This test verifies the edge case of having two different OIDC providers with different role/channel configurations but with UsernameClaim set in a way that means they create users with the same username, yet with different access.
(t *testing.T)
| 2678 | // This test verifies the edge case of having two different OIDC providers with different role/channel configurations |
| 2679 | // but with UsernameClaim set in a way that means they create users with the same username, yet with different access. |
| 2680 | func TestOpenIDConnectIssuerChange(t *testing.T) { |
| 2681 | base.RequireNumTestBuckets(t, 2) |
| 2682 | |
| 2683 | base.SetUpTestLogging(t, base.LevelDebug, base.KeyAuth, base.KeyAccess, base.KeyHTTP) |
| 2684 | const ( |
| 2685 | testDocName = "testDoc" |
| 2686 | subject = "frodo" |
| 2687 | ) |
| 2688 | |
| 2689 | ctx := base.TestCtx(t) |
| 2690 | // We need to create two different sync gateways, so that we have two different OIDC issuers to test with. |
| 2691 | // Note that we set the OIDC config after the mock SG is running, because we need to know its URL for the issuer field |
| 2692 | tb1 := base.GetTestBucket(t) |
| 2693 | defer tb1.Close(ctx) |
| 2694 | rt1Config := RestTesterConfig{ |
| 2695 | DatabaseConfig: &DatabaseConfig{DbConfig: DbConfig{}}, |
| 2696 | CustomTestBucket: tb1, |
| 2697 | } |
| 2698 | rt1 := NewRestTesterDefaultCollection(t, &rt1Config) // CBG-2618: fix collection channel access |
| 2699 | defer rt1.Close() |
| 2700 | |
| 2701 | msg1 := httptest.NewServer(rt1.TestPublicHandler()) |
| 2702 | defer msg1.Close() |
| 2703 | |
| 2704 | rt2 := NewRestTesterDefaultCollection(t, // CBG-2618: fix collection channel access |
| 2705 | &RestTesterConfig{DatabaseConfig: &DatabaseConfig{DbConfig: DbConfig{ |
| 2706 | Unsupported: &db.UnsupportedOptions{ |
| 2707 | OidcTestProvider: &db.OidcTestProviderOptions{ |
| 2708 | Enabled: true, |
| 2709 | }, |
| 2710 | }, |
| 2711 | }}}) |
| 2712 | defer rt2.Close() |
| 2713 | msg2 := httptest.NewServer(rt2.TestPublicHandler()) |
| 2714 | defer msg2.Close() |
| 2715 | |
| 2716 | // We need to update the config now because there's a chicken-and-egg problem - we need to know the ports of the mock |
| 2717 | // sync gateways for the issuer fields |
| 2718 | newCfg := rt1.DatabaseConfig.DbConfig |
| 2719 | newCfg.OIDCConfig = &auth.OIDCOptions{ |
| 2720 | Providers: auth.OIDCProviderMap{ |
| 2721 | "test": &auth.OIDCProvider{ |
| 2722 | JWTConfigCommon: auth.JWTConfigCommon{ |
| 2723 | Issuer: fmt.Sprintf("%s/%s/_oidc_testing", msg1.URL, rt1.DatabaseConfig.Name), |
| 2724 | ClientID: base.Ptr("sync_gateway"), |
| 2725 | Register: true, |
| 2726 | // this UsernameClaim is critical - we'll generate two users from two different OIDC issuers but with the same username |
| 2727 | UsernameClaim: "username", |
| 2728 | ChannelsClaim: "channels", |
| 2729 | }, |
| 2730 | }, |
| 2731 | "test2": &auth.OIDCProvider{ |
| 2732 | JWTConfigCommon: auth.JWTConfigCommon{ |
| 2733 | Issuer: fmt.Sprintf("%s/%s/_oidc_testing", msg2.URL, rt2.DatabaseConfig.Name), |
| 2734 | ClientID: base.Ptr("sync_gateway"), |
| 2735 | Register: true, |
| 2736 | UsernameClaim: "username", |
| 2737 | }, |
nothing calls this directly
no test coverage detected