Function TestGetOIDCCallbackURL

rest/oidc_api_test.go:385–458

Verifies OpenID Connect callback URL in redirect link is returned in the Location header for both oidc and _oidc_challenge requests.

(t *testing.T)

// Verifies OpenID Connect callback URL in redirect link is returned in the Location
// header for both oidc and _oidc_challenge requests.
func TestGetOIDCCallbackURL(t *testing.T) {
	type test struct {
		name         string
		authURL      string
		issuer       string
		wantProvider string
	}
	tests := []test{
		{
			// Provider should be included in callback URL when the requested provider is not default.
			name:         "requested provider is not default",
			authURL:      "/db/${path}?provider=bar&offline=true",
			wantProvider: "bar",
			issuer:       "${path}/bar",
		}, {
			// Provider should NOT be included in callback URL when the requested provider is not default.
			name:    "requested provider is default",
			authURL: "/db/${path}?provider=foo&offline=true",
			issuer:  "${path}/foo",
		}, {
			// Provider should NOT be included in callback URL when no provider is requested.
			name:    "no provider is requested",
			authURL: "/db/${path}?offline=true",
			issuer:  "${path}/foo",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			providers := auth.OIDCProviderMap{"foo": mockProvider("foo"), "bar": mockProvider("bar")}
			openIDConnectOptions := auth.OIDCOptions{Providers: providers, DefaultProvider: base.Ptr("foo")}
			rtConfig := RestTesterConfig{DatabaseConfig: &DatabaseConfig{DbConfig: DbConfig{OIDCConfig: &openIDConnectOptions}}}
			rt := NewRestTester(t, &rtConfig)
			defer rt.Close()

			mockAuthServer, err := newMockAuthServer()
			require.NoError(t, err, "Error creating mock oauth2 server")
			mockAuthServer.Start()
			defer mockAuthServer.Shutdown()
			refreshProviderConfig(providers, mockAuthServer.URL)
			tc.issuer = strings.ReplaceAll(tc.issuer, "${path}", mockAuthServer.URL)
			mockAuthServer.options.issuer = tc.issuer

			// Check _oidc_challenge behavior
			authURL := strings.ReplaceAll(tc.authURL, "${path}", "_oidc_challenge")
			resp := rt.SendAdminRequest(http.MethodGet, authURL, "")
			require.Equal(t, http.StatusUnauthorized, resp.Code)
			wwwAuthHeader := resp.Header().Get("Www-Authenticate")
			location := regexp.MustCompile(`login="(?P<login>.*?)"`).FindStringSubmatch(wwwAuthHeader)[1]

			require.NotEmpty(t, location, "error extracting location from header")
			locationURL, err := url.Parse(location)
			require.NoError(t, err, "error parsing location URL")
			redirectURI := locationURL.Query().Get(requestParamRedirectURI)
			redirectURL, err := url.Parse(redirectURI)
			require.NoError(t, err, "error parsing redirect_uri URL")
			assert.Equal(t, tc.wantProvider, redirectURL.Query().Get(auth.OIDCAuthProvider))