|
|
|
|
@ -51,6 +51,17 @@ var ( |
|
|
|
|
}, |
|
|
|
|
} |
|
|
|
|
validIDTokenClaimsWithStackSet = idTokenClaims{ |
|
|
|
|
Claims: &jwt.Claims{ |
|
|
|
|
Subject: "user:2", |
|
|
|
|
Expiry: jwt.NewNumericDate(time.Date(2023, 5, 3, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
IssuedAt: jwt.NewNumericDate(time.Date(2023, 5, 2, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
}, |
|
|
|
|
Rest: authnlib.IDTokenClaims{ |
|
|
|
|
AuthenticatedBy: "extended_jwt", |
|
|
|
|
Namespace: "stacks-1234", |
|
|
|
|
}, |
|
|
|
|
} |
|
|
|
|
validIDTokenClaimsWithDeprecatedStackClaimSet = idTokenClaims{ |
|
|
|
|
Claims: &jwt.Claims{ |
|
|
|
|
Subject: "user:2", |
|
|
|
|
Expiry: jwt.NewNumericDate(time.Date(2023, 5, 3, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
@ -61,7 +72,7 @@ var ( |
|
|
|
|
Namespace: "stack-1234", |
|
|
|
|
}, |
|
|
|
|
} |
|
|
|
|
validAcessTokenClaimsWildcard = accessTokenClaims{ |
|
|
|
|
validAccessTokenClaimsWildcard = accessTokenClaims{ |
|
|
|
|
Claims: &jwt.Claims{ |
|
|
|
|
Subject: "access-policy:this-uid", |
|
|
|
|
Expiry: jwt.NewNumericDate(time.Date(2023, 5, 3, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
@ -71,15 +82,24 @@ var ( |
|
|
|
|
Namespace: "*", |
|
|
|
|
}, |
|
|
|
|
} |
|
|
|
|
invalidWildcardNamespaceIDTokenClaims = idTokenClaims{ |
|
|
|
|
validAccessTokenClaimsWithStackSet = accessTokenClaims{ |
|
|
|
|
Claims: &jwt.Claims{ |
|
|
|
|
Subject: "user:2", |
|
|
|
|
Subject: "access-policy:this-uid", |
|
|
|
|
Expiry: jwt.NewNumericDate(time.Date(2023, 5, 3, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
IssuedAt: jwt.NewNumericDate(time.Date(2023, 5, 2, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
}, |
|
|
|
|
Rest: authnlib.IDTokenClaims{ |
|
|
|
|
AuthenticatedBy: "extended_jwt", |
|
|
|
|
Namespace: "*", |
|
|
|
|
Rest: authnlib.AccessTokenClaims{ |
|
|
|
|
Namespace: "stacks-1234", |
|
|
|
|
}, |
|
|
|
|
} |
|
|
|
|
validAccessTokenClaimsWithDeprecatedStackClaimSet = accessTokenClaims{ |
|
|
|
|
Claims: &jwt.Claims{ |
|
|
|
|
Subject: "access-policy:this-uid", |
|
|
|
|
Expiry: jwt.NewNumericDate(time.Date(2023, 5, 3, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
IssuedAt: jwt.NewNumericDate(time.Date(2023, 5, 2, 0, 0, 0, 0, time.UTC)), |
|
|
|
|
}, |
|
|
|
|
Rest: authnlib.AccessTokenClaims{ |
|
|
|
|
Namespace: "stack-1234", |
|
|
|
|
}, |
|
|
|
|
} |
|
|
|
|
invalidNamespaceIDTokenClaims = idTokenClaims{ |
|
|
|
|
@ -220,7 +240,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) { |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should authenticate as service using wildcard namespace", |
|
|
|
|
accessToken: &validAcessTokenClaimsWildcard, |
|
|
|
|
accessToken: &validAccessTokenClaimsWildcard, |
|
|
|
|
orgID: 1, |
|
|
|
|
want: &authn.Identity{ |
|
|
|
|
ID: "this-uid", |
|
|
|
|
@ -258,7 +278,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) { |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should authenticate as user using wildcard namespace for access token", |
|
|
|
|
accessToken: &validAcessTokenClaimsWildcard, |
|
|
|
|
accessToken: &validAccessTokenClaimsWildcard, |
|
|
|
|
idToken: &validIDTokenClaims, |
|
|
|
|
orgID: 1, |
|
|
|
|
want: &authn.Identity{ |
|
|
|
|
@ -276,7 +296,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) { |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should authenticate as user using wildcard namespace for access token, setting allowed namespace to specific", |
|
|
|
|
accessToken: &validAcessTokenClaimsWildcard, |
|
|
|
|
accessToken: &validAccessTokenClaimsWildcard, |
|
|
|
|
idToken: &validIDTokenClaimsWithStackSet, |
|
|
|
|
orgID: 1, |
|
|
|
|
cfg: &setting.Cfg{ |
|
|
|
|
@ -291,7 +311,7 @@ func TestExtendedJWT_Authenticate(t *testing.T) { |
|
|
|
|
ID: "2", |
|
|
|
|
Type: claims.TypeUser, |
|
|
|
|
OrgID: 1, |
|
|
|
|
AllowedKubernetesNamespace: "stack-1234", |
|
|
|
|
AllowedKubernetesNamespace: "stacks-1234", |
|
|
|
|
AuthenticatedBy: "extendedjwt", |
|
|
|
|
AuthID: "access-policy:this-uid", |
|
|
|
|
ClientParams: authn.ClientParams{ |
|
|
|
|
@ -301,14 +321,109 @@ func TestExtendedJWT_Authenticate(t *testing.T) { |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should return error when id token namespace is a wildcard", |
|
|
|
|
accessToken: &validAccessTokenClaims, |
|
|
|
|
idToken: &invalidWildcardNamespaceIDTokenClaims, |
|
|
|
|
name: "should authenticate as service using specific namespace claim in access token", |
|
|
|
|
accessToken: &validAccessTokenClaimsWithStackSet, |
|
|
|
|
orgID: 1, |
|
|
|
|
wantErr: errExtJWTDisallowedNamespaceClaim, |
|
|
|
|
cfg: &setting.Cfg{ |
|
|
|
|
// default org set up by the authenticator is 1
|
|
|
|
|
StackID: "1234", |
|
|
|
|
ExtJWTAuth: setting.ExtJWTSettings{ |
|
|
|
|
Enabled: true, |
|
|
|
|
ExpectIssuer: "http://localhost:3000", |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
want: &authn.Identity{ |
|
|
|
|
ID: "this-uid", |
|
|
|
|
UID: "this-uid", |
|
|
|
|
Type: claims.TypeAccessPolicy, |
|
|
|
|
OrgID: 1, |
|
|
|
|
AllowedKubernetesNamespace: "stacks-1234", |
|
|
|
|
AuthenticatedBy: "extendedjwt", |
|
|
|
|
AuthID: "access-policy:this-uid", |
|
|
|
|
ClientParams: authn.ClientParams{ |
|
|
|
|
SyncPermissions: true, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should authenticate as service using specific deprecated namespace claim in access token", |
|
|
|
|
accessToken: &validAccessTokenClaimsWithDeprecatedStackClaimSet, |
|
|
|
|
orgID: 1, |
|
|
|
|
cfg: &setting.Cfg{ |
|
|
|
|
// default org set up by the authenticator is 1
|
|
|
|
|
StackID: "1234", |
|
|
|
|
ExtJWTAuth: setting.ExtJWTSettings{ |
|
|
|
|
Enabled: true, |
|
|
|
|
ExpectIssuer: "http://localhost:3000", |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
want: &authn.Identity{ |
|
|
|
|
ID: "this-uid", |
|
|
|
|
UID: "this-uid", |
|
|
|
|
Type: claims.TypeAccessPolicy, |
|
|
|
|
OrgID: 1, |
|
|
|
|
AllowedKubernetesNamespace: "stack-1234", |
|
|
|
|
AuthenticatedBy: "extendedjwt", |
|
|
|
|
AuthID: "access-policy:this-uid", |
|
|
|
|
ClientParams: authn.ClientParams{ |
|
|
|
|
SyncPermissions: true, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should authenticate as user using specific deprecated namespace claim in access and id tokens", |
|
|
|
|
accessToken: &validAccessTokenClaimsWithDeprecatedStackClaimSet, |
|
|
|
|
idToken: &validIDTokenClaimsWithDeprecatedStackClaimSet, |
|
|
|
|
orgID: 1, |
|
|
|
|
cfg: &setting.Cfg{ |
|
|
|
|
// default org set up by the authenticator is 1
|
|
|
|
|
StackID: "1234", |
|
|
|
|
ExtJWTAuth: setting.ExtJWTSettings{ |
|
|
|
|
Enabled: true, |
|
|
|
|
ExpectIssuer: "http://localhost:3000", |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
want: &authn.Identity{ |
|
|
|
|
ID: "2", |
|
|
|
|
Type: claims.TypeUser, |
|
|
|
|
OrgID: 1, |
|
|
|
|
AllowedKubernetesNamespace: "stack-1234", |
|
|
|
|
AuthenticatedBy: "extendedjwt", |
|
|
|
|
AuthID: "access-policy:this-uid", |
|
|
|
|
ClientParams: authn.ClientParams{ |
|
|
|
|
SyncPermissions: true, |
|
|
|
|
FetchSyncedUser: true, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should authenticate as user using wildcard namespace for access token, setting allowed namespace to specific", |
|
|
|
|
accessToken: &validAccessTokenClaimsWildcard, |
|
|
|
|
idToken: &validIDTokenClaimsWithStackSet, |
|
|
|
|
orgID: 1, |
|
|
|
|
cfg: &setting.Cfg{ |
|
|
|
|
// default org set up by the authenticator is 1
|
|
|
|
|
StackID: "1234", |
|
|
|
|
ExtJWTAuth: setting.ExtJWTSettings{ |
|
|
|
|
Enabled: true, |
|
|
|
|
ExpectIssuer: "http://localhost:3000", |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
want: &authn.Identity{ |
|
|
|
|
ID: "2", |
|
|
|
|
Type: claims.TypeUser, |
|
|
|
|
OrgID: 1, |
|
|
|
|
AllowedKubernetesNamespace: "stacks-1234", |
|
|
|
|
AuthenticatedBy: "extendedjwt", |
|
|
|
|
AuthID: "access-policy:this-uid", |
|
|
|
|
ClientParams: authn.ClientParams{ |
|
|
|
|
FetchSyncedUser: true, |
|
|
|
|
SyncPermissions: true, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
}, |
|
|
|
|
{ |
|
|
|
|
name: "should return error when id token has wildcard namespace", |
|
|
|
|
name: "should return error when id token has an invalid namespace", |
|
|
|
|
accessToken: &validAccessTokenClaims, |
|
|
|
|
idToken: &invalidNamespaceIDTokenClaims, |
|
|
|
|
orgID: 1, |
|
|
|
|
|
Charandas
9 months ago
committed by