Checks that we correctly handle the removal of an OIDC provider while it's in use
(t *testing.T)
| 2586 | |
| 2587 | // Checks that we correctly handle the removal of an OIDC provider while it's in use |
| 2588 | func TestOpenIDConnectProviderRemoval(t *testing.T) { |
| 2589 | |
| 2590 | const ( |
| 2591 | providerName = "foo" |
| 2592 | subject = "noah" |
| 2593 | usernameClaim = "username" |
| 2594 | channelsClaim = "channels" |
| 2595 | testChannelName = "test_channel" |
| 2596 | ) |
| 2597 | providers := auth.OIDCProviderMap{ |
| 2598 | providerName: mockProviderWith(providerName, mockProviderRegister{}, mockProviderUserPrefix{""}, mockProviderUsernameClaim{usernameClaim}, mockProviderChannelsClaim{channelsClaim}), |
| 2599 | } |
| 2600 | mockAuthServer, err := newMockAuthServer() |
| 2601 | require.NoError(t, err, "Error creating mock oauth2 server") |
| 2602 | mockAuthServer.Start() |
| 2603 | defer mockAuthServer.Shutdown() |
| 2604 | mockAuthServer.options.issuer = mockAuthServer.URL + "/" + providerName |
| 2605 | refreshProviderConfig(providers, mockAuthServer.URL) |
| 2606 | |
| 2607 | rt := NewRestTester(t, &RestTesterConfig{PersistentConfig: true}) |
| 2608 | defer rt.Close() |
| 2609 | |
| 2610 | oidcOptions := auth.OIDCOptions{Providers: providers, DefaultProvider: base.Ptr(providerName)} |
| 2611 | dbConfig := rt.NewDbConfig() |
| 2612 | dbConfig.OIDCConfig = &oidcOptions |
| 2613 | |
| 2614 | RequireStatus(t, rt.CreateDatabase("db", dbConfig), http.StatusCreated) |
| 2615 | |
| 2616 | // Sanity check that we can authenticate properly |
| 2617 | jwt, err := mockAuthServer.makeToken(claimsAuthenticWithExtraClaims(map[string]interface{}{ |
| 2618 | usernameClaim: subject, |
| 2619 | channelsClaim: []string{testChannelName}, |
| 2620 | })) |
| 2621 | require.NoError(t, err, "Failed to create test JWT") |
| 2622 | |
| 2623 | RequireStatus(t, rt.SendRequestWithHeaders(http.MethodPost, "/{{.db}}/_session", "{}", map[string]string{"Authorization": BearerToken + " " + jwt}), http.StatusOK) |
| 2624 | |
| 2625 | // Check that the user is present in the admin API |
| 2626 | res := rt.SendAdminRequest(http.MethodGet, "/{{.db}}/_user/"+subject, "") |
| 2627 | RequireStatus(t, res, http.StatusOK) |
| 2628 | var adminResult db.Body |
| 2629 | require.NoError(t, base.JSONUnmarshal(res.Body.Bytes(), &adminResult)) |
| 2630 | |
| 2631 | assert.Equal(t, subject, adminResult["name"]) |
| 2632 | assert.Equal(t, mockAuthServer.options.issuer, adminResult["jwt_issuer"]) |
| 2633 | assert.Equal(t, []interface{}{testChannelName}, adminResult["jwt_channels"]) |
| 2634 | assert.NotEmpty(t, adminResult["jwt_last_updated"]) |
| 2635 | // check it's a valid time |
| 2636 | _, err = time.Parse(time.RFC3339Nano, adminResult["jwt_last_updated"].(string)) |
| 2637 | require.NoError(t, err) |
| 2638 | |
| 2639 | // Now simulate deleting the provider from the config. |
| 2640 | // Need to do this get-then-replace because of CBG-2122 |
| 2641 | dbConfig = rt.NewDbConfig() |
| 2642 | delete(oidcOptions.Providers, providerName) |
| 2643 | providers["INVALID"] = mockProviderWith("INVALID") |
| 2644 | providers["INVALID"].Issuer = "INVALID" |
| 2645 |
nothing calls this directly
no test coverage detected