package oidcauth import ( "strings" "testing" "time" "github.com/coreos/go-oidc" "github.com/hashicorp/consul/internal/go-sso/oidcauth/oidcauthtest" "github.com/stretchr/testify/require" ) func TestConfigValidate(t *testing.T) { type testcase struct { config Config expectAuthType int expectErr string } srv := oidcauthtest.Start(t) oidcCases := map[string]testcase{ "all required": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, }, expectAuthType: authOIDCFlow, }, "missing required OIDCDiscoveryURL": { config: Config{ Type: TypeOIDC, // OIDCDiscoveryURL: srv.Addr(), // OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, }, expectErr: "must be set for type", }, "missing required OIDCClientID": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), // OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, }, expectErr: "must be set for type", }, "missing required OIDCClientSecret": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", // OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, }, expectErr: "must be set for type", }, "missing required AllowedRedirectURIs": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{}, }, expectErr: "must be set for type", }, "incompatible with JWKSURL": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, JWKSURL: srv.Addr() + "/certs", }, expectErr: "must not be set for type", }, "incompatible with JWKSCACert": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, JWKSCACert: srv.CACert(), }, expectErr: "must not be set for type", }, "incompatible with JWTValidationPubKeys": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, JWTValidationPubKeys: []string{testJWTPubKey}, }, expectErr: "must not be set for type", }, "incompatible with BoundIssuer": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, BoundIssuer: "foo", }, expectErr: "must not be set for type", }, "incompatible with ExpirationLeeway": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, ExpirationLeeway: 1 * time.Second, }, expectErr: "must not be set for type", }, "incompatible with NotBeforeLeeway": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, NotBeforeLeeway: 1 * time.Second, }, expectErr: "must not be set for type", }, "incompatible with ClockSkewLeeway": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, ClockSkewLeeway: 1 * time.Second, }, expectErr: "must not be set for type", }, "bad discovery cert": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: oidcBadCACerts, OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, }, expectErr: "certificate signed by unknown authority", }, "garbage discovery cert": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: garbageCACert, OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, }, expectErr: "could not parse CA PEM value successfully", }, "good discovery cert": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, }, expectAuthType: authOIDCFlow, }, "valid redirect uris": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{ "http://foo.test", "https://example.com", "https://evilcorp.com:8443", }, }, expectAuthType: authOIDCFlow, }, "invalid redirect uris": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{ "%%%%", "http://foo.test", "https://example.com", "https://evilcorp.com:8443", }, }, expectErr: "Invalid AllowedRedirectURIs provided: [%%%%]", }, "valid algorithm": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, JWTSupportedAlgs: []string{ oidc.RS256, oidc.RS384, oidc.RS512, oidc.ES256, oidc.ES384, oidc.ES512, oidc.PS256, oidc.PS384, oidc.PS512, }, }, expectAuthType: authOIDCFlow, }, "invalid algorithm": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, JWTSupportedAlgs: []string{ oidc.RS256, oidc.RS384, oidc.RS512, oidc.ES256, oidc.ES384, oidc.ES512, oidc.PS256, oidc.PS384, oidc.PS512, "foo", }, }, expectErr: "Invalid supported algorithm", }, "valid claim mappings": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, ClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, ListClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, }, expectAuthType: authOIDCFlow, }, "invalid repeated value claim mappings": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, ClaimMappings: map[string]string{ "foo": "bar", "bling": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, ListClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, }, expectErr: "ClaimMappings contains multiple mappings for key", }, "invalid repeated list claim mappings": { config: Config{ Type: TypeOIDC, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), OIDCClientID: "abc", OIDCClientSecret: "def", AllowedRedirectURIs: []string{"http://foo.test"}, ClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, ListClaimMappings: map[string]string{ "foo": "bar", "bling": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, }, expectErr: "ListClaimMappings contains multiple mappings for key", }, } jwtCases := map[string]testcase{ "all required for oidc discovery": { config: Config{ Type: TypeJWT, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), }, expectAuthType: authOIDCDiscovery, }, "all required for jwks": { config: Config{ Type: TypeJWT, JWKSURL: srv.Addr() + "/certs", JWKSCACert: srv.CACert(), // needed to avoid self signed cert issue }, expectAuthType: authJWKS, }, "all required for public keys": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, }, expectAuthType: authStaticKeys, }, "incompatible with OIDCClientID": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, OIDCClientID: "abc", }, expectErr: "must not be set for type", }, "incompatible with OIDCClientSecret": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, OIDCClientSecret: "abc", }, expectErr: "must not be set for type", }, "incompatible with OIDCScopes": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, OIDCScopes: []string{"blah"}, }, expectErr: "must not be set for type", }, "incompatible with OIDCACRValues": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, OIDCACRValues: []string{"acr1"}, }, expectErr: "must not be set for type", }, "incompatible with AllowedRedirectURIs": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, AllowedRedirectURIs: []string{"http://foo.test"}, }, expectErr: "must not be set for type", }, "incompatible with VerboseOIDCLogging": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, VerboseOIDCLogging: true, }, expectErr: "must not be set for type", }, "too many methods (discovery + jwks)": { config: Config{ Type: TypeJWT, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), JWKSURL: srv.Addr() + "/certs", JWKSCACert: srv.CACert(), // JWTValidationPubKeys: []string{testJWTPubKey}, }, expectErr: "exactly one of", }, "too many methods (discovery + pubkeys)": { config: Config{ Type: TypeJWT, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), // JWKSURL: srv.Addr() + "/certs", // JWKSCACert: srv.CACert(), JWTValidationPubKeys: []string{testJWTPubKey}, }, expectErr: "exactly one of", }, "too many methods (jwks + pubkeys)": { config: Config{ Type: TypeJWT, // OIDCDiscoveryURL: srv.Addr(), // OIDCDiscoveryCACert: srv.CACert(), JWKSURL: srv.Addr() + "/certs", JWKSCACert: srv.CACert(), JWTValidationPubKeys: []string{testJWTPubKey}, }, expectErr: "exactly one of", }, "too many methods (discovery + jwks + pubkeys)": { config: Config{ Type: TypeJWT, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), JWKSURL: srv.Addr() + "/certs", JWKSCACert: srv.CACert(), JWTValidationPubKeys: []string{testJWTPubKey}, }, expectErr: "exactly one of", }, "incompatible with JWKSCACert": { config: Config{ Type: TypeJWT, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), JWKSCACert: srv.CACert(), }, expectErr: "should not be set unless", }, "invalid pubkey": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKeyBad}, }, expectErr: "error parsing public key", }, "incompatible with OIDCDiscoveryCACert": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, OIDCDiscoveryCACert: srv.CACert(), }, expectErr: "should not be set unless", }, "bad discovery cert": { config: Config{ Type: TypeJWT, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: oidcBadCACerts, }, expectErr: "certificate signed by unknown authority", }, "good discovery cert": { config: Config{ Type: TypeJWT, OIDCDiscoveryURL: srv.Addr(), OIDCDiscoveryCACert: srv.CACert(), }, expectAuthType: authOIDCDiscovery, }, "jwks invalid 404": { config: Config{ Type: TypeJWT, JWKSURL: srv.Addr() + "/certs_missing", JWKSCACert: srv.CACert(), }, expectErr: "get keys failed", }, "jwks mismatched certs": { config: Config{ Type: TypeJWT, JWKSURL: srv.Addr() + "/certs_invalid", JWKSCACert: srv.CACert(), }, expectErr: "failed to decode keys", }, "jwks bad certs": { config: Config{ Type: TypeJWT, JWKSURL: srv.Addr() + "/certs_invalid", JWKSCACert: garbageCACert, }, expectErr: "could not parse CA PEM value successfully", }, "valid algorithm": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, JWTSupportedAlgs: []string{ oidc.RS256, oidc.RS384, oidc.RS512, oidc.ES256, oidc.ES384, oidc.ES512, oidc.PS256, oidc.PS384, oidc.PS512, }, }, expectAuthType: authStaticKeys, }, "invalid algorithm": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, JWTSupportedAlgs: []string{ oidc.RS256, oidc.RS384, oidc.RS512, oidc.ES256, oidc.ES384, oidc.ES512, oidc.PS256, oidc.PS384, oidc.PS512, "foo", }, }, expectErr: "Invalid supported algorithm", }, "valid claim mappings": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, ClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, ListClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, }, expectAuthType: authStaticKeys, }, "invalid repeated value claim mappings": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, ClaimMappings: map[string]string{ "foo": "bar", "bling": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, ListClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, }, expectErr: "ClaimMappings contains multiple mappings for key", }, "invalid repeated list claim mappings": { config: Config{ Type: TypeJWT, JWTValidationPubKeys: []string{testJWTPubKey}, ClaimMappings: map[string]string{ "foo": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, ListClaimMappings: map[string]string{ "foo": "bar", "bling": "bar", "peanutbutter": "jelly", "wd40": "ducttape", }, }, expectErr: "ListClaimMappings contains multiple mappings for key", }, } cases := map[string]testcase{ "bad type": { config: Config{Type: "invalid"}, expectErr: "authenticator type should be", }, } for k, v := range oidcCases { cases["type=oidc/"+k] = v v2 := v v2.config.Type = "" cases["type=inferred_oidc/"+k] = v2 } for k, v := range jwtCases { cases["type=jwt/"+k] = v } for name, tc := range cases { tc := tc t.Run(name, func(t *testing.T) { err := tc.config.Validate() if tc.expectErr != "" { require.Error(t, err) requireErrorContains(t, err, tc.expectErr) } else { require.NoError(t, err) require.Equal(t, tc.expectAuthType, tc.config.authType()) } }) } } func requireErrorContains(t *testing.T, err error, expectedErrorMessage string) { t.Helper() if err == nil { t.Fatal("An error is expected but got nil.") } if !strings.Contains(err.Error(), expectedErrorMessage) { t.Fatalf("unexpected error: %v", err) } } const ( testJWTPubKey = `-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEVs/o5+uQbTjL3chynL4wXgUg2R9 q9UU8I5mEovUf86QZ7kOBIjJwqnzD1omageEHWwHdBO6B+dFabmdT9POxg== -----END PUBLIC KEY-----` testJWTPubKeyBad = `-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIrollingyourricksEVs/o5+uQbTjL3chynL4wXgUg2R9 q9UU8I5mEovUf86QZ7kOBIjJwqnzD1omageEHWwHdBO6B+dFabmdT9POxg== -----END PUBLIC KEY-----` garbageCACert = `this is not a key` oidcBadCACerts = `-----BEGIN CERTIFICATE----- MIIDYDCCAkigAwIBAgIJAK8uAVsPxWKGMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX aWRnaXRzIFB0eSBMdGQwHhcNMTgwNzA5MTgwODI5WhcNMjgwNzA2MTgwODI5WjBF MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50 ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEA1eaEmIHKQqDlSadCtg6YY332qIMoeSb2iZTRhBRYBXRhMIKF3HoLXlI8 /3veheMnBQM7zxIeLwtJ4VuZVZcpJlqHdsXQVj6A8+8MlAzNh3+Xnv0tjZ83QLwZ D6FWvMEzihxATD9uTCu2qRgeKnMYQFq4EG72AGb5094zfsXTAiwCfiRPVumiNbs4 Mr75vf+2DEhqZuyP7GR2n3BKzrWo62yAmgLQQ07zfd1u1buv8R72HCYXYpFul5qx slZHU3yR+tLiBKOYB+C/VuB7hJZfVx25InIL1HTpIwWvmdk3QzpSpAGIAxWMXSzS oRmBYGnsgR6WTymfXuokD4ZhHOpFZQIDAQABo1MwUTAdBgNVHQ4EFgQURh/QFJBn hMXcgB1bWbGiU9B2VBQwHwYDVR0jBBgwFoAURh/QFJBnhMXcgB1bWbGiU9B2VBQw DwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAr8CZLA3MQjMDWweS ax9S1fRb8ifxZ4RqDcLj3dw5KZqnjEo8ggczR66T7vVXet/2TFBKYJAM0np26Z4A WjZfrDT7/bHXseWQAUhw/k2d39o+Um4aXkGpg1Paky9D+ddMdbx1hFkYxDq6kYGd PlBYSEiYQvVxDx7s7H0Yj9FWKO8WIO6BRUEvLlG7k/Xpp1OI6dV3nqwJ9CbcbqKt ff4hAtoAmN0/x6yFclFFWX8s7bRGqmnoj39/r98kzeGFb/lPKgQjSVcBJuE7UO4k 8HP6vsnr/ruSlzUMv6XvHtT68kGC1qO3MfqiPhdSa4nxf9g/1xyBmAw/Uf90BJrm sj9DpQ== -----END CERTIFICATE-----` )