484 lines
19 KiB
Go
484 lines
19 KiB
Go
package iamauth
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestNewBearerToken(t *testing.T) {
|
|
cases := map[string]struct {
|
|
tokenStr string
|
|
config Config
|
|
expToken BearerToken
|
|
expError string
|
|
}{
|
|
"valid token": {
|
|
tokenStr: validBearerTokenJson,
|
|
expToken: validBearerTokenParsed,
|
|
},
|
|
"valid token with role": {
|
|
tokenStr: validBearerTokenWithRoleJson,
|
|
config: Config{
|
|
EnableIAMEntityDetails: true,
|
|
GetEntityMethodHeader: "X-Consul-IAM-GetEntity-Method",
|
|
GetEntityURLHeader: "X-Consul-IAM-GetEntity-URL",
|
|
GetEntityHeadersHeader: "X-Consul-IAM-GetEntity-Headers",
|
|
GetEntityBodyHeader: "X-Consul-IAM-GetEntity-Body",
|
|
STSEndpoint: validBearerTokenParsed.getCallerIdentityURL,
|
|
},
|
|
expToken: validBearerTokenWithRoleParsed,
|
|
},
|
|
|
|
"empty json": {
|
|
tokenStr: `{}`,
|
|
expError: "unexpected end of JSON input",
|
|
},
|
|
"missing iam_request_method field": {
|
|
tokenStr: tokenJsonMissingMethodField,
|
|
expError: "iam_http_request_method must be POST",
|
|
},
|
|
"missing iam_request_url field": {
|
|
tokenStr: tokenJsonMissingUrlField,
|
|
expError: "url is invalid",
|
|
},
|
|
"missing iam_request_headers field": {
|
|
tokenStr: tokenJsonMissingHeadersField,
|
|
expError: "unexpected end of JSON input",
|
|
},
|
|
"missing iam_request_body field": {
|
|
tokenStr: tokenJsonMissingBodyField,
|
|
expError: "iam_request_body error",
|
|
},
|
|
"invalid json": {
|
|
tokenStr: `{`,
|
|
expError: "unexpected end of JSON input",
|
|
},
|
|
}
|
|
for name, c := range cases {
|
|
t.Run(name, func(t *testing.T) {
|
|
token, err := NewBearerToken(c.tokenStr, &c.config)
|
|
t.Logf("token = %+v", token)
|
|
if c.expError != "" {
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), c.expError)
|
|
require.Nil(t, token)
|
|
} else {
|
|
require.NoError(t, err)
|
|
c.expToken.config = &c.config
|
|
require.Equal(t, &c.expToken, token)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseRequestBody(t *testing.T) {
|
|
cases := map[string]struct {
|
|
body string
|
|
allowedValues url.Values
|
|
expValues url.Values
|
|
expError string
|
|
}{
|
|
"one allowed field": {
|
|
body: "Action=GetCallerIdentity&Version=1234",
|
|
allowedValues: url.Values{"Version": []string{"1234"}},
|
|
expValues: url.Values{
|
|
"Action": []string{"GetCallerIdentity"},
|
|
"Version": []string{"1234"},
|
|
},
|
|
},
|
|
"many allowed fields": {
|
|
body: "Action=GetRole&RoleName=my-role&Version=1234",
|
|
allowedValues: url.Values{
|
|
"Action": []string{"GetUser", "GetRole"},
|
|
"UserName": nil,
|
|
"RoleName": nil,
|
|
"Version": nil,
|
|
},
|
|
expValues: url.Values{
|
|
"Action": []string{"GetRole"},
|
|
"RoleName": []string{"my-role"},
|
|
"Version": []string{"1234"},
|
|
},
|
|
},
|
|
"action only": {
|
|
body: "Action=GetRole",
|
|
allowedValues: nil,
|
|
expValues: url.Values{"Action": []string{"GetRole"}},
|
|
},
|
|
|
|
"empty body": {
|
|
expValues: url.Values{},
|
|
expError: `missing field "Action"`,
|
|
},
|
|
"disallowed field": {
|
|
body: "Action=GetRole&Version=1234&Extra=Abc",
|
|
allowedValues: url.Values{"Action": nil, "Version": nil},
|
|
expError: `unexpected field "Extra"`,
|
|
},
|
|
"mismatched action": {
|
|
body: "Action=GetRole",
|
|
allowedValues: url.Values{"Action": []string{"GetUser"}},
|
|
expError: `unexpected value Action=[GetRole]`,
|
|
},
|
|
"mismatched field": {
|
|
body: "Action=GetRole&Extra=1234",
|
|
allowedValues: url.Values{"Action": nil, "Extra": []string{"abc"}},
|
|
expError: `unexpected value Extra=[1234]`,
|
|
},
|
|
"multi-valued field": {
|
|
body: "Action=GetRole&Action=GetUser",
|
|
allowedValues: url.Values{"Action": []string{"GetRole", "GetUser"}},
|
|
// only one value is allowed.
|
|
expError: `unexpected value Action=[GetRole GetUser]`,
|
|
},
|
|
"empty action": {
|
|
body: "Action=",
|
|
allowedValues: nil,
|
|
expError: `missing field "Action"`,
|
|
},
|
|
"missing action": {
|
|
body: "Version=1234",
|
|
allowedValues: url.Values{"Action": []string{"GetRole"}},
|
|
expError: `missing field "Action"`,
|
|
},
|
|
}
|
|
for name, c := range cases {
|
|
t.Run(name, func(t *testing.T) {
|
|
values, err := parseRequestBody(c.body, c.allowedValues)
|
|
if c.expError != "" {
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), c.expError)
|
|
require.Nil(t, values)
|
|
} else {
|
|
require.NoError(t, err)
|
|
require.Equal(t, c.expValues, values)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidateGetCallerIdentityBody(t *testing.T) {
|
|
cases := map[string]struct {
|
|
body string
|
|
expError string
|
|
}{
|
|
"valid": {"Action=GetCallerIdentity&Version=1234", ""},
|
|
"valid 2": {"Action=GetCallerIdentity", ""},
|
|
"empty action": {
|
|
"Action=",
|
|
`iam_request_body error: missing field "Action"`,
|
|
},
|
|
"invalid action": {
|
|
"Action=GetRole",
|
|
`iam_request_body error: unexpected value Action=[GetRole]`,
|
|
},
|
|
"missing action": {
|
|
"Version=1234",
|
|
`iam_request_body error: missing field "Action"`,
|
|
},
|
|
"empty": {
|
|
"",
|
|
`iam_request_body error: missing field "Action"`,
|
|
},
|
|
}
|
|
for name, c := range cases {
|
|
t.Run(name, func(t *testing.T) {
|
|
token := &BearerToken{getCallerIdentityBody: c.body}
|
|
err := token.validateGetCallerIdentityBody()
|
|
if c.expError != "" {
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), c.expError)
|
|
} else {
|
|
require.NoError(t, err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidateIAMEntityBody(t *testing.T) {
|
|
cases := map[string]struct {
|
|
body string
|
|
expReqType string
|
|
expError string
|
|
}{
|
|
"valid role": {
|
|
body: "Action=GetRole&RoleName=my-role&Version=1234",
|
|
expReqType: "GetRole",
|
|
},
|
|
"valid role without version": {
|
|
body: "Action=GetRole&RoleName=my-role",
|
|
expReqType: "GetRole",
|
|
},
|
|
"valid user": {
|
|
body: "Action=GetUser&UserName=my-role&Version=1234",
|
|
expReqType: "GetUser",
|
|
},
|
|
"valid user without version": {
|
|
body: "Action=GetUser&UserName=my-role",
|
|
expReqType: "GetUser",
|
|
},
|
|
|
|
"invalid action": {
|
|
body: "Action=GetCallerIdentity",
|
|
expError: `unexpected value Action=[GetCallerIdentity]`,
|
|
},
|
|
"role missing action": {
|
|
body: "RoleName=my-role&Version=1234",
|
|
expError: `missing field "Action"`,
|
|
},
|
|
"user missing action": {
|
|
body: "UserName=my-role&Version=1234",
|
|
expError: `missing field "Action"`,
|
|
},
|
|
"empty": {
|
|
body: "",
|
|
expError: `missing field "Action"`,
|
|
},
|
|
"empty action": {
|
|
body: "Action=",
|
|
expError: `missing field "Action"`,
|
|
},
|
|
"role with user name": {
|
|
body: "Action=GetRole&UserName=my-role&Version=1234",
|
|
expError: `invalid request body`,
|
|
},
|
|
"user with role name": {
|
|
body: "Action=GetUser&RoleName=my-role&Version=1234",
|
|
expError: `invalid request body`,
|
|
},
|
|
}
|
|
for name, c := range cases {
|
|
t.Run(name, func(t *testing.T) {
|
|
token := &BearerToken{
|
|
config: &Config{},
|
|
getIAMEntityBody: c.body,
|
|
}
|
|
reqType, err := token.validateIAMEntityBody()
|
|
if c.expError != "" {
|
|
require.Error(t, err)
|
|
require.Contains(t, err.Error(), c.expError)
|
|
require.Equal(t, "", reqType)
|
|
} else {
|
|
require.NoError(t, err)
|
|
require.Equal(t, c.expReqType, reqType)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidateSTSHostname(t *testing.T) {
|
|
cases := []struct {
|
|
url string
|
|
ok bool
|
|
}{
|
|
// https://docs.aws.amazon.com/general/latest/gr/sts.html
|
|
{"sts.us-east-2.amazonaws.com", true},
|
|
{"sts-fips.us-east-2.amazonaws.com", true},
|
|
{"sts.us-east-1.amazonaws.com", true},
|
|
{"sts-fips.us-east-1.amazonaws.com", true},
|
|
{"sts.us-west-1.amazonaws.com", true},
|
|
{"sts-fips.us-west-1.amazonaws.com", true},
|
|
{"sts.us-west-2.amazonaws.com", true},
|
|
{"sts-fips.us-west-2.amazonaws.com", true},
|
|
{"sts.af-south-1.amazonaws.com", true},
|
|
{"sts.ap-east-1.amazonaws.com", true},
|
|
{"sts.ap-southeast-3.amazonaws.com", true},
|
|
{"sts.ap-south-1.amazonaws.com", true},
|
|
{"sts.ap-northeast-3.amazonaws.com", true},
|
|
{"sts.ap-northeast-2.amazonaws.com", true},
|
|
{"sts.ap-southeast-1.amazonaws.com", true},
|
|
{"sts.ap-southeast-2.amazonaws.com", true},
|
|
{"sts.ap-northeast-1.amazonaws.com", true},
|
|
{"sts.ca-central-1.amazonaws.com", true},
|
|
{"sts.eu-central-1.amazonaws.com", true},
|
|
{"sts.eu-west-1.amazonaws.com", true},
|
|
{"sts.eu-west-2.amazonaws.com", true},
|
|
{"sts.eu-south-1.amazonaws.com", true},
|
|
{"sts.eu-west-3.amazonaws.com", true},
|
|
{"sts.eu-north-1.amazonaws.com", true},
|
|
{"sts.me-south-1.amazonaws.com", true},
|
|
{"sts.sa-east-1.amazonaws.com", true},
|
|
{"sts.us-gov-east-1.amazonaws.com", true},
|
|
{"sts.us-gov-west-1.amazonaws.com", true},
|
|
|
|
// prefix must be either 'sts.' or 'sts-fips.'
|
|
{".amazonaws.com", false},
|
|
{"iam.amazonaws.com", false},
|
|
{"other.amazonaws.com", false},
|
|
// suffix must be '.amazonaws.com' and not some other domain
|
|
{"stsamazonaws.com", false},
|
|
{"sts-fipsamazonaws.com", false},
|
|
{"sts.stsamazonaws.com", false},
|
|
{"sts.notamazonaws.com", false},
|
|
{"sts-fips.stsamazonaws.com", false},
|
|
{"sts-fips.notamazonaws.com", false},
|
|
{"sts.amazonaws.com.spoof", false},
|
|
{"sts.amazonaws.spoof.com", false},
|
|
{"xyz.sts.amazonaws.com", false},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.url, func(t *testing.T) {
|
|
url := "https://" + c.url
|
|
parsedUrl, err := parseUrl(url)
|
|
require.NoError(t, err)
|
|
|
|
token := &BearerToken{
|
|
config: &Config{},
|
|
getCallerIdentityURL: url,
|
|
parsedCallerIdentityURL: parsedUrl,
|
|
}
|
|
err = token.validateSTSHostname()
|
|
if c.ok {
|
|
require.NoError(t, err)
|
|
} else {
|
|
require.Error(t, err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidateIAMHostname(t *testing.T) {
|
|
cases := []struct {
|
|
url string
|
|
ok bool
|
|
}{
|
|
// https://docs.aws.amazon.com/general/latest/gr/iam-service.html
|
|
{"iam.amazonaws.com", true},
|
|
{"iam-fips.amazonaws.com", true},
|
|
{"iam.us-gov.amazonaws.com", true},
|
|
{"iam-fips.us-gov.amazonaws.com", true},
|
|
|
|
// prefix must be either 'iam.' or 'aim-fips.'
|
|
{".amazonaws.com", false},
|
|
{"sts.amazonaws.com", false},
|
|
{"other.amazonaws.com", false},
|
|
// suffix must be '.amazonaws.com' and not some other domain
|
|
{"iamamazonaws.com", false},
|
|
{"iam-fipsamazonaws.com", false},
|
|
{"iam.iamamazonaws.com", false},
|
|
{"iam.notamazonaws.com", false},
|
|
{"iam-fips.iamamazonaws.com", false},
|
|
{"iam-fips.notamazonaws.com", false},
|
|
{"iam.amazonaws.com.spoof", false},
|
|
{"iam.amazonaws.spoof.com", false},
|
|
{"xyz.iam.amazonaws.com", false},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.url, func(t *testing.T) {
|
|
url := "https://" + c.url
|
|
parsedUrl, err := parseUrl(url)
|
|
require.NoError(t, err)
|
|
|
|
token := &BearerToken{
|
|
config: &Config{},
|
|
getCallerIdentityURL: url,
|
|
parsedIAMEntityURL: parsedUrl,
|
|
}
|
|
err = token.validateIAMHostname()
|
|
if c.ok {
|
|
require.NoError(t, err)
|
|
} else {
|
|
require.Error(t, err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
var (
|
|
validBearerTokenJson = `{
|
|
"iam_http_request_method":"POST",
|
|
"iam_request_body":"QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ==",
|
|
"iam_request_headers":"eyJBdXRob3JpemF0aW9uIjpbIkFXUzQtSE1BQy1TSEEyNTYgQ3JlZGVudGlhbD1mYWtlLzIwMjIwMzIyL3VzLWVhc3QtMS9zdHMvYXdzNF9yZXF1ZXN0LCBTaWduZWRIZWFkZXJzPWNvbnRlbnQtbGVuZ3RoO2NvbnRlbnQtdHlwZTtob3N0O3gtYW16LWRhdGU7eC1hbXotc2VjdXJpdHktdG9rZW4sIFNpZ25hdHVyZT1lZmMzMjBiOTcyZDA3YjM4YjY1ZWIyNDI1NjgwNWUwMzE0OWRhNTg2ZDgwNGY4YzYzNjRjZTk4ZGViZTA4MGIxIl0sIkNvbnRlbnQtTGVuZ3RoIjpbIjQzIl0sIkNvbnRlbnQtVHlwZSI6WyJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7IGNoYXJzZXQ9dXRmLTgiXSwiVXNlci1BZ2VudCI6WyJhd3Mtc2RrLWdvLzEuNDIuMzQgKGdvMS4xNy41OyBkYXJ3aW47IGFtZDY0KSJdLCJYLUFtei1EYXRlIjpbIjIwMjIwMzIyVDIxMTEwM1oiXSwiWC1BbXotU2VjdXJpdHktVG9rZW4iOlsiZmFrZSJdfQ==",
|
|
"iam_request_url":"aHR0cHM6Ly9zdHMuYW1hem9uYXdzLmNvbS8="
|
|
}`
|
|
|
|
validBearerTokenParsed = BearerToken{
|
|
getCallerIdentityMethod: "POST",
|
|
getCallerIdentityURL: "https://sts.amazonaws.com/",
|
|
getCallerIdentityHeader: http.Header{
|
|
"Authorization": []string{"AWS4-HMAC-SHA256 Credential=fake/20220322/us-east-1/sts/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token, Signature=efc320b972d07b38b65eb24256805e03149da586d804f8c6364ce98debe080b1"},
|
|
"Content-Length": []string{"43"},
|
|
"Content-Type": []string{"application/x-www-form-urlencoded; charset=utf-8"},
|
|
"User-Agent": []string{"aws-sdk-go/1.42.34 (go1.17.5; darwin; amd64)"},
|
|
"X-Amz-Date": []string{"20220322T211103Z"},
|
|
"X-Amz-Security-Token": []string{"fake"},
|
|
},
|
|
getCallerIdentityBody: "Action=GetCallerIdentity&Version=2011-06-15",
|
|
parsedCallerIdentityURL: &url.URL{
|
|
Scheme: "https",
|
|
Host: "sts.amazonaws.com",
|
|
Path: "/",
|
|
},
|
|
}
|
|
|
|
validBearerTokenWithRoleJson = `{"iam_http_request_method":"POST","iam_request_body":"QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ==","iam_request_headers":"eyJBdXRob3JpemF0aW9uIjpbIkFXUzQtSE1BQy1TSEEyNTYgQ3JlZGVudGlhbD1mYWtlLWtleS1pZC8yMDIyMDMyMi9mYWtlLXJlZ2lvbi9zdHMvYXdzNF9yZXF1ZXN0LCBTaWduZWRIZWFkZXJzPWNvbnRlbnQtbGVuZ3RoO2NvbnRlbnQtdHlwZTtob3N0O3gtYW16LWRhdGU7eC1jb25zdWwtaWFtLWdldGVudGl0eS1ib2R5O3gtY29uc3VsLWlhbS1nZXRlbnRpdHktaGVhZGVyczt4LWNvbnN1bC1pYW0tZ2V0ZW50aXR5LW1ldGhvZDt4LWNvbnN1bC1pYW0tZ2V0ZW50aXR5LXVybCwgU2lnbmF0dXJlPTU2MWFjMzFiNWFkMDFjMTI0YzU0YzE2OGY3NmVhNmJmZDY0NWI4ZWM1MzQ1ZjgzNTc3MjljOWFhMGI0NzEzMzciXSwiQ29udGVudC1MZW5ndGgiOlsiNDMiXSwiQ29udGVudC1UeXBlIjpbImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZDsgY2hhcnNldD11dGYtOCJdLCJVc2VyLUFnZW50IjpbImF3cy1zZGstZ28vMS40Mi4zNCAoZ28xLjE3LjU7IGRhcndpbjsgYW1kNjQpIl0sIlgtQW16LURhdGUiOlsiMjAyMjAzMjJUMjI1NzQyWiJdLCJYLUNvbnN1bC1JYW0tR2V0ZW50aXR5LUJvZHkiOlsiQWN0aW9uPUdldFJvbGVcdTAwMjZSb2xlTmFtZT1teS1yb2xlXHUwMDI2VmVyc2lvbj0yMDEwLTA1LTA4Il0sIlgtQ29uc3VsLUlhbS1HZXRlbnRpdHktSGVhZGVycyI6WyJ7XCJBdXRob3JpemF0aW9uXCI6W1wiQVdTNC1ITUFDLVNIQTI1NiBDcmVkZW50aWFsPWZha2Uta2V5LWlkLzIwMjIwMzIyL3VzLWVhc3QtMS9pYW0vYXdzNF9yZXF1ZXN0LCBTaWduZWRIZWFkZXJzPWNvbnRlbnQtbGVuZ3RoO2NvbnRlbnQtdHlwZTtob3N0O3gtYW16LWRhdGUsIFNpZ25hdHVyZT1hYTJhMTlkMGEzMDVkNzRiYmQwMDk3NzZiY2E4ODBlNTNjZmE5OTFlNDgzZTQwMzk0NzE4MWE0MWNjNDgyOTQwXCJdLFwiQ29udGVudC1MZW5ndGhcIjpbXCI1MFwiXSxcIkNvbnRlbnQtVHlwZVwiOltcImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZDsgY2hhcnNldD11dGYtOFwiXSxcIlVzZXItQWdlbnRcIjpbXCJhd3Mtc2RrLWdvLzEuNDIuMzQgKGdvMS4xNy41OyBkYXJ3aW47IGFtZDY0KVwiXSxcIlgtQW16LURhdGVcIjpbXCIyMDIyMDMyMlQyMjU3NDJaXCJdfSJdLCJYLUNvbnN1bC1JYW0tR2V0ZW50aXR5LU1ldGhvZCI6WyJQT1NUIl0sIlgtQ29uc3VsLUlhbS1HZXRlbnRpdHktVXJsIjpbImh0dHBzOi8vaWFtLmFtYXpvbmF3cy5jb20vIl19","iam_request_url":"aHR0cDovLzEyNy4wLjAuMTo2MzY5Ni9zdHMv"}`
|
|
|
|
validBearerTokenWithRoleParsed = BearerToken{
|
|
getCallerIdentityMethod: "POST",
|
|
getCallerIdentityURL: "http://127.0.0.1:63696/sts/",
|
|
getCallerIdentityHeader: http.Header{
|
|
"Authorization": []string{"AWS4-HMAC-SHA256 Credential=fake-key-id/20220322/fake-region/sts/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-consul-iam-getentity-body;x-consul-iam-getentity-headers;x-consul-iam-getentity-method;x-consul-iam-getentity-url, Signature=561ac31b5ad01c124c54c168f76ea6bfd645b8ec5345f8357729c9aa0b471337"},
|
|
"Content-Length": []string{"43"},
|
|
"Content-Type": []string{"application/x-www-form-urlencoded; charset=utf-8"},
|
|
"User-Agent": []string{"aws-sdk-go/1.42.34 (go1.17.5; darwin; amd64)"},
|
|
"X-Amz-Date": []string{"20220322T225742Z"},
|
|
"X-Consul-Iam-Getentity-Body": []string{"Action=GetRole&RoleName=my-role&Version=2010-05-08"},
|
|
"X-Consul-Iam-Getentity-Headers": []string{`{"Authorization":["AWS4-HMAC-SHA256 Credential=fake-key-id/20220322/us-east-1/iam/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date, Signature=aa2a19d0a305d74bbd009776bca880e53cfa991e483e403947181a41cc482940"],"Content-Length":["50"],"Content-Type":["application/x-www-form-urlencoded; charset=utf-8"],"User-Agent":["aws-sdk-go/1.42.34 (go1.17.5; darwin; amd64)"],"X-Amz-Date":["20220322T225742Z"]}`},
|
|
"X-Consul-Iam-Getentity-Method": []string{"POST"},
|
|
"X-Consul-Iam-Getentity-Url": []string{"https://iam.amazonaws.com/"},
|
|
},
|
|
getCallerIdentityBody: "Action=GetCallerIdentity&Version=2011-06-15",
|
|
|
|
// Fields parsed from headers above
|
|
getIAMEntityMethod: "POST",
|
|
getIAMEntityURL: "https://iam.amazonaws.com/",
|
|
getIAMEntityHeader: http.Header{
|
|
"Authorization": []string{"AWS4-HMAC-SHA256 Credential=fake-key-id/20220322/us-east-1/iam/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date, Signature=aa2a19d0a305d74bbd009776bca880e53cfa991e483e403947181a41cc482940"},
|
|
"Content-Length": []string{"50"},
|
|
"Content-Type": []string{"application/x-www-form-urlencoded; charset=utf-8"},
|
|
"User-Agent": []string{"aws-sdk-go/1.42.34 (go1.17.5; darwin; amd64)"},
|
|
"X-Amz-Date": []string{"20220322T225742Z"},
|
|
},
|
|
getIAMEntityBody: "Action=GetRole&RoleName=my-role&Version=2010-05-08",
|
|
entityRequestType: "GetRole",
|
|
|
|
parsedCallerIdentityURL: &url.URL{
|
|
Scheme: "http",
|
|
Host: "127.0.0.1:63696",
|
|
Path: "/sts/",
|
|
},
|
|
parsedIAMEntityURL: &url.URL{
|
|
Scheme: "https",
|
|
Host: "iam.amazonaws.com",
|
|
Path: "/",
|
|
},
|
|
}
|
|
|
|
tokenJsonMissingMethodField = `{
|
|
"iam_request_body":"QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ==",
|
|
"iam_request_headers":"eyJBdXRob3JpemF0aW9uIjpbIkFXUzQtSE1BQy1TSEEyNTYgQ3JlZGVudGlhbD1mYWtlLzIwMjIwMzIyL3VzLWVhc3QtMS9zdHMvYXdzNF9yZXF1ZXN0LCBTaWduZWRIZWFkZXJzPWNvbnRlbnQtbGVuZ3RoO2NvbnRlbnQtdHlwZTtob3N0O3gtYW16LWRhdGU7eC1hbXotc2VjdXJpdHktdG9rZW4sIFNpZ25hdHVyZT1lZmMzMjBiOTcyZDA3YjM4YjY1ZWIyNDI1NjgwNWUwMzE0OWRhNTg2ZDgwNGY4YzYzNjRjZTk4ZGViZTA4MGIxIl0sIkNvbnRlbnQtTGVuZ3RoIjpbIjQzIl0sIkNvbnRlbnQtVHlwZSI6WyJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7IGNoYXJzZXQ9dXRmLTgiXSwiVXNlci1BZ2VudCI6WyJhd3Mtc2RrLWdvLzEuNDIuMzQgKGdvMS4xNy41OyBkYXJ3aW47IGFtZDY0KSJdLCJYLUFtei1EYXRlIjpbIjIwMjIwMzIyVDIxMTEwM1oiXSwiWC1BbXotU2VjdXJpdHktVG9rZW4iOlsiZmFrZSJdfQ==",
|
|
"iam_request_url":"aHR0cHM6Ly9zdHMuYW1hem9uYXdzLmNvbS8="
|
|
}`
|
|
|
|
tokenJsonMissingBodyField = `{
|
|
"iam_http_request_method":"POST",
|
|
"iam_request_headers":"eyJBdXRob3JpemF0aW9uIjpbIkFXUzQtSE1BQy1TSEEyNTYgQ3JlZGVudGlhbD1mYWtlLzIwMjIwMzIyL3VzLWVhc3QtMS9zdHMvYXdzNF9yZXF1ZXN0LCBTaWduZWRIZWFkZXJzPWNvbnRlbnQtbGVuZ3RoO2NvbnRlbnQtdHlwZTtob3N0O3gtYW16LWRhdGU7eC1hbXotc2VjdXJpdHktdG9rZW4sIFNpZ25hdHVyZT1lZmMzMjBiOTcyZDA3YjM4YjY1ZWIyNDI1NjgwNWUwMzE0OWRhNTg2ZDgwNGY4YzYzNjRjZTk4ZGViZTA4MGIxIl0sIkNvbnRlbnQtTGVuZ3RoIjpbIjQzIl0sIkNvbnRlbnQtVHlwZSI6WyJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7IGNoYXJzZXQ9dXRmLTgiXSwiVXNlci1BZ2VudCI6WyJhd3Mtc2RrLWdvLzEuNDIuMzQgKGdvMS4xNy41OyBkYXJ3aW47IGFtZDY0KSJdLCJYLUFtei1EYXRlIjpbIjIwMjIwMzIyVDIxMTEwM1oiXSwiWC1BbXotU2VjdXJpdHktVG9rZW4iOlsiZmFrZSJdfQ==",
|
|
"iam_request_url":"aHR0cHM6Ly9zdHMuYW1hem9uYXdzLmNvbS8="
|
|
}`
|
|
|
|
tokenJsonMissingHeadersField = `{
|
|
"iam_http_request_method":"POST",
|
|
"iam_request_body":"QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ==",
|
|
"iam_request_url":"aHR0cHM6Ly9zdHMuYW1hem9uYXdzLmNvbS8="
|
|
}`
|
|
|
|
tokenJsonMissingUrlField = `{
|
|
"iam_http_request_method":"POST",
|
|
"iam_request_body":"QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ==",
|
|
"iam_request_headers":"eyJBdXRob3JpemF0aW9uIjpbIkFXUzQtSE1BQy1TSEEyNTYgQ3JlZGVudGlhbD1mYWtlLzIwMjIwMzIyL3VzLWVhc3QtMS9zdHMvYXdzNF9yZXF1ZXN0LCBTaWduZWRIZWFkZXJzPWNvbnRlbnQtbGVuZ3RoO2NvbnRlbnQtdHlwZTtob3N0O3gtYW16LWRhdGU7eC1hbXotc2VjdXJpdHktdG9rZW4sIFNpZ25hdHVyZT1lZmMzMjBiOTcyZDA3YjM4YjY1ZWIyNDI1NjgwNWUwMzE0OWRhNTg2ZDgwNGY4YzYzNjRjZTk4ZGViZTA4MGIxIl0sIkNvbnRlbnQtTGVuZ3RoIjpbIjQzIl0sIkNvbnRlbnQtVHlwZSI6WyJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ7IGNoYXJzZXQ9dXRmLTgiXSwiVXNlci1BZ2VudCI6WyJhd3Mtc2RrLWdvLzEuNDIuMzQgKGdvMS4xNy41OyBkYXJ3aW47IGFtZDY0KSJdLCJYLUFtei1EYXRlIjpbIjIwMjIwMzIyVDIxMTEwM1oiXSwiWC1BbXotU2VjdXJpdHktVG9rZW4iOlsiZmFrZSJdfQ=="
|
|
}`
|
|
)
|