k-space/dex
Archived
11
0
Fork 0
Code Issues Pull Requests Packages Projects Activity

keystone: test cases, refactoring and cleanup

Browse Source
This commit is contained in:
joannano
2018-12-13 12:22:53 +01:00
committed by Krzysztof Balka
parent a965365a2b
commit 88d1e2b041
10 changed files with 487 additions and 483 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.travis.yml
View File

@@ -13,13 +13,14 @@ services:
- docker - docker
env: env:
- DEX_POSTGRES_DATABASE=postgres DEX_POSTGRES_USER=postgres DEX_POSTGRES_HOST="localhost" DEX_ETCD_ENDPOINTS=http://localhost:2379 DEX_LDAP_TESTS=1 DEBIAN_FRONTEND=noninteractive - DEX_POSTGRES_DATABASE=postgres DEX_POSTGRES_USER=postgres DEX_POSTGRES_HOST="localhost" DEX_ETCD_ENDPOINTS=http://localhost:2379 DEX_LDAP_TESTS=1 DEBIAN_FRONTEND=noninteractive DEX_KEYSTONE_URL=http://localhost:5000 DEX_KEYSTONE_ADMIN_URL=http://localhost:35357
install: install:
- sudo -E apt-get install -y --force-yes slapd time ldap-utils - sudo -E apt-get install -y --force-yes slapd time ldap-utils
- sudo /etc/init.d/slapd stop - sudo /etc/init.d/slapd stop
- docker run -d --net=host gcr.io/etcd-development/etcd:v3.2.9 - docker run -d --net=host gcr.io/etcd-development/etcd:v3.2.9
- docker run -d -p 0.0.0.0:5000:5000 -p 0.0.0.0:35357:35357 openio/openstack-keystone
- sleep 60s
script: script:
- make testall - make testall

9
Dockerfile
View File

@@ -11,12 +11,15 @@ FROM alpine:3.8
# experience when this doesn't work out of the box. # experience when this doesn't work out of the box.
# #
# OpenSSL is required so wget can query HTTPS endpoints for health checking. # OpenSSL is required so wget can query HTTPS endpoints for health checking.
RUN apk add --update ca-certificates openssl bash RUN apk add --update ca-certificates openssl
COPY --from=0 /go/bin/dex /usr/local/bin/dex
# Import frontend assets and set the correct CWD directory so the assets # Import frontend assets and set the correct CWD directory so the assets
# are in the default path. # are in the default path.
COPY web /web COPY web /web
WORKDIR / WORKDIR /
EXPOSE 5500-5600 ENTRYPOINT ["dex"]
CMD ["bash"]
CMD ["version"]

1
connector/connector.go
View File

@@ -35,7 +35,6 @@ type Identity struct {
// //
// This data is never shared with end users, OAuth clients, or through the API. // This data is never shared with end users, OAuth clients, or through the API.
ConnectorData []byte ConnectorData []byte
Password string
} }
// PasswordConnector is an interface implemented by connectors which take a // PasswordConnector is an interface implemented by connectors which take a

