mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-20 23:14:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Move ad specific stuff to controller

Browse Source 
also make extra refresh attributes a separate field rather than part of
Extra

Signed-off-by: Margo Crawford <margaretc@vmware.com>
This commit is contained in:
Margo Crawford
2021-12-09 16:16:36 -08:00
parent acaad05341
commit 59d999956c
14 changed files with 547 additions and 656 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/oidc/auth/auth_handler.go
+2 -2
View File
@@ -123,13 +123,13 @@ func handleAuthRequestForLDAPUpstream(
if idpType == psession.ProviderTypeLDAP {
customSessionData.LDAP = &psession.LDAPSessionData{
UserDN: dn,
ExtraRefreshAttributes: authenticateResponse.User.GetExtra(),
ExtraRefreshAttributes: authenticateResponse.ExtraRefreshAttributes,
}
}
if idpType == psession.ProviderTypeActiveDirectory {
customSessionData.ActiveDirectory = &psession.ActiveDirectorySessionData{
UserDN: dn,
ExtraRefreshAttributes: authenticateResponse.User.GetExtra(),
ExtraRefreshAttributes: authenticateResponse.ExtraRefreshAttributes,
}
}
internal/oidc/auth/auth_handler_test.go
+7 -3
View File
@@ -269,6 +269,8 @@ func TestAuthorizationEndpoint(t *testing.T) {
happyLDAPUID := "some-ldap-uid"
happyLDAPUserDN := "cn=foo,dn=bar"
happyLDAPGroups := []string{"group1", "group2", "group3"}
happyLDAPExtraRefreshAttribute := "some-refresh-attribute"
happyLDAPExtraRefreshValue := "some-refresh-attribute-value"
parsedUpstreamLDAPURL, err := url.Parse(upstreamLDAPURL)
require.NoError(t, err)
@@ -283,9 +285,11 @@ func TestAuthorizationEndpoint(t *testing.T) {
Name: happyLDAPUsernameFromAuthenticator,
UID: happyLDAPUID,
Groups: happyLDAPGroups,
Extra: map[string][]string{"some-refresh-attribute": {"some-refresh-attribute-value"}},
},
DN: happyLDAPUserDN,
ExtraRefreshAttributes: map[string]string{
happyLDAPExtraRefreshAttribute: happyLDAPExtraRefreshValue,
},
}, true, nil
}
return nil, false, nil
@@ -444,7 +448,7 @@ func TestAuthorizationEndpoint(t *testing.T) {
LDAP: nil,
ActiveDirectory: &psession.ActiveDirectorySessionData{
UserDN: happyLDAPUserDN,
ExtraRefreshAttributes: map[string][]string{"some-refresh-attribute": {"some-refresh-attribute-value"}},
ExtraRefreshAttributes: map[string]string{happyLDAPExtraRefreshAttribute: happyLDAPExtraRefreshValue},
},
}
@@ -455,7 +459,7 @@ func TestAuthorizationEndpoint(t *testing.T) {
OIDC: nil,
LDAP: &psession.LDAPSessionData{
UserDN: happyLDAPUserDN,
ExtraRefreshAttributes: map[string][]string{"some-refresh-attribute": {"some-refresh-attribute-value"}},
ExtraRefreshAttributes: map[string]string{happyLDAPExtraRefreshAttribute: happyLDAPExtraRefreshValue},
},
ActiveDirectory: nil,
}
internal/oidc/provider/dynamic_upstream_idp_provider.go
+1 -1
View File
@@ -102,7 +102,7 @@ type StoredRefreshAttributes struct {
Subject string
DN string
AuthTime time.Time
AdditionalAttributes map[string][]string
AdditionalAttributes map[string]string
}
type DynamicUpstreamIDPProvider interface {
internal/oidc/token/token_handler.go
+1 -2
View File
@@ -180,7 +180,7 @@ func upstreamLDAPRefresh(ctx context.Context, providerCache oidc.UpstreamIdentit
return errorsx.WithStack(errMissingUpstreamSessionInternalError)
}
var additionalAttributes map[string][]string
var additionalAttributes map[string]string
if s.ProviderType == psession.ProviderTypeLDAP {
additionalAttributes = s.LDAP.ExtraRefreshAttributes
} else {
@@ -200,7 +200,6 @@ func upstreamLDAPRefresh(ctx context.Context, providerCache oidc.UpstreamIdentit
Username: username,
Subject: subject,
DN: dn,
AuthTime: session.IDTokenClaims().AuthTime,
AdditionalAttributes: additionalAttributes,
})
if err != nil {