From 29b3523e07b61d006914ac9e24f317610c7eda16 Mon Sep 17 00:00:00 2001
From: Marcelo Clavel <mclavel00@gmail.com>
Date: Thu, 1 Sep 2022 07:46:24 -0400
Subject: [PATCH] feat(connector/authproxy): support multiple groups (#2643)

Signed-off-by: Marcelo Clavel <mclavel00@gmail.com>
---
 connector/authproxy/authproxy.go      |   7 +-
 connector/authproxy/authproxy_test.go | 134 ++++++++++++++++++++++++++
 2 files changed, 140 insertions(+), 1 deletion(-)
 create mode 100644 connector/authproxy/authproxy_test.go

diff --git a/connector/authproxy/authproxy.go b/connector/authproxy/authproxy.go
index 487a3f60..87154121 100644
--- a/connector/authproxy/authproxy.go
+++ b/connector/authproxy/authproxy.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 
 	"github.com/dexidp/dex/connector"
 	"github.com/dexidp/dex/pkg/log"
@@ -69,7 +70,11 @@ func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connecto
 	groups := m.groups
 	headerGroup := r.Header.Get(m.groupHeader)
 	if headerGroup != "" {
-		groups = append(groups, headerGroup)
+		splitheaderGroup := strings.Split(headerGroup, ",")
+		for i, v := range splitheaderGroup {
+			splitheaderGroup[i] = strings.TrimSpace(v)
+		}
+		groups = append(splitheaderGroup, groups...)
 	}
 	return connector.Identity{
 		UserID:        remoteUser, // TODO: figure out if this is a bad ID value.
diff --git a/connector/authproxy/authproxy_test.go b/connector/authproxy/authproxy_test.go
new file mode 100644
index 00000000..5d42530e
--- /dev/null
+++ b/connector/authproxy/authproxy_test.go
@@ -0,0 +1,134 @@
+package authproxy
+
+import (
+	"io"
+	"net/http"
+	"reflect"
+	"testing"
+
+	"github.com/sirupsen/logrus"
+
+	"github.com/dexidp/dex/connector"
+)
+
+const (
+	testEmail        = "testuser@example.com"
+	testGroup1       = "group1"
+	testGroup2       = "group2"
+	testGroup3       = "group 3"
+	testGroup4       = "group 4"
+	testStaticGroup1 = "static1"
+	testStaticGroup2 = "static 2"
+)
+
+var logger = &logrus.Logger{Out: io.Discard, Formatter: &logrus.TextFormatter{}}
+
+func TestUser(t *testing.T) {
+	config := Config{
+		UserHeader: "X-Remote-User",
+	}
+	conn := callback{userHeader: config.UserHeader, logger: logger, pathSuffix: "/test"}
+
+	req, err := http.NewRequest("GET", "/", nil)
+	expectNil(t, err)
+	req.Header = map[string][]string{
+		"X-Remote-User": {testEmail},
+	}
+
+	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	expectNil(t, err)
+
+	expectEquals(t, ident.UserID, testEmail)
+	expectEquals(t, ident.Email, testEmail)
+	expectEquals(t, len(ident.Groups), 0)
+}
+
+func TestSingleGroup(t *testing.T) {
+	config := Config{
+		UserHeader:  "X-Remote-User",
+		GroupHeader: "X-Remote-Group",
+	}
+
+	conn := callback{userHeader: config.UserHeader, groupHeader: config.GroupHeader, logger: logger, pathSuffix: "/test"}
+
+	req, err := http.NewRequest("GET", "/", nil)
+	expectNil(t, err)
+	req.Header = map[string][]string{
+		"X-Remote-User":  {testEmail},
+		"X-Remote-Group": {testGroup1},
+	}
+
+	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	expectNil(t, err)
+
+	expectEquals(t, ident.UserID, testEmail)
+	expectEquals(t, len(ident.Groups), 1)
+	expectEquals(t, ident.Groups[0], testGroup1)
+}
+
+func TestMultipleGroup(t *testing.T) {
+	config := Config{
+		UserHeader:  "X-Remote-User",
+		GroupHeader: "X-Remote-Group",
+	}
+
+	conn := callback{userHeader: config.UserHeader, groupHeader: config.GroupHeader, logger: logger, pathSuffix: "/test"}
+
+	req, err := http.NewRequest("GET", "/", nil)
+	expectNil(t, err)
+	req.Header = map[string][]string{
+		"X-Remote-User":  {testEmail},
+		"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
+	}
+
+	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	expectNil(t, err)
+
+	expectEquals(t, ident.UserID, testEmail)
+	expectEquals(t, len(ident.Groups), 4)
+	expectEquals(t, ident.Groups[0], testGroup1)
+	expectEquals(t, ident.Groups[1], testGroup2)
+	expectEquals(t, ident.Groups[2], testGroup3)
+	expectEquals(t, ident.Groups[3], testGroup4)
+}
+
+func TestStaticGroup(t *testing.T) {
+	config := Config{
+		UserHeader:  "X-Remote-User",
+		GroupHeader: "X-Remote-Group",
+		Groups:      []string{"static1", "static 2"},
+	}
+
+	conn := callback{userHeader: config.UserHeader, groupHeader: config.GroupHeader, groups: config.Groups, logger: logger, pathSuffix: "/test"}
+
+	req, err := http.NewRequest("GET", "/", nil)
+	expectNil(t, err)
+	req.Header = map[string][]string{
+		"X-Remote-User":  {testEmail},
+		"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
+	}
+
+	ident, err := conn.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	expectNil(t, err)
+
+	expectEquals(t, ident.UserID, testEmail)
+	expectEquals(t, len(ident.Groups), 6)
+	expectEquals(t, ident.Groups[0], testGroup1)
+	expectEquals(t, ident.Groups[1], testGroup2)
+	expectEquals(t, ident.Groups[2], testGroup3)
+	expectEquals(t, ident.Groups[3], testGroup4)
+	expectEquals(t, ident.Groups[4], testStaticGroup1)
+	expectEquals(t, ident.Groups[5], testStaticGroup2)
+}
+
+func expectNil(t *testing.T, a interface{}) {
+	if a != nil {
+		t.Errorf("Expected %+v to equal nil", a)
+	}
+}
+
+func expectEquals(t *testing.T, a interface{}, b interface{}) {
+	if !reflect.DeepEqual(a, b) {
+		t.Errorf("Expected %+v to equal %+v", a, b)
+	}
+}