mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-01-04 12:14:24 +00:00
0d31e955ae
Background: For dynamic clients, the groups scope is not always allowed and/or requested by the client, so it will not always be granted by the Supervisor for an authorization request. Previously, when the groups scope was not granted, we would skip searching for upstream groups in some scenarios. This commit changes the behavior of authorization flows so that even when the groups scope is not granted we still search for the upstream group memberships as configured, and we pass the upstream group memberships into any configured identity transformations. The identity transformations could potentially reject the user's authentication based on their upstream group membership. When the groups scope is not granted, we don't include the groups in the final Supervisor-issued ID token. This behavior is not changed.
76 lines
2.0 KiB
Go
76 lines
2.0 KiB
Go
// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package transformtestutil
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"go.pinniped.dev/internal/celtransformer"
|
|
"go.pinniped.dev/internal/idtransform"
|
|
)
|
|
|
|
func NewPrefixingPipeline(t *testing.T, usernamePrefix, groupsPrefix string) *idtransform.TransformationPipeline {
|
|
t.Helper()
|
|
|
|
transformer, err := celtransformer.NewCELTransformer(5 * time.Second)
|
|
require.NoError(t, err)
|
|
|
|
p := idtransform.NewTransformationPipeline()
|
|
|
|
userTransform, err := transformer.CompileTransformation(
|
|
&celtransformer.UsernameTransformation{Expression: fmt.Sprintf(`"%s" + username`, usernamePrefix)},
|
|
nil,
|
|
)
|
|
require.NoError(t, err)
|
|
p.AppendTransformation(userTransform)
|
|
|
|
groupsTransform, err := transformer.CompileTransformation(
|
|
&celtransformer.GroupsTransformation{Expression: fmt.Sprintf(`groups.map(g, "%s" + g)`, groupsPrefix)},
|
|
nil,
|
|
)
|
|
require.NoError(t, err)
|
|
p.AppendTransformation(groupsTransform)
|
|
|
|
return p
|
|
}
|
|
|
|
func NewRejectAllAuthPipeline(t *testing.T) *idtransform.TransformationPipeline {
|
|
t.Helper()
|
|
|
|
transformer, err := celtransformer.NewCELTransformer(5 * time.Second)
|
|
require.NoError(t, err)
|
|
|
|
p := idtransform.NewTransformationPipeline()
|
|
|
|
compiledTransform, err := transformer.CompileTransformation(
|
|
&celtransformer.AllowAuthenticationPolicy{Expression: `false`},
|
|
nil,
|
|
)
|
|
require.NoError(t, err)
|
|
p.AppendTransformation(compiledTransform)
|
|
|
|
return p
|
|
}
|
|
|
|
func NewPipeline(t *testing.T, transforms []celtransformer.CELTransformation) *idtransform.TransformationPipeline {
|
|
t.Helper()
|
|
|
|
transformer, err := celtransformer.NewCELTransformer(5 * time.Second)
|
|
require.NoError(t, err)
|
|
|
|
p := idtransform.NewTransformationPipeline()
|
|
|
|
for _, transform := range transforms {
|
|
compiledTransform, err := transformer.CompileTransformation(transform, nil)
|
|
require.NoError(t, err)
|
|
p.AppendTransformation(compiledTransform)
|
|
}
|
|
|
|
return p
|
|
}
|