mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2025-12-23 06:15:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add pinniped_supported_identity_provider_types to the IDP discovery endpoint

Browse Source
This commit is contained in:
Joshua Casey
2024-04-29 16:51:44 -05:00
parent 6b3f175885
commit a86d7d27c1
12 changed files with 165 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go.tmpl
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/1.24/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/1.25/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/1.26/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/1.27/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/1.28/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/1.29/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/1.30/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

8
generated/latest/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go generated
View File

@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
// IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
type IDPDiscoveryResponse struct {
PinnipedIDPs []PinnipedIDP `json:"pinniped_identity_providers"`
PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
}
// PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
Type IDPType `json:"type"`
Flows []IDPFlow `json:"flows,omitempty"`
}
// PinnipedSupportedIDPType describes a single identity provider type.
type PinnipedSupportedIDPType struct {
Type IDPType `json:"type"`
}

16
internal/federationdomain/endpoints/idpdiscovery/idp_discovery_handler.go
View File

@@ -37,15 +37,23 @@ func NewHandler(upstreamIDPs federationdomainproviders.FederationDomainIdentityP
}
func responseAsJSON(upstreamIDPs federationdomainproviders.FederationDomainIdentityProvidersListerI) ([]byte, error) {
r := v1alpha1.IDPDiscoveryResponse{PinnipedIDPs: []v1alpha1.PinnipedIDP{}}
r := v1alpha1.IDPDiscoveryResponse{
PinnipedSupportedIDPTypes: []v1alpha1.PinnipedSupportedIDPType{
{Type: v1alpha1.IDPTypeActiveDirectory},
{Type: v1alpha1.IDPTypeLDAP},
{Type: v1alpha1.IDPTypeOIDC},
},
}
upstreams := upstreamIDPs.GetIdentityProviders()
r.PinnipedIDPs = make([]v1alpha1.PinnipedIDP, len(upstreams))
// The cache of IDPs could change at any time, so always recalculate the list.
for _, federationDomainIdentityProvider := range upstreamIDPs.GetIdentityProviders() {
r.PinnipedIDPs = append(r.PinnipedIDPs, v1alpha1.PinnipedIDP{
for i, federationDomainIdentityProvider := range upstreams {
r.PinnipedIDPs[i] = v1alpha1.PinnipedIDP{
Name: federationDomainIdentityProvider.GetDisplayName(),
Type: federationDomainIdentityProvider.GetIDPDiscoveryType(),
Flows: federationDomainIdentityProvider.GetIDPDiscoveryFlows(),
})
}
}
// Nobody like an API that changes the results unnecessarily. :)

76
internal/federationdomain/endpoints/idpdiscovery/idp_discovery_handler_test.go
View File

@@ -22,6 +22,7 @@ func TestIDPDiscovery(t *testing.T) {
method string
path string
idpLister *testidplister.TestFederationDomainIdentityProvidersListerFinder
wantStatus int
wantContentType string
@@ -33,6 +34,16 @@ func TestIDPDiscovery(t *testing.T) {
name: "happy path",
method: http.MethodGet,
path: "/some/path" + oidc.WellKnownEndpointPath,
idpLister: testidplister.NewUpstreamIDPListerBuilder().
WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("z-some-oidc-idp").WithAllowPasswordGrant(true).Build()).
WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("x-some-oidc-idp").Build()).
WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("a-some-ldap-idp").Build()).
WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("a-some-oidc-idp").Build()).
WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ldap-idp").Build()).
WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("x-some-ldap-idp").Build()).
WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ad-idp").Build()).
WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("y-some-ad-idp").Build()).
BuildFederationDomainIdentityProvidersListerFinder(),
wantStatus: http.StatusOK,
wantContentType: "application/json",
wantFirstResponseBodyJSON: here.Doc(`{
@@ -45,6 +56,11 @@ func TestIDPDiscovery(t *testing.T) {
{"name": "z-some-ad-idp", "type": "activedirectory", "flows": ["cli_password", "browser_authcode"]},
{"name": "z-some-ldap-idp", "type": "ldap", "flows": ["cli_password", "browser_authcode"]},
{"name": "z-some-oidc-idp", "type": "oidc", "flows": ["browser_authcode", "cli_password"]}
],
"pinniped_supported_identity_provider_types": [
{"type": "activedirectory"},
{"type": "ldap"},
{"type": "oidc"}
]
}`),
wantSecondResponseBodyJSON: here.Doc(`{
@@ -55,6 +71,43 @@ func TestIDPDiscovery(t *testing.T) {
{"name": "some-other-ldap-idp-2", "type": "ldap", "flows": ["cli_password", "browser_authcode"]},
{"name": "some-other-oidc-idp-1", "type": "oidc", "flows": ["browser_authcode", "cli_password"]},
{"name": "some-other-oidc-idp-2", "type": "oidc", "flows": ["browser_authcode"]}
],
"pinniped_supported_identity_provider_types": [
{"type": "activedirectory"},
{"type": "ldap"},
{"type": "oidc"}
]
}`),
},
{
name: "no starting IDPs still returns supported IDP types",
method: http.MethodGet,
path: "/some/path" + oidc.WellKnownEndpointPath,
idpLister: testidplister.NewUpstreamIDPListerBuilder().
BuildFederationDomainIdentityProvidersListerFinder(),
wantStatus: http.StatusOK,
wantContentType: "application/json",
wantFirstResponseBodyJSON: here.Doc(`{
"pinniped_identity_providers": [],
"pinniped_supported_identity_provider_types": [
{"type": "activedirectory"},
{"type": "ldap"},
{"type": "oidc"}
]
}`),
wantSecondResponseBodyJSON: here.Doc(`{
"pinniped_identity_providers": [
{"name": "some-other-ad-idp-1", "type": "activedirectory", "flows": ["cli_password", "browser_authcode"]},
{"name": "some-other-ad-idp-2", "type": "activedirectory", "flows": ["cli_password", "browser_authcode"]},
{"name": "some-other-ldap-idp-1", "type": "ldap", "flows": ["cli_password", "browser_authcode"]},
{"name": "some-other-ldap-idp-2", "type": "ldap", "flows": ["cli_password", "browser_authcode"]},
{"name": "some-other-oidc-idp-1", "type": "oidc", "flows": ["browser_authcode", "cli_password"]},
{"name": "some-other-oidc-idp-2", "type": "oidc", "flows": ["browser_authcode"]}
],
"pinniped_supported_identity_provider_types": [
{"type": "activedirectory"},
{"type": "ldap"},
{"type": "oidc"}
]
}`),
},
@@ -62,6 +115,9 @@ func TestIDPDiscovery(t *testing.T) {
name: "bad method",
method: http.MethodPost,
path: oidc.WellKnownEndpointPath,
idpLister: testidplister.NewUpstreamIDPListerBuilder().
WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("some-oidc-idp").Build()).
BuildFederationDomainIdentityProvidersListerFinder(),
wantStatus: http.StatusMethodNotAllowed,
wantContentType: "text/plain; charset=utf-8",
wantBodyString: "Method not allowed (try GET)\n",
@@ -69,18 +125,8 @@ func TestIDPDiscovery(t *testing.T) {
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
idpLister := testidplister.NewUpstreamIDPListerBuilder().
WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("z-some-oidc-idp").WithAllowPasswordGrant(true).Build()).
WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("x-some-oidc-idp").Build()).
WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("a-some-ldap-idp").Build()).
WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("a-some-oidc-idp").Build()).
WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ldap-idp").Build()).
WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("x-some-ldap-idp").Build()).
WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ad-idp").Build()).
WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("y-some-ad-idp").Build()).
BuildFederationDomainIdentityProvidersListerFinder()
handler := NewHandler(idpLister)
require.NotNil(t, test.idpLister)
handler := NewHandler(test.idpLister)
req := httptest.NewRequest(test.method, test.path, nil)
rsp := httptest.NewRecorder()
handler.ServeHTTP(rsp, req)
@@ -98,15 +144,15 @@ func TestIDPDiscovery(t *testing.T) {
}
// Change the list of IDPs in the cache.
idpLister.SetLDAPIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
test.idpLister.SetLDAPIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ldap-idp-1").Build(),
oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ldap-idp-2").Build(),
})
idpLister.SetOIDCIdentityProviders([]*oidctestutil.TestUpstreamOIDCIdentityProvider{
test.idpLister.SetOIDCIdentityProviders([]*oidctestutil.TestUpstreamOIDCIdentityProvider{
oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("some-other-oidc-idp-1").WithAllowPasswordGrant(true).Build(),
oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("some-other-oidc-idp-2").Build(),
})
idpLister.SetActiveDirectoryIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
test.idpLister.SetActiveDirectoryIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ad-idp-2").Build(),
oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ad-idp-1").Build(),
})

14
internal/federationdomain/endpointsmanager/manager_test.go
View File

@@ -118,8 +118,18 @@ func TestManager(t *testing.T) {
r.Equal(http.StatusOK, recorder.Code, "unexpected response:", recorder)
responseBody, err := io.ReadAll(recorder.Body)
r.NoError(err)
r.Equal(
fmt.Sprintf(`{"pinniped_identity_providers":[%s]}`+"\n", strings.Join(expectedIDPJSONList, ",")),
expectedResponse := here.Docf(`{
"pinniped_identity_providers": [%s],
"pinniped_supported_identity_provider_types": [
{"type":"activedirectory"},
{"type":"ldap"},
{"type":"oidc"}
]
}`, strings.Join(expectedIDPJSONList, ","))
r.JSONEq(
expectedResponse,
string(responseBody),
)
}