253
connector/keystone/keystone.go
View File

@@ -2,163 +2,186 @@
package keystone package keystone
import ( import (
"context"
"fmt"
"github.com/dexidp/dex/connector"
"github.com/sirupsen/logrus"
"encoding/json"
"net/http"
"bytes" "bytes"
"context"
"encoding/json"
"fmt"
"io/ioutil" "io/ioutil"
"net/http"
"github.com/sirupsen/logrus"
"github.com/dexidp/dex/connector"
) )
var ( var (
_ connector.PasswordConnector = &Connector{} _ connector.PasswordConnector = &keystoneConnector{}
_ connector.RefreshConnector = &Connector{} _ connector.RefreshConnector = &keystoneConnector{}
) )
// Open returns an authentication strategy using Keystone. // Open returns an authentication strategy using Keystone.
func (c *Config) Open(id string, logger logrus.FieldLogger) (connector.Connector, error) { func (c *Config) Open(id string, logger logrus.FieldLogger) (connector.Connector, error) {
return &Connector{c.Domain, c.KeystoneHost, return &keystoneConnector{c.Domain, c.KeystoneHost,
c.KeystoneUsername, c.KeystonePassword, logger}, nil c.KeystoneUsername, c.KeystonePassword, logger}, nil
} }
func (p Connector) Close() error { return nil } func (p *keystoneConnector) Close() error { return nil }
func (p Connector) Login(ctx context.Context, s connector.Scopes, username, password string) ( func (p *keystoneConnector) Login(ctx context.Context, s connector.Scopes, username, password string) (
identity connector.Identity, validPassword bool, err error) { identity connector.Identity, validPassword bool, err error) {
response, err := p.getTokenResponse(username, password) resp, err := p.getTokenResponse(ctx, username, password)
if err != nil {
return identity, false, fmt.Errorf("keystone: error %v", err)
}
// Providing wrong password or wrong keystone URI throws error // Providing wrong password or wrong keystone URI throws error
if err == nil && response.StatusCode == 201 { if resp.StatusCode == 201 {
token := response.Header["X-Subject-Token"][0] token := resp.Header.Get("X-Subject-Token")
data, _ := ioutil.ReadAll(response.Body) data, err := ioutil.ReadAll(resp.Body)
if err != nil {
return identity, false, err
}
defer resp.Body.Close()
var tokenResponse = new(TokenResponse) var tokenResp = new(tokenResponse)
err := json.Unmarshal(data, &tokenResponse) err = json.Unmarshal(data, &tokenResp)
if err != nil {
return identity, false, fmt.Errorf("keystone: invalid token response: %v", err)
}
groups, err := p.getUserGroups(ctx, tokenResp.Token.User.ID, token)
if err != nil {
return identity, false, err
}
if err != nil { identity.Username = username
fmt.Printf("keystone: invalid token response: %v", err) identity.UserID = tokenResp.Token.User.ID
return identity, false, err identity.Groups = groups
}
groups, err := p.getUserGroups(tokenResponse.Token.User.ID, token)
if err != nil {
return identity, false, err
}
identity.Username = username
identity.UserID = tokenResponse.Token.User.ID
identity.Groups = groups
return identity, true, nil return identity, true, nil
} else if err != nil {
fmt.Printf("keystone: error %v", err)
return identity, false, err
} else {
data, _ := ioutil.ReadAll(response.Body)
fmt.Println(string(data))
return identity, false, err
} }
return identity, false, nil return identity, false, nil
} }
func (p Connector) Prompt() string { return "username" } func (p *keystoneConnector) Prompt() string { return "username" }
func (p Connector) Refresh( func (p *keystoneConnector) Refresh(
ctx context.Context, s connector.Scopes, identity connector.Identity) (connector.Identity, error) { ctx context.Context, s connector.Scopes, identity connector.Identity) (connector.Identity, error) {
if len(identity.ConnectorData) == 0 { token, err := p.getAdminToken(ctx)
return identity, nil if err != nil {
return identity, fmt.Errorf("keystone: failed to obtain admin token: %v", err)
} }
token, err := p.getAdminToken() ok, err := p.checkIfUserExists(ctx, identity.UserID, token)
if err != nil {
return identity, err
}
if !ok {
return identity, fmt.Errorf("keystone: user %q does not exist", identity.UserID)
}
if err != nil { groups, err := p.getUserGroups(ctx, identity.UserID, token)
fmt.Printf("keystone: failed to obtain admin token") if err != nil {
return identity, err return identity, err
} }
ok := p.checkIfUserExists(identity.UserID, token) identity.Groups = groups
if !ok {
fmt.Printf("keystone: user %q does not exist\n", identity.UserID)
