tt.args.issuer)(tt.args.allowInsecure)
|
||||
if tt.res.err == nil {
|
||||
assert.NoError(t, err)
|
||||
assert.Equal(t, tt.res.issuer, issuer(nil))
|
||||
}
|
||||
if tt.res.err != nil {
|
||||
assert.ErrorIs(t, err, tt.res.err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue