diff --git a/server/server_test.go b/server/server_test.go index 381465f1..4865ab1f 100644 --- a/server/server_test.go +++ b/server/server_test.go @@ -4,9 +4,14 @@ import ( "crypto/rsa" "crypto/x509" "encoding/pem" + "errors" + "fmt" "net/http" "net/http/httptest" "net/http/httputil" + "net/url" + "strings" + "sync" "testing" "time" @@ -59,12 +64,11 @@ FDWV28nTP9sqbtsmU8Tem2jzMvZ7C/Q0AuDoKELFUpux8shm8wfIhyaPnXUGZoAZ Np4vUwMSYV5mopESLWOg3loBxKyLGFtgGKVCjGiQvy6zISQ4fQo= -----END RSA PRIVATE KEY-----`) -func newTestServer(path string) (*httptest.Server, *Server) { +func newTestServer(updateConfig func(c *Config)) (*httptest.Server, *Server) { var server *Server s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { server.ServeHTTP(w, r) })) - s.URL = s.URL + path config := Config{ Issuer: s.URL, Storage: memory.New(), @@ -76,6 +80,11 @@ func newTestServer(path string) (*httptest.Server, *Server) { }, }, } + if updateConfig != nil { + updateConfig(&config) + } + s.URL = config.Issuer + var err error if server, err = newServer(config, staticRotationStrategy(testKey)); err != nil { panic(err) @@ -85,14 +94,16 @@ func newTestServer(path string) (*httptest.Server, *Server) { } func TestNewTestServer(t *testing.T) { - newTestServer("") + newTestServer(nil) } func TestDiscovery(t *testing.T) { ctx, cancel := context.WithCancel(context.Background()) defer cancel() - httpServer, _ := newTestServer("/nonrootpath") + httpServer, _ := newTestServer(func(c *Config) { + c.Issuer = c.Issuer + "/non-root-path" + }) defer httpServer.Close() p, err := oidc.NewProvider(ctx, httpServer.URL) @@ -114,11 +125,13 @@ func TestDiscovery(t *testing.T) { } } -func TestOAuth2Flow(t *testing.T) { +func TestOAuth2CodeFlow(t *testing.T) { ctx, cancel := context.WithCancel(context.Background()) defer cancel() - httpServer, s := newTestServer("/nonrootpath") + httpServer, s := newTestServer(func(c *Config) { + c.Issuer = c.Issuer + "/non-root-path" + }) defer httpServer.Close() p, err := oidc.NewProvider(ctx, httpServer.URL) @@ -221,6 +234,153 @@ func TestOAuth2Flow(t *testing.T) { } } +type nonceSource struct { + nonce string + once sync.Once +} + +func (n *nonceSource) ClaimNonce(nonce string) error { + if n.nonce != nonce { + return errors.New("invalid nonce") + } + ok := false + n.once.Do(func() { ok = true }) + if !ok { + return errors.New("invalid nonce") + } + return nil +} + +func TestOAuth2ImplicitFlow(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + httpServer, s := newTestServer(func(c *Config) { + // Enable support for the implicit flow. + c.SupportedResponseTypes = []string{"code", "token"} + }) + defer httpServer.Close() + + p, err := oidc.NewProvider(ctx, httpServer.URL) + if err != nil { + t.Fatalf("failed to get provider: %v", err) + } + + var ( + reqDump, respDump []byte + gotIDToken bool + state = "a_state" + nonce = "a_nonce" + ) + defer func() { + if !gotIDToken { + t.Errorf("never got a id token in fragment\n%s\n%s", reqDump, respDump) + } + }() + + var oauth2Config *oauth2.Config + oauth2Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path == "/callback" { + q := r.URL.Query() + if errType := q.Get("error"); errType != "" { + if desc := q.Get("error_description"); desc != "" { + t.Errorf("got error from server %s: %s", errType, desc) + } else { + t.Errorf("got error from server %s", errType) + } + w.WriteHeader(http.StatusInternalServerError) + return + } + // Fragment is checked by the client since net/http servers don't preserve URL fragments. + // E.g. + // + // r.URL.Fragment + // + // Will always be empty. + w.WriteHeader(http.StatusOK) + return + } + u := oauth2Config.AuthCodeURL(state, oauth2.SetAuthURLParam("response_type", "token"), oidc.Nonce(nonce)) + http.Redirect(w, r, u, http.StatusSeeOther) + })) + + defer oauth2Server.Close() + + redirectURL := oauth2Server.URL + "/callback" + client := storage.Client{ + ID: "testclient", + Secret: "testclientsecret", + RedirectURIs: []string{redirectURL}, + } + if err := s.storage.CreateClient(client); err != nil { + t.Fatalf("failed to create client: %v", err) + } + + src := &nonceSource{nonce: nonce} + + idTokenVerifier := p.NewVerifier(ctx, oidc.VerifyAudience(client.ID), oidc.VerifyNonce(src)) + + oauth2Config = &oauth2.Config{ + ClientID: client.ID, + ClientSecret: client.Secret, + Endpoint: p.Endpoint(), + Scopes: []string{oidc.ScopeOpenID, "profile", "email", "offline_access"}, + RedirectURL: redirectURL, + } + + checkIDToken := func(u *url.URL) error { + if u.Fragment == "" { + return fmt.Errorf("url has no fragment: %s", u) + } + v, err := url.ParseQuery(u.Fragment) + if err != nil { + return fmt.Errorf("failed to parse fragment: %v", err) + } + idToken := v.Get("id_token") + if idToken == "" { + return errors.New("no id_token in fragment") + } + if _, err := idTokenVerifier.Verify(idToken); err != nil { + return fmt.Errorf("failed to verify id_token: %v", err) + } + return nil + } + + httpClient := &http.Client{ + // net/http servers don't preserve URL fragments when passing the request to + // handlers. The only way to get at that values is to check the redirect on + // the client side. + CheckRedirect: func(req *http.Request, via []*http.Request) error { + if len(via) > 10 { + return errors.New("too many redirects") + } + + // If we're being redirected back to the client server, inspect the URL fragment + // for an ID Token. + u := req.URL.String() + if strings.HasPrefix(u, oauth2Server.URL) { + if err := checkIDToken(req.URL); err == nil { + gotIDToken = true + } else { + t.Error(err) + } + } + return nil + }, + } + + resp, err := httpClient.Get(oauth2Server.URL + "/login") + if err != nil { + t.Fatalf("get failed: %v", err) + } + if reqDump, err = httputil.DumpRequest(resp.Request, false); err != nil { + t.Fatal(err) + } + if respDump, err = httputil.DumpResponse(resp, true); err != nil { + t.Fatal(err) + } +} + type storageWithKeysTrigger struct { storage.Storage f func()