return identity, fmt.Errorf("keystone: user %q does not exist", identity.UserID)
}
groups, err := p.getUserGroups(identity.UserID, token)
if err != nil {
fmt.Printf("keystone: Failed to fetch user %q groups", identity.UserID)
return identity, fmt.Errorf("keystone: failed to fetch user %q groups", identity.UserID)
}
identity.Groups = groups
fmt.Printf("Identity data after use of refresh token: %v", identity)
return identity, nil return identity, nil
} }
func (p *keystoneConnector) getTokenResponse(ctx context.Context, username, pass string) (response *http.Response, err error) {
func (p Connector) getTokenResponse(username, password string) (response *http.Response, err error) { client := &http.Client{}
jsonData := LoginRequestData{ jsonData := loginRequestData{
Auth: Auth{ auth: auth{
Identity: Identity{ Identity: identity{
Methods:[]string{"password"}, Methods: []string{"password"},
Password: Password{ Password: password{
User: User{ User: user{
Name: username, Name: username,
Domain: Domain{ID:p.Domain}, Domain: domain{ID: p.Domain},
Password: password, Password: pass,
}, },
}, },
}, },
}, },
} }
jsonValue, _ := json.Marshal(jsonData) jsonValue, err := json.Marshal(jsonData)
loginURI := p.KeystoneHost + "/v3/auth/tokens" if err != nil {
return http.Post(loginURI, "application/json", bytes.NewBuffer(jsonValue)) return nil, err
}
authTokenURL := p.KeystoneHost + "/v3/auth/tokens/"
req, err := http.NewRequest("POST", authTokenURL, bytes.NewBuffer(jsonValue))
if err != nil {
return nil, err
}
req.Header.Set("Content-Type", "application/json")
req = req.WithContext(ctx)
return client.Do(req)
} }
func (p Connector) getAdminToken()(string, error) { func (p *keystoneConnector) getAdminToken(ctx context.Context) (string, error) {
response, err := p.getTokenResponse(p.KeystoneUsername, p.KeystonePassword) resp, err := p.getTokenResponse(ctx, p.KeystoneUsername, p.KeystonePassword)
if err!= nil { if err != nil {
return "", err return "", err
} }
token := response.Header["X-Subject-Token"][0] token := resp.Header.Get("X-Subject-Token")
return token, nil return token, nil
} }
func (p Connector) checkIfUserExists(userID string, token string) (bool) { func (p *keystoneConnector) checkIfUserExists(ctx context.Context, userID string, token string) (bool, error) {
groupsURI := p.KeystoneHost + "/v3/users/" + userID userURL := p.KeystoneHost + "/v3/users/" + userID
client := &http.Client{} client := &http.Client{}
req, _ := http.NewRequest("GET", groupsURI, nil) req, err := http.NewRequest("GET", userURL, nil)
req.Header.Set("X-Auth-Token", token) if err != nil {
response, err := client.Do(req) return false, err
if err == nil && response.StatusCode == 200 { }
return true
} req.Header.Set("X-Auth-Token", token)
return false req = req.WithContext(ctx)
resp, err := client.Do(req)
if err != nil {
return false, err
}
if resp.StatusCode == 200 {
return true, nil
}
return false, err
} }
func (p Connector) getUserGroups(userID string, token string) ([]string, error) { func (p *keystoneConnector) getUserGroups(ctx context.Context, userID string, token string) ([]string, error) {
groupsURI := p.KeystoneHost + "/v3/users/" + userID + "/groups" client := &http.Client{}
client := &http.Client{} groupsURL := p.KeystoneHost + "/v3/users/" + userID + "/groups"
req, _ := http.NewRequest("GET", groupsURI, nil)
req.Header.Set("X-Auth-Token", token)
response, err := client.Do(req)
if err != nil { req, err := http.NewRequest("GET", groupsURL, nil)
fmt.Printf("keystone: error while fetching user %q groups\n", userID) req.Header.Set("X-Auth-Token", token)
return nil, err req = req.WithContext(ctx)
} resp, err := client.Do(req)
data, _ := ioutil.ReadAll(response.Body) if err != nil {
var groupsResponse = new(GroupsResponse) p.Logger.Errorf("keystone: error while fetching user %q groups\n", userID)
err = json.Unmarshal(data, &groupsResponse) return nil, err
if err != nil { }
return nil, err
} data, err := ioutil.ReadAll(resp.Body)
groups := []string{} if err != nil {
for _, group := range groupsResponse.Groups { return nil, err
groups = append(groups, group.Name) }
} defer resp.Body.Close()
return groups, nil
var groupsResp = new(groupsResponse)
err = json.Unmarshal(data, &groupsResp)
if err != nil {
return nil, err
}
groups := make([]string, len(groupsResp.Groups))
for i, group := range groupsResp.Groups {
groups[i] = group.Name
}
return groups, nil
} }

495
connector/keystone/keystone_test.go
View File

@@ -1,275 +1,358 @@
package keystone package keystone
import ( import (
"testing"
"github.com/dexidp/dex/connector"
"fmt"
"io"
"os"
"time"
"net/http"
"github.com/docker/docker/api/types"
"github.com/docker/docker/api/types/container"
"github.com/docker/docker/client"
networktypes "github.com/docker/docker/api/types/network"
"github.com/docker/go-connections/nat"
"golang.org/x/net/context"
"bytes" "bytes"
"context"
"encoding/json" "encoding/json"
"fmt"
"io/ioutil" "io/ioutil"
"net/http"
"os"
"reflect"
"strings"
"testing"
"github.com/dexidp/dex/connector"
) )
const dockerCliVersion = "1.37" const (
adminUser = "demo"
adminPass = "DEMO_PASS"
invalidPass = "WRONG_PASS"
const exposedKeystonePort = "5000" testUser = "test_user"
const exposedKeystonePortAdmin = "35357" testPass = "test_pass"
testEmail = "test@example.com"
testGroup = "test_group"
testDomain = "default"
)
const keystoneHost = "http://localhost" var (
const keystoneURL = keystoneHost + ":" + exposedKeystonePort keystoneURL = ""
const keystoneAdminURL = keystoneHost + ":" + exposedKeystonePortAdmin keystoneAdminURL = ""
const authTokenURL = keystoneURL + "/v3/auth/tokens/" authTokenURL = ""
const userURL = keystoneAdminURL + "/v3/users/" usersURL = ""
const groupURL = keystoneAdminURL + "/v3/groups/" groupsURL = ""
)
func startKeystoneContainer() string { type userResponse struct {
ctx := context.Background() User struct {
cli, err := client.NewClientWithOpts(client.WithVersion(dockerCliVersion)) ID string `json:"id"`
} `json:"user"`
if err != nil {
fmt.Printf("Error %v", err)
return ""
}
imageName := "openio/openstack-keystone"
out, err := cli.ImagePull(ctx, imageName, types.ImagePullOptions{})
if err != nil {
fmt.Printf("Error %v", err)
return ""
}
io.Copy(os.Stdout, out)
resp, err := cli.ContainerCreate(ctx, &container.Config{
Image: imageName,
}, &container.HostConfig{
PortBindings: nat.PortMap{
"5000/tcp": []nat.PortBinding{
{
HostIP: "0.0.0.0",
HostPort: exposedKeystonePort,
},
},
"35357/tcp": []nat.PortBinding{
{
HostIP: "0.0.0.0",
HostPort: exposedKeystonePortAdmin,
},
},
},
}, &networktypes.NetworkingConfig{}, "dex_keystone_test")
if err != nil {
fmt.Printf("Error %v", err)
return ""
}
if err := cli.ContainerStart(ctx, resp.ID, types.ContainerStartOptions{}); err != nil {
panic(err)
}
fmt.Println(resp.ID)
return resp.ID
} }
func cleanKeystoneContainer(ID string) { type groupResponse struct {
ctx := context.Background() Group struct {
cli, err := client.NewClientWithOpts(client.WithVersion(dockerCliVersion)) ID string `json:"id"`
if err != nil { } `json:"group"`
fmt.Printf("Error %v", err)
return
}
duration := time.Duration(1)
if err:= cli.ContainerStop(ctx, ID, &duration); err != nil {
fmt.Printf("Error %v", err)
return
}
if err:= cli.ContainerRemove(ctx, ID, types.ContainerRemoveOptions{}); err != nil {
fmt.Printf("Error %v", err)
}
} }
func getAdminToken(admin_name, admin_pass string) (token string) { func getAdminToken(t *testing.T, adminName, adminPass string) (token, id string) {
t.Helper()
client := &http.Client{} client := &http.Client{}
jsonData := LoginRequestData{ jsonData := loginRequestData{
Auth: Auth{ auth: auth{
Identity: Identity{ Identity: identity{
Methods:[]string{"password"}, Methods: []string{"password"},
Password: Password{ Password: password{
User: User{ User: user{
Name: admin_name, Name: adminName,
Domain: Domain{ID: "default"}, Domain: domain{ID: testDomain},
Password: admin_pass, Password: adminPass,
}, },
}, },
}, },
}, },
} }
body, _ := json.Marshal(jsonData) body, err := json.Marshal(jsonData)
if err != nil {
t.Fatal(err)
}
req, _ := http.NewRequest("POST", authTokenURL, bytes.NewBuffer(body)) req, err := http.NewRequest("POST", authTokenURL, bytes.NewBuffer(body))
if err != nil {
t.Fatalf("keystone: failed to obtain admin token: %v\n", err)
}
req.Header.Set("Content-Type", "application/json") req.Header.Set("Content-Type", "application/json")
resp, _ := client.Do(req) resp, err := client.Do(req)
if err != nil {
t.Fatal(err)
}
token = resp.Header["X-Subject-Token"][0] token = resp.Header.Get("X-Subject-Token")
return token
data, err := ioutil.ReadAll(resp.Body)
if err != nil {
t.Fatal(err)
}
defer resp.Body.Close()
var tokenResp = new(tokenResponse)
err = json.Unmarshal(data, &tokenResp)
if err != nil {
t.Fatal(err)
}
return token, tokenResp.Token.User.ID
} }
func createUser(token, user_name, user_email, user_pass string) (string){ func createUser(t *testing.T, token, userName, userEmail, userPass string) string {
t.Helper()
client := &http.Client{} client := &http.Client{}
createUserData := CreateUserRequest{ createUserData := map[string]interface{}{
CreateUser: CreateUserForm{ "user": map[string]interface{}{
Name: user_name, "name": userName,
Email: user_email, "email": userEmail,
Enabled: true, "enabled": true,
Password: user_pass, "password": userPass,
Roles: []string{"admin"}, "roles": []string{"admin"},
}, },
} }
body, _ := json.Marshal(createUserData) body, err := json.Marshal(createUserData)
req, _ := http.NewRequest("POST", userURL, bytes.NewBuffer(body))
req.Header.Set("X-Auth-Token", token)
req.Header.Add("Content-Type", "application/json")
resp, _ := client.Do(req)
data, _ := ioutil.ReadAll(resp.Body)
var userResponse = new(UserResponse)
err := json.Unmarshal(data, &userResponse)
if err != nil { if err != nil {
fmt.Println(err) t.Fatal(err)
} }
fmt.Println(userResponse.User.ID) req, err := http.NewRequest("POST", usersURL, bytes.NewBuffer(body))
return userResponse.User.ID if err != nil {
t.Fatal(err)
} }
func deleteUser(token, id string) {
client := &http.Client{}
deleteUserURI := userURL + id
fmt.Println(deleteUserURI)
req, _ := http.NewRequest("DELETE", deleteUserURI, nil)
req.Header.Set("X-Auth-Token", token) req.Header.Set("X-Auth-Token", token)
resp, _ := client.Do(req) req.Header.Add("Content-Type", "application/json")
fmt.Println(resp) resp, err := client.Do(req)
if err != nil {
t.Fatal(err)
}
data, err := ioutil.ReadAll(resp.Body)
if err != nil {
t.Fatal(err)
}
defer resp.Body.Close()
var userResp = new(userResponse)
err = json.Unmarshal(data, &userResp)
if err != nil {
t.Fatal(err)
}
return userResp.User.ID
} }
func createGroup(token, description, name string) string{ // delete group or user
func delete(t *testing.T, token, id, uri string) {
t.Helper()
client := &http.Client{} client := &http.Client{}
createGroupData := CreateGroup{ deleteURI := uri + id
CreateGroupForm{ req, err := http.NewRequest("DELETE", deleteURI, nil)
Description: description, if err != nil {
Name: name, t.Fatalf("error: %v", err)
}
req.Header.Set("X-Auth-Token", token)
client.Do(req)
}
func createGroup(t *testing.T, token, description, name string) string {
t.Helper()
client := &http.Client{}
createGroupData := map[string]interface{}{
"group": map[string]interface{}{
"name": name,
"description": description,
}, },
} }
body, _ := json.Marshal(createGroupData) body, err := json.Marshal(createGroupData)
req, _ := http.NewRequest("POST", groupURL, bytes.NewBuffer(body))
req.Header.Set("X-Auth-Token", token)
req.Header.Add("Content-Type", "application/json")
resp, _ := client.Do(req)
data, _ := ioutil.ReadAll(resp.Body)
var groupResponse = new(GroupID)
err := json.Unmarshal(data, &groupResponse)
if err != nil { if err != nil {
fmt.Println(err) t.Fatal(err)
} }
return groupResponse.Group.ID req, err := http.NewRequest("POST", groupsURL, bytes.NewBuffer(body))
} if err != nil {
t.Fatal(err)
func addUserToGroup(token, groupId, userId string) { }
uri := groupURL + groupId + "/users/" + userId
client := &http.Client{}
req, _ := http.NewRequest("PUT", uri, nil)
req.Header.Set("X-Auth-Token", token) req.Header.Set("X-Auth-Token", token)
resp, _ := client.Do(req) req.Header.Add("Content-Type", "application/json")
fmt.Println(resp) resp, err := client.Do(req)
if err != nil {
t.Fatal(err)
}
data, err := ioutil.ReadAll(resp.Body)
if err != nil {
t.Fatal(err)
}
defer resp.Body.Close()
var groupResp = new(groupResponse)
err = json.Unmarshal(data, &groupResp)
if err != nil {
t.Fatal(err)
}
return groupResp.Group.ID
} }
const adminUser = "demo" func addUserToGroup(t *testing.T, token, groupID, userID string) error {
const adminPass = "DEMO_PASS" t.Helper()
const invalidPass = "WRONG_PASS" uri := groupsURL + groupID + "/users/" + userID
client := &http.Client{}
const testUser = "test_user" req, err := http.NewRequest("PUT", uri, nil)
const testPass = "test_pass" if err != nil {
const testEmail = "test@example.com" return err
}
const domain = "default" req.Header.Set("X-Auth-Token", token)
client.Do(req)
return nil
}
func TestIncorrectCredentialsLogin(t *testing.T) { func TestIncorrectCredentialsLogin(t *testing.T) {
c := Connector{KeystoneHost: keystoneURL, Domain: domain, c := keystoneConnector{KeystoneHost: keystoneURL, Domain: testDomain,
KeystoneUsername: adminUser, KeystonePassword: adminPass} KeystoneUsername: adminUser, KeystonePassword: adminPass}
s := connector.Scopes{OfflineAccess: true, Groups: true} s := connector.Scopes{OfflineAccess: true, Groups: true}
_, validPW, _ := c.Login(context.Background(), s, adminUser, invalidPass) _, validPW, err := c.Login(context.Background(), s, adminUser, invalidPass)
if err != nil {
t.Fatal(err.Error())
}
if validPW { if validPW {
t.Fail() t.Fail()
} }
} }
func TestValidUserLogin(t *testing.T) { func TestValidUserLogin(t *testing.T) {
token := getAdminToken(adminUser, adminPass) token, _ := getAdminToken(t, adminUser, adminPass)
userID := createUser(token, testUser, testEmail, testPass) userID := createUser(t, token, testUser, testEmail, testPass)
c := Connector{KeystoneHost: keystoneURL, Domain: domain, c := keystoneConnector{KeystoneHost: keystoneURL, Domain: testDomain,
KeystoneUsername: adminUser, KeystonePassword: adminPass} KeystoneUsername: adminUser, KeystonePassword: adminPass}
s := connector.Scopes{OfflineAccess: true, Groups: true} s := connector.Scopes{OfflineAccess: true, Groups: true}
_, validPW, _ := c.Login(context.Background(), s, testUser, testPass) identity, validPW, err := c.Login(context.Background(), s, testUser, testPass)
if !validPW { if err != nil {
t.Fail() t.Fatal(err.Error())
} }
deleteUser(token, userID) t.Log(identity)
if !validPW {
t.Fail()
}
delete(t, token, userID, usersURL)
} }
func TestUseRefreshToken(t *testing.T) { func TestUseRefreshToken(t *testing.T) {
t.Fatal("Not implemented") token, adminID := getAdminToken(t, adminUser, adminPass)
groupID := createGroup(t, token, "Test group description", testGroup)
addUserToGroup(t, token, groupID, adminID)
c := keystoneConnector{KeystoneHost: keystoneURL, Domain: testDomain,
KeystoneUsername: adminUser, KeystonePassword: adminPass}
s := connector.Scopes{OfflineAccess: true, Groups: true}
identityLogin, _, err := c.Login(context.Background(), s, adminUser, adminPass)
if err != nil {
t.Fatal(err.Error())
}
identityRefresh, err := c.Refresh(context.Background(), s, identityLogin)
if err != nil {
t.Fatal(err.Error())
}
delete(t, token, groupID, groupsURL)
expectEquals(t, 1, len(identityRefresh.Groups))
expectEquals(t, testGroup, string(identityRefresh.Groups[0]))
} }
func TestUseRefreshTokenUserDeleted(t *testing.T){ func TestUseRefreshTokenUserDeleted(t *testing.T) {
t.Fatal("Not implemented") token, _ := getAdminToken(t, adminUser, adminPass)
userID := createUser(t, token, testUser, testEmail, testPass)
c := keystoneConnector{KeystoneHost: keystoneURL, Domain: testDomain,
KeystoneUsername: adminUser, KeystonePassword: adminPass}
s := connector.Scopes{OfflineAccess: true, Groups: true}
identityLogin, _, err := c.Login(context.Background(), s, testUser, testPass)
if err != nil {
t.Fatal(err.Error())
}
_, err = c.Refresh(context.Background(), s, identityLogin)
if err != nil {
t.Fatal(err.Error())
}
delete(t, token, userID, usersURL)
_, err = c.Refresh(context.Background(), s, identityLogin)
if !strings.Contains(err.Error(), "does not exist") {
t.Errorf("unexpected error: %s", err.Error())
}
} }
func TestUseRefreshTokenGroupsChanged(t *testing.T){ func TestUseRefreshTokenGroupsChanged(t *testing.T) {
t.Fatal("Not implemented") token, _ := getAdminToken(t, adminUser, adminPass)
userID := createUser(t, token, testUser, testEmail, testPass)
c := keystoneConnector{KeystoneHost: keystoneURL, Domain: testDomain,
KeystoneUsername: adminUser, KeystonePassword: adminPass}
s := connector.Scopes{OfflineAccess: true, Groups: true}
identityLogin, _, err := c.Login(context.Background(), s, testUser, testPass)
if err != nil {
t.Fatal(err.Error())
}
identityRefresh, err := c.Refresh(context.Background(), s, identityLogin)
if err != nil {
t.Fatal(err.Error())
}
expectEquals(t, 0, len(identityRefresh.Groups))
groupID := createGroup(t, token, "Test group description", testGroup)
addUserToGroup(t, token, groupID, userID)
identityRefresh, err = c.Refresh(context.Background(), s, identityLogin)
if err != nil {
t.Fatal(err.Error())
}
delete(t, token, groupID, groupsURL)
delete(t, token, userID, usersURL)
expectEquals(t, 1, len(identityRefresh.Groups))
} }
func TestMain(m *testing.M) { func TestMain(m *testing.M) {
dockerID := startKeystoneContainer() keystoneURLEnv := "DEX_KEYSTONE_URL"
repeats := 10 keystoneAdminURLEnv := "DEX_KEYSTONE_ADMIN_URL"
running := false keystoneURL = os.Getenv(keystoneURLEnv)
for i := 0; i < repeats; i++ { if keystoneURL == "" {
_, err := http.Get(keystoneURL) fmt.Printf("variable %q not set, skipping keystone connector tests\n", keystoneURLEnv)
if err == nil { return
running = true }
break keystoneAdminURL := os.Getenv(keystoneAdminURLEnv)
} if keystoneAdminURL == "" {
time.Sleep(10 * time.Second) fmt.Printf("variable %q not set, skipping keystone connector tests\n", keystoneAdminURLEnv)
} return
if !running { }
fmt.Printf("Failed to start keystone container") authTokenURL = keystoneURL + "/v3/auth/tokens/"
os.Exit(1) fmt.Printf("Auth token url %q\n", authTokenURL)
} fmt.Printf("Keystone URL %q\n", keystoneURL)
defer cleanKeystoneContainer(dockerID) usersURL = keystoneAdminURL + "/v3/users/"
// run all tests groupsURL = keystoneAdminURL + "/v3/groups/"
// run all tests
m.Run() m.Run()
} }
func expectEquals(t *testing.T, a interface{}, b interface{}) {
if !reflect.DeepEqual(a, b) {
t.Errorf("Expected %v to be equal %v", a, b)
}
}

141
connector/keystone/types.go
View File

@@ -4,133 +4,84 @@ import (
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
) )
type Connector struct { type keystoneConnector struct {
Domain string Domain string
KeystoneHost string KeystoneHost string
KeystoneUsername string KeystoneUsername string
KeystonePassword string KeystonePassword string
Logger logrus.FieldLogger Logger logrus.FieldLogger
} }
type ConnectorData struct { type userKeystone struct {
AccessToken string `json:"accessToken"` Domain domainKeystone `json:"domain"`
ID string `json:"id"`
Name string `json:"name"`
} }
type KeystoneUser struct { type domainKeystone struct {
Domain KeystoneDomain `json:"domain"` ID string `json:"id"`
ID string `json:"id"`
Name string `json:"name"`
}
type KeystoneDomain struct {
ID string `json:"id"`
Name string `json:"name"` Name string `json:"name"`
} }
// Config holds the configuration parameters for Keystone connector.
// Keystone should expose API v3
// An example config:
// connectors:
// type: keystone
// id: keystone
// name: Keystone
// config:
// keystoneHost: http://example:5000
// domain: default
// keystoneUsername: demo
// keystonePassword: DEMO_PASS
type Config struct { type Config struct {
Domain string `json:"domain"` Domain string `json:"domain"`
KeystoneHost string `json:"keystoneHost"` KeystoneHost string `json:"keystoneHost"`
KeystoneUsername string `json:"keystoneUsername"` KeystoneUsername string `json:"keystoneUsername"`
KeystonePassword string `json:"keystonePassword"` KeystonePassword string `json:"keystonePassword"`
} }
type LoginRequestData struct { type loginRequestData struct {
Auth `json:"auth"` auth `json:"auth"`
} }
type Auth struct { type auth struct {
Identity `json:"identity"` Identity identity `json:"identity"`
} }
type Identity struct { type identity struct {
Methods []string `json:"methods"` Methods []string `json:"methods"`
Password `json:"password"` Password password `json:"password"`
} }
type Password struct { type password struct {
User `json:"user"` User user `json:"user"`
} }
type User struct { type user struct {
Name string `json:"name"`
Domain `json:"domain"`
Password string `json:"password"`
}
type Domain struct {
ID string `json:"id"`
}
type Token struct {
IssuedAt string `json:"issued_at"`
Extras map[string]interface{} `json:"extras"`
Methods []string `json:"methods"`
ExpiresAt string `json:"expires_at"`
User KeystoneUser `json:"user"`
}
type TokenResponse struct {
Token Token `json:"token"`
}
type CreateUserRequest struct {
CreateUser CreateUserForm `json:"user"`
}
type CreateUserForm struct {
Name string `json:"name"` Name string `json:"name"`
Email string `json:"email"` Domain domain `json:"domain"`
Enabled bool `json:"enabled"`
Password string `json:"password"` Password string `json:"password"`
Roles []string `json:"roles"`
} }
type UserResponse struct { type domain struct {
User CreateUserResponse `json:"user"`
}
type CreateUserResponse struct {
Username string `json:"username"`
Name string `json:"name"`
Roles []string `json:"roles"`
Enabled bool `json:"enabled"`
Options string `json:"options"`
ID string `json:"id"`
Email string `json:"email"`
}
type CreateGroup struct {
Group CreateGroupForm `json:"group"`
}
type CreateGroupForm struct {
Description string `json:"description"`
Name string `json:"name"`
}
type GroupID struct {
Group GroupIDForm `json:"group"`
}
type GroupIDForm struct {
ID string `json:"id"` ID string `json:"id"`
} }
type Links struct { type token struct {
Self string `json:"self"` User userKeystone `json:"user"`
Previous string `json:"previous"`
Next string `json:"next"`
} }
type Group struct { type tokenResponse struct {
DomainID string `json:"domain_id` Token token `json:"token"`
Description string `json:"description"`
ID string `json:"id"`
Links Links `json:"links"`
Name string `json:"name"`
} }
type GroupsResponse struct { type group struct {
Links Links `json:"links"` ID string `json:"id"`
Groups []Group `json:"groups"` Name string `json:"name"`
}
type groupsResponse struct {
Groups []group `json:"groups"`
} }

55
examples/config-keystone.yaml
View File

@@ -1,55 +0,0 @@
# The base path of dex and the external name of the OpenID Connect service.
# This is the canonical URL that all clients MUST use to refer to dex. If a
# path is provided, dex's HTTP service will listen at a non-root URL.
issuer: http://0.0.0.0:5556/dex
# The storage configuration determines where dex stores its state. Supported
# options include SQL flavors and Kubernetes third party resources.
#
# See the storage document at Documentation/storage.md for further information.
storage:
type: sqlite3
config:
file: examples/dex.db #be in the dex directory, else change path here
# Configuration for the HTTP endpoints.
web:
https: 0.0.0.0:5556
# Uncomment for HTTPS options.
# https: 127.0.0.1:5554
tlsCert: ./ssl/dex.crt
tlsKey: ./ssl/dex.key
# Configuration for telemetry
telemetry:
http: 0.0.0.0:5558
oauth2:
responseTypes: ["id_token"]
# Instead of reading from an external storage, use this list of clients.
staticClients:
- id: example-app
redirectURIs:
- 'http://127.0.0.1:5555/callback'
name: 'Example App'
secret: ZXhhbXBsZS1hcHAtc2VjcmV0
#Provide Keystone connector and its config here
# /v3/auth/tokens
connectors:
- type: keystone
id: keystone
name: Keystone
config:
keystoneHost: http://localhost:5000
domain: default
keystoneUsername: demo
keystonePassword: DEMO_PASS
# Let dex keep a list of passwords which can be used to login to dex.
enablePasswordDB: true
oauth2:
skipApprovalScreen: true

6
server/handlers.go
View File

@@ -211,7 +211,6 @@ func (s *Server) handleConnectorLogin(w http.ResponseWriter, r *http.Request) {
} }
authReqID := r.FormValue("req") authReqID := r.FormValue("req")
s.logger.Errorf("Auth req id %v", authReqID)
authReq, err := s.storage.GetAuthRequest(authReqID) authReq, err := s.storage.GetAuthRequest(authReqID)
if err != nil { if err != nil {
@@ -346,7 +345,7 @@ func (s *Server) handleConnectorCallback(w http.ResponseWriter, r *http.Request)
s.renderError(w, http.StatusInternalServerError, "Requested resource does not exist.") s.renderError(w, http.StatusInternalServerError, "Requested resource does not exist.")
return return
} }
s.logger.Errorf("2Failed to get auth request: %v", err) s.logger.Errorf("Failed to get auth request: %v", err)
s.renderError(w, http.StatusInternalServerError, "Database error.") s.renderError(w, http.StatusInternalServerError, "Database error.")
return return
} }
@@ -358,7 +357,6 @@ func (s *Server) handleConnectorCallback(w http.ResponseWriter, r *http.Request)
} }
conn, err := s.getConnector(authReq.ConnectorID) conn, err := s.getConnector(authReq.ConnectorID)
s.logger.Errorf("X Connector %v", conn)
if err != nil { if err != nil {
s.logger.Errorf("Failed to get connector with id %q : %v", authReq.ConnectorID, err) s.logger.Errorf("Failed to get connector with id %q : %v", authReq.ConnectorID, err)
s.renderError(w, http.StatusInternalServerError, "Requested resource does not exist.") s.renderError(w, http.StatusInternalServerError, "Requested resource does not exist.")
@@ -437,7 +435,7 @@ func (s *Server) finalizeLogin(identity connector.Identity, authReq storage.Auth
func (s *Server) handleApproval(w http.ResponseWriter, r *http.Request) { func (s *Server) handleApproval(w http.ResponseWriter, r *http.Request) {
authReq, err := s.storage.GetAuthRequest(r.FormValue("req")) authReq, err := s.storage.GetAuthRequest(r.FormValue("req"))
if err != nil { if err != nil {
s.logger.Errorf("3Failed to get auth request: %v", err) s.logger.Errorf("Failed to get auth request: %v", err)
s.renderError(w, http.StatusInternalServerError, "Database error.") s.renderError(w, http.StatusInternalServerError, "Database error.")
return return
} }

4
server/server.go
View File

@@ -27,6 +27,7 @@ import (
"github.com/dexidp/dex/connector/bitbucketcloud" "github.com/dexidp/dex/connector/bitbucketcloud"
"github.com/dexidp/dex/connector/github" "github.com/dexidp/dex/connector/github"
"github.com/dexidp/dex/connector/gitlab" "github.com/dexidp/dex/connector/gitlab"
"github.com/dexidp/dex/connector/keystone"
"github.com/dexidp/dex/connector/ldap" "github.com/dexidp/dex/connector/ldap"
"github.com/dexidp/dex/connector/linkedin" "github.com/dexidp/dex/connector/linkedin"
"github.com/dexidp/dex/connector/microsoft" "github.com/dexidp/dex/connector/microsoft"
@@ -34,7 +35,6 @@ import (
"github.com/dexidp/dex/connector/oidc" "github.com/dexidp/dex/connector/oidc"
"github.com/dexidp/dex/connector/saml" "github.com/dexidp/dex/connector/saml"
"github.com/dexidp/dex/storage" "github.com/dexidp/dex/storage"
"github.com/dexidp/dex/connector/keystone"
) )
// LocalConnector is the local passwordDB connector which is an internal // LocalConnector is the local passwordDB connector which is an internal
@@ -456,7 +456,7 @@ func openConnector(logger logrus.FieldLogger, conn storage.Connector) (connector
f, ok := ConnectorsConfig[conn.Type] f, ok := ConnectorsConfig[conn.Type]
if !ok { if !ok {
return c, fmt.Errorf("xunknown connector type %q", conn.Type) return c, fmt.Errorf("unknown connector type %q", conn.Type)
} }
connConfig := f() connConfig := f()

1
storage/static.go
View File

@@ -3,6 +3,7 @@ package storage
import ( import (
"errors" "errors"
"strings" "strings"
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
) )