E2E test that checks OpenID Connect Implicit Flow edge cases.
(t *testing.T)
| 1392 | |
| 1393 | // E2E test that checks OpenID Connect Implicit Flow edge cases. |
| 1394 | func TestOpenIDConnectImplicitFlowEdgeCases(t *testing.T) { |
| 1395 | base.SetUpTestLogging(t, base.LevelInfo, base.KeyAuth, base.KeyHTTP) |
| 1396 | |
| 1397 | const emailClaim = "email" |
| 1398 | var username = "foo_noah" |
| 1399 | providers := auth.OIDCProviderMap{ |
| 1400 | "foo": mockProviderWith("foo", mockProviderRegister{}, mockProviderUserPrefix{"foo"}), |
| 1401 | } |
| 1402 | defaultProvider := "foo" |
| 1403 | mockAuthServer, err := newMockAuthServer() |
| 1404 | require.NoError(t, err, "Error creating mock oauth2 server") |
| 1405 | mockAuthServer.Start() |
| 1406 | defer mockAuthServer.Shutdown() |
| 1407 | mockAuthServer.options.issuer = mockAuthServer.URL + "/" + defaultProvider |
| 1408 | refreshProviderConfig(providers, mockAuthServer.URL) |
| 1409 | |
| 1410 | opts := auth.OIDCOptions{Providers: providers, DefaultProvider: &defaultProvider} |
| 1411 | restTesterConfig := RestTesterConfig{DatabaseConfig: &DatabaseConfig{DbConfig: DbConfig{OIDCConfig: &opts}}} |
| 1412 | restTester := NewRestTester(t, &restTesterConfig) |
| 1413 | defer restTester.Close() |
| 1414 | |
| 1415 | ctx := restTester.Context() |
| 1416 | mockSyncGateway := httptest.NewServer(restTester.TestPublicHandler()) |
| 1417 | defer mockSyncGateway.Close() |
| 1418 | mockSyncGatewayURL := mockSyncGateway.URL |
| 1419 | authenticator := restTester.ServerContext().Database(ctx, "db").Authenticator(base.TestCtx(t)) |
| 1420 | |
| 1421 | sendAuthRequest := func(claimSet claimSet) (*http.Response, error) { |
| 1422 | token, err := mockAuthServer.makeToken(claimSet) |
| 1423 | require.NoError(t, err, "Error obtaining signed token from OpenID Connect provider") |
| 1424 | require.NotEmpty(t, token, "Empty token retrieved from OpenID Connect provider") |
| 1425 | sessionEndpoint := mockSyncGatewayURL + "/" + restTester.DatabaseConfig.Name + "/_session" |
| 1426 | request := createOIDCRequest(t, sessionEndpoint, token) |
| 1427 | return http.DefaultClient.Do(request) |
| 1428 | } |
| 1429 | |
| 1430 | runBadAuthTest := func(claimSet claimSet) { |
| 1431 | response, err := sendAuthRequest(claimSet) |
| 1432 | defer func() { assert.NoError(t, response.Body.Close()) }() |
| 1433 | require.NoError(t, err, "Error sending request with bearer token") |
| 1434 | expectedAuthError := forceError{ |
| 1435 | expectedErrorCode: http.StatusUnauthorized, |
| 1436 | expectedErrorMessage: ErrInvalidLogin.Message, |
| 1437 | } |
| 1438 | assertHttpResponse(t, response, expectedAuthError) |
| 1439 | } |
| 1440 | |
| 1441 | runGoodAuthTest := func(claimSet claimSet, username string) { |
| 1442 | response, err := sendAuthRequest(claimSet) |
| 1443 | defer func() { assert.NoError(t, response.Body.Close()) }() |
| 1444 | require.NoError(t, err, "Error sending request with bearer token") |
| 1445 | checkGoodAuthResponse(t, restTester, response, username) |
| 1446 | } |
| 1447 | |
| 1448 | t.Run("new user authentication with an expired token", func(t *testing.T) { |
| 1449 | claimSet := claimsAuthentic() |
| 1450 | claimSet.primaryClaims.Expiry = jwt.NewNumericDate(time.Now().Add(-5 * time.Minute)) |
| 1451 | runBadAuthTest(claimSet) |
nothing calls this directly
no test coverage detected