Function TestAuthenticateTrustedJWT

auth/auth_test.go:796–1214

(t *testing.T)

}

func TestAuthenticateTrustedJWT(t *testing.T) {
	base.SetUpTestLogging(t, base.LevelDebug, base.KeyAuth, base.KeyAccess, base.KeyHTTP)
	ctx := base.TestCtx(t)
	testBucket := base.GetTestBucket(t)
	defer testBucket.Close(ctx)

	dataStore := testBucket.GetSingleDataStore()

	auth := NewTestAuthenticator(t, dataStore, nil, DefaultAuthenticatorOptions(ctx))

	var callbackURLFunc OIDCCallbackURLFunc
	callbackURL := base.Ptr("http://comcast:4984/_callback")
	providerGoogle := oidcProviderForTest(t, &OIDCProvider{
		Name: "Google",
		JWTConfigCommon: JWTConfigCommon{
			ClientID: base.Ptr("aud1"),
			Issuer:   issuerGoogleAccounts,
		},
		CallbackURL: callbackURL,
	})

	// Make an RSA signer for signing tokens
	signer, err := getRSASigner()
	require.NoError(t, err, "Failed to create RSA signer")

	t.Run("malformed token with bad header no payload", func(t *testing.T) {
		user, _, expiry, err := auth.AuthenticateTrustedJWT("DmBb9C5", providerGoogle, callbackURLFunc)
		assert.Error(t, err, "Error parsing malformed token")
		assert.Nil(t, user, "User shouldn't be created or retrieved")
		assert.Equal(t, time.Time{}, expiry, "Expiry should be zero time instant")
	})

	t.Run("malformed token with bad header bad payload", func(t *testing.T) {
		user, _, expiry, err := auth.AuthenticateTrustedJWT("DmBb9C5.C#m7G#7", providerGoogle, callbackURLFunc)
		assert.Error(t, err, "Error parsing malformed token")
		assert.Nil(t, user, "User shouldn't be created or retrieved")
		assert.Equal(t, time.Time{}, expiry, "Expiry should be zero time instant")
	})

	t.Run("malformed token with bad header bad base64 payload", func(t *testing.T) {
		token := "DmBb9C5." + ToBase64String(`{"unknown":"value"}`)
		user, _, expiry, err := auth.AuthenticateTrustedJWT(token, providerGoogle, callbackURLFunc)
		assert.Error(t, err, "Error parsing malformed token")
		assert.Nil(t, user, "User shouldn't be created or retrieved")
		assert.Equal(t, time.Time{}, expiry, "Expiry should be zero time instant")
	})

	t.Run("token with issuer but no clientID config", func(t *testing.T) {
		builder := jwt.Signed(signer).Claims(jwt.Claims{Issuer: issuerGoogleAccounts})
		token, err := builder.Serialize()
		require.NoError(t, err, "Error serializing token using compact serialization format")
		provider := oidcProviderForTest(t, &OIDCProvider{
			Name: providerGoogle.Name,
			JWTConfigCommon: JWTConfigCommon{
				Issuer: issuerGoogleAccounts,
			},
			CallbackURL: providerGoogle.CallbackURL,
